holycodex 0.5.2 → 0.6.1-dev.29547206710.2

package/dist/cli.js

@@ -0,0 +1,834 @@
+import process$1 from "node:process";
+import { access, copyFile, cp, lstat, mkdir, readFile, readdir, readlink, rename, rm, stat, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { pluginRoot } from "@holycodex/plugin";
+import { Buffer } from "node:buffer";
+//#region packages/cli/src/catalog.ts
+var VERSION = "0.6.1-dev.29547206710.2";
+var SKILLS = [
+	"ast-grep",
+	"caveman",
+	"compress",
+	"debugging",
+	"define-goal",
+	"frontend",
+	"handoff",
+	"lsp",
+	"lsp-setup",
+	"plan",
+	"plan-review",
+	"programming",
+	"refactor",
+	"remove-slop",
+	"rules",
+	"security-research"
+];
+var AGENTS = [
+	"explorer",
+	"librarian",
+	"worker"
+];
+var ROOT_MODEL = {
+	model: "gpt-5.6-sol",
+	reasoningEffort: "medium"
+};
+var AGENT_MODELS = {
+	explorer: {
+		model: "gpt-5.6-luna",
+		reasoningEffort: "low"
+	},
+	librarian: {
+		model: "gpt-5.6-luna",
+		reasoningEffort: "low"
+	},
+	worker: {
+		model: "gpt-5.6-terra",
+		reasoningEffort: "high"
+	}
+};
+var MANAGED_AGENT_MODEL_HISTORY = {
+	explorer: [{
+		model: "gpt-5.6-luna",
+		reasoningEffort: "low"
+	}],
+	librarian: [{
+		model: "gpt-5.6-luna",
+		reasoningEffort: "low"
+	}],
+	worker: [{
+		model: "gpt-5.6-luna",
+		reasoningEffort: "medium"
+	}, {
+		model: "gpt-5.6-terra",
+		reasoningEffort: "high"
+	}]
+};
+var GENERATED_RUNTIMES = [
+	"bootstrap.js",
+	"core-instructions.js",
+	"git-bash.js",
+	"git-bash-resolver.js",
+	"LICENSE-LSP-MIT.txt",
+	"lsp.js",
+	"mcp-stdio-core.js",
+	"rules.js"
+];
+var WINDOWS_SHELL_POLICY = "On native Windows, before the first shell action, inspect callable and deferred tools until `mcp__git_bash__run` is resolved. Use it for every shell command, including Git, Bash, POSIX, package, build, test, and script commands. If unavailable, stop and report the blocker. Never fall back to PowerShell or cmd.";
+function effectiveMcpServers(platform) {
+	return {
+		...platform === "win32" ? { git_bash: {
+			command: "node",
+			args: ["runtime/git-bash.js", "mcp"],
+			cwd: ".",
+			enabled_tools: ["run"]
+		} } : {},
+		lsp: {
+			command: "node",
+			args: ["runtime/lsp.js", "mcp"],
+			cwd: "."
+		},
+		context7: {
+			command: "bunx",
+			args: ["@upstash/context7-mcp"]
+		}
+	};
+}
+function requiredPackageRuntimes(platform) {
+	return platform === "win32" ? GENERATED_RUNTIMES : GENERATED_RUNTIMES.filter((file) => file !== "git-bash.js" && file !== "git-bash-resolver.js");
+}
+//#endregion
+//#region packages/git-bash-mcp/src/git-bash-resolver.ts
+var GIT_BASH_ENV_KEY = "HOLYCODEX_GIT_BASH_PATH";
+var PROGRAM_FILES = "C:\\Program Files\\Git\\bin\\bash.exe";
+var PROGRAM_FILES_X86 = "C:\\Program Files (x86)\\Git\\bin\\bash.exe";
+var INVALID_LAUNCHERS = ["\\windows\\system32\\", "\\microsoft\\windowsapps\\"];
+function resolveGitBash(input) {
+	if (input.platform !== "win32") return {
+		found: true,
+		path: null,
+		source: "not-required",
+		checkedPaths: []
+	};
+	const checkedPaths = [];
+	const configured = input.env[GIT_BASH_ENV_KEY]?.trim();
+	if (configured) {
+		checkedPaths.push(configured);
+		return isBash(configured) && input.exists(configured) ? {
+			found: true,
+			path: configured,
+			source: "env",
+			checkedPaths
+		} : missing(checkedPaths);
+	}
+	for (const candidate of [{
+		path: PROGRAM_FILES,
+		source: "program-files"
+	}, {
+		path: PROGRAM_FILES_X86,
+		source: "program-files-x86"
+	}]) {
+		checkedPaths.push(candidate.path);
+		if (input.exists(candidate.path)) return {
+			found: true,
+			path: candidate.path,
+			source: candidate.source,
+			checkedPaths
+		};
+	}
+	for (const raw of input.where("bash")) {
+		const candidate = raw.trim();
+		if (!candidate) continue;
+		checkedPaths.push(candidate);
+		const normalized = candidate.replaceAll("/", "\\").toLowerCase();
+		if (INVALID_LAUNCHERS.some((part) => normalized.includes(part))) continue;
+		if (isBash(candidate) && input.exists(candidate)) return {
+			found: true,
+			path: candidate,
+			source: "path",
+			checkedPaths
+		};
+	}
+	return missing(checkedPaths);
+}
+function resolveGitBashForCurrentProcess(input = {}) {
+	return resolveGitBash({
+		platform: input.platform ?? process.platform,
+		env: input.env ?? process.env,
+		exists: existsSync,
+		where: (command) => {
+			try {
+				return execFileSync("where", [command], { encoding: "utf8" }).split(/\r?\n/).filter(Boolean);
+			} catch (error) {
+				if (error instanceof Error) return [];
+				throw error;
+			}
+		}
+	});
+}
+function isBash(path) {
