holycodex 0.11.2 → 0.11.3-dev.157.1

package/README.md

@@ -11,6 +11,8 @@ Use `holycodex --help` for commands, autonomy options, routing plans, and servic
 
 On a fresh installation, omitting autonomy flags seeds Codex Approve for me semantics: `approval_policy = "on-request"`, `approvals_reviewer = "auto_review"`, and `sandbox_mode = "workspace-write"`. On an existing installation, omitting autonomy flags preserves the complete current permission selection. `--no-codex-autonomous`, `--codex-autonomous`, and `--dangerous-codex-autonomous` explicitly replace that selection with their documented modes. HolyCodex never generates `default_permissions` or selects a named permission profile.
 
-Install also attempts to add or enable the official `codex-security@openai-curated` plugin through structured Codex CLI commands. If no global Codex CLI is available, HolyCodex can use the active Bun executable or a supported npm/pnpm package runner. External availability failures are non-fatal and reported in human and JSON results. Cleanup leaves this independent official plugin installed. Build Web Apps remains separately managed by Codex.
+Install also attempts to add or enable the official `codex-security@openai-curated` and `computer-use@openai-bundled` plugins through structured Codex CLI commands. If no global Codex CLI is available, HolyCodex can use the active Bun executable or a supported npm/pnpm package runner. External availability failures are non-fatal and reported in human and JSON results. Cleanup leaves these independent official plugins installed. Build Web Apps remains separately managed by Codex.
+
+Human-readable installs show each step as it completes. Use `-v` or `--verbose` for launcher, backup, plan, and plugin-state details; `--json` remains progress-free and machine-readable.
 
 Repository, documentation, license, and security notices: https://github.com/davidbasilefilho/holycodex

package/THIRD-PARTY-NOTICES.md

@@ -9,3 +9,5 @@ The caveman communication concept is adapted from [juliusbrussee/caveman](https:
 HolyCodex agent routing and orchestration instructions adapt bounded-role, task-ownership, non-overlapping-write, session-reuse, and verification-planning concepts from [alvinunreal/oh-my-opencode-slim](https://github.com/alvinunreal/oh-my-opencode-slim) at commit `7bc7b56856ee693812d87d68615757d4d1c2e218`, principally `src/agents/{orchestrator,explorer,librarian,fixer}.ts`, `src/skills/verification-planning/SKILL.md`, and `docs/background-orchestration.md`. OpenCode runtime APIs, hooks, council, ACP, companion, and background-session mechanics were not copied. Upstream material is MIT licensed; its license is preserved in `packages/plugin/plugin/LICENSE-OH-MY-OPENCODE-SLIM-MIT.txt`.
 
 The bundled LSP runtime at `packages/plugin/plugin/runtime/lsp.js` is derived from `code-yeongyu/oh-my-openagent`'s `lsp-tools-mcp`. Copyright (c) 2026 Yeongyu Kim; used under the MIT License preserved at `packages/plugin/plugin/runtime/LICENSE-LSP-MIT.txt`.
+
+The isolated workflow runtime uses [quickjs-emscripten](https://github.com/justjake/quickjs-emscripten) and QuickJS compiled to WebAssembly. Both projects are distributed under the MIT License; the bundled license is preserved at `runtime/LICENSE-QUICKJS-EMSCRIPTEN-MIT.txt`.

package/dist/cli.js

@@ -1906,6 +1906,207 @@ function handleIntersectionResults(result, left, right) {
 	result.value = merged.data;
 	return result;
 }
+var $ZodTuple = /*@__PURE__*/ $constructor("$ZodTuple", (inst, def) => {
+	$ZodType.init(inst, def);
+	const items = def.items;
+	inst._zod.parse = (payload, ctx) => {
+		const input = payload.value;
+		if (!Array.isArray(input)) {
+			payload.issues.push({
+				input,
+				inst,
+				expected: "tuple",
+				code: "invalid_type"
+			});
+			return payload;
+		}
+		payload.value = [];
+		const proms = [];
+		const optinStart = getTupleOptStart(items, "optin");
+		const optoutStart = getTupleOptStart(items, "optout");
+		if (!def.rest) {
+			if (input.length < optinStart) {
+				payload.issues.push({
+					code: "too_small",
+					minimum: optinStart,
+					inclusive: true,
+					input,
+					inst,
+					origin: "array"
+				});
+				return payload;
+			}
+			if (input.length > items.length) payload.issues.push({
+				code: "too_big",
+				maximum: items.length,
+				inclusive: true,
+				input,
+				inst,
+				origin: "array"
+			});
+		}
+		const itemResults = new Array(items.length);
+		for (let i = 0; i < items.length; i++) {
+			const r = items[i]._zod.run({
+				value: input[i],
+				issues: []
+			}, ctx);
+			if (r instanceof Promise) proms.push(r.then((rr) => {
+				itemResults[i] = rr;
+			}));
+			else itemResults[i] = r;
+		}
+		if (def.rest) {
+			let i = items.length - 1;
+			const rest = input.slice(items.length);
+			for (const el of rest) {
+				i++;
+				const result = def.rest._zod.run({
+					value: el,
+					issues: []
+				}, ctx);
+				if (result instanceof Promise) proms.push(result.then((r) => handleTupleResult(r, payload, i)));
+				else handleTupleResult(result, payload, i);
+			}
+		}
+		if (proms.length) return Promise.all(proms).then(() => handleTupleResults(itemResults, payload, items, input, optoutStart));
+		return handleTupleResults(itemResults, payload, items, input, optoutStart);
+	};
+});
+function getTupleOptStart(items, key) {
+	for (let i = items.length - 1; i >= 0; i--) if (items[i]._zod[key] !== "optional") return i + 1;
+	return 0;
+}
+function handleTupleResult(result, final, index) {
+	if (result.issues.length) final.issues.push(...prefixIssues(index, result.issues));
+	final.value[index] = result.value;
+}
+function handleTupleResults(itemResults, final, items, input, optoutStart) {
+	for (let i = 0; i < items.length; i++) {
+		const r = itemResults[i];
+		const isPresent = i < input.length;
+		if (r.issues.length) {
+			if (!isPresent && i >= optoutStart) {
+				final.value.length = i;
+				break;
+			}
+			final.issues.push(...prefixIssues(i, r.issues));
+		}
+		final.value[i] = r.value;
+	}
+	for (let i = final.value.length - 1; i >= input.length; i--) if (items[i]._zod.optout === "optional" && final.value[i] === void 0) final.value.length = i;
+	else break;
+	return final;
+}
+var $ZodRecord = /*@__PURE__*/ $constructor("$ZodRecord", (inst, def) => {
+	$ZodType.init(inst, def);
+	inst._zod.parse = (payload, ctx) => {
+		const input = payload.value;
+		if (!isPlainObject(input)) {
+			payload.issues.push({
+				expected: "record",
+				code: "invalid_type",
+				input,
+				inst
+			});
+			return payload;
+		}
+		const proms = [];
+		const values = def.keyType._zod.values;
+		if (values) {
+			payload.value = {};
+			const recordKeys = /* @__PURE__ */ new Set();
