jules-orchestrator-kit 0.52.8 → 0.53.0

package/README.md

@@ -2,7 +2,7 @@
 
 # jules-orchestrator-kit
 
-### Task orchestration and automated verification harness for Google Jules
+### Task orchestration and automated verification harness for coding agents
 
 <br/>
 
@@ -24,6 +24,7 @@
 
 <p align="center">
   <a href="#quickstart">Quickstart</a> &nbsp;•&nbsp;
+  <a href="#any-repository">Any Repository</a> &nbsp;•&nbsp;
   <a href="#overview">Overview</a> &nbsp;•&nbsp;
   <a href="#target-workflows">Target Workflows</a> &nbsp;•&nbsp;
   <a href="#triage-guidelines">Triage</a> &nbsp;•&nbsp;
@@ -57,8 +58,8 @@ npx jules-orchestrator-kit init
 ```
 
 ```bash
-# 2. Commit what init wrote — .agent/config.yml is on the gate's deny list by
-#    design, so leaving it uncommitted makes the first gate reject your tree
+# 2. Commit what init wrote — .agent/config.yml is protected by BUILTIN_PROTECT,
+#    so leaving it uncommitted makes the first gate reject your tree
 git add .agent AGENTS.md SPEC.md CONSTRAINTS.md .gitignore && git commit -m "chore: add agent config"
 ```
 
@@ -67,6 +68,20 @@ git add .agent AGENTS.md SPEC.md CONSTRAINTS.md .gitignore && git commit -m "cho
 npx jules-orchestrator-kit task create
 ```
 
+`init` reads the repository, not a template: it detects the stack, picks a
+provider this machine can actually reach, and generates a CI workflow for the
+toolchain the project uses. Nothing about your setup is assumed.
+
+```bash
+# Which agents can this machine dispatch to, and what is missing for the rest?
+npx jules-orchestrator-kit providers
+```
+
+```bash
+# How hard should the gate verify agent work? (minimal | standard | max)
+npx jules-orchestrator-kit profile --set max
+```
+
 > [!TIP]
 > **Not sure what to run next?**  
 > `agentctl` with no arguments reads the repository state and prints the single
@@ -87,6 +102,44 @@ npx jules-orchestrator-kit task create
 
 <br/>
 
+<a id="any-repository"></a>
+## Using It In Any Repository
+
+Four things differ between projects, and the kit resolves each one from the
+repository rather than from a template.
+
+| What differs | How it is resolved | Inspect / override |
+| :--- | :--- | :--- |
+| **The stack** | `detectStack()` recognises 24+ ecosystems (Cargo, Go, Python/Django, Maven/Gradle, .NET, PHP/Laravel, Ruby, Elixir, Swift, Flutter/Dart, CMake, Bun, Deno, Node + Turbo/pnpm/Nx workspaces) and derives the setup, lint, test and build commands from the manifest it finds. | `agentctl doctor` · `verify:` in `.agent/config.yml` |
+| **The agent** | `provider:` selects Google Jules (hosted REST), the Claude Code CLI, the Codex CLI or the Gemini CLI. Readiness means a credential for the hosted one and a binary on `PATH` for the local ones — never both. | `agentctl providers` · `agentctl init --provider <name>` |
+| **How hard to verify** | `verify.profile` expands at load time into a stage pipeline that skips gates the runtime cannot support, and says which and why. | `agentctl profile` · `agentctl profile --set max` |
+| **Where CI runs** | A workflow is *generated* for the detected stack — the project's toolchain plus Node for the CLI — not copied from this repository. | `agentctl ci init [--target github\|gitlab]` |
+
+### Verification profiles
+
+| Profile | Runs | Use when |
+| :--- | :--- | :--- |
+| `minimal` | setup → tests | The suite is slow, the stack is unfamiliar, or it is day one. |
+| `standard` | setup → lint → tests → build → anti-tamper on the diff | The everyday gate. Scaffolded by default. |
+| `max` | everything above → mutation scoring → V8 diff coverage *(Node runtimes only)* → 3-pass flakiness probe | The change is consequential, or an agent has been getting green too easily. |
+
+Nothing in a profile is Node-specific by assumption. Gates a runtime cannot
+support are skipped with a stated reason rather than failing the diff — a Cargo
+repository on `max` runs mutation and stability probing and is never asked for
+`NODE_V8_COVERAGE`.
+
+### No provider? Still useful
+
+Every gate below runs locally with no API key, no CLI and no network:
+`agentctl check`, `mutate`, `coverage`, `probe`, `assert`, `evidence`, `rules`,
+`doctor`. The provider is only needed to *dispatch* work, not to verify it.
+
+<br/>
+
+---
+
+<br/>
+
 <a id="overview"></a>
 ## Overview
 
