kylon-cli 0.3.10-next.713 → 0.4.0-next.714

package/README.md

@@ -79,8 +79,8 @@ blocks scheduled tasks) the daemon runs in the foreground until `Ctrl+C`, and
 ### `kylon onboard`
 
 `kylon onboard` is the terminal-first way to start: it creates a **new**
-workspace from the Claude Code context already on this machine. Run it from
-your project directory, or install and onboard in one line:
+workspace from the Claude Code or Codex context already on this machine. Run it
+from your project directory, or install and onboard in one line:
 
 ```bash
 curl -fsSL https://api.kylon.io/install.sh | sh -s -- onboard
@@ -90,11 +90,21 @@ The installer hands `kylon onboard` the controlling terminal for its one local
 question; on a machine without one (CI, a headless box) it passes `--yes` and
 the browser confirmation is the only gate.
 
+Which agent it builds from is decided first, and never by guessing twice:
+`--provider claude-code|codex` decides outright; otherwise, when only one of
+the two has anything on this machine, that one is used; when both do, you are
+asked. A run that cannot ask — `--yes`, `--json`, or the hosted installer's
+non-TTY pipe — uses Claude Code, which is what the command has always meant, and
+says so when it passed over Codex.
+
 It detects, offline and read-only, the project (the nearest `.git` ancestor,
 named from its `origin` repository when available and otherwise from its
-directory), the `CLAUDE.md` instruction files (project, `.claude/`, and
-user-level), and direct child skill packages under these exact repository
-locations:
+directory), the instruction files, and the skill packages each agent loads.
+
+For **Claude Code** that is the `CLAUDE.md` instruction files (project,
+`.claude/`, and user-level), the user's Claude Code skill directory, the
+project's memory entries, and direct child skill packages under these exact
+repository locations:
 
 - `.claude/skills`
 - `.agents/skills`
@@ -102,15 +112,42 @@ locations:
 - `agent_resources/skills`
 - `skills`
 
-The user's Claude Code skill directory and the project's Claude Code memory
-entries are also included. Each skill package must be a direct child directory
-with a top-level `SKILL.md`. Discovery checks only the listed roots; it does not
-recursively search the repository for directories named `skills`. Roots are
-processed in the listed order, duplicate package names keep the first match,
-and an unusually large root is skipped before any packages inside it are read.
-
-Env files, credential-shaped content, binaries, empty files, oversized
-files, and symlinks are never uploaded. Its terminal summary shows the semantic
+For **Codex** it is `AGENTS.md`, walked the way Codex walks it:
+`$CODEX_HOME/AGENTS.md` first, then one file in **every** directory from the
+repository root down to the working directory, deepest last, because that is
+the order Codex applies them in and the order the persona is joined in. Its
+skills come from `.agents/skills` in every directory from the working directory
+up to the repository root, plus `$CODEX_HOME/skills` and `$HOME/.agents/skills`;
+the nearest directory wins a name contest, and Codex's own `.system` built-ins
+are left alone. `AGENTS.override.md` is never uploaded, for the same reason
+`CLAUDE.local.md` is not: Codex documents it as a temporary machine-local
+override, removed to restore the shared guidance, so it is one machine's
+private amendment rather than the instruction set a workspace should inherit.
+When the instruction chain is longer than the five-file cap, the global layer,
+the repository root, and the directories nearest the working directory are kept
+and the dropped middle is reported. There is a length budget as well as a file
+count: the agent's instructions are held to a character limit that the server
+applies by trimming the *end* of the joined text, which for Codex is the most
+specific layer. So when the combined files are too long, the broadest ones are
+dropped here instead — and named — so the instructions closest to your working
+directory are the ones that survive.
+
+Each skill package must be a direct child directory with a top-level
+`SKILL.md`. Discovery checks only the listed roots; it does not recursively
+search the repository for directories named `skills`. Roots are processed in
+the listed order, duplicate package names keep the first match, and an
+unusually large root is skipped before any packages inside it are read.
+
+Codex memory is **not** uploaded unless you pass `--include-memory`. Claude
+Code keeps memory per project, so onboarding one project uploads only that
+project's entries; Codex keeps a single store under `$CODEX_HOME/memories`
+covering every repository the machine has worked on, and sending all of it to a
+new workspace is a choice rather than a detail. With the flag, the entries and
+the compact `memory_summary.md` are uploaded; the `MEMORY.md` routing index and
+Codex's derived working state (`raw_memories.md`, `rollout_summaries/`) are not.
+
+Env files, credential-shaped content, binaries, empty files, oversized files,
+and symlinks are never uploaded. Its terminal summary shows the semantic
 project name and its source separately from the physical checkout root. It then
 asks once (Enter confirms) and opens your browser: you sign in or sign up,
 review the proposal, rename or untick anything, and press one button. The
@@ -145,9 +182,9 @@ also stops the run until it is repaired or discarded, and so does a damaged
 `computer-session.json`, which is read strictly at the one-connection check. One `kylon onboard` runs per computer at a time (a
 second concurrent run is refused up front; a run that was paused for minutes
 while another took its place stops rather than continuing), and a resumed run
-applies the same one-connection rule as a fresh one. `--json` never starts Claude Code's interactive sign-in; a
-signed-out Claude Code fails with the command to run, and stdout stays one JSON
-document. A workspace credential that cannot be saved locally is revoked
+applies the same one-connection rule as a fresh one. `--json` never starts the
+provider's interactive sign-in; a signed-out Claude Code or Codex fails with the
+command to run, and stdout stays one JSON document. A workspace credential that cannot be saved locally is revoked
 server-side rather than left live.
 
 For agent-driven runs, `--yes` skips the local prompt and `--json` (which

package/dist/kylon-bundle.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.10-next.713",
-  "fingerprint": "1469f9c1bb3247af7869a7f171120f9388dcc3927cae5d03632498f5ce99927a",
-  "source_commit": "135254dd93fa5305b6b6b42c3d4c4741e1a3a892"
+  "version": "0.4.0-next.714",
+  "fingerprint": "49f262687539d8324488ff754db6d893b6dcff0df84d5491f97ba4b88ab843e2",
+  "source_commit": "99b6d7826fe83cd409423ad77ac663cf444fdd70"
 }