+	return path.toLowerCase().endsWith("bash.exe");
+}
+function missing(checkedPaths) {
+	return {
+		found: false,
+		checkedPaths,
+		installHint: `Git Bash required. Install: winget install --id Git.Git -e --source winget\nCustom path: set ${GIT_BASH_ENV_KEY}=C:\\path\\to\\bash.exe`
+	};
+}
+//#endregion
+//#region packages/mcp-stdio-core/src/process.ts
+var TRUNCATED_MARKER = "\n... diagnostic output truncated ...\n";
+async function runManagedProcess(input) {
+	return await new Promise((resolve) => {
+		const child = spawn(input.command, [...input.args], {
+			...input.cwd === void 0 ? {} : { cwd: input.cwd },
+			...input.env === void 0 ? {} : { env: input.env },
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true,
+			detached: input.platform !== "win32"
+		});
+		let stdout = {
+			head: "",
+			tail: "",
+			truncated: false
+		};
+		let stderr = {
+			head: "",
+			tail: "",
+			truncated: false
+		};
+		let timedOut = false;
+		let matched = false;
+		let settled = false;
+		let terminationFallback;
+		const finish = (exitCode, error) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timeout);
+			if (terminationFallback !== void 0) clearTimeout(terminationFallback);
+			resolve({
+				exitCode,
+				stdout: outputText(stdout),
+				stderr: outputText(stderr),
+				timedOut,
+				matched,
+				outputTruncated: stdout.truncated || stderr.truncated,
+				...error === void 0 ? {} : { error }
+			});
+		};
+		const terminate = () => {
+			killProcessTree(child, input.platform);
+			terminationFallback ??= setTimeout(() => finish(child.exitCode), 2e3);
+			terminationFallback.unref();
+		};
+		const inspectMatch = () => {
+			if (matched || input.matchOutput === void 0) return;
+			if (input.matchOutput(`${outputText(stdout)}\n${outputText(stderr)}`)) {
+				matched = true;
+				terminate();
+			}
+		};
+		child.stdout.on("data", (chunk) => {
+			stdout = appendOutput(stdout, chunk.toString(), input.maxOutputChars);
+			inspectMatch();
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr = appendOutput(stderr, chunk.toString(), input.maxOutputChars);
+			inspectMatch();
+		});
+		child.once("error", (error) => finish(null, error.message));
+		child.once("close", (code) => finish(code));
+		const timeout = setTimeout(() => {
+			timedOut = true;
+			terminate();
+		}, input.timeoutMs);
+		timeout.unref();
+		if (input.stdin === void 0) child.stdin.end();
+		else child.stdin.end(input.stdin);
+	});
+}
+function killProcessTree(child, platform, signal = "SIGTERM", runTaskkill = (command, args) => spawnSync(command, [...args], {
+	stdio: "ignore",
+	windowsHide: true
+})) {
+	if (platform === "win32" && child.pid !== void 0) {
+		const result = runTaskkill("taskkill", [
+			"/pid",
+			String(child.pid),
+			"/f",
+			"/t"
+		]);
+		if (result.error === void 0 && result.status === 0) return;
+	}
+	if (platform !== "win32" && child.pid !== void 0) try {
+		process.kill(-child.pid, signal);
+		return;
+	} catch {}
+	try {
+		child.kill(signal);
+	} catch {}
+}
+function appendOutput(state, chunk, limit) {
+	const safeLimit = Math.max(1, limit);
+	const headLimit = Math.ceil(safeLimit / 2);
+	const tailLimit = Math.floor(safeLimit / 2);
+	if (!state.truncated && state.head.length + chunk.length <= safeLimit) return {
+		...state,
+		head: state.head + chunk
+	};
+	const combined = state.truncated ? chunk : state.head + chunk;
+	return {
+		head: state.truncated ? state.head : combined.slice(0, headLimit),
+		tail: `${state.tail}${combined.slice(state.truncated ? 0 : headLimit)}`.slice(-tailLimit),
+		truncated: true
+	};
+}
+function outputText(state) {
+	return state.truncated ? `${state.head}${TRUNCATED_MARKER}${state.tail}` : state.head;
+}
+//#endregion
+//#region packages/cli/src/doctor.ts
+async function runCommand(name, args, platform) {
+	const result = await runManagedProcess({
+		command: name,
+		args,
+		platform,
+		timeoutMs: 1e4,
+		maxOutputChars: 64 * 1024
+	});
+	return {
+		ok: result.exitCode === 0 && !result.timedOut && result.error === void 0,
+		output: `${result.stdout}\n${result.stderr}`.trim() || result.error || ""
+	};
+}
+async function startContext7(platform) {
+	const result = await runManagedProcess({
+		command: "bunx",
+		args: ["@upstash/context7-mcp"],
+		platform,
+		timeoutMs: 15e3,
+		maxOutputChars: 128 * 1024,
+		stdin: `${JSON.stringify({
+			jsonrpc: "2.0",
+			id: 1,
+			method: "initialize",
+			params: {
+				protocolVersion: "2025-03-26",
+				capabilities: {},
+				clientInfo: {
+					name: "holycodex-doctor",
+					version: VERSION
+				}
+			}
+		})}\n`,