+			for (const key of values) if (typeof key === "string" || typeof key === "number" || typeof key === "symbol") {
+				recordKeys.add(typeof key === "number" ? key.toString() : key);
+				const keyResult = def.keyType._zod.run({
+					value: key,
+					issues: []
+				}, ctx);
+				if (keyResult instanceof Promise) throw new Error("Async schemas not supported in object keys currently");
+				if (keyResult.issues.length) {
+					payload.issues.push({
+						code: "invalid_key",
+						origin: "record",
+						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),
+						input: key,
+						path: [key],
+						inst
+					});
+					continue;
+				}
+				const outKey = keyResult.value;
+				const result = def.valueType._zod.run({
+					value: input[key],
+					issues: []
+				}, ctx);
+				if (result instanceof Promise) proms.push(result.then((result) => {
+					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));
+					payload.value[outKey] = result.value;
+				}));
+				else {
+					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));
+					payload.value[outKey] = result.value;
+				}
+			}
+			let unrecognized;
+			for (const key in input) if (!recordKeys.has(key)) {
+				unrecognized = unrecognized ?? [];
+				unrecognized.push(key);
+			}
+			if (unrecognized && unrecognized.length > 0) payload.issues.push({
+				code: "unrecognized_keys",
+				input,
+				inst,
+				keys: unrecognized
+			});
+		} else {
+			payload.value = {};
+			for (const key of Reflect.ownKeys(input)) {
+				if (key === "__proto__") continue;
+				if (!Object.prototype.propertyIsEnumerable.call(input, key)) continue;
+				let keyResult = def.keyType._zod.run({
+					value: key,
+					issues: []
+				}, ctx);
+				if (keyResult instanceof Promise) throw new Error("Async schemas not supported in object keys currently");
+				if (typeof key === "string" && number$1.test(key) && keyResult.issues.length) {
+					const retryResult = def.keyType._zod.run({
+						value: Number(key),
+						issues: []
+					}, ctx);
+					if (retryResult instanceof Promise) throw new Error("Async schemas not supported in object keys currently");
+					if (retryResult.issues.length === 0) keyResult = retryResult;
+				}
+				if (keyResult.issues.length) {
+					if (def.mode === "loose") payload.value[key] = input[key];
+					else payload.issues.push({
+						code: "invalid_key",
+						origin: "record",
+						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),
+						input: key,
+						path: [key],
+						inst
+					});
+					continue;
+				}
+				const result = def.valueType._zod.run({
+					value: input[key],
+					issues: []
+				}, ctx);
+				if (result instanceof Promise) proms.push(result.then((result) => {
+					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));
+					payload.value[keyResult.value] = result.value;
+				}));
+				else {
+					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));
+					payload.value[keyResult.value] = result.value;
+				}
+			}
+		}
+		if (proms.length) return Promise.all(proms).then(() => payload);
+		return payload;
+	};
+});
 var $ZodEnum = /*@__PURE__*/ $constructor("$ZodEnum", (inst, def) => {
 	$ZodType.init(inst, def);
 	const values = getEnumValues(def.entries);
@@ -3171,6 +3372,77 @@ var intersectionProcessor = (schema, ctx, json, params) => {
 	const isSimpleIntersection = (val) => "allOf" in val && Object.keys(val).length === 1;
 	json.allOf = [...isSimpleIntersection(a) ? a.allOf : [a], ...isSimpleIntersection(b) ? b.allOf : [b]];
 };
+var tupleProcessor = (schema, ctx, _json, params) => {
+	const json = _json;
+	const def = schema._zod.def;
+	json.type = "array";
+	const prefixPath = ctx.target === "draft-2020-12" ? "prefixItems" : "items";
+	const restPath = ctx.target === "draft-2020-12" ? "items" : ctx.target === "openapi-3.0" ? "items" : "additionalItems";
+	const prefixItems = def.items.map((x, i) => process$2(x, ctx, {
+		...params,
+		path: [
+			...params.path,
+			prefixPath,
+			i
+		]
+	}));
+	const rest = def.rest ? process$2(def.rest, ctx, {
+		...params,
+		path: [
+			...params.path,
+			restPath,
+			...ctx.target === "openapi-3.0" ? [def.items.length] : []
+		]
+	}) : null;
+	if (ctx.target === "draft-2020-12") {
+		json.prefixItems = prefixItems;
+		if (rest) json.items = rest;
+	} else if (ctx.target === "openapi-3.0") {
+		json.items = { anyOf: prefixItems };
+		if (rest) json.items.anyOf.push(rest);
+		json.minItems = prefixItems.length;
+		if (!rest) json.maxItems = prefixItems.length;
+	} else {
+		json.items = prefixItems;
+		if (rest) json.additionalItems = rest;
+	}
+	const { minimum, maximum } = schema._zod.bag;
+	if (typeof minimum === "number") json.minItems = minimum;
+	if (typeof maximum === "number") json.maxItems = maximum;
+};
+var recordProcessor = (schema, ctx, _json, params) => {
+	const json = _json;
+	const def = schema._zod.def;
+	json.type = "object";
+	const keyType = def.keyType;
+	const patterns = keyType._zod.bag?.patterns;
+	if (def.mode === "loose" && patterns && patterns.size > 0) {
+		const valueSchema = process$2(def.valueType, ctx, {
+			...params,
+			path: [
+				...params.path,
+				"patternProperties",
+				"*"
+			]
+		});
+		json.patternProperties = {};
+		for (const pattern of patterns) json.patternProperties[pattern.source] = valueSchema;
+	} else {
+		if (ctx.target === "draft-07" || ctx.target === "draft-2020-12") json.propertyNames = process$2(def.keyType, ctx, {
+			...params,
+			path: [...params.path, "propertyNames"]
+		});
+		json.additionalProperties = process$2(def.valueType, ctx, {
+			...params,
+			path: [...params.path, "additionalProperties"]
+		});
+	}
+	const keyValues = keyType._zod.values;
+	if (keyValues) {
+		const validKeyValues = [...keyValues].filter((v) => typeof v === "string" || typeof v === "number");
+		if (validKeyValues.length > 0) json.required = validKeyValues;
+	}
+};
 var nullableProcessor = (schema, ctx, json, params) => {
 	const def = schema._zod.def;
 	const inner = process$2(def.innerType, ctx, params);
@@ -3859,6 +4131,45 @@ function intersection(left, right) {
 		right
 	});
 }
+var ZodTuple = /*@__PURE__*/ $constructor("ZodTuple", (inst, def) => {
+	$ZodTuple.init(inst, def);
+	ZodType.init(inst, def);
+	inst._zod.processJSONSchema = (ctx, json, params) => tupleProcessor(inst, ctx, json, params);
+	inst.rest = (rest) => inst.clone({
+		...inst._zod.def,
+		rest
+	});
+});
+function tuple(items, _paramsOrRest, _params) {
+	const hasRest = _paramsOrRest instanceof $ZodType;
+	return new ZodTuple({
+		type: "tuple",
+		items,
+		rest: hasRest ? _paramsOrRest : null,
+		...normalizeParams(hasRest ? _params : _paramsOrRest)
+	});
+}
+var ZodRecord = /*@__PURE__*/ $constructor("ZodRecord", (inst, def) => {
+	$ZodRecord.init(inst, def);