@@ -137,13 +190,17 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 
 ## Core Capabilities
 
+* **Provider-Agnostic:** Dispatches to Google Jules (hosted REST), the Claude Code CLI, the OpenAI Codex CLI or the Gemini CLI. `agentctl providers` probes each one — a credential for the hosted provider, a binary on `PATH` for the local ones — and every verification gate works with no provider configured at all.
+* **Vendor-Neutral Configuration:** Every `JULES_*` environment variable also answers to an `AGENT_*` spelling (`AGENT_API_KEY`, `AGENT_REPO`, `AGENT_SWARM_CONCURRENCY`). The legacy name always wins where both are set, so adding an alias cannot change a working setup.
+* **One-Word Verification Depth:** `verify.profile: minimal | standard | max` expands at load time into a stack-aware pipeline — `max` adds mutation scoring, flakiness probing and, where the runtime emits it, V8 diff coverage. A Cargo repository is never asked for `NODE_V8_COVERAGE`.
+* **Generated, Not Copied, CI:** `agentctl ci init` writes a GitHub Actions or GitLab job carrying the toolchain the detected stack needs (`setup-python`, `setup-go`, `setup-java`, …) plus Node for the CLI itself.
 * **Zero Runtime Dependencies:** Built exclusively on Node.js 20+ built-in modules (`node:fs`, `node:child_process`, `node:crypto`, `node:path`, `node:http`, `node:tty`, `node:test`).
 * **Cross-Platform Parity:** Verified 100% green across Linux, macOS (Darwin), and Windows on Node 20, 22, and 24.
 * **Autonomous Self-Healing Loop:** Captures test stderr/stdout, fingerprints error traces, and feeds structured context back into automated repair turns (up to 3 attempts) before human escalation.
 * **Fail-Closed Security & Secret Redaction:** Evaluates explicit Deny rules before Allow rules against canonicalized, case-folded paths. Redacts high-entropy keys and base64-encoded credentials (such as Kubernetes `Secret` manifests).
 * **Complexity & Cost Router:** Zero-dependency heuristic classifier (`src/router.mjs`) routing mechanical tasks to lightweight models while reserving primary models for complex refactors, with a `node --check` syntax-verification gate that transparently escalates a FAST-tier result to the primary provider if it left broken JS on disk.
 * **Terminal UI & Diagnostic Matrix (`agentctl doctor`):** Interactive terminal dashboard, task sidecar manager, and automated transactional self-repair.
-* **Verified Test Suite:** Tested with **828 unit tests across 91 suites passing in < 10.0s**.
+* **Verified Test Suite:** Tested with **797 unit tests across 98 suites passing in < 12.0s**.
 
