thoth-agents 0.1.6 → 0.1.7

package/dist/cli/index.js

@@ -1,4072 +1,51 @@
 #!/usr/bin/env node
+import {
+  getOpenCodePath,
+  getOpenCodeVersion,
+  isOpenCodeInstalled
+} from "../chunk-DYGVRAMS.js";
+import {
+  CODEX_ROLE_NAMES,
+  RECOMMENDED_SKILLS,
+  SUPPORTED_OPERATION_HARNESSES,
+  applyCodexPlan,
+  applyCodexSetup,
+  applyOpenCodePlan,
+  buildCodexModelPlan,
+  buildCodexSetupPlan,
+  buildCodexSyncPlan,
+  buildCodexUpdatePlan,
+  buildOpenCodeModelPlan,
+  buildOpenCodeSyncPlan,
+  buildOpenCodeUpdatePlan,
+  codexAdapter,
+  formatCodexSetupPlan,
+  getCodexStatus,
+  getOpenCodeStatus,
+  getOperationHarness,
+  installRecommendedSkill,
+  listOperationHarnesses
+} from "../chunk-OJCEGZSA.js";
+import {
+  ALL_AGENT_NAMES,
+  CUSTOM_SKILLS,
+  DEFAULT_MODELS,
+  addPluginToOpenCodeConfig,
+  detectCurrentConfig,
+  disableDefaultAgents,
+  generateLiteConfig,
+  getExistingLiteConfigPath,
+  installCustomSkills,
+  writeLiteConfig
+} from "../chunk-OES76C67.js";
 
-// src/cli/index.ts
-import { pathToFileURL } from "url";
-
-// src/harness/adapters/codex.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { dirname as dirname2, resolve } from "path";
-import { fileURLToPath } from "url";
-
-// src/agents/prompt-dialects.ts
-var OPENCODE_CAPABILITIES = {
-  agentDefinitions: "supported",
-  delegatedExecution: "supported",
-  parallelDelegation: "supported",
-  runtimeHooks: "supported",
-  mcpConfiguration: "supported",
-  skillPackaging: "supported",
-  rolePermissions: "supported",
-  parentContextInjection: "supported",
-  memoryGovernanceEnforcement: "supported"
-};
-var CODEX_PROMPT_CAPABILITIES = {
-  agentDefinitions: "supported",
-  delegatedExecution: "instruction-only",
-  parallelDelegation: "instruction-only",
-  runtimeHooks: "unknown",
-  mcpConfiguration: "supported",
-  skillPackaging: "supported",
-  rolePermissions: "instruction-only",
-  parentContextInjection: "instruction-only",
-  memoryGovernanceEnforcement: "instruction-only"
-};
-function supportedCapabilityProfile(capabilities) {
-  return {
-    capabilities,
-    renderCapabilityDisclosure: () => void 0
-  };
-}
-function codexCapabilityDisclosure(capability) {
-  const status = CODEX_PROMPT_CAPABILITIES[capability];
-  if (status === "supported") {
-    return void 0;
-  }
-  if (status === "unknown") {
-    return `${capability}: unknown in Codex; treat related behavior as diagnostic-only unless the active Codex host documents support.`;
-  }
-  return `${capability}: ${status} in Codex; preserve the role responsibility as prompt guidance because equivalent runtime enforcement is not guaranteed.`;
-}
-var OPENCODE_PROMPT_DIALECT = {
-  harness: "opencode",
-  tools: {
-    delegationTool: "task",
-    backgroundDelegationTool: "task(background=true)",
-    backgroundStatusTool: "task_status",
-    userQuestionTool: "question",
-    progressTool: "todowrite",
-    hostStatusSurface: "task_status",
-    roleReference: (role) => `@${role}`
-  },
-  capabilities: supportedCapabilityProfile(OPENCODE_CAPABILITIES),
-  dispatchLabel(method) {
-    switch (method) {
-      case "root-coordinator":
-        return "root coordinator";
-      case "task":
-        return "task";
-      case "synchronous-task-only":
-        return "synchronous task only";
-    }
-  },
-  renderRoleInvocation(role) {
-    return `@${role}`;
-  }
-};
-var CODEX_PROMPT_DIALECT = {
-  harness: "codex",
-  tools: {
-    delegationTool: "Codex custom-agent task",
-    backgroundDelegationTool: "Codex background role-agent run",
-    backgroundStatusTool: "Codex host status surface",
-    userQuestionTool: "request_user_input",
-    progressTool: "Codex progress tracking surface",
-    hostStatusSurface: "Codex host status surface",
-    roleReference: (role) => `${role} role agent`
-  },
-  capabilities: {
-    capabilities: CODEX_PROMPT_CAPABILITIES,
-    renderCapabilityDisclosure: codexCapabilityDisclosure
-  },
-  dispatchLabel(method) {
-    switch (method) {
-      case "root-coordinator":
-        return "ambient Codex root session coordinator";
-      case "task":
-        return "Codex custom-agent task";
-      case "synchronous-task-only":
-        return "synchronous Codex custom-agent task only";
-    }
-  },
-  renderRoleInvocation(role) {
-    return role === "orchestrator" ? "orchestrator role agent" : `${role} subagent`;
-  }
-};
-
-// src/agents/prompt-sections.ts
-function createQuestionProtocolSection() {
-  return {
-    kind: "question-protocol",
-    toolConcept: "userQuestion"
-  };
-}
-function createSubagentRulesSection(memoryAccess = "base") {
-  return {
-    kind: "subagent-rules",
-    memoryAccess,
-    progressConcept: "progress",
-    userQuestionConcept: "userQuestion"
-  };
-}
-function createResponseBudgetSection() {
-  return { kind: "response-budget" };
-}
-function createStepBudgetSection(steps) {
-  if (steps === void 0 || !Number.isInteger(steps) || steps <= 0) {
-    return void 0;
-  }
-  return { kind: "step-budget", steps };
-}
-function detectModelFamilyFromModel(model) {
-  const id = getPrimaryModelId(model)?.toLowerCase();
-  if (!id) {
-    return void 0;
-  }
-  if (id.includes("claude") || id.startsWith("anthropic/")) {
-    return "claude";
-  }
-  if (id.includes("gpt") || id.startsWith("openai/")) {
-    return "openai";
-  }
-  if (id.includes("gemini") || id.startsWith("google/")) {
-    return "gemini";
-  }
-  if (id.includes("kimi") || id.includes("k2")) {
-    return "kimi";
-  }
-  if (id.includes("glm") || id.startsWith("zai-")) {
-    return "glm";
-  }
-  return void 0;
-}
-function createModelFamilySection(role, model) {
-  const family = detectModelFamilyFromModel(model);
-  if (!family) {
-    return void 0;
-  }
-  return { kind: "model-family", role, family };
-}
-function roleText(template) {
-  return { kind: "role-text", template };
-}
-function specialistSections({
-  role,
-  mode,
-  dispatch,
-  scope,
-  responsibility,
-  rules,
-  memoryAccess,
-  output
-}) {
-  const dispatchLabel = dispatch === "task" ? "{{dispatch.task}}" : "{{dispatch.synchronous-task-only}}";
-  return [
-    roleText(`<role>
-You are ${role}.
-</role>
-
-<mode>
-- Mode: ${mode}
-- Dispatch method: ${dispatchLabel}
-- Scope: ${scope}
-</mode>
-
-<responsibility>
-${responsibility}
-</responsibility>
-
-<rules>`),
-    createSubagentRulesSection(memoryAccess),
-    roleText(`${rules.join("\n")}
-</rules>`),
-    createQuestionProtocolSection(),
-    roleText(`<output>`),
-    createResponseBudgetSection(),
-    roleText(`${output}
-</output>`)
-  ];
-}
-function createOrchestratorPromptSections() {
-  return [
-    roleText(`<role>
-You are the delegate-first root coordinator and decision engine for thoth-agents.
-The root agent is the orchestrator/root coordinator for the session.
-Orchestrator-only, root-only, or orchestrator-owned rules still apply even if
-the harness does not name this agent "orchestrator".
-</role>
-
-<style>
-Respond in the user's language. Be warm, direct, evidence-led, and concise.
-Push back when context, risk, or assumptions are weak. Avoid verbosity.
-</style>
-
-<core-rules>
-- Mode: primary coordinator. Mutation: none.
-- Load \`thoth-mem-agents\` and \`requirements-interview\`.
-- You MUST NOT read or write any file in the workspace except \`openspec/\` coordination artifacts for the SDD pipeline.
-- Delegate all inspection, writing, searching, debugging, and verification.
-- Own the thinking: analyze, choose approach, handle task sequencing, synthesize facts, decide, ask \`{{userQuestionTool}}\` for blocking user input, manage progress, own root-session memory, and write the final report.
-- Use sub-agents for evidence and action, not to outsource architecture or planning.
-- Never request raw file dumps from sub-agents; ask for findings, paths, line anchors, diffs, verification, and blockers.
-- Use openspec/ for coordination artifacts, especially
-  openspec/changes/{change-name}/tasks.md.
-- Visual or UX work and screenshots always go to {{role.designer}}.
-- Verify through delegation, not inline.
-- Verification should follow the user's project instructions and use the smallest sufficient delegated checks: typecheck, lint, focused tests, or build when appropriate.
-- When a harness cannot enforce a rule directly, preserve the rule as instruction-only guidance and disclose the enforcement gap instead of weakening the contract.
-</core-rules>
-
-<session-bootstrap>
-- At the start of a new root session, when thoth-mem tools are available, load \`thoth-mem-agents\` and \`requirements-interview\`, call \`mem_session_start\` with the current project and session identity, then save the real user prompt with \`mem_save_prompt\`.
-- Save only the real user request with \`mem_save_prompt\`; never save generated sub-agent prompts, handoffs, summaries, or tool scaffolding as user intent.
-- If thoth-mem tools or required session/project identity are unavailable, disclose that memory bootstrap could not run and continue without pretending memory was saved.
-</session-bootstrap>
-
-<routing>
-{{role.explorer}}: read-only codebase discovery. Use for broad search, symbols, references, unknown paths, or multiple candidates.
-{{role.librarian}}: read-only external docs/public examples. Use for version-sensitive APIs, official docs, or unfamiliar libraries.
-{{role.oracle}}: read-only review/diagnosis. Use for architecture, security/correctness risk, plan review, persistent bugs, or high-stakes ambiguity.
-{{role.designer}}: write-capable UI/UX owner. Use for user-facing UI, styles, layout, interactions, and all visual QA.
-{{role.quick}}: write-capable narrow implementer. Use for clear, mechanical, low-risk, uniform edits.
-{{role.deep}}: write-capable thorough implementer. Use for backend logic, data flow, APIs, state, refactors, edge cases, or correctness-critical work.
-
-Tiebreakers:
-- User-facing UI -> {{role.designer}}. Backend/system logic -> {{role.deep}}. Mechanical pattern -> {{role.quick}}.
-- Discovery first when paths or facts are unknown; implementation agent may read known local context for its own task, but should not redo broad discovery already assigned to {{role.explorer}}/{{role.librarian}}.
-- Do not use {{role.oracle}} for routine synthesis. After {{role.explorer}}/{{role.librarian}} results, you combine facts, inferences, unknowns, confidence, and next step.
-</routing>
-
-<subagent-prompts>
-- Every sub-agent prompt you write must be in English, regardless of the user's language.
-- Keep user-facing replies in the user's language, but translate delegated task prompts, internal handoffs, SDD envelopes, and verification requests into English.
-- Prefer 2-3 surgical discovery probes over one broad exploration when independent facts can be gathered in parallel.
-- A surgical probe asks one narrow question and returns only the anchors needed for your decision.
-</subagent-prompts>
-
-<internal-handoff>
-Before dispatching {{role.designer}}, {{role.quick}}, or {{role.deep}} after discovery, synthesize a compact internal handoff. This is an implementation detail between you and sub-agents, not a user-facing step or artifact.
-
-Internal handoff fields: Goal, Decision, Evidence, Scope, Steps, Verification, and Uncertainty. Include relevant files, symbols, anchors, constraints, non-goals, and what to escalate instead of guessing.
-
-Never mention the internal handoff to the user, ask the user to prepare it, or present handoff preparation as the recommended next step. To the user, describe the actual work: discovery, design, implementation, verification, or the concrete decision needed.
-
-For {{role.explorer}}/{{role.librarian}}, ask narrow fact-finding questions for likely files, symbols, call sites, constraints, examples, versioned API facts, and verification targets. Require decision-ready findings, not raw context.
-</internal-handoff>
-
-<dispatch>
-- If independent delegations are ready, launch them in the same response.
-- Default to normal synchronous \`{{delegationTool}}\` execution.
-- Experimental background \`{{backgroundDelegationTool}}\` is allowed only for {{role.explorer}} and {{role.librarian}} for asynchronous delegation.
-- {{role.oracle}}, {{role.designer}}, {{role.quick}}, and {{role.deep}} always use normal synchronous \`{{delegationTool}}\` execution.
-- When using background \`{{delegationTool}}\`, treat it as conditional and non-portable: if the host does not expose the experimental path, fall back to normal synchronous \`{{delegationTool}}\`.
-- Use \`{{backgroundStatusTool}}\` to wait, poll, and collect background task results before synthesizing or reporting completion.
-- If a result is empty, contradictory, or low-confidence, retry once with a materially sharper prompt; then escalate with evidence via \`{{userQuestionTool}}\`.
-- If a named subagent hits capacity, retry that same role up to 3 attempts.
-- Never switch to \`default\`, \`worker\`, or any other role.
-- After 3 failures, stay on the same role; if a same-role model override exists, use it. Otherwise report a capacity blocker.
-- Write-capable dispatches must include the internal handoff when one exists, so implementers can edit instead of rediscovering the plan.
-- Never tell sub-agents to discard working-tree changes.
-</dispatch>
-
-<sdd>
-All work always starts with requirements-interview skill.
-
-Routes:
-- Direct implementation for low-complexity work.
-- Accelerated SDD: propose -> tasks.
-- Full SDD: propose -> spec -> design -> tasks.
-
-Hard gates:
-- Artifact-producing SDD phases are dispatched to {{role.deep}} or {{role.quick}} with the matching skill loaded.
-- {{role.oracle}} is read-only and only handles plan-reviewer.
-- Never skip artifacts or jump from requirements-interview to implementation when SDD is selected.
-- Before SDD execution, load \`executing-plans\`; then track progress in {{progressTool}} plus the persistent artifact.
-- If openspec persistence is selected and openspec/ is missing, dispatch sdd-init first.
-- During SDD execution, batch compatible implementation work.
-- Group consecutive ready SDD tasks for the same execution agent into one dispatch when dependencies, scope, and verification can be handled together. Keep per-task tracking and evidence; do not split a compatible {{role.designer}}/{{role.quick}}/{{role.deep}} run into one delegation per checkbox.
-
-SDD dispatch envelope must include: skill name, persistence mode, pipeline type, change name, project name, needed prior artifact context, verification expectation, and return envelope.
-After each phase, verify the sub-agent reported the openspec path and/or thoth-mem topic_key. Retry once if missing.
-
-Artifact governance handoff:
-- After \`sdd-tasks\`, you may surface report-only artifact governance findings before execution preparation starts.
-- Delegate governance inspection; do not inspect repository artifacts inline.
-- Do not treat governance findings as an execution gate.
-- Do not let governance validation replace \`plan-reviewer\` or \`executing-plans\`.
-- Root thoth-mem ownership stays with you; sub-agents may surface findings but must not own session memory, prompts, or progress checkpoints.
-
-Plan gate: after tasks, ask with \`{{userQuestionTool}}\`: "Review plan with {{role.oracle}} before executing (Recommended)" or "Proceed to execution".
-If reviewed, the review loop is complete only after [OKAY].
-If {{role.oracle}} returns [OKAY], ask the user with \`{{userQuestionTool}}\` whether to proceed to implementation or stop with the approved plan.
-Do not dispatch \`sdd-apply\` after oracle approval until the user confirms implementation.
-Post-execution: delegate sdd-verify, then sdd-archive when verification passes.
-</sdd>
-
-<progress-memory>
-- Keep {{progressTool}} top-level and lean for multi-step work.
-- When SDD is active, update both {{progressTool}} and openspec/changes/{change-name}/tasks.md before dispatch and after results.
-- Root-session memory is yours: search before repeated work; save durable decisions, discoveries, bugs, patterns, constraints, and session summaries.
-- Durable \`mem_save\` guidance: save architecture decisions, accepted or rejected recommendations, bug fixes with root cause, non-obvious discoveries, conventions, configuration changes, and durable user preferences. Use stable topic keys for evolving topics, and keep general observations outside the protected \`sdd/*\` namespace.
-- Targeted 3-layer recall protocol: \`mem_search\` with compact results -> \`mem_timeline\` around promising observations -> \`mem_get_observation\` only for records needed in full. Use preview search only when compact results do not disambiguate.
-- SDD memory artifacts use deterministic topic keys only in thoth-mem or hybrid persistence modes: \`sdd/{change}/{artifact}\`.
-- Before ending the root session, call \`mem_session_summary\` with a concise Goal, Instructions, Discoveries, Accomplished, Next Steps, and Relevant Files summary. Do not claim memory was saved unless the tool call succeeded.
-- After compaction, first preserve the compacted summary with \`mem_session_summary\`, then recover recent context and use the 3-layer recall protocol before continuing work.
