thoth-agents 0.1.0

package/dist/cli/index.js

@@ -0,0 +1,4579 @@
+#!/usr/bin/env node
+
+// src/cli/index.ts
+import { pathToFileURL } from "url";
+
+// src/harness/adapters/codex.ts
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { dirname as dirname2, resolve } from "path";
+
+// src/agents/prompt-dialects.ts
+var OPENCODE_CAPABILITIES = {
+  agentDefinitions: "supported",
+  delegatedExecution: "supported",
+  parallelDelegation: "supported",
+  runtimeHooks: "supported",
+  mcpConfiguration: "supported",
+  skillPackaging: "supported",
+  rolePermissions: "supported",
+  parentContextInjection: "supported",
+  memoryGovernanceEnforcement: "supported"
+};
+var CODEX_PROMPT_CAPABILITIES = {
+  agentDefinitions: "supported",
+  delegatedExecution: "instruction-only",
+  parallelDelegation: "instruction-only",
+  runtimeHooks: "unknown",
+  mcpConfiguration: "supported",
+  skillPackaging: "supported",
+  rolePermissions: "instruction-only",
+  parentContextInjection: "instruction-only",
+  memoryGovernanceEnforcement: "instruction-only"
+};
+function supportedCapabilityProfile(capabilities) {
+  return {
+    capabilities,
+    renderCapabilityDisclosure: () => void 0
+  };
+}
+function codexCapabilityDisclosure(capability) {
+  const status = CODEX_PROMPT_CAPABILITIES[capability];
+  if (status === "supported") {
+    return void 0;
+  }
+  if (status === "unknown") {
+    return `${capability}: unknown in Codex; treat related behavior as diagnostic-only unless the active Codex host documents support.`;
+  }
+  return `${capability}: ${status} in Codex; preserve the role responsibility as prompt guidance because equivalent runtime enforcement is not guaranteed.`;
+}
+var OPENCODE_PROMPT_DIALECT = {
+  harness: "opencode",
+  tools: {
+    delegationTool: "task",
+    backgroundDelegationTool: "task(background=true)",
+    backgroundStatusTool: "task_status",
+    userQuestionTool: "question",
+    progressTool: "todowrite",
+    hostStatusSurface: "task_status",
+    roleReference: (role) => `@${role}`
+  },
+  capabilities: supportedCapabilityProfile(OPENCODE_CAPABILITIES),
+  dispatchLabel(method) {
+    switch (method) {
+      case "root-coordinator":
+        return "root coordinator";
+      case "task":
+        return "task";
+      case "synchronous-task-only":
+        return "synchronous task only";
+    }
+  },
+  renderRoleInvocation(role) {
+    return `@${role}`;
+  }
+};
+var CODEX_PROMPT_DIALECT = {
+  harness: "codex",
+  tools: {
+    delegationTool: "Codex custom-agent task",
+    backgroundDelegationTool: "Codex background role-agent run",
+    backgroundStatusTool: "Codex host status surface",
+    userQuestionTool: "request_user_input",
+    progressTool: "Codex progress tracking surface",
+    hostStatusSurface: "Codex host status surface",
+    roleReference: (role) => `${role} role agent`
+  },
+  capabilities: {
+    capabilities: CODEX_PROMPT_CAPABILITIES,
+    renderCapabilityDisclosure: codexCapabilityDisclosure
+  },
+  dispatchLabel(method) {
+    switch (method) {
+      case "root-coordinator":
+        return "ambient Codex root session coordinator";
+      case "task":
+        return "Codex custom-agent task";
+      case "synchronous-task-only":
+        return "synchronous Codex custom-agent task only";
+    }
+  },
+  renderRoleInvocation(role) {
+    return role === "orchestrator" ? "orchestrator role agent" : `${role} subagent`;
+  }
+};
+
+// src/agents/prompt-sections.ts
+function createQuestionProtocolSection() {
+  return {
+    kind: "question-protocol",
+    toolConcept: "userQuestion"
+  };
+}
+function createSubagentRulesSection(memoryAccess = "base") {
+  return {
+    kind: "subagent-rules",
+    memoryAccess,
+    progressConcept: "progress",
+    userQuestionConcept: "userQuestion"
+  };
+}
+function createResponseBudgetSection() {
+  return { kind: "response-budget" };
+}
+function createStepBudgetSection(steps) {
+  if (steps === void 0 || !Number.isInteger(steps) || steps <= 0) {
+    return void 0;
+  }
+  return { kind: "step-budget", steps };
+}
+function detectModelFamilyFromModel(model) {
+  const id = getPrimaryModelId(model)?.toLowerCase();
+  if (!id) {
+    return void 0;
+  }
+  if (id.includes("claude") || id.startsWith("anthropic/")) {
+    return "claude";
+  }
+  if (id.includes("gpt") || id.startsWith("openai/")) {
+    return "openai";
+  }
+  if (id.includes("gemini") || id.startsWith("google/")) {
+    return "gemini";
+  }
+  if (id.includes("kimi") || id.includes("k2")) {
+    return "kimi";
+  }
+  if (id.includes("glm") || id.startsWith("zai-")) {
+    return "glm";
+  }
+  return void 0;
+}
+function createModelFamilySection(role, model) {
+  const family = detectModelFamilyFromModel(model);
+  if (!family) {
+    return void 0;
+  }
+  return { kind: "model-family", role, family };
+}
+function roleText(template) {
+  return { kind: "role-text", template };
+}
+function specialistSections({
+  role,
+  mode,
+  dispatch,
+  scope,
+  responsibility,
+  rules,
+  memoryAccess,
+  output
+}) {
+  const dispatchLabel = dispatch === "task" ? "{{dispatch.task}}" : "{{dispatch.synchronous-task-only}}";
+  return [
+    roleText(`<role>
+You are ${role}.
+</role>
+
+<mode>
+- Mode: ${mode}
+- Dispatch method: ${dispatchLabel}
+- Scope: ${scope}
+</mode>
+
+<responsibility>
+${responsibility}
+</responsibility>
+
+<rules>`),
+    createSubagentRulesSection(memoryAccess),
+    roleText(`${rules.join("\n")}
+</rules>`),
+    createQuestionProtocolSection(),
+    roleText(`<output>`),
+    createResponseBudgetSection(),
+    roleText(`${output}
+</output>`)
+  ];
+}
+function createOrchestratorPromptSections() {
+  return [
+    roleText(`<role>
+You are the delegate-first root coordinator and decision engine for thoth-agents.
+The root agent is the orchestrator/root coordinator for the session.
+Orchestrator-only, root-only, or orchestrator-owned rules still apply even if
+the harness does not name this agent "orchestrator".
+</role>
+
+<style>
+Respond in the user's language. Be warm, direct, evidence-led, and concise.
+Push back when context, risk, or assumptions are weak. Avoid verbosity.
+</style>
+
+<core-rules>
+- Mode: primary coordinator. Mutation: none.
+- Load \`thoth-mem-agents\` and \`requirements-interview\`.
+- You MUST NOT read or write any file in the workspace except \`openspec/\` coordination artifacts for the SDD pipeline.
+- Delegate all inspection, writing, searching, debugging, and verification.
+- Own the thinking: analyze the request, choose the approach, synthesize facts, make decisions, ask \`{{userQuestionTool}}\`, manage progress, and own root-session memory.
+- Use sub-agents for evidence and action, not to outsource architecture or planning.
+- Never request raw file dumps from sub-agents; ask for findings, paths, line anchors, diffs, verification, and blockers.
+- Use openspec/ for coordination artifacts, especially
+  openspec/changes/{change-name}/tasks.md.
+- Visual or UX work and screenshots always go to {{role.designer}}.
+- Verify through delegation, not inline.
+- Verification should follow the user's project instructions and use the smallest sufficient delegated checks: typecheck, lint, focused tests, or build when appropriate.
+</core-rules>
+
+<session-bootstrap>
+- At the start of a new root session, when thoth-mem tools are available, load \`thoth-mem-agents\` and \`requirements-interview\`, call \`mem_session_start\` with the current project and session identity, then save the real user prompt with \`mem_save_prompt\`.
+- Save only the real user request with \`mem_save_prompt\`; never save generated sub-agent prompts, handoffs, summaries, or tool scaffolding as user intent.
+- If thoth-mem tools or required session/project identity are unavailable, disclose that memory bootstrap could not run and continue without pretending memory was saved.
+</session-bootstrap>
+
+<routing>
+{{role.explorer}}: read-only codebase discovery. Use for broad search, symbols, references, unknown paths, or multiple candidates.
+{{role.librarian}}: read-only external docs/public examples. Use for version-sensitive APIs, official docs, or unfamiliar libraries.
+{{role.oracle}}: read-only review/diagnosis. Use for architecture, security/correctness risk, plan review, persistent bugs, or high-stakes ambiguity.
+{{role.designer}}: write-capable UI/UX owner. Use for user-facing UI, styles, layout, interactions, and all visual QA.
+{{role.quick}}: write-capable narrow implementer. Use for clear, mechanical, low-risk, uniform edits.
+{{role.deep}}: write-capable thorough implementer. Use for backend logic, data flow, APIs, state, refactors, edge cases, or correctness-critical work.
+
+Tiebreakers:
+- User-facing UI -> {{role.designer}}. Backend/system logic -> {{role.deep}}. Mechanical pattern -> {{role.quick}}.
+- Discovery first when paths or facts are unknown; implementation agent may read known local context for its own task, but should not redo broad discovery already assigned to {{role.explorer}}/{{role.librarian}}.
+- Do not use {{role.oracle}} for routine synthesis. After {{role.explorer}}/{{role.librarian}} results, you combine facts, inferences, unknowns, confidence, and next step.
+</routing>
+
+<subagent-prompts>
+- Every sub-agent prompt you write must be in English, regardless of the user's language.
+- Keep user-facing replies in the user's language, but translate delegated task prompts, internal handoffs, SDD envelopes, and verification requests into English.
+- Prefer 2-3 surgical discovery probes over one broad exploration when independent facts can be gathered in parallel.
+- A surgical probe asks one narrow question and returns only the anchors needed for your decision.
+</subagent-prompts>
+
+<internal-handoff>
+Before dispatching {{role.designer}}, {{role.quick}}, or {{role.deep}} after discovery, synthesize a compact internal handoff. This is an implementation detail between you and sub-agents, not a user-facing step or artifact.
+
+Internal handoff fields:
+- Goal: the specific outcome for this task.
+- Decision: the chosen approach and why it is the right next move.
+- Evidence: relevant files, symbols, line anchors, docs, constraints, and known invariants from {{role.explorer}}/{{role.librarian}}.
+- Scope: exact files/areas to change and non-goals to avoid.
+- Steps: ordered implementation instructions, including what to preserve.
+- Verification: smallest sufficient checks or visual QA required.
+- Uncertainty: remaining unknowns the implementer may resolve locally, plus what should be escalated instead of guessed.
+
+Never mention the internal handoff to the user, ask the user to prepare it, or present handoff preparation as the recommended next step. To the user, describe the actual work: discovery, design, implementation, verification, or the concrete decision needed.
+
+For {{role.explorer}}/{{role.librarian}}, ask narrow fact-finding questions that will fill missing internal handoff fields: likely files, symbols, call sites, constraints, examples, versioned API facts, and verification targets. Require decision-ready findings, not raw context.
+</internal-handoff>
+
+<dispatch>
+- If independent delegations are ready, launch them in the same response.
+- Default to normal synchronous \`{{delegationTool}}\` execution.
+- Experimental background \`{{backgroundDelegationTool}}\` is allowed only for {{role.explorer}} and {{role.librarian}} for asynchronous delegation.
+- {{role.oracle}}, {{role.designer}}, {{role.quick}}, and {{role.deep}} always use normal synchronous \`{{delegationTool}}\` execution.
+- When using background \`{{delegationTool}}\`, treat it as conditional and non-portable: if the host does not expose the experimental path, fall back to normal synchronous \`{{delegationTool}}\`.
+- Use \`{{backgroundStatusTool}}\` to wait, poll, and collect background task results before synthesizing or reporting completion.
+- If a result is empty, contradictory, or low-confidence, retry once with a materially sharper prompt; then escalate with evidence via \`{{userQuestionTool}}\`.
+- If a named subagent hits capacity, retry that same role up to 3 attempts.
+- Never switch to \`default\`, \`worker\`, or any other role.
+- After 3 failures, stay on the same role; if a same-role model override exists, use it. Otherwise report a capacity blocker.
+- Write-capable dispatches must include the internal handoff when one exists, so implementers can edit instead of rediscovering the plan.
+- Never tell sub-agents to discard working-tree changes.
+</dispatch>
+
+<sdd>
+All work always starts with requirements-interview skill.
+
+Routes:
+- Direct implementation for low-complexity work.
+- Accelerated SDD: propose -> tasks.
+- Full SDD: propose -> spec -> design -> tasks.
+
+Hard gates:
+- Artifact-producing SDD phases are dispatched to {{role.deep}} or {{role.quick}} with the matching skill loaded.
+- {{role.oracle}} is read-only and only handles plan-reviewer.
+- Never skip artifacts or jump from requirements-interview to implementation when SDD is selected.
+- Before SDD execution, load \`executing-plans\`; then track progress in {{progressTool}} plus the persistent artifact.
+- If openspec persistence is selected and openspec/ is missing, dispatch sdd-init first.
+- During SDD execution, batch compatible implementation work.
+- Group consecutive ready SDD tasks for the same execution agent into one dispatch when dependencies, scope, and verification can be handled together. Keep per-task tracking and evidence; do not split a compatible {{role.designer}}/{{role.quick}}/{{role.deep}} run into one delegation per checkbox.
+
+SDD dispatch envelope must include: skill name, persistence mode, pipeline type, change name, project name, needed prior artifact context, verification expectation, and return envelope.
+After each phase, verify the sub-agent reported the openspec path and/or thoth-mem topic_key. Retry once if missing.
+
+Artifact governance handoff:
+- After \`sdd-tasks\`, you may surface report-only artifact governance findings before execution preparation starts.
+- Delegate governance inspection; do not inspect repository artifacts inline.
+- Do not treat governance findings as an execution gate.
+- Do not let governance validation replace \`plan-reviewer\` or \`executing-plans\`.
+- Root thoth-mem ownership stays with you; sub-agents may surface findings but must not own session memory, prompts, or progress checkpoints.
+
+Plan gate: after tasks, ask with \`{{userQuestionTool}}\`: "Review plan with {{role.oracle}} before executing (Recommended)" or "Proceed to execution".
+If reviewed, the review loop is complete only after [OKAY].
+If {{role.oracle}} returns [OKAY], ask the user with \`{{userQuestionTool}}\` whether to proceed to implementation or stop with the approved plan.
+Do not dispatch \`sdd-apply\` after oracle approval until the user confirms implementation.
+Post-execution: delegate sdd-verify, then sdd-archive when verification passes.
+</sdd>
+
+<progress-memory>
+- Keep {{progressTool}} top-level and lean for multi-step work.
+- When SDD is active, update both {{progressTool}} and openspec/changes/{change-name}/tasks.md before dispatch and after results.
+- Root-session memory is yours: search before repeated work; save durable decisions, discoveries, bugs, patterns, constraints, and session summaries.
+- Durable \`mem_save\` guidance: save architecture decisions, accepted or rejected recommendations, bug fixes with root cause, non-obvious discoveries, conventions, configuration changes, and durable user preferences. Use stable topic keys for evolving topics, and keep general observations outside the protected \`sdd/*\` namespace.
+- Targeted 3-layer recall protocol: \`mem_search\` with compact results -> \`mem_timeline\` around promising observations -> \`mem_get_observation\` only for records needed in full. Use preview search only when compact results do not disambiguate.
+- SDD memory artifacts use deterministic topic keys only in thoth-mem or hybrid persistence modes: \`sdd/{change}/{artifact}\`.
+- Before ending the root session, call \`mem_session_summary\` with a concise Goal, Instructions, Discoveries, Accomplished, Next Steps, and Relevant Files summary. Do not claim memory was saved unless the tool call succeeded.
+- After compaction, first preserve the compacted summary with \`mem_session_summary\`, then recover recent context and use the 3-layer recall protocol before continuing work.
+</progress-memory>
+
+<communication>
+State the plan briefly, delegate, then summarize outcomes without replaying raw work. Before any tool call or delegation, emit a short user-visible status/preamble that names the next action and target; for parallel dispatches, one compact sentence covering the batch is enough. Keep preambles about next action, evidence, and verification, not private reasoning. Separate evidence, inference, and uncertainty when it matters. Never ask blocking questions in prose.
+</communication>`),
+    createQuestionProtocolSection()
+  ];
+}
+function createReadOnlySpecialistPromptSections(role) {
+  if (role === "explorer") {
+    return specialistSections({
+      role,
+      mode: "read-only",
+      dispatch: "task",
+      scope: "local repository discovery",
+      responsibility: "Find workspace facts fast. Return decision-ready evidence for internal handoffs: paths, lines, symbols, constraints, edit targets, and conclusions.",
+      rules: [
+        "- Questions should be rare; exhaust local evidence first.",
+        "- Prefer paths, lines, symbols, and concise summaries over dumps.",
+        "- When full content is explicitly requested, reproduce it faithfully."
+      ],
+      memoryAccess: "readonly",
+      output: `
+Return exactly these sections, in this order:
+
+STATUS: one of CONFIRMED | PARTIAL | INCONCLUSIVE
+- CONFIRMED = direct evidence answers the question with high confidence.
+- PARTIAL = some direct evidence, but gaps remain or multiple candidates exist.
+- INCONCLUSIVE = no sufficient evidence found. Never fabricate a confident answer from naming similarity alone.
+
+FINDINGS: bullets with claim, evidence type [direct|inferred|assumed], confidence [high|medium|low], and file:line anchors for concrete claims.
+
+ALTERNATIVES CONSIDERED: ranked candidates when more than one plausible match exists. Omit if only one candidate.
+
+UNRESOLVED QUESTIONS: what remains ambiguous. State what additional context would unblock the search.
+
+UNCHECKED AREAS: what you did not inspect that could change the answer. Omit if nothing notable.
+
+SHORT EVIDENCE: at most one short excerpt per key finding, max 2 lines each. Skip if citations are self-explanatory.
+
+Lead with STATUS. Stay under 40 lines total when possible. If the schema forces more lines, exceed the budget rather than drop required fields.`
+    });
+  }
+  if (role === "librarian") {
+    return specialistSections({
+      role,
+      mode: "read-only",
+      dispatch: "task",
+      scope: "external research plus local confirmation when needed",
+      responsibility: "Gather authoritative external evidence that helps the orchestrator make implementation decisions. Prefer official docs first, then high-signal public examples. Every substantive claim must carry a source URL.",
+      rules: [
+        "- Questions should be rare; exhaust available sources first.",
+        "- Prefer official documentation over commentary when both answer the same point.",
+        "- Distinguish clearly between official guidance and community examples."
+      ],
+      memoryAccess: "readonly",
+      output: `- Organize by finding. Include a source URL for every claim.
+- Distinguish official docs from community examples.
+- Return synthesized findings, not full documentation excerpts.
+- Target: under 40 lines total.`
+    });
+  }
+  return specialistSections({
+    role,
+    mode: "read-only",
+    dispatch: "synchronous task only",
+    scope: "advice, diagnosis, architecture, code review, and plan review",
+    responsibility: "Provide strategic technical guidance anchored to evidence. Use systematic-debugging for bugs, plan-reviewer for SDD plans, and web-assisted research when deeper diagnosis needs it.",
+    rules: [
+      "- Cite exact files and lines for local claims.",
+      "- Separate observations, risks, and recommendations.",
+      "- Ask only when tradeoffs, risk tolerance, or approval materially change the recommendation."
+    ],
+    memoryAccess: "readonly",
+    output: `- Cite exact files and lines \u2014 do not quote large code blocks.
+- Separate observations, risks, and recommendations.
+- For diagnosis: root cause + fix recommendation, not step-by-step trace.
+- Target: under 50 lines total.`
+  });
+}
+function createWriteCapableSpecialistPromptSections(role) {
+  if (role === "designer") {
+    return specialistSections({
+      role,
+      mode: "write-capable",
+      dispatch: "synchronous task only",
+      scope: "UI/UX decisions, implementation, and visual verification",
+      responsibility: "Own the user-facing solution end to end: choose the UX approach, implement it, and verify it visually. Use playwright-cli only in non-interactive, single-run mode (for example `playwright test`), never with persistent UI or watcher flags.\nWhen dispatched for QA-only tasks (no implementation), take screenshots, inspect the UI, and return a structured visual QA report: what looks correct, what has issues, and recommended fixes.",
+      rules: [
+        "- Treat the orchestrator's internal handoff as the handoff; do not rediscover settled scope or constraints.",
+        "- Own UX decisions instead of bouncing them back unless a real user preference is required.",
+        "- Verify visually when feasible; do not stop at code that merely compiles.",
+        "- Keep changes focused on the user-facing outcome.",
+        "- NEVER run blocking or long-running commands: no `playwright test --ui`, `playwright show-report`, `--headed --debug`, dev servers, or watchers. Use single-run variants and capture screenshots/traces as artifacts."
+      ],
+      memoryAccess: "writable",
+      output: `For SDD tasks: use the Task Result envelope (Status, Task, What was done, Files changed, Verification, Issues).
+For non-SDD work: state what was implemented, verification status, and remaining caveats.
+- Include visual verification status when applicable.
+- Target: under 30 lines total.`
+    });
+  }
+  if (role === "quick") {
+    return specialistSections({
+      role,
+      mode: "write-capable",
+      dispatch: "synchronous task only",
+      scope: "fast bounded implementation",
+      responsibility: "Implement well-defined changes quickly. Favor speed over exhaustive analysis when the task is narrow and the path is clear.",
+      rules: [
+        "- Optimize for fast execution on narrow, clear tasks.",
+        "- Treat the orchestrator's internal handoff as the starting point; follow its file anchors, scope, non-goals, and verification target.",
+        "- Read only the context you need.",
+        "- Do not redo broad discovery. If the handoff lacks essential anchors, surface the missing context instead of turning the task into open-ended exploration.",
+        "- Avoid multi-step planning; if the task stops being bounded, surface it.",
+        "- Ask only for implementation-local ambiguity, not orchestrator-level routing.",
+        "- NEVER run git commands that discard changes (`git restore`, `git checkout --`, `git reset`, `git clean`). Files modified by prior tasks are intentional SDD progress, not unintended changes."