+		matchOutput: (output) => output.includes("\"serverInfo\"") || output.includes("\"capabilities\"")
+	});
+	const diagnostic = `${result.stdout}\n${result.stderr}`.trim() || result.error || "";
+	return {
+		ok: result.matched,
+		packageFailure: /(?:404|failed to resolve|package.*not found|error: GET)/i.test(diagnostic),
+		detail: diagnostic
+	};
+}
+var defaultRuntime$1 = {
+	platform: process.platform,
+	command: (name, args) => runCommand(name, args, process.platform),
+	context7: () => startContext7(process.platform),
+	gitBash: resolveGitBashForCurrentProcess
+};
+function check(id, status, code, detail, fix) {
+	return {
+		id,
+		status,
+		code,
+		detail,
+		...fix === void 0 ? {} : { fix }
+	};
+}
+async function missingFiles(root, paths) {
+	const missing = [];
+	for (const path of paths) try {
+		await access(join(root, path));
+	} catch {
+		missing.push(path);
+	}
+	return missing;
+}
+function rootString(config, key) {
+	return new RegExp(`^\\s*${key}\\s*=\\s*"([^"]+)"`, "m").exec(config)?.[1];
+}
+function tableBoolean(config, table, key) {
+	const body = new RegExp(`^\\s*\\[${table.replaceAll(".", "\\.")}]\\s*$([\\s\\S]*?)(?=^\\s*\\[|(?![\\s\\S]))`, "m").exec(config)?.[1];
+	const value = body === void 0 ? void 0 : new RegExp(`^\\s*${key}\\s*=\\s*(true|false)`, "m").exec(body)?.[1];
+	return value === void 0 ? void 0 : value === "true";
+}
+function autonomy(config) {
+	const approval = rootString(config, "approval_policy");
+	const sandbox = rootString(config, "sandbox_mode");
+	const network = tableBoolean(config, "sandbox_workspace_write", "network_access");
+	if (approval === "on-request" && sandbox === "workspace-write" && network === true) return "safe-workspace";
+	if (approval === "never" && sandbox === "workspace-write" && network === true) return "autonomous-workspace";
+	if (approval === "never" && sandbox === "danger-full-access") return "dangerous";
+	return "unknown";
+}
+async function doctor(home = process.env.CODEX_HOME ?? join(homedir(), ".codex"), runtime = defaultRuntime$1) {
+	const checks = [];
+	const pluginRoot = join(home, "plugins", "cache", "holycodex", "holycodex", VERSION);
+	const configPath = join(home, "config.toml");
+	const missing = await missingFiles(pluginRoot, [
+		".codex-plugin/plugin.json",
+		".mcp.json",
+		"LICENSE-OH-MY-OPENCODE-SLIM-MIT.txt",
+		"hooks/hooks.json",
+		...requiredPackageRuntimes(runtime.platform).map((file) => `runtime/${file}`),
+		...AGENTS.map((name) => `agents/${name}.toml`),
+		...SKILLS.map((name) => `skills/${name}/SKILL.md`)
+	]);
+	checks.push(missing.length === 0 ? check("package", "ok", "package-ready", `Plugin ${VERSION}, generated runtime, hooks, three agents, and ${SKILLS.length} skills are present.`) : check("package", "error", "package-incomplete", `Missing ${missing.join(", ")}.`, "Reinstall HolyCodex."));
+	let mcp;
+	try {
+		mcp = JSON.parse(await readFile(join(pluginRoot, ".mcp.json"), "utf8"));
+	} catch (error) {
+		checks.push(check("mcp-config", "error", "malformed-mcp-config", error instanceof Error ? error.message : "Invalid MCP JSON.", "Reinstall HolyCodex."));
+	}
+	const servers = mcp?.mcpServers;
+	const requiredMcps = runtime.platform === "win32" ? ["git_bash", "lsp"] : ["lsp"];
+	for (const name of requiredMcps) checks.push(servers?.[name] === void 0 ? check(`mcp-${name}`, "error", "missing-required-mcp", `${name} is not configured.`, "Reinstall HolyCodex.") : check(`mcp-${name}`, "ok", "required-mcp-ready", `${name} is configured locally.`));
+	const gitBashConfig = servers?.git_bash;
+	if (runtime.platform === "win32" && gitBashConfig !== void 0) {
+		const expected = effectiveMcpServers("win32").git_bash;
+		checks.push(JSON.stringify(gitBashConfig) === JSON.stringify(expected) ? check("mcp-git_bash-config", "ok", "git-bash-mcp-config-ready", "Git Bash MCP exposes only run through the supported allowlist.") : check("mcp-git_bash-config", "error", "invalid-git-bash-mcp-config", "Git Bash MCP command or enabled_tools configuration is stale.", "Reinstall HolyCodex."));
+	} else if (runtime.platform !== "win32" && gitBashConfig !== void 0) checks.push(check("mcp-git_bash-config", "error", "unexpected-git-bash-mcp", "Git Bash MCP must not be installed on non-Windows platforms.", "Reinstall HolyCodex for this platform."));
+	const context7 = servers?.context7;
+	const obsoleteAuth = context7 !== void 0 && [
+		"headers",
+		"env",
+		"authorization",
+		"apiKey"
+	].some((key) => key in context7);
+	if (context7 === void 0) checks.push(check("context7-config", "error", "missing-context7", "Context7 is not configured.", "Reinstall HolyCodex."));