-</progress-memory>
-
-<communication>
-State the plan briefly, delegate, then summarize outcomes without replaying raw work. Before any tool call or delegation, emit a short user-visible status/preamble that names the next action and target; for parallel dispatches, one compact sentence covering the batch is enough. Keep preambles about next action, evidence, and verification, not private reasoning. Separate evidence, inference, and uncertainty when it matters. Never ask blocking questions in prose.
-</communication>`),
-    createQuestionProtocolSection()
-  ];
-}
-function createReadOnlySpecialistPromptSections(role) {
-  if (role === "explorer") {
-    return specialistSections({
-      role,
-      mode: "read-only",
-      dispatch: "task",
-      scope: "local repository discovery",
-      responsibility: "Find workspace facts fast. Return decision-ready evidence for internal handoffs: paths, lines, symbols, candidate files, constraints, edit targets, verification targets, and conclusions.",
-      rules: [
-        "- Questions should be rare; exhaust local evidence first.",
-        "- Prefer paths, lines, symbols, and concise summaries over dumps.",
-        "- Do not implement, edit files, mutate the repository, or own durable session memory.",
-        "- When full content is explicitly requested, reproduce it faithfully."
-      ],
-      memoryAccess: "readonly",
-      output: `
-Return exactly these sections, in this order:
-
-STATUS: one of CONFIRMED | PARTIAL | INCONCLUSIVE
-- CONFIRMED = direct evidence answers the question with high confidence.
-- PARTIAL = some direct evidence, but gaps remain or multiple candidates exist.
-- INCONCLUSIVE = no sufficient evidence found. Never fabricate a confident answer from naming similarity alone.
-
-FINDINGS: bullets with claim, evidence type [direct|inferred|assumed], confidence [high|medium|low], and file:line anchors for concrete claims.
-
-ALTERNATIVES CONSIDERED: ranked candidates when more than one plausible match exists. Omit if only one candidate.
-
-UNRESOLVED QUESTIONS: ambiguity and what context would unblock it.
-
-UNCHECKED AREAS: what you did not inspect that could change the answer. Omit if nothing notable.
-
-SHORT EVIDENCE: at most one 2-line excerpt per key finding.
-
-Lead with STATUS. Stay under 40 lines total when possible. If the schema forces more lines, exceed the budget rather than drop required fields.`
-    });
-  }
-  if (role === "librarian") {
-    return specialistSections({
-      role,
-      mode: "read-only",
-      dispatch: "task",
-      scope: "external docs and research plus local confirmation when needed",
-      responsibility: "Gather authoritative external evidence that helps the orchestrator make implementation decisions. Prefer official docs first, include version sensitivity, then high-signal public examples. Every substantive claim must carry a source URL.",
-      rules: [
-        "- Questions should be rare; exhaust available sources first.",
-        "- Prefer official documentation over commentary when both answer the same point.",
-        "- Distinguish clearly between official guidance and community examples.",
-        "- Do not mutate the repository, invent undocumented APIs, or perform broad implementation work."
-      ],
-      memoryAccess: "readonly",
-      output: `- Organize by finding. Include a source URL for every claim.
-- Distinguish official docs from community examples.
-- Return synthesized findings, not full documentation excerpts.
-- Target: under 40 lines total.`
-    });
-  }
-  return specialistSections({
-    role,
-    mode: "read-only",
-    dispatch: "synchronous task only",
-    scope: "advice, diagnosis, architecture, code review, and plan review",
-    responsibility: "Provide read-only review and strategic technical guidance anchored to evidence, including findings, risks, assumptions, and decision-ready conclusions. Use systematic-debugging for bugs, plan-reviewer for SDD plans, and web-assisted research when deeper diagnosis needs it.",
-    rules: [
-      "- Cite exact files and lines for local claims.",
-      "- Separate observations, risks, and recommendations.",
-      "- Ask only when tradeoffs, risk tolerance, or approval materially change the recommendation.",
-      "- Do not produce SDD artifacts, implement edits, or mutate the workspace."
-    ],
-    memoryAccess: "readonly",
-    output: `- Cite exact files and lines \u2014 do not quote large code blocks.
-- Separate observations, risks, and recommendations.
-- For diagnosis: root cause + fix recommendation, not step-by-step trace.
-- Target: under 50 lines total.`
-  });
-}
-function createWriteCapableSpecialistPromptSections(role) {
-  if (role === "designer") {
-    return specialistSections({
-      role,
-      mode: "write-capable",
-      dispatch: "synchronous task only",
-      scope: "UI/UX decisions, implementation, and visual verification",
-      responsibility: "Own the user-facing solution: choose the UX approach, implement it, and verify it visually across responsive states when screens change. Use the harness-available visual verification surface in a non-blocking, single-run mode and capture evidence that supports your findings.\nFor visual QA-only tasks, inspect the UI, summarize what looks correct, note issues, and recommend fixes.",
-      rules: [
-        "- Treat the orchestrator's internal handoff as the handoff; do not rediscover settled scope or constraints.",
-        "- Own UX decisions instead of bouncing them back unless a real user preference is required.",
-        "- Verify visually and check responsive behavior when feasible; do not stop at code that merely compiles.",
-        "- Keep changes focused on the user-facing outcome.",
-        "- Preserve unrelated working-tree changes.",
-        "- Avoid interactive, blocking, or persistent visual verification modes unless explicitly requested; keep verification single-run and evidence-driven."
-      ],
-      memoryAccess: "writable",
-      output: `For SDD tasks: use the Task Result envelope (Status, Task, What was done, Files changed, Verification, Issues).
-For non-SDD work: state what was implemented, verification status, and remaining caveats.
-- Include visual verification status when applicable.
-- Target: under 30 lines total.`
-    });
-  }
-  if (role === "quick") {
-    return specialistSections({
-      role,
-      mode: "write-capable",
-      dispatch: "synchronous task only",
-      scope: "fast bounded implementation",
-      responsibility: "Implement well-defined changes quickly. Favor speed over exhaustive analysis when the task is narrow, low-risk, mechanical, and the path is clear.",
-      rules: [
-        "- Optimize for fast execution on narrow, clear tasks.",
-        "- Treat the orchestrator's internal handoff as the starting point; follow its file anchors, scope, non-goals, and verification target.",
-        "- Preserve unrelated working-tree changes.",
-        "- Read only the context you need.",
-        "- Do not redo broad discovery. If the handoff lacks essential anchors, surface the missing context instead of turning the task into open-ended exploration.",
-        "- Avoid multi-step planning; if the task stops being bounded, surface it.",
-        "- Ask only for implementation-local ambiguity, not orchestrator-level routing.",
-        "- NEVER run git commands that discard changes (`git restore`, `git checkout --`, `git reset`, `git clean`). Files modified by prior tasks are intentional SDD progress, not unintended changes."
-      ],
-      memoryAccess: "writable",
-      output: `For SDD tasks: use the Task Result envelope (Status, Task, What was done, Files changed, Verification, Issues).
-For non-SDD work: status + summary + files changed + issues. Nothing more.
-- Target: under 20 lines total.`
-    });
-  }
-  return specialistSections({
-    role,
-    mode: "write-capable",
-    dispatch: "synchronous task only",
-    scope: "thorough implementation and verification",
-    responsibility: "Handle correctness-critical, multi-file, or edge-case-heavy changes with full local context analysis. Use test-driven-development and systematic-debugging when relevant before implementing fixes.",
-    rules: [
-      "- Treat the orchestrator's internal handoff as the architecture handoff; validate it against nearby code, but do not restart upstream discovery unless evidence contradicts it.",
-      "- Do not skip verification \u2014 thoroughness is your value proposition.",
-      "- Investigate related files, types, and call sites before changing shared behavior, prioritizing the anchors and constraints in the handoff.",
-      "- Preserve unrelated working-tree changes.",
-      "- Ask when a real architecture or implementation tradeoff blocks correct execution."
-    ],
-    memoryAccess: "writable",
-    output: `For SDD tasks: use the Task Result envelope (Status, Task, What was done, Files changed, Verification, Issues).
-For non-SDD work: summary + files changed + verification results + edge cases considered.
-- Save detailed analysis for follow-up requests; return only actionable conclusions.
-- Target: under 40 lines total.`
-  });
-}
-function getPrimaryModelId(model) {
-  if (Array.isArray(model)) {
-    const first = model[0];
-    return typeof first === "string" ? first : first?.id;
-  }
-  return model;
-}
-function renderQuestionProtocol(_section, dialect) {
-  return `<questions>
-Use \`${dialect.tools.userQuestionTool}\` only for blocking choices: unresolved ambiguity that changes the result, destructive/security-sensitive actions, or missing secrets. Do all non-blocked work first, ask one targeted question with a recommended default first, then stop.
-</questions>`;
-}
-function renderSubagentRules(section, dialect) {
-  const rules = [
-    `- Single-task leaf agent: do not delegate, manage SDD phases, act as orchestrator, or call \`${dialect.tools.progressTool}\`.`,
-    `- Use \`${dialect.tools.userQuestionTool}\` only for local blocking decisions.`,
-    "- Never discard working-tree changes: no `git restore`, `git checkout -- <path>`, `git reset --hard`, `git clean`, or `git stash`.",
-    "- Avoid blocking/watch commands; use terminating checks only."
-  ];
-  if (section.memoryAccess === "readonly") {
-    rules.push(
-      "- Use read-only thoth-mem only when dispatch gives session_id/project: `mem_search` -> `mem_timeline` -> `mem_get_observation`.",
-      "- Never call `mem_session_start`, `mem_session_summary`, or `mem_save_prompt`; those tools are orchestrator-owned.",
-      "- Never write memory; memory writes are orchestrator-owned."
-    );
-  }
-  if (section.memoryAccess === "writable") {
-    rules.push(
-      "- Use delegated thoth-mem tools only (mem_save, mem_search, mem_get_observation, mem_timeline, mem_suggest_topic_key).",
-      "- Never call `mem_session_start`, `mem_session_summary`, or `mem_save_prompt`; those tools are orchestrator-owned.",
-      "- Always use the parent session_id/project from dispatch for every thoth-mem call.",
-      "- If either is missing, do NOT call thoth-mem.",
-      "- For reads, use only `mem_search` -> `mem_timeline` -> `mem_get_observation`.",
-      "- You do not own durable memory of your own; `mem_save` writes under the orchestrator's session/project only."
-    );
-  }
-  return rules.join("\n");
-}
-function renderResponseBudget() {
-  return "Return concise structured results: status, summary, files, verification/issues. Never return raw file dumps.";
-}
-function renderStepBudget(section) {
-  return `<step-budget>
-- You have a hard execution budget of ${section.steps} steps.
-- Plan your tool use before acting, prioritize the highest-signal checks first, and stop once you have enough evidence to answer.
-- Avoid repeated searches or reads. If the remaining work will exceed the budget, return partial findings with the next best target instead of looping.
-</step-budget>`;
-}
-function getRoleModelProfile(role) {
-  switch (role) {
-    case "orchestrator":
-      return "- Exploit your role by selecting the right specialist category, launching independent tasks together, and synthesizing facts/inferences/unknowns before the next dispatch.";
-    case "explorer":
-      return "- Exploit your role by scanning broadly first, then narrowing to symbol/path evidence with ranked candidates and confidence.";
-    case "librarian":
-      return "- Exploit your role by prioritizing official docs, dates, versions, and source quality before summarizing public examples.";
-    case "oracle":
-      return "- Exploit your role by challenging assumptions, identifying risk, and giving a decision-ready recommendation backed by evidence.";
-    case "designer":
-      return "- Exploit your role by making concrete UX choices, implementing them, and verifying the visible result instead of stopping at code review.";
-    case "quick":
-      return "- Exploit your role by applying the smallest clear edit, avoiding broad exploration, and returning immediately after focused verification.";
-    case "deep":
-      return "- Exploit your role by building a complete mental model of shared behavior, writing tests first when behavior changes, and verifying edge cases.";
-  }
-}
-function renderModelFamily(section) {
-  const roleGuidance = getRoleModelProfile(section.role);
-  if (section.family === "claude") {
-    return `<model-profile family="claude">
-- Use XML-like sections, label uncertainty, and delegate aggressively when agentic.
-${roleGuidance}
-</model-profile>`;
-  }
-  if (section.family === "openai") {
-    return `<model-profile family="openai">
-- Plan briefly, then act. Keep tool dispatch explicit: action, target, return shape.
-${roleGuidance}
-</model-profile>`;
-  }
-  if (section.family === "gemini") {
-    return `<model-profile family="gemini">
-- Use long-context breadth deliberately, then ground conclusions in exact anchors.
-${roleGuidance}
-</model-profile>`;
-  }
-  if (section.family === "kimi") {
-    return `<model-profile family="kimi">
-- Favor repository-scale navigation before edits; keep patches grounded in current file state.
-${roleGuidance}
-</model-profile>`;
-  }
-  return `<model-profile family="glm">
-- Use compact checklists, conservative steps, clear verification, and concrete blockers.