+      ],
+      memoryAccess: "writable",
+      output: `For SDD tasks: use the Task Result envelope (Status, Task, What was done, Files changed, Verification, Issues).
+For non-SDD work: status + summary + files changed + issues. Nothing more.
+- Target: under 20 lines total.`
+    });
+  }
+  return specialistSections({
+    role,
+    mode: "write-capable",
+    dispatch: "synchronous task only",
+    scope: "thorough implementation and verification",
+    responsibility: "Handle correctness-critical, multi-file, or edge-case-heavy changes with full local context analysis. Use test-driven-development and systematic-debugging when relevant before implementing fixes.",
+    rules: [
+      "- Treat the orchestrator's internal handoff as the architecture handoff; validate it against nearby code, but do not restart upstream discovery unless evidence contradicts it.",
+      "- Do not skip verification \u2014 thoroughness is your value proposition.",
+      "- Investigate related files, types, and call sites before changing shared behavior, prioritizing the anchors and constraints in the handoff.",
+      "- Ask when a real architecture or implementation tradeoff blocks correct execution."
+    ],
+    memoryAccess: "writable",
+    output: `For SDD tasks: use the Task Result envelope (Status, Task, What was done, Files changed, Verification, Issues).
+For non-SDD work: summary + files changed + verification results + edge cases considered.
+- Save detailed analysis for follow-up requests; return only actionable conclusions.
+- Target: under 40 lines total.`
+  });
+}
+function getPrimaryModelId(model) {
+  if (Array.isArray(model)) {
+    const first = model[0];
+    return typeof first === "string" ? first : first?.id;
+  }
+  return model;
+}
+function renderQuestionProtocol(_section, dialect) {
+  return `<questions>
+Use \`${dialect.tools.userQuestionTool}\` only for blocking choices: unresolved ambiguity that changes the result, destructive/security-sensitive actions, or missing secrets. Do all non-blocked work first, ask one targeted question with a recommended default first, then stop.
+</questions>`;
+}
+function renderSubagentRules(section, dialect) {
+  const rules = [
+    `- Single-task leaf agent: do not delegate, manage SDD phases, act as orchestrator, or call \`${dialect.tools.progressTool}\`.`,
+    `- Use \`${dialect.tools.userQuestionTool}\` only for local blocking decisions.`,
+    "- Never discard working-tree changes: no `git restore`, `git checkout -- <path>`, `git reset --hard`, `git clean`, or `git stash`.",
+    "- Avoid blocking/watch commands; use terminating checks only."
+  ];
+  if (section.memoryAccess === "readonly") {
+    rules.push(
+      "- Use read-only thoth-mem only when dispatch gives session_id/project: `mem_search` -> `mem_timeline` -> `mem_get_observation`.",
+      "- Never call `mem_session_start`, `mem_session_summary`, or `mem_save_prompt`; those tools are orchestrator-owned.",
+      "- Never write memory; memory writes are orchestrator-owned."
+    );
+  }
+  if (section.memoryAccess === "writable") {
+    rules.push(
+      "- Use delegated thoth-mem tools only (mem_save, mem_search, mem_get_observation, mem_timeline, mem_suggest_topic_key).",
+      "- Never call `mem_session_start`, `mem_session_summary`, or `mem_save_prompt`; those tools are orchestrator-owned.",
+      "- Always use the parent session_id/project from dispatch for every thoth-mem call.",
+      "- If either is missing, do NOT call thoth-mem.",
+      "- For reads, use only `mem_search` -> `mem_timeline` -> `mem_get_observation`.",
+      "- You do not own durable memory of your own; `mem_save` writes under the orchestrator's session/project only."
+    );
+  }
+  return rules.join("\n");
+}
+function renderResponseBudget() {
+  return "Return concise structured results: status, summary, files, verification/issues. Never return raw file dumps.";
+}
+function renderStepBudget(section) {
+  return `<step-budget>
+- You have a hard execution budget of ${section.steps} steps.
+- Plan your tool use before acting, prioritize the highest-signal checks first, and stop once you have enough evidence to answer.
+- Avoid repeated searches or reads. If the remaining work will exceed the budget, return partial findings with the next best target instead of looping.
+</step-budget>`;
+}
+function getRoleModelProfile(role) {
+  switch (role) {
+    case "orchestrator":
+      return "- Exploit your role by selecting the right specialist category, launching independent tasks together, and synthesizing facts/inferences/unknowns before the next dispatch.";
+    case "explorer":
+      return "- Exploit your role by scanning broadly first, then narrowing to symbol/path evidence with ranked candidates and confidence.";
+    case "librarian":
+      return "- Exploit your role by prioritizing official docs, dates, versions, and source quality before summarizing public examples.";
+    case "oracle":
+      return "- Exploit your role by challenging assumptions, identifying risk, and giving a decision-ready recommendation backed by evidence.";
+    case "designer":
+      return "- Exploit your role by making concrete UX choices, implementing them, and verifying the visible result instead of stopping at code review.";
+    case "quick":
+      return "- Exploit your role by applying the smallest clear edit, avoiding broad exploration, and returning immediately after focused verification.";
+    case "deep":
+      return "- Exploit your role by building a complete mental model of shared behavior, writing tests first when behavior changes, and verifying edge cases.";
+  }
+}
+function renderModelFamily(section) {
+  const roleGuidance = getRoleModelProfile(section.role);
+  if (section.family === "claude") {
+    return `<model-profile family="claude">
+- Use XML-like sections, label uncertainty, and delegate aggressively when agentic.
+${roleGuidance}
+</model-profile>`;
+  }
+  if (section.family === "openai") {
+    return `<model-profile family="openai">
+- Plan briefly, then act. Keep tool dispatch explicit: action, target, return shape.
+${roleGuidance}
+</model-profile>`;
+  }
+  if (section.family === "gemini") {
+    return `<model-profile family="gemini">
+- Use long-context breadth deliberately, then ground conclusions in exact anchors.
+${roleGuidance}
+</model-profile>`;
+  }
+  if (section.family === "kimi") {
+    return `<model-profile family="kimi">
+- Favor repository-scale navigation before edits; keep patches grounded in current file state.
+${roleGuidance}
+</model-profile>`;
+  }
+  return `<model-profile family="glm">
+- Use compact checklists, conservative steps, clear verification, and concrete blockers.
+${roleGuidance}
+</model-profile>`;
+}
+function renderRoleText(section, dialect) {
+  return section.template.replaceAll("{{delegationTool}}", dialect.tools.delegationTool).replaceAll(
+    "{{backgroundDelegationTool}}",
+    dialect.tools.backgroundDelegationTool ?? dialect.tools.delegationTool
+  ).replaceAll(
+    "{{backgroundStatusTool}}",
+    dialect.tools.backgroundStatusTool ?? dialect.tools.hostStatusSurface ?? ""
+  ).replaceAll("{{userQuestionTool}}", dialect.tools.userQuestionTool).replaceAll("{{progressTool}}", dialect.tools.progressTool).replaceAll("{{dispatch.task}}", dialect.dispatchLabel("task")).replaceAll(
+    "{{dispatch.synchronous-task-only}}",
+    dialect.dispatchLabel("synchronous-task-only")
+  ).replace(
+    /\{\{role\.(\w+)\}\}/g,
+    (_match, role) => dialect.renderRoleInvocation(role)
+  );
+}
+function renderPromptSection(section, dialect) {
+  switch (section.kind) {
+    case "question-protocol":
+      return renderQuestionProtocol(section, dialect);
+    case "subagent-rules":
+      return renderSubagentRules(section, dialect);
+    case "response-budget":
+      return renderResponseBudget();
+    case "step-budget":
+      return renderStepBudget(section);
+    case "model-family":
+      return renderModelFamily(section);
+    case "role-text":
+      return renderRoleText(section, dialect);
+  }
+}
+function renderRolePrompt(sections, dialect) {
+  return sections.map((section) => renderPromptSection(section, dialect).trim()).filter(Boolean).join("\n\n");
+}
+
+// src/agents/prompt-utils.ts
+var QUESTION_PROTOCOL = renderPromptSection(
+  createQuestionProtocolSection(),
+  OPENCODE_PROMPT_DIALECT
+);
+var SUBAGENT_RULES = renderPromptSection(
+  createSubagentRulesSection("base"),
+  OPENCODE_PROMPT_DIALECT
+);
+var SUBAGENT_RULES_READONLY = renderPromptSection(
+  createSubagentRulesSection("readonly"),
+  OPENCODE_PROMPT_DIALECT
+);
+var SUBAGENT_RULES_WRITABLE = renderPromptSection(
+  createSubagentRulesSection("writable"),
+  OPENCODE_PROMPT_DIALECT
+);
+var RESPONSE_BUDGET = renderPromptSection(
+  createResponseBudgetSection(),
+  OPENCODE_PROMPT_DIALECT
+);
+function trimPromptSection(section) {
+  const trimmed = section?.trim();
+  return trimmed ? trimmed : void 0;
+}
+function appendPromptSections(...sections) {
+  return sections.map(trimPromptSection).filter(Boolean).join("\n\n");
+}
+function replacePromptPlaceholders(template, placeholders = {}) {
+  return Object.entries(placeholders).reduce((prompt, [key, value]) => {
+    if (value === void 0) {
+      return prompt;
+    }
+    return prompt.replaceAll(`{{${key}}}`, String(value));
+  }, template);
+}
+function composeAgentPrompt({
+  basePrompt,
+  customPrompt,
+  customAppendPrompt,
+  placeholders
+}) {
+  const resolvedBase = replacePromptPlaceholders(basePrompt, placeholders);
+  if (customPrompt) {
+    return replacePromptPlaceholders(customPrompt, placeholders);
+  }
+  return appendPromptSections(
+    resolvedBase,
+    replacePromptPlaceholders(customAppendPrompt ?? "", placeholders)
+  );
+}
+
+// src/config/constants.ts
+var AGENT_ALIASES = {
+  explore: "explorer",
+  "frontend-ui-ux-engineer": "designer"
+};
+var DEFAULT_MODELS = {
+  orchestrator: void 0,
+  oracle: "openai/gpt-5.4",
+  librarian: "openai/gpt-5.4-mini",
+  explorer: "openai/gpt-5.4-mini",
+  designer: "openai/gpt-5.4-mini",
+  quick: "openai/gpt-5.4-mini",
+  deep: "openai/gpt-5.4"
+};
+var DEFAULT_TIMEOUT_MS = 2 * 60 * 1e3;
+var MAX_POLL_TIME_MS = 5 * 60 * 1e3;
+var DEFAULT_THOTH_COMMAND = ["pnpm", "dlx", "thoth-mem@latest"];
+
+// src/config/loader.ts
+import * as fs from "fs";
+import * as path from "path";
+
+// src/cli/config-io.ts
+import {
+  copyFileSync,
+  existsSync as existsSync2,
+  readFileSync,
+  renameSync,
+  statSync,
+  writeFileSync
+} from "fs";
+
+// src/cli/paths.ts
+import { existsSync, mkdirSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+function getDefaultOpenCodeConfigDir() {
+  const userConfigDir = process.env.XDG_CONFIG_HOME ? process.env.XDG_CONFIG_HOME : join(homedir(), ".config");
+  return join(userConfigDir, "opencode");
+}
+function getCustomOpenCodeConfigDir() {
+  const configDir = process.env.OPENCODE_CONFIG_DIR?.trim();
+  return configDir || void 0;
+}
+function getConfigDir() {
+  const customConfigDir = getCustomOpenCodeConfigDir();
+  if (customConfigDir) {
+    return customConfigDir;
+  }
+  return getDefaultOpenCodeConfigDir();
+}
+function getOpenCodeConfigPaths() {
+  const configDir = getDefaultOpenCodeConfigDir();
+  return [join(configDir, "opencode.json"), join(configDir, "opencode.jsonc")];
+}
+function getConfigJson() {
+  return getOpenCodeConfigPaths()[0];
+}
+function getConfigJsonc() {
+  return getOpenCodeConfigPaths()[1];
+}
+function getLiteConfig() {
+  return join(getConfigDir(), "thoth-agents.json");
+}
+function getLiteConfigJsonc() {
+  return join(getConfigDir(), "thoth-agents.jsonc");
+}
+function getExistingLiteConfigPath() {
+  const jsonPath = getLiteConfig();
+  if (existsSync(jsonPath)) return jsonPath;
+  const jsoncPath = getLiteConfigJsonc();
+  if (existsSync(jsoncPath)) return jsoncPath;
+  return jsonPath;
+}
+function getExistingConfigPath() {
+  const jsonPath = getConfigJson();
+  if (existsSync(jsonPath)) return jsonPath;
+  const jsoncPath = getConfigJsonc();
+  if (existsSync(jsoncPath)) return jsoncPath;
+  return jsonPath;
+}
+function ensureConfigDir() {
+  const configDir = getConfigDir();
+  if (!existsSync(configDir)) {
+    mkdirSync(configDir, { recursive: true });
+  }
+}
+function ensureOpenCodeConfigDir() {
+  const configDir = dirname(getConfigJson());
+  if (!existsSync(configDir)) {
+    mkdirSync(configDir, { recursive: true });
+  }
+}
+
+// src/cli/providers.ts
+var MODEL_MAPPINGS = {
+  openai: {
+    orchestrator: { model: "openai/gpt-5.4" },
+    oracle: { model: "openai/gpt-5.4", variant: "high" },
+    librarian: { model: "openai/gpt-5.4-mini", variant: "low" },
+    explorer: { model: "openai/gpt-5.4-mini", variant: "low" },
+    designer: { model: "openai/gpt-5.4-mini", variant: "medium" },
+    quick: { model: "openai/gpt-5.4-mini", variant: "low" },
+    deep: { model: "openai/gpt-5.4", variant: "high" }
+  },
+  kimi: {
+    orchestrator: { model: "kimi-for-coding/k2p5" },
+    oracle: { model: "kimi-for-coding/k2p5", variant: "high" },
+    librarian: { model: "kimi-for-coding/k2p5", variant: "low" },
+    explorer: { model: "kimi-for-coding/k2p5", variant: "low" },
+    designer: { model: "kimi-for-coding/k2p5", variant: "medium" },
+    quick: { model: "kimi-for-coding/k2p5", variant: "low" },
+    deep: { model: "kimi-for-coding/k2p5", variant: "high" }
+  },
+  copilot: {
+    orchestrator: { model: "github-copilot/claude-opus-4.6" },
+    oracle: { model: "github-copilot/claude-opus-4.6", variant: "high" },
+    librarian: { model: "github-copilot/grok-code-fast-1", variant: "low" },
+    explorer: { model: "github-copilot/grok-code-fast-1", variant: "low" },
+    designer: {
+      model: "github-copilot/gemini-3.1-pro-preview",
+      variant: "medium"
+    },
+    quick: { model: "github-copilot/claude-sonnet-4.6", variant: "low" },
+    deep: { model: "github-copilot/claude-opus-4.6", variant: "high" }
+  },
+  "zai-plan": {
+    orchestrator: { model: "zai-coding-plan/glm-5" },
+    oracle: { model: "zai-coding-plan/glm-5", variant: "high" },
+    librarian: { model: "zai-coding-plan/glm-5", variant: "low" },
+    explorer: { model: "zai-coding-plan/glm-5", variant: "low" },
+    designer: { model: "zai-coding-plan/glm-5", variant: "medium" },
+    quick: { model: "zai-coding-plan/glm-5", variant: "low" },
+    deep: { model: "zai-coding-plan/glm-5", variant: "high" }
+  }
+};
+function generateLiteConfig(installConfig) {
+  const config = {
+    preset: "openai",
+    presets: {}
+  };
+  const createAgentConfig = (modelInfo) => {
+    return {
+      model: modelInfo.model,
+      variant: modelInfo.variant
+    };
+  };
+  const buildPreset = (mappingName) => {
+    const mapping = MODEL_MAPPINGS[mappingName];
+    return Object.fromEntries(
+      Object.entries(mapping).map(([agentName, modelInfo]) => [
+        agentName,
+        createAgentConfig(modelInfo)
+      ])
+    );
+  };
+  config.presets.openai = buildPreset("openai");
+  if (installConfig.hasTmux) {
+    config.tmux = {
+      enabled: true,
+      layout: "main-vertical",
+      main_pane_size: 60
+    };
+  }
+  return config;
+}
+
+// src/cli/config-io.ts
+var PACKAGE_NAME = "thoth-agents";
+function stripJsonComments(json) {
+  const commentPattern = /\\"|"(?:\\"|[^"])*"|(\/\/.*|\/\*[\s\S]*?\*\/)/g;
+  const trailingCommaPattern = /\\"|"(?:\\"|[^"])*"|(,)(\s*[}\]])/g;
+  return json.replace(
+    commentPattern,
+    (match, commentGroup) => commentGroup ? "" : match
+  ).replace(
+    trailingCommaPattern,
+    (match, comma, closing) => comma ? closing : match
+  );
+}
+function parseConfigFile(path3) {
+  try {
+    if (!existsSync2(path3)) return { config: null };
+    const stat = statSync(path3);
+    if (stat.size === 0) return { config: null };
+    const content = readFileSync(path3, "utf-8");
+    if (content.trim().length === 0) return { config: null };
+    return { config: JSON.parse(stripJsonComments(content)) };
+  } catch (err) {
+    return { config: null, error: String(err) };
+  }
+}
+function parseConfig(path3) {
+  const result = parseConfigFile(path3);
+  if (result.config || result.error) return result;
+  if (path3.endsWith(".json")) {
+    const jsoncPath = path3.replace(/\.json$/, ".jsonc");
+    return parseConfigFile(jsoncPath);
+  }
+  return { config: null };
+}
+function writeConfig(configPath, config) {
+  if (configPath.endsWith(".jsonc")) {
+    console.warn(
+      "[config-manager] Writing to .jsonc file - comments will not be preserved"
+    );
+  }
+  const tmpPath = `${configPath}.tmp`;
+  const bakPath = `${configPath}.bak`;
+  const content = `${JSON.stringify(config, null, 2)}
+`;
+  if (existsSync2(configPath)) {
+    copyFileSync(configPath, bakPath);
+  }
+  writeFileSync(tmpPath, content);
+  renameSync(tmpPath, configPath);
+}
+async function addPluginToOpenCodeConfig() {
+  const configPath = getExistingConfigPath();
+  try {
+    ensureOpenCodeConfigDir();
+  } catch (err) {
+    return {
+      success: false,
+      configPath,
+      error: `Failed to create config directory: ${err}`
+    };
+  }
+  try {
+    const { config: parsedConfig, error } = parseConfig(configPath);
+    if (error) {
+      return {
+        success: false,
+        configPath,
+        error: `Failed to parse config: ${error}`
+      };
+    }
+    const config = parsedConfig ?? {};
+    const plugins = config.plugin ?? [];
+    const filteredPlugins = plugins.filter(
+      (p) => p !== PACKAGE_NAME && !p.startsWith(`${PACKAGE_NAME}@`)
+    );
+    filteredPlugins.push(`${PACKAGE_NAME}@latest`);
+    config.plugin = filteredPlugins;
+    writeConfig(configPath, config);
+    return { success: true, configPath };
+  } catch (err) {
+    return {
+      success: false,
+      configPath,
+      error: `Failed to update opencode config: ${err}`
+    };
+  }
+}
+function writeLiteConfig(installConfig, targetPath) {
+  const configPath = targetPath ?? getLiteConfig();
+  try {
+    ensureConfigDir();
+    const config = generateLiteConfig(installConfig);
+    const tmpPath = `${configPath}.tmp`;
+    const bakPath = `${configPath}.bak`;
+    const content = `${JSON.stringify(config, null, 2)}
+`;
+    if (existsSync2(configPath)) {
+      copyFileSync(configPath, bakPath);
+    }
+    writeFileSync(tmpPath, content);
+    renameSync(tmpPath, configPath);
+    return { success: true, configPath };
+  } catch (err) {
+    return {
+      success: false,
+      configPath,
+      error: `Failed to write lite config: ${err}`
+    };
+  }
+}
+function disableDefaultAgents() {
+  const configPath = getExistingConfigPath();
+  try {
+    ensureOpenCodeConfigDir();
+    const { config: parsedConfig, error } = parseConfig(configPath);
+    if (error) {
+      return {
+        success: false,
+        configPath,
+        error: `Failed to parse config: ${error}`
+      };
+    }
+    const config = parsedConfig ?? {};
+    const agent = config.agent ?? {};
+    agent.explore = { disable: true };
+    agent.general = { disable: true };
+    config.agent = agent;
+    writeConfig(configPath, config);
+    return { success: true, configPath };
+  } catch (err) {
+    return {
+      success: false,
+      configPath,
+      error: `Failed to disable default agents: ${err}`
+    };
+  }
+}
+function detectCurrentConfig() {
+  const result = {
+    isInstalled: false,
+    hasKimi: false,
+    hasOpenAI: false,
+    hasAnthropic: false,
+    hasCopilot: false,
+    hasZaiPlan: false,
+    hasAntigravity: false,
+    hasChutes: false,
+    hasOpencodeZen: false,
+    hasTmux: false
+  };
+  const { config } = parseConfig(getExistingConfigPath());
+  if (!config) return result;
+  const plugins = config.plugin ?? [];
+  result.isInstalled = plugins.some((p) => p.startsWith(PACKAGE_NAME));
+  result.hasAntigravity = plugins.some(
+    (p) => p.startsWith("opencode-antigravity-auth")
+  );
+  const providers = config.provider;
+  result.hasKimi = !!providers?.kimi;
+  result.hasAnthropic = !!providers?.anthropic;
+  result.hasCopilot = !!providers?.["github-copilot"];
+  result.hasZaiPlan = !!providers?.["zai-coding-plan"];
+  result.hasChutes = !!providers?.chutes;
+  if (providers?.google) result.hasAntigravity = true;
+  const { config: liteConfig } = parseConfig(getLiteConfig());
+  if (liteConfig && typeof liteConfig === "object") {
+    const configObj = liteConfig;
+    const presetName = configObj.preset;
+    const presets = configObj.presets;
+    const agents = presets?.[presetName];
+    if (agents) {
+      const models = Object.values(agents).map((a) => a?.model).filter(Boolean);
+      result.hasOpenAI = models.some((m) => m?.startsWith("openai/"));
+      result.hasAnthropic = models.some((m) => m?.startsWith("anthropic/"));
+      result.hasCopilot = models.some((m) => m?.startsWith("github-copilot/"));
+      result.hasZaiPlan = models.some((m) => m?.startsWith("zai-coding-plan/"));
+      result.hasOpencodeZen = models.some((m) => m?.startsWith("opencode/"));
+      if (models.some((m) => m?.startsWith("google/"))) {
+        result.hasAntigravity = true;
+      }
+      if (models.some((m) => m?.startsWith("chutes/"))) {
+        result.hasChutes = true;
+      }
+    }
+    if (configObj.tmux && typeof configObj.tmux === "object") {
+      const tmuxConfig = configObj.tmux;
+      result.hasTmux = tmuxConfig.enabled === true;
+    }
+  }
+  return result;
+}
+
+// src/config/schema.ts
+import { z } from "zod";
+var AGENT_NAMES = [
