halfcycle 0.4.18 → 0.5.0

package/dist/install-manifest.d.ts

@@ -60,6 +60,32 @@ export interface SettingsRecord {
     readonly denyCreated: boolean;
     readonly statusLineSha256?: string;
 }
+/**
+ * What the installer did to `.codex/hooks.json` (`codex-install-target` AC5): the
+ * settings record's hook half, with the same meaning field by field. OPTIONAL in the
+ * manifest, like `mcp`: a manifest an earlier version wrote has no such key, and it
+ * must still parse. `hookCommands` is written and, as for settings, never read to
+ * decide a removal: uninstall takes out every Codex command of ours by membership.
+ */
+export interface CodexHooksRecord {
+    readonly created: boolean;
+    readonly adopted: boolean;
+    readonly hookCommands: readonly string[];
+    readonly eventsCreated: readonly string[];
+    readonly hooksCreated: boolean;
+}
+/**
+ * What the installer did to `.codex/config.toml` (`codex-install-target` AC5).
+ * `block` is the exact text the install put there, including the line ending and blank
+ * separator line it wrote before the opening marker when it appended one, as
+ * `.gitignore`'s record keeps its appended text. `created` is whether a run created
+ * the file. OPTIONAL in the manifest, like `codexHooks`: a manifest an earlier version
+ * wrote has no such key, and it must still parse.
+ */
+export interface CodexConfigRecord {
+    readonly created: boolean;
+    readonly block: string;
+}
 /** What the installer did to `.mcp.json`. `entrySha256` is the canonical hash of the
  *  `halfcycle` server entry as last written; absent when no run has written one. */
 export interface McpRecord {
@@ -93,6 +119,8 @@ export interface InstallManifest {
     readonly leftAlone: readonly string[];
     readonly settings: SettingsRecord;
     readonly mcp?: McpRecord;
+    readonly codexHooks?: CodexHooksRecord;
+    readonly codexConfig?: CodexConfigRecord;
     readonly gitignore: GitignoreRecord;
     readonly gitattributes?: GitattributesRecord;
 }
@@ -180,6 +208,8 @@ export interface ManifestDraft {
     readonly createdDirs: Set<string>;
     settings: SettingsRecord | undefined;
     mcp: McpRecord | undefined;
+    codexHooks: CodexHooksRecord | undefined;
+    codexConfig: CodexConfigRecord | undefined;
     gitignore: GitignoreRecord | undefined;
     gitattributes: GitattributesRecord | undefined;
 }
@@ -221,6 +251,17 @@ export declare function recordDenyRetired(draft: ManifestDraft, hashes: readonly
  * does not.
  */
 export declare function recordMcp(draft: ManifestDraft, observed: McpRecord): void;
+/**
+ * What this run observed about `.codex/hooks.json`, by the settings record's
+ * carry-forward rule (`recordSettings`): the two lists are unions, and `created`,
+ * `adopted` and `hooksCreated` keep the first value recorded.
+ */
+export declare function recordCodexHooks(draft: ManifestDraft, observed: CodexHooksRecord): void;
+/**
+ * What this run did to `.codex/config.toml`: `created` keeps its first value, and
+ * `block` is this run's (the caller composes it, separator included).
+ */
+export declare function recordCodexConfig(draft: ManifestDraft, observed: CodexConfigRecord): void;
 /**
  * What this run did to `.gitignore`: `created` keeps its first value, and each of
  * `appended` is added after the elements already recorded (an adopted block from an

package/dist/install-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-manifest.d.ts","sourceRoot":"","sources":["../src/install-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,+CAA+C;AAC/C,eAAO,MAAM,oBAAoB,qCAAqC,CAAC;AAEvE,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,kCAAkC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;CAAE,CAAC;AAEzD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;oFACoF;AACpF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,8CAA8C;AAC9C,MAAM,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAEjD;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAErD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,uBAAuB,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,CAAC;CAC9C;AAMD,oFAAoF;AACpF,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAG7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CASrD;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD;AAOD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CAenE;AAMD,6EAA6E;AAC7E,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,MAAM,EAAE,MAAM;CAI3B;AAyCD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CA6G3D;AAMD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAC;IACrC,GAAG,EAAE,SAAS,GAAG,SAAS,CAAC;IAC3B,SAAS,EAAE,eAAe,GAAG,SAAS,CAAC;IACvC,aAAa,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAChD;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,eAAe,GAAG,IAAI,EAChC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,EACnC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GACrC,aAAa,CAef;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAE/F;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAE1E;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAE7E;AAED,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAExE;AAED,yCAAyC;AACzC,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAEzE;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAuBnF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAKvF;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,GAAG,IAAI,CAazE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAEzG;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAG7G;AAeD,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAsBpE"}
+{"version":3,"file":"install-manifest.d.ts","sourceRoot":"","sources":["../src/install-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,+CAA+C;AAC/C,eAAO,MAAM,oBAAoB,qCAAqC,CAAC;AAEvE,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,kCAAkC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;CAAE,CAAC;AAEzD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;oFACoF;AACpF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,8CAA8C;AAC9C,MAAM,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAEjD;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAErD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,uBAAuB,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,CAAC;CAC9C;AAMD,oFAAoF;AACpF,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAG7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CASrD;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD;AAOD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CAwBnE;AAMD,6EAA6E;AAC7E,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,MAAM,EAAE,MAAM;CAI3B;AAyCD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAsI3D;AAMD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAC;IACrC,GAAG,EAAE,SAAS,GAAG,SAAS,CAAC;IAC3B,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACzC,WAAW,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC3C,SAAS,EAAE,eAAe,GAAG,SAAS,CAAC;IACvC,aAAa,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAChD;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,eAAe,GAAG,IAAI,EAChC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,EACnC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GACrC,aAAa,CAiBf;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAE/F;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAE1E;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAE7E;AAED,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAExE;AAED,yCAAyC;AACzC,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAEzE;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAuBnF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAKvF;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,GAAG,IAAI,CAazE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAYvF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAEzG;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAG7G;AAeD,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAwBpE"}

package/dist/install-plan.d.ts

@@ -45,8 +45,12 @@ export type PendingBytes = typeof PENDING;
  * Every kind of file the installer writes, each with its own preview words. Every member
  * of `closedWriteSet()` maps to one (`previewKindOf`), and a test asserts none is
  * missing, so a new installer file cannot ship without words for the preview.