-${roleGuidance}
-</model-profile>`;
-}
-function renderRoleText(section, dialect) {
-  return section.template.replaceAll("{{delegationTool}}", dialect.tools.delegationTool).replaceAll(
-    "{{backgroundDelegationTool}}",
-    dialect.tools.backgroundDelegationTool ?? dialect.tools.delegationTool
-  ).replaceAll(
-    "{{backgroundStatusTool}}",
-    dialect.tools.backgroundStatusTool ?? dialect.tools.hostStatusSurface ?? ""
-  ).replaceAll("{{userQuestionTool}}", dialect.tools.userQuestionTool).replaceAll("{{progressTool}}", dialect.tools.progressTool).replaceAll("{{dispatch.task}}", dialect.dispatchLabel("task")).replaceAll(
-    "{{dispatch.synchronous-task-only}}",
-    dialect.dispatchLabel("synchronous-task-only")
-  ).replace(
-    /\{\{role\.(\w+)\}\}/g,
-    (_match, role) => dialect.renderRoleInvocation(role)
-  );
-}
-function renderPromptSection(section, dialect) {
-  switch (section.kind) {
-    case "question-protocol":
-      return renderQuestionProtocol(section, dialect);
-    case "subagent-rules":
-      return renderSubagentRules(section, dialect);
-    case "response-budget":
-      return renderResponseBudget();
-    case "step-budget":
-      return renderStepBudget(section);
-    case "model-family":
-      return renderModelFamily(section);
-    case "role-text":
-      return renderRoleText(section, dialect);
-  }
-}
-function renderRolePrompt(sections, dialect) {
-  return sections.map((section) => renderPromptSection(section, dialect).trim()).filter(Boolean).join("\n\n");
-}
-
-// src/agents/prompt-utils.ts
-var QUESTION_PROTOCOL = renderPromptSection(
-  createQuestionProtocolSection(),
-  OPENCODE_PROMPT_DIALECT
-);
-var SUBAGENT_RULES = renderPromptSection(
-  createSubagentRulesSection("base"),
-  OPENCODE_PROMPT_DIALECT
-);
-var SUBAGENT_RULES_READONLY = renderPromptSection(
-  createSubagentRulesSection("readonly"),
-  OPENCODE_PROMPT_DIALECT
-);
-var SUBAGENT_RULES_WRITABLE = renderPromptSection(
-  createSubagentRulesSection("writable"),
-  OPENCODE_PROMPT_DIALECT
-);
-var RESPONSE_BUDGET = renderPromptSection(
-  createResponseBudgetSection(),
-  OPENCODE_PROMPT_DIALECT
-);
-function trimPromptSection(section) {
-  const trimmed = section?.trim();
-  return trimmed ? trimmed : void 0;
-}
-function appendPromptSections(...sections) {
-  return sections.map(trimPromptSection).filter(Boolean).join("\n\n");
-}
-function replacePromptPlaceholders(template, placeholders = {}) {
-  return Object.entries(placeholders).reduce((prompt, [key, value]) => {
-    if (value === void 0) {
-      return prompt;
-    }
-    return prompt.replaceAll(`{{${key}}}`, String(value));
-  }, template);
-}
-function composeAgentPrompt({
-  basePrompt,
-  customPrompt,
-  customAppendPrompt,
-  placeholders
-}) {
-  const resolvedBase = replacePromptPlaceholders(basePrompt, placeholders);
-  if (customPrompt) {
-    return replacePromptPlaceholders(customPrompt, placeholders);
-  }
-  return appendPromptSections(
-    resolvedBase,
-    replacePromptPlaceholders(customAppendPrompt ?? "", placeholders)
-  );
-}
-
-// src/config/constants.ts
-var AGENT_ALIASES = {
-  explore: "explorer",
-  "frontend-ui-ux-engineer": "designer"
-};
-var DEFAULT_MODELS = {
-  orchestrator: void 0,
-  oracle: "openai/gpt-5.4",
-  librarian: "openai/gpt-5.4-mini",
-  explorer: "openai/gpt-5.4-mini",
-  designer: "openai/gpt-5.4-mini",
-  quick: "openai/gpt-5.4-mini",
-  deep: "openai/gpt-5.4"
-};
-var DEFAULT_TIMEOUT_MS = 2 * 60 * 1e3;
-var MAX_POLL_TIME_MS = 5 * 60 * 1e3;
-var DEFAULT_THOTH_COMMAND = ["npx", "-y", "thoth-mem"];
-
-// src/config/loader.ts
-import * as fs from "fs";
-import * as path from "path";
-
-// src/cli/config-io.ts
-import {
-  copyFileSync,
-  existsSync as existsSync2,
-  readFileSync,
-  renameSync,
-  statSync,
-  writeFileSync
-} from "fs";
-
-// src/cli/paths.ts
-import { existsSync, mkdirSync } from "fs";
-import { homedir } from "os";
-import { dirname, join } from "path";
-function getDefaultOpenCodeConfigDir() {
-  const userConfigDir = process.env.XDG_CONFIG_HOME ? process.env.XDG_CONFIG_HOME : join(homedir(), ".config");
-  return join(userConfigDir, "opencode");
-}
-function getCustomOpenCodeConfigDir() {
-  const configDir = process.env.OPENCODE_CONFIG_DIR?.trim();
-  return configDir || void 0;
-}
-function getConfigDir() {
-  const customConfigDir = getCustomOpenCodeConfigDir();
-  if (customConfigDir) {
-    return customConfigDir;
-  }
-  return getDefaultOpenCodeConfigDir();
-}
-function getOpenCodeConfigPaths() {
-  const configDir = getDefaultOpenCodeConfigDir();
-  return [join(configDir, "opencode.json"), join(configDir, "opencode.jsonc")];
-}
-function getConfigJson() {
-  return getOpenCodeConfigPaths()[0];
-}
-function getConfigJsonc() {
-  return getOpenCodeConfigPaths()[1];
-}
-function getLiteConfig() {
-  return join(getConfigDir(), "thoth-agents.json");
-}
-function getLiteConfigJsonc() {
-  return join(getConfigDir(), "thoth-agents.jsonc");
-}
-function getExistingLiteConfigPath() {
-  const jsonPath = getLiteConfig();
-  if (existsSync(jsonPath)) return jsonPath;
-  const jsoncPath = getLiteConfigJsonc();
-  if (existsSync(jsoncPath)) return jsoncPath;
-  return jsonPath;
-}
-function getExistingConfigPath() {
-  const jsonPath = getConfigJson();
-  if (existsSync(jsonPath)) return jsonPath;
-  const jsoncPath = getConfigJsonc();
-  if (existsSync(jsoncPath)) return jsoncPath;
-  return jsonPath;
-}
-function ensureConfigDir() {
-  const configDir = getConfigDir();
-  if (!existsSync(configDir)) {
-    mkdirSync(configDir, { recursive: true });
-  }
-}
-function ensureOpenCodeConfigDir() {
-  const configDir = dirname(getConfigJson());
-  if (!existsSync(configDir)) {
-    mkdirSync(configDir, { recursive: true });
-  }
-}
-
-// src/cli/providers.ts
-var MODEL_MAPPINGS = {
-  openai: {
-    orchestrator: { model: "openai/gpt-5.4" },
-    oracle: { model: "openai/gpt-5.4", variant: "high" },
-    librarian: { model: "openai/gpt-5.4-mini", variant: "low" },
-    explorer: { model: "openai/gpt-5.4-mini", variant: "low" },
-    designer: { model: "openai/gpt-5.4-mini", variant: "medium" },
-    quick: { model: "openai/gpt-5.4-mini", variant: "low" },
-    deep: { model: "openai/gpt-5.4", variant: "high" }
-  },
-  kimi: {
-    orchestrator: { model: "kimi-for-coding/k2p5" },
-    oracle: { model: "kimi-for-coding/k2p5", variant: "high" },
-    librarian: { model: "kimi-for-coding/k2p5", variant: "low" },
-    explorer: { model: "kimi-for-coding/k2p5", variant: "low" },
-    designer: { model: "kimi-for-coding/k2p5", variant: "medium" },
-    quick: { model: "kimi-for-coding/k2p5", variant: "low" },
-    deep: { model: "kimi-for-coding/k2p5", variant: "high" }
-  },
-  copilot: {
-    orchestrator: { model: "github-copilot/claude-opus-4.6" },
-    oracle: { model: "github-copilot/claude-opus-4.6", variant: "high" },
-    librarian: { model: "github-copilot/grok-code-fast-1", variant: "low" },
-    explorer: { model: "github-copilot/grok-code-fast-1", variant: "low" },
-    designer: {
-      model: "github-copilot/gemini-3.1-pro-preview",
-      variant: "medium"
-    },
-    quick: { model: "github-copilot/claude-sonnet-4.6", variant: "low" },
-    deep: { model: "github-copilot/claude-opus-4.6", variant: "high" }
-  },
-  "zai-plan": {
-    orchestrator: { model: "zai-coding-plan/glm-5" },
-    oracle: { model: "zai-coding-plan/glm-5", variant: "high" },
-    librarian: { model: "zai-coding-plan/glm-5", variant: "low" },
-    explorer: { model: "zai-coding-plan/glm-5", variant: "low" },
-    designer: { model: "zai-coding-plan/glm-5", variant: "medium" },
-    quick: { model: "zai-coding-plan/glm-5", variant: "low" },
-    deep: { model: "zai-coding-plan/glm-5", variant: "high" }
-  }
-};
-function generateLiteConfig(installConfig) {
-  const config = {
-    preset: "openai",
-    presets: {}
-  };
-  const createAgentConfig = (modelInfo) => {
-    return {
-      model: modelInfo.model,
-      variant: modelInfo.variant
-    };
-  };
-  const buildPreset = (mappingName) => {
-    const mapping = MODEL_MAPPINGS[mappingName];
-    return Object.fromEntries(
-      Object.entries(mapping).map(([agentName, modelInfo]) => [
-        agentName,
-        createAgentConfig(modelInfo)
-      ])
-    );
-  };
-  config.presets.openai = buildPreset("openai");
-  if (installConfig.hasTmux) {
-    config.tmux = {
-      enabled: true,
-      layout: "main-vertical",
-      main_pane_size: 60
-    };
-  }
-  return config;
-}
-
-// src/cli/config-io.ts
-var PACKAGE_NAME = "thoth-agents";
-function stripJsonComments(json) {
-  const commentPattern = /\\"|"(?:\\"|[^"])*"|(\/\/.*|\/\*[\s\S]*?\*\/)/g;
-  const trailingCommaPattern = /\\"|"(?:\\"|[^"])*"|(,)(\s*[}\]])/g;
-  return json.replace(
-    commentPattern,
-    (match, commentGroup) => commentGroup ? "" : match
-  ).replace(
-    trailingCommaPattern,
-    (match, comma, closing) => comma ? closing : match
-  );
-}
-function parseConfigFile(path3) {
-  try {
-    if (!existsSync2(path3)) return { config: null };
-    const stat = statSync(path3);
-    if (stat.size === 0) return { config: null };
-    const content = readFileSync(path3, "utf-8");
-    if (content.trim().length === 0) return { config: null };
-    return { config: JSON.parse(stripJsonComments(content)) };
-  } catch (err) {
-    return { config: null, error: String(err) };
-  }
-}
-function parseConfig(path3) {
-  const result = parseConfigFile(path3);
-  if (result.config || result.error) return result;
-  if (path3.endsWith(".json")) {
-    const jsoncPath = path3.replace(/\.json$/, ".jsonc");
-    return parseConfigFile(jsoncPath);
-  }
-  return { config: null };
-}
-function writeConfig(configPath, config) {
-  if (configPath.endsWith(".jsonc")) {
-    console.warn(
-      "[config-manager] Writing to .jsonc file - comments will not be preserved"
-    );
-  }
-  const tmpPath = `${configPath}.tmp`;
-  const bakPath = `${configPath}.bak`;
-  const content = `${JSON.stringify(config, null, 2)}
-`;
-  if (existsSync2(configPath)) {
-    copyFileSync(configPath, bakPath);
-  }
-  writeFileSync(tmpPath, content);
-  renameSync(tmpPath, configPath);
-}
-async function addPluginToOpenCodeConfig() {
-  const configPath = getExistingConfigPath();
-  try {
-    ensureOpenCodeConfigDir();
-  } catch (err) {
-    return {
-      success: false,
-      configPath,
-      error: `Failed to create config directory: ${err}`
-    };
-  }
-  try {
-    const { config: parsedConfig, error } = parseConfig(configPath);
-    if (error) {
-      return {
-        success: false,
-        configPath,
-        error: `Failed to parse config: ${error}`
-      };
-    }
-    const config = parsedConfig ?? {};
-    const plugins = config.plugin ?? [];
-    const filteredPlugins = plugins.filter(
-      (p) => p !== PACKAGE_NAME && !p.startsWith(`${PACKAGE_NAME}@`)
-    );
-    filteredPlugins.push(`${PACKAGE_NAME}@latest`);
-    config.plugin = filteredPlugins;
-    writeConfig(configPath, config);
-    return { success: true, configPath };
-  } catch (err) {
-    return {
-      success: false,
-      configPath,
-      error: `Failed to update opencode config: ${err}`
-    };
-  }
-}
-function writeLiteConfig(installConfig, targetPath) {
-  const configPath = targetPath ?? getLiteConfig();
-  try {
-    ensureConfigDir();
-    const config = generateLiteConfig(installConfig);
-    const tmpPath = `${configPath}.tmp`;
-    const bakPath = `${configPath}.bak`;
-    const content = `${JSON.stringify(config, null, 2)}
-`;
-    if (existsSync2(configPath)) {
-      copyFileSync(configPath, bakPath);
-    }
-    writeFileSync(tmpPath, content);
-    renameSync(tmpPath, configPath);
-    return { success: true, configPath };
-  } catch (err) {
-    return {
-      success: false,
-      configPath,
-      error: `Failed to write lite config: ${err}`
-    };
-  }
-}
-function disableDefaultAgents() {
-  const configPath = getExistingConfigPath();
-  try {
-    ensureOpenCodeConfigDir();
-    const { config: parsedConfig, error } = parseConfig(configPath);
-    if (error) {
-      return {
-        success: false,
-        configPath,
-        error: `Failed to parse config: ${error}`
-      };
-    }
-    const config = parsedConfig ?? {};
-    const agent = config.agent ?? {};
-    agent.explore = { disable: true };
-    agent.general = { disable: true };
-    config.agent = agent;
-    writeConfig(configPath, config);
-    return { success: true, configPath };
-  } catch (err) {
-    return {
-      success: false,
-      configPath,
-      error: `Failed to disable default agents: ${err}`
-    };
-  }
-}
-function detectCurrentConfig() {
-  const result = {
-    isInstalled: false,
-    hasKimi: false,
-    hasOpenAI: false,
-    hasAnthropic: false,
-    hasCopilot: false,
-    hasZaiPlan: false,
-    hasAntigravity: false,
-    hasChutes: false,
-    hasOpencodeZen: false,
-    hasTmux: false
-  };
-  const { config } = parseConfig(getExistingConfigPath());
-  if (!config) return result;
-  const plugins = config.plugin ?? [];
-  result.isInstalled = plugins.some((p) => p.startsWith(PACKAGE_NAME));
-  result.hasAntigravity = plugins.some(
-    (p) => p.startsWith("opencode-antigravity-auth")
-  );
-  const providers = config.provider;
-  result.hasKimi = !!providers?.kimi;
-  result.hasAnthropic = !!providers?.anthropic;
-  result.hasCopilot = !!providers?.["github-copilot"];
-  result.hasZaiPlan = !!providers?.["zai-coding-plan"];
-  result.hasChutes = !!providers?.chutes;
-  if (providers?.google) result.hasAntigravity = true;
-  const { config: liteConfig } = parseConfig(getLiteConfig());
-  if (liteConfig && typeof liteConfig === "object") {
-    const configObj = liteConfig;
-    const presetName = configObj.preset;
-    const presets = configObj.presets;
-    const agents = presets?.[presetName];
-    if (agents) {
-      const models = Object.values(agents).map((a) => a?.model).filter(Boolean);
-      result.hasOpenAI = models.some((m) => m?.startsWith("openai/"));
-      result.hasAnthropic = models.some((m) => m?.startsWith("anthropic/"));
-      result.hasCopilot = models.some((m) => m?.startsWith("github-copilot/"));
-      result.hasZaiPlan = models.some((m) => m?.startsWith("zai-coding-plan/"));
-      result.hasOpencodeZen = models.some((m) => m?.startsWith("opencode/"));
-      if (models.some((m) => m?.startsWith("google/"))) {
-        result.hasAntigravity = true;
-      }
-      if (models.some((m) => m?.startsWith("chutes/"))) {
-        result.hasChutes = true;
-      }
-    }
-    if (configObj.tmux && typeof configObj.tmux === "object") {
-      const tmuxConfig = configObj.tmux;
-      result.hasTmux = tmuxConfig.enabled === true;
-    }
-  }
-  return result;
-}
-
-// src/config/schema.ts
-import { z } from "zod";
-var AGENT_NAMES = [
-  "orchestrator",
-  "oracle",
-  "designer",
-  "explorer",
-  "librarian",
-  "quick",
-  "deep"
-];
-var FALLBACK_AGENT_NAMES = [...AGENT_NAMES];
-var MANUAL_AGENT_NAMES = [...AGENT_NAMES];
-var ProviderModelIdSchema = z.string().regex(
-  /^[^/\s]+\/[^\s]+$/,
-  "Expected provider/model format (provider/.../model)"
-);
-var ManualAgentPlanSchema = z.object({
-  primary: ProviderModelIdSchema,
-  fallback1: ProviderModelIdSchema,
-  fallback2: ProviderModelIdSchema,
-  fallback3: ProviderModelIdSchema
-}).superRefine((value, ctx) => {
-  const unique = /* @__PURE__ */ new Set([
-    value.primary,
-    value.fallback1,
-    value.fallback2,
-    value.fallback3
-  ]);
-  if (unique.size !== 4) {
-    ctx.addIssue({
-      code: z.ZodIssueCode.custom,
-      message: "primary and fallbacks must be unique per agent"
-    });
-  }
-});
-var ManualPlanSchema = z.object({
-  orchestrator: ManualAgentPlanSchema,
-  oracle: ManualAgentPlanSchema,
-  designer: ManualAgentPlanSchema,
-  explorer: ManualAgentPlanSchema,
-  librarian: ManualAgentPlanSchema,
-  quick: ManualAgentPlanSchema,
-  deep: ManualAgentPlanSchema
-}).strict();
-var AgentModelChainSchema = z.array(z.string()).min(1);
-var FallbackChainsSchema = z.object({
-  orchestrator: AgentModelChainSchema.optional(),
-  oracle: AgentModelChainSchema.optional(),
-  designer: AgentModelChainSchema.optional(),
-  explorer: AgentModelChainSchema.optional(),
-  librarian: AgentModelChainSchema.optional(),
-  quick: AgentModelChainSchema.optional(),
-  deep: AgentModelChainSchema.optional()
-}).catchall(AgentModelChainSchema);
-var AgentOverrideConfigSchema = z.object({
-  model: z.union([
-    z.string(),
-    z.array(
-      z.union([
-        z.string(),
-        z.object({
-          id: z.string(),
-          variant: z.string().optional()
-        })
-      ])
-    )
-  ]).optional(),
-  temperature: z.number().min(0).max(2).optional(),
-  steps: z.number().int().min(1).optional(),
-  variant: z.string().optional().catch(void 0)
-});
-var TmuxLayoutSchema = z.enum([
-  "main-horizontal",
-  // Main pane on top, agents stacked below
-  "main-vertical",
-  // Main pane on left, agents stacked on right
-  "tiled",
-  // All panes equal size grid
-  "even-horizontal",
-  // All panes side by side
-  "even-vertical"
-  // All panes stacked vertically
-]);
-var TmuxConfigSchema = z.object({
-  enabled: z.boolean().default(false),
-  layout: TmuxLayoutSchema.default("main-vertical"),
-  main_pane_size: z.number().min(20).max(80).default(60)
-  // percentage for main pane
-});
-var PresetSchema = z.record(z.string(), AgentOverrideConfigSchema);
-var AgentNameSchema = z.enum(AGENT_NAMES);
-var McpNameSchema = z.enum([
-  "exa",
-  "context7",
-  "grep_app",
-  "thoth_mem"
-]);
-var ThothConfigSchema = z.object({
-  command: z.array(z.string()).optional(),
-  data_dir: z.string().optional(),
-  environment: z.record(z.string(), z.string()).optional(),
-  timeout: z.number().optional(),
-  http_port: z.number().optional()
-});
-var ArtifactStoreModeSchema = z.enum([
-  "thoth-mem",
-  "openspec",
-  "hybrid"
-]);
-var ArtifactStoreConfigSchema = z.object({
-  mode: ArtifactStoreModeSchema.default("hybrid")
-});
-var CodexGenerationConfigSchema = z.object({
-  enabled: z.boolean().default(false),
-  outputRoot: z.string().optional(),
-  dryRun: z.boolean().default(true)
-});