 <br/>
 
@@ -158,7 +215,7 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 
 | Command | Usage | Description | Exit Codes |
 | :--- | :--- | :--- | :--- |
-| `init` | `agentctl init [--interactive] [--tier pro] [--force]` | Interactive onboarding wizard & stack detector. Generates `.agent/config.yml` and scaffolds `AGENTS.md`, the role prompts, the guardrails and the runtime `.gitignore` entries. Existing files are preserved unless `--force`. | `0` (Created) |
+| `init` | `agentctl init [--interactive] [--tier pro] [--provider <name>] [--profile <name>] [--force]` | Interactive onboarding wizard & stack detector. Generates `.agent/config.yml` and scaffolds `AGENTS.md`, the role prompts, the guardrails and the runtime `.gitignore` entries. Existing files are preserved unless `--force`. | `0` (Created) |
 | `budget` | `agentctl budget [--by-user] [--json] [reset]` | Reports rolling 24h task budget, quota headroom, and per-developer task attribution without external auth servers. | `0` (Status), `2` (Arg Error) |
 | `task create` | `agentctl task create [<prompt>] [--title <t>] [-p <prompt>] [-f <file>] [--template <id>] [--role <name>] [--tier fast\|complex]` | Interactively authors & scopes falsifiable task envelopes with secret scrubbing, preflight gate checks, and DAG dependency wiring. | `0` (Queued), `1` (Secret/Unfalsifiable) |
 | `task template` | `agentctl task template [<id>] [--list] [--json]` | Lists and synthesizes pre-calibrated task envelopes (Web, Deep Think, Universal & Agent Hardening: `web-cwv`, `web-wcag`, `web-seo`, `web-playwright`, `agent-dead-code-audit`, `web-flaky-heal`, `web-i18n`, `web-ai-access`, `agent-qa-mutation`, `agent-ci-falsify`, `agent-service-isolate`, `agent-error-paths`, `agent-security-audit`, `agent-dep-audit`, `agent-doc-drift`, `agent-config-audit`, `agent-api-contract`, `deep-debug`, `deep-feature`, `deep-optimize`, `deep-harden`). | `0` (Listed/Synthesized) |
@@ -169,6 +226,9 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 | `retry` | `agentctl retry <sessionId> [--role <role>] [--with-failure] [--json]` | Fetches error traces and activity logs from a failed session and synthesizes a targeted OODA retry dispatch. | `0` (Dispatched), `1` (Error) |
 | `prune` | `agentctl prune [--age 7d] [--state <state>] [--delete] [--yes] [--json]` | Queries and batch-archives or deletes stale/completed sessions via Jules v1alpha API to keep workspaces clean. | `0` (Cleaned) |
 | `pr harvest` | `agentctl pr harvest [--tier r0,r1] [--limit <n>] [--auto] [--allow-no-checks] [--dry-run]` | Discovers open agent PRs, evaluates CI checks & risk tiers, and auto-squashes green low-risk changes autonomously. A PR reporting **no** CI checks is skipped unless `--allow-no-checks` is passed, and an unavailable changed-file list blocks rather than classifying as low risk. | `0` (Triaged/Merged), `1` (Error) |
+| `providers` | `agentctl providers [--json]` | Probes every built-in provider and reports which ones this machine can dispatch to, what each one is missing, and which is active. | `0` (Active provider ready), `1` (Not ready) |
+| `profile` | `agentctl profile [--list] [--set minimal\|standard\|max] [--json]` | Shows the verification stages the configured profile expands to on this stack, or writes a new profile into `.agent/config.yml` without disturbing comments. | `0` (Shown/Set), `2` (Unknown profile) |
+| `ci init` | `agentctl ci init [--target github\|gitlab] [--force] [--dry-run] [--json]` | Generates a stack-aware CI gate workflow (`.github/workflows/agent-gate.yml` or `.gitlab-ci.agent-gate.yml`) that runs `agentctl check --mode committed`. Refuses to overwrite without `--force`. | `0` (Written/Skipped), `1` (Write error), `2` (Unknown target) |
 | `doctor` | `agentctl doctor [--json]` | Diagnostic DAG check runner & automated transactional self-repair engine. | `0` (Healthy), `1` (Failures) |
 | `queue` | `agentctl queue [--dag] [--concurrency <n>] [--dry-run] [--json]` | Consumes and executes task envelopes in `.agent/jules-queue/` with Kahn's DAG dependency resolution. Non-task files (manifests, `README.md`) are skipped, and `--dry-run` previews without moving anything. | `0` (Complete) |
 | `swarm` | `agentctl swarm [--json]` | Runs parallel multi-agent swarm across worker slots with PID liveness detection. | `0` (Complete) |
@@ -222,7 +282,6 @@ verify:
 scope:
   deny:
     - ".github/**"
-    - ".agent/config.yml"
     - "keys/**"
 
 # Plan tier. Defaults to `free` when unset — the kit will not assume you are
@@ -391,7 +450,7 @@ const result = await fast.dispatch({ prompt: "Fix a typo." }, { root: process.cw
 | **Warm Session Resumption & PR Bundler** | `src/provider.mjs`, `src/engine.mjs` | Multi-turn warm session context streaming via `POST /v1alpha/sessions/{id}:sendMessage` & evidence PR descriptions. | **v0.31.0** *(Shipped)* |
 | **TDD Harness & Prompt Falsifiability Linter** | `agentctl test-gen`, `agentctl task optimize` | Automated RED-state test generator, `scope.deny` test locking, and prompt testability linter with fuzzy path resolution. | **v0.31.0** *(Shipped)* |
 | **Atomic Git Checkpoint & Rollback** | `agentctl rollback` (`src/ops/checkpoint.mjs`) | Pre-flight git HEAD/stash snapshotting, atomic rollback restoration, and 10-session pruning rotation. | **v0.31.0** *(Shipped)* |
-| **Interactive UX Engine & TUI Engine** | `src/ux/` (`capabilities`, `key-decoder`, `renderer`, `layout`, `widgets`) | Zero-dependency terminal capabilities detector, sequence key decoder, virtual frame renderer, and widgets. | **v0.30.0** *(Shipped)* |
+| **Terminal UI Engine** | `src/tui.mjs`, `src/key-decoder.mjs` | Zero-dependency terminal capabilities detector, sequence key decoder, and interactive prompt widgets. | **v0.30.0** *(Shipped)* |
 | **PR Review Auto-Remediation Loop** | `agentctl review-repair` (`src/review-repair.mjs`) | Ingests GitHub PR review comments (`CHANGES_REQUESTED`), extracts line/file context, and dispatches automated repair turns. | **v0.27.0** *(Shipped)* |
 