+	else if (typeof context7.url === "string") checks.push(check("context7-config", "error", "obsolete-context7-remote", "Context7 still uses a hosted URL.", "Reinstall to use local bunx Context7."));
+	else if (obsoleteAuth) checks.push(check("context7-config", "error", "obsolete-context7-auth", "Context7 contains obsolete authentication settings.", "Remove auth settings and reinstall."));
+	else if (context7.command !== "bunx" || JSON.stringify(context7.args) !== JSON.stringify(["@upstash/context7-mcp"])) checks.push(check("context7-config", "error", "wrong-context7-package", "Expected bunx @upstash/context7-mcp.", "Repair .mcp.json or reinstall."));
+	else checks.push(check("context7-config", "ok", "local-context7-config", "Local no-auth Context7 is configured."));
+	const bun = await runtime.command("bun", ["--version"]);
+	const bunx = await runtime.command("bunx", ["--version"]);
+	checks.push(bun.ok ? check("bun", "ok", "bun-ready", `Bun ${bun.output || "available"}.`) : check("bun", "error", "missing-bun", "Bun is unavailable.", "Install or repair Bun."));
+	checks.push(bunx.ok ? check("bunx", "ok", "bunx-ready", `bunx ${bunx.output || "available"}.`) : check("bunx", "error", "missing-bunx", "bunx is unavailable.", "Repair the Bun installation."));
+	if (bun.ok && bunx.ok && checks.some((item) => item.code === "local-context7-config")) {
+		const started = await runtime.context7();
+		checks.push(started.ok ? check("context7-startup", "ok", "context7-healthy", "Context7 completed a bounded MCP handshake.") : started.packageFailure ? check("context7-startup", "error", "context7-package-resolution-failed", started.detail || "Context7 package resolution failed.", "Check network/package availability.") : check("context7-startup", "error", "context7-startup-failed", started.detail || "Context7 did not complete an MCP handshake within 15 seconds.", runtime.platform === "win32" ? "Run bunx @upstash/context7-mcp in Git Bash." : "Run bunx @upstash/context7-mcp in the native shell."));
+	}
+	if (runtime.platform === "win32") {
+		const gitBash = runtime.gitBash();
+		checks.push(gitBash.found ? check("git-bash", "ok", "git-bash-ready", `Git Bash: ${gitBash.path ?? "configured"}.`) : check("git-bash", "error", "missing-git-bash", "Git Bash is required on Windows but unavailable.", gitBash.installHint));
+	} else checks.push(check("git-bash", "ok", "git-bash-not-applicable", "Git Bash is not applicable on this platform."));
+	let config = "";
+	try {
+		config = await readFile(configPath, "utf8");
+	} catch {
+		checks.push(check("codex-config", "error", "missing-codex-config", `Missing ${configPath}.`, "Run holycodex install."));
+	}
+	const mode = autonomy(config);
+	checks.push(mode === "unknown" ? check("autonomy", "error", "invalid-autonomy-config", "Approval, sandbox, and network settings do not match a supported mode.", "Rerun install with the intended autonomy flag.") : mode === "dangerous" ? check("autonomy", "warning", "dangerous-autonomy", "Explicit dangerous autonomy is active; workspace containment is removed.") : check("autonomy", "ok", `${mode}-ready`, mode === "safe-workspace" ? "Safe workspace autonomy is active." : "Approval-free workspace autonomy is active."));
+	checks.push(tableBoolean(config, "features", "default_mode_request_user_input") === true ? check("user-input", "ok", "user-input-ready", "default_mode_request_user_input is enabled.") : check("user-input", "error", "user-input-disabled", "default_mode_request_user_input is not enabled.", "Rerun holycodex install."));
+	checks.push(/^\s*status_line\s*=\s*\[[\s\S]*?context-remaining[\s\S]*?]/m.test(config) ? check("context-visibility", "warning", "context-visible-support-unverified", "status_line includes context-remaining. Current official Codex config documents this item, but publishes no minimum compatible Codex version.") : check("context-visibility", "error", "context-hidden", "status_line does not include context-remaining.", "Rerun holycodex install."));
+	const codex = await runtime.command("codex", ["--version"]);
+	checks.push(codex.ok ? check("codex", "ok", "codex-version", codex.output || "Codex is available.") : check("codex", "warning", "codex-version-unavailable", "Codex version could not be read; status-line compatibility cannot be independently confirmed."));
+	const agentModelFailures = [];
+	for (const agent of AGENTS) try {
+		const text = await readFile(join(pluginRoot, "agents", `${agent}.toml`), "utf8");
+		const expected = AGENT_MODELS[agent];