-var FailoverConfigSchema = z.object({
-  enabled: z.boolean().default(true),
-  timeoutMs: z.number().min(0).default(15e3),
-  retryDelayMs: z.number().min(0).default(500),
-  chains: FallbackChainsSchema.default({})
-});
-var PluginConfigSchema = z.object({
-  preset: z.string().optional(),
-  setDefaultAgent: z.boolean().optional(),
-  scoringEngineVersion: z.enum(["v1", "v2-shadow", "v2"]).optional(),
-  balanceProviderUsage: z.boolean().optional(),
-  manualPlan: ManualPlanSchema.optional(),
-  presets: z.record(z.string(), PresetSchema).optional(),
-  agents: z.record(z.string(), AgentOverrideConfigSchema).optional(),
-  disabled_mcps: z.array(z.string()).optional(),
-  tmux: TmuxConfigSchema.optional(),
-  fallback: FailoverConfigSchema.optional(),
-  thoth: ThothConfigSchema.optional(),
-  artifactStore: ArtifactStoreConfigSchema.optional(),
-  codex: CodexGenerationConfigSchema.optional()
-});
-
-// src/config/loader.ts
-var PROMPTS_DIR_NAME = "thoth-agents";
-function loadAgentPrompt(agentName, preset) {
-  const presetDirName = preset && /^[a-zA-Z0-9_-]+$/.test(preset) ? preset : void 0;
-  const promptsDir = path.join(getConfigDir(), PROMPTS_DIR_NAME);
-  const promptSearchDirs = presetDirName ? [path.join(promptsDir, presetDirName), promptsDir] : [promptsDir];
-  const result = {};
-  const readFirstPrompt = (fileName, errorPrefix) => {
-    for (const dir of promptSearchDirs) {
-      const promptPath = path.join(dir, fileName);
-      if (!fs.existsSync(promptPath)) {
-        continue;
-      }
-      try {
-        return fs.readFileSync(promptPath, "utf-8");
-      } catch (error) {
-        console.warn(
-          `[thoth-agents] ${errorPrefix} ${promptPath}:`,
-          error instanceof Error ? error.message : String(error)
-        );
-      }
-    }
-    return void 0;
-  };
-  result.prompt = readFirstPrompt(
-    `${agentName}.md`,
-    "Error reading prompt file"
-  );
-  result.appendPrompt = readFirstPrompt(
-    `${agentName}_append.md`,
-    "Error reading append prompt file"
-  );
-  return result;
-}
-
-// src/config/utils.ts
-function getAgentOverride(config, name) {
-  const overrides = config?.agents ?? {};
-  return overrides[name] ?? overrides[Object.keys(AGENT_ALIASES).find((k) => AGENT_ALIASES[k] === name) ?? ""];
-}
-
-// src/mcp/context7.ts
-var CONTEXT7_MCP_URL = "https://mcp.context7.com/mcp";
-var context7 = {
-  type: "remote",
-  url: CONTEXT7_MCP_URL,
-  headers: process.env.CONTEXT7_API_KEY ? { CONTEXT7_API_KEY: process.env.CONTEXT7_API_KEY } : void 0,
-  oauth: false
-};
-
-// src/mcp/exa.ts
-var exa = {
-  type: "local",
-  command: ["npx", "-y", "exa-mcp-server"]
-};
-
-// src/mcp/grep-app.ts
-var GREP_APP_MCP_URL = "https://mcp.grep.app";
-
-// src/harness/core/agent-pack.ts
-var AGENT_ROLES = [
-  {
-    name: "orchestrator",
-    mode: "primary-non-mutating",
-    dispatch: "root-coordinator",
-    canMutateWorkspace: false,
-    scope: "coordination, routing, decisions, progress, and root memory",
-    responsibility: "Delegate-first coordinator for SDD workflow, specialist dispatch, and root-session memory ownership.",
-    toolGovernance: [
-      "delegates inspection, writing, debugging, and verification",
-      "owns question prompts and root-session memory",
-      "does not perform inline workspace implementation"
-    ],
-    verification: [
-      "routes verification to specialists",
-      "summarizes evidence from changed files, diagnostics, and tests"
-    ]
-  },
-  {
-    name: "explorer",
-    mode: "read-only",
-    dispatch: "task",
-    canMutateWorkspace: false,
-    scope: "local repository discovery",
-    responsibility: "Find workspace facts fast and return paths, lines, symbols, constraints, edit targets, and conclusions.",
-    toolGovernance: [
-      "read/search/code-navigation tools only",
-      "no durable memory writes",
-      "no task delegation or progress ownership"
-    ],
-    verification: ["reports confidence, anchors, unchecked areas, and gaps"]
-  },
-  {
-    name: "librarian",
-    mode: "read-only",
-    dispatch: "task",
-    canMutateWorkspace: false,
-    scope: "external research plus local confirmation when needed",
-    responsibility: "Gather authoritative external evidence and distinguish official docs from examples.",
-    toolGovernance: [
-      "research and read-only local confirmation tools",
-      "no workspace mutation",
-      "no durable memory writes"
-    ],
-    verification: ["sources every substantive external claim with a URL"]
-  },
-  {
-    name: "oracle",
-    mode: "read-only",
-    dispatch: "synchronous-task-only",
-    canMutateWorkspace: false,
-    scope: "advice, diagnosis, architecture, code review, and plan review",
-    responsibility: "Provide strategic technical guidance anchored to evidence and review SDD plans.",
-    toolGovernance: [
-      "read-only analysis and review",
-      "no implementation or artifact-producing SDD phases",
-      "no task delegation"
-    ],
-    verification: ["separates observations, risks, and recommendations"]
-  },
-  {
-    name: "designer",
-    mode: "write-capable",
-    dispatch: "synchronous-task-only",
-    canMutateWorkspace: true,
-    scope: "UI/UX decisions, implementation, and visual verification",
-    responsibility: "Own user-facing implementation choices and visual QA for UI work.",
-    toolGovernance: [
-      "may edit focused UI/UX files",
-      "owns screenshots and visual QA",
-      "does not delegate or own SDD progress"
-    ],
-    verification: ["includes visual verification status when applicable"]
-  },
-  {
-    name: "quick",
-    mode: "write-capable",
-    dispatch: "synchronous-task-only",
-    canMutateWorkspace: true,
-    scope: "fast bounded implementation",
-    responsibility: "Implement well-defined narrow or mechanical changes with focused verification.",
-    toolGovernance: [
-      "may edit bounded targets",
-      "does not perform broad rediscovery",
-      "does not delegate or own SDD progress"
-    ],
-    verification: ["runs the smallest sufficient focused check"]
-  },
-  {
-    name: "deep",
-    mode: "write-capable",
-    dispatch: "synchronous-task-only",
-    canMutateWorkspace: true,
-    scope: "thorough implementation and verification",
-    responsibility: "Handle correctness-critical, multi-file, or edge-case-heavy changes with full local context analysis.",
-    toolGovernance: [
-      "may edit implementation and tests",
-      "validates shared behavior against related code and call sites",
-      "does not delegate or own SDD progress"
-    ],
-    verification: ["does not skip verification and reports edge-case evidence"]
-  }
-];
-var DELEGATE_FIRST_RULES = [
-  "The orchestrator coordinates, decides, asks blocking questions, and delegates evidence or action.",
-  "Explorer, librarian, and oracle remain read-only specialists.",
-  "Designer, quick, and deep are write-capable leaf agents with synchronous task dispatch.",
-  "Subagents return findings, diffs, verification, and blockers rather than raw file dumps.",
-  "No leaf agent owns SDD progress checkboxes or orchestrator-only memory."
-];
-var VERIFICATION_PROTOCOL = [
-  "Completion reports include changed files and verification evidence.",
-  "Behavior changes require the smallest sufficient automated check or an explicitly documented check.",
-  "Visual changes require designer-owned visual QA when feasible."
-];
-var AGENT_PACK_CONTRACT = {
-  roles: [...AGENT_ROLES],
-  delegateFirstRules: [...DELEGATE_FIRST_RULES],
-  verificationProtocol: [...VERIFICATION_PROTOCOL]
-};
-function getAgentPackContract() {
-  return {
-    roles: AGENT_PACK_CONTRACT.roles.map((role) => ({
-      ...role,
-      toolGovernance: [...role.toolGovernance],
-      verification: [...role.verification]
-    })),
-    delegateFirstRules: [...AGENT_PACK_CONTRACT.delegateFirstRules],
-    verificationProtocol: [...AGENT_PACK_CONTRACT.verificationProtocol]
-  };
-}
-
-// src/harness/core/memory-governance.ts
-var ROOT_OWNED_TOOLS = [
-  "mem_session_start",
-  "mem_session_summary",
-  "mem_save_prompt"
-];
-var READ_RECALL_CHAIN = [
-  "mem_search",
-  "mem_timeline",
-  "mem_get_observation"
-];
-var WRITE_CAPABLE_DELEGATED_TOOLS = [
-  "mem_save",
-  "mem_search",
-  "mem_get_observation",
-  "mem_timeline",
-  "mem_suggest_topic_key"
-];
-var ALL_MEMORY_TOOLS = [
-  ...ROOT_OWNED_TOOLS,
-  ...READ_RECALL_CHAIN,
-  "mem_suggest_topic_key",
-  "mem_save"
-];
-function uniqueTools(tools) {
-  return [...new Set(tools)];
-}
-function roleAllowedTools(role) {
-  if (role.name === "orchestrator") {
-    return uniqueTools([...ROOT_OWNED_TOOLS, ...WRITE_CAPABLE_DELEGATED_TOOLS]);
-  }
-  if (role.mode === "read-only") {
-    return [...READ_RECALL_CHAIN];
-  }
-  return [...WRITE_CAPABLE_DELEGATED_TOOLS];
-}
-function roleRules(role) {
-  const sharedSubagentRules = [
-    "Every subagent memory call requires the parent session_id and project from dispatch; if either is missing, do not call thoth-mem.",
-    "Never call mem_session_start, mem_session_summary, or mem_save_prompt; those tools are root/orchestrator-owned.",
-    "Protect the sdd/* topic namespace; SDD artifacts may use deterministic sdd/{change}/{artifact} topic keys only in persistence modes that include thoth-mem."
-  ];
-  if (role.name === "orchestrator") {
-    return [
-      "mem_session_start, mem_session_summary, and mem_save_prompt are root/main orchestrator-owned tools and responsibilities.",
-      "In harnesses without an orchestrator-named agent, root/main orchestrator-owned means the initial/root agent when the harness does not expose an orchestrator-named agent.",
-      "Dispatch parent session_id and project when authorizing subagent memory use.",
-      "Protect the sdd/* topic namespace and write SDD memory artifacts only in thoth-mem or hybrid persistence modes."
-    ];
-  }
-  if (role.mode === "read-only") {
-    return [
-      ...sharedSubagentRules,
-      "Read-only agents may only perform bounded, project-scoped recall with mem_search -> mem_timeline -> mem_get_observation when authorized.",
-      "Read-only agents must never write durable memory."
-    ];
-  }
-  return [
-    ...sharedSubagentRules,
-    "Write-capable agents may call mem_save only for delegated durable observations under the parent session/project.",
-    "For reads, use only mem_search -> mem_timeline -> mem_get_observation."
-  ];
-}
-function getRoleMemoryGovernance(role) {
-  const allowedTools = roleAllowedTools(role);
-  return {
-    role: role.name,
-    rootOwnedTools: [...ROOT_OWNED_TOOLS],
-    allowedTools,
-    forbiddenTools: ALL_MEMORY_TOOLS.filter(
-      (tool) => !allowedTools.includes(tool)
-    ),
-    requiresParentContext: role.name !== "orchestrator",
-    mayReadProjectMemory: role.name !== "orchestrator",
-    mayWriteDurableObservations: role.mode === "write-capable",
-    protectsSddNamespace: true,
-    rules: roleRules(role)
-  };
-}
-function renderMemoryGovernanceInstructions(role, dialect) {
-  const governance = getRoleMemoryGovernance(role);
-  const harnessRules = dialect ? [
-    `- Harness wording: use ${dialect.renderRoleInvocation("orchestrator")} as the memory owner and \`${dialect.tools.userQuestionTool}\` for blocking memory-context questions.`,
-    `- Progress ownership remains with the coordinator; report memory-governance verification for tracking in ${dialect.tools.progressTool}.`
-  ] : [];
-  return [
-    "thoth-mem governance:",
-    ...governance.rules.map((rule) => `- ${rule}`),
-    ...harnessRules,
-    `- Runtime enforcement: ${role.name === "orchestrator" ? "root-owned" : "instruction-level unless the target harness validates per-agent memory controls"}.`
-  ].join("\n");
-}
-function memoryGovernanceDiagnostics(input) {
-  const diagnostics = [];
-  if (input.permissionControls !== "supported") {
-    diagnostics.push({
-      severity: "warning",
-      code: `${input.harness}.permission.memory.enforcement_gap`,
-      message: "Runtime controls for root-only memory tools are unavailable; governance is rendered as instruction-level guidance.",
-      harness: input.harness,
-      capability: "rolePermissions",
-      fallback: "instruction-only"
-    });
-  }
-  if (input.parentContextInjection !== "supported") {
-    diagnostics.push({
-      severity: input.parentContextInjection === "unknown" ? "error" : "warning",
-      code: `${input.harness}.context.parent_injection.unvalidated`,
-      message: "Parent session_id/project injection is not runtime-enforced; subagents must be instructed not to use memory without explicit dispatch context.",
-      harness: input.harness,
-      capability: "parentContextInjection",
-      fallback: "instruction-only"
-    });
-  }
-  if (input.memoryWriteControls !== "supported") {
-    diagnostics.push({
-      severity: "warning",
-      code: `${input.harness}.permission.memory_write.enforcement_gap`,
-      message: "Runtime controls for delegated memory writes are unavailable; write-capable agents receive instruction-level mem_save limits only.",
-      harness: input.harness,
-      capability: "memoryGovernanceEnforcement",
-      fallback: "instruction-only"
-    });
-  }
-  return diagnostics;
-}
-
-// src/harness/core/skills.ts
-var ORCHESTRATOR_ONLY = ["orchestrator"];
-var SHARED_SKILL_SUPPORT = {
-  name: "_shared",
-  description: "Shared OpenSpec, persistence, and thoth-mem SDD conventions",
-  allowedRoles: [
-    "orchestrator",
-    "explorer",
-    "librarian",
-    "oracle",
-    "designer",
-    "quick",
-    "deep"
-  ],
-  sourcePath: "src/skills/_shared",
-  kind: "shared-support",
-  purpose: "support"
-};
-var BUNDLED_SKILL_REGISTRY = [
-  {
-    name: "requirements-interview",
-    description: "Mandatory step-0 discovery interview to understand user intent, clarify scope, and choose the right path before implementation",
-    allowedRoles: ORCHESTRATOR_ONLY,
-    sourcePath: "src/skills/requirements-interview",
-    kind: "skill",
-    purpose: "requirements"
-  },
-  {
-    name: "thoth-mem-agents",
-    description: "Orchestrator/subagent thoth-mem workflow contract for parent session_id/project ownership, prompt-save prohibitions, and safe durable memory usage",
-    allowedRoles: [
-      "orchestrator",
-      "explorer",
-      "librarian",
-      "oracle",
-      "designer",
-      "quick",
-      "deep"
-    ],
-    sourcePath: "src/skills/thoth-mem-agents",
-    kind: "skill",
-    purpose: "memory"
-  },
-  {
-    name: "plan-reviewer",
-    description: "Review SDD task plans for execution blockers and valid references",
-    allowedRoles: ["orchestrator", "oracle"],
-    sourcePath: "src/skills/plan-reviewer",
-    kind: "skill",
-    purpose: "review"
-  },
-  {
-    name: "sdd-init",
-    description: "Initialize OpenSpec structure and SDD project context",
-    allowedRoles: ORCHESTRATOR_ONLY,
-    sourcePath: "src/skills/sdd-init",
-    kind: "skill",
-    purpose: "sdd"
-  },
-  {
-    name: "sdd-propose",
-    description: "Create change proposals for OpenSpec workflows",
-    allowedRoles: ORCHESTRATOR_ONLY,
-    sourcePath: "src/skills/sdd-propose",
-    kind: "skill",
-    purpose: "sdd"
-  },
-  {
-    name: "sdd-spec",
-    description: "Write OpenSpec delta specifications",
-    allowedRoles: ORCHESTRATOR_ONLY,
-    sourcePath: "src/skills/sdd-spec",
-    kind: "skill",
-    purpose: "sdd"
-  },
-  {
-    name: "sdd-design",
-    description: "Create technical solution design artifacts for changes",
-    allowedRoles: ORCHESTRATOR_ONLY,
-    sourcePath: "src/skills/sdd-design",
-    kind: "skill",
-    purpose: "sdd"
-  },
-  {
-    name: "sdd-tasks",
-    description: "Generate phased implementation task checklists",
-    allowedRoles: ORCHESTRATOR_ONLY,
-    sourcePath: "src/skills/sdd-tasks",
-    kind: "skill",
-    purpose: "sdd"
-  },
-  {
-    name: "sdd-apply",
-    description: "Execute tasks and persist implementation progress",
-    allowedRoles: ORCHESTRATOR_ONLY,
-    sourcePath: "src/skills/sdd-apply",
-    kind: "skill",
-    purpose: "sdd"
-  },
-  {
-    name: "executing-plans",
-    description: "Execute SDD task lists with real-time progress tracking, sub-agent dispatch, and verification checkpoints",
-    allowedRoles: ORCHESTRATOR_ONLY,
-    sourcePath: "src/skills/executing-plans",
-    kind: "skill",
-    purpose: "sdd"
-  },
-  {
-    name: "sdd-verify",
-    description: "Build verification reports and compliance matrices",
-    allowedRoles: ORCHESTRATOR_ONLY,
-    sourcePath: "src/skills/sdd-verify",
-    kind: "skill",
-    purpose: "sdd"
-  },
-  {
-    name: "sdd-archive",
-    description: "Archive completed OpenSpec changes with audit trails",
-    allowedRoles: ORCHESTRATOR_ONLY,
-    sourcePath: "src/skills/sdd-archive",
-    kind: "skill",
-    purpose: "sdd"
-  }
-];
-var SKILL_REGISTRY = [
-  ...BUNDLED_SKILL_REGISTRY,
-  SHARED_SKILL_SUPPORT
-];
-function getSkillRegistry() {
-  return SKILL_REGISTRY.map((entry) => ({
-    ...entry,
-    allowedRoles: [...entry.allowedRoles]
-  }));
-}
-
-// src/harness/writers/codex-plugin-package.ts
-import { createHash } from "crypto";
-
-// src/harness/adapters/codex-surfaces.ts
-var CODEX_HOOK_EVENTS = [
-  "SessionStart",
-  "UserPromptSubmit",
-  "PreToolUse",
-  "PermissionRequest",
-  "PostToolUse",
-  "Stop"
-];
-var SUPPORTED_CODEX_HOOK_OUTPUT_FIELDS = ["message"];
-var CODEX_PLUGIN_MANIFEST_FIELDS = [
-  "name",
-  "version",
-  "description",
-  "skills",
-  "mcpServers",
-  "apps",
-  "hooks",
-  "interface"
-];
-var CODEX_SURFACES = [
-  {
-    id: "project-agent-toml",
-    target: "agent-definition",
-    status: "validated",
-    artifactKind: "agent-config",
-    path: ".codex/agents/{name}.toml",
-    fields: [
-      "name",
-      "description",
-      "developer_instructions",
-      "model",
-      "model_reasoning_effort",
-      "sandbox_mode"
-    ],
-    diagnosticCode: "codex.surface.agent_definition.validated",
-    summary: "Project-scoped custom agents are standalone TOML files.",
-    evidence: "OpenAI Codex Subagents docs: ~/.codex/agents/ and .codex/agents/ with required name, description, developer_instructions."