 </details>

package/bin/agentctl.mjs

@@ -3,6 +3,7 @@
 import { parseArgs } from "node:util";
 import { readFileSync, existsSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { applyEnvAliases } from "../src/env-aliases.mjs";
 import { loadConfig, resolveRoot, detectStack, bootstrapZeroTestRepo } from "../src/config.mjs";
 import { gate, dispatch, run, isTaskFile } from "../src/engine.mjs";
 import { acquireLock, releaseLock, lockStatus, getQueueDir } from "../src/state.mjs";
@@ -11,6 +12,12 @@ import { reapOrphanedIntents, reapStaleMutexDirs } from "../src/journal.mjs";
 import { KIT_VERSION } from "../src/version.mjs";
 import { budgetStatus, listOpenReservations, releaseOpenReservations, resolveConcurrency } from "../src/budget.mjs";
 
+// Vendor-neutral env spellings are filled in before any module reads
+// process.env, so `AGENT_API_KEY` works everywhere `JULES_API_KEY` does. A
+// value already present under the legacy name always wins — see
+// src/env-aliases.mjs.
+applyEnvAliases(process.env);
+
 const args = process.argv.slice(2);
 const command = args[0];
 
@@ -35,7 +42,7 @@ export function formatBudgetLine(b) {
 
 export function printHelp() {
   console.log(`
-🚀 agentctl v${VERSION} — Universal Agent Orchestrator & Safety Gatekeeper
+agentctl v${VERSION} — Universal Agent Orchestrator & Safety Gatekeeper
 
 Usage: agentctl <command> [options]
 
@@ -55,6 +62,9 @@ Commands:
   clean                 Clean stale branches, worktrees, locks, and ledgers
   lock <action>         Manage mutex locks (acquire | release | status)
   doctor                Run system diagnostics and stack resolution checks
+  providers             List agent providers and whether this machine can reach them (--json)
+  profile               Show or set the verification profile (--list, --set <name>, --json)
+  ci init               Generate a stack-aware CI gate workflow (--target github|gitlab, --force)
   bootstrap             Bootstrap zero-test repository with verification oracle
   review-repair         Parse PR review comments and synthesize OODA repair tasks
   dashboard             Start local HTTP telemetry and audit dashboard
@@ -1193,6 +1203,150 @@ async function main() {
       break;
     }
 