+		if (!text.includes(`model = "${expected.model}"`) || !text.includes(`model_reasoning_effort = "${expected.reasoningEffort}"`)) agentModelFailures.push(agent);
+	} catch {
+		agentModelFailures.push(agent);
+	}
+	checks.push(agentModelFailures.length === 0 ? check("agent-models", "ok", "agent-models-ready", "Explorer and librarian use Luna low; worker uses Terra high.") : check("agent-models", "error", "agent-models-stale", `Agent model configuration is stale for ${agentModelFailures.join(", ")}.`, "Reinstall HolyCodex."));
+	return {
+		healthy: !checks.some((item) => item.status === "error"),
+		autonomy: mode,
+		checks
+	};
+}
+//#endregion
+//#region packages/cli/src/config.ts
+var START = "# >>> holycodex managed >>>";
+var END = "# <<< holycodex managed <<<";
+var ORIGINAL_ROOT = "# holycodex original root: ";
+var ORIGINAL_TABLE_KEY = "# holycodex original table key: ";
+var OLD_NAMESPACES = [
+	"marketplaces.sisyphuslabs",
+	"plugins.\"omo@sisyphuslabs\"",
+	"marketplaces.lazycodex",
+	"plugins.\"omo@lazycodex\"",
+	"marketplaces.code-yeongyu-codex-plugins",
+	"plugins.\"omo@code-yeongyu-codex-plugins\"",
+	"agents.plan",
+	"agents.metis",
+	"agents.momus",
+	"agents.oracle",
+	"agents.sisyphus",
+	"agents.prometheus",
+	"agents.atlas",
+	"agents.hephaestus",
+	"hooks.state.\"omo@sisyphuslabs",
+	"hooks.state.\"omo@lazycodex",
+	"hooks.state.\"omo@code-yeongyu-codex-plugins"
+];
+function removeManaged(input) {
+	const escapedStart = START.replaceAll(">", "\\>");
+	const escapedEnd = END.replaceAll("<", "\\<");
+	return input.replace(new RegExp(`${escapedStart}([\\s\\S]*?)${escapedEnd}(?:\\r?\\n){0,2}`, "g"), (_match, body) => {
+		const encoded = body.match(/^# holycodex original root: ([A-Za-z0-9+/=]+)$/m)?.[1];
+		if (encoded !== void 0) return `${Buffer.from(encoded, "base64").toString("utf8")}\n`;
+		const tableKey = body.match(/^# holycodex original table key: ([A-Za-z0-9+/=]+)$/m)?.[1];
+		return tableKey === void 0 ? "" : `${Buffer.from(tableKey, "base64").toString("utf8")}\n`;
+	}).trim();
+}
+function removeLegacyOmo(input) {
+	return input.split(/(?=^\s*\[)/m).filter((section) => {
+		const header = /^\s*\[([^\]]+)]/.exec(section)?.[1];
+		if (header === void 0) return true;
+		if (OLD_NAMESPACES.some((name) => header === name || header.startsWith(`${name}.`) || name.includes("\"omo@") && header.startsWith(name))) return false;
+		return ![
+			"agents.explorer",
+			"agents.librarian",
+			"agents.worker"
+		].some((name) => header === name || header.startsWith(`${name}.`)) || !/(?:sisyphuslabs|omo@|oh-my|code-yeongyu)/i.test(section);
+	}).join("").trimEnd();
+}
+function injectTableKey(input, table, key, value) {
+	const match = new RegExp(`^\\s*\\[${table.replaceAll(".", "\\.")}]\\s*$`, "m").exec(input);
+	const tail = match === null ? "" : input.slice(match.index + match[0].length);
+	const tableEnd = nextTableBoundary(tail);
+	const tableBody = tableEnd < 0 ? tail : tail.slice(0, tableEnd);
+	const originalKey = new RegExp(`^[ \\t]*${key}[ \\t]*=.*$`, "m").exec(tableBody)?.[0];
+	const managed = `${START}\n${originalKey === void 0 ? "" : `${ORIGINAL_TABLE_KEY}${Buffer.from(originalKey).toString("base64")}\n`}${key} = ${value}\n${END}`;
+	if (match === null) return `${input.trimEnd()}\n\n${START}\n[${table}]\n${key} = ${value}\n${END}`.trim();
+	const bodyStart = match.index + match[0].length;
+	const next = nextTableBoundary(input.slice(bodyStart));
+	const bodyEnd = next < 0 ? input.length : bodyStart + next;
+	const cleanedBody = input.slice(bodyStart, bodyEnd).replace(new RegExp(`^\\s*${key}\\s*=.*\\r?\\n?`, "gm"), "").trim();
+	const suffix = input.slice(bodyEnd).trimStart();
+	return `${input.slice(0, bodyStart)}\n${cleanedBody ? `${cleanedBody}\n` : ""}${managed}${suffix ? `\n${suffix}` : ""}`.trim();
+}
+function nextTableBoundary(input) {
+	const header = /^\s*\[/m.exec(input)?.index ?? -1;
+	const managedHeader = /^# >>> holycodex managed >>>\r?\n\s*\[/m.exec(input)?.index ?? -1;
+	if (header < 0) return managedHeader;
+	if (managedHeader < 0) return header;
+	return Math.min(header, managedHeader);
+}
+function rootValue(input, key) {
+	if (key === "status_line") return /^\s*status_line\s*=\s*\[[\s\S]*?^\s*]\s*(?:#.*)?$/m.exec(input)?.[0] ?? /^\s*status_line\s*=.*$/m.exec(input)?.[0];
+	return new RegExp(`^\\s*${key}\\s*=.*$`, "m").exec(input)?.[0];
+}
+function removeRootValue(input, value) {
+	return value === void 0 ? input : input.replace(value, "");
+}
+function mergedStatusLine(original) {
+	if (original === void 0) return "[\"model-with-reasoning\", \"context-remaining\", \"current-dir\"]";