-  },
-  {
-    id: "project-config-toml",
-    target: "config",
-    status: "validated",
-    artifactKind: "harness-config",
-    path: ".codex/config.toml",
-    fields: [
-      "model",
-      "model_reasoning_effort",
-      "approval_policy",
-      "sandbox_mode",
-      "features",
-      "mcp_servers",
-      "skills.config",
-      "agents"
-    ],
-    diagnosticCode: "codex.surface.config.validated",
-    summary: "Codex supports project-scoped config TOML after trust.",
-    evidence: "OpenAI Codex Configuration Reference: ~/.codex/config.toml and project .codex/config.toml overrides."
-  },
-  {
-    id: "mcp-server-config",
-    target: "mcp-config",
-    status: "validated",
-    artifactKind: "mcp-config",
-    path: ".codex/config.toml",
-    fields: ["mcp_servers.<id>", "url", "command", "args", "env", "tools"],
-    diagnosticCode: "codex.surface.mcp.validated",
-    summary: "MCP servers are configured through Codex config TOML.",
-    evidence: "OpenAI Codex config docs describe mcp_servers and per-tool approval overrides."
-  },
-  {
-    id: "repo-skills-directory",
-    target: "skill-directory",
-    status: "validated",
-    artifactKind: "skill",
-    path: ".agents/skills/{skill}/SKILL.md",
-    fields: ["SKILL.md", "scripts/", "references/", "assets/"],
-    diagnosticCode: "codex.surface.skills.validated",
-    summary: "Repository skills are discovered from .agents/skills.",
-    evidence: "OpenAI Codex Skills docs: repo skills are scanned from .agents/skills up to the repository root."
-  },
-  {
-    id: "project-hooks-json",
-    target: "hook-config",
-    status: "validated",
-    artifactKind: "hook-config",
-    path: ".codex/hooks.json",
-    fields: [
-      "SessionStart.command",
-      "UserPromptSubmit.command",
-      "PreToolUse.command",
-      "PermissionRequest.command",
-      "PostToolUse.command",
-      "Stop.command"
-    ],
-    diagnosticCode: "codex.surface.hooks_json.validated",
-    summary: "Codex supports project-local hooks.json command handlers.",
-    evidence: "OpenAI Codex hooks docs describe hooks.json with SessionStart, UserPromptSubmit, PreToolUse, PermissionRequest, PostToolUse, and Stop command handlers."
-  },
-  {
-    id: "inline-hooks-table",
-    target: "hook-config",
-    status: "validated",
-    artifactKind: "hook-config",
-    path: ".codex/config.toml",
-    fields: [
-      "hooks.SessionStart.command",
-      "hooks.UserPromptSubmit.command",
-      "hooks.PreToolUse.command",
-      "hooks.PermissionRequest.command",
-      "hooks.PostToolUse.command",
-      "hooks.Stop.command"
-    ],
-    diagnosticCode: "codex.surface.inline_hooks.validated",
-    summary: "Codex supports inline [hooks] configuration in TOML.",
-    evidence: "OpenAI Codex configuration docs describe inline [hooks] settings gated by trusted project configuration."
-  },
-  {
-    id: "features-hooks-toggle",
-    target: "hook-config",
-    status: "validated",
-    artifactKind: "hook-config",
-    path: ".codex/config.toml",
-    fields: ["features.hooks"],
-    diagnosticCode: "codex.surface.features_hooks.validated",
-    summary: "Codex hook loading is controlled by the features.hooks toggle.",
-    evidence: "OpenAI Codex configuration docs require enabling [features].hooks before project hook configuration is active."
-  },
-  {
-    id: "plugin-hooks-bundle",
-    target: "hook-config",
-    status: "validated",
-    artifactKind: "hook-config",
-    path: ".codex/plugins/{plugin}/hooks.json",
-    fields: ["features.plugin_hooks", "plugin.hooks", "plugin.trust_review"],
-    diagnosticCode: "codex.surface.plugin_hooks.validated",
-    summary: "Codex plugin hook bundles are documented behind plugin hook feature and trust review gates.",
-    evidence: "OpenAI Codex plugin docs describe bundled hook configuration requiring plugin_hooks enablement and trust review."
-  },
-  {
-    id: "plugin-manifest-json",
-    target: "plugin-manifest",
-    status: "validated",
-    artifactKind: "manifest",
-    path: ".codex-plugin/plugin.json",
-    fields: [...CODEX_PLUGIN_MANIFEST_FIELDS],
-    diagnosticCode: "codex.surface.plugin_manifest.validated",
-    summary: "Codex plugin packages are described by a plugin-root plugin.json manifest.",
-    evidence: "OpenAI Codex plugin docs describe plugin.json with official fields including name, version, description, skills, mcpServers, apps, hooks, and interface."
-  },
-  {
-    id: "plugin-skills-directory",
-    target: "skill-directory",
-    status: "validated",
-    artifactKind: "skill",
-    path: ".codex-plugin/skills/{skill}/SKILL.md",
-    fields: ["skills", "./skills/"],
-    diagnosticCode: "codex.surface.plugin_skills.validated",
-    summary: "Codex plugin packages can bundle skills under plugin-root skills/.",
-    evidence: "OpenAI Codex plugin docs describe plugin-bundled skills referenced from plugin.json using plugin-root relative paths."
-  },
-  {
-    id: "plugin-hooks-json",
-    target: "hook-config",
-    status: "validated",
-    artifactKind: "hook-config",
-    path: ".codex-plugin/hooks/hooks.json",
-    fields: ["hooks", "./hooks/hooks.json"],
-    diagnosticCode: "codex.surface.plugin_hooks_json.validated",
-    summary: "Codex plugin packages can bundle hook configuration under plugin-root hooks/.",
-    evidence: "OpenAI Codex plugin docs describe hook bundle assets referenced from plugin.json and gated by plugin_hooks plus trust review."
-  },
-  {
-    id: "plugin-mcp-json",
-    target: "mcp-config",
-    status: "validated",
-    artifactKind: "mcp-config",
-    path: ".codex-plugin/.mcp.json",
-    fields: ["mcpServers", "./.mcp.json"],
-    diagnosticCode: "codex.surface.plugin_mcp_json.validated",
-    summary: "Codex plugin packages can bundle MCP server definitions in plugin-root .mcp.json.",
-    evidence: "OpenAI Codex plugin docs describe bundled .mcp.json server definitions referenced from plugin.json using plugin-root relative paths."
-  },
-  {
-    id: "inline-hooks",
-    target: "hook-config",
-    status: "unknown",
-    artifactKind: "hook-config",
-    fields: ["features.hooks", "hooks"],
-    diagnosticCode: "codex.surface.hooks.unvalidated",
-    summary: "Lifecycle hook availability is documented, but hook event shape and parity with OpenCode runtime hooks is not validated for this adapter.",
-    evidence: "Codex config reference mentions hooks; this implementation has not validated exact event schemas for plugin parity.",
-    fallback: "diagnostic-only"
-  },
-  {
-    id: "per-agent-runtime-permissions",
-    target: "permission-control",
-    status: "unsupported",
-    fields: ["per-agent tool allow/deny equivalent to OpenCode permissions"],
-    diagnosticCode: "codex.permission.memory.enforcement_gap",
-    summary: "Codex sandbox and approval policy can constrain sessions, but OpenCode-style per-agent MCP/tool deny maps are not validated.",
-    evidence: "Codex approvals/security docs cover sandbox and approval policies, not exact OpenCode per-agent permission maps.",
-    fallback: "instruction-only"
-  },
-  {
-    id: "programmatic-delegation-runtime",
-    target: "delegation-runtime",
-    status: "unsupported",
-    fields: [
-      "task API",
-      "background task sessions",
-      "tmux lifecycle hooks",
-      "automatic subagent session close"
-    ],
-    diagnosticCode: "codex.delegation.runtime.unsupported",
-    summary: "Codex subagents are user/instruction-triggered; no OpenCode plugin task API or automatic subagent session close parity is validated.",
-    evidence: "Codex subagents docs describe manual spawning and agent threads, not this plugin runtime task API or a validated runtime close hook.",
-    fallback: "instruction-only"
-  },
-  {
-    id: "parent-context-injection",
-    target: "parent-context-injection",
-    status: "unknown",
-    fields: ["parent session_id", "project"],
-    diagnosticCode: "codex.context.parent_injection.unvalidated",
-    summary: "No machine-enforced parent context injection mechanism is validated; prompts must instruct users to include parent session_id/project.",
-    evidence: "No validated Codex surface in Phase 1 proves automatic parent context injection into spawned agents.",
-    fallback: "instruction-only"
-  }
-];
-function getCodexSurfaceRecords() {
-  return CODEX_SURFACES.map((surface) => ({
-    ...surface,
-    fields: [...surface.fields]
-  }));
-}
-function getCodexSurface(id) {
-  return getCodexSurfaceRecords().find((surface) => surface.id === id);
-}
-function assertCodexSurfaceCanGenerate(id) {
-  const surface = getCodexSurface(id);
-  if (!surface) {
-    return {
-      ok: false,
-      diagnostic: {
-        severity: "error",
-        code: "harness.surface_unvalidated",
-        message: `Codex surface "${id}" is not registered and cannot generate artifacts.`,
-        harness: "codex",
-        surface: id,
-        fallback: "diagnostic-only"
-      }
-    };
-  }
-  if (surface.status !== "validated" || !surface.artifactKind) {
-    return {
-      ok: false,
-      diagnostic: codexSurfaceDiagnostic(surface)
-    };
-  }
-  return { ok: true, surface };
-}
-function codexSurfaceDiagnostic(surface) {
-  const severity = surface.status === "unsupported" ? "warning" : "error";
-  return {
-    severity,
-    code: surface.diagnosticCode,
-    message: `${surface.summary} Artifact generation is disabled for this surface.`,
-    harness: "codex",
-    surface: surface.id,
-    fallback: surface.fallback ?? "diagnostic-only"
-  };
-}
-function normalizeCodexPath(value) {
-  return value.replace(/\\/g, "/");
-}
-function codexPluginPackageDiagnostic(code, message, surface) {
-  return {
-    severity: "error",
-    code,
-    message,
-    harness: "codex",
-    surface,
-    fallback: "diagnostic-only"
-  };
-}
-function isPathUnderCodexPlugin(pathValue) {
-  const normalized = normalizeCodexPath(pathValue);
-  const segments = normalized.split("/");
-  return !normalized.startsWith("/") && !/^[A-Za-z]:\//.test(normalized) && !segments.includes("..") && (normalized === ".codex-plugin" || normalized === ".codex-plugin/" || normalized.startsWith(".codex-plugin/"));
-}
-function fieldAllowedForPluginSurface(surface, field) {
-  if (surface.id === "plugin-manifest-json") {
-    return CODEX_PLUGIN_MANIFEST_FIELDS.includes(
-      field
-    );
-  }
-  return surface.fields.includes(field);
-}
-function validateCodexPluginPackageSurface(input) {
-  const canGenerate = assertCodexSurfaceCanGenerate(input.surfaceId);
-  if (!canGenerate.ok) {
-    return {
-      ok: false,
-      diagnostics: [
-        {
-          ...canGenerate.diagnostic,
-          code: "codex.plugin.surface.unvalidated",
-          message: `Codex plugin package surface "${input.surfaceId}" is not validated for .codex-plugin artifacts.`
-        }
-      ]
-    };
-  }
-  const diagnostics = [];
-  const surface = canGenerate.surface;
-  if (!surface.path?.startsWith(".codex-plugin")) {
-    diagnostics.push(
-      codexPluginPackageDiagnostic(
-        "codex.plugin.surface.unvalidated",
-        `Codex surface "${input.surfaceId}" is validated, but not as a .codex-plugin package surface.`,
-        input.surfaceId
-      )
-    );
-  }
-  if (input.path && !isPathUnderCodexPlugin(input.path)) {
-    diagnostics.push(
-      codexPluginPackageDiagnostic(
-        "codex.plugin.path.unvalidated",
-        `Codex plugin package path "${input.path}" must stay under .codex-plugin/.`,
-        input.surfaceId
-      )
-    );
-  }
-  for (const field of input.fields ?? []) {
-    if (!fieldAllowedForPluginSurface(surface, field)) {
-      diagnostics.push(
-        codexPluginPackageDiagnostic(
-          "codex.plugin.field.unvalidated",
-          `Codex plugin field "${field}" is not validated for surface "${input.surfaceId}".`,
-          input.surfaceId
-        )
-      );
-    }
-  }
-  if (diagnostics.length > 0) return { ok: false, diagnostics };
-  return { ok: true, surface };
-}
-function isCodexHookEvent(event) {
-  return CODEX_HOOK_EVENTS.includes(event);
-}
-function codexHookDiagnostic(code, message) {
-  return {
-    severity: "warning",
-    code,
-    message,
-    harness: "codex",
-    surface: "hook-config",
-    fallback: "diagnostic-only"
-  };
-}
-function inferHookHandlerType(handler) {
-  if (!handler) return void 0;
-  if (typeof handler.type === "string") return handler.type;
-  if ("command" in handler) return "command";
-  if ("prompt" in handler) return "prompt";
-  if ("agent" in handler) return "agent";
-  return void 0;
-}
-function validateCodexHookSurface(input) {
-  const diagnostics = [];
-  const handlerType = inferHookHandlerType(input.handler);
-  if (!isCodexHookEvent(input.event)) {
-    diagnostics.push(
-      codexHookDiagnostic(
-        "codex.hooks.event.unsupported",
-        `Codex hook event "${input.event}" is not documented for this adapter.`
-      )
-    );
-  }
-  if (handlerType !== "command") {
-    diagnostics.push(
-      codexHookDiagnostic(
-        handlerType === "prompt" ? "codex.hooks.handler.prompt_unsupported" : handlerType === "agent" ? "codex.hooks.handler.agent_unsupported" : "codex.hooks.handler.unsupported",
-        `Codex hook handler "${handlerType ?? "unknown"}" is not supported; only command handlers are validated.`
-      )
-    );
-  }
-  if (input.handler?.async === true) {
-    diagnostics.push(
-      codexHookDiagnostic(
-        "codex.hooks.async.unsupported",
-        "Async Codex hook execution is not validated for this adapter."
-      )
-    );
-  }
-  const unsupportedOutputField = input.outputFields?.find(
-    (field) => !SUPPORTED_CODEX_HOOK_OUTPUT_FIELDS.includes(field)
-  );
-  if (unsupportedOutputField) {
-    diagnostics.push(
-      codexHookDiagnostic(
-        "codex.hooks.output_field.unsupported",
-        `Codex hook output field "${unsupportedOutputField}" is not supported by the validated hook surface.`
-      )
-    );
-  }
-  if (input.interceptsToolExecution) {
-    diagnostics.push(
-      codexHookDiagnostic(
-        "codex.hooks.tool_interception.unsupported",
-        "Full tool interception is not supported; Codex hooks are diagnostic/config surfaces, not OpenCode runtime enforcement hooks."