+    case "providers": {
+      const { values } = parseArgs({
+        args: args.slice(1),
+        options: { json: { type: "boolean", short: "j" } },
+        allowPositionals: true,
+      });
+      const { detectAvailableProviders, probeProvider } = await import("../src/provider-readiness.mjs");
+      const probes = detectAvailableProviders();
+      const active = config.provider || "jules";
+      const activeProbe = probeProvider(active);
+
+      if (values.json) {
+        console.log(JSON.stringify({ active, activeReady: activeProbe.ready, providers: probes }, null, 2));
+        process.exit(0);
+      }
+
+      console.log(`\n🔌 Agent providers\n`);
+      for (const p of probes) {
+        const marker = p.name === active ? "▸" : " ";
+        console.log(`  ${marker} ${p.ready ? "✅" : "⬜"} ${p.name.padEnd(14)} ${p.label}`);
+        console.log(`       ${p.reason}`);
+        if (!p.ready) console.log(`       Fix: ${p.remedy}`);
+      }
+      if (!probes.some((p) => p.name === active)) {
+        console.log(`  ▸ ⬜ ${active.padEnd(14)} ${activeProbe.label}`);
+        console.log(`       ${activeProbe.reason}`);
+      }
+      console.log(`\n  Active: ${active} (provider: in ${config._file || ".agent/config.yml"})`);
+      console.log(`  Switch: agentctl init --provider <name>   ·   every gate below works with no provider at all\n`);
+      process.exit(activeProbe.ready ? 0 : 1);
+      break;
+    }
+
+    case "profile": {
+      const { values } = parseArgs({
+        args: args.slice(1),
+        options: {
+          list: { type: "boolean", short: "l" },
+          set: { type: "string" },
+          json: { type: "boolean", short: "j" },
+        },
+        allowPositionals: true,
+      });
+      const { PROFILE_NAMES, PROFILE_DESCRIPTIONS, buildProfileStages, buildDefaultStages } = await import("../src/profiles.mjs");
+
+      if (values.set) {
+        const name = String(values.set).toLowerCase();
+        if (!PROFILE_NAMES.includes(name)) {
+          console.error(`❌ Unknown profile '${values.set}'. Choose one of: ${PROFILE_NAMES.join(", ")}`);
+          process.exit(2);
+        }
+        const { setVerificationProfile } = await import("../src/profiles-io.mjs");
+        const res = setVerificationProfile(root, name);
+        if (!res.ok) {
+          console.error(`❌ ${res.error}`);
+          process.exit(1);
+        }
+        console.log(`✅ Verification profile set to '${name}' in ${res.file}`);
+        process.exit(0);
+      }
+
+      if (values.list) {
+        if (values.json) {
+          console.log(JSON.stringify(PROFILE_NAMES.map((n) => ({ name: n, description: PROFILE_DESCRIPTIONS[n] })), null, 2));
+        } else {
+          console.log(`\n🎚️  Verification profiles\n`);
+          for (const n of PROFILE_NAMES) console.log(`  ${n.padEnd(10)} ${PROFILE_DESCRIPTIONS[n]}`);
+          console.log(`\n  Set with: agentctl profile --set max\n`);
+        }
+        process.exit(0);
+      }
+
+      const stack = detectStack(root).stack;
+      const activeProfile = config.verify.profile || "(none — running the built-in pipeline)";
+      const plan = config.verify.profile
+        ? buildProfileStages(config.verify.profile, { stack, verify: config.verify })
+        : { profile: null, stages: config.verify.stages || buildDefaultStages(config.verify), skipped: [] };
+
+      if (values.json) {
+        console.log(JSON.stringify({ profile: config.verify.profile, stack, stages: plan.stages, skipped: plan.skipped }, null, 2));
+        process.exit(0);
+      }
+
+      console.log(`\n🎚️  Verification profile: ${activeProfile}   (stack: ${stack})\n`);
+      if (plan.stages.length === 0) {
+        console.log(`  No stages resolved — no verification command is configured or detectable.`);
+        console.log(`  Set verify.test in .agent/config.yml, or run: agentctl bootstrap`);
+      }
+      for (const st of plan.stages) {
+        const what = st.assert ? `assert:${st.assert}` : st.cmd;
+        console.log(`  ${String(st.id).padEnd(14)} ${what}`);
+      }
+      for (const sk of plan.skipped) {
+        console.log(`  ${String(sk.id).padEnd(14)} — skipped: ${sk.reason}`);
+      }
+      console.log(`\n  Change with: agentctl profile --set ${config.verify.profile === "max" ? "standard" : "max"}\n`);
+      process.exit(0);
+      break;
+    }
+
+    case "ci": {
+      const sub = args[1];
+      if (sub !== "init") {
+        console.error(`❌ Unknown 'ci' action '${sub || ""}'. Usage: agentctl ci init [--target github|gitlab] [--force]`);
+        process.exit(2);
+      }
+      const { values } = parseArgs({
+        args: args.slice(2),
+        options: {
+          target: { type: "string", default: "github" },
+          force: { type: "boolean", short: "f" },
+          "dry-run": { type: "boolean", short: "d" },
+          json: { type: "boolean", short: "j" },
+        },
+        allowPositionals: true,
+      });
+      const { writeCiWorkflow } = await import("../src/ci-templates.mjs");
+      const res = writeCiWorkflow(root, {
+        target: values.target,
+        force: values.force,
+        dryRun: values["dry-run"],
+        config,
+        version: VERSION,
+        stack: detectStack(root),
+      });
+
+      if (values.json) {
+        console.log(JSON.stringify(res, null, 2));
+        process.exit(res.ok ? 0 : 1);
+      }
+      if (!res.ok) {
+        console.error(`❌ ${res.error}`);
+        process.exit(1);
+      }
+      console.log(`✅ ${res.written ? "Wrote" : "Would write"} ${res.file}`);
+      console.log(`   Stack: ${res.stack} · runtime setup: ${res.setupSummary}`);
+      console.log(`   The workflow runs: agentctl check --mode committed`);
+      if (!res.written && !values["dry-run"]) {
+        console.log(`   (unchanged — pass --force to overwrite)`);
+      }
+      process.exit(0);
+      break;
+    }
+
     case "bootstrap": {
       const { values } = parseArgs({
         args: args.slice(1),
@@ -1250,6 +1404,8 @@ async function main() {
           "no-interactive": { type: "boolean" },
           yes: { type: "boolean", short: "y" },
           tier: { type: "string", short: "t" },
+          provider: { type: "string" },
+          profile: { type: "string" },
           json: { type: "boolean", short: "j" },
           "dry-run": { type: "boolean", short: "d" },
           force: { type: "boolean", short: "f" },
@@ -1267,6 +1423,10 @@ async function main() {
         // re-run. Undefined lets the wizard seed the menu from the existing
         // config and fall back to FALLBACK_TIER when there is nothing to seed.
         tier: values.tier,
+        // Both undefined by default so the wizard can detect a provider the
+        // machine can actually reach and keep the profile already in config.
+        provider: values.provider,
+        profile: values.profile,
         allowDefaults: true,
       });
 