+ *
+ * `codex-checks`, `codex-server`, `skill` and `crew-profile` land ahead of the Codex and
+ * crew-profile writers themselves (`codex-install-target`, `crew-agent-profiles`), so a
+ * later task plans a Codex or crew path with words already waiting for it.
  */
-export declare const PREVIEW_KINDS: readonly ["command", "check-script", "settings", "server-entry", "ignore-list", "line-endings", "halfcycle-folder", "runner", "captured-index", "old-sign-in"];
+export declare const PREVIEW_KINDS: readonly ["command", "check-script", "settings", "server-entry", "ignore-list", "line-endings", "halfcycle-folder", "runner", "captured-index", "old-sign-in", "codex-checks", "codex-server", "skill", "crew-profile"];
 export type PreviewKind = (typeof PREVIEW_KINDS)[number];
 /** One path in the plan. `bytes` is `null` for `leave` and `remove`. */
 export interface InstallPlanEntry {

package/dist/install-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-plan.d.ts","sourceRoot":"","sources":["../src/install-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAYH,OAAO,EA4CL,KAAK,cAAc,EACnB,KAAK,cAAc,EAEnB,KAAK,aAAa,EAKnB,MAAM,cAAc,CAAC;AAQtB,wCAAwC;AACxC,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,OAAO,EAAE,OAAO,MAA0B,CAAC;AACxD,MAAM,MAAM,YAAY,GAAG,OAAO,OAAO,CAAC;AAE1C;;;;GAIG;AACH,eAAO,MAAM,aAAa,gKAWhB,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,YAAY,CAAC;IAC7C,uGAAuG;IACvG,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAA;CAAE,GACnH;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAErC,yFAAyF;AACzF,MAAM,WAAW,WAAW;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,yFAAyF;IACzF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAKD;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CA6DpE,CAAC;AAoCH,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAGlE;AAYD;;;GAGG;AACH,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,cAAc,EAAE,cAAc,GAAG,gBAAgB,CAAC;IACjG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAKD,iGAAiG;AACjG,wBAAgB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAwGpE;AAwJD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,aAAa,CAqEjE"}
+{"version":3,"file":"install-plan.d.ts","sourceRoot":"","sources":["../src/install-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAYH,OAAO,EAoDL,KAAK,cAAc,EACnB,KAAK,cAAc,EAEnB,KAAK,aAAa,EAKnB,MAAM,cAAc,CAAC;AAQtB,wCAAwC;AACxC,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,OAAO,EAAE,OAAO,MAA0B,CAAC;AACxD,MAAM,MAAM,YAAY,GAAG,OAAO,OAAO,CAAC;AAE1C;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,yNAehB,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,YAAY,CAAC;IAC7C,uGAAuG;IACvG,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAA;CAAE,GACnH;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAErC,yFAAyF;AACzF,MAAM,WAAW,WAAW;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,yFAAyF;IACzF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAKD;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAqFpE,CAAC;AAyCH,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAMlE;AAYD;;;GAGG;AACH,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,cAAc,EAAE,cAAc,GAAG,gBAAgB,CAAC;IACjG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAKD,iGAAiG;AACjG,wBAAgB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAsHpE;AAoMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,aAAa,CA0EjE"}

package/dist/install.d.ts

@@ -4,8 +4,9 @@
  * Writes the client install surface (slash-command stubs, the vendored guard
  * binary, governance-hook wiring and the committed project identity) into a target
  * engagement repo — and the engagement's credential OUTSIDE it, at machine level
- * (T-09; see `engagement-credential.ts`). NO worker role files land
- * either — see the step-1 note in `install()` (FX-2, W3-F-27). NO method prose lands: the
+ * (T-09; see `engagement-credential.ts`). NO worker role files are copied
+ * either — see the step-1 note in `install()` (FX-2, W3-F-27); the crew profiles are
+ * generated from the roster (step 8c). NO method prose lands: the
  * stubs carry a description and a call, and the procedure arrives from the delivery
  * service at run time (INV-016). Reads the bundle version from
  * .claude-plugin/plugin.json and pins it in the target's .halfcycle/bundle.json.
@@ -21,10 +22,11 @@
  * (E1-T-09). The name is deliberately innocuous — it discloses nothing about
  * Halfcycle's scaffold contents.