-      )
-    );
-  }
-  if (diagnostics.length > 0 || !isCodexHookEvent(input.event)) {
-    return { ok: false, diagnostics };
-  }
-  return { ok: true, event: input.event, handlerType: "command" };
-}
-
-// src/harness/writers/codex-plugin-package.ts
-var PLUGIN_MANIFEST_SURFACE_ID = "plugin-manifest-json";
-function normalizePath(value) {
-  return value.replace(/\\/g, "/");
-}
-function pluginRootReference(pathValue) {
-  const normalized = normalizePath(pathValue);
-  const relative4 = normalized.slice(".codex-plugin/".length);
-  return `./${relative4}`;
-}
-function sha256(content) {
-  return `sha256:${createHash("sha256").update(content).digest("hex")}`;
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function stableValue(value) {
-  if (Array.isArray(value)) return value.map(stableValue);
-  if (!isRecord(value)) return value;
-  return Object.fromEntries(
-    Object.keys(value).sort((left, right) => left.localeCompare(right)).map((key) => [key, stableValue(value[key])])
-  );
-}
-function stableJson(value) {
-  return `${JSON.stringify(value, null, 2)}
-`;
-}
-function orderManifestFields(manifest) {
-  const ordered = {};
-  for (const field of CODEX_PLUGIN_MANIFEST_FIELDS) {
-    if (field in manifest) ordered[field] = manifest[field];
-  }
-  return ordered;
-}
-function fieldDiagnostic(field) {
-  return {
-    severity: "error",
-    code: "codex.plugin.field.unvalidated",
-    message: `Skipping unvalidated Codex plugin manifest field "${field}".`,
-    harness: "codex",
-    surface: PLUGIN_MANIFEST_SURFACE_ID,
-    fallback: "diagnostic-only"
-  };
-}
-function artifactKindForSurface(surfaceId) {
-  if (surfaceId === "plugin-mcp-json") return "mcp-config";
-  return surfaceId === "plugin-hooks-json" ? "hook-config" : "skill";
-}
-function codexHookPackageDiagnostic(code, message) {
-  return {
-    severity: "warning",
-    code,
-    message,
-    harness: "codex",
-    surface: "plugin-hooks-json",
-    fallback: "diagnostic-only"
-  };
-}
-function normalizeHookDefinition(hook) {
-  return {
-    command: hook.handler.command,
-    ...hook.outputFields?.length ? { output: [...hook.outputFields].sort() } : {}
-  };
-}
-function renderHookDefinitions(hookDefinitions) {
-  const diagnostics = [];
-  const hooksByEvent = /* @__PURE__ */ new Map();
-  for (const hook of hookDefinitions) {
-    const validation = validateCodexHookSurface(hook);
-    if (!validation.ok) {
-      diagnostics.push(...validation.diagnostics);
-      continue;
-    }
-    const eventHooks = hooksByEvent.get(validation.event) ?? [];
-    eventHooks.push(normalizeHookDefinition(hook));
-    hooksByEvent.set(validation.event, eventHooks);
-  }
-  if (hooksByEvent.size === 0) {
-    diagnostics.push(
-      codexHookPackageDiagnostic(
-        "codex.plugin.hooks.none_packaged",
-        "No Codex plugin hooks were packaged because no hook definitions passed existing Codex hook validation."
-      )
-    );
-    return { diagnostics };
-  }
-  const content = stableJson(
-    Object.fromEntries(
-      [...hooksByEvent.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([event, hooks]) => [event, hooks.map(stableValue)])
-    )
-  );
-  return { content, diagnostics };
-}
-function parseRawHookContent(content) {
-  const diagnostics = [];
-  const hookDefinitions = [];
-  let parsed;
-  try {
-    parsed = JSON.parse(content);
-  } catch {
-    return {
-      hookDefinitions,
-      diagnostics: [
-        codexHookPackageDiagnostic(
-          "codex.plugin.hooks.invalid_json",
-          "Skipping Codex plugin hooks asset because hooks.json content is not valid JSON."
-        )
-      ]
-    };
-  }
-  if (!isRecord(parsed)) {
-    return {
-      hookDefinitions,
-      diagnostics: [
-        codexHookPackageDiagnostic(
-          "codex.plugin.hooks.invalid_shape",
-          "Skipping Codex plugin hooks asset because hooks.json must be an object keyed by Codex hook event."
-        )
-      ]
-    };
-  }
-  for (const [event, definitions] of Object.entries(parsed)) {
-    if (!Array.isArray(definitions)) {
-      diagnostics.push(
-        codexHookPackageDiagnostic(
-          "codex.plugin.hooks.invalid_shape",
-          `Skipping Codex plugin hook event "${event}" because its value is not an array of command handlers.`
-        )
-      );
-      continue;
-    }
-    for (const definition of definitions) {
-      if (!isRecord(definition)) {
-        diagnostics.push(
-          codexHookPackageDiagnostic(
-            "codex.plugin.hooks.invalid_shape",
-            `Skipping Codex plugin hook event "${event}" entry because it is not an object.`
-          )
-        );
-        continue;
-      }
-      const output = definition.output;
-      hookDefinitions.push({
-        event,
-        handler: {
-          type: typeof definition.type === "string" ? definition.type : "command",
-          command: definition.command,
-          async: definition.async
-        },
-        outputFields: Array.isArray(output) ? output.filter((field) => typeof field === "string") : void 0,
-        interceptsToolExecution: definition.interceptsToolExecution === true
-      });
-    }
-  }
-  return { hookDefinitions, diagnostics };
-}
-function resolveHookAssetContent(asset) {
-  if (asset.surfaceId !== "plugin-hooks-json") {
-    return { content: asset.content, diagnostics: [] };
-  }
-  const fromInput = asset.hookDefinitions ? { hookDefinitions: [...asset.hookDefinitions], diagnostics: [] } : asset.content !== void 0 ? parseRawHookContent(asset.content) : { hookDefinitions: [], diagnostics: [] };
-  const rendered = renderHookDefinitions(fromInput.hookDefinitions);
-  return {
-    content: rendered.content,
-    diagnostics: [...fromInput.diagnostics, ...rendered.diagnostics]
-  };
-}
-function renderCodexPluginPackage(input) {
-  const artifacts = [];
-  const diagnostics = [];
-  const manifest = {};
-  const provenance = [];
-  for (const field of Object.keys(input.manifest)) {
-    if (!CODEX_PLUGIN_MANIFEST_FIELDS.includes(
-      field
-    )) {
-      diagnostics.push(fieldDiagnostic(field));
-    }
-  }
-  const manifestValidation = validateCodexPluginPackageSurface({
-    surfaceId: PLUGIN_MANIFEST_SURFACE_ID,
-    path: ".codex-plugin/plugin.json",
-    fields: Object.keys(input.manifest).filter(
-      (field) => CODEX_PLUGIN_MANIFEST_FIELDS.includes(
-        field
-      )
-    )
-  });
-  if (!manifestValidation.ok)
-    diagnostics.push(...manifestValidation.diagnostics);
-  for (const field of CODEX_PLUGIN_MANIFEST_FIELDS) {
-    if (field in input.manifest)
-      manifest[field] = stableValue(input.manifest[field]);
-  }
-  for (const asset of [...input.assets ?? []].sort(
-    (left, right) => normalizePath(left.path).localeCompare(normalizePath(right.path))
-  )) {
-    const assetPath = normalizePath(asset.path);
-    const validation = validateCodexPluginPackageSurface({
-      surfaceId: asset.surfaceId,
-      path: assetPath,
-      fields: [asset.manifestField]
-    });
-    if (!validation.ok) {
-      diagnostics.push(...validation.diagnostics);
-      continue;
-    }
-    const hookContent = resolveHookAssetContent(asset);
-    diagnostics.push(...hookContent.diagnostics);
-    if (asset.surfaceId === "plugin-hooks-json" && !hookContent.content) {
-      continue;
-    }
-    const assetContent = hookContent.content ?? asset.content;
-    const reference = pluginRootReference(assetPath);
-    manifest[asset.manifestField] = reference;
-    if (assetContent !== void 0 && !assetPath.endsWith("/")) {
-      artifacts.push({
-        harness: "codex",
-        kind: artifactKindForSurface(asset.surfaceId),
-        path: assetPath,
-        description: asset.description ?? `Codex plugin asset for ${asset.manifestField}`,
-        content: assetContent
-      });
-    }
-    provenance.push({
-      field: asset.manifestField,
-      path: assetPath,
-      reference,
-      ...asset.provenanceName ? { name: asset.provenanceName } : {},
-      ...asset.sourcePath ? { sourcePath: normalizePath(asset.sourcePath) } : {},
-      ...assetContent !== void 0 ? { sha256: sha256(assetContent) } : {}
-    });
-  }
-  artifacts.push({
-    harness: "codex",
-    kind: "manifest",
-    path: ".codex-plugin/plugin.json",
-    description: "Deterministic Codex plugin package manifest.",
-    content: stableJson(orderManifestFields(manifest))
-  });
-  artifacts.push({
-    harness: "codex",
-    kind: "manifest",
-    path: ".codex-plugin/.thoth-agents-plugin-assets.json",
-    description: "Deterministic Codex plugin package asset provenance.",
-    content: stableJson({
-      generatedBy: "thoth-agents",
-      assets: provenance.sort(
-        (left, right) => left.path.localeCompare(right.path)
-      )
-    })
-  });
-  return { artifacts, diagnostics };
-}
-
-// src/harness/writers/codex-toml.ts
-function escapeTomlString(value) {
-  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\t/g, "\\t").replace(/\n/g, "\\n").replace(/\f/g, "\\f").replace(/\r/g, "\\r");
-}
-function escapeTomlMultilineString(value) {
-  return value.replace(/\\/g, "\\\\").replace(/"""/g, '\\"\\"\\"').replace(/\r\n/g, "\n").replace(/\r/g, "\n");
-}
-function renderScalar(value) {
-  if (typeof value === "string") return `"${escapeTomlString(value)}"`;
-  if (typeof value === "number" || typeof value === "boolean") {
-    return String(value);
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map(renderScalar).join(", ")}]`;
-  }
-  throw new Error(`Unsupported TOML scalar: ${String(value)}`);
-}
-function renderField(key, value) {
-  if (key === "developer_instructions" && typeof value === "string") {
-    return [`${key} = """`, escapeTomlMultilineString(value), '"""', ""];
-  }
-  return [`${key} = ${renderScalar(value)}`];
-}
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function fieldOrder(fields, keys) {
-  const orderedRoots = fields.map((field) => field.split(".")[0]);
-  return [...keys].sort((left, right) => {
-    const leftIndex = orderedRoots.indexOf(left);
-    const rightIndex = orderedRoots.indexOf(right);
-    if (leftIndex !== -1 || rightIndex !== -1) {
-      return (leftIndex === -1 ? Number.MAX_SAFE_INTEGER : leftIndex) - (rightIndex === -1 ? Number.MAX_SAFE_INTEGER : rightIndex);
-    }
-    return left.localeCompare(right);
-  });
-}
-function isAllowedRoot(fields, key) {
-  return fields.some(
-    (field) => field === key || field.startsWith(`${key}.`) || field.includes("<id>") && key === field.split(".")[0]
-  );
-}
-function renderTable(lines, tablePath, value) {
-  lines.push(`[${tablePath.join(".")}]`);
-  const nested = [];
-  for (const key of Object.keys(value).sort()) {
-    const entry = value[key];
-    if (isRecord2(entry)) {
-      nested.push([key, entry]);
-    } else {
-      lines.push(...renderField(key, entry));
-    }
-  }
-  lines.push("");
-  for (const [key, entry] of nested) {
-    renderTable(lines, [...tablePath, key], entry);
-  }
-}
-function renderCodexToml(input) {
-  const canGenerate = assertCodexSurfaceCanGenerate(input.surfaceId);
-  if (!canGenerate.ok) {
-    return { content: "", diagnostics: [canGenerate.diagnostic] };
-  }
-  const surface = getCodexSurface(input.surfaceId);
-  const fields = surface?.fields ?? [];
-  const diagnostics = [];
-  const lines = [];
-  const tables = [];
-  for (const key of fieldOrder(fields, Object.keys(input.values))) {
-    const value = input.values[key];
-    if (!isAllowedRoot(fields, key)) {
-      diagnostics.push({
-        severity: "warning",
-        code: "codex.toml.field.unvalidated",
-        message: `Skipping unvalidated Codex TOML field "${key}" for surface "${input.surfaceId}".`,
-        harness: "codex",
-        surface: input.surfaceId,
-        fallback: "diagnostic-only"
-      });
-      continue;
-    }
-    if (isRecord2(value)) {
-      tables.push([key, value]);
-    } else {
-      lines.push(...renderField(key, value));
-    }
-  }
-  if (tables.length > 0 && lines.length > 0) lines.push("");
-  for (const [key, value] of tables) {
-    renderTable(lines, [key], value);
-  }
-  while (lines.at(-1) === "") lines.pop();
-  return {
-    content: lines.join("\n") + (lines.length > 0 ? "\n" : ""),
-    diagnostics
-  };
-}
-
-// src/harness/writers/skill-layout.ts
-import { createHash as createHash2 } from "crypto";
-import * as fs2 from "fs";
-import * as path2 from "path";
-var OUTPUT_MODE_CONFIG = {
-  "plugin-package": {
-    basePath: ".codex-plugin/skills",
-    manifestPath: ".codex-plugin/skills/.thoth-agents-manifest.json",
-    surfaceId: "plugin-skills-directory",
-    label: "plugin-bundled"
-  },
-  "repo-local-fallback": {
-    basePath: ".agents/skills",
-    manifestPath: ".agents/skills/.thoth-agents-manifest.json",
-    surfaceId: "repo-skills-directory",
-    label: "fallback .agents/skills"
-  }
-};
-function normalizePath2(value) {
-  return value.split(path2.sep).join("/");
-}
-function collectFiles(directory) {
-  if (!fs2.existsSync(directory)) return [];
-  const entries = fs2.readdirSync(directory, { withFileTypes: true });
-  const files = [];
-  for (const entry of entries) {
-    const entryPath = path2.join(directory, entry.name);
-    if (entry.isDirectory()) {
-      files.push(...collectFiles(entryPath));
-    } else if (entry.isFile()) {
-      files.push(entryPath);
-    }
-  }
-  return files.sort((left, right) => left.localeCompare(right));
-}
-function sha2562(content) {
-  return `sha256:${createHash2("sha256").update(content).digest("hex")}`;
-}
-function resolveOutputModes(input) {
-  const requested = input.outputModes ?? (input.outputMode ? [input.outputMode] : []);
-  const modes = requested.length > 0 ? requested : ["plugin-package"];
-  return [...new Set(modes)];
-}
-function duplicateScopeDiagnostic(skillNames, surfaceId) {
-  if (skillNames.length === 0) return void 0;
-  return {
-    severity: "warning",
-    code: "codex.skill.duplicate_scope_precedence_unverified",
-    message: `Codex skills are selected for both plugin-bundled and fallback .agents/skills scopes: ${skillNames.join(", ")}. Plugin-bundled skills are the intended primary package content, but runtime precedence with fallback scopes is unresolved and must be validated before relying on ordering.`,
-    harness: "codex",
-    surface: surfaceId,
-    fallback: "diagnostic-only"
-  };
-}
-function renderCodexSkillLayout(input) {
-  const surface = assertCodexSurfaceCanGenerate(input.surfaceId);
-  if (!surface.ok) {
-    return { artifacts: [], diagnostics: [surface.diagnostic] };
-  }
-  const artifacts = [];
-  const diagnostics = [];
-  const outputModes = resolveOutputModes(input);
-  for (const mode of outputModes) {
-    const modeSurface = assertCodexSurfaceCanGenerate(
-      OUTPUT_MODE_CONFIG[mode].surfaceId
-    );
-    if (!modeSurface.ok) diagnostics.push(modeSurface.diagnostic);
-  }
-  const duplicateDiagnostic = duplicateScopeDiagnostic(
-    outputModes.length > 1 ? input.skills.map((skill) => skill.name).sort() : [],
-    input.surfaceId
-  );
-  if (duplicateDiagnostic) diagnostics.push(duplicateDiagnostic);
-  const manifests = new Map(
-    outputModes.map((mode) => [mode, []])
-  );
-  for (const skill of [...input.skills].sort(
-    (left, right) => left.name.localeCompare(right.name)
-  )) {
-    const sourceBaseRoot = input.packageRoot ?? input.projectRoot;
-    const sourceRoot = path2.join(sourceBaseRoot, skill.sourcePath);
-    const files = collectFiles(sourceRoot);
-    if (files.length === 0) {
-      diagnostics.push({
-        severity: "warning",
-        code: "codex.skill.source_missing",
-        message: `Skipping Codex skill "${skill.name}" because source path "${skill.sourcePath}" was not found.`,
-        harness: "codex",
-        surface: input.surfaceId,
-        fallback: "diagnostic-only"
-      });
-      continue;
-    }
-    for (const file of files) {
-      const relative4 = normalizePath2(path2.relative(sourceRoot, file));
-      const content = fs2.readFileSync(file, "utf8");
-      const sourcePath = normalizePath2(path2.relative(sourceBaseRoot, file));
-      for (const mode of outputModes) {
-        const config = OUTPUT_MODE_CONFIG[mode];
-        const outputPath = `${config.basePath}/${skill.name}/${relative4}`;
-        artifacts.push({
-          harness: "codex",
-          kind: "skill",
-          path: outputPath,
-          description: `Codex ${config.label} skill artifact for ${skill.name}`,
-          content
-        });
-        manifests.get(mode)?.push({
-          name: skill.name,
-          sourcePath,
-          outputPath,
-          sha256: sha2562(content)
-        });
-      }
-    }
-  }
-  for (const mode of outputModes) {
-    const config = OUTPUT_MODE_CONFIG[mode];
-    artifacts.push({
-      harness: "codex",
-      kind: "manifest",
-      path: config.manifestPath,
-      description: `Generated Codex ${config.label} skill source manifest with source hashes.`,
-      content: `${JSON.stringify({ generatedBy: "thoth-agents", skills: manifests.get(mode) ?? [] }, null, 2)}
-`
-    });
-  }
-  return { artifacts, diagnostics };
-}
-
-// src/harness/adapters/codex.ts
-function readRootPackageVersion(context) {
-  const packageJsonPath = findRootPackageJsonPath([
-    ...hasCodexPackageRoot(context) ? [context.packageRoot] : [],
-    context.projectRoot,
-    process.cwd(),
-    fileURLToPath(new URL(".", import.meta.url))
-  ]);
-  return readPackageJsonVersion(packageJsonPath);
-}
-function createCodexPluginPackageManifest(context) {
-  return {
-    name: "thoth-agents",
-    version: readRootPackageVersion(context),
-    description: "Delegate-first OpenCode plugin with seven agents, thoth-mem persistence, and bundled SDD skills."