+  "orchestrator",
+  "oracle",
+  "designer",
+  "explorer",
+  "librarian",
+  "quick",
+  "deep"
+];
+var FALLBACK_AGENT_NAMES = [...AGENT_NAMES];
+var MANUAL_AGENT_NAMES = [...AGENT_NAMES];
+var ProviderModelIdSchema = z.string().regex(
+  /^[^/\s]+\/[^\s]+$/,
+  "Expected provider/model format (provider/.../model)"
+);
+var ManualAgentPlanSchema = z.object({
+  primary: ProviderModelIdSchema,
+  fallback1: ProviderModelIdSchema,
+  fallback2: ProviderModelIdSchema,
+  fallback3: ProviderModelIdSchema
+}).superRefine((value, ctx) => {
+  const unique = /* @__PURE__ */ new Set([
+    value.primary,
+    value.fallback1,
+    value.fallback2,
+    value.fallback3
+  ]);
+  if (unique.size !== 4) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "primary and fallbacks must be unique per agent"
+    });
+  }
+});
+var ManualPlanSchema = z.object({
+  orchestrator: ManualAgentPlanSchema,
+  oracle: ManualAgentPlanSchema,
+  designer: ManualAgentPlanSchema,
+  explorer: ManualAgentPlanSchema,
+  librarian: ManualAgentPlanSchema,
+  quick: ManualAgentPlanSchema,
+  deep: ManualAgentPlanSchema
+}).strict();
+var AgentModelChainSchema = z.array(z.string()).min(1);
+var FallbackChainsSchema = z.object({
+  orchestrator: AgentModelChainSchema.optional(),
+  oracle: AgentModelChainSchema.optional(),
+  designer: AgentModelChainSchema.optional(),
+  explorer: AgentModelChainSchema.optional(),
+  librarian: AgentModelChainSchema.optional(),
+  quick: AgentModelChainSchema.optional(),
+  deep: AgentModelChainSchema.optional()
+}).catchall(AgentModelChainSchema);
+var AgentOverrideConfigSchema = z.object({
+  model: z.union([
+    z.string(),
+    z.array(
+      z.union([
+        z.string(),
+        z.object({
+          id: z.string(),
+          variant: z.string().optional()
+        })
+      ])
+    )
+  ]).optional(),
+  temperature: z.number().min(0).max(2).optional(),
+  steps: z.number().int().min(1).optional(),
+  variant: z.string().optional().catch(void 0)
+});
+var TmuxLayoutSchema = z.enum([
+  "main-horizontal",
+  // Main pane on top, agents stacked below
+  "main-vertical",
+  // Main pane on left, agents stacked on right
+  "tiled",
+  // All panes equal size grid
+  "even-horizontal",
+  // All panes side by side
+  "even-vertical"
+  // All panes stacked vertically
+]);
+var TmuxConfigSchema = z.object({
+  enabled: z.boolean().default(false),
+  layout: TmuxLayoutSchema.default("main-vertical"),
+  main_pane_size: z.number().min(20).max(80).default(60)
+  // percentage for main pane
+});
+var PresetSchema = z.record(z.string(), AgentOverrideConfigSchema);
+var AgentNameSchema = z.enum(AGENT_NAMES);
+var McpNameSchema = z.enum([
+  "exa",
+  "context7",
+  "grep_app",
+  "thoth_mem"
+]);
+var ThothConfigSchema = z.object({
+  command: z.array(z.string()).optional(),
+  data_dir: z.string().optional(),
+  environment: z.record(z.string(), z.string()).optional(),
+  timeout: z.number().optional(),
+  http_port: z.number().optional()
+});
+var ArtifactStoreModeSchema = z.enum([
+  "thoth-mem",
+  "openspec",
+  "hybrid"
+]);
+var ArtifactStoreConfigSchema = z.object({
+  mode: ArtifactStoreModeSchema.default("hybrid")
+});
+var CodexGenerationConfigSchema = z.object({
+  enabled: z.boolean().default(false),
+  outputRoot: z.string().optional(),
+  dryRun: z.boolean().default(true)
+});
+var FailoverConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  timeoutMs: z.number().min(0).default(15e3),
+  retryDelayMs: z.number().min(0).default(500),
+  chains: FallbackChainsSchema.default({})
+});
+var PluginConfigSchema = z.object({
+  preset: z.string().optional(),
+  setDefaultAgent: z.boolean().optional(),
+  scoringEngineVersion: z.enum(["v1", "v2-shadow", "v2"]).optional(),
+  balanceProviderUsage: z.boolean().optional(),
+  manualPlan: ManualPlanSchema.optional(),
+  presets: z.record(z.string(), PresetSchema).optional(),
+  agents: z.record(z.string(), AgentOverrideConfigSchema).optional(),
+  disabled_mcps: z.array(z.string()).optional(),
+  tmux: TmuxConfigSchema.optional(),
+  fallback: FailoverConfigSchema.optional(),
+  thoth: ThothConfigSchema.optional(),
+  artifactStore: ArtifactStoreConfigSchema.optional(),
+  codex: CodexGenerationConfigSchema.optional()
+});
+
+// src/config/loader.ts
+var PROMPTS_DIR_NAME = "thoth-agents";
+function loadAgentPrompt(agentName, preset) {
+  const presetDirName = preset && /^[a-zA-Z0-9_-]+$/.test(preset) ? preset : void 0;
+  const promptsDir = path.join(getConfigDir(), PROMPTS_DIR_NAME);
+  const promptSearchDirs = presetDirName ? [path.join(promptsDir, presetDirName), promptsDir] : [promptsDir];
+  const result = {};
+  const readFirstPrompt = (fileName, errorPrefix) => {
+    for (const dir of promptSearchDirs) {
+      const promptPath = path.join(dir, fileName);
+      if (!fs.existsSync(promptPath)) {
+        continue;
+      }
+      try {
+        return fs.readFileSync(promptPath, "utf-8");
+      } catch (error) {
+        console.warn(
+          `[thoth-agents] ${errorPrefix} ${promptPath}:`,
+          error instanceof Error ? error.message : String(error)
+        );
+      }
+    }
+    return void 0;
+  };
+  result.prompt = readFirstPrompt(
+    `${agentName}.md`,
+    "Error reading prompt file"
+  );
+  result.appendPrompt = readFirstPrompt(
+    `${agentName}_append.md`,
+    "Error reading append prompt file"
+  );
+  return result;
+}
+
+// src/config/utils.ts
+function getAgentOverride(config, name) {
+  const overrides = config?.agents ?? {};
+  return overrides[name] ?? overrides[Object.keys(AGENT_ALIASES).find((k) => AGENT_ALIASES[k] === name) ?? ""];
+}
+
+// src/mcp/context7.ts
+var CONTEXT7_MCP_URL = "https://mcp.context7.com/mcp";
+var context7 = {
+  type: "remote",
+  url: CONTEXT7_MCP_URL,
+  headers: process.env.CONTEXT7_API_KEY ? { CONTEXT7_API_KEY: process.env.CONTEXT7_API_KEY } : void 0,
+  oauth: false
+};
+
+// src/mcp/exa.ts
+var exa = {
+  type: "local",
+  command: ["npx", "-y", "exa-mcp-server"]
+};
+
+// src/mcp/grep-app.ts
+var GREP_APP_MCP_URL = "https://mcp.grep.app";
+
+// src/harness/core/agent-pack.ts
+var AGENT_ROLES = [
+  {
+    name: "orchestrator",
+    mode: "primary-non-mutating",
+    dispatch: "root-coordinator",
+    canMutateWorkspace: false,
+    scope: "coordination, routing, decisions, progress, and root memory",
+    responsibility: "Delegate-first coordinator for SDD workflow, specialist dispatch, and root-session memory ownership.",
+    toolGovernance: [
+      "delegates inspection, writing, debugging, and verification",
+      "owns question prompts and root-session memory",
+      "does not perform inline workspace implementation"
+    ],
+    verification: [
+      "routes verification to specialists",
+      "summarizes evidence from changed files, diagnostics, and tests"
+    ]
+  },
+  {
+    name: "explorer",
+    mode: "read-only",
+    dispatch: "task",
+    canMutateWorkspace: false,
+    scope: "local repository discovery",
+    responsibility: "Find workspace facts fast and return paths, lines, symbols, constraints, edit targets, and conclusions.",
+    toolGovernance: [
+      "read/search/code-navigation tools only",
+      "no durable memory writes",
+      "no task delegation or progress ownership"
+    ],
+    verification: ["reports confidence, anchors, unchecked areas, and gaps"]
+  },
+  {
+    name: "librarian",
+    mode: "read-only",
+    dispatch: "task",
+    canMutateWorkspace: false,
+    scope: "external research plus local confirmation when needed",
+    responsibility: "Gather authoritative external evidence and distinguish official docs from examples.",
+    toolGovernance: [
+      "research and read-only local confirmation tools",
+      "no workspace mutation",
+      "no durable memory writes"
+    ],
+    verification: ["sources every substantive external claim with a URL"]
+  },
+  {
+    name: "oracle",
+    mode: "read-only",
+    dispatch: "synchronous-task-only",
+    canMutateWorkspace: false,
+    scope: "advice, diagnosis, architecture, code review, and plan review",
+    responsibility: "Provide strategic technical guidance anchored to evidence and review SDD plans.",
+    toolGovernance: [
+      "read-only analysis and review",
+      "no implementation or artifact-producing SDD phases",
+      "no task delegation"
+    ],
+    verification: ["separates observations, risks, and recommendations"]
+  },
+  {
+    name: "designer",
+    mode: "write-capable",
+    dispatch: "synchronous-task-only",
+    canMutateWorkspace: true,
+    scope: "UI/UX decisions, implementation, and visual verification",
+    responsibility: "Own user-facing implementation choices and visual QA for UI work.",
+    toolGovernance: [
+      "may edit focused UI/UX files",
+      "owns screenshots and visual QA",
+      "does not delegate or own SDD progress"
+    ],
+    verification: ["includes visual verification status when applicable"]
+  },
+  {
+    name: "quick",
+    mode: "write-capable",
+    dispatch: "synchronous-task-only",
+    canMutateWorkspace: true,
+    scope: "fast bounded implementation",
+    responsibility: "Implement well-defined narrow or mechanical changes with focused verification.",
+    toolGovernance: [
+      "may edit bounded targets",
+      "does not perform broad rediscovery",
+      "does not delegate or own SDD progress"
+    ],
+    verification: ["runs the smallest sufficient focused check"]
+  },
+  {
+    name: "deep",
+    mode: "write-capable",
+    dispatch: "synchronous-task-only",
+    canMutateWorkspace: true,
+    scope: "thorough implementation and verification",
+    responsibility: "Handle correctness-critical, multi-file, or edge-case-heavy changes with full local context analysis.",
+    toolGovernance: [
+      "may edit implementation and tests",
+      "validates shared behavior against related code and call sites",
+      "does not delegate or own SDD progress"
+    ],
+    verification: ["does not skip verification and reports edge-case evidence"]
+  }
+];
+var DELEGATE_FIRST_RULES = [
+  "The orchestrator coordinates, decides, asks blocking questions, and delegates evidence or action.",
+  "Explorer, librarian, and oracle remain read-only specialists.",
+  "Designer, quick, and deep are write-capable leaf agents with synchronous task dispatch.",
+  "Subagents return findings, diffs, verification, and blockers rather than raw file dumps.",
+  "No leaf agent owns SDD progress checkboxes or orchestrator-only memory."
+];
+var VERIFICATION_PROTOCOL = [
+  "Completion reports include changed files and verification evidence.",
+  "Behavior changes require the smallest sufficient automated check or an explicitly documented check.",
+  "Visual changes require designer-owned visual QA when feasible."
+];
+var AGENT_PACK_CONTRACT = {
+  roles: [...AGENT_ROLES],
+  delegateFirstRules: [...DELEGATE_FIRST_RULES],
+  verificationProtocol: [...VERIFICATION_PROTOCOL]
+};
+function getAgentPackContract() {
+  return {
+    roles: AGENT_PACK_CONTRACT.roles.map((role) => ({
+      ...role,
+      toolGovernance: [...role.toolGovernance],
+      verification: [...role.verification]
+    })),
+    delegateFirstRules: [...AGENT_PACK_CONTRACT.delegateFirstRules],
+    verificationProtocol: [...AGENT_PACK_CONTRACT.verificationProtocol]
+  };
+}
+
+// src/harness/core/memory-governance.ts
+var ROOT_OWNED_TOOLS = [
+  "mem_session_start",
+  "mem_session_summary",
+  "mem_save_prompt"
+];
+var READ_RECALL_CHAIN = [
+  "mem_search",
+  "mem_timeline",
+  "mem_get_observation"
+];
+var WRITE_CAPABLE_DELEGATED_TOOLS = [
+  "mem_save",
+  "mem_search",
+  "mem_get_observation",
+  "mem_timeline",
+  "mem_suggest_topic_key"
+];
+var ALL_MEMORY_TOOLS = [
+  ...ROOT_OWNED_TOOLS,
+  ...READ_RECALL_CHAIN,
+  "mem_suggest_topic_key",
+  "mem_save"
+];
+function uniqueTools(tools) {
+  return [...new Set(tools)];
+}
+function roleAllowedTools(role) {
+  if (role.name === "orchestrator") {
+    return uniqueTools([...ROOT_OWNED_TOOLS, ...WRITE_CAPABLE_DELEGATED_TOOLS]);
+  }
+  if (role.mode === "read-only") {
+    return [...READ_RECALL_CHAIN];
+  }
+  return [...WRITE_CAPABLE_DELEGATED_TOOLS];
+}
+function roleRules(role) {
+  const sharedSubagentRules = [
+    "Every subagent memory call requires the parent session_id and project from dispatch; if either is missing, do not call thoth-mem.",
+    "Never call mem_session_start, mem_session_summary, or mem_save_prompt; those tools are root/orchestrator-owned.",
+    "Protect the sdd/* topic namespace; SDD artifacts may use deterministic sdd/{change}/{artifact} topic keys only in persistence modes that include thoth-mem."
+  ];
+  if (role.name === "orchestrator") {
+    return [
+      "mem_session_start, mem_session_summary, and mem_save_prompt are root/main orchestrator-owned tools and responsibilities.",
+      "In harnesses without an orchestrator-named agent, root/main orchestrator-owned means the initial/root agent when the harness does not expose an orchestrator-named agent.",
+      "Dispatch parent session_id and project when authorizing subagent memory use.",
+      "Protect the sdd/* topic namespace and write SDD memory artifacts only in thoth-mem or hybrid persistence modes."
+    ];
+  }
+  if (role.mode === "read-only") {
+    return [
+      ...sharedSubagentRules,
+      "Read-only agents may only perform bounded, project-scoped recall with mem_search -> mem_timeline -> mem_get_observation when authorized.",
+      "Read-only agents must never write durable memory."
+    ];
+  }
+  return [
+    ...sharedSubagentRules,
+    "Write-capable agents may call mem_save only for delegated durable observations under the parent session/project.",
+    "For reads, use only mem_search -> mem_timeline -> mem_get_observation."
+  ];
+}
+function getRoleMemoryGovernance(role) {
+  const allowedTools = roleAllowedTools(role);
+  return {
+    role: role.name,
+    rootOwnedTools: [...ROOT_OWNED_TOOLS],
+    allowedTools,
+    forbiddenTools: ALL_MEMORY_TOOLS.filter(
+      (tool) => !allowedTools.includes(tool)
+    ),
+    requiresParentContext: role.name !== "orchestrator",
+    mayReadProjectMemory: role.name !== "orchestrator",
+    mayWriteDurableObservations: role.mode === "write-capable",
+    protectsSddNamespace: true,
+    rules: roleRules(role)
+  };
+}
+function renderMemoryGovernanceInstructions(role, dialect) {
+  const governance = getRoleMemoryGovernance(role);
+  const harnessRules = dialect ? [
+    `- Harness wording: use ${dialect.renderRoleInvocation("orchestrator")} as the memory owner and \`${dialect.tools.userQuestionTool}\` for blocking memory-context questions.`,
+    `- Progress ownership remains with the coordinator; report memory-governance verification for tracking in ${dialect.tools.progressTool}.`
+  ] : [];
+  return [
+    "thoth-mem governance:",
+    ...governance.rules.map((rule) => `- ${rule}`),
+    ...harnessRules,
+    `- Runtime enforcement: ${role.name === "orchestrator" ? "root-owned" : "instruction-level unless the target harness validates per-agent memory controls"}.`
+  ].join("\n");
+}
+function memoryGovernanceDiagnostics(input) {
+  const diagnostics = [];
+  if (input.permissionControls !== "supported") {
+    diagnostics.push({
+      severity: "warning",
+      code: `${input.harness}.permission.memory.enforcement_gap`,
+      message: "Runtime controls for root-only memory tools are unavailable; governance is rendered as instruction-level guidance.",
+      harness: input.harness,
+      capability: "rolePermissions",
+      fallback: "instruction-only"
+    });
+  }
+  if (input.parentContextInjection !== "supported") {
+    diagnostics.push({
+      severity: input.parentContextInjection === "unknown" ? "error" : "warning",
+      code: `${input.harness}.context.parent_injection.unvalidated`,
+      message: "Parent session_id/project injection is not runtime-enforced; subagents must be instructed not to use memory without explicit dispatch context.",
+      harness: input.harness,
+      capability: "parentContextInjection",
+      fallback: "instruction-only"
+    });
+  }
+  if (input.memoryWriteControls !== "supported") {
+    diagnostics.push({
+      severity: "warning",
+      code: `${input.harness}.permission.memory_write.enforcement_gap`,
+      message: "Runtime controls for delegated memory writes are unavailable; write-capable agents receive instruction-level mem_save limits only.",
+      harness: input.harness,
+      capability: "memoryGovernanceEnforcement",
+      fallback: "instruction-only"
+    });
+  }
+  return diagnostics;
+}
+
+// src/harness/core/skills.ts
+var ORCHESTRATOR_ONLY = ["orchestrator"];
+var SHARED_SKILL_SUPPORT = {
+  name: "_shared",
+  description: "Shared OpenSpec, persistence, and thoth-mem SDD conventions",
+  allowedRoles: [
+    "orchestrator",
+    "explorer",
+    "librarian",
+    "oracle",
+    "designer",
+    "quick",
+    "deep"
+  ],
+  sourcePath: "src/skills/_shared",
+  kind: "shared-support",
+  purpose: "support"
+};
+var BUNDLED_SKILL_REGISTRY = [
+  {
+    name: "requirements-interview",
+    description: "Mandatory step-0 discovery interview to understand user intent, clarify scope, and choose the right path before implementation",
+    allowedRoles: ORCHESTRATOR_ONLY,
+    sourcePath: "src/skills/requirements-interview",
+    kind: "skill",
+    purpose: "requirements"
+  },
+  {
+    name: "thoth-mem-agents",
+    description: "Orchestrator/subagent thoth-mem workflow contract for parent session_id/project ownership, prompt-save prohibitions, and safe durable memory usage",
+    allowedRoles: [
+      "orchestrator",
+      "explorer",
+      "librarian",
+      "oracle",
+      "designer",
+      "quick",
+      "deep"
+    ],
+    sourcePath: "src/skills/thoth-mem-agents",
+    kind: "skill",
+    purpose: "memory"
+  },
+  {
+    name: "plan-reviewer",
+    description: "Review SDD task plans for execution blockers and valid references",
+    allowedRoles: ["orchestrator", "oracle"],
+    sourcePath: "src/skills/plan-reviewer",
+    kind: "skill",
+    purpose: "review"
+  },
+  {
+    name: "sdd-init",
+    description: "Initialize OpenSpec structure and SDD project context",
+    allowedRoles: ORCHESTRATOR_ONLY,
+    sourcePath: "src/skills/sdd-init",
+    kind: "skill",
+    purpose: "sdd"
+  },
+  {
+    name: "sdd-propose",
+    description: "Create change proposals for OpenSpec workflows",
+    allowedRoles: ORCHESTRATOR_ONLY,
+    sourcePath: "src/skills/sdd-propose",
+    kind: "skill",
+    purpose: "sdd"
+  },
+  {
+    name: "sdd-spec",
+    description: "Write OpenSpec delta specifications",
+    allowedRoles: ORCHESTRATOR_ONLY,
+    sourcePath: "src/skills/sdd-spec",
+    kind: "skill",
+    purpose: "sdd"
+  },
+  {
+    name: "sdd-design",
+    description: "Create technical design artifacts for changes",
+    allowedRoles: ORCHESTRATOR_ONLY,
+    sourcePath: "src/skills/sdd-design",
+    kind: "skill",
+    purpose: "sdd"
+  },
+  {
+    name: "sdd-tasks",
+    description: "Generate phased implementation task checklists",
+    allowedRoles: ORCHESTRATOR_ONLY,
+    sourcePath: "src/skills/sdd-tasks",
+    kind: "skill",
+    purpose: "sdd"
+  },
+  {
+    name: "sdd-apply",
+    description: "Execute tasks and persist implementation progress",
+    allowedRoles: ORCHESTRATOR_ONLY,
+    sourcePath: "src/skills/sdd-apply",
+    kind: "skill",
+    purpose: "sdd"
+  },
+  {
+    name: "executing-plans",
+    description: "Execute SDD task lists with real-time progress tracking, sub-agent dispatch, and verification checkpoints",
+    allowedRoles: ORCHESTRATOR_ONLY,
+    sourcePath: "src/skills/executing-plans",
+    kind: "skill",
+    purpose: "sdd"
+  },
+  {
+    name: "sdd-verify",
+    description: "Build verification reports and compliance matrices",
+    allowedRoles: ORCHESTRATOR_ONLY,
+    sourcePath: "src/skills/sdd-verify",
+    kind: "skill",
+    purpose: "sdd"
+  },
+  {
+    name: "sdd-archive",
+    description: "Archive completed OpenSpec changes with audit trails",
+    allowedRoles: ORCHESTRATOR_ONLY,
+    sourcePath: "src/skills/sdd-archive",
+    kind: "skill",
+    purpose: "sdd"
+  }
+];
+var SKILL_REGISTRY = [
+  ...BUNDLED_SKILL_REGISTRY,
+  SHARED_SKILL_SUPPORT
+];
+function getSkillRegistry() {
+  return SKILL_REGISTRY.map((entry) => ({
+    ...entry,
+    allowedRoles: [...entry.allowedRoles]
+  }));
+}
+
+// src/harness/writers/codex-plugin-package.ts
+import { createHash } from "crypto";
+
+// src/harness/adapters/codex-surfaces.ts
+var CODEX_HOOK_EVENTS = [
+  "SessionStart",
+  "UserPromptSubmit",
+  "PreToolUse",
+  "PermissionRequest",
+  "PostToolUse",
+  "Stop"
+];
+var SUPPORTED_CODEX_HOOK_OUTPUT_FIELDS = ["message"];
+var CODEX_PLUGIN_MANIFEST_FIELDS = [
+  "name",
+  "version",
+  "description",
+  "skills",
+  "mcpServers",
+  "apps",
+  "hooks",
+  "interface"
+];
+var CODEX_SURFACES = [
+  {
+    id: "project-agent-toml",
+    target: "agent-definition",
+    status: "validated",
+    artifactKind: "agent-config",
+    path: ".codex/agents/{name}.toml",
+    fields: [
+      "name",
+      "description",
+      "developer_instructions",
+      "model",
+      "model_reasoning_effort",
+      "sandbox_mode"
+    ],
+    diagnosticCode: "codex.surface.agent_definition.validated",
+    summary: "Project-scoped custom agents are standalone TOML files.",
+    evidence: "OpenAI Codex Subagents docs: ~/.codex/agents/ and .codex/agents/ with required name, description, developer_instructions."