+	const items = [...original.slice(original.indexOf("=") + 1).matchAll(/"((?:\\.|[^"\\])*)"/g)].map((match) => JSON.parse(`"${match[1]}"`));
+	if (!items.includes("context-remaining")) items.push("context-remaining");
+	return `[${items.map((item) => JSON.stringify(item)).join(", ")}]`;
+}
+function installConfig(input, mode, _platform) {
+	const base = removeLegacyOmo(removeManaged(input));
+	const firstTable = base.search(/^\s*\[/m);
+	const root = firstTable < 0 ? base : base.slice(0, firstTable);
+	const tables = firstTable < 0 ? "" : base.slice(firstTable);
+	const controlled = [
+		"approval_policy",
+		"sandbox_mode",
+		"max_concurrent_threads_per_session",
+		"status_line"
+	].map((key) => rootValue(root, key));
+	const originalRoot = root.trim();
+	const preservedRoot = controlled.reduce(removeRootValue, root).trim();
+	const hasModel = /^\s*model\s*=/m.test(preservedRoot);
+	const hasEffort = /^\s*model_reasoning_effort\s*=/m.test(preservedRoot);
+	const model = hasModel ? "" : `model = "${ROOT_MODEL.model}"\n`;
+	const effort = hasEffort ? "" : `model_reasoning_effort = "${ROOT_MODEL.reasoningEffort}"\n`;
+	const approval = mode === "default" ? "on-request" : "never";
+	const sandbox = mode === "dangerous" ? "danger-full-access" : "workspace-write";
+	let configured = `${`${START}\n${originalRoot ? `${ORIGINAL_ROOT}${Buffer.from(originalRoot).toString("base64")}\n` : ""}${model}${effort}${preservedRoot ? `${preservedRoot}\n` : ""}approval_policy = "${approval}"\nsandbox_mode = "${sandbox}"\nstatus_line = ${mergedStatusLine(controlled[3])}\n${END}`}${tables ? `\n\n${tables}` : ""}`;
+	configured = injectTableKey(configured, "features", "default_mode_request_user_input", "true");
+	configured = injectTableKey(configured, "features", "multi_agent", "true");
+	configured = injectTableKey(configured, "agents", "max_threads", "2");
+	configured = injectTableKey(configured, "agents", "max_depth", "1");
+	if (mode !== "dangerous") configured = injectTableKey(configured, "sandbox_workspace_write", "network_access", "true");
+	for (const agent of AGENTS) configured = injectTableKey(configured, `agents.${agent}`, "config_file", `"holycodex/agents/${agent}.toml"`);
+	const plugin = `${START}\n[marketplaces.holycodex]\nsource = "https://github.com/davidbasilefilho/holycodex.git"\n\n[plugins."holycodex@holycodex"]\nenabled = true\n${END}`;
+	return `${configured.trim()}\n\n${plugin}\n`;
+}
+//#endregion
+//#region packages/cli/src/files.ts
+async function exists(path) {
+	try {
+		await stat(path);
+		return true;
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return false;
+		throw error;
+	}
+}
+async function backup(path, root) {
+	if (!await exists(path)) return void 0;
+	const target = join(root, path.replace(/^([A-Za-z]:)?[\\/]+/, "").replaceAll(":", ""));
+	await mkdir(dirname(target), { recursive: true });
+	await copyBackup(path, target);
+	return target;
+}
+async function copyBackup(source, target) {
+	const metadata = await lstat(source);
+	if (metadata.isSymbolicLink()) {
+		await writeFile(`${target}.symlink`, await readlink(source), "utf8");
+		return;
+	}
+	if (!metadata.isDirectory()) {
+		await copyFile(source, target);
+		return;
+	}
+	await mkdir(target, { recursive: true });
+	for (const entry of await readdir(source)) await copyBackup(join(source, entry), join(target, entry));
+}
+async function atomicWrite(path, content) {
+	await mkdir(dirname(path), { recursive: true });
+	const temporary = `${path}.${process.pid}.tmp`;
+	await writeFile(temporary, content, "utf8");
+	await rename(temporary, path);
+}
+async function readText(path) {
+	return await exists(path) ? readFile(path, "utf8") : "";
+}
+//#endregion
+//#region packages/cli/src/install.ts
+var defaultRuntime = {
+	platform: process.platform,
+	gitBash: resolveGitBashForCurrentProcess
+};
+function paths(home = process.env.CODEX_HOME ?? join(homedir(), ".codex")) {
+	const marketplaceCache = join(home, "plugins", "cache", "holycodex");
+	const cacheRoot = join(marketplaceCache, "holycodex");
+	return {
+		home,
+		config: join(home, "config.toml"),
+		marketplaceCache,
+		cacheRoot,
+		cache: join(cacheRoot, VERSION),
+		agents: join(home, "holycodex", "agents"),
+		legacy: [
+			join(home, "plugins", "cache", "sisyphuslabs", "omo"),
+			join(home, "plugins", "cache", "lazycodex", "omo"),
+			join(home, "plugins", "cache", "code-yeongyu-codex-plugins", "omo")
+		]
+	};
+}
+function backupRoot() {
+	return join(tmpdir(), "holycodex-backups", (/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-"));