  */
-import { BUNDLE_PIN_REL, MCP_REGISTRATION_REL, MCP_SERVER_KEY, SETTINGS_REL, WRITE_CAPABLE_TOOLS } from '@halfcycle/core';
+import { BUNDLE_PIN_REL, MCP_REGISTRATION_REL, MCP_SERVER_KEY, SETTINGS_REL, WRITE_CAPABLE_TOOLS, type AgentId } from '@halfcycle/core';
+import { type CrewGroup, type CrewMember, type CrewRole, type CrewTier } from '@halfcycle/events';
 import { type PlannedProjectIdentity } from './identity.js';
 import { lineKey, type InstallManifest, type ManifestFile } from './install-manifest.js';
-import { type ClaudeSettings, type StatusLineSetting } from './merge-settings.js';
+import { type ClaudeSettings, type CodexHooksFile, type StatusLineSetting } from './merge-settings.js';
 export type EngagementType = 'self-build' | 'client';
 export interface BundlePin {
     version: string;
@@ -318,6 +320,35 @@ export interface InstallResult {
      * The install still succeeded; the caller says so in one line and changes nothing.
      */
     notShared: NotShared | null;
+    /**
+     * What setting up did for Codex (`codex-install-target`, *The approval line*). The
+     * CLI decides from it whether to print the one approval step Codex needs or a
+     * problem line instead.
+     */
+    codex: CodexInstallResult;
+}
+/**
+ * What became of Codex's checks file this run. `written`: created or changed;
+ * `current`: already held every check as this version writes it; `unreadable`: not a
+ * JSON object of hook lists, so it was left byte for byte; `link`: the file or a
+ * folder above it is a symbolic link, which is never followed.
+ */
+export type CodexHooksOutcome = 'written' | 'current' | 'unreadable' | 'link';
+/**
+ * What became of Codex's settings file this run (`codex-install-target`, *The approval
+ * line*). `written`: the block was added or replaced; `current`: the block already
+ * held exactly what this version writes; `conflict`: the file already names a server
+ * of that name, holds its servers in a form a new table cannot join, has a broken
+ * block, or could not be read, so it was left byte for byte; `refused-address`: the
+ * address failed the allowlist, so no block was written and any existing one was
+ * kept; `link`: the file or a folder above it is a symbolic link; `no-credential`:
+ * no server entry is written on this run at all.
+ */
+export type CodexConfigOutcome = 'written' | 'current' | 'conflict' | 'refused-address' | 'link' | 'no-credential';
+/** The Codex half of an install's result: one field per Codex file written. */
+export interface CodexInstallResult {
+    readonly hooks: CodexHooksOutcome;
+    readonly config: CodexConfigOutcome;
 }
 /** The travel finding: one ignored file to name, its rule, and how many others. */
 export interface NotShared {
@@ -336,6 +367,62 @@ export interface NotShared {
 export declare function renderNotShared(finding: NotShared): string;
 /** The benign-named Zone-B root directory reserved in the install layout. */
 export declare const ZONE_B_DIR = ".workbench";
+/**
+ * Codex's checks file (`codex-install-target` AC2). Its one home is the Codex profile
+ * in `@halfcycle/core` (`AGENT_PROFILES.codex.settingsFiles`, where Codex has exactly
+ * one hook file); read from there rather than typed a second time. Declared up here
+ * because `WRITE_ALLOWLIST` below is built at module load.
+ */
+export declare const CODEX_HOOKS_REL: string;
+/**
+ * Codex's project settings file, where its MCP servers are registered
+ * (`codex-install-target` AC3). Its one home is the Codex profile's MCP registration
+ * (`AGENT_PROFILES.codex.mcpRegistration`), read from there for the same reason as
+ * `CODEX_HOOKS_REL`, and declared up here for the same reason too.
+ */
+export declare const CODEX_CONFIG_REL: string;
+/** Claude Code's folder of agent profiles. */
+export declare const CLAUDE_AGENTS_DIR = ".claude/agents";
+/** Codex's folder of agent roles. */
+export declare const CODEX_AGENTS_DIR = ".codex/agents";
+/**
+ * A crew member's profile path for one agent, from a checked callsign. Exported ONLY so
+ * the check can be tested directly, as `skillRel` is.
+ *
+ * THE CASE (AC2, T-31's first step, measured 2026-10-31 on Claude Code 2.1.314): a
+ * profile whose file and `name` are an upper-case callsign loads under that name, case
+ * kept (the session's agent list showed it upper case beside a lower-case probe), and
+ * an agent call naming it in upper case started it. So Claude Code's file and name keep
+ * the callsign as written. Codex's are lower case (AC4): Codex refuses an upper-case
+ * task name (M2).
+ */
+export declare function crewProfileRel(agent: AgentId, callsign: string): string;
+/**
+ * THE SECOND OPERAND (AC2, INV-023): the profile's absolute path, after asserting that
+ * its parent is the agent's folder resolved ON ITS OWN. The joined result and the folder
+ * are two different computations, so a name that escaped the folder could not pass both
+ * this and the pattern. Exported ONLY so this check can be tested apart from the pattern.