+  },
+  {
+    id: "project-config-toml",
+    target: "config",
+    status: "validated",
+    artifactKind: "harness-config",
+    path: ".codex/config.toml",
+    fields: [
+      "model",
+      "model_reasoning_effort",
+      "approval_policy",
+      "sandbox_mode",
+      "features",
+      "mcp_servers",
+      "skills.config",
+      "agents"
+    ],
+    diagnosticCode: "codex.surface.config.validated",
+    summary: "Codex supports project-scoped config TOML after trust.",
+    evidence: "OpenAI Codex Configuration Reference: ~/.codex/config.toml and project .codex/config.toml overrides."
+  },
+  {
+    id: "mcp-server-config",
+    target: "mcp-config",
+    status: "validated",
+    artifactKind: "mcp-config",
+    path: ".codex/config.toml",
+    fields: ["mcp_servers.<id>", "url", "command", "args", "env", "tools"],
+    diagnosticCode: "codex.surface.mcp.validated",
+    summary: "MCP servers are configured through Codex config TOML.",
+    evidence: "OpenAI Codex config docs describe mcp_servers and per-tool approval overrides."
+  },
+  {
+    id: "repo-skills-directory",
+    target: "skill-directory",
+    status: "validated",
+    artifactKind: "skill",
+    path: ".agents/skills/{skill}/SKILL.md",
+    fields: ["SKILL.md", "scripts/", "references/", "assets/"],
+    diagnosticCode: "codex.surface.skills.validated",
+    summary: "Repository skills are discovered from .agents/skills.",
+    evidence: "OpenAI Codex Skills docs: repo skills are scanned from .agents/skills up to the repository root."
+  },
+  {
+    id: "project-hooks-json",
+    target: "hook-config",
+    status: "validated",
+    artifactKind: "hook-config",
+    path: ".codex/hooks.json",
+    fields: [
+      "SessionStart.command",
+      "UserPromptSubmit.command",
+      "PreToolUse.command",
+      "PermissionRequest.command",
+      "PostToolUse.command",
+      "Stop.command"
+    ],
+    diagnosticCode: "codex.surface.hooks_json.validated",
+    summary: "Codex supports project-local hooks.json command handlers.",
+    evidence: "OpenAI Codex hooks docs describe hooks.json with SessionStart, UserPromptSubmit, PreToolUse, PermissionRequest, PostToolUse, and Stop command handlers."
+  },
+  {
+    id: "inline-hooks-table",
+    target: "hook-config",
+    status: "validated",
+    artifactKind: "hook-config",
+    path: ".codex/config.toml",
+    fields: [
+      "hooks.SessionStart.command",
+      "hooks.UserPromptSubmit.command",
+      "hooks.PreToolUse.command",
+      "hooks.PermissionRequest.command",
+      "hooks.PostToolUse.command",
+      "hooks.Stop.command"
+    ],
+    diagnosticCode: "codex.surface.inline_hooks.validated",
+    summary: "Codex supports inline [hooks] configuration in TOML.",
+    evidence: "OpenAI Codex configuration docs describe inline [hooks] settings gated by trusted project configuration."
+  },
+  {
+    id: "features-hooks-toggle",
+    target: "hook-config",
+    status: "validated",
+    artifactKind: "hook-config",
+    path: ".codex/config.toml",
+    fields: ["features.hooks"],
+    diagnosticCode: "codex.surface.features_hooks.validated",
+    summary: "Codex hook loading is controlled by the features.hooks toggle.",
+    evidence: "OpenAI Codex configuration docs require enabling [features].hooks before project hook configuration is active."
+  },
+  {
+    id: "plugin-hooks-bundle",
+    target: "hook-config",
+    status: "validated",
+    artifactKind: "hook-config",
+    path: ".codex/plugins/{plugin}/hooks.json",
+    fields: ["features.plugin_hooks", "plugin.hooks", "plugin.trust_review"],
+    diagnosticCode: "codex.surface.plugin_hooks.validated",
+    summary: "Codex plugin hook bundles are documented behind plugin hook feature and trust review gates.",
+    evidence: "OpenAI Codex plugin docs describe bundled hook configuration requiring plugin_hooks enablement and trust review."
+  },
+  {
+    id: "plugin-manifest-json",
+    target: "plugin-manifest",
+    status: "validated",
+    artifactKind: "manifest",
+    path: ".codex-plugin/plugin.json",
+    fields: [...CODEX_PLUGIN_MANIFEST_FIELDS],
+    diagnosticCode: "codex.surface.plugin_manifest.validated",
+    summary: "Codex plugin packages are described by a plugin-root plugin.json manifest.",
+    evidence: "OpenAI Codex plugin docs describe plugin.json with official fields including name, version, description, skills, mcpServers, apps, hooks, and interface."
+  },
+  {
+    id: "plugin-skills-directory",
+    target: "skill-directory",
+    status: "validated",
+    artifactKind: "skill",
+    path: ".codex-plugin/skills/{skill}/SKILL.md",
+    fields: ["skills", "./skills/"],
+    diagnosticCode: "codex.surface.plugin_skills.validated",
+    summary: "Codex plugin packages can bundle skills under plugin-root skills/.",
+    evidence: "OpenAI Codex plugin docs describe plugin-bundled skills referenced from plugin.json using plugin-root relative paths."
+  },
+  {
+    id: "plugin-hooks-json",
+    target: "hook-config",
+    status: "validated",
+    artifactKind: "hook-config",
+    path: ".codex-plugin/hooks/hooks.json",
+    fields: ["hooks", "./hooks/hooks.json"],
+    diagnosticCode: "codex.surface.plugin_hooks_json.validated",
+    summary: "Codex plugin packages can bundle hook configuration under plugin-root hooks/.",
+    evidence: "OpenAI Codex plugin docs describe hook bundle assets referenced from plugin.json and gated by plugin_hooks plus trust review."
+  },
+  {
+    id: "plugin-mcp-json",
+    target: "mcp-config",
+    status: "validated",
+    artifactKind: "mcp-config",
+    path: ".codex-plugin/.mcp.json",
+    fields: ["mcpServers", "./.mcp.json"],
+    diagnosticCode: "codex.surface.plugin_mcp_json.validated",
+    summary: "Codex plugin packages can bundle MCP server definitions in plugin-root .mcp.json.",
+    evidence: "OpenAI Codex plugin docs describe bundled .mcp.json server definitions referenced from plugin.json using plugin-root relative paths."
+  },
+  {
+    id: "inline-hooks",
+    target: "hook-config",
+    status: "unknown",
+    artifactKind: "hook-config",
+    fields: ["features.hooks", "hooks"],
+    diagnosticCode: "codex.surface.hooks.unvalidated",
+    summary: "Lifecycle hook availability is documented, but hook event shape and parity with OpenCode runtime hooks is not validated for this adapter.",
+    evidence: "Codex config reference mentions hooks; this implementation has not validated exact event schemas for plugin parity.",
+    fallback: "diagnostic-only"
+  },
+  {
+    id: "per-agent-runtime-permissions",
+    target: "permission-control",
+    status: "unsupported",
+    fields: ["per-agent tool allow/deny equivalent to OpenCode permissions"],
+    diagnosticCode: "codex.permission.memory.enforcement_gap",
+    summary: "Codex sandbox and approval policy can constrain sessions, but OpenCode-style per-agent MCP/tool deny maps are not validated.",
+    evidence: "Codex approvals/security docs cover sandbox and approval policies, not exact OpenCode per-agent permission maps.",
+    fallback: "instruction-only"
+  },
+  {
+    id: "programmatic-delegation-runtime",
+    target: "delegation-runtime",
+    status: "unsupported",
+    fields: [
+      "task API",
+      "background task sessions",
+      "tmux lifecycle hooks",
+      "automatic subagent session close"
+    ],
+    diagnosticCode: "codex.delegation.runtime.unsupported",
+    summary: "Codex subagents are user/instruction-triggered; no OpenCode plugin task API or automatic subagent session close parity is validated.",
+    evidence: "Codex subagents docs describe manual spawning and agent threads, not this plugin runtime task API or a validated runtime close hook.",
+    fallback: "instruction-only"
+  },
+  {
+    id: "parent-context-injection",
+    target: "parent-context-injection",
+    status: "unknown",
+    fields: ["parent session_id", "project"],
+    diagnosticCode: "codex.context.parent_injection.unvalidated",
+    summary: "No machine-enforced parent context injection mechanism is validated; prompts must instruct users to include parent session_id/project.",
+    evidence: "No validated Codex surface in Phase 1 proves automatic parent context injection into spawned agents.",
+    fallback: "instruction-only"
+  }
+];
+function getCodexSurfaceRecords() {
+  return CODEX_SURFACES.map((surface) => ({
+    ...surface,
+    fields: [...surface.fields]
+  }));
+}
+function getCodexSurface(id) {
+  return getCodexSurfaceRecords().find((surface) => surface.id === id);
+}
+function assertCodexSurfaceCanGenerate(id) {
+  const surface = getCodexSurface(id);
+  if (!surface) {
+    return {
+      ok: false,
+      diagnostic: {
+        severity: "error",
+        code: "harness.surface_unvalidated",
+        message: `Codex surface "${id}" is not registered and cannot generate artifacts.`,
+        harness: "codex",
+        surface: id,
+        fallback: "diagnostic-only"
+      }
+    };
+  }
+  if (surface.status !== "validated" || !surface.artifactKind) {
+    return {
+      ok: false,
+      diagnostic: codexSurfaceDiagnostic(surface)
+    };
+  }
+  return { ok: true, surface };
+}
+function codexSurfaceDiagnostic(surface) {
+  const severity = surface.status === "unsupported" ? "warning" : "error";
+  return {
+    severity,
+    code: surface.diagnosticCode,
+    message: `${surface.summary} Artifact generation is disabled for this surface.`,
+    harness: "codex",
+    surface: surface.id,
+    fallback: surface.fallback ?? "diagnostic-only"
+  };
+}
+function normalizeCodexPath(value) {
+  return value.replace(/\\/g, "/");
+}
+function codexPluginPackageDiagnostic(code, message, surface) {
+  return {
+    severity: "error",
+    code,
+    message,
+    harness: "codex",
+    surface,
+    fallback: "diagnostic-only"
+  };
+}
+function isPathUnderCodexPlugin(pathValue) {
+  const normalized = normalizeCodexPath(pathValue);
+  const segments = normalized.split("/");
+  return !normalized.startsWith("/") && !/^[A-Za-z]:\//.test(normalized) && !segments.includes("..") && (normalized === ".codex-plugin" || normalized === ".codex-plugin/" || normalized.startsWith(".codex-plugin/"));
+}
+function fieldAllowedForPluginSurface(surface, field) {
+  if (surface.id === "plugin-manifest-json") {
+    return CODEX_PLUGIN_MANIFEST_FIELDS.includes(
+      field
+    );
+  }
+  return surface.fields.includes(field);
+}
+function validateCodexPluginPackageSurface(input) {
+  const canGenerate = assertCodexSurfaceCanGenerate(input.surfaceId);
+  if (!canGenerate.ok) {
+    return {
+      ok: false,
+      diagnostics: [
+        {
+          ...canGenerate.diagnostic,
+          code: "codex.plugin.surface.unvalidated",
+          message: `Codex plugin package surface "${input.surfaceId}" is not validated for .codex-plugin artifacts.`
+        }
+      ]
+    };
+  }
+  const diagnostics = [];
+  const surface = canGenerate.surface;
+  if (!surface.path?.startsWith(".codex-plugin")) {
+    diagnostics.push(
+      codexPluginPackageDiagnostic(
+        "codex.plugin.surface.unvalidated",
+        `Codex surface "${input.surfaceId}" is validated, but not as a .codex-plugin package surface.`,
+        input.surfaceId
+      )
+    );
+  }
+  if (input.path && !isPathUnderCodexPlugin(input.path)) {
+    diagnostics.push(
+      codexPluginPackageDiagnostic(
+        "codex.plugin.path.unvalidated",
+        `Codex plugin package path "${input.path}" must stay under .codex-plugin/.`,
+        input.surfaceId
+      )
+    );
+  }
+  for (const field of input.fields ?? []) {
+    if (!fieldAllowedForPluginSurface(surface, field)) {
+      diagnostics.push(
+        codexPluginPackageDiagnostic(
+          "codex.plugin.field.unvalidated",
+          `Codex plugin field "${field}" is not validated for surface "${input.surfaceId}".`,
+          input.surfaceId
+        )
+      );
+    }
+  }
+  if (diagnostics.length > 0) return { ok: false, diagnostics };
+  return { ok: true, surface };
+}
+function isCodexHookEvent(event) {
+  return CODEX_HOOK_EVENTS.includes(event);
+}
+function codexHookDiagnostic(code, message) {
+  return {
+    severity: "warning",
+    code,
+    message,
+    harness: "codex",
+    surface: "hook-config",
+    fallback: "diagnostic-only"
+  };
+}
+function inferHookHandlerType(handler) {
+  if (!handler) return void 0;
+  if (typeof handler.type === "string") return handler.type;
+  if ("command" in handler) return "command";
+  if ("prompt" in handler) return "prompt";
+  if ("agent" in handler) return "agent";
+  return void 0;
+}
+function validateCodexHookSurface(input) {
+  const diagnostics = [];
+  const handlerType = inferHookHandlerType(input.handler);
+  if (!isCodexHookEvent(input.event)) {
+    diagnostics.push(
+      codexHookDiagnostic(
+        "codex.hooks.event.unsupported",
+        `Codex hook event "${input.event}" is not documented for this adapter.`
+      )
+    );
+  }
+  if (handlerType !== "command") {
+    diagnostics.push(
+      codexHookDiagnostic(
+        handlerType === "prompt" ? "codex.hooks.handler.prompt_unsupported" : handlerType === "agent" ? "codex.hooks.handler.agent_unsupported" : "codex.hooks.handler.unsupported",
+        `Codex hook handler "${handlerType ?? "unknown"}" is not supported; only command handlers are validated.`
+      )
+    );
+  }
+  if (input.handler?.async === true) {
+    diagnostics.push(
+      codexHookDiagnostic(
+        "codex.hooks.async.unsupported",
+        "Async Codex hook execution is not validated for this adapter."
+      )
+    );
+  }
+  const unsupportedOutputField = input.outputFields?.find(
+    (field) => !SUPPORTED_CODEX_HOOK_OUTPUT_FIELDS.includes(field)
+  );
+  if (unsupportedOutputField) {
+    diagnostics.push(
+      codexHookDiagnostic(
+        "codex.hooks.output_field.unsupported",
+        `Codex hook output field "${unsupportedOutputField}" is not supported by the validated hook surface.`
+      )
+    );
+  }
+  if (input.interceptsToolExecution) {
+    diagnostics.push(
+      codexHookDiagnostic(
+        "codex.hooks.tool_interception.unsupported",
+        "Full tool interception is not supported; Codex hooks are diagnostic/config surfaces, not OpenCode runtime enforcement hooks."
+      )
+    );
+  }
+  if (diagnostics.length > 0 || !isCodexHookEvent(input.event)) {
+    return { ok: false, diagnostics };
+  }
+  return { ok: true, event: input.event, handlerType: "command" };
+}
+
+// src/harness/writers/codex-plugin-package.ts
+var PLUGIN_MANIFEST_SURFACE_ID = "plugin-manifest-json";
+function normalizePath(value) {
+  return value.replace(/\\/g, "/");
+}
+function pluginRootReference(pathValue) {
+  const normalized = normalizePath(pathValue);
+  const relative4 = normalized.slice(".codex-plugin/".length);
+  return `./${relative4}`;
+}
+function sha256(content) {
+  return `sha256:${createHash("sha256").update(content).digest("hex")}`;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stableValue(value) {
+  if (Array.isArray(value)) return value.map(stableValue);
+  if (!isRecord(value)) return value;
+  return Object.fromEntries(
+    Object.keys(value).sort((left, right) => left.localeCompare(right)).map((key) => [key, stableValue(value[key])])
+  );
+}
+function stableJson(value) {
+  return `${JSON.stringify(value, null, 2)}
+`;
+}
+function orderManifestFields(manifest) {
+  const ordered = {};
+  for (const field of CODEX_PLUGIN_MANIFEST_FIELDS) {
+    if (field in manifest) ordered[field] = manifest[field];
+  }
+  return ordered;
+}
+function fieldDiagnostic(field) {
+  return {
+    severity: "error",
+    code: "codex.plugin.field.unvalidated",
+    message: `Skipping unvalidated Codex plugin manifest field "${field}".`,
+    harness: "codex",
+    surface: PLUGIN_MANIFEST_SURFACE_ID,
+    fallback: "diagnostic-only"
+  };
+}
+function artifactKindForSurface(surfaceId) {
+  if (surfaceId === "plugin-mcp-json") return "mcp-config";
+  return surfaceId === "plugin-hooks-json" ? "hook-config" : "skill";
+}
+function codexHookPackageDiagnostic(code, message) {
+  return {
+    severity: "warning",
+    code,
+    message,
+    harness: "codex",
+    surface: "plugin-hooks-json",
+    fallback: "diagnostic-only"
+  };
+}
+function normalizeHookDefinition(hook) {
+  return {
+    command: hook.handler.command,
+    ...hook.outputFields?.length ? { output: [...hook.outputFields].sort() } : {}
+  };
+}
+function renderHookDefinitions(hookDefinitions) {
+  const diagnostics = [];
+  const hooksByEvent = /* @__PURE__ */ new Map();
+  for (const hook of hookDefinitions) {
+    const validation = validateCodexHookSurface(hook);
+    if (!validation.ok) {
+      diagnostics.push(...validation.diagnostics);
+      continue;
+    }
+    const eventHooks = hooksByEvent.get(validation.event) ?? [];
+    eventHooks.push(normalizeHookDefinition(hook));
+    hooksByEvent.set(validation.event, eventHooks);
+  }
+  if (hooksByEvent.size === 0) {
+    diagnostics.push(
+      codexHookPackageDiagnostic(
+        "codex.plugin.hooks.none_packaged",
+        "No Codex plugin hooks were packaged because no hook definitions passed existing Codex hook validation."
+      )
+    );
+    return { diagnostics };
+  }
+  const content = stableJson(
+    Object.fromEntries(
+      [...hooksByEvent.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([event, hooks]) => [event, hooks.map(stableValue)])
+    )
+  );
+  return { content, diagnostics };
+}
+function parseRawHookContent(content) {
+  const diagnostics = [];
+  const hookDefinitions = [];
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return {
+      hookDefinitions,
+      diagnostics: [
+        codexHookPackageDiagnostic(
+          "codex.plugin.hooks.invalid_json",
+          "Skipping Codex plugin hooks asset because hooks.json content is not valid JSON."
+        )
+      ]
+    };
+  }
+  if (!isRecord(parsed)) {
+    return {
+      hookDefinitions,
+      diagnostics: [
+        codexHookPackageDiagnostic(
+          "codex.plugin.hooks.invalid_shape",
+          "Skipping Codex plugin hooks asset because hooks.json must be an object keyed by Codex hook event."