+}
+function assertGitBashReady(platform, resolution) {
+	if (platform !== "win32") return;
+	if (!resolution.found) throw new Error(resolution.installHint);
+}
+async function install(options, runtime = defaultRuntime) {
+	assertGitBashReady(runtime.platform, runtime.gitBash());
+	const target = paths();
+	const root = backupRoot();
+	const backups = [
+		await backup(target.config, root),
+		await backup(target.marketplaceCache, root),
+		await backup(target.agents, root),
+		...await Promise.all(target.legacy.map((path) => backup(path, root)))
+	].filter((path) => path !== void 0);
+	const config = installConfig(await readText(target.config), options.autonomy, runtime.platform);
+	await atomicWrite(target.config, config);
+	await rm(target.marketplaceCache, {
+		recursive: true,
+		force: true
+	});
+	await mkdir(dirname(target.cache), { recursive: true });
+	await cp(pluginRoot, target.cache, { recursive: true });
+	await writePlatformPlugin(target.cache, runtime.platform);
+	const existingAgentPreferences = await readAgentPreferences(target.agents);
+	await rm(target.agents, {
+		recursive: true,
+		force: true
+	});
+	await cp(join(pluginRoot, "agents"), target.agents, { recursive: true });
+	await writePlatformAgents(target.agents, runtime.platform);
+	await preserveAgentPreferences(target.agents, existingAgentPreferences);
+	const removedLegacy = [];
+	for (const path of target.legacy) {
+		if (!await exists(path)) continue;
+		await rm(path, { recursive: true });
+		removedLegacy.push(path);
+	}
+	return {
+		action: "install",
+		changed: [
+			target.config,
+			target.cache,
+			target.agents,
+			...removedLegacy
+		],
+		backups
+	};
+}
+async function readAgentPreferences(root) {
+	const preferences = {};
+	await Promise.all(AGENTS.map(async (agent) => {
+		const source = await readText(join(root, `${agent}.toml`));
+		const model = tomlString(source, "model");
+		const reasoningEffort = tomlString(source, "model_reasoning_effort");
+		if (model === void 0 && reasoningEffort === void 0) return;
+		if (!MANAGED_AGENT_MODEL_HISTORY[agent].some((item) => item.model === model && item.reasoningEffort === reasoningEffort)) preferences[agent] = {
+			...model === void 0 ? {} : { model },
+			...reasoningEffort === void 0 ? {} : { reasoningEffort }
+		};
+	}));
+	return preferences;
+}
+async function preserveAgentPreferences(root, preferences) {
+	await Promise.all(AGENTS.map(async (agent) => {
+		const preference = preferences[agent];
+		if (preference === void 0) return;
+		const path = join(root, `${agent}.toml`);
+		let source = await readText(path);
+		if (preference.model !== void 0) source = replaceTomlString(source, "model", preference.model);
+		if (preference.reasoningEffort !== void 0) source = replaceTomlString(source, "model_reasoning_effort", preference.reasoningEffort);
+		await atomicWrite(path, source);
+	}));
+}
+function tomlString(input, key) {
+	return new RegExp(`^${key}\\s*=\\s*"([^"]+)"`, "m").exec(input)?.[1];
+}
+function replaceTomlString(input, key, value) {
+	return input.replace(new RegExp(`^${key}\\s*=.*$`, "m"), `${key} = ${JSON.stringify(value)}`);
+}
+async function writePlatformPlugin(root, platform) {
+	await atomicWrite(join(root, ".mcp.json"), `${JSON.stringify({ mcpServers: effectiveMcpServers(platform) }, null, 2)}\n`);
+	await writePlatformAgents(join(root, "agents"), platform);
+}
+async function writePlatformAgents(root, platform) {
+	if (platform === "win32") return;
+	await Promise.all(AGENTS.map(async (agent) => {
+		const path = join(root, `${agent}.toml`);
+		await atomicWrite(path, (await readText(path)).replace(`${WINDOWS_SHELL_POLICY}\n\n`, ""));
+	}));
+}
+async function cleanup(_options) {
+	const target = paths();
+	const root = backupRoot();
+	const backups = [
+		await backup(target.config, root),
+		await backup(target.marketplaceCache, root),
+		await backup(target.agents, root)
+	].filter((path) => path !== void 0);
+	const changed = [];
+	if (await exists(target.config)) {
+		const current = await readText(target.config);
+		const unmanaged = removeManaged(current);
+		const cleaned = `${unmanaged}\n`;
+		if (unmanaged.length === 0 && current.includes("# >>> holycodex managed >>>")) {
+			await rm(target.config);
+			changed.push(target.config);
+		} else if (cleaned !== current) {
+			await atomicWrite(target.config, cleaned);
+			changed.push(target.config);
+		}
+	}
+	if (await exists(target.marketplaceCache)) {
+		await rm(target.marketplaceCache, { recursive: true });