+ */
+export declare function crewProfileTarget(targetRepo: string, rel: string): string;
+/**
+ * THE BODY (`crew-agent-profiles`, *The body*): built from the role and the tier ALONE,
+ * so two members sharing both share a body byte for byte, and nothing about the project
+ * or the method can reach it (INV-016). The callsign appears only in a profile's name
+ * and description.
+ */
+export declare function crewProfileBody(role: CrewRole, group: CrewGroup, tier: CrewTier): string;
+/** One generated profile: where it goes and its bytes. */
+export interface CrewProfileFile {
+    readonly rel: string;
+    readonly text: string;
+}
+/**
+ * EVERY CREW PROFILE THIS VERSION WRITES, in roster order: Claude Code's for every
+ * member, then Codex's for every member outside the `reviewer` group (AC4: a Codex role
+ * cannot be made read-only, so no reviewer gets one). Pure; the one source of the paths
+ * the allowlist, the closed write set and the plan all read.
+ */
+export declare function renderCrewProfiles(roster?: readonly CrewMember[]): CrewProfileFile[];
 /**
  * This package's own root, wherever it has been unpacked to.
  *
@@ -388,6 +475,15 @@ export { SETTINGS_REL, WRITE_CAPABLE_TOOLS };
 export declare const GITIGNORE_REL = ".gitignore";
 /** The attributes file the installer appends its line-ending rules to. */
 export declare const GITATTRIBUTES_REL = ".gitattributes";
+/**
+ * A Codex skill's path in the client tree — Codex's twin of `commandStubRel`
+ * (`codex-install-target` AC4, T-14). INV-023: the name is checked BEFORE it
+ * reaches a path, because an unchecked `plugin.json` entry (a dot, a slash) could
+ * otherwise climb out of `.agents/skills/`. Exported ONLY so the check can be
+ * tested directly, as `writeOwned` is; every real caller inside this module goes
+ * through it via `planCodexSkills` and `closedWriteSet`.
+ */
+export declare function skillRel(name: string): string;
 /**
  * The connection-headers helper an earlier version generated and `.mcp.json` named
  * (T-24, #446). RETIRED by `windows-client-seat`: Claude Code runs a `headersHelper`
@@ -408,6 +504,8 @@ export interface ClosedWriteSet {
     readonly ownedDirs: ReadonlySet<string>;
     /** Every hook command that is ours: `HALFCYCLE_HOOK_COMMANDS`, generated and retired. */
     readonly hookCommands: ReadonlySet<string>;
+    /** Every Codex hook command that is ours: the Codex profile's `commands`, generated and retired. */
+    readonly codexHookCommands: ReadonlySet<string>;
     /** The SHA-256 of every deny rule the installer adds. */
     readonly denyRuleSha256: ReadonlySet<string>;
     /** The `$schema` value the installer writes into `.claude/settings.json`. */
@@ -473,8 +571,9 @@ export declare const RETIRED_DENY_PATTERNS: readonly string[];
  * DERIVED, NOT LISTED. The command stubs come from `plugin.json`'s `commands[]`, the
  * same array `copyManifestCommands` copies from; the hook scripts from
  * `OWNED_GENERATED_HEADERS`, the table the owned-generated writes key on; the retired
- * headers helper from `RETIRED_WRITE_SET_FILES`; the rest from the named constants
- * their writers use. The directories are the
+ * headers helper from `RETIRED_WRITE_SET_FILES`; Codex's checks file and its commands
+ * from the Codex profile (`AGENT_PROFILES.codex`), the table `generateCodexHooksJson`
+ * writes from; the rest from the named constants their writers use. The directories are the
  * ancestors of every member, so a new file under a new directory brings its
  * directory with it. The writer and the remover therefore cannot hold two lists.
  */
@@ -535,6 +634,18 @@ type BytesAfter = (rel: string) => Uint8Array;
  * path in sorted order. Reads only: nothing here writes to the tree or to git.
  */
 declare function findNotShared(targetRepo: string, manifest: InstallManifest, collidedPaths: readonly string[]): NotShared | null;
+/**
+ * The named body changes AC4 makes, from a command's own source body: the
+ * slash form of its own name becomes the bare name, the Claude Code trust
+ * sentence becomes its Codex twin, and — where the source carries it — the
+ * `/mcp`-reconnect fallback becomes "start a new Codex session" (M5). Throws
+ * when a source carries neither the slash form nor the trust sentence — the
+ * build fails rather than shipping a skill with Claude Code's own wording —
+ * and throws if `/mcp` survives the transform regardless of why. Exported
+ * ONLY so the refusal can be tested directly, on synthetic text, the way
+ * `writeOwned`'s path-scope guard is.
+ */
+export declare function codexSkillBody(name: string, sourceBody: string): string;
 /** A planned command stub: a `PlannedFile` plus whether a collision is an edit of ours (E8). */
 export interface PlannedCommand extends PlannedFile {
     readonly editedCollided: boolean;
@@ -750,6 +861,24 @@ export declare function statusLineSetElsewhere(targetRepo: string, home?: string
  * protecting anyone: see DENY_PATTERNS for what these three do and do not cover.
  */
 export declare function generateSettingsJson(): string;
+/**
+ * A FRESH `.codex/hooks.json` (`codex-install-target` AC2): the Codex profile's wiring
+ * table (`AGENT_PROFILES.codex.wiring`, `@halfcycle/core`), one group per row in table
+ * order, in Codex's documented shape — `{ "hooks": { <event>: [ { "matcher"?,
+ * "hooks": [ { "type": "command", "command", "timeout", "commandWindows"? } ] } ] } }`.