+	ZodType.init(inst, def);
+	inst._zod.processJSONSchema = (ctx, json, params) => recordProcessor(inst, ctx, json, params);
+	inst.keyType = def.keyType;
+	inst.valueType = def.valueType;
+});
+function record(keyType, valueType, params) {
+	if (!valueType || !valueType._zod) return new ZodRecord({
+		type: "record",
+		keyType: string(),
+		valueType: keyType,
+		...normalizeParams(valueType)
+	});
+	return new ZodRecord({
+		type: "record",
+		keyType,
+		valueType,
+		...normalizeParams(params)
+	});
+}
 var ZodEnum = /*@__PURE__*/ $constructor("ZodEnum", (inst, def) => {
 	$ZodEnum.init(inst, def);
 	ZodType.init(inst, def);
@@ -4080,7 +4391,7 @@ function superRefine(fn, params) {
 }
 //#endregion
 //#region packages/cli/src/catalog.ts
-var VERSION = "0.11.2";
+var VERSION = "0.11.3-dev.157.1";
 var SKILLS = [
 	"ast-grep",
 	"babysit-ci",
@@ -4096,7 +4407,8 @@ var SKILLS = [
 	"programming",
 	"refactor",
 	"remove-slop",
-	"rules"
+	"rules",
+	"workflows"
 ];
 var AGENTS = _enum([
 	"explorer",
@@ -4138,6 +4450,46 @@ var ModelRouteSchema = discriminatedUnion("model", [
 		reasoningEffort: ReasoningEffortSchema
 	})
 ]);
+var WORKFLOW_STAGES = [
+	"analysis",
+	"research",
+	"implementation",
+	"verification"
+];
+var WorkflowStageSchema = _enum(WORKFLOW_STAGES);
+var WorkflowLimitsSchema = strictObject({
+	concurrency: number().int().positive(),
+	totalCalls: number().int().positive(),
+	workflowDepth: number().int().positive(),
+	retries: number().int().nonnegative(),
+	loopIterations: number().int().positive(),
+	fanOut: number().int().positive(),
+	maxConcurrency: number().int().positive(),
+	maxCalls: number().int().positive(),
+	maxRetries: number().int().nonnegative()
+});
+var WorkflowPolicySchema = strictObject({
+	permittedRoutes: strictObject({
+		explorer: record(WorkflowStageSchema, array(ModelRouteSchema).min(1)),
+		librarian: record(WorkflowStageSchema, array(ModelRouteSchema).min(1)),
+		worker: record(WorkflowStageSchema, array(ModelRouteSchema).min(1))
+	}),
+	verbosity: literal("low"),
+	serviceTiers: tuple([literal("default"), literal("fast")]),
+	limits: WorkflowLimitsSchema,
+	projectedUsage: strictObject({
+		standard: number().positive(),
+		fast: number().positive()
+	}),
+	runtime: strictObject({
+		maxSeconds: number().int().positive(),
+		maxRuntimeMs: number().int().positive()
+	}),
+	softSizeGuidance: strictObject({
+		maxInputTokens: number().int().positive(),
+		maxScriptBytes: number().int().positive()
+	})
+});
 var RoutingPresetSchema = strictObject({
 	root: ModelRouteSchema,
 	agents: strictObject({
@@ -4145,10 +4497,7 @@ var RoutingPresetSchema = strictObject({
 		librarian: ModelRouteSchema,
 		worker: ModelRouteSchema
 	}),
-	usage: strictObject({
-		maxSubagents: number().int().nonnegative(),
-		maxDepth: literal(1)
-	})
+	workflow: WorkflowPolicySchema
 });
 var ModelRoutingPlansSchema = strictObject({
 	go: RoutingPresetSchema,
@@ -4158,6 +4507,31 @@ var ModelRoutingPlansSchema = strictObject({
 	"pro-5x": RoutingPresetSchema,
 	"pro-20x": RoutingPresetSchema
 });
+function workflowFor(agents, limits, projectedUsage, maxSeconds, maxInputTokens) {
+	return {
+		permittedRoutes: Object.fromEntries(AGENTS.map((agent) => [agent, Object.fromEntries(WORKFLOW_STAGES.map((stage) => [stage, [agents[agent]]]))])),
+		verbosity: "low",
+		serviceTiers: ["default", "fast"],
+		limits: {
+			...limits,
+			maxConcurrency: limits.concurrency,
+			maxCalls: limits.totalCalls,
+			maxRetries: limits.retries
+		},
+		projectedUsage: {
+			standard: projectedUsage,
+			fast: projectedUsage * 2
+		},
+		runtime: {
+			maxSeconds,
+			maxRuntimeMs: maxSeconds * 1e3
+		},
+		softSizeGuidance: {
+			maxInputTokens,
+			maxScriptBytes: Math.min(maxInputTokens, 4 * 1024 * 1024)
+		}
+	};
+}
 var DEFAULT_PLAN = "plus";
 var MODEL_ROUTING_PLANS = ModelRoutingPlansSchema.parse({
 	go: {
@@ -4179,10 +4553,27 @@ var MODEL_ROUTING_PLANS = ModelRoutingPlansSchema.parse({
 				reasoningEffort: "high"
 			}
 		},
-		usage: {
-			maxSubagents: 0,
-			maxDepth: 1
-		}
+		workflow: workflowFor({
+			explorer: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "high"
+			},
+			librarian: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "high"
+			},
+			worker: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "high"
+			}
+		}, {
+			concurrency: 1,
+			totalCalls: 4,
+			workflowDepth: 2,
+			retries: 0,
+			loopIterations: 1,
+			fanOut: 1
+		}, 4, 120, 2e4)
 	},
 	"plus-low": {
 		root: {
@@ -4203,10 +4594,27 @@ var MODEL_ROUTING_PLANS = ModelRoutingPlansSchema.parse({
 				reasoningEffort: "high"
 			}
 		},
-		usage: {
-			maxSubagents: 2,
-			maxDepth: 1
-		}
+		workflow: workflowFor({
+			explorer: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "high"
+			},
+			librarian: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "high"
+			},
+			worker: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "high"
+			}
+		}, {
+			concurrency: 2,
+			totalCalls: 8,
+			workflowDepth: 3,
+			retries: 1,
+			loopIterations: 2,
+			fanOut: 2
+		}, 8, 300, 3e4)
 	},
 	plus: {
 		root: {
@@ -4227,10 +4635,27 @@ var MODEL_ROUTING_PLANS = ModelRoutingPlansSchema.parse({
 				reasoningEffort: "high"
 			}
 		},
-		usage: {
-			maxSubagents: 2,
-			maxDepth: 1
-		}
+		workflow: workflowFor({
+			explorer: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "high"
+			},
+			librarian: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "high"
+			},
+			worker: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "high"
+			}
+		}, {
+			concurrency: 3,
+			totalCalls: 16,
+			workflowDepth: 4,
+			retries: 2,
+			loopIterations: 3,
+			fanOut: 3
+		}, 16, 600, 5e4)
 	},
 	"plus-high": {
 		root: {
@@ -4251,10 +4676,27 @@ var MODEL_ROUTING_PLANS = ModelRoutingPlansSchema.parse({
 				reasoningEffort: "xhigh"
 			}
 		},
-		usage: {
-			maxSubagents: 2,
-			maxDepth: 1
-		}
+		workflow: workflowFor({
+			explorer: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "high"
+			},
+			librarian: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "high"
+			},
+			worker: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "xhigh"
+			}
+		}, {
+			concurrency: 4,
+			totalCalls: 24,
+			workflowDepth: 5,
+			retries: 3,
+			loopIterations: 4,
+			fanOut: 4
+		}, 24, 900, 7e4)
 	},
 	"pro-5x": {
 		root: {
@@ -4275,10 +4717,27 @@ var MODEL_ROUTING_PLANS = ModelRoutingPlansSchema.parse({
 				reasoningEffort: "xhigh"
 			}
 		},
-		usage: {
-			maxSubagents: 2,
-			maxDepth: 1
-		}
+		workflow: workflowFor({
+			explorer: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "high"
+			},
+			librarian: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "high"
+			},