@@ -1282,6 +1442,17 @@ async function main() {
       } else {
         console.log(`✅ Onboarding complete! Manifest generated at ${res.configPath}`);
         console.log(`   Tier: ${res.plan.tier.toUpperCase()} (${res.plan.limits.concurrency} worker(s), ${res.plan.limits.daily_tasks} daily tasks)`);
+        {
+          const { probeProvider } = await import("../src/provider-readiness.mjs");
+          const probe = probeProvider(res.plan.provider);
+          console.log(`   Provider                  : ${probe.name} ${probe.ready ? "(ready)" : `(not ready — ${probe.remedy})`}`);
+          const { buildProfileStages, describeProfilePlan } = await import("../src/profiles.mjs");
+          const planned = buildProfileStages(res.plan.profile, {
+            stack: res.plan.stack,
+            verify: { ...res.plan.verify, unit: res.plan.verify.test },
+          });
+          console.log(`   Verification Profile      : ${res.plan.profile} → ${describeProfilePlan(planned)}`);
+        }
         if (res.plan.verify.test) {
           console.log(`   Verification Test Command : "${res.plan.verify.test}"`);
         } else {

package/bin/init.js

@@ -8,6 +8,8 @@ import readline from "node:readline/promises";
 import zlib from "node:zlib";
 import crypto from "node:crypto";
 import { resolveProjectCommands } from "../scripts/command-resolver.mjs";
+import { KIT_VERSION } from "../src/version.mjs";
+import { detectStack } from "../src/config.mjs";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -52,7 +54,7 @@ Options:
   process.exit(0);
 }
 
-console.log("\n🚀 Initializing Google Jules Orchestration Kit...\n");
+console.log("\n🚀 Initializing agent orchestrator kit...\n");
 console.log(`📁 Target Directory: ${targetDir}`);
 if (isForce) console.log("⚠️ Force mode enabled (existing files will be overwritten).");
 
@@ -129,65 +131,62 @@ for (const item of scaffolded.created) {
 
 const agentDir = path.join(targetDir, ".agent");
 
-// Scaffold .agent/jules.yml
+// Scaffold the manifest pair.
+//
+// This entry point used to hand-roll a thinner `.agent/jules.yml` while
+// `agentctl init` wrote a `.agent/config.yml` the runtime actually reads, so
+// which of the two scaffolders you happened to run decided whether the
+// repository had a provider, a tier and a verification profile at all. Both
+// now go through `planInit`.
+const { planInit } = await import("../src/wizard-init.mjs");
+const initPlan = planInit(targetDir, {
+  testCmd: detected.testCmd,
+  buildCmd: detected.buildCmd,
+  lintCmd: detected.lintCmd,
+  baseBranch: answerBranchVal || process.env.BASE_BRANCH || undefined,
+});
+
+const configPath = path.join(agentDir, "config.yml");
+if (!fs.existsSync(configPath) || isForce) {
+  fs.writeFileSync(configPath, initPlan.configYaml, "utf-8");
+  console.log(`✅ Created: .agent/config.yml (provider: ${initPlan.provider}, profile: ${initPlan.profile})`);
+}
+
 const yamlConfigPath = path.join(agentDir, "jules.yml");
 if (!fs.existsSync(yamlConfigPath) || isForce) {
-  const yamlContent = `# Google Jules Repository Configuration (Version 2)
-version: 2
-test_cmd: "${detected.testCmd || "npm test"}"
-build_cmd: "${detected.buildCmd || "npm run build"}"
-forbidden_paths: [".github/**", "**/.env*", "**/*.pem", "**/lock-manager*"]
-`;
-  fs.writeFileSync(yamlConfigPath, yamlContent, "utf-8");
+  fs.writeFileSync(yamlConfigPath, initPlan.julesYaml, "utf-8");
   console.log("✅ Created: .agent/jules.yml");
 }
 