-  };
-}
-function findRootPackageJsonPath(startDirs) {
-  for (const startDir of startDirs) {
-    let currentDir = resolve(startDir);
-    while (true) {
-      const packageJsonPath = resolve(currentDir, "package.json");
-      if (existsSync5(packageJsonPath)) {
-        const packageJsonText = readFileSync4(packageJsonPath, "utf8");
-        const packageJson = JSON.parse(packageJsonText);
-        if (packageJson.name === "thoth-agents") {
-          return packageJsonPath;
-        }
-      }
-      const parentDir = dirname2(currentDir);
-      if (parentDir === currentDir) {
-        break;
-      }
-      currentDir = parentDir;
-    }
-  }
-  throw new Error(
-    "Unable to locate the thoth-agents root package.json from the render context or current working directory."
-  );
-}
-function readPackageJsonVersion(packageJsonPath) {
-  const packageJsonText = readFileSync4(packageJsonPath, "utf8");
-  const packageJson = JSON.parse(packageJsonText);
-  if (typeof packageJson.version !== "string" || packageJson.version.length === 0) {
-    throw new Error("Root package.json version must be a non-empty string.");
-  }
-  return packageJson.version;
-}
-function stableJson2(value) {
-  return `${JSON.stringify(value, null, 2)}
-`;
-}
-function codexCommandConfig(commandParts) {
-  const [command = "", ...args] = commandParts;
-  return {
-    command,
-    ...args.length > 0 ? { args } : {}
-  };
-}
-function codexMcpConfig(config) {
-  if ("url" in config) {
-    return { url: config.url };
-  }
-  const [command = "", ...args] = config.command;
-  return {
-    command,
-    ...args.length > 0 ? { args } : {},
-    ...config.environment && Object.keys(config.environment).length > 0 ? { env: config.environment } : {}
-  };
-}
-function createCodexBuiltinMcpServers() {
-  return {
-    exa: codexMcpConfig(exa),
-    context7: { url: CONTEXT7_MCP_URL },
-    grep_app: { url: GREP_APP_MCP_URL },
-    thoth_mem: codexCommandConfig(DEFAULT_THOTH_COMMAND)
-  };
-}
-function createCodexBuiltinMcpJsonConfig() {
-  return {
-    mcpServers: createCodexBuiltinMcpServers()
-  };
-}
-function createCodexBuiltinMcpTomlConfig() {
-  return {
-    mcp_servers: createCodexBuiltinMcpServers()
-  };
-}
-var CODEX_SUBAGENT_DEFAULT_MODELS = {
-  oracle: "gpt-5.5",
-  librarian: "gpt-5.4-mini",
-  explorer: "gpt-5.4-mini",
-  designer: "gpt-5.4-mini",
-  quick: "gpt-5.4-mini",
-  deep: "gpt-5.5"
-};
-var CODEX_SUBAGENT_REASONING_EFFORTS = {
-  oracle: "high",
-  explorer: "low",
-  librarian: "medium",
-  designer: "medium",
-  quick: "low",
-  deep: "medium"
-};
-var CODEX_ROOT_START = "<!-- thoth-agents:codex-root:start -->";
-var CODEX_ROOT_END = "<!-- thoth-agents:codex-root:end -->";
-var CODEX_CAPABILITIES = CODEX_PROMPT_DIALECT.capabilities.capabilities;
-function codexPromptSections(roleName) {
-  switch (roleName) {
-    case "orchestrator":
-      return createOrchestratorPromptSections();
-    case "explorer":
-    case "librarian":
-    case "oracle":
-      return createReadOnlySpecialistPromptSections(roleName);
-    case "designer":
-    case "quick":
-    case "deep":
-      return createWriteCapableSpecialistPromptSections(roleName);
-  }
-}
-function codexModelFamilyPromptSection(roleName, model) {
-  const section = createModelFamilySection(roleName, model);
-  return section ? renderPromptSection(section, CODEX_PROMPT_DIALECT) : void 0;
-}
-function codexStepBudgetPromptSection(steps) {
-  const section = createStepBudgetSection(steps);
-  return section ? renderPromptSection(section, CODEX_PROMPT_DIALECT) : void 0;
-}
-function renderCodexRolePrompt(roleName, config, model) {
-  const promptOverrides = loadAgentPrompt(roleName, config?.preset);
-  const override = getAgentOverride(config, roleName);
-  const basePrompt = renderRolePrompt(
-    codexPromptSections(roleName),
-    CODEX_PROMPT_DIALECT
-  );
-  const prompt = composeAgentPrompt({
-    basePrompt,
-    customPrompt: promptOverrides.prompt,
-    customAppendPrompt: appendPromptSections(
-      codexModelFamilyPromptSection(roleName, model),
-      promptOverrides.appendPrompt
-    )
-  });
-  return appendPromptSections(
-    prompt,
-    codexStepBudgetPromptSection(override?.steps)
-  );
-}
-function codexRoleInstructions(role) {
-  return [
-    "<role-operational-contract>",
-    `- Role: ${role.name}`,
-    `- Mode: ${role.mode}`,
-    `- Scope: ${role.scope}`,
-    `- Responsibility: ${role.responsibility}`,
-    "- Use request_user_input for local blocking decisions.",
-    "- Permissions, memory governance, runtime hooks, and provider-per-agent controls are instruction-level unless the active Codex runtime documents stronger enforcement.",
-    `- ${role.name} runs as a Codex custom-agent TOML entry; the orchestrator remains the ambient Codex root session, not a generated role TOML.`,
-    ...role.toolGovernance.map((rule) => `- ${rule}`),
-    ...role.verification.map((rule) => `- ${rule}`),
-    "</role-operational-contract>"
-  ].join("\n");
-}
-function roleInstructions(role, config) {
-  const model = getCodexAgentModel(role, config) ?? DEFAULT_MODELS[role.name];
-  return [
-    renderCodexRolePrompt(role.name, config, model),
-    codexRoleInstructions(role),
-    renderMemoryGovernanceInstructions(role, CODEX_PROMPT_DIALECT)
-  ].join("\n\n");
-}
-function renderCodexRootInstructions(config) {
-  const rootOverride = getAgentOverride(config, "orchestrator");
-  const rootPrompt = renderCodexRolePrompt(
-    "orchestrator",
-    config,
-    rootOverride?.model ?? DEFAULT_MODELS.orchestrator
-  );
-  return [
-    CODEX_ROOT_START,
-    rootPrompt,
-    "<codex-runtime>",
-    "- The ambient Codex root session is the root/main orchestrator; orchestrator-only and root-owned instructions apply to it because Codex does not generate a selectable orchestrator agent TOML.",
-    "- On each new root session, when thoth-mem tools are installed and session/project identity is known, call mem_session_start with the active project and session identity, then save the real user prompt with mem_save_prompt before later delegation.",
-    "- If thoth-mem tools or identity values are unavailable, disclose that memory bootstrap could not run and continue without claiming memory was saved.",
-    "- Use the ambient Codex root session as the delegate-first root coordinator; do not generate or select an orchestrator TOML.",
-    "- Delegate by invoking the installed Codex role agents: explorer, librarian, oracle, designer, quick, and deep.",
-    "- After receiving a delegated subagent response, close that subagent session unless you will retry or intentionally keep using that exact same session; explorer and librarian sessions must always be closed immediately after their response, and retry sessions must be closed after the retry result unless explicit same-session reuse is still required.",
-    "- Use packaged thoth-agents plugin capabilities through Codex plugin, skill, MCP, and hook review surfaces after enabling them with /plugins and /hooks.",
-    "- For blocking user decisions in Codex Default mode, use request_user_input after features.default_mode_request_user_input is enabled; do not ask those questions in plain prose.",
-    "- Memory governance, role permissions, provider-per-agent controls, and hooks are instruction-level unless the active Codex runtime documents stronger enforcement.",
-    "</codex-runtime>",
-    CODEX_ROOT_END,
-    ""
-  ].join("\n");
-}
-function agentModelReasoningEffort(role) {
-  return isCodexSubagentName(role.name) ? CODEX_SUBAGENT_REASONING_EFFORTS[role.name] : "medium";
-}
-function isCodexSubagentName(name) {
-  return name in CODEX_SUBAGENT_DEFAULT_MODELS;
-}
-function getPrimaryModelId2(model) {
-  if (Array.isArray(model)) {
-    const first = model[0];
-    return typeof first === "string" ? first : first?.id;
-  }
-  return model;
-}
-function getCodexAgentModel(role, config) {
-  if (!isCodexSubagentName(role.name)) return void 0;
-  return getPrimaryModelId2(config?.agents?.[role.name]?.model) ?? CODEX_SUBAGENT_DEFAULT_MODELS[role.name];
-}
-function codexSurfaceHasField(surfaceId, field) {
-  return getCodexSurface(surfaceId)?.fields.includes(field) ?? false;
-}
-function hasCodexConfig(context) {
-  return "config" in context;
-}
-function hasCodexPackageRoot(context) {
-  return "packageRoot" in context && typeof context.packageRoot === "string" && context.packageRoot.length > 0;
-}
-function renderAgentArtifacts({ config }) {
-  const artifacts = [];
-  const diagnostics = [];
-  const supportsReasoningEffort = codexSurfaceHasField(
-    "project-agent-toml",
-    "model_reasoning_effort"
-  );
-  for (const role of getAgentPackContract().roles.filter(
-    (candidate) => candidate.name !== "orchestrator"
-  )) {
-    const model = getCodexAgentModel(role, config);
-    const toml = renderCodexToml({
-      surfaceId: "project-agent-toml",
-      values: {
-        name: role.name,
-        description: role.responsibility,
-        developer_instructions: roleInstructions(role, config),
-        ...model ? { model } : {},
-        ...supportsReasoningEffort ? { model_reasoning_effort: agentModelReasoningEffort(role) } : {},
-        sandbox_mode: role.canMutateWorkspace ? "workspace-write" : "read-only"
-      }
-    });
-    diagnostics.push(...toml.diagnostics);
-    artifacts.push({
-      harness: "codex",
-      kind: "agent-config",
-      path: `.codex/agents/thoth-agents-${role.name}.toml`,
-      description: `Codex agent definition for ${role.name}.`,
-      content: toml.content
-    });
-  }
-  return { artifacts, diagnostics };
-}
-function renderConfigArtifacts() {
-  const config = renderCodexToml({
-    surfaceId: "project-config-toml",
-    values: {
-      approval_policy: "on-request",
-      sandbox_mode: "workspace-write",
-      "skills.config": { enabled: true, sources: ["repo"] },
-      agents: getAgentPackContract().roles.filter((role) => role.name !== "orchestrator").map((role) => role.name)
-    }
-  });
-  const mcp = renderCodexToml({
-    surfaceId: "mcp-server-config",
-    values: createCodexBuiltinMcpTomlConfig()
-  });
-  return {
-    artifacts: [
-      {
-        harness: "codex",
-        kind: "harness-config",
-        path: ".codex/config.toml",
-        description: "Codex project configuration snippet for the agent pack.",
-        content: config.content
-      },
-      {
-        harness: "codex",
-        kind: "mcp-config",
-        path: ".codex/config.toml",
-        description: "Codex MCP configuration snippet for thoth-mem.",
-        content: mcp.content
-      }
-    ],
-    diagnostics: [...config.diagnostics, ...mcp.diagnostics]
-  };
-}
-function capabilityDiagnostics() {
-  const surfaceDiagnostics = getCodexSurfaceRecords().filter((surface) => surface.status !== "validated").map(codexSurfaceDiagnostic);
-  const governanceDiagnostics = memoryGovernanceDiagnostics({
-    harness: "codex",
-    permissionControls: CODEX_CAPABILITIES.rolePermissions,
-    parentContextInjection: CODEX_CAPABILITIES.parentContextInjection,
-    memoryWriteControls: CODEX_CAPABILITIES.memoryGovernanceEnforcement
-  });
-  return [...surfaceDiagnostics, ...governanceDiagnostics];
-}
-function hookReadinessDiagnostics() {
-  return [
-    {
-      severity: "warning",
-      code: "codex.hooks.project_trust.required",
-      message: "Codex project-local hooks require trusted project configuration before .codex/hooks.json or inline [hooks] command handlers are active; generated artifacts remain diagnostic-only until trust and features.hooks are reviewed.",
-      harness: "codex",
-      surface: "project-hooks-json",
-      fallback: "diagnostic-only"
-    },
-    {
-      severity: "warning",
-      code: "codex.hooks.features_hooks.required",
-      message: "Codex hook loading is gated by features.hooks; this adapter reports the docs-backed config surface but does not generate hook scripts or claim runtime enforcement.",
-      harness: "codex",
-      surface: "features-hooks-toggle",
-      fallback: "diagnostic-only"
-    },
-    {
-      severity: "warning",
-      code: "codex.hooks.plugin_trust.required",
-      message: "Bundled Codex plugin hook configuration is package content only; activation requires features.plugin_hooks and plugin hook trust review, and this adapter does not enable hooks automatically or claim hard permission enforcement.",
-      harness: "codex",
-      surface: "plugin-hooks-bundle",
-      fallback: "diagnostic-only"
-    }
-  ];
-}
-function resolveSkillOutputModes(context) {
-  return context.options?.codexSkillOutputModes ?? ["plugin-package"];
-}
-var codexAdapter = {
-  id: "codex",
-  displayName: "Codex",
-  capabilities: CODEX_CAPABILITIES,
-  render(context) {
-    const config = hasCodexConfig(context) ? context.config : void 0;
-    const agentArtifacts = renderAgentArtifacts({ config });
-    const configArtifacts = renderConfigArtifacts();
-    const skillOutputModes = resolveSkillOutputModes(context);
-    const skillLayout = renderCodexSkillLayout({
-      projectRoot: context.projectRoot,
-      ...hasCodexPackageRoot(context) ? { packageRoot: context.packageRoot } : {},
-      skills: getSkillRegistry(),
-      surfaceId: "plugin-skills-directory",
-      outputModes: skillOutputModes
-    });
-    const pluginPackage = renderCodexPluginPackage({
-      manifest: createCodexPluginPackageManifest(context),
-      assets: [
-        {
-          surfaceId: "plugin-skills-directory",
-          manifestField: "skills",
-          path: ".codex-plugin/skills/",
-          description: "Codex plugin-bundled skill directory."