+			worker: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "xhigh"
+			}
+		}, {
+			concurrency: 6,
+			totalCalls: 40,
+			workflowDepth: 6,
+			retries: 3,
+			loopIterations: 5,
+			fanOut: 5
+		}, 40, 1200, 1e5)
 	},
 	"pro-20x": {
 		root: {
@@ -4299,12 +4758,31 @@ var MODEL_ROUTING_PLANS = ModelRoutingPlansSchema.parse({
 				reasoningEffort: "max"
 			}
 		},
-		usage: {
-			maxSubagents: 2,
-			maxDepth: 1
-		}
+		workflow: workflowFor({
+			explorer: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "high"
+			},
+			librarian: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "high"
+			},
+			worker: {
+				model: "gpt-5.6-luna",
+				reasoningEffort: "max"
+			}
+		}, {
+			concurrency: 8,
+			totalCalls: 80,
+			workflowDepth: 8,
+			retries: 4,
+			loopIterations: 8,
+			fanOut: 8
+		}, 80, 2400, 15e4)
 	}
 });
+Object.fromEntries(PLAN_NAMES.map((plan) => [plan, MODEL_ROUTING_PLANS[plan].workflow]));
+Object.fromEntries(PLAN_NAMES.map((plan) => [plan, MODEL_ROUTING_PLANS[plan].workflow.limits]));
 MODEL_ROUTING_PLANS[DEFAULT_PLAN].root;
 MODEL_ROUTING_PLANS[DEFAULT_PLAN].agents;
 var LEGACY_MANAGED_AGENT_MODEL_HISTORY = {
@@ -4567,8 +5045,11 @@ var GENERATED_RUNTIMES = [
 	"git-bash.js",
 	"git-bash-resolver.js",
 	"LICENSE-LSP-MIT.txt",
+	"LICENSE-QUICKJS-EMSCRIPTEN-MIT.txt",
 	"lsp.js",
-	"rules.js"
+	"rules.js",
+	"workflow.js",
+	"workflow-evaluator.js"
 ];
 var WINDOWS_SHELL_POLICY = "On native Windows, run every shell command through the bundled Git Bash launcher, including Git, package, build, test, script and POSIX commands. Never execute task commands through PowerShell or cmd. If Git Bash cannot be resolved, stop and report the blocker. On non-Windows, use the native shell normally.";
 var LITE_WRITING_POLICY = "Communicate grammatically and concisely. Omit filler, hedging, repetition, decoration, self-reference, style announcements and tool narration. Preserve exact technical terms, APIs, commands, paths, errors and commit keywords. Use fuller grammar for safety, ambiguity, clarification and ordered instructions. Apply this policy only to agent communication, never to literal authored or transformed content, UI or accessibility labels, help text, errors, logs, tests, fixtures, documentation, comments, commit or PR text, authored prompts, translations, quotations, generated content, public APIs, or existing repository and product voice.";
@@ -4588,7 +5069,8 @@ var INSTALL_FLAGS = /* @__PURE__ */ new Set([
 	"--fast",
 	"--fast-all",
 	"--no-fast",
-	"--json"
+	"--json",
+	"--verbose"
 ]);
 var SHARED_FLAGS = /* @__PURE__ */ new Set(["--json"]);
 /** Strictly parses command-specific HolyCodex CLI arguments. */
@@ -4611,6 +5093,12 @@ function parseCliArguments(args) {
 	const values = /* @__PURE__ */ new Map();
 	for (let index = 1; index < args.length; index += 1) {
 		const token = args[index];
+		if (token === "-v") {
+			if (!allowed.has("--verbose")) throw new Error(`Option -v is not valid for ${command}.`);
+			if (values.has("--verbose")) throw new Error("Repeated option: --verbose");
+			values.set("--verbose", true);
+			continue;
+		}
 		if (token === void 0 || !token.startsWith("--")) throw new Error(`Unexpected positional argument: ${token ?? ""}`);
 		const separator = token.indexOf("=");
 		const name = separator < 0 ? token : token.slice(0, separator);
@@ -4660,7 +5148,8 @@ function parseCliArguments(args) {
 		plan: plan.data,
 		...maxValue === void 0 ? {} : { maxSubagents: Number(maxValue) },
 		autonomy,
-		fast
+		fast,
+		verbose: values.has("--verbose")
 	};
 }
 function base(action) {
@@ -4669,7 +5158,8 @@ function base(action) {
 		json: false,
 		plan: DEFAULT_PLAN,
 		autonomy: { requested: false },
-		fast: "standard"
+		fast: "standard",
+		verbose: false
 	};
 }
 //#endregion
@@ -5134,7 +5624,7 @@ var ORIGINAL_ROOT = "# holycodex original root: ";
 var ORIGINAL_TABLE_KEY = "# holycodex original table key: ";
 var PLAN_PREFIX = "# holycodex plan: ";
 var FAST_MODE_PREFIX = "# holycodex fast: ";
-var MAX_SUBAGENTS_PREFIX = "# holycodex max-subagents: ";
+var WORKFLOW_POLICY_PREFIX = "# holycodex workflow-policy: ";
 var OLD_NAMESPACES = [
 	"marketplaces.sisyphuslabs",
 	"plugins.\"omo@sisyphuslabs\"",
@@ -5253,15 +5743,30 @@ function readManagedFastMode(input) {
 	const value = new RegExp(`^${FAST_MODE_PREFIX}(.+)$`, "m").exec(input)?.[1]?.trim();
 	return FastModeSchema.safeParse(value).data;
 }
-/** Reads an explicit managed direct-subagent override. */
-function readManagedMaxSubagents(input) {
-	const raw = new RegExp(`^${MAX_SUBAGENTS_PREFIX}(.*)$`, "m").exec(input)?.[1]?.trim();
-	if (raw === void 0) return { configured: false };
-	if (!/^\d+$/.test(raw)) return { configured: true };
-	return {
-		configured: true,
-		value: Number(raw)
-	};
+/** Reads the plan-authoritative workflow policy metadata from managed configuration. */
+function readManagedWorkflowPolicy(input) {
+	const raw = new RegExp(`^${WORKFLOW_POLICY_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(.+)$`, "m").exec(input)?.[1];
+	if (raw === void 0) return void 0;
+	try {
+		const value = JSON.parse(raw);
+		if (typeof value !== "object" || value === null) return void 0;
+		const record = value;
+		const plan = PLAN_NAMES.find((name) => name === record.plan);
+		const limits = record.limits;
+		const usage = record.projectedUsage;
+		const runtime = record.runtime;
+		const size = record.softSizeGuidance;
+		if (plan === void 0 || typeof limits !== "object" || limits === null || typeof usage !== "object" || usage === null || typeof runtime !== "object" || runtime === null || typeof size !== "object" || size === null) return void 0;
+		return {
+			plan,
+			limits,
+			projectedUsage: usage,
+			runtime,
+			softSizeGuidance: size
+		};
+	} catch {
+		return;
+	}
 }
 /** Identifies explicit Root route overrides preserved from active managed configuration. */
 function readPreservedRootOverrides(input) {
@@ -5320,7 +5825,7 @@ function mergedStatusLine(original) {
 	return `[${items.map((item) => JSON.stringify(item)).join(", ")}]`;
 }
 /** Installs config. */
-function installConfig(input, mode, _platform, plan = DEFAULT_PLAN, maxSubagents, fastMode = "standard") {
+function installConfig(input, mode, _platform, plan = DEFAULT_PLAN, _legacyMaxSubagents, fastMode = "standard") {
 	const request = normalizeRequestedAutonomy(mode);
 	const priorAutonomy = readAutonomyMetadata(input);
 	const previousOriginalRoot = readOriginalRootMetadata(input);
@@ -5366,17 +5871,22 @@ function installConfig(input, mode, _platform, plan = DEFAULT_PLAN, maxSubagents
 	const hasModel = /^\s*model\s*=/m.test(preservedRoot);
 	const hasEffort = /^\s*model_reasoning_effort\s*=/m.test(preservedRoot);
 	const rootRoute = MODEL_ROUTING_PLANS[plan].root;