-// Scaffold .github/workflows/jules-audit.yml
-const githubWorkflowsDir = path.join(targetDir, ".github/workflows");
-const auditWfSource = path.join(kitRoot, ".github/workflows/jules-audit.yml");
-const auditWfTarget = path.join(githubWorkflowsDir, "jules-audit.yml");
-
-if (fs.existsSync(auditWfSource)) {
-  if (!fs.existsSync(githubWorkflowsDir)) {
-    fs.mkdirSync(githubWorkflowsDir, { recursive: true });
-  }
-  if (!fs.existsSync(auditWfTarget) || isForce) {
-    fs.copyFileSync(auditWfSource, auditWfTarget);
-    console.log("✅ Added GitHub Actions workflow: .github/workflows/jules-audit.yml");
-  }
+// 3b. Generate a CI gate workflow for *this* repository's stack.
+//
+// This used to copy the kit's own audit workflow verbatim: a nine-way Node
+// matrix running `npm install`, `npm test` and a script path that exists only
+// inside the kit. In a Rust, Python or Go repository it was red on the first
+// push for reasons that had nothing to do with that repository's code.
+const { writeCiWorkflow } = await import("../src/ci-templates.mjs");
+const ciRes = writeCiWorkflow(targetDir, {
+  target: "github",
+  force: isForce,
+  // `resolveProjectCommands` reports a human-readable source string; the CI
+  // generator needs the machine-readable stack id.
+  stack: detectStack(targetDir),
+  config: { baseBranch: answerBranchVal || process.env.BASE_BRANCH || "main" },
+  version: KIT_VERSION,
+});
+if (ciRes.ok && ciRes.written) {
+  console.log(`✅ Generated CI gate for '${ciRes.stack}': ${ciRes.file}`);
+} else if (ciRes.ok) {
+  console.log(`↩️  Kept existing ${ciRes.file} (use --force to regenerate)`);
 }
 
-// 4. Copy scripts/ directory with PER-FILE existence guard
-const targetScriptsDir = path.join(targetDir, "scripts");
-if (!fs.existsSync(targetScriptsDir)) {
-  fs.mkdirSync(targetScriptsDir, { recursive: true });
-}
-
-const sourceScriptsDir = path.join(kitRoot, "scripts");
-let copiedCount = 0;
-let skippedCount = 0;
-
-if (fs.existsSync(sourceScriptsDir)) {
-  const scriptFiles = fs.readdirSync(sourceScriptsDir);
-  const excludeFiles = new Set(["release.mjs"]);
-  scriptFiles.forEach((file) => {
-    if (excludeFiles.has(file)) return;
-    const srcFile = path.join(sourceScriptsDir, file);
-    const destFile = path.join(targetScriptsDir, file);
-    if (!fs.existsSync(destFile) || isForce) {
-      fs.copyFileSync(srcFile, destFile);
-      try {
-        fs.chmodSync(destFile, 0o755);
-      } catch (err) {
-        console.warn(`⚠️ Could not set executable permissions on ${file}:`, err.message);
-      }
-      copiedCount++;
-    } else {
-      skippedCount++;
-    }
-  });
-  console.log(`✅ Copied ${copiedCount} orchestration scripts to ./scripts/ (${skippedCount} skipped, use --force to overwrite)`);
-}
+// 4. The kit's own scripts/ directory is NOT copied here.
+//
+// It used to be — twenty orchestration scripts dropped into the target repo's
+// scripts/ folder, where they collided with the project's own files, aged
+// independently of the installed kit, and duplicated commands that `agentctl`
+// already exposes. Everything they did is reachable through the CLI, which is
+// what the injected package.json entries below point at.
 
 // 5. Optionally inject scripts into target package.json if present
 const targetPkgPath = path.join(targetDir, "package.json");
@@ -196,18 +195,22 @@ if (fs.existsSync(targetPkgPath) && targetDir !== kitRoot) {
     const pkg = JSON.parse(fs.readFileSync(targetPkgPath, "utf-8"));
     pkg.scripts = pkg.scripts || {};
     let updated = false;
-    const julesScripts = {
-      "jules:dispatch": "agentctl dispatch",
-      "jules:queue": "agentctl queue",
-      "jules:create": "agentctl task create",
-      "jules:status": "agentctl status",
-      "jules:audit": "agentctl gate",
-      "jules:scan": "agentctl scan",
-      "jules:swarm": "agentctl swarm",
-      "jules:nightly": "agentctl clean"
+    // Vendor-neutral names: these run `agentctl`, which dispatches to whichever
+    // provider the repository selected. `jules:*` entries from an older init are
+    // left in place — removing scripts a project may reference in CI is not
+    // this command's business.
+    const agentScripts = {
+      "agent:gate": "agentctl check",
+      "agent:dispatch": "agentctl dispatch",
+      "agent:queue": "agentctl queue",
+      "agent:create": "agentctl task create",
+      "agent:status": "agentctl status",
+      "agent:doctor": "agentctl doctor",
+      "agent:swarm": "agentctl swarm",
+      "agent:clean": "agentctl clean"
     };
 