+        )
+      ]
+    };
+  }
+  for (const [event, definitions] of Object.entries(parsed)) {
+    if (!Array.isArray(definitions)) {
+      diagnostics.push(
+        codexHookPackageDiagnostic(
+          "codex.plugin.hooks.invalid_shape",
+          `Skipping Codex plugin hook event "${event}" because its value is not an array of command handlers.`
+        )
+      );
+      continue;
+    }
+    for (const definition of definitions) {
+      if (!isRecord(definition)) {
+        diagnostics.push(
+          codexHookPackageDiagnostic(
+            "codex.plugin.hooks.invalid_shape",
+            `Skipping Codex plugin hook event "${event}" entry because it is not an object.`
+          )
+        );
+        continue;
+      }
+      const output = definition.output;
+      hookDefinitions.push({
+        event,
+        handler: {
+          type: typeof definition.type === "string" ? definition.type : "command",
+          command: definition.command,
+          async: definition.async
+        },
+        outputFields: Array.isArray(output) ? output.filter((field) => typeof field === "string") : void 0,
+        interceptsToolExecution: definition.interceptsToolExecution === true
+      });
+    }
+  }
+  return { hookDefinitions, diagnostics };
+}
+function resolveHookAssetContent(asset) {
+  if (asset.surfaceId !== "plugin-hooks-json") {
+    return { content: asset.content, diagnostics: [] };
+  }
+  const fromInput = asset.hookDefinitions ? { hookDefinitions: [...asset.hookDefinitions], diagnostics: [] } : asset.content !== void 0 ? parseRawHookContent(asset.content) : { hookDefinitions: [], diagnostics: [] };
+  const rendered = renderHookDefinitions(fromInput.hookDefinitions);
+  return {
+    content: rendered.content,
+    diagnostics: [...fromInput.diagnostics, ...rendered.diagnostics]
+  };
+}
+function renderCodexPluginPackage(input) {
+  const artifacts = [];
+  const diagnostics = [];
+  const manifest = {};
+  const provenance = [];
+  for (const field of Object.keys(input.manifest)) {
+    if (!CODEX_PLUGIN_MANIFEST_FIELDS.includes(
+      field
+    )) {
+      diagnostics.push(fieldDiagnostic(field));
+    }
+  }
+  const manifestValidation = validateCodexPluginPackageSurface({
+    surfaceId: PLUGIN_MANIFEST_SURFACE_ID,
+    path: ".codex-plugin/plugin.json",
+    fields: Object.keys(input.manifest).filter(
+      (field) => CODEX_PLUGIN_MANIFEST_FIELDS.includes(
+        field
+      )
+    )
+  });
+  if (!manifestValidation.ok)
+    diagnostics.push(...manifestValidation.diagnostics);
+  for (const field of CODEX_PLUGIN_MANIFEST_FIELDS) {
+    if (field in input.manifest)
+      manifest[field] = stableValue(input.manifest[field]);
+  }
+  for (const asset of [...input.assets ?? []].sort(
+    (left, right) => normalizePath(left.path).localeCompare(normalizePath(right.path))
+  )) {
+    const assetPath = normalizePath(asset.path);
+    const validation = validateCodexPluginPackageSurface({
+      surfaceId: asset.surfaceId,
+      path: assetPath,
+      fields: [asset.manifestField]
+    });
+    if (!validation.ok) {
+      diagnostics.push(...validation.diagnostics);
+      continue;
+    }
+    const hookContent = resolveHookAssetContent(asset);
+    diagnostics.push(...hookContent.diagnostics);
+    if (asset.surfaceId === "plugin-hooks-json" && !hookContent.content) {
+      continue;
+    }
+    const assetContent = hookContent.content ?? asset.content;
+    const reference = pluginRootReference(assetPath);
+    manifest[asset.manifestField] = reference;
+    if (assetContent !== void 0 && !assetPath.endsWith("/")) {
+      artifacts.push({
+        harness: "codex",
+        kind: artifactKindForSurface(asset.surfaceId),
+        path: assetPath,
+        description: asset.description ?? `Codex plugin asset for ${asset.manifestField}`,
+        content: assetContent
+      });
+    }
+    provenance.push({
+      field: asset.manifestField,
+      path: assetPath,
+      reference,
+      ...asset.provenanceName ? { name: asset.provenanceName } : {},
+      ...asset.sourcePath ? { sourcePath: normalizePath(asset.sourcePath) } : {},
+      ...assetContent !== void 0 ? { sha256: sha256(assetContent) } : {}
+    });
+  }
+  artifacts.push({
+    harness: "codex",
+    kind: "manifest",
+    path: ".codex-plugin/plugin.json",
+    description: "Deterministic Codex plugin package manifest.",
+    content: stableJson(orderManifestFields(manifest))
+  });
+  artifacts.push({
+    harness: "codex",
+    kind: "manifest",
+    path: ".codex-plugin/.thoth-agents-plugin-assets.json",
+    description: "Deterministic Codex plugin package asset provenance.",
+    content: stableJson({
+      generatedBy: "thoth-agents",
+      assets: provenance.sort(
+        (left, right) => left.path.localeCompare(right.path)
+      )
+    })
+  });
+  return { artifacts, diagnostics };
+}
+
+// src/harness/writers/codex-toml.ts
+function escapeTomlString(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\t/g, "\\t").replace(/\n/g, "\\n").replace(/\f/g, "\\f").replace(/\r/g, "\\r");
+}
+function escapeTomlMultilineString(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"""/g, '\\"\\"\\"').replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+}
+function renderScalar(value) {
+  if (typeof value === "string") return `"${escapeTomlString(value)}"`;
+  if (typeof value === "number" || typeof value === "boolean") {
+    return String(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(renderScalar).join(", ")}]`;
+  }
+  throw new Error(`Unsupported TOML scalar: ${String(value)}`);
+}
+function renderField(key, value) {
+  if (key === "developer_instructions" && typeof value === "string") {
+    return [`${key} = """`, escapeTomlMultilineString(value), '"""', ""];
+  }
+  return [`${key} = ${renderScalar(value)}`];
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function fieldOrder(fields, keys) {
+  const orderedRoots = fields.map((field) => field.split(".")[0]);
+  return [...keys].sort((left, right) => {
+    const leftIndex = orderedRoots.indexOf(left);
+    const rightIndex = orderedRoots.indexOf(right);
+    if (leftIndex !== -1 || rightIndex !== -1) {
+      return (leftIndex === -1 ? Number.MAX_SAFE_INTEGER : leftIndex) - (rightIndex === -1 ? Number.MAX_SAFE_INTEGER : rightIndex);
+    }
+    return left.localeCompare(right);
+  });
+}
+function isAllowedRoot(fields, key) {
+  return fields.some(
+    (field) => field === key || field.startsWith(`${key}.`) || field.includes("<id>") && key === field.split(".")[0]
+  );
+}
+function renderTable(lines, tablePath, value) {
+  lines.push(`[${tablePath.join(".")}]`);
+  const nested = [];
+  for (const key of Object.keys(value).sort()) {
+    const entry = value[key];
+    if (isRecord2(entry)) {
+      nested.push([key, entry]);
+    } else {
+      lines.push(...renderField(key, entry));
+    }
+  }
+  lines.push("");
+  for (const [key, entry] of nested) {
+    renderTable(lines, [...tablePath, key], entry);
+  }
+}
+function renderCodexToml(input) {
+  const canGenerate = assertCodexSurfaceCanGenerate(input.surfaceId);
+  if (!canGenerate.ok) {
+    return { content: "", diagnostics: [canGenerate.diagnostic] };
+  }
+  const surface = getCodexSurface(input.surfaceId);
+  const fields = surface?.fields ?? [];
+  const diagnostics = [];
+  const lines = [];
+  const tables = [];
+  for (const key of fieldOrder(fields, Object.keys(input.values))) {
+    const value = input.values[key];
+    if (!isAllowedRoot(fields, key)) {
+      diagnostics.push({
+        severity: "warning",
+        code: "codex.toml.field.unvalidated",
+        message: `Skipping unvalidated Codex TOML field "${key}" for surface "${input.surfaceId}".`,
+        harness: "codex",
+        surface: input.surfaceId,
+        fallback: "diagnostic-only"
+      });
+      continue;
+    }
+    if (isRecord2(value)) {
+      tables.push([key, value]);
+    } else {
+      lines.push(...renderField(key, value));
+    }
+  }
+  if (tables.length > 0 && lines.length > 0) lines.push("");
+  for (const [key, value] of tables) {
+    renderTable(lines, [key], value);
+  }
+  while (lines.at(-1) === "") lines.pop();
+  return {
+    content: lines.join("\n") + (lines.length > 0 ? "\n" : ""),
+    diagnostics
+  };
+}
+
+// src/harness/writers/skill-layout.ts
+import { createHash as createHash2 } from "crypto";
+import * as fs2 from "fs";
+import * as path2 from "path";
+var OUTPUT_MODE_CONFIG = {
+  "plugin-package": {
+    basePath: ".codex-plugin/skills",
+    manifestPath: ".codex-plugin/skills/.thoth-agents-manifest.json",
+    surfaceId: "plugin-skills-directory",
+    label: "plugin-bundled"
+  },
+  "repo-local-fallback": {
+    basePath: ".agents/skills",
+    manifestPath: ".agents/skills/.thoth-agents-manifest.json",
+    surfaceId: "repo-skills-directory",
+    label: "fallback .agents/skills"
+  }
+};
+function normalizePath2(value) {
+  return value.split(path2.sep).join("/");
+}
+function collectFiles(directory) {
+  if (!fs2.existsSync(directory)) return [];
+  const entries = fs2.readdirSync(directory, { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    const entryPath = path2.join(directory, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...collectFiles(entryPath));
+    } else if (entry.isFile()) {
+      files.push(entryPath);
+    }
+  }
+  return files.sort((left, right) => left.localeCompare(right));
+}
+function sha2562(content) {
+  return `sha256:${createHash2("sha256").update(content).digest("hex")}`;
+}
+function resolveOutputModes(input) {
+  const requested = input.outputModes ?? (input.outputMode ? [input.outputMode] : []);
+  const modes = requested.length > 0 ? requested : ["plugin-package"];
+  return [...new Set(modes)];
+}
+function duplicateScopeDiagnostic(skillNames, surfaceId) {
+  if (skillNames.length === 0) return void 0;
+  return {
+    severity: "warning",
+    code: "codex.skill.duplicate_scope_precedence_unverified",
+    message: `Codex skills are selected for both plugin-bundled and fallback .agents/skills scopes: ${skillNames.join(", ")}. Plugin-bundled skills are the intended primary package content, but runtime precedence with fallback scopes is unresolved and must be validated before relying on ordering.`,
+    harness: "codex",
+    surface: surfaceId,
+    fallback: "diagnostic-only"
+  };
+}
+function renderCodexSkillLayout(input) {
+  const surface = assertCodexSurfaceCanGenerate(input.surfaceId);
+  if (!surface.ok) {
+    return { artifacts: [], diagnostics: [surface.diagnostic] };
+  }
+  const artifacts = [];
+  const diagnostics = [];
+  const outputModes = resolveOutputModes(input);
+  for (const mode of outputModes) {
+    const modeSurface = assertCodexSurfaceCanGenerate(
+      OUTPUT_MODE_CONFIG[mode].surfaceId
+    );
+    if (!modeSurface.ok) diagnostics.push(modeSurface.diagnostic);
+  }
+  const duplicateDiagnostic = duplicateScopeDiagnostic(
+    outputModes.length > 1 ? input.skills.map((skill) => skill.name).sort() : [],
+    input.surfaceId
+  );
+  if (duplicateDiagnostic) diagnostics.push(duplicateDiagnostic);
+  const manifests = new Map(
+    outputModes.map((mode) => [mode, []])
+  );
+  for (const skill of [...input.skills].sort(
+    (left, right) => left.name.localeCompare(right.name)
+  )) {
+    const sourceRoot = path2.join(input.projectRoot, skill.sourcePath);
+    const files = collectFiles(sourceRoot);
+    if (files.length === 0) {
+      diagnostics.push({
+        severity: "warning",
+        code: "codex.skill.source_missing",
+        message: `Skipping Codex skill "${skill.name}" because source path "${skill.sourcePath}" was not found.`,
+        harness: "codex",
+        surface: input.surfaceId,
+        fallback: "diagnostic-only"
+      });
+      continue;
+    }
+    for (const file of files) {
+      const relative4 = normalizePath2(path2.relative(sourceRoot, file));
+      const content = fs2.readFileSync(file, "utf8");
+      const sourcePath = normalizePath2(path2.relative(input.projectRoot, file));
+      for (const mode of outputModes) {
+        const config = OUTPUT_MODE_CONFIG[mode];
+        const outputPath = `${config.basePath}/${skill.name}/${relative4}`;
+        artifacts.push({
+          harness: "codex",
+          kind: "skill",
+          path: outputPath,
+          description: `Codex ${config.label} skill artifact for ${skill.name}`,
+          content
+        });
+        manifests.get(mode)?.push({
+          name: skill.name,
+          sourcePath,
+          outputPath,
+          sha256: sha2562(content)
+        });
+      }
+    }
+  }
+  for (const mode of outputModes) {
+    const config = OUTPUT_MODE_CONFIG[mode];
+    artifacts.push({
+      harness: "codex",
+      kind: "manifest",
+      path: config.manifestPath,
+      description: `Generated Codex ${config.label} skill source manifest with source hashes.`,
+      content: `${JSON.stringify({ generatedBy: "thoth-agents", skills: manifests.get(mode) ?? [] }, null, 2)}
+`
+    });
+  }
+  return { artifacts, diagnostics };
+}
+
+// src/harness/adapters/codex.ts
+function readRootPackageVersion(startDir) {
+  const packageJsonPath = findRootPackageJsonPath([startDir, process.cwd()]);
+  return readPackageJsonVersion(packageJsonPath);
+}
+function createCodexPluginPackageManifest(projectRoot) {
+  return {
+    name: "thoth-agents",
+    version: readRootPackageVersion(projectRoot),
+    description: "Delegate-first OpenCode plugin with seven agents, thoth-mem persistence, and bundled SDD skills."
+  };
+}
+function findRootPackageJsonPath(startDirs) {
+  for (const startDir of startDirs) {
+    let currentDir = resolve(startDir);
+    while (true) {
+      const packageJsonPath = resolve(currentDir, "package.json");
+      if (existsSync5(packageJsonPath)) {
+        const packageJsonText = readFileSync4(packageJsonPath, "utf8");
+        const packageJson = JSON.parse(packageJsonText);
+        if (packageJson.name === "thoth-agents") {
+          return packageJsonPath;
+        }
+      }
+      const parentDir = dirname2(currentDir);
+      if (parentDir === currentDir) {
+        break;
+      }
+      currentDir = parentDir;
+    }
+  }
+  throw new Error(
+    "Unable to locate the thoth-agents root package.json from the render context or current working directory."
+  );
+}
+function readPackageJsonVersion(packageJsonPath) {
+  const packageJsonText = readFileSync4(packageJsonPath, "utf8");
+  const packageJson = JSON.parse(packageJsonText);
+  if (typeof packageJson.version !== "string" || packageJson.version.length === 0) {
+    throw new Error("Root package.json version must be a non-empty string.");
+  }
+  return packageJson.version;
+}
+function stableJson2(value) {
+  return `${JSON.stringify(value, null, 2)}
+`;
+}
+function codexCommandConfig(commandParts) {
+  const [command = "", ...args] = commandParts;
+  return {
+    command,
+    ...args.length > 0 ? { args } : {}
+  };
+}
+function codexMcpConfig(config) {
+  if ("url" in config) {
+    return { url: config.url };
+  }
+  const [command = "", ...args] = config.command;
+  return {
+    command,
+    ...args.length > 0 ? { args } : {},
+    ...config.environment && Object.keys(config.environment).length > 0 ? { env: config.environment } : {}
+  };
+}
+function createCodexBuiltinMcpServers() {
+  return {
+    exa: codexMcpConfig(exa),
+    context7: { url: CONTEXT7_MCP_URL },
+    grep_app: { url: GREP_APP_MCP_URL },
+    thoth_mem: codexCommandConfig(DEFAULT_THOTH_COMMAND)
+  };
+}
+function createCodexBuiltinMcpJsonConfig() {
+  return {
+    mcpServers: createCodexBuiltinMcpServers()
+  };
+}
+function createCodexBuiltinMcpTomlConfig() {
+  return {
+    mcp_servers: createCodexBuiltinMcpServers()
+  };
+}
+var CODEX_SUBAGENT_DEFAULT_MODELS = {
+  oracle: "gpt-5.5",
+  librarian: "gpt-5.4-mini",
+  explorer: "gpt-5.4-mini",
+  designer: "gpt-5.4-mini",
+  quick: "gpt-5.4-mini",
+  deep: "gpt-5.5"
+};
+var CODEX_SUBAGENT_REASONING_EFFORTS = {
+  oracle: "high",
+  explorer: "low",
+  librarian: "medium",
+  designer: "medium",
+  quick: "low",
+  deep: "medium"
+};
+var CODEX_ROOT_START = "<!-- thoth-agents:codex-root:start -->";
+var CODEX_ROOT_END = "<!-- thoth-agents:codex-root:end -->";
+var CODEX_CAPABILITIES = CODEX_PROMPT_DIALECT.capabilities.capabilities;
+function codexPromptSections(roleName) {
+  switch (roleName) {
+    case "orchestrator":
+      return createOrchestratorPromptSections();
+    case "explorer":
+    case "librarian":
+    case "oracle":
+      return createReadOnlySpecialistPromptSections(roleName);
+    case "designer":
+    case "quick":
+    case "deep":
+      return createWriteCapableSpecialistPromptSections(roleName);
+  }
+}
+function codexModelFamilyPromptSection(roleName, model) {
+  const section = createModelFamilySection(roleName, model);
+  return section ? renderPromptSection(section, CODEX_PROMPT_DIALECT) : void 0;
+}
+function codexStepBudgetPromptSection(steps) {
+  const section = createStepBudgetSection(steps);
+  return section ? renderPromptSection(section, CODEX_PROMPT_DIALECT) : void 0;
+}
+function renderCodexRolePrompt(roleName, config, model) {
+  const promptOverrides = loadAgentPrompt(roleName, config?.preset);
+  const override = getAgentOverride(config, roleName);
+  const basePrompt = renderRolePrompt(
+    codexPromptSections(roleName),
+    CODEX_PROMPT_DIALECT
+  );
+  const prompt = composeAgentPrompt({
+    basePrompt,
+    customPrompt: promptOverrides.prompt,
+    customAppendPrompt: appendPromptSections(
+      codexModelFamilyPromptSection(roleName, model),
+      promptOverrides.appendPrompt
+    )
+  });
+  return appendPromptSections(
+    prompt,
+    codexStepBudgetPromptSection(override?.steps)
+  );
+}
+function codexRoleInstructions(role) {
+  return [
+    "<role-operational-contract>",
+    `- Role: ${role.name}`,
+    `- Mode: ${role.mode}`,
+    `- Scope: ${role.scope}`,
+    `- Responsibility: ${role.responsibility}`,
+    "- Use request_user_input for local blocking decisions.",
+    "- Permissions, memory governance, runtime hooks, and provider-per-agent controls are instruction-level unless the active Codex runtime documents stronger enforcement.",
+    `- ${role.name} runs as a Codex custom agent TOML; there is no selectable orchestrator TOML.`,
+    ...role.toolGovernance.map((rule) => `- ${rule}`),
+    ...role.verification.map((rule) => `- ${rule}`),
+    "</role-operational-contract>"
+  ].join("\n");
+}
+function roleInstructions(role, config) {
+  const model = getCodexAgentModel(role, config) ?? DEFAULT_MODELS[role.name];
+  return [
+    renderCodexRolePrompt(role.name, config, model),
+    codexRoleInstructions(role),
+    renderMemoryGovernanceInstructions(role, CODEX_PROMPT_DIALECT)
+  ].join("\n\n");
+}
+function renderCodexRootInstructions(config) {
+  const rootOverride = getAgentOverride(config, "orchestrator");
+  const rootPrompt = renderCodexRolePrompt(
+    "orchestrator",
+    config,
+    rootOverride?.model ?? DEFAULT_MODELS.orchestrator
+  );
+  return [
+    CODEX_ROOT_START,
+    rootPrompt,
+    "<codex-runtime>",
+    "- The ambient Codex root session is the root/main orchestrator; orchestrator-only and root-owned instructions apply to it because Codex does not generate a selectable orchestrator agent TOML.",
+    "- On each new root session, when thoth-mem tools are installed and session/project identity is known, call mem_session_start with the active project and session identity, then save the real user prompt with mem_save_prompt before later delegation.",
+    "- If thoth-mem tools or identity values are unavailable, disclose that memory bootstrap could not run and continue without claiming memory was saved.",
+    "- Use the ambient Codex root session as the delegate-first root coordinator; do not generate or select an orchestrator TOML.",
+    "- Delegate by invoking the installed Codex role agents: explorer, librarian, oracle, designer, quick, and deep.",
+    "- After receiving a delegated subagent response, close that subagent session unless you will retry or intentionally keep using that exact same session; explorer and librarian sessions must always be closed immediately after their response, and retry sessions must be closed after the retry result unless explicit same-session reuse is still required.",
+    "- Use packaged thoth-agents plugin capabilities through Codex plugin, skill, MCP, and hook review surfaces after enabling them with /plugins and /hooks.",
+    "- For blocking user decisions in Codex Default mode, use request_user_input after features.default_mode_request_user_input is enabled; do not ask those questions in plain prose.",
+    "- Permissions, memory policy, provider-per-agent controls, and hooks are instruction-only unless the active Codex runtime documents stronger enforcement.",
+    "</codex-runtime>",
+    CODEX_ROOT_END,
+    ""
+  ].join("\n");
+}
+function agentModelReasoningEffort(role) {
+  return isCodexSubagentName(role.name) ? CODEX_SUBAGENT_REASONING_EFFORTS[role.name] : "medium";
+}
+function isCodexSubagentName(name) {
+  return name in CODEX_SUBAGENT_DEFAULT_MODELS;
+}
+function getPrimaryModelId2(model) {
+  if (Array.isArray(model)) {
+    const first = model[0];
+    return typeof first === "string" ? first : first?.id;
+  }
+  return model;
+}
+function getCodexAgentModel(role, config) {
+  if (!isCodexSubagentName(role.name)) return void 0;
+  return getPrimaryModelId2(config?.agents?.[role.name]?.model) ?? CODEX_SUBAGENT_DEFAULT_MODELS[role.name];
+}
+function codexSurfaceHasField(surfaceId, field) {
+  return getCodexSurface(surfaceId)?.fields.includes(field) ?? false;
+}
+function hasCodexConfig(context) {
+  return "config" in context;
+}
+function renderAgentArtifacts({ config }) {
+  const artifacts = [];
+  const diagnostics = [];
+  const supportsReasoningEffort = codexSurfaceHasField(
+    "project-agent-toml",
+    "model_reasoning_effort"
+  );
+  for (const role of getAgentPackContract().roles.filter(
+    (candidate) => candidate.name !== "orchestrator"
+  )) {
+    const model = getCodexAgentModel(role, config);
+    const toml = renderCodexToml({
+      surfaceId: "project-agent-toml",
+      values: {
+        name: role.name,
+        description: role.responsibility,
+        developer_instructions: roleInstructions(role, config),
+        ...model ? { model } : {},
+        ...supportsReasoningEffort ? { model_reasoning_effort: agentModelReasoningEffort(role) } : {},
+        sandbox_mode: role.canMutateWorkspace ? "workspace-write" : "read-only"
+      }
+    });
+    diagnostics.push(...toml.diagnostics);
+    artifacts.push({
+      harness: "codex",
+      kind: "agent-config",
+      path: `.codex/agents/thoth-agents-${role.name}.toml`,
+      description: `Codex agent definition for ${role.name}.`,
+      content: toml.content
+    });
+  }
+  return { artifacts, diagnostics };
+}
+function renderConfigArtifacts() {
+  const config = renderCodexToml({
+    surfaceId: "project-config-toml",
+    values: {
+      approval_policy: "on-request",
+      sandbox_mode: "workspace-write",
+      "skills.config": { enabled: true, sources: ["repo"] },
+      agents: getAgentPackContract().roles.filter((role) => role.name !== "orchestrator").map((role) => role.name)
+    }
+  });
+  const mcp = renderCodexToml({
+    surfaceId: "mcp-server-config",
+    values: createCodexBuiltinMcpTomlConfig()
+  });
+  return {
+    artifacts: [
+      {
+        harness: "codex",
+        kind: "harness-config",
+        path: ".codex/config.toml",
+        description: "Codex project configuration snippet for the agent pack.",
+        content: config.content
+      },
+      {
+        harness: "codex",
+        kind: "mcp-config",
+        path: ".codex/config.toml",
+        description: "Codex MCP configuration snippet for thoth-mem.",
+        content: mcp.content
+      }
+    ],
+    diagnostics: [...config.diagnostics, ...mcp.diagnostics]
+  };
+}
+function capabilityDiagnostics() {
+  const surfaceDiagnostics = getCodexSurfaceRecords().filter((surface) => surface.status !== "validated").map(codexSurfaceDiagnostic);
+  const governanceDiagnostics = memoryGovernanceDiagnostics({
+    harness: "codex",
+    permissionControls: CODEX_CAPABILITIES.rolePermissions,
+    parentContextInjection: CODEX_CAPABILITIES.parentContextInjection,
+    memoryWriteControls: CODEX_CAPABILITIES.memoryGovernanceEnforcement
+  });
+  return [...surfaceDiagnostics, ...governanceDiagnostics];
+}
+function hookReadinessDiagnostics() {
+  return [
+    {
+      severity: "warning",
+      code: "codex.hooks.project_trust.required",
+      message: "Codex project-local hooks require trusted project configuration before .codex/hooks.json or inline [hooks] command handlers are active; generated artifacts remain diagnostic-only until trust and features.hooks are reviewed.",
+      harness: "codex",
+      surface: "project-hooks-json",
+      fallback: "diagnostic-only"
+    },
+    {
+      severity: "warning",
+      code: "codex.hooks.features_hooks.required",
+      message: "Codex hook loading is gated by features.hooks; this adapter reports the docs-backed config surface but does not generate hook scripts or claim runtime enforcement.",
+      harness: "codex",
+      surface: "features-hooks-toggle",
+      fallback: "diagnostic-only"
+    },
+    {
+      severity: "warning",
+      code: "codex.hooks.plugin_trust.required",
+      message: "Bundled Codex plugin hook configuration is package content only; activation requires features.plugin_hooks and plugin hook trust review, and this adapter does not enable hooks automatically or claim hard permission enforcement.",
+      harness: "codex",
+      surface: "plugin-hooks-bundle",
+      fallback: "diagnostic-only"
+    }
+  ];
+}
+function resolveSkillOutputModes(context) {
+  return context.options?.codexSkillOutputModes ?? ["plugin-package"];
+}
+var codexAdapter = {
+  id: "codex",
+  displayName: "Codex",
+  capabilities: CODEX_CAPABILITIES,
+  render(context) {
+    const config = hasCodexConfig(context) ? context.config : void 0;
+    const agentArtifacts = renderAgentArtifacts({ config });
+    const configArtifacts = renderConfigArtifacts();
+    const skillOutputModes = resolveSkillOutputModes(context);
+    const skillLayout = renderCodexSkillLayout({
+      projectRoot: context.projectRoot,
+      skills: getSkillRegistry(),
+      surfaceId: "plugin-skills-directory",
+      outputModes: skillOutputModes
+    });
+    const pluginPackage = renderCodexPluginPackage({
+      manifest: createCodexPluginPackageManifest(context.projectRoot),
+      assets: [
+        {
+          surfaceId: "plugin-skills-directory",
+          manifestField: "skills",
+          path: ".codex-plugin/skills/",
+          description: "Codex plugin-bundled skill directory."