-	const effectiveMaxSubagents = maxSubagents ?? MODEL_ROUTING_PLANS[plan].usage.maxSubagents;
 	const model = hasModel ? "" : `model = "${rootRoute.model}"\n`;
 	const effort = hasEffort ? "" : `model_reasoning_effort = "${rootRoute.reasoningEffort}"\n`;
 	const originalSource = previousOriginalRoot === void 0 ? priorAutonomy === void 0 && legacyGeneratedRoot === void 0 ? originalControlled : "" : removePermissionLines(previousOriginalRoot);
 	const original = originalSource ? `${ORIGINAL_ROOT}${Buffer.from(originalSource).toString("base64")}\n` : "";
-	const maxSubagentsMetadata = maxSubagents === void 0 ? "" : `${MAX_SUBAGENTS_PREFIX}${maxSubagents}\n`;
 	const rootServiceTier = fastMode === "fast-all" ? "fast" : "default";
 	const priorManagedRoot = new RegExp(`^${START}\\r?\\n([\\s\\S]*?)^${END}\\r?$`, "m").exec(input)?.[1];
 	const webSearch = readPreservedRootOverrides(input).webSearch ? rootTomlString(priorManagedRoot ?? "", "web_search") ?? "live" : "live";
 	const statusLine = mergedStatusLine(rootValue(root, "status_line") ?? rootTomlStringArraySource(tableSource(base, "tui") ?? "", "status_line"));
-	const rootBlock = `${START}\n${PLAN_PREFIX}${plan}\n${FAST_MODE_PREFIX}${fastMode}\n${AUTONOMY_METADATA_PREFIX}${effectiveAutonomy}\n${maxSubagentsMetadata}${original}${originalPermissionMetadata(permissionLines)}${model}${effort}web_search = ${JSON.stringify(webSearch)}\nmodel_verbosity = "low"\nservice_tier = "${rootServiceTier}"\n${rootPermissionLines.join("\n")}\n${END}`;
+	const workflow = MODEL_ROUTING_PLANS[plan].workflow;
+	const rootBlock = `${START}\n${PLAN_PREFIX}${plan}\n${FAST_MODE_PREFIX}${fastMode}\n${WORKFLOW_POLICY_PREFIX}${JSON.stringify({
+		plan,
+		limits: workflow.limits,
+		projectedUsage: workflow.projectedUsage,
+		runtime: workflow.runtime,
+		softSizeGuidance: workflow.softSizeGuidance
+	})}\n${AUTONOMY_METADATA_PREFIX}${effectiveAutonomy}\n${original}${originalPermissionMetadata(permissionLines)}${model}${effort}web_search = ${JSON.stringify(webSearch)}\nmodel_verbosity = "low"\nservice_tier = "${rootServiceTier}"\n${rootPermissionLines.join("\n")}\n${END}`;
 	let configured = `${preservedRoot ? `${preservedRoot}\n` : ""}${rootBlock}${tables ? `\n\n${tables}` : ""}`;
 	const legacyMultiAgentV2 = /\bmulti_agent_v2\s*=\s*(true|false)/.exec(configured)?.[1];
 	configured = injectTableKeys(configured, "features", [
@@ -5384,8 +5894,7 @@ function installConfig(input, mode, _platform, plan = DEFAULT_PLAN, maxSubagents
 		["multi_agent", "true"],
 		...legacyMultiAgentV2 === void 0 ? [] : [["multi_agent_v2", legacyMultiAgentV2]]
 	]);
-	const usage = MODEL_ROUTING_PLANS[plan].usage;
-	configured = injectTableKeys(configured, "agents", [["max_concurrent_threads_per_session", String(effectiveMaxSubagents + 1)], ["max_depth", String(usage.maxDepth)]]);
+	configured = injectTableKeys(configured, "agents", [["max_concurrent_threads_per_session", String(workflow.limits.concurrency + 1)]]);
 	configured = injectTableKeys(configured, "tui", [["status_line", statusLine]]);
 	if (effectiveAutonomy !== "dangerous") configured = injectTableKeys(configured, "sandbox_workspace_write", [["network_access", "true"]]);
 	configured = injectTableKeys(configured, "desktop", [["show-context-window-usage", "true"]]);
@@ -5479,6 +5988,7 @@ function executableOnPath(name) {
 }
 //#endregion
 //#region packages/cli/src/doctor.ts
+var DOCTOR_LSP_IDLE_SHUTDOWN_MS = 1e3;
 var COMPATIBILITY_KEYS = ["desktop.show-context-window-usage"];
 async function runCommand(name, args, env) {
 	const result = await runManagedProcess({
@@ -5569,7 +6079,7 @@ async function doctor(home = process.env.CODEX_HOME ?? join(homedir(), ".codex")
 		"--json"
 	], {
 		...process.env,
-		HOLYCODEX_LSP_IDLE_SHUTDOWN_MS: "0",
+		HOLYCODEX_LSP_IDLE_SHUTDOWN_MS: String(DOCTOR_LSP_IDLE_SHUTDOWN_MS),
 		HOLYCODEX_LSP_IDLE_CHECK_INTERVAL_MS: "50"
 	});
 	checks.push(lsp.ok ? check("lsp", "ok", "lsp-cli-ready", "The LSP CLI and daemon are reachable.") : check("lsp", "error", "lsp-cli-failed", lsp.output || "LSP CLI failed.", "Reinstall HolyCodex and inspect the reported daemon log."));
@@ -5580,8 +6090,19 @@ async function doctor(home = process.env.CODEX_HOME ?? join(homedir(), ".codex")
 	const plan = readManagedPlan(config);
 	const overrides = readPreservedRootOverrides(config);
 	const fast = readManagedFastMode(config);
-	const max = readManagedMaxSubagents(config);
-	checks.push(plan === void 0 ? check("routes", "error", "route-plan-missing", "Managed route plan metadata is missing.", "Reinstall HolyCodex.") : check("routes", "ok", "routes-ready", `${plan} routes are active${max.configured ? ` with max-subagents=${max.value ?? "invalid"}` : ""}.`));
+	const workflow = readManagedWorkflowPolicy(config);
+	checks.push(plan === void 0 ? check("routes", "error", "route-plan-missing", "Managed route plan metadata is missing.", "Reinstall HolyCodex.") : check("routes", "ok", "routes-ready", `${plan} workflow policy is active with permitted stage routes.`));
+	checks.push(plan === void 0 || workflow === void 0 ? check("workflow", "error", "workflow-settings-missing", "Managed workflow settings are missing or invalid.", "Reinstall HolyCodex.") : JSON.stringify(workflow) === JSON.stringify({
+		plan,
+		limits: MODEL_ROUTING_PLANS[plan].workflow.limits,
+		projectedUsage: MODEL_ROUTING_PLANS[plan].workflow.projectedUsage,
+		runtime: MODEL_ROUTING_PLANS[plan].workflow.runtime,
+		softSizeGuidance: MODEL_ROUTING_PLANS[plan].workflow.softSizeGuidance
+	}) ? check("workflow", "ok", "workflow-settings-ready", `${plan} workflow limits, projected usage, runtime, and size guidance match the catalog.`) : check("workflow", "error", "workflow-settings-drift", `${plan} workflow settings do not match the authoritative catalog.`, "Reinstall HolyCodex."));
+	checks.push(missing.includes("runtime/workflow.js") ? check("workflow-runtime", "error", "workflow-runtime-missing", "The isolated workflow runtime is missing.", "Reinstall HolyCodex.") : check("workflow-runtime", "ok", "workflow-runtime-ready", "The isolated workflow runtime is present."));
+	const manifest = await readFile(join(pluginRoot, ".codex-plugin", "plugin.json"), "utf8").catch(() => "");
+	const mcpManifest = await access(join(pluginRoot, ".mcp.json")).then(() => true).catch(() => false);
+	checks.push(!mcpManifest && !manifest.includes("mcpServers") && !manifest.includes("MCP Tools") ? check("mcp", "ok", "mcp-free", "The installation does not declare MCP servers or tools.") : check("mcp", "error", "mcp-declared", "The installation declares MCP servers or tools.", "Reinstall HolyCodex from a MCP-free package."));