-    for (const [key, val] of Object.entries(julesScripts)) {
+    for (const [key, val] of Object.entries(agentScripts)) {
       if (!pkg.scripts[key] || isForce) {
         pkg.scripts[key] = val;
         updated = true;
@@ -216,7 +219,7 @@ if (fs.existsSync(targetPkgPath) && targetDir !== kitRoot) {
 
     if (updated) {
       fs.writeFileSync(targetPkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
-      console.log("✅ Added Jules commands to package.json");
+      console.log("✅ Added agent:* commands to package.json");
     }
   } catch (err) {
     console.warn("⚠️ Failed to inject helper scripts into target package.json:", err.message);
@@ -229,7 +232,7 @@ if (scaffolded.gitignore.length > 0) {
   console.log(`✅ Added ${scaffolded.gitignore.length} runtime state entries to .gitignore`);
 }
 
-console.log("\n🎉 Google Jules Orchestration Kit successfully initialized!");
+console.log("\n🎉 Agent orchestrator kit initialized.");
 
 // 6. Generate Encoded Workspace Manifest (JULES_WEB_SETUP.md)
 const agentState = {
@@ -272,13 +275,23 @@ ${payloadToken}
 
 fs.writeFileSync(path.join(targetDir, ".agent", "JULES_WEB_SETUP.md"), setupMdContent, "utf-8");
 
-console.log("\n🔗 Google Jules Setup Complete");
-console.log("  Your local agent configurations are ready.");
-console.log(`  👉 Encoded Workspace Manifest: \x1b[36m${payloadToken}\x1b[0m`);
-console.log("\n  (A backup was written to .agent/JULES_WEB_SETUP.md)");
+// The encoded manifest is a Google Jules convenience — it pastes the detected
+// workspace into the Jules web UI. It is written unconditionally because it
+// costs nothing and a repository can change provider later, but it is only
+// *announced* when Jules is the provider this repo actually selected;
+// otherwise it is one more Google-specific string in the way of someone who
+// chose a different agent.
+if (initPlan.provider === "jules") {
+  console.log("\n🔗 Google Jules workspace manifest");
+  console.log(`  👉 Paste into the Jules web UI: \x1b[36m${payloadToken}\x1b[0m`);
+  console.log("  (A copy was written to .agent/JULES_WEB_SETUP.md)");
+} else {
+  console.log(`\n  Provider: ${initPlan.provider}. A Google Jules workspace manifest was also written to .agent/JULES_WEB_SETUP.md if you ever switch.`);
+}
 console.log("\nNext Steps:");
-console.log("  1. See official documentation at https://jules.google");
-console.log("  2. Set environment variables: JULES_REPO=\"owner/repo\"");
-console.log("  3. Scaffold a new task: npm run jules:create \"My Feature\"");
-console.log("  4. Dispatch the queue:  npm run jules:queue");
-console.log("  5. Run pre-merge audit: npm run jules:audit\n");
+console.log("  1. Pick a provider:      agentctl providers   (jules | claude-code | codex | gemini)");
+console.log("  2. Pick a gate depth:    agentctl profile --list   (minimal | standard | max)");
+console.log("  3. Scaffold a task:      agentctl task create");
+console.log("  4. Dispatch the queue:   agentctl queue");
+console.log("  5. Run the pre-merge gate: agentctl check\n");
+console.log("  Not sure? Run `agentctl` with no arguments — it reads the repo and names one step.\n");

package/index.mjs

@@ -36,6 +36,16 @@ export {
   parseRetryAfter,
 } from "./src/provider.mjs";
 export { resolveRoutedProvider } from "./src/router.mjs";
+export {
+  PROVIDER_DESCRIPTORS,
+  PROVIDER_PREFERENCE,
+  whichBinary,
+  probeProvider,
+  detectAvailableProviders,
+  suggestProvider,
+} from "./src/provider-readiness.mjs";
+export { ENV_ALIASES, applyEnvAliases, describeEnvVar } from "./src/env-aliases.mjs";
+export { PROFILE_NAMES, PROFILE_DESCRIPTIONS, buildProfileStages, describeProfilePlan } from "./src/profiles.mjs";
 export {
   detectPolyglotStack,
   resolveWorkspaceBoundary,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.52.8",
-  "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for Google Jules (jules) autonomous agents.",
+  "version": "0.53.0",
+  "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for autonomous coding agents — Google Jules, Claude Code, Codex and Gemini CLI.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/FullThrottle83/jules-orchestrator-kit.git"
@@ -63,6 +63,9 @@
   "keywords": [
     "jules",
     "google-jules",
+    "claude-code",
+    "codex",
+    "gemini-cli",
     "ai-agent",
     "orchestrator",
     "mcp",