+        },
+        {
+          surfaceId: "plugin-mcp-json",
+          manifestField: "mcpServers",
+          path: ".codex-plugin/.mcp.json",
+          description: "Codex plugin-bundled MCP server definitions.",
+          content: stableJson2(createCodexBuiltinMcpJsonConfig())
+        },
+        {
+          surfaceId: "plugin-hooks-json",
+          manifestField: "hooks",
+          path: ".codex-plugin/hooks/hooks.json",
+          description: "Codex plugin-bundled hook configuration.",
+          hookDefinitions: []
+        }
+      ]
+    });
+    return {
+      harness: "codex",
+      artifacts: [
+        ...agentArtifacts.artifacts,
+        ...configArtifacts.artifacts,
+        ...pluginPackage.artifacts,
+        ...skillLayout.artifacts
+      ],
+      diagnostics: [
+        ...agentArtifacts.diagnostics,
+        ...configArtifacts.diagnostics,
+        ...pluginPackage.diagnostics,
+        ...skillLayout.diagnostics,
+        ...hookReadinessDiagnostics(),
+        ...capabilityDiagnostics()
+      ]
+    };
+  }
+};
+
+// src/cli/install.ts
+import { existsSync as existsSync10 } from "fs";
+import { homedir as homedir3 } from "os";
+import { cwd } from "process";
+
+// src/cli/codex-install.ts
+import {
+  copyFileSync as copyFileSync3,
+  existsSync as existsSync7,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync6,
+  rmSync,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { basename, dirname as dirname4, isAbsolute, join as join6, relative as relative2 } from "path";
+
+// src/harness/codex-plugin-paths.ts
+import { join as join4 } from "path";
+var CODEX_PLUGIN_ARTIFACT_PREFIX = ".codex-plugin/";
+function codexPluginRootArtifactPath(artifactPath) {
+  if (!artifactPath.startsWith(CODEX_PLUGIN_ARTIFACT_PREFIX)) {
+    throw new Error(`Expected Codex plugin artifact path: ${artifactPath}`);
+  }
+  const relativePath = artifactPath.slice(CODEX_PLUGIN_ARTIFACT_PREFIX.length);
+  if (relativePath === ".mcp.json") return relativePath;
+  if (relativePath === "plugin.json" || relativePath.startsWith(".")) {
+    return join4(".codex-plugin", relativePath);
+  }
+  return relativePath;
+}
+
+// src/cli/codex-config-io.ts
+import {
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync6,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync5,
+  renameSync as renameSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { dirname as dirname3 } from "path";
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function splitArrayItems(raw) {
+  const items = [];
+  let current = "";
+  let quote;
+  let escaped = false;
+  for (const char of raw) {
+    if (quote === "double" && escaped) {
+      current += char;
+      escaped = false;
+      continue;
+    }
+    if (quote === "double" && char === "\\") {
+      current += char;
+      escaped = true;
+      continue;
+    }
+    if (!quote && char === ",") {
+      items.push(current.trim());
+      current = "";
+      continue;
+    }
+    if (!quote && char === "'") quote = "single";
+    else if (quote === "single" && char === "'") quote = void 0;
+    else if (!quote && char === '"') quote = "double";
+    else if (quote === "double" && char === '"') quote = void 0;
+    current += char;
+  }
+  if (current.trim()) items.push(current.trim());
+  return items;
+}
+function parseBasicString(value) {
+  return value.slice(1, -1).replace(/\\n/g, "\n").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+}
+function parseScalar(raw) {
+  const value = raw.trim();
+  if (value === "true") return true;
+  if (value === "false") return false;
+  if (/^-?\d+(\.\d+)?$/.test(value)) return Number(value);
+  if (value.startsWith("[") && value.endsWith("]")) {
+    const body = value.slice(1, -1).trim();
+    if (!body) return [];
+    return splitArrayItems(body).map(parseScalar);
+  }
+  if (value.startsWith('"') && value.endsWith('"')) {
+    return parseBasicString(value);
+  }
+  if (value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+function parseTomlKeySegment(raw) {
+  const segment = raw.trim();
+  if (segment.startsWith('"') && segment.endsWith('"')) {
+    return parseBasicString(segment);
+  }
+  if (segment.startsWith("'") && segment.endsWith("'")) {
+    return segment.slice(1, -1);
+  }
+  return segment;
+}
+function parseTomlKeyPath(raw) {
+  const segments = [];
+  let current = "";
+  let quote;
+  let escaped = false;
+  for (const char of raw) {
+    if (quote === "double" && escaped) {
+      current += char;
+      escaped = false;
+      continue;
+    }
+    if (quote === "double" && char === "\\") {
+      current += char;
+      escaped = true;
+      continue;
+    }
+    if (!quote && char === ".") {
+      segments.push(parseTomlKeySegment(current));
+      current = "";
+      continue;
+    }
+    if (!quote && char === "'") quote = "single";
+    else if (quote === "single" && char === "'") quote = void 0;
+    else if (!quote && char === '"') quote = "double";
+    else if (quote === "double" && char === '"') quote = void 0;
+    current += char;
+  }
+  segments.push(parseTomlKeySegment(current));
+  return segments;
+}
+function ensureTable(root, path3) {
+  let current = root;
+  for (const segment of path3) {
+    const existing = current[segment];
+    if (!isRecord3(existing)) current[segment] = {};
+    current = current[segment];
+  }
+  return current;
+}
+function parseCodexToml(content) {
+  const root = {};
+  let table = [];
+  for (const rawLine of content.split(/\r?\n/)) {
+    const trimmed = rawLine.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const arrayTableMatch = /^\[\[([^\]]+)\]\]$/.exec(trimmed);
+    const tableMatch = /^\[([^\]]+)\]$/.exec(trimmed);
+    const tablePath = arrayTableMatch?.[1] ?? tableMatch?.[1];
+    if (tablePath) {
+      table = parseTomlKeyPath(tablePath);
+      ensureTable(root, table);
+      continue;
+    }
+    const assignment = /^([^=]+)=(.*)$/.exec(trimmed);
+    if (!assignment) throw new Error(`Unsupported TOML line: ${rawLine}`);
+    ensureTable(root, table)[assignment[1].trim()] = parseScalar(assignment[2]);
+  }
+  return root;
+}
+function renderScalar2(value) {
+  if (typeof value === "string") {
+    const canUseLiteralString = value.includes("\\") && !value.includes("'") && [...value].every((char) => char.charCodeAt(0) >= 32);
+    if (canUseLiteralString) {
+      return `'${value}'`;
+    }
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+  }
+  return String(value);
+}
+function renderValue(value) {
+  if (Array.isArray(value)) return `[${value.map(renderScalar2).join(", ")}]`;
+  return renderScalar2(value);
+}
+function renderTomlKeySegment(segment) {
+  if (/^[A-Za-z0-9_]+$/.test(segment)) return segment;
+  const canUseLiteralKey = (segment.includes("\\") || segment.includes(".")) && !segment.includes("'") && [...segment].every((char) => char.charCodeAt(0) >= 32);
+  if (canUseLiteralKey) return `'${segment}'`;
+  return `"${segment.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function renderTomlSection(lines, value, path3 = []) {
+  if (path3.length > 0)
+    lines.push(`[${path3.map(renderTomlKeySegment).join(".")}]`);
+  const nested = [];
+  for (const key of Object.keys(value).sort()) {
+    const entry = value[key];
+    if (isRecord3(entry)) nested.push([key, entry]);
+    else lines.push(`${key} = ${renderValue(entry)}`);
+  }
+  if (path3.length > 0) lines.push("");
+  for (const [key, entry] of nested)
+    renderTomlSection(lines, entry, [...path3, key]);
+}
+function renderCodexTomlDocument(document) {
+  const lines = [];
+  renderTomlSection(lines, document);
+  while (lines.at(-1) === "") lines.pop();
+  return `${lines.join("\n")}
+`;
+}
+function mergeCodexManagedConfig(document, options) {
+  const features = ensureTable(document, ["features"]);
+  features.default_mode_request_user_input = true;
+  const diffSummary = ["ensure features.default_mode_request_user_input = true"];
+  if (options.pluginId) {
+    const plugin = ensureTable(document, ["plugins", options.pluginId]);
+    plugin.enabled = true;
+    diffSummary.push(`ensure plugins."${options.pluginId}".enabled = true`);
+  } else {
+    diffSummary.push(
+      "plugin enablement left to /plugins; no guessed plugin id written"
+    );
+  }
+  return {
+    content: renderCodexTomlDocument(document),
+    diffSummary,
+    warnings: [
+      "Codex TOML comments and formatting may be rewritten; a backup is created before apply."
+    ]
+  };
+}
+function writeCodexConfigMerge(options) {
+  try {
+    const before = existsSync6(options.configPath) ? readFileSync5(options.configPath, "utf8") : "";
+    const parsed = parseCodexToml(before);
+    const merged = mergeCodexManagedConfig(parsed, {
+      pluginId: options.pluginId
+    });
+    const changed = before !== merged.content;
+    if (options.dryRun || !changed) {
+      return {
+        success: true,
+        configPath: options.configPath,
+        changed,
+        diffSummary: merged.diffSummary,
+        warnings: merged.warnings
+      };
+    }
+    mkdirSync2(dirname3(options.configPath), { recursive: true });
+    const backupPath = `${options.configPath}.bak`;
+    if (existsSync6(options.configPath))
+      copyFileSync2(options.configPath, backupPath);
+    const tmpPath = `${options.configPath}.tmp`;
+    writeFileSync2(tmpPath, merged.content);
+    renameSync2(tmpPath, options.configPath);
+    return {
+      success: true,
+      configPath: options.configPath,
+      backupPath: existsSync6(backupPath) ? backupPath : void 0,
+      changed,
+      diffSummary: merged.diffSummary,
+      warnings: merged.warnings
+    };
+  } catch (error) {
+    return {
+      success: false,
+      configPath: options.configPath,
+      changed: false,
+      diffSummary: [],
+      warnings: [],
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+
+// src/cli/codex-paths.ts
+import { homedir as homedir2 } from "os";
+import { join as join5 } from "path";
+var CODEX_ROLE_NAMES = [
+  "explorer",
+  "librarian",
+  "oracle",
+  "designer",
+  "quick",
+  "deep"
+];
+function getCodexHome(options = {}) {
+  const explicit = options.codexHome ?? process.env.CODEX_HOME?.trim();
+  return explicit || join5(options.homeDir ?? homedir2(), ".codex");
+}
+function resolveCodexTargets(options) {
+  const codexHome = getCodexHome(options);
+  const agentsDir = options.scope === "project" ? join5(options.projectRoot, ".codex", "agents") : join5(codexHome, "agents");
+  return {
+    scope: options.scope,
+    codexHome,
+    configPath: join5(codexHome, "config.toml"),
+    rootInstructionsPath: join5(codexHome, "AGENTS.md"),
+    roleAgentPaths: CODEX_ROLE_NAMES.map((role) => ({
+      role,
+      path: join5(agentsDir, `thoth-agents-${role}.toml`)
+    })),
+    managedModelsPath: join5(
+      codexHome,
+      "agents",
+      ".thoth-agents-managed-models.json"
+    ),
+    skillsDir: options.scope === "project" ? join5(options.projectRoot, ".agents", "skills") : join5(options.homeDir ?? homedir2(), ".agents", "skills"),
+    packageRoot: join5(options.projectRoot, ".codex-plugin"),
+    personalPluginRoot: join5(codexHome, "plugins", "thoth-agents"),
+    personalMarketplacePath: join5(
+      options.homeDir ?? homedir2(),
+      ".agents",
+      "plugins",
+      "marketplace.json"
+    )
+  };
+}
+
+// src/cli/codex-install.ts
+var ROOT_START = "<!-- thoth-agents:codex-root:start -->";
+var ROOT_END = "<!-- thoth-agents:codex-root:end -->";
+var MANAGED_MODEL_STATE_VERSION = 1;
+function mergeManagedBlock(existing, managedBlock) {
+  const start = existing.indexOf(ROOT_START);
+  const end = existing.indexOf(ROOT_END);
+  if (start !== -1 && end !== -1 && end > start) {
+    return `${existing.slice(0, start)}${managedBlock}${existing.slice(end + ROOT_END.length).replace(/^\s*\n/, "")}`;
+  }
+  return `${existing}${existing.endsWith("\n") || existing.length === 0 ? "" : "\n"}
+${managedBlock}`;
+}
+function writeTextWithBackup(path3, content) {
+  mkdirSync3(dirname4(path3), { recursive: true });
+  if (existsSync7(path3) && readFileSync6(path3, "utf8") === content) return false;
+  if (existsSync7(path3)) copyFileSync3(path3, `${path3}.bak`);
+  writeFileSync3(path3, content);
+  return true;
+}
+function packageArtifactTarget(packageRoot, artifact) {
+  return join6(packageRoot, codexPluginRootArtifactPath(artifact.path));
+}
+function normalizeRelativeMarketplacePath(path3) {
+  const normalized = path3.replaceAll("\\", "/");
+  if (isAbsolute(path3) || /^[A-Za-z]:\//.test(normalized)) return normalized;
+  if (normalized.startsWith("./")) return normalized;
+  return `./${normalized}`;
+}
+function marketplaceSourcePath(homeDir, personalPluginRoot) {
+  return normalizeRelativeMarketplacePath(
+    relative2(homeDir, personalPluginRoot)
+  );
+}
+function managedMarketplaceEntry(homeDir, personalPluginRoot) {
+  return {
+    name: "thoth-agents",
+    source: {
+      source: "local",
+      path: marketplaceSourcePath(homeDir, personalPluginRoot)
+    },
+    policy: {
+      installation: "AVAILABLE",
+      authentication: "ON_INSTALL"
+    },
+    category: "Productivity"
+  };
+}
+function stableJson3(value) {
+  return `${JSON.stringify(value, null, 2)}
+`;
+}
+function emptyManagedModelState() {
+  return {
+    version: MANAGED_MODEL_STATE_VERSION,
+    models: {}
+  };
+}
+function readManagedModelState(path3) {
+  if (!existsSync7(path3)) return emptyManagedModelState();
+  try {
+    const parsed = JSON.parse(readFileSync6(path3, "utf8"));
+    if (parsed.version !== MANAGED_MODEL_STATE_VERSION || !parsed.models || typeof parsed.models !== "object" || Array.isArray(parsed.models)) {
+      return emptyManagedModelState();
+    }
+    return {
+      version: MANAGED_MODEL_STATE_VERSION,
+      models: Object.fromEntries(
+        Object.entries(parsed.models).filter(
+          (entry) => typeof entry[0] === "string" && typeof entry[1] === "string"
+        )
+      )
+    };
+  } catch {
+    return emptyManagedModelState();
+  }
+}
+function parseRoleTomlModel(content) {
+  const match = /^model\s*=\s*"((?:\\.|[^"\\])*)"\s*$/m.exec(content);
+  if (!match) return void 0;
+  return match[1].replace(/\\n/g, "\n").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+}
+function escapeTomlString2(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\t/g, "\\t").replace(/\n/g, "\\n").replace(/\f/g, "\\f").replace(/\r/g, "\\r");
+}
+function replaceRoleTomlModel(content, model) {
+  const rendered = `model = "${escapeTomlString2(model)}"`;
+  if (/^model\s*=\s*"(?:\\.|[^"\\])*"\s*$/m.test(content)) {
+    return content.replace(/^model\s*=\s*"(?:\\.|[^"\\])*"\s*$/m, rendered);
+  }
+  return `${rendered}
+${content}`;
+}
+function roleManagedModelStateKey(path3) {
+  return basename(path3);
+}
+function resolveRoleTomlContent(options) {
+  const renderedModel = parseRoleTomlModel(options.renderedContent);
+  const key = roleManagedModelStateKey(options.targetPath);
+  if (!renderedModel) return options.renderedContent;
+  if (options.reset || !existsSync7(options.targetPath)) {
+    options.nextState.models[key] = renderedModel;
+    return options.renderedContent;
+  }
+  const currentModel = parseRoleTomlModel(
+    readFileSync6(options.targetPath, "utf8")
+  );
+  const trackedModel = options.state.models[key];
+  const isUserOwned = currentModel !== void 0 && (trackedModel === void 0 ? currentModel !== renderedModel : currentModel !== trackedModel);
+  if (isUserOwned) {
+    if (trackedModel !== void 0)
+      options.nextState.models[key] = trackedModel;
+    return replaceRoleTomlModel(options.renderedContent, currentModel);
+  }
+  options.nextState.models[key] = renderedModel;
+  return options.renderedContent;
+}
+function mergePersonalMarketplace(existing, homeDir, personalPluginRoot) {
+  const parsed = existing.trim() ? JSON.parse(existing) : {};
+  const plugins = Array.isArray(parsed.plugins) ? parsed.plugins : [];
+  const managedEntry = managedMarketplaceEntry(homeDir, personalPluginRoot);
+  const nextPlugins = plugins.filter(
+    (entry) => !(entry && typeof entry === "object" && "name" in entry && entry.name === "thoth-agents")
+  ).concat(managedEntry);
+  return stableJson3({
+    ...parsed,
+    name: typeof parsed.name === "string" ? parsed.name : "personal-marketplace",
+    interface: parsed.interface && typeof parsed.interface === "object" ? parsed.interface : { displayName: "Personal Plugin Marketplace" },
+    plugins: nextPlugins
+  });
+}
+function roleArtifactContent(role, artifacts) {
+  const path3 = `.codex/agents/thoth-agents-${role}.toml`;
+  const artifact = artifacts.find((candidate) => candidate.path === path3);
+  if (!artifact?.content)
+    throw new Error(`Missing Codex role artifact: ${path3}`);
+  return String(artifact.content);
+}
+function buildCodexSetupPlan(config) {
+  const targets = resolveCodexTargets({
+    scope: config.scope,
+    projectRoot: config.projectRoot,
+    homeDir: config.homeDir,
+    codexHome: config.codexHome
+  });
+  const render = codexAdapter.render({ projectRoot: config.projectRoot });
+  const packageArtifacts = render.artifacts.filter(
+    (artifact) => artifact.path.startsWith(".codex-plugin/")
+  );
+  const rootBlock = renderCodexRootInstructions();
+  const managedModelState = readManagedModelState(targets.managedModelsPath);
+  const nextManagedModelState = emptyManagedModelState();
+  const items = [
+    {
+      kind: "root-instructions",
+      action: "merge-managed-block",
+      targetPath: targets.rootInstructionsPath,
+      description: `Merge managed Codex root instructions into ${targets.rootInstructionsPath}.`,
+      requiresBackup: true,
+      content: rootBlock
+    },
+    ...targets.roleAgentPaths.map(
+      (target) => ({
+        kind: "role-subagent-toml",
+        action: "write-role-toml",
+        targetPath: target.path,
+        description: `Materialize Codex role subagent ${target.role}.`,
+        requiresBackup: existsSync7(target.path),
+        role: target.role,
+        content: resolveRoleTomlContent({
+          renderedContent: roleArtifactContent(target.role, render.artifacts),
+          targetPath: target.path,
+          state: managedModelState,
+          nextState: nextManagedModelState,
+          reset: config.reset
+        })
+      })
+    ),
+    {
+      kind: "managed-model-state",
+      action: "write-managed-model-state",
+      targetPath: targets.managedModelsPath,
+      description: "Record thoth-agents-managed Codex role model ownership state.",
+      requiresBackup: existsSync7(targets.managedModelsPath),
+      content: stableJson3(nextManagedModelState)
+    },
+    ...packageArtifacts.map(
+      (artifact) => ({
+        kind: "personal-plugin-source",
+        action: "refresh-package",
+        targetPath: packageArtifactTarget(targets.personalPluginRoot, artifact),
+        description: `Refresh Personal Codex plugin source asset ${artifact.path}.`,
+        requiresBackup: false,
+        content: String(artifact.content ?? "")
+      })
+    ),
+    {
+      kind: "personal-marketplace",
+      action: "merge-marketplace",
+      targetPath: targets.personalMarketplacePath,
+      description: "Register Personal Codex marketplace entry for the local thoth-agents plugin source.",
+      requiresBackup: existsSync7(targets.personalMarketplacePath),
+      content: targets.personalPluginRoot
+    },
+    {
+      kind: "user-config",
+      action: "merge-toml",
+      targetPath: targets.configPath,
+      description: "Merge managed Codex feature gates into user config.toml.",
+      requiresBackup: true
+    },
+    {
+      kind: "diagnostic",
+      action: "diagnose-only",
+      targetPath: targets.codexHome,
+      description: "Report /plugins, /hooks, precedence, and capability review steps.",
+      requiresBackup: false
+    }
+  ];
+  return {
+    dryRun: config.dryRun === true,
+    reset: config.reset,
+    items,
+    configPath: targets.configPath,
+    pluginId: config.pluginId,
+    diagnostics: [
+      "Restart Codex, then run /plugins to review and enable the Personal thoth-agents plugin registered through ~/.agents/plugins/marketplace.json.",
+      "Run /hooks to review and trust plugin hooks; features.plugin_hooks does not bypass hook trust review.",
+      "Codex Default mode user-input requests require features.default_mode_request_user_input = true and use the request_user_input tool; other modes may not expose it.",
+      "Higher-precedence Codex config (project, profile, CLI, system, or admin) may override user config feature flags."