+		changed.push(target.marketplaceCache);
+	}
+	if (await exists(target.agents)) {
+		await rm(target.agents, { recursive: true });
+		changed.push(target.agents);
+	}
+	return {
+		action: "cleanup",
+		changed,
+		backups
+	};
+}
+//#endregion
+//#region packages/cli/src/presentation.ts
+var RESET = "\x1B[0m";
+var BOLD = "\x1B[1m";
+var CYAN = "\x1B[36m";
+var GREEN = "\x1B[32m";
+var YELLOW = "\x1B[33m";
+var RED = "\x1B[31m";
+var DIM = "\x1B[2m";
+function paint(enabled, code, text) {
+	return enabled ? `${code}${text}${RESET}` : text;
+}
+function supportsColor(isTTY, noColor) {
+	return isTTY === true && noColor === void 0;
+}
+function renderHelp(version, color) {
+	const title = paint(color, `${BOLD}${CYAN}`, `HOLYCODEX ${version}`);
+	const section = (text) => paint(color, BOLD, text);
+	const muted = (text) => paint(color, DIM, text);
+	return `${title}\n${muted("Lean Codex toolkit installer and doctor")}\n\n${section("USAGE")}\n  holycodex <command> [options]\n\n${section("COMMANDS")}\n  install                         Install or update HolyCodex\n  cleanup                         Remove HolyCodex-owned state\n  doctor                          Diagnose installation and runtime\n\n${section("OPTIONS")}\n  --help                          Show help\n  --version                       Show version\n  --no-tui                        Accepted; commands remain noninteractive\n  --codex-autonomous              Never ask; keep workspace sandbox\n  --no-codex-autonomous           Safe interactive defaults\n  --dangerous-codex-autonomous    Never ask; disable filesystem sandbox\n  --json                          Print machine-readable output\n`;
+}
+function renderDoctor(result, color) {
+	return `${result.healthy ? paint(color, GREEN, "✓ HolyCodex doctor: healthy") : paint(color, RED, "✗ HolyCodex doctor: issues found")}\n${result.checks.map((item) => {
+		const label = item.status.toUpperCase().padEnd(7);
+		const line = `  ${paint(color, item.status === "ok" ? GREEN : item.status === "warning" ? YELLOW : RED, label)} ${item.id}  ${item.detail}`;
+		return item.fix === void 0 ? line : `${line}\n           ${paint(color, DIM, `Fix: ${item.fix}`)}`;
+	}).join("\n")}\n`;
+}
+function renderRunResult(result, color) {
+	return `${paint(color, GREEN, `✓ HolyCodex ${result.action} complete`)}\n  Changed: ${result.changed.length}\n  Backups: ${result.backups.length}\n`;
+}
+function renderNotice(kind, message, color) {
+	return `${paint(color, kind === "warning" ? RED : YELLOW, `! ${kind === "warning" ? "WARNING" : "NOTICE"}`)}  ${message}\n`;
+}
+//#endregion
+//#region packages/cli/src/cli.ts
+async function main() {
+	const args = process$1.argv.slice(2);
+	const stdoutColor = supportsColor(process$1.stdout.isTTY, process$1.env.NO_COLOR);
+	const stderrColor = supportsColor(process$1.stderr.isTTY, process$1.env.NO_COLOR);
+	if (args.includes("--help") || args.length === 0) {
+		process$1.stdout.write(renderHelp(VERSION, stdoutColor));
+		return;
+	}
+	if (args.includes("--version")) {
+		process$1.stdout.write(`${VERSION}\n`);
+		return;
+	}
+	const command = args.find((arg) => !arg.startsWith("--"));
+	const autonomyFlags = args.filter((arg) => [
+		"--codex-autonomous",
+		"--no-codex-autonomous",
+		"--dangerous-codex-autonomous"
+	].includes(arg));
+	if (autonomyFlags.length > 1) throw new Error(`Conflicting autonomy flags: ${autonomyFlags.join(", ")}`);
+	const options = {
+		autonomy: args.includes("--dangerous-codex-autonomous") ? "dangerous" : args.includes("--codex-autonomous") ? "autonomous" : "default",
+		json: args.includes("--json")
+	};
+	if (command === "doctor") {
+		const result = await doctor();
+		process$1.stdout.write(options.json ? `${JSON.stringify(result)}\n` : renderDoctor(result, stdoutColor));
+		if (!result.healthy) process$1.exitCode = 1;
+		return;
+	}
+	if (options.autonomy === "dangerous") process$1.stderr.write(renderNotice("warning", "Dangerous autonomy disables approvals and filesystem sandboxing.", stderrColor));
+	else if (options.autonomy === "autonomous") process$1.stderr.write(renderNotice("notice", "--codex-autonomous is now workspace-contained. Use --dangerous-codex-autonomous only for unrestricted behavior.", stderrColor));
+	const result = command === "install" ? await install(options) : command === "cleanup" ? await cleanup(options) : void 0;
+	if (result === void 0) throw new Error(`Unknown command: ${command ?? ""}`);
+	process$1.stdout.write(options.json ? `${JSON.stringify(result)}\n` : renderRunResult(result, stdoutColor));
+}
+await main();
+//#endregion