 	checks.push(overrides.model || overrides.reasoningEffort ? check("root-overrides", "ok", "root-overrides-preserved", "Intentional Root model or reasoning overrides are preserved and healthy.") : check("root-overrides", "ok", "root-managed-defaults", "Root uses managed route defaults."));
 	if (plan !== void 0 && fast === void 0) checks.push(check("fast", "warning", "fast-metadata-missing", "Fast metadata is missing; doctor will not guess a service tier.", "Reinstall with an explicit Fast mode."));
 	if (plan !== void 0) for (const agent of AGENTS) {
@@ -5743,8 +6264,14 @@ function deduplicate(candidates) {
 }
 //#endregion
 //#region packages/cli/src/codex-security.ts
-var CODEX_SECURITY_PLUGIN = "codex-security@openai-curated";
-var CODEX_SECURITY_MARKETPLACE = "openai-curated";
+var CODEX_SECURITY_PLUGIN = {
+	id: "codex-security@openai-curated",
+	marketplace: "openai-curated"
+};
+var COMPUTER_USE_PLUGIN = {
+	id: "computer-use@openai-bundled",
+	marketplace: "openai-bundled"
+};
 var CODEX_PLUGIN_OPERATIONAL_TIMEOUT_MS = 15e3;
 var CODEX_PACKAGE_BOOTSTRAP_TIMEOUT_MS = 12e4;
 var MAX_CODEX_CATALOG_DIAGNOSTIC_CHARS = 256 * 1024;
@@ -5785,6 +6312,14 @@ var FATAL_POLICY_CODES = /* @__PURE__ */ new Set([
 ]);
 /** Installs or enables the official Codex Security plugin without failing HolyCodex installation. */
 async function installCodexSecurity(runProcess = runManagedProcess, platform = process.platform, env = process.env, options = {}) {
+	return installOfficialPlugin(CODEX_SECURITY_PLUGIN, runProcess, platform, env, options);
+}
+/** Installs or enables the official Computer Use plugin without failing HolyCodex installation. */
+async function installComputerUse(runProcess = runManagedProcess, platform = process.platform, env = process.env, options = {}) {
+	return installOfficialPlugin(COMPUTER_USE_PLUGIN, runProcess, platform, env, options);
+}
+/** Installs or enables one official Codex plugin through a verified catalog entry. */
+async function installOfficialPlugin(plugin, runProcess = runManagedProcess, platform = process.platform, env = process.env, options = {}) {
 	const runtimeFacts = options.runtimeFacts ?? (runProcess === runManagedProcess ? defaultCodexLauncherRuntimeFacts(platform) : void 0);
 	const candidates = createCodexLauncherCandidates({
 		...options.injected === void 0 ? {} : { injected: options.injected },
@@ -5804,7 +6339,7 @@ async function installCodexSecurity(runProcess = runManagedProcess, platform = p
 			continue;
 		}
 		if (installedOutcome.kind === "fatal") return skipped(installedOutcome.reason, attemptedLaunchers);
-		const installedPlugin = findPlugin(installedOutcome.catalog);
+		const installedPlugin = findPlugin(installedOutcome.catalog, plugin.id);
 		if (installedPlugin?.installed === true && installedPlugin.enabled === true) return {
 			status: "already-installed",
 			launcherSource: launcher.source
@@ -5822,7 +6357,7 @@ async function installCodexSecurity(runProcess = runManagedProcess, platform = p
 				continue;
 			}
 			if (catalogOutcome.kind === "fatal") return skipped(catalogOutcome.reason, attemptedLaunchers);
-			if (findPlugin(catalogOutcome.catalog) === void 0) {
+			if (findPlugin(catalogOutcome.catalog, plugin.id) === void 0) {
 				const marketplaceOutcome = inspectMarketplaceResult(await runCodexPlugin(runProcess, launcher, [
 					"plugin",
 					"marketplace",
@@ -5834,14 +6369,14 @@ async function installCodexSecurity(runProcess = runManagedProcess, platform = p
 					continue;
 				}
 				if (marketplaceOutcome.kind === "fatal") return skipped(marketplaceOutcome.reason, attemptedLaunchers);
-				fallbackReasons.push(marketplaceOutcome.marketplaces.includes(CODEX_SECURITY_MARKETPLACE) ? "plugin-not-offered" : "marketplace-unavailable");
+				fallbackReasons.push(marketplaceOutcome.marketplaces.includes(plugin.marketplace) ? "plugin-not-offered" : "marketplace-unavailable");
 				continue;
 			}
 		}
 		const addOutcome = inspectAddResult(await runCodexPlugin(runProcess, launcher, [
 			"plugin",
 			"add",
-			CODEX_SECURITY_PLUGIN,
+			plugin.id,
 			"--json"
 		], platform, env, "add"), launcher);
 		if (addOutcome.kind === "fallback") {
@@ -5859,7 +6394,7 @@ async function installCodexSecurity(runProcess = runManagedProcess, platform = p
 			continue;
 		}
 		if (verification.kind === "fatal") return skipped(verification.reason, attemptedLaunchers);
-		const verifiedPlugin = findPlugin(verification.catalog);
+		const verifiedPlugin = findPlugin(verification.catalog, plugin.id);
 		if (verifiedPlugin?.installed !== true || verifiedPlugin.enabled !== true) {
 			fallbackReasons.push("verification-failed");
 			continue;
@@ -5946,8 +6481,8 @@ function inspectMarketplaceResult(result, launcher) {
 		marketplaces
 	};
 }
-function findPlugin(catalog) {
-	return catalog.plugins.find(({ id }) => id === CODEX_SECURITY_PLUGIN);
+function findPlugin(catalog, pluginId) {
+	return catalog.plugins.find(({ id }) => id === pluginId);
 }
 function classifyFailure(result, launcher) {
 	if (result.error !== void 0) {
@@ -6313,10 +6848,13 @@ function assertGitBashReady(platform, resolution) {
 }
 /** Provides install. */
 async function install(options, runtime = defaultRuntime) {
+	notify(options, "prerequisites", "Checking prerequisites", "running");
 	assertGitBashReady(runtime.platform, runtime.gitBash());
+	notify(options, "prerequisites", "Checking prerequisites", "complete");
 	const plan = options.plan ?? "plus";
 	const target = paths();
 	const root = backupRoot();
+	notify(options, "backup", "Backing up existing installation", "running");
 	const configBackup = await backup(target.config, root);
 	const cacheBackup = await backup(target.marketplaceCache, root);
 	const agentsBackup = await backup(target.agents, root);
@@ -6326,10 +6864,14 @@ async function install(options, runtime = defaultRuntime) {
 		agentsBackup,
 		...await Promise.all(target.legacy.map((path) => backup(path, root)))
 	].filter((path) => path !== void 0);
+	notify(options, "backup", "Backing up existing installation", "complete", `${backups.length} saved`);
+	notify(options, "configuration", "Preparing configuration", "running");
 	const existingConfig = await readText(target.config);
 	const previousPlan = readManagedPlan(existingConfig);
 	const fastMode = options.fast ?? "standard";
 	const config = installConfig(existingConfig, options.autonomy, runtime.platform, plan, options.maxSubagents, fastMode);
+	notify(options, "configuration", "Preparing configuration", "complete", plan);
+	notify(options, "staging", "Staging plugin and agent files", "running");
 	const existingAgentPreferences = await readAgentPreferences(target.agents, previousPlan);
 	const staging = await mkdtemp(join(tmpdir(), "holycodex-stage-"));
 	const stagedCache = join(staging, "cache");