+    ],
+    disclaimers: [
+      "Role permissions, provider-per-agent settings, memory governance, and hook enforcement are instruction-level or user-managed unless documented Codex runtime controls are available.",
+      "Codex v1 reset is managed-only; no broad destructive --force behavior is implemented."
+    ]
+  };
+}
+function formatCodexSetupPlan(plan) {
+  const refreshPackageGroups = /* @__PURE__ */ new Map();
+  for (const item of plan.items) {
+    if (item.action !== "refresh-package") continue;
+    const group = refreshPackageGroups.get(item.kind) ?? [];
+    group.push(item);
+    refreshPackageGroups.set(item.kind, group);
+  }
+  const renderedRefreshKinds = /* @__PURE__ */ new Set();
+  const lines = [];
+  for (const item of plan.items) {
+    if (item.action !== "refresh-package") {
+      lines.push(`- ${item.action}: ${item.targetPath} (${item.description})`);
+      continue;
+    }
+    if (renderedRefreshKinds.has(item.kind)) continue;
+    renderedRefreshKinds.add(item.kind);
+    lines.push(formatRefreshPackageGroup(item.kind, refreshPackageGroups));
+  }
+  return ["Codex setup plan:", ...lines].join("\n");
+}
+function formatRefreshPackageGroup(kind, groups) {
+  const items = groups.get(kind) ?? [];
+  const description = kind === "personal-plugin-source" ? "Refresh Personal Codex plugin source" : "Refresh documented .codex-plugin package";
+  return `- refresh-package: ${commonTargetDirectory(items)} (${description}, ${items.length} files.)`;
+}
+function commonTargetDirectory(items) {
+  if (items.length === 0) return "";
+  let common = dirname4(items[0]?.targetPath ?? "");
+  for (const item of items.slice(1)) {
+    while (!isSameOrChildPath(item.targetPath, common)) {
+      const parent = dirname4(common);
+      if (parent === common) return common;
+      common = parent;
+    }
+  }
+  return common;
+}
+function isSameOrChildPath(path3, parent) {
+  return path3 === parent || path3.startsWith(`${parent}\\`) || path3.startsWith(`${parent}/`);
+}
+function uniqueMessages(messages) {
+  return [...new Set(messages)];
+}
+function applyCodexSetup(plan) {
+  const changed = [];
+  const diagnostics = uniqueMessages([
+    ...plan.diagnostics,
+    ...plan.disclaimers
+  ]);
+  if (plan.dryRun) return { success: true, changed, diagnostics };
+  try {
+    for (const targetPath of managedRefreshRoots(plan)) {
+      rmSync(targetPath, { recursive: true, force: true });
+    }
+    for (const item of plan.items) {
+      if (item.action === "diagnose-only") continue;
+      if (item.action === "merge-toml") {
+        const result = writeCodexConfigMerge({
+          configPath: item.targetPath,
+          dryRun: false,
+          pluginId: plan.pluginId
+        });
+        diagnostics.push(...result.diffSummary, ...result.warnings);
+        if (!result.success) throw new Error(result.error);
+        if (result.changed) changed.push(item.targetPath);
+        continue;
+      }
+      if (item.action === "merge-marketplace") {
+        if (item.content === void 0) continue;
+        const content2 = mergePersonalMarketplace(
+          existsSync7(item.targetPath) ? readFileSync6(item.targetPath, "utf8") : "",
+          dirname4(dirname4(dirname4(item.targetPath))),
+          item.content
+        );
+        if (writeTextWithBackup(item.targetPath, content2))
+          changed.push(item.targetPath);
+        continue;
+      }
+      if (item.content === void 0) continue;
+      const content = item.action === "merge-managed-block" ? mergeManagedBlock(
+        existsSync7(item.targetPath) ? readFileSync6(item.targetPath, "utf8") : "",
+        item.content
+      ) : item.content;
+      if (writeTextWithBackup(item.targetPath, content))
+        changed.push(item.targetPath);
+    }
+    return { success: true, changed, diagnostics: uniqueMessages(diagnostics) };
+  } catch (error) {
+    return {
+      success: false,
+      changed,
+      diagnostics: uniqueMessages(diagnostics),
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+function managedRefreshRoots(plan) {
+  const refreshGroups = /* @__PURE__ */ new Map();
+  for (const item of plan.items) {
+    if (item.action !== "refresh-package") continue;
+    const group = refreshGroups.get(item.kind) ?? [];
+    group.push(item);
+    refreshGroups.set(item.kind, group);
+  }
+  return [...refreshGroups].filter(([kind]) => kind === "personal-plugin-source").map(([, items]) => commonTargetDirectory(items)).filter((path3) => path3.length > 0);
+}
+
+// src/cli/system.ts
+import { statSync as statSync2 } from "fs";
+
+// src/utils/subprocess.ts
+import {
+  spawn as nodeSpawn,
+  spawnSync as nodeSpawnSync
+} from "child_process";
+import { Readable } from "stream";
+function emptyReadableStream() {
+  return new ReadableStream({
+    start(controller) {
+      controller.close();
+    }
+  });
+}
+function toWebReadable(stream) {
+  if (!stream) {
+    return emptyReadableStream();
+  }
+  return Readable.toWeb(
+    stream
+  );
+}
+function fallbackStdin() {
+  return {
+    write: () => void 0,
+    end: () => void 0
+  };
+}
+function spawn(command, options = {}) {
+  const child = nodeSpawn(command[0], command.slice(1), {
+    cwd: options.cwd,
+    env: options.env,
+    stdio: [
+      options.stdin ?? "pipe",
+      options.stdout ?? "pipe",
+      options.stderr ?? "pipe"
+    ]
+  });
+  const managed = {
+    stdin: child.stdin ?? fallbackStdin(),
+    stdout: toWebReadable(child.stdout),
+    stderr: toWebReadable(child.stderr),
+    exited: new Promise((resolve2) => {
+      child.on("exit", (code) => {
+        managed.exitCode = code;
+        resolve2(code ?? 1);
+      });
+      child.on("error", () => {
+        managed.exitCode = 1;
+        resolve2(1);
+      });
+    }),
+    exitCode: child.exitCode,
+    kill: () => {
+      child.kill();
+    }
+  };
+  return managed;
+}
+
+// src/cli/system.ts
+var cachedOpenCodePath = null;
+function getOpenCodePaths() {
+  const home = process.env.HOME || process.env.USERPROFILE || "";
+  return [
+    // PATH (try this first)
+    "opencode",
+    // User local installations (Linux & macOS)
+    `${home}/.local/bin/opencode`,
+    `${home}/.opencode/bin/opencode`,
+    `${home}/bin/opencode`,
+    // System-wide installations
+    "/usr/local/bin/opencode",
+    "/opt/opencode/bin/opencode",
+    "/usr/bin/opencode",
+    "/bin/opencode",
+    // macOS specific
+    "/Applications/OpenCode.app/Contents/MacOS/opencode",
+    `${home}/Applications/OpenCode.app/Contents/MacOS/opencode`,
+    // Homebrew (macOS & Linux)
+    "/opt/homebrew/bin/opencode",
+    "/home/linuxbrew/.linuxbrew/bin/opencode",
+    `${home}/homebrew/bin/opencode`,
+    // macOS user Library
+    `${home}/Library/Application Support/opencode/bin/opencode`,
+    // Snap (Linux)
+    "/snap/bin/opencode",
+    "/var/snap/opencode/current/bin/opencode",
+    // Flatpak (Linux)
+    "/var/lib/flatpak/exports/bin/ai.opencode.OpenCode",
+    `${home}/.local/share/flatpak/exports/bin/ai.opencode.OpenCode`,
+    // Nix (Linux/macOS)
+    "/nix/store/opencode/bin/opencode",
+    `${home}/.nix-profile/bin/opencode`,
+    "/run/current-system/sw/bin/opencode",
+    // Cargo (Rust toolchain)
+    `${home}/.cargo/bin/opencode`,
+    // npm/npx global
+    `${home}/.npm-global/bin/opencode`,
+    "/usr/local/lib/node_modules/opencode/bin/opencode",
+    // Yarn global
+    `${home}/.yarn/bin/opencode`,
+    // PNPM
+    `${home}/.pnpm-global/bin/opencode`
+  ];
+}
+function resolveOpenCodePath() {
+  if (cachedOpenCodePath) {
+    return cachedOpenCodePath;
+  }
+  const paths = getOpenCodePaths();
+  for (const opencodePath of paths) {
+    if (opencodePath === "opencode") continue;
+    try {
+      const stat = statSync2(opencodePath);
+      if (stat.isFile()) {
+        cachedOpenCodePath = opencodePath;
+        return opencodePath;
+      }
+    } catch {
+    }
+  }
+  return "opencode";
+}
+async function isOpenCodeInstalled() {
+  const paths = getOpenCodePaths();
+  for (const opencodePath of paths) {
+    try {
+      const proc = spawn([opencodePath, "--version"], {
+        stdout: "pipe",
+        stderr: "pipe"
+      });
+      await proc.exited;
+      if (proc.exitCode === 0) {
+        cachedOpenCodePath = opencodePath;
+        return true;
+      }
+    } catch {
+    }
+  }
+  return false;
+}
+async function getOpenCodeVersion() {
+  const opencodePath = resolveOpenCodePath();
+  try {
+    const proc = spawn([opencodePath, "--version"], {
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const output = await new Response(proc.stdout).text();
+    await proc.exited;
+    if (proc.exitCode === 0) {
+      return output.trim();
+    }
+  } catch {
+  }
+  return null;
+}
+function getOpenCodePath() {
+  const path3 = resolveOpenCodePath();
+  return path3 === "opencode" ? null : path3;
+}
+
+// src/cli/custom-skills.ts
+import {
+  copyFileSync as copyFileSync4,
+  existsSync as existsSync9,
+  mkdirSync as mkdirSync5,
+  readdirSync as readdirSync3,
+  rmSync as rmSync2,
+  statSync as statSync4
+} from "fs";
+import { dirname as dirname5, join as join8, parse } from "path";
+import { fileURLToPath } from "url";
+
+// src/cli/skill-manifest.ts
+import { createHash as createHash3 } from "crypto";
+import {
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync4,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync7,
+  statSync as statSync3,
+  writeFileSync as writeFileSync4
+} from "fs";
+import { join as join7, relative as relative3 } from "path";
+var SHARED_SKILL_DIRECTORY = "_shared";
+var SKILLS_SOURCE_ROOT = join7("src", "skills");
+var MANIFEST_FILE_NAME = ".skill-manifest.json";
+function getManifestPath() {
+  return join7(getCustomSkillsDir(), MANIFEST_FILE_NAME);
+}
+function listFilesRecursive(dirPath) {
+  if (!existsSync8(dirPath)) {
+    return [];
+  }
+  const files = [];
+  const entries = readdirSync2(dirPath).sort(
+    (left, right) => left.localeCompare(right)
+  );
+  for (const entry of entries) {
+    const entryPath = join7(dirPath, entry);
+    const stat = statSync3(entryPath);
+    if (stat.isDirectory()) {
+      files.push(...listFilesRecursive(entryPath));
+      continue;
+    }
+    files.push(entryPath);
+  }
+  return files;
+}
+function readPackageVersion(packageRoot) {
+  const packageJsonPath = join7(packageRoot, "package.json");
+  const packageJson = JSON.parse(readFileSync7(packageJsonPath, "utf-8"));
+  if (typeof packageJson.version !== "string" || packageJson.version.length === 0) {
+    throw new Error(`Invalid package version in ${packageJsonPath}`);
+  }
+  return packageJson.version;
+}
+function readManifest() {
+  const manifestPath = getManifestPath();
+  if (!existsSync8(manifestPath)) {
+    return null;
+  }
+  try {
+    return JSON.parse(readFileSync7(manifestPath, "utf-8"));
+  } catch (error) {
+    console.warn(`Failed to read skill manifest: ${manifestPath}`, error);
+    return null;
+  }
+}
+function writeManifest(manifest) {
+  const manifestPath = getManifestPath();
+  mkdirSync4(getCustomSkillsDir(), { recursive: true });
+  writeFileSync4(manifestPath, `${JSON.stringify(manifest, null, 2)}
+`);
+}
+function computeSkillHash(skillDirPath) {
+  const hash = createHash3("sha256");
+  for (const filePath of listFilesRecursive(skillDirPath)) {
+    hash.update(`${relative3(skillDirPath, filePath)}
+`);
+    hash.update(readFileSync7(filePath));
+    hash.update("\n");
+  }
+  return hash.digest("hex");
+}
+function findRemovedSkills(manifest) {
+  const currentSkillNames = new Set(CUSTOM_SKILLS.map((skill) => skill.name));
+  return Object.keys(manifest.skills).filter(
+    (skillName) => !currentSkillNames.has(skillName)
+  );
+}
+function checkSkillsNeedUpdate(packageRoot) {
+  const manifest = readManifest();
+  const pluginVersion = readPackageVersion(packageRoot);
+  const sharedHash = computeSkillHash(
+    join7(packageRoot, SKILLS_SOURCE_ROOT, SHARED_SKILL_DIRECTORY)
+  );
+  const versionChanged = manifest !== null && manifest.pluginVersion !== pluginVersion;
+  const sharedChanged = manifest !== null && manifest.sharedHash !== sharedHash;
+  const removedSkills = manifest ? findRemovedSkills(manifest) : [];
+  const skillsNeedingUpdate = CUSTOM_SKILLS.flatMap((skill) => {
+    const sourcePath = join7(packageRoot, skill.sourcePath);
+    const targetPath = join7(getCustomSkillsDir(), skill.name);
+    const sourceHash = computeSkillHash(sourcePath);
+    const manifestEntry = manifest?.skills[skill.name];
+    const reasons = [];
+    if (!manifest) {
+      reasons.push("manifest-missing");
+    }
+    if (versionChanged) {
+      reasons.push("version-change");
+    }
+    if (sharedChanged) {
+      reasons.push("shared-hash-mismatch");
+    }
+    if (!manifestEntry) {
+      reasons.push("new-skill");
+    } else if (manifestEntry.hash !== sourceHash) {
+      reasons.push("hash-mismatch");
+    }
+    if (!existsSync8(targetPath)) {
+      reasons.push("missing-install");
+    }
+    if (reasons.length === 0) {
+      return [];
+    }
+    return [
+      {
+        skill,
+        sourceHash,
+        targetPath,
+        reasons
+      }
+    ];
+  });
+  return {
+    pluginVersion,
+    sharedHash,
+    manifest,
+    versionChanged,
+    sharedChanged,
+    needsUpdate: skillsNeedingUpdate.length > 0 || removedSkills.length > 0,
+    skillsNeedingUpdate,
+    removedSkills
+  };
+}
+
+// src/cli/custom-skills.ts
+var SHARED_SKILL_DIRECTORY2 = "_shared";
+var SHARED_SKILL_SOURCE_PATH = `src/skills/${SHARED_SKILL_DIRECTORY2}`;
+var CUSTOM_SKILLS = BUNDLED_SKILL_REGISTRY.map(
+  (skill) => ({
+    name: skill.name,
+    description: skill.description,
+    allowedAgents: [...skill.allowedRoles],
+    sourcePath: skill.sourcePath
+  })
+);
+function getCustomSkillsDir() {
+  return join8(getConfigDir(), "skills");
+}
+function copyDirRecursive(src, dest) {
+  if (!existsSync9(dest)) {
+    mkdirSync5(dest, { recursive: true });
+  }
+  const entries = readdirSync3(src);
+  for (const entry of entries) {
+    const srcPath = join8(src, entry);
+    const destPath = join8(dest, entry);
+    const stat = statSync4(srcPath);
+    if (stat.isDirectory()) {
+      copyDirRecursive(srcPath, destPath);
+    } else {
+      const destDir = dirname5(destPath);
+      if (!existsSync9(destDir)) {
+        mkdirSync5(destDir, { recursive: true });
+      }
+      copyFileSync4(srcPath, destPath);
+    }
+  }
+}
+function installSharedSkillAssets(packageRoot) {
+  const sharedSourcePath = join8(packageRoot, SHARED_SKILL_SOURCE_PATH);
+  const sharedTargetPath = join8(getCustomSkillsDir(), SHARED_SKILL_DIRECTORY2);
+  if (!existsSync9(sharedSourcePath)) {
+    console.error(`Custom skill shared assets not found: ${sharedSourcePath}`);
+    return false;
+  }
+  rmSync2(sharedTargetPath, { recursive: true, force: true });
+  copyDirRecursive(sharedSourcePath, sharedTargetPath);
+  return true;
+}
+function findPackageRoot(startDir) {
+  let currentDir = startDir;
+  const filesystemRoot = parse(startDir).root;
+  while (true) {
+    if (existsSync9(join8(currentDir, "package.json")) && existsSync9(join8(currentDir, "src", "skills"))) {
+      return currentDir;
+    }
+    if (currentDir === filesystemRoot) {
+      return null;
+    }
+    const parentDir = dirname5(currentDir);
+    if (parentDir === currentDir) {
+      return null;
+    }
+    currentDir = parentDir;
+  }
+}
+function resolvePackageRoot(packageRoot) {
+  if (packageRoot) {
+    return packageRoot;
+  }
+  const moduleDir = fileURLToPath(new URL(".", import.meta.url));
+  return findPackageRoot(moduleDir) ?? fileURLToPath(new URL("../..", import.meta.url));
+}
+function installCustomSkillFiles(skill, packageRoot) {
+  const sourcePath = join8(packageRoot, skill.sourcePath);
+  const targetPath = join8(getCustomSkillsDir(), skill.name);
+  if (!existsSync9(sourcePath)) {
+    console.error(`Custom skill source not found: ${sourcePath}`);
+    return false;
+  }
+  rmSync2(targetPath, { recursive: true, force: true });
+  copyDirRecursive(sourcePath, targetPath);
+  return true;
+}
+function removeObsoleteSkills(removedSkillNames) {
+  const removedSkills = [];
+  for (const skillName of removedSkillNames) {
+    const targetPath = join8(getCustomSkillsDir(), skillName);
+    try {
+      console.log(`Removing obsolete bundled skill: ${skillName}`);
+      rmSync2(targetPath, { recursive: true, force: true });
+      removedSkills.push(skillName);
+    } catch (error) {
+      console.warn(`Failed to remove obsolete bundled skill: ${skillName}`);
+      console.warn(error);
+    }
+  }
+  return removedSkills;
+}
+function buildManifest(packageRoot, updatedSkills, previousManifest, pluginVersion, sharedHash) {
+  const installedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const updatedSkillNames = new Set(
+    updatedSkills.map(({ skill }) => skill.name)
+  );
+  const skills = Object.fromEntries(
+    CUSTOM_SKILLS.map((skill) => {
+      const previousEntry = previousManifest?.skills[skill.name];
+      const nextInstalledAt = updatedSkillNames.has(skill.name) ? installedAt : previousEntry?.installedAt ?? installedAt;
+      return [
+        skill.name,
+        {
+          hash: computeSkillHash(join8(packageRoot, skill.sourcePath)),
+          installedAt: nextInstalledAt
+        }
+      ];
+    })
+  );
+  return {
+    pluginVersion,
+    sharedHash,
+    skills
+  };
+}
+function pruneRemovedSkillsFromManifest(manifest, removedSkills) {
+  const removedSkillNames = new Set(removedSkills);
+  return {
+    ...manifest,
+    skills: Object.fromEntries(
+      Object.entries(manifest.skills).filter(
+        ([skillName]) => !removedSkillNames.has(skillName)
+      )
+    )
+  };
+}
+function installCustomSkills(packageRoot = resolvePackageRoot()) {
+  const updateCheck = checkSkillsNeedUpdate(packageRoot);
+  if (!updateCheck.needsUpdate) {
+    return {
+      success: true,
+      updatedSkills: [],
+      skippedSkills: [...CUSTOM_SKILLS],
+      failedSkills: [],
+      removedSkills: []
+    };
+  }
+  const removedSkills = removeObsoleteSkills(updateCheck.removedSkills);
+  if (removedSkills.length > 0 && updateCheck.manifest) {