-        },
-        {
-          surfaceId: "plugin-mcp-json",
-          manifestField: "mcpServers",
-          path: ".codex-plugin/.mcp.json",
-          description: "Codex plugin-bundled MCP server definitions.",
-          content: stableJson2(createCodexBuiltinMcpJsonConfig())
-        },
-        {
-          surfaceId: "plugin-hooks-json",
-          manifestField: "hooks",
-          path: ".codex-plugin/hooks/hooks.json",
-          description: "Codex plugin-bundled hook configuration.",
-          hookDefinitions: []
-        }
-      ]
-    });
-    return {
-      harness: "codex",
-      artifacts: [
-        ...agentArtifacts.artifacts,
-        ...configArtifacts.artifacts,
-        ...pluginPackage.artifacts,
-        ...skillLayout.artifacts
-      ],
-      diagnostics: [
-        ...agentArtifacts.diagnostics,
-        ...configArtifacts.diagnostics,
-        ...pluginPackage.diagnostics,
-        ...skillLayout.diagnostics,
-        ...hookReadinessDiagnostics(),
-        ...capabilityDiagnostics()
-      ]
-    };
-  }
-};
-
-// src/cli/install.ts
-import { existsSync as existsSync10 } from "fs";
-import { homedir as homedir3 } from "os";
-import { cwd } from "process";
-
-// src/cli/codex-install.ts
-import {
-  copyFileSync as copyFileSync4,
-  existsSync as existsSync9,
-  mkdirSync as mkdirSync5,
-  readFileSync as readFileSync7,
-  rmSync as rmSync2,
-  writeFileSync as writeFileSync4
-} from "fs";
-import { basename, dirname as dirname5, isAbsolute, join as join8, relative as relative3 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
-
-// src/harness/codex-plugin-paths.ts
-import { join as join4 } from "path";
-var CODEX_PLUGIN_ARTIFACT_PREFIX = ".codex-plugin/";
-function codexPluginRootArtifactPath(artifactPath) {
-  if (!artifactPath.startsWith(CODEX_PLUGIN_ARTIFACT_PREFIX)) {
-    throw new Error(`Expected Codex plugin artifact path: ${artifactPath}`);
-  }
-  const relativePath = artifactPath.slice(CODEX_PLUGIN_ARTIFACT_PREFIX.length);
-  if (relativePath === ".mcp.json") return relativePath;
-  if (relativePath === "plugin.json" || relativePath.startsWith(".")) {
-    return join4(".codex-plugin", relativePath);
-  }
-  return relativePath;
-}
-
-// src/cli/codex-config-io.ts
-import {
-  copyFileSync as copyFileSync2,
-  existsSync as existsSync6,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync5,
-  renameSync as renameSync2,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { dirname as dirname3 } from "path";
-function splitTomlLines(content) {
-  return (content.match(/[^\r\n]*(?:\r\n|\n|\r)|[^\r\n]+$/g) ?? []).map(
-    (rawLine) => {
-      const eol = /(\r\n|\n|\r)$/.exec(rawLine)?.[1] ?? "";
-      return {
-        text: eol ? rawLine.slice(0, -eol.length) : rawLine,
-        eol
-      };
-    }
-  );
-}
-function tomlLineBreak(content) {
-  return /(\r\n|\n|\r)/.exec(content)?.[1] ?? "\n";
-}
-function uncommentedTomlLine(line) {
-  return line.split("#", 1)[0].trim();
-}
-function isTomlTableHeader(line) {
-  const trimmed = uncommentedTomlLine(line);
-  return trimmed.startsWith("[[") && trimmed.endsWith("]]") || trimmed.startsWith("[") && trimmed.endsWith("]");
-}
-function isFeaturesHeader(line) {
-  return uncommentedTomlLine(line) === "[features]";
-}
-function renderTomlLines(lines) {
-  return lines.map((line) => `${line.text}${line.eol}`).join("");
-}
-function ensureLineHasEol(lines, index, eol) {
-  if (index >= 0 && lines[index]?.eol === "") lines[index].eol = eol;
-}
-function appendFeaturesSection(content) {
-  const eol = tomlLineBreak(content);
-  if (!content) {
-    return `[features]${eol}default_mode_request_user_input = true${eol}`;
-  }
-  const separator = content.endsWith("\n") || content.endsWith("\r") ? content.endsWith(`${eol}${eol}`) ? "" : eol : `${eol}${eol}`;
-  return `${content}${separator}[features]${eol}default_mode_request_user_input = true${eol}`;
-}
-function patchCodexDefaultModeUserInputFeature(content) {
-  const lines = splitTomlLines(content);
-  const eol = tomlLineBreak(content);
-  const featuresStart = lines.findIndex((line) => isFeaturesHeader(line.text));
-  if (featuresStart === -1) return appendFeaturesSection(content);
-  let featuresEnd = lines.length;
-  for (let index = featuresStart + 1; index < lines.length; index++) {
-    if (isTomlTableHeader(lines[index].text)) {
-      featuresEnd = index;
-      break;
-    }
-  }
-  const flagPattern = /^(\s*default_mode_request_user_input\s*=\s*)(true|false)(\b.*)$/;
-  for (let index = featuresStart + 1; index < featuresEnd; index++) {
-    const match = flagPattern.exec(lines[index].text);
-    if (!match) continue;
-    if (match[2] === "true") return content;
-    lines[index].text = `${match[1]}true${match[3]}`;
-    return renderTomlLines(lines);
-  }
-  let insertAt = featuresEnd;
-  while (insertAt > featuresStart + 1 && lines[insertAt - 1].text.trim() === "")
-    insertAt--;
-  ensureLineHasEol(lines, insertAt - 1, eol);
-  lines.splice(insertAt, 0, {
-    text: "default_mode_request_user_input = true",
-    eol
-  });
-  return renderTomlLines(lines);
-}
-function buildCodexManagedConfigPatch(content, options) {
-  const diffSummary = [
-    "ensure features.default_mode_request_user_input = true"
-  ];
-  if (options.pluginId) {
-    diffSummary.push(
-      `plugin enablement for "${options.pluginId}" is not textually merged; use /plugins to enable it`
-    );
-  } else {
-    diffSummary.push(
-      "plugin enablement left to /plugins; no guessed plugin id written"
-    );
-  }
-  return {
-    content: patchCodexDefaultModeUserInputFeature(content),
-    diffSummary,
-    warnings: []
-  };
-}
-function writeCodexConfigMerge(options) {
-  try {
-    const before = existsSync6(options.configPath) ? readFileSync5(options.configPath, "utf8") : "";
-    const merged = buildCodexManagedConfigPatch(before, {
-      pluginId: options.pluginId
-    });
-    const changed = before !== merged.content;
-    if (options.dryRun || !changed) {
-      return {
-        success: true,
-        configPath: options.configPath,
-        changed,
-        diffSummary: merged.diffSummary,
-        warnings: merged.warnings
-      };
-    }
-    mkdirSync2(dirname3(options.configPath), { recursive: true });
-    const backupPath = `${options.configPath}.bak`;
-    if (existsSync6(options.configPath))
-      copyFileSync2(options.configPath, backupPath);
-    const tmpPath = `${options.configPath}.tmp`;
-    writeFileSync2(tmpPath, merged.content);
-    renameSync2(tmpPath, options.configPath);
-    return {
-      success: true,
-      configPath: options.configPath,
-      backupPath: existsSync6(backupPath) ? backupPath : void 0,
-      changed,
-      diffSummary: merged.diffSummary,
-      warnings: merged.warnings
-    };
-  } catch (error) {
-    return {
-      success: false,
-      configPath: options.configPath,
-      changed: false,
-      diffSummary: [],
-      warnings: [],
-      error: error instanceof Error ? error.message : String(error)
-    };
-  }
-}
-
-// src/cli/codex-paths.ts
-import { homedir as homedir2 } from "os";
-import { join as join5 } from "path";
-var CODEX_ROLE_NAMES = [
-  "explorer",
-  "librarian",
-  "oracle",
-  "designer",
-  "quick",
-  "deep"
-];
-function getCodexHome(options = {}) {
-  const explicit = options.codexHome ?? process.env.CODEX_HOME?.trim();
-  return explicit || join5(options.homeDir ?? homedir2(), ".codex");
-}
-function resolveCodexTargets(options) {
-  const codexHome = getCodexHome(options);
-  const agentsDir = options.scope === "project" ? join5(options.projectRoot, ".codex", "agents") : join5(codexHome, "agents");
-  return {
-    scope: options.scope,
-    codexHome,
-    configPath: join5(codexHome, "config.toml"),
-    rootInstructionsPath: join5(codexHome, "AGENTS.md"),
-    roleAgentPaths: CODEX_ROLE_NAMES.map((role) => ({
-      role,
-      path: join5(agentsDir, `thoth-agents-${role}.toml`)
-    })),
-    managedModelsPath: join5(
-      codexHome,
-      "agents",
-      ".thoth-agents-managed-models.json"
-    ),
-    skillsDir: options.scope === "project" ? join5(options.projectRoot, ".agents", "skills") : join5(options.homeDir ?? homedir2(), ".agents", "skills"),
-    packageRoot: join5(options.projectRoot, ".codex-plugin"),
-    personalPluginRoot: join5(codexHome, "plugins", "thoth-agents"),
-    personalMarketplacePath: join5(
-      options.homeDir ?? homedir2(),
-      ".agents",
-      "plugins",
-      "marketplace.json"
-    )
-  };
-}
-
-// src/cli/custom-skills.ts
-import {
-  copyFileSync as copyFileSync3,
-  existsSync as existsSync8,
-  mkdirSync as mkdirSync4,
-  readdirSync as readdirSync3,
-  rmSync,
-  statSync as statSync3
-} from "fs";
-import { dirname as dirname4, join as join7, parse } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-
-// src/cli/skill-manifest.ts
-import { createHash as createHash3 } from "crypto";
-import {
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync3,
-  readdirSync as readdirSync2,
-  readFileSync as readFileSync6,
-  statSync as statSync2,
-  writeFileSync as writeFileSync3
-} from "fs";
-import { join as join6, relative as relative2 } from "path";
-var SHARED_SKILL_DIRECTORY = "_shared";
-var SKILLS_SOURCE_ROOT = join6("src", "skills");
-var MANIFEST_FILE_NAME = ".skill-manifest.json";
-function getManifestPath() {
-  return join6(getCustomSkillsDir(), MANIFEST_FILE_NAME);
-}
-function listFilesRecursive(dirPath) {
-  if (!existsSync7(dirPath)) {
-    return [];
-  }
-  const files = [];
-  const entries = readdirSync2(dirPath).sort(
-    (left, right) => left.localeCompare(right)
-  );
-  for (const entry of entries) {
-    const entryPath = join6(dirPath, entry);
-    const stat = statSync2(entryPath);
-    if (stat.isDirectory()) {
-      files.push(...listFilesRecursive(entryPath));
-      continue;
-    }
-    files.push(entryPath);
-  }
-  return files;
-}
-function readPackageVersion(packageRoot) {
-  const packageJsonPath = join6(packageRoot, "package.json");
-  const packageJson = JSON.parse(readFileSync6(packageJsonPath, "utf-8"));
-  if (typeof packageJson.version !== "string" || packageJson.version.length === 0) {
-    throw new Error(`Invalid package version in ${packageJsonPath}`);
-  }
-  return packageJson.version;
-}
-function readManifest() {
-  const manifestPath = getManifestPath();
-  if (!existsSync7(manifestPath)) {
-    return null;
-  }
-  try {
-    return JSON.parse(readFileSync6(manifestPath, "utf-8"));
-  } catch (error) {
-    console.warn(`Failed to read skill manifest: ${manifestPath}`, error);
-    return null;
-  }
-}
-function writeManifest(manifest) {
-  const manifestPath = getManifestPath();
-  mkdirSync3(getCustomSkillsDir(), { recursive: true });
-  writeFileSync3(manifestPath, `${JSON.stringify(manifest, null, 2)}
-`);
-}
-function computeSkillHash(skillDirPath) {
-  const hash = createHash3("sha256");
-  for (const filePath of listFilesRecursive(skillDirPath)) {
-    hash.update(`${relative2(skillDirPath, filePath)}
-`);
-    hash.update(readFileSync6(filePath));
-    hash.update("\n");
-  }
-  return hash.digest("hex");
-}
-function findRemovedSkills(manifest) {
-  const currentSkillNames = new Set(CUSTOM_SKILLS.map((skill) => skill.name));
-  return Object.keys(manifest.skills).filter(
-    (skillName) => !currentSkillNames.has(skillName)
-  );
-}
-function checkSkillsNeedUpdate(packageRoot) {
-  const manifest = readManifest();
-  const pluginVersion = readPackageVersion(packageRoot);
-  const sharedHash = computeSkillHash(
-    join6(packageRoot, SKILLS_SOURCE_ROOT, SHARED_SKILL_DIRECTORY)
-  );
-  const versionChanged = manifest !== null && manifest.pluginVersion !== pluginVersion;
-  const sharedChanged = manifest !== null && manifest.sharedHash !== sharedHash;
-  const removedSkills = manifest ? findRemovedSkills(manifest) : [];
-  const skillsNeedingUpdate = CUSTOM_SKILLS.flatMap((skill) => {
-    const sourcePath = join6(packageRoot, skill.sourcePath);
-    const targetPath = join6(getCustomSkillsDir(), skill.name);
-    const sourceHash = computeSkillHash(sourcePath);
-    const manifestEntry = manifest?.skills[skill.name];
-    const reasons = [];
-    if (!manifest) {
-      reasons.push("manifest-missing");
-    }
-    if (versionChanged) {
-      reasons.push("version-change");
-    }
-    if (sharedChanged) {
-      reasons.push("shared-hash-mismatch");
-    }
-    if (!manifestEntry) {
-      reasons.push("new-skill");
-    } else if (manifestEntry.hash !== sourceHash) {
-      reasons.push("hash-mismatch");
-    }
-    if (!existsSync7(targetPath)) {
-      reasons.push("missing-install");
-    }
-    if (reasons.length === 0) {
-      return [];
-    }
-    return [
-      {
-        skill,
-        sourceHash,
-        targetPath,
-        reasons
-      }
-    ];
-  });
-  return {
-    pluginVersion,
-    sharedHash,
-    manifest,
-    versionChanged,
-    sharedChanged,
-    needsUpdate: skillsNeedingUpdate.length > 0 || removedSkills.length > 0,
-    skillsNeedingUpdate,
-    removedSkills
-  };
-}
-
-// src/cli/custom-skills.ts
-var SHARED_SKILL_DIRECTORY2 = "_shared";
-var SHARED_SKILL_SOURCE_PATH = `src/skills/${SHARED_SKILL_DIRECTORY2}`;
-var CUSTOM_SKILLS = BUNDLED_SKILL_REGISTRY.map(
-  (skill) => ({
-    name: skill.name,
-    description: skill.description,
-    allowedAgents: [...skill.allowedRoles],
-    sourcePath: skill.sourcePath
-  })
-);
-function getCustomSkillsDir() {
-  return join7(getConfigDir(), "skills");
-}
-function copyDirRecursive(src, dest) {
-  if (!existsSync8(dest)) {
-    mkdirSync4(dest, { recursive: true });
-  }
-  const entries = readdirSync3(src);
-  for (const entry of entries) {
-    const srcPath = join7(src, entry);
-    const destPath = join7(dest, entry);
-    const stat = statSync3(srcPath);
-    if (stat.isDirectory()) {
-      copyDirRecursive(srcPath, destPath);
-    } else {
-      const destDir = dirname4(destPath);
-      if (!existsSync8(destDir)) {
-        mkdirSync4(destDir, { recursive: true });
-      }
-      copyFileSync3(srcPath, destPath);
-    }
-  }
-}
-function installSharedSkillAssets(packageRoot) {
-  const sharedSourcePath = join7(packageRoot, SHARED_SKILL_SOURCE_PATH);
-  const sharedTargetPath = join7(getCustomSkillsDir(), SHARED_SKILL_DIRECTORY2);
-  if (!existsSync8(sharedSourcePath)) {
-    console.error(`Custom skill shared assets not found: ${sharedSourcePath}`);
-    return false;
-  }
-  rmSync(sharedTargetPath, { recursive: true, force: true });
-  copyDirRecursive(sharedSourcePath, sharedTargetPath);
-  return true;
-}
-function findPackageRoot(startDir) {
-  let currentDir = startDir;
-  const filesystemRoot = parse(startDir).root;
-  while (true) {
-    if (existsSync8(join7(currentDir, "package.json")) && existsSync8(join7(currentDir, "src", "skills"))) {
-      return currentDir;
-    }
-    if (currentDir === filesystemRoot) {
-      return null;
-    }
-    const parentDir = dirname4(currentDir);
-    if (parentDir === currentDir) {
-      return null;
-    }
-    currentDir = parentDir;
-  }
-}
-function resolvePackageRoot(packageRoot) {
-  if (packageRoot) {
-    return packageRoot;
-  }
-  const moduleDir = fileURLToPath2(new URL(".", import.meta.url));
-  return findPackageRoot(moduleDir) ?? fileURLToPath2(new URL("../..", import.meta.url));
-}
-function installCustomSkillFiles(skill, packageRoot) {
-  const sourcePath = join7(packageRoot, skill.sourcePath);
-  const targetPath = join7(getCustomSkillsDir(), skill.name);
-  if (!existsSync8(sourcePath)) {
-    console.error(`Custom skill source not found: ${sourcePath}`);
-    return false;
-  }
-  rmSync(targetPath, { recursive: true, force: true });
-  copyDirRecursive(sourcePath, targetPath);
-  return true;
-}
-function removeObsoleteSkills(removedSkillNames) {
-  const removedSkills = [];
-  for (const skillName of removedSkillNames) {
-    const targetPath = join7(getCustomSkillsDir(), skillName);
-    try {
-      console.log(`Removing obsolete bundled skill: ${skillName}`);
-      rmSync(targetPath, { recursive: true, force: true });
-      removedSkills.push(skillName);
-    } catch (error) {
-      console.warn(`Failed to remove obsolete bundled skill: ${skillName}`);
-      console.warn(error);
-    }
-  }
-  return removedSkills;
-}
-function buildManifest(packageRoot, updatedSkills, previousManifest, pluginVersion, sharedHash) {
-  const installedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const updatedSkillNames = new Set(
-    updatedSkills.map(({ skill }) => skill.name)
-  );
-  const skills = Object.fromEntries(
-    CUSTOM_SKILLS.map((skill) => {
-      const previousEntry = previousManifest?.skills[skill.name];
-      const nextInstalledAt = updatedSkillNames.has(skill.name) ? installedAt : previousEntry?.installedAt ?? installedAt;
-      return [
-        skill.name,
-        {
-          hash: computeSkillHash(join7(packageRoot, skill.sourcePath)),
-          installedAt: nextInstalledAt
-        }
-      ];
-    })
-  );
-  return {
-    pluginVersion,
-    sharedHash,
-    skills
-  };
-}
-function pruneRemovedSkillsFromManifest(manifest, removedSkills) {
-  const removedSkillNames = new Set(removedSkills);