@@ -6339,10 +6881,15 @@ async function install(options, runtime = defaultRuntime) {
 	await cp(join(pluginRoot, "agents"), stagedAgents, { recursive: true });
 	await writeInstalledAgents(stagedAgents, runtime.platform, plan, fastMode);
 	await preserveAgentPreferences(stagedAgents, existingAgentPreferences, plan, fastMode);
+	notify(options, "staging", "Staging plugin and agent files", "complete");
+	notify(options, "validation", "Validating staged installation", "running");
 	await validateStaging(stagedCache, stagedAgents);
+	notify(options, "validation", "Validating staged installation", "complete");
 	const removedLegacy = [];
 	let codexSecurity;
+	let computerUse;
 	try {
+		notify(options, "managed-files", "Installing managed files", "running");
 		await atomicWrite(target.config, config);
 		await rm(target.cache, {
 			recursive: true,
@@ -6360,8 +6907,16 @@ async function install(options, runtime = defaultRuntime) {
 			await rm(path, { recursive: true });
 			removedLegacy.push(path);
 		}
+		notify(options, "managed-files", "Installing managed files", "complete");
+		notify(options, "codex-security", "Installing Codex Security", "running");
 		codexSecurity = await installCodexSecurity(runtime.runProcess, runtime.platform, process.env);
+		notify(options, "codex-security", "Installing Codex Security", "complete", pluginProgressDetail(codexSecurity));
+		notify(options, "computer-use", "Installing Computer Use", "running");
+		computerUse = await installComputerUse(runtime.runProcess, runtime.platform, process.env);
+		notify(options, "computer-use", "Installing Computer Use", "complete", pluginProgressDetail(computerUse));
+		notify(options, "cleanup", "Removing obsolete caches", "running");
 		await removeObsoleteVersionCaches(target.cacheRoot);
+		notify(options, "cleanup", "Removing obsolete caches", "complete");
 	} catch (error) {
 		await restoreTarget(target.config, configBackup);
 		await restoreTarget(target.marketplaceCache, cacheBackup);
@@ -6385,9 +6940,21 @@ async function install(options, runtime = defaultRuntime) {
 		backups,
 		plan,
 		codexSecurity,
-		...options.maxSubagents === void 0 ? {} : { maxSubagents: options.maxSubagents }
+		computerUse
 	};
 }
+function notify(options, step, label, status, detail) {
+	options.onProgress?.({
+		step,
+		label,
+		status,
+		...detail === void 0 ? {} : { detail }
+	});
+}
+function pluginProgressDetail(result) {
+	if (result.status === "skipped") return `skipped: ${result.reason}`;
+	return result.launcherSource === void 0 ? result.status : `${result.status} via ${result.launcherSource}`;
+}
 async function validateStaging(cache, agents) {
 	const required = [
 		join(cache, ".codex-plugin", "plugin.json"),
@@ -6408,7 +6975,7 @@ async function restoreTarget(target, source) {
 }
 async function removeObsoleteVersionCaches(cacheRoot) {
 	if (!await exists(cacheRoot)) return;
-	for (const entry of await readdir(cacheRoot)) if (entry !== "0.11.2") await rm(join(cacheRoot, entry), {
+	for (const entry of await readdir(cacheRoot)) if (entry !== "0.11.3-dev.157.1") await rm(join(cacheRoot, entry), {
 		recursive: true,
 		force: true
 	});
@@ -6577,17 +7144,21 @@ function renderHelp(version, color) {
 	const title = paint(color, `${BOLD}${CYAN}`, `HolyCodex ${version}`);
 	const section = (text) => paint(color, BOLD, text);
 	const muted = (text) => paint(color, DIM, text);
-	return `${title}\n${muted("Lean Codex toolkit installer and doctor")}\n\n${section("USAGE")}\n  holycodex <command> [options]\n\n${section("COMMANDS")}\n  install                         Install or update HolyCodex\n  cleanup                         Remove HolyCodex-owned state\n  doctor                          Diagnose installation and runtime\n\n${section("OPTIONS")}\n  --plan <plan>                   Model routing plan for install: ${PLAN_HELP}\n                                   Default: ${DEFAULT_PLAN}\n  --max-subagents <count>          Override concurrent direct subagents for install\n  --fast                          Use Fast for generated subagents only\n  --fast-all                      Use Fast for Root and generated subagents\n  --no-fast                       Use Standard for Root and generated subagents\n  -h, --help                      Show help\n  -v, --version                   Show version\n  --no-tui                        Accepted; commands remain noninteractive\n  --codex-autonomous              Never ask; keep workspace sandbox\n  --no-codex-autonomous           Safe interactive defaults\n  --dangerous-codex-autonomous    Never ask; disable filesystem sandbox\n  --json                          Print machine-readable output\n`;
+	return `${title}\n${muted("Lean Codex toolkit installer and doctor")}\n\n${section("USAGE")}\n  holycodex <command> [options]\n\n${section("COMMANDS")}\n  install                         Install or update HolyCodex\n  cleanup                         Remove HolyCodex-owned state\n  doctor                          Diagnose installation and runtime\n\n${section("OPTIONS")}\n  --plan <plan>                   Model routing plan for install: ${PLAN_HELP}\n                                   Default: ${DEFAULT_PLAN}\n  --max-subagents <count>          Override concurrent direct subagents for install\n  --fast                          Use Fast for generated subagents only\n  --fast-all                      Use Fast for Root and generated subagents\n  --no-fast                       Use Standard for Root and generated subagents\n  -h, --help                      Show help\n  -v, --version                   Show version\n  --no-tui                        Accepted; commands remain noninteractive\n  --codex-autonomous              Never ask; keep workspace sandbox\n  --no-codex-autonomous           Safe interactive defaults\n  --dangerous-codex-autonomous    Never ask; disable filesystem sandbox\n  install --verbose              Show detailed install steps
+  --json                          Print machine-readable output\n`;
 }
 /** Renders install-specific model plan and option help. */
 function renderInstallHelp(version, color) {
 	const title = paint(color, `${BOLD}${CYAN}`, `HolyCodex ${version}`);
 	const section = (text) => paint(color, BOLD, text);