+    writeManifest(
+      pruneRemovedSkillsFromManifest(updateCheck.manifest, removedSkills)
+    );
+  }
+  if (updateCheck.skillsNeedingUpdate.length === 0) {
+    writeManifest(
+      buildManifest(
+        packageRoot,
+        [],
+        updateCheck.manifest,
+        updateCheck.pluginVersion,
+        updateCheck.sharedHash
+      )
+    );
+    return {
+      success: true,
+      updatedSkills: [],
+      skippedSkills: [...CUSTOM_SKILLS],
+      failedSkills: [],
+      removedSkills
+    };
+  }
+  if (!installSharedSkillAssets(packageRoot)) {
+    return {
+      success: false,
+      updatedSkills: [],
+      skippedSkills: [],
+      failedSkills: updateCheck.skillsNeedingUpdate.map(
+        ({ skill, reasons }) => ({
+          skill,
+          reasons
+        })
+      ),
+      removedSkills
+    };
+  }
+  const updatesBySkillName = new Map(
+    updateCheck.skillsNeedingUpdate.map((entry) => [entry.skill.name, entry])
+  );
+  const updatedSkills = [];
+  const skippedSkills = [];
+  const failedSkills = [];
+  for (const skill of CUSTOM_SKILLS) {
+    const pendingUpdate = updatesBySkillName.get(skill.name);
+    if (!pendingUpdate) {
+      skippedSkills.push(skill);
+      continue;
+    }
+    if (installCustomSkillFiles(skill, packageRoot)) {
+      updatedSkills.push({
+        skill,
+        reasons: pendingUpdate.reasons
+      });
+      continue;
+    }
+    failedSkills.push({
+      skill,
+      reasons: pendingUpdate.reasons
+    });
+  }
+  if (failedSkills.length > 0) {
+    return {
+      success: false,
+      updatedSkills,
+      skippedSkills,
+      failedSkills,
+      removedSkills
+    };
+  }
+  writeManifest(
+    buildManifest(
+      packageRoot,
+      updatedSkills,
+      updateCheck.manifest,
+      updateCheck.pluginVersion,
+      updateCheck.sharedHash
+    )
+  );
+  return {
+    success: true,
+    updatedSkills,
+    skippedSkills,
+    failedSkills,
+    removedSkills
+  };
+}
+
+// src/cli/skills.ts
+import { spawnSync } from "child_process";
+var RECOMMENDED_SKILLS = [
+  {
+    name: "simplify",
+    repo: "https://github.com/brianlovin/claude-config",
+    skillName: "simplify",
+    description: "YAGNI code simplification expert"
+  },
+  {
+    name: "playwright-cli",
+    repo: "https://github.com/microsoft/playwright-cli",
+    skillName: "playwright-cli",
+    description: "Browser automation for visual checks and testing"
+  }
+];
+function installSkill(skill) {
+  const args = [
+    "skills",
+    "add",
+    skill.repo,
+    "--skill",
+    skill.skillName,
+    "-a",
+    "opencode",
+    "-y",
+    "--global"
+  ];
+  try {
+    const result = spawnSync("npx", args, { stdio: "inherit" });
+    if (result.status !== 0) {
+      return false;
+    }
+    if (skill.postInstallCommands && skill.postInstallCommands.length > 0) {
+      console.log(`Running post-install commands for ${skill.name}...`);
+      for (const cmd of skill.postInstallCommands) {
+        console.log(`> ${cmd}`);
+        const [command, ...cmdArgs] = cmd.split(" ");
+        const cmdResult = spawnSync(command, cmdArgs, { stdio: "inherit" });
+        if (cmdResult.status !== 0) {
+          console.warn(`Post-install command failed: ${cmd}`);
+        }
+      }
+    }
+    return true;
+  } catch (error) {
+    console.error(`Failed to install skill: ${skill.name}`, error);
+    return false;
+  }
+}
+
+// src/cli/install.ts
+var GREEN = "\x1B[32m";
+var BLUE = "\x1B[34m";
+var YELLOW = "\x1B[33m";
+var RED = "\x1B[31m";
+var BOLD = "\x1B[1m";
+var DIM = "\x1B[2m";
+var RESET = "\x1B[0m";
+var SYMBOLS = {
+  check: `${GREEN}\u2713${RESET}`,
+  cross: `${RED}\u2717${RESET}`,
+  arrow: `${BLUE}\u2192${RESET}`,
+  bullet: `${DIM}\u2022${RESET}`,
+  info: `${BLUE}\u2139${RESET}`,
+  warn: `${YELLOW}\u26A0${RESET}`,
+  star: `${YELLOW}\u2605${RESET}`
+};
+function printHeader(isUpdate) {
+  console.log();
+  console.log(`${BOLD}thoth-agents ${isUpdate ? "Update" : "Install"}${RESET}`);
+  console.log("=".repeat(30));
+  console.log();
+}
+function printStep(step, total, message) {
+  console.log(`${DIM}[${step}/${total}]${RESET} ${message}`);
+}
+function printSuccess(message) {
+  console.log(`${SYMBOLS.check} ${message}`);
+}
+function printError(message) {
+  console.log(`${SYMBOLS.cross} ${RED}${message}${RESET}`);
+}
+function printInfo(message) {
+  console.log(`${SYMBOLS.info} ${message}`);
+}
+function formatCustomSkillReasons(report) {
+  if (report.updatedSkills.length === 0 && report.removedSkills.length === 0) {
+    return "all bundled skills already up to date";
+  }
+  return `${report.updatedSkills.length} updated, ${report.removedSkills.length} removed, ${report.skippedSkills.length} unchanged`;
+}
+function formatSkillReasons(reasons) {
+  return reasons.join(", ");
+}
+async function checkOpenCodeInstalled() {
+  const installed = await isOpenCodeInstalled();
+  if (!installed) {
+    printError("OpenCode is not installed on this system.");
+    printInfo("Install it with:");
+    console.log(
+      `     ${BLUE}curl -fsSL https://opencode.ai/install | bash${RESET}`
+    );
+    console.log();
+    printInfo("Or if already installed, add it to your PATH:");
+    console.log(`     ${BLUE}export PATH="$HOME/.local/bin:$PATH"${RESET}`);
+    console.log(`     ${BLUE}export PATH="$HOME/.opencode/bin:$PATH"${RESET}`);
+    return { ok: false };
+  }
+  const version = await getOpenCodeVersion();
+  const path3 = getOpenCodePath();
+  const detectedVersion = version ?? "";
+  const pathInfo = path3 ? ` (${DIM}${path3}${RESET})` : "";
+  printSuccess(`OpenCode ${detectedVersion} detected${pathInfo}`);
+  return { ok: true, version: version ?? void 0, path: path3 ?? void 0 };
+}
+function handleStepResult(result, successMsg) {
+  if (!result.success) {
+    printError(`Failed: ${result.error}`);
+    return false;
+  }
+  printSuccess(
+    `${successMsg} ${SYMBOLS.arrow} ${DIM}${result.configPath}${RESET}`
+  );
+  return true;
+}
+function formatConfigSummary() {
+  const lines = [];
+  lines.push(`${BOLD}Configuration Summary${RESET}`);
+  lines.push("");
+  lines.push(`  ${BOLD}Preset:${RESET} ${BLUE}openai${RESET}`);
+  lines.push(`  ${SYMBOLS.check} Seven-agent thoth-agents roster`);
+  lines.push(`  ${SYMBOLS.check} OpenAI models by default`);
+  lines.push(`  ${SYMBOLS.check} thoth-mem enabled for orchestrator memory`);
+  lines.push(`  ${SYMBOLS.check} Delegation results persisted to disk`);
+  lines.push(`  ${SYMBOLS.check} Bundled SDD skills ready for install`);
+  const seeDocs = "see docs/provider-configurations.md";
+  lines.push(`  ${DIM}\u25CB Kimi \u2014 ${seeDocs}${RESET}`);
+  lines.push(`  ${DIM}\u25CB GitHub Copilot \u2014 ${seeDocs}${RESET}`);
+  lines.push(`  ${DIM}\u25CB ZAI Coding Plan \u2014 ${seeDocs}${RESET}`);
+  return lines.join("\n");
+}
+async function runInstall(config) {
+  const detected = detectCurrentConfig();
+  const isUpdate = detected.isInstalled;
+  printHeader(isUpdate);
+  let totalSteps = 4;
+  if (config.installSkills) totalSteps += 1;
+  if (config.installCustomSkills) totalSteps += 1;
+  let step = 1;
+  printStep(step++, totalSteps, "Checking OpenCode installation...");
+  if (config.dryRun) {
+    printInfo("Dry run mode - skipping OpenCode check");
+  } else {
+    const { ok } = await checkOpenCodeInstalled();
+    if (!ok) return 1;
+  }
+  printStep(step++, totalSteps, "Adding thoth-agents plugin...");
+  if (config.dryRun) {
+    printInfo("Dry run mode - skipping plugin installation");
+  } else {
+    const pluginResult = await addPluginToOpenCodeConfig();
+    if (!handleStepResult(pluginResult, "Plugin added")) return 1;
+  }
+  printStep(step++, totalSteps, "Disabling OpenCode default agents...");
+  if (config.dryRun) {
+    printInfo("Dry run mode - skipping agent disabling");
+  } else {
+    const agentResult = disableDefaultAgents();
+    if (!handleStepResult(agentResult, "Default agents disabled")) return 1;
+  }
+  printStep(step++, totalSteps, "Writing thoth-agents configuration...");
+  if (config.dryRun) {
+    const liteConfig = generateLiteConfig(config);
+    printInfo("Dry run mode - configuration that would be written:");
+    console.log(`
+${JSON.stringify(liteConfig, null, 2)}
+`);
+  } else {
+    const configPath = getExistingLiteConfigPath();
+    const configExists = existsSync10(configPath);
+    if (configExists && !config.reset) {
+      printInfo(
+        `Configuration already exists at ${configPath}. Use --reset to overwrite.`
+      );
+    } else {
+      const liteResult = writeLiteConfig(
+        config,
+        configExists ? configPath : void 0
+      );
+      if (!handleStepResult(
+        liteResult,
+        configExists ? "Config reset" : "Config written"
+      ))
+        return 1;
+    }
+  }
+  if (config.installSkills) {
+    printStep(step++, totalSteps, "Installing recommended external skills...");
+    if (config.dryRun) {
+      printInfo("Dry run mode - would install skills:");
+      for (const skill of RECOMMENDED_SKILLS) {
+        printInfo(`  - ${skill.name}`);
+      }
+    } else {
+      let skillsInstalled = 0;
+      for (const skill of RECOMMENDED_SKILLS) {
+        printInfo(`Installing ${skill.name}...`);
+        if (installSkill(skill)) {
+          printSuccess(`Installed: ${skill.name}`);
+          skillsInstalled++;
+        } else {
+          printInfo(`Skipped: ${skill.name} (already installed)`);
+        }
+      }
+      printSuccess(
+        `${skillsInstalled}/${RECOMMENDED_SKILLS.length} skills processed`
+      );
+    }
+  }
+  if (config.installCustomSkills) {
+    printStep(step++, totalSteps, "Installing bundled thoth-agents skills...");
+    if (config.dryRun) {
+      printInfo("Dry run mode - would install bundled skills:");
+      for (const skill of CUSTOM_SKILLS) {
+        printInfo(`  - ${skill.name}`);
+      }
+    } else {
+      const report = installCustomSkills();
+      for (const updatedSkill of report.updatedSkills) {
+        printSuccess(
+          `Installed: ${updatedSkill.skill.name} (${formatSkillReasons(updatedSkill.reasons)})`
+        );
+      }
+      for (const skippedSkill of report.skippedSkills) {
+        printInfo(`Up to date: ${skippedSkill.name}`);
+      }
+      for (const removedSkill of report.removedSkills) {
+        printInfo(`Removed obsolete skill: ${removedSkill}`);
+      }
+      for (const failedSkill of report.failedSkills) {
+        printError(
+          `Failed: ${failedSkill.skill.name} (${formatSkillReasons(failedSkill.reasons)})`
+        );
+      }
+      if (!report.success) {
+        return 1;
+      }
+      printSuccess(
+        `Bundled skills processed: ${formatCustomSkillReasons(report)}`
+      );
+    }
+  }
+  console.log();
+  console.log(formatConfigSummary());
+  console.log();
+  const statusMsg = isUpdate ? "thoth-agents updated!" : "thoth-agents installation complete!";
+  console.log(`${SYMBOLS.star} ${BOLD}${GREEN}${statusMsg}${RESET}`);
+  console.log();
+  console.log(`${BOLD}Next steps:${RESET}`);
+  console.log();
+  console.log(`  1. Start OpenCode:`);
+  console.log(`     ${BLUE}$ opencode${RESET}`);
+  console.log();
+  const modelsInfo = "Default configuration uses OpenAI models (gpt-5.4 / gpt-5.4-mini).";
+  console.log(`${BOLD}${modelsInfo}${RESET}`);
+  console.log(
+    `  ${DIM}Includes the seven-agent roster, thoth-mem memory defaults,${RESET}`
+  );
+  console.log(
+    `  ${DIM}native task delegation, and bundled SDD skills.${RESET}`
+  );
+  const altProviders = "For alternative providers (Kimi, GitHub Copilot, ZAI Coding Plan)";
+  console.log(`${BOLD}${altProviders}, see:${RESET}`);
+  const docsUrl = "https://github.com/EremesNG/thoth-agents/blob/master/docs/provider-configurations.md";
+  console.log(`  ${BLUE}${docsUrl}${RESET}`);
+  console.log();
+  return 0;
+}
+function createInstallConfig(args) {
+  return {
+    agent: args.agent ?? "opencode",
+    hasTmux: args.tmux === "yes",
+    installSkills: args.skills === "yes",
+    installCustomSkills: true,
+    dryRun: args.dryRun,
+    reset: args.reset ?? false
+  };
+}
+async function install(args) {
+  const config = createInstallConfig(args);
+  if (config.agent === "codex") {
+    const plan = buildCodexSetupPlan({
+      dryRun: config.dryRun,
+      reset: config.reset,
+      scope: "user",
+      projectRoot: cwd(),
+      homeDir: homedir3()
+    });
+    console.log(formatCodexSetupPlan(plan));
+    const result = applyCodexSetup(plan);
+    for (const diagnostic of result.diagnostics) printInfo(diagnostic);
+    if (!result.success) {
+      printError(`Codex install failed: ${result.error}`);
+      return 1;
+    }
+    printSuccess(
+      config.dryRun ? "Codex dry-run complete; no files written" : "Codex agent-pack setup complete"
+    );
+    return 0;
+  }
+  return runInstall(config);
+}
+
+// src/cli/index.ts
+function parseInstallArgs(args) {
+  const result = {
+    tui: true,
+    agent: "opencode"
+  };
+  for (const arg of args) {
+    if (arg === "--no-tui") {
+      result.tui = false;
+    } else if (arg.startsWith("--tmux=")) {
+      result.tmux = arg.split("=")[1];
+    } else if (arg.startsWith("--skills=")) {
+      result.skills = arg.split("=")[1];
+    } else if (arg === "--dry-run") {
+      result.dryRun = true;
+    } else if (arg === "--reset") {
+      result.reset = true;
+    } else if (arg.startsWith("--agent=")) {
+      const agent = arg.split("=")[1];
+      if (agent !== "opencode" && agent !== "codex") {
+        throw new Error(
+          `Unsupported install agent: ${agent}. Supported agents: opencode, codex.`
+        );
+      }
+      result.agent = agent;
+    } else if (arg === "-h" || arg === "--help") {
+      printHelp();
+      process.exit(0);
+    }
+  }
+  return result;
+}
+function parseGenerateArgs(args) {
+  const result = {};
+  for (const arg of args) {
+    if (arg.startsWith("--harness=")) {
+      const harness = arg.split("=")[1];
+      if (harness !== "codex") {
+        return {
+          command: "error",
+          message: `Unsupported generate harness: ${harness}.`
+        };
+      }
+      result.harness = harness;
+    } else if (arg === "--dry-run") {
+      result.dryRun = true;
+    } else if (arg.startsWith("--output-root=")) {
+      result.outputRoot = arg.split("=")[1];
+    }
+  }
+  if (result.harness !== "codex") {
+    return {
+      command: "error",
+      message: "Codex generation requires --harness=codex."
+    };
+  }
+  return {
+    command: "generate",
+    generateArgs: {
+      harness: result.harness,
+      dryRun: result.dryRun,
+      outputRoot: result.outputRoot
+    }
+  };
+}
+function parseCliArgs(args) {
+  if (args.length === 0 || args[0] === "install") {
+    const hasSubcommand = args[0] === "install";
+    try {
+      const installArgs = parseInstallArgs(args.slice(hasSubcommand ? 1 : 0));
+      return { command: "install", installArgs };
+    } catch (error) {
+      return {
+        command: "error",
+        message: error instanceof Error ? error.message : String(error)
+      };
+    }
+  }
+  if (args[0] === "generate") {
+    return parseGenerateArgs(args.slice(1));
+  }
+  if (args[0] === "-h" || args[0] === "--help") {
+    return { command: "help" };
+  }
+  return { command: "error", message: `Unknown command: ${args[0]}` };
+}
+function printHelp() {
+  console.log(`
+thoth-agents installer (thoth-agents)
+
+Usage: pnpm dlx thoth-agents install [OPTIONS]
+       pnpm dlx thoth-agents generate --harness=codex --dry-run
+
+Options:
+  --tmux=yes|no          Enable tmux integration (yes/no)
+  --skills=yes|no        Install recommended external skills
+  --no-tui               Non-interactive mode
+  --dry-run              Simulate install without writing files
+  --reset                Repair managed installer-owned targets
+  --agent=opencode|codex Select OpenCode plugin install (default) or Codex agent-pack setup
+  -h, --help             Show this help message
+
+Generate options:
+  --harness=codex        Explicitly select Codex artifact generation
+  --output-root=PATH     Override generation root metadata
+
+thoth-agents installs the seven-agent roster, thoth-mem defaults,
+native task delegation, and bundled SDD skills for OpenCode.
+
+Bundled thoth-agents skills are always installed.
+Use --skills=no to skip only recommended external skills.
+
+The generated config uses OpenAI by default.
+For alternative providers, see docs/provider-configurations.md.
+
+Examples:
+  pnpm dlx thoth-agents@latest install
+  pnpm dlx thoth-agents@latest install --agent=opencode
+  pnpm dlx thoth-agents@latest install --agent=codex
+  pnpm dlx thoth-agents@latest install --agent=codex --dry-run
+  pnpm dlx thoth-agents install --no-tui --tmux=no --skills=yes
+  pnpm dlx thoth-agents install --dry-run
+  pnpm dlx thoth-agents install --reset
+  pnpm dlx thoth-agents generate --harness=codex --dry-run
+`);
+}
+function printCodexGeneration(args) {
+  if (!args.dryRun) {
+    console.error(
+      "Codex generation is dry-run only in this MVP. Pass --dry-run."
+    );
+    return 1;
+  }
+  const result = codexAdapter.render({
+    projectRoot: process.cwd(),
+    options: {
+      dryRun: true,
+      outputRoot: args.outputRoot,
+      targetHarness: "codex"
+    }
+  });
+  console.log(JSON.stringify(result, null, 2));
+  return 0;
+}
+async function main() {
+  const parsed = parseCliArgs(process.argv.slice(2));
+  if (parsed.command === "install") {
+    const exitCode = await install(parsed.installArgs);
+    process.exit(exitCode);
+  } else if (parsed.command === "generate") {
+    process.exit(printCodexGeneration(parsed.generateArgs));
+  } else if (parsed.command === "help") {
+    printHelp();
+    process.exit(0);
+  } else {
+    console.error(parsed.message);
+    console.error("Run with --help for usage information");
+    process.exit(1);
+  }
+}
+var entrypointUrl = process.argv[1] ? pathToFileURL(process.argv[1]).href : void 0;
+if (import.meta.url === entrypointUrl) {
+  main().catch((err) => {
+    console.error("Fatal error:", err);
+    process.exit(1);
+  });
+}
+export {
+  parseCliArgs
+};