+ * Events appear in the order of their first row.
+ *
+ * NOTHING HERE IS DECIDED: every value is the profile's. This function only puts the
+ * rows into Codex's shape, so the table has one home and the file cannot drift from
+ * what the runner and the hosted check read.
+ *
+ * ITS BYTES ARE WHAT EVERY CODEX USER APPROVES (phase D2; measurement M1): Codex keys
+ * each approval on the hook's definition and position, so any change to these bytes
+ * makes every person approve the checks again. `test/codex-hooks.test.ts` pins
+ * them. A generated script's CONTENTS are not in here — each command runs a script by
+ * its path — so a script can change without asking anyone again.
+ */
+export declare function generateCodexHooksJson(): string;
 /**
  * What the wrapper's fallback says when it stops a command (`risky-action-check`,
  * *User-facing behaviour*, decision 7): why the check is not running and the one
@@ -852,6 +981,142 @@ export declare function planLegacyCiStanzaRemoval(targetRepo: string): RetiredFi
  * on its next run and silently join a fresh credential.
  */
 export { MCP_REGISTRATION_REL, MCP_SERVER_KEY };
+/**
+ * THE POSITIVE ADDRESS ALLOWLIST every address passes BEFORE it reaches the `url` line
+ * or Codex's headers command (`codex-install-target` AC3). Nothing else guarantees the
+ * address's characters: it is the origin control declares on the create answer, typed
+ * only as a string (`packages/events/src/credential-wire.ts`), plus `/mcp`
+ * (`mcpEndpointUrl`). Codex's command puts it inside a single-quoted string of a
+ * `node -e` program held to the character rule (`MCP_HEADERS_HELPER_COMMAND`'s
+ * docblock: no `"`, `$`, `%`, backtick, `\` or `!`), and the pattern admits none of
+ * those, nor `'`, whitespace, a control character or `%`-encoding. So a string from
+ * control can never close the quoting it sits in and become part of a command the
+ * agent runs.
+ *
+ * A POSITIVE pattern, never a list of refused characters: a character nobody thought
+ * of is refused by default. It also refuses an IPv6 literal and a host with `_`;
+ * accepted, because control's origins are DNS names. JavaScript's `$` matches only at
+ * the very end of the input (no `m` flag), so a trailing newline is refused too.
+ */
+export declare const CODEX_ADDRESS_PATTERN: RegExp;
+/** Whether `address` may be written into Codex's settings and its headers command. */
+export declare function codexAddressAllowed(address: string): boolean;
+/**
+ * THE COMMAND CODEX RUNS FOR THE CONNECTION HEADERS (`http_headers_helper`), the twin
+ * of `MCP_HEADERS_HELPER_COMMAND` on measurement M5's `--url` arm
+ * (`codex-install-target` AC3; `codex-client-seat` AC4). `null` when the address fails
+ * `CODEX_ADDRESS_PATTERN`: that is the only way an address reaches the program, so no
+ * caller can build a command around an unchecked one.
+ *
+ * A FUNCTION OF THE ADDRESS rather than a constant, because Codex clears the helper's
+ * environment to eight names (M5), so no variable names the server: the program passes
+ * it to the verb as `--url <address>`, and the address is per project. Everything else
+ * is fixed text.
+ *
+ * WHAT DIFFERS FROM CLAUDE CODE'S PROGRAM, and why: IT NEVER EXITS NON-ZERO. Codex fails
+ * the whole server on a non-zero exit or on stdout that is not one JSON object of
+ * strings, and then never reaches delivery's sentence (M5). So:
+ *  - the runner's stdout is CAPTURED, not inherited, and printed only when the runner
+ *    exits 0; on any other exit, a signal, or a failure to start it, the placeholder
+ *    object is printed instead. stderr still passes through, so the runner's own
+ *    sentences reach the person;
+ *  - no runner at or above the session's folder keeps Claude Code's sentence on
+ *    stderr, then prints the placeholder object;
+ *  - a Node below the floor keeps the floor's sentence (`nodeFloorProgram`, given this
+ *    command's below-the-floor arm), then prints the placeholder object;
+ *  - anything that throws prints the placeholder object, and at most one object is
+ *    ever printed.
+ * stdin is not given to the runner: the verb reads none.
+ *
+ * The character rule and the Node 10 parse rule hold for the whole written string,
+ * asserted in `test/codex-config.test.ts` on what the installer writes, and the
+ * command is run there against the real vendored binary.
+ */
+export declare function codexMcpHeadersHelperCommand(address: string): string | null;
+/**
+ * The opening and closing lines of the one block the installer owns in
+ * `.codex/config.toml`. STABLE TEXT: no version, date or address, so every version
+ * finds every earlier block. Changing either strands every block already written.
+ */
+export declare const CODEX_CONFIG_OPEN_MARKER = "# >>> Halfcycle \u2014 generated by the Halfcycle installer; replaced on every install";
+export declare const CODEX_CONFIG_CLOSE_MARKER = "# <<< Halfcycle";
+/**
+ * THE BLOCK, a pure generator (`codex-install-target`, *The `config.toml` block*): the
+ * opening marker, `[mcp_servers.halfcycle]`, `url`, `http_headers_helper`, the closing
+ * marker, joined with `\n` and no trailing newline (`reconcileCodexConfig` puts it in
+ * the file's own line ending). `null` when `address` fails the allowlist, which is
+ * checked here, before either value is built.
+ *
+ * NO APPROVAL SETTING, deliberately: the installer never commits a standing grant (the
+ * operator's standing rule of 2026-08-10, recorded in `DENY_PATTERNS`' docblock). So no
+ * `default_tools_approval_mode` or any other approval key is written, and headless
+ * Codex cannot call Halfcycle's tools until the person chooses an approval mode
+ * themselves (M5). A test asserts the parsed block holds exactly `url` and
+ * `http_headers_helper`.
+ */
+export declare function generateCodexConfigBlock(address: string): string | null;
+/**
+ * THE SECOND KEY for removing a block (`codex-install-target` AC5): `block` (the
+ * marker lines and what is between them, any line endings) regenerates byte for byte
+ * from its own `url` line, with this version's headers command or a retired one. A
+ * block anyone edited, or whose address no longer passes the allowlist, does not.
+ *
+ * `retired` is `RETIRED_CODEX_MCP_HEADERS_HELPERS` for every real caller; the
+ * parameter exists so a test can show a block an older helper wrote is recognised
+ * while that list is empty.
+ */
+export declare function regeneratesCodexBlock(block: string, retired?: ReadonlyArray<(address: string) => string | null>): boolean;
+/** Why the reconciler left a file alone. */
+export type CodexConfigConflict = 'server-named' | 'broken-markers' | 'unreadable';
+/**
+ * The reconciler's three results: the file's new text (with `appended`, the exact text
+ * added at the end when the file held no block, `null` when a block was replaced in
+ * place), `unchanged`, or a conflict. `block` is the block exactly as it sits in the
+ * resulting file, its closing line's ending included when it has one: what the install
+ * record keeps (`codexConfig.block`).
+ */
+export type CodexConfigReconciled = {
+    readonly kind: 'new';
+    readonly text: string;
+    readonly appended: string | null;
+    readonly block: string;
+} | {
+    readonly kind: 'unchanged';
+    readonly block: string;
+} | {
+    readonly kind: 'conflict';
+    readonly reason: CodexConfigConflict;
+};
+/**
+ * Why the installer must leave this `.codex/config.toml` text alone, or `null` when its
+ * block may be written. Depends on the text alone, never on the address, so a preview
+ * can say it before the address is known.
+ */
+export declare function codexConfigConflict(existing: string): CodexConfigConflict | null;
+/** Whether `existing` holds exactly one well-formed block of ours. */
+export declare function holdsCodexBlock(existing: string): boolean;
+/**
+ * The block's span in `text`, from the start of its opening line to the end of its
+ * closing line's line ending (or of the text, when that line has none); `none` with no
+ * block, `broken` for any broken-marker form (`locateCodexBlock`).
+ */
+export declare function codexBlockSpan(text: string): {
+    readonly start: number;
+    readonly end: number;
+} | 'none' | 'broken';
+/**
+ * THE RECONCILER, pure: the file's text (`null`: no file) and the block in, one of
+ * three results out (`codex-install-target`, *The `config.toml` block*).
+ *  - No file, or an empty one: the block and a newline.
+ *  - No block: appended after a line ending (when the file lacks a final one) and one
+ *    blank separator line, the text the install record keeps (AC5).
+ *  - Our block: replaced in place, so a changed address or command reaches trees
+ *    installed before.
+ *  - A conflict (`codexConfigConflict`): nothing is written.
+ * Every byte outside the block is kept, and the block takes the file's line ending
+ * (`lineEndingOf`).
+ */
+export declare function reconcileCodexConfig(existing: string | null, block: string): CodexConfigReconciled;
 /**
  * Delete the retired `.halfcycle/mcp-headers.sh` when, and only when, BOTH hold —
  * the rule `removeLegacyCiStanza` follows, applied to this path
@@ -1459,7 +1724,8 @@ export declare function applyLegacyMigration(targetRepo: string, decided: Legacy
  * Install the bundle into a target engagement repo.
  *
  * Write order:
- * 1. (nothing) — NO worker role files land in a client tree (FX-2, W3-F-27)
+ * 1. (nothing) — NO worker role files are copied into a client tree (FX-2, W3-F-27);
+ *    the generated crew profiles are 8c
  * 2. commands → .claude/commands/ (one-screen stubs, no method prose)
  * 3. captured-payload fixtures store convention → test/fixtures/captured/
  * 4. vendored guard binary → .halfcycle/bin/bin.bundle.mjs (self-contained)
@@ -1474,6 +1740,8 @@ export declare function applyLegacyMigration(targetRepo: string, decided: Legacy
  *    at machine level — T-09) + migration of any pre-T-09 in-tree credential
  * 8. .halfcycle/bundle.json pin
  * 8b. .halfcycle/crew.json — CREW_ROSTER, serialised verbatim (crew-roster-and-dispatch)
+ * 8c. One profile per crew member → .claude/agents/<CALLSIGN>.md, and for every member
+ *    outside the reviewer group .codex/agents/<callsign>.toml (crew-agent-profiles)
  * 9. Bootstrap scan → .halfcycle/state.json (INV-021 — once, onboarding-time,
  *    a no-op if the file already exists; never re-run on a re-install)
  * 10. .halfcycle/install-manifest.json — what this and every earlier install put
@@ -1504,6 +1772,8 @@ export interface InstallSteps {
     /** The write set's directories already there BEFORE anything is written. */
     readonly dirsBefore: ReadonlySet<string>;
     readonly commands: readonly PlannedCommand[];
+    /** Codex's twin of `commands` (`codex-install-target` AC4, T-14). */
+    readonly codexSkills: readonly PlannedCommand[];
     readonly vendored: PlannedFile;
     readonly settings: PlannedSettings;
     readonly hooks: readonly PlannedFile[];
@@ -1511,6 +1781,10 @@ export interface InstallSteps {
     readonly mcp: PlannedMcp;
     /** The retired connection-headers helper; `null` when no server entry is written. */
     readonly mcpHelper: RetiredFileRemoval | null;
+    /** Codex's checks file (`codex-install-target` AC2), after the server entry. */
+    readonly codexHooks: PlannedCodexHooks;
+    /** Codex's settings file (`codex-install-target` AC3), after Codex's checks file. */
+    readonly codexConfig: PlannedCodexConfig;
     readonly gitignore: PlannedMerge;
     readonly gitattributes: PlannedMerge;
     readonly identity: PlannedProjectIdentity;
@@ -1525,6 +1799,8 @@ export interface InstallSteps {
     /** `null` while the project id is pending (a preview). */
     readonly pin: PlannedFile | null;
     readonly crew: PlannedFile;
+    /** One profile per crew member (`crew-agent-profiles`), after the crew roster. */
+    readonly crewProfiles: readonly PlannedCommand[];
     readonly scan: {
         readonly text: string | null;
     };
@@ -1556,6 +1832,14 @@ export declare function planCommandStubs(targetRepo: string, previous: InstallMa
     version: string;
     commands: PlannedCommand[];
 };
+/**
+ * 2b. Codex's twin of the command stubs — `.agents/skills/<name>/SKILL.md`, one
+ * per `plugin.json` command (`codex-install-target` AC4, T-14). Same manifest,
+ * same collision rule (`decideCollisionSafe`, `bytesAreOurs`): a developer's
+ * differing file at the path is reported and kept, never overwritten. A declared
+ * command whose source file is missing is a build error, exactly as for the stubs.
+ */
+export declare function planCodexSkills(targetRepo: string, previous: InstallManifest | null, writeSet: ClosedWriteSet): PlannedCommand[];
 /** The install record an earlier install left here, or `null`. Reads only. */
 export { readPreviousManifest };
 /**
@@ -1590,8 +1874,106 @@ export declare function planHookScripts(targetRepo: string): PlannedFile[];
 export declare function planMcpRegistration(targetRepo: string, credential: DeviceCredential | 'pending' | undefined): PlannedMcp;
 /** The write half of the server entry, through `writeAllowlisted`. */
 export declare function putPlannedMcp(targetRepo: string, planned: PlannedMcp): void;
+/**
+ * True when `rel`, or any folder on the way to it below `root`, is a symbolic link.
+ * Stops at the first part that does not exist. THE ONE TEST both verbs apply before
+ * touching a merged file: install leaves such a file alone (`planCodexHooks`), and
+ * uninstall does not follow one (`uninstall.ts`, `applyMergedJson`).
+ */
+export declare function symlinkOnPath(root: string, rel: string): boolean;
+/**
+ * Codex's checks file as planned (`codex-install-target` AC2). `before` is the file's
+ * text (`null`: absent) and `existing` its parsed value when it could be read; `text`
+ * is what goes there when `outcome` is `written`, and `null` otherwise.
+ */
+export interface PlannedCodexHooks {
+    readonly outcome: CodexHooksOutcome;
+    readonly before: string | null;
+    readonly existing: Record<string, unknown> | null;
+    readonly generated: CodexHooksFile;
+    readonly text: string | null;
+}
+/**
+ * 6c. `.codex/hooks.json` — Codex's checks, MERGED beside a developer's own entries and
+ * never moving one of ours (`codex-install-target` AC2; `mergeCodexHooks`). Planned
+ * after the server entry and before `.gitignore`, so no Claude Code write moves.
+ *
+ * Two arms leave the file byte for byte and say why, rather than refusing the install
+ * as an unreadable `.claude/settings.json` does: Codex is the second agent, and a
+ * project's Claude Code setup should not wait on it.
+ *  - `link`: the file, or a folder above it, is a symbolic link (`symlinkOnPath`).
+ *  - `unreadable`: not valid JSON; a root or `hooks` value that is not an object; an
+ *    event Halfcycle writes whose value is not a list; or a `.codex` that is not a
+ *    folder, so nothing could be written under it.
+ *
+ * A file whose parsed value already equals the merge's result is `current` and keeps
+ * its bytes, whatever its formatting: whitespace and key order are not part of what
+ * Codex approves.
+ */
+export declare function planCodexHooks(targetRepo: string): PlannedCodexHooks;
+/** The write half of Codex's checks file, through `writeAllowlisted`. */
+export declare function putPlannedCodexHooks(targetRepo: string, planned: PlannedCodexHooks): void;
+/**
+ * Codex's settings file as planned (`codex-install-target` AC3). `outcome` is
+ * `pending` only in a preview, whose address is still to come. `before` is the file's
+ * text when it was read (`null`: absent, or not read). `text` is what goes there when
+ * `outcome` is `written`; `appended` is the exact text added at the end of a file that
+ * held no block (`null` otherwise, a created file included). `blockKept` is true when
+ * the address was refused and the file already held a block of ours, which is kept.
+ */
+export interface PlannedCodexConfig {
+    readonly outcome: CodexConfigOutcome | 'pending';
+    readonly before: string | null;
+    readonly text: string | null;
+    readonly appended: string | null;
+    /** The block as it sits in the file after this run, when `written` or `current`. */
+    readonly inFile: string | null;
+    readonly conflict: CodexConfigConflict | null;
+    readonly blockKept: boolean;
+}
+/**
+ * 6d. `.codex/config.toml` — Codex's server entry, one marked block beside whatever
+ * the developer's file holds (`codex-install-target` AC3; `reconcileCodexConfig`).
+ * Planned after Codex's checks file and before `.gitignore`, so no Claude Code write
+ * moves. Decided in this order, each arm leaving the file byte for byte:
+ *  1. no credential: `.mcp.json` is not written, so neither is this (`no-credential`);
+ *  2. the file, or a folder above it, is a symbolic link (`link`), never followed;
+ *  3. it cannot be read byte for byte (`conflict`, `unreadable`);
+ *  4. a preview: whatever does not need the address is decided, the rest `pending`;
+ *  5. the address fails `CODEX_ADDRESS_PATTERN` (`refused-address`), BEFORE any block
+ *     is built, so no part of a refused address is written; a block already there is
+ *     kept, and the report names it;
+ *  6. the reconciler: a conflict, `current`, or the new text (`written`).
+ *
+ * The address is `mcpEndpointUrl` of the credential's MCP origin: the value `.mcp.json`
+ * gets (`planMcpRegistration`), from the one function that composes it.
+ */
+export declare function planCodexConfig(targetRepo: string, credential: DeviceCredential | 'pending' | undefined): PlannedCodexConfig;
+/** The write half of Codex's settings file, through `writeAllowlisted`. */
+export declare function putPlannedCodexConfig(targetRepo: string, planned: PlannedCodexConfig): void;
 /** 8b. The crew roster, owned by path (see `writeCrewRoster`). */
 export declare function planCrewRoster(targetRepo: string): PlannedFile;
+/**
+ * 8c. One profile per crew member (`crew-agent-profiles` AC2–AC6): Claude Code's for
+ * every member, Codex's for every member outside the `reviewer` group, from
+ * `renderCrewProfiles`, the one generator.
+ *
+ * OWNED BY EVIDENCE, AND THE EVIDENCE IS THE BYTES (`decideCollisionSafe`, `bytesAreOurs`),
+ * the rule the command stubs and the Codex skills use: a differing file is replaced only
+ * when it holds exactly what an earlier install recorded or what this version writes, so
+ * a developer's own file at one of these names, or one of ours they edited, is kept and
+ * named. `decideOwnedGenerated`'s header-line evidence is NOT used here, deliberately: a
+ * profile's line under its opening `---` is `name: <callsign>`, which a developer's own
+ * profile of the same name carries too, so that rule would read theirs as ours and
+ * overwrite it.
+ *
+ * A LINK IS NEVER FOLLOWED, AND A FILE IN A FOLDER'S PLACE IS NEVER MOVED: a profile path
+ * that is, or sits under, a symbolic link, or whose folder is taken by a file (a `.codex`
+ * that is a file, say), is left as it is and named, so a linked `.claude/agents` cannot
+ * carry a write out of the project and the rest of the install still finishes. Both name
+ * checks (`crewProfileRel`, `crewProfileTarget`) run before any read.
+ */
+export declare function planCrewProfiles(targetRepo: string, previous: InstallManifest | null, writeSet: ClosedWriteSet): PlannedCommand[];
 /** 10. The install record, owned by path, decided once its bytes are known. */
 export declare function planInstallRecord(targetRepo: string, text: string): PlannedFile;
 export { writeBundlePin, planBundlePin, writeEngagementCredential, findNotShared };
@@ -1636,9 +2018,12 @@ export type { MutableReport, CopyOutcome, BytesAfter };
 export declare const SELF_BUILD_GITIGNORE_REL = ".halfcycle/.gitignore";
 /**
  * The repo paths the self-build install may write, and the only ones (`self-build-install`
- * AC4). ONE HOME: the install mode below writes exactly these, and the monorepo
- * uninstall takes back exactly these, so the two cannot disagree. Every entry sits under
- * a `WRITE_ALLOWLIST` prefix. The credential is not here because it is not in the repo.
+ * AC4, amended 2026-10-31 by `T-32` per `crew-agent-profiles` AC7: the self-build set gains
+ * every crew profile `renderCrewProfiles` names, Claude Code's and Codex's alike, so this
+ * repository's own coordinator has one to start each callsign by). ONE HOME: the install
+ * mode below writes exactly these, and the monorepo uninstall takes back exactly these, so
+ * the two cannot disagree. Every entry sits under a `WRITE_ALLOWLIST` prefix. The credential
+ * is not here because it is not in the repo.
  */
 export declare const SELF_BUILD_WRITE_SET: readonly string[];
 export interface SelfBuildInstallOptions {