-	return `${title}\n\n${section("Usage:")}\n  holycodex install [options]\n\n${section("Options:")}\n  --plan <plan>                   Model routing plan: ${PLAN_HELP}\n                                   Default: ${DEFAULT_PLAN}\n  --max-subagents <count>          Override concurrent direct subagents\n  --fast                          Use Fast for generated subagents only\n  --fast-all                      Use Fast for Root and generated subagents\n  --no-fast                       Use Standard for Root and generated subagents\n  --json                          Print machine-readable output\n  --no-tui                        Accepted; install remains noninteractive\n  --codex-autonomous              Never ask; keep workspace sandbox\n  --no-codex-autonomous           Safe interactive defaults\n  --dangerous-codex-autonomous    Never ask; disable filesystem sandbox\n  -h, --help                      Show help\n\nPlans provide increasing expected model usage and capability. Fast flags are mutually exclusive.\n\n${section("Examples:")}\n  bunx holycodex install\n  bunx holycodex install --plan go\n  bunx holycodex install --plan plus-low --fast\n  bunx holycodex install --plan plus-high\n  bunx holycodex install --plan pro-5x --fast-all\n  bunx holycodex install --plan pro-20x --no-fast\n`;
+	return `${title}\n\n${section("Usage:")}\n  holycodex install [options]\n\n${section("Options:")}\n  --plan <plan>                   Model routing plan: ${PLAN_HELP}\n                                   Default: ${DEFAULT_PLAN}\n  --max-subagents <count>          Override concurrent direct subagents\n  --fast                          Use Fast for generated subagents only\n  --fast-all                      Use Fast for Root and generated subagents\n  --no-fast                       Use Standard for Root and generated subagents\n  -v, --verbose                   Show detailed install steps
+  --json                          Print machine-readable output\n  --no-tui                        Accepted; install remains noninteractive\n  --codex-autonomous              Never ask; keep workspace sandbox\n  --no-codex-autonomous           Safe interactive defaults\n  --dangerous-codex-autonomous    Never ask; disable filesystem sandbox\n  -h, --help                      Show help\n\nPlans provide increasing expected model usage and capability. Fast flags are mutually exclusive.\n\n${section("Examples:")}\n  bunx holycodex install\n  bunx holycodex install --plan go\n  bunx holycodex install --plan plus-low --fast\n  bunx holycodex install --plan plus-high\n  bunx holycodex install --plan pro-5x --fast-all\n  bunx holycodex install --plan pro-20x --no-fast\n`;
 }
 /** Renders error. */
 function renderError(message, color) {
-	return `${paint(color, `${BOLD}${RED}`, "✗ ERROR")}  ${message}\n  ${paint(color, DIM, "Run holycodex --help for usage.")}\n`;
+	const label = paint(color, `${BOLD}${RED}`, "✗ ERROR");
+	const hint = paint(color, DIM, "Run holycodex --help for usage.");
+	return `${color ? "\r\x1B[2K" : ""}${label}  ${message}\n  ${hint}\n`;
 }
 /** Renders doctor. */
 function renderDoctor(result, color) {
@@ -6603,14 +7174,17 @@ function renderRunResult(result, color) {
 	const action = result.action === "install" ? "Updated" : "Removed";
 	const empty = result.action === "install" ? "changes" : "removal";
 	const backup = result.backups.length === 0 ? "" : `\n  Existing HolyCodex files were backed up before ${result.action === "install" ? "replacement" : "cleanup"}.`;
-	return `${title}\n  ${result.changed.length === 0 ? `No HolyCodex-managed files needed ${empty}.` : `${action} HolyCodex configuration, plugin files, and agent profiles.`}${backup}${renderCodexSecurity(result)}\n`;
+	return `${title}\n  ${result.changed.length === 0 ? `No HolyCodex-managed files needed ${empty}.` : `${action} HolyCodex configuration, plugin files, and agent profiles.`}${backup}${renderOfficialPlugins(result)}\n`;
+}
+function renderOfficialPlugins(result) {
+	return [renderOfficialPlugin("Codex Security", result.codexSecurity), renderOfficialPlugin("Computer Use", result.computerUse)].join("");
 }
-function renderCodexSecurity(result) {
-	if (result.codexSecurity === void 0) return "";
-	if (result.codexSecurity.status === "installed") return "\n  Installed official Codex Security plugin.";
-	if (result.codexSecurity.status === "enabled") return "\n  Enabled existing official Codex Security plugin.";
-	if (result.codexSecurity.status === "already-installed") return "\n  Official Codex Security plugin is already installed and enabled.";
-	return `\n  Skipped official Codex Security plugin: ${CODEX_SECURITY_SKIP_MESSAGES[result.codexSecurity.reason]}`;
+function renderOfficialPlugin(name, plugin) {
+	if (plugin === void 0) return "";
+	if (plugin.status === "installed") return `\n  Installed official ${name} plugin.`;
+	if (plugin.status === "enabled") return `\n  Enabled existing official ${name} plugin.`;
+	if (plugin.status === "already-installed") return `\n  Official ${name} plugin is already installed and enabled.`;
+	return `\n  Skipped official ${name} plugin: ${CODEX_SECURITY_SKIP_MESSAGES[plugin.reason]}`;
 }
 var CODEX_SECURITY_SKIP_MESSAGES = {
 	"codex-unavailable": "no usable Codex launcher was found.",
@@ -6626,6 +7200,13 @@ var CODEX_SECURITY_SKIP_MESSAGES = {
 	unsupported: "the available Codex launchers do not support plugin installation.",
 	"download-failed": "the latest Codex package could not be downloaded."
 };
+/** Renders one concise installation progress transition. */
+function renderInstallProgress(event, color, isTTY, verbose) {
+	const detail = verbose && event.detail !== void 0 ? `  ${paint(color, DIM, event.detail)}` : "";
+	if (event.status === "running") return isTTY ? `\r${paint(color, CYAN, "●")} ${event.label}` : "";
+	const line = `${paint(color, GREEN, "✓")} ${event.label}${detail}`;
+	return isTTY ? `\r\u001B[2K${line}\n` : `  ${line}\n`;
+}
 /** Renders notice. */
 function renderNotice(kind, message, color) {
 	return `${paint(color, kind === "warning" ? RED : YELLOW, `! ${kind === "warning" ? "WARNING" : "NOTICE"}`)}  ${message}\n`;
@@ -6649,6 +7230,8 @@ async function main() {
 		fast: parsed.fast,
 		json: parsed.json,
 		plan: parsed.plan,
+		verbose: parsed.verbose,
+		...parsed.command === "install" && !parsed.json ? { onProgress: (event) => process$1.stdout.write(renderInstallProgress(event, stdoutColor, process$1.stdout.isTTY === true, parsed.verbose)) } : {},
 		...parsed.maxSubagents === void 0 ? {} : { maxSubagents: parsed.maxSubagents }
 	};
 	if (parsed.command === "doctor") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "holycodex",
-  "version": "0.11.2",
+  "version": "0.11.3-dev.157.1",
   "description": "Lean Codex-only agent toolkit installer and doctor",
   "keywords": [
     "agents",
@@ -39,9 +39,13 @@
     "prepack": "vp run --workspace-root build"
   },
   "dependencies": {
-    "@holycodex/plugin": "0.11.2",
+    "@holycodex/plugin": "0.11.3-dev.157.1",
     "zod": "^4.4.3"
   },
+  "devDependencies": {
+    "@holycodex/workflow-host": "workspace:*",
+    "@holycodex/workflow-runtime": "workspace:*"
+  },
   "engines": {
     "node": ">=26 <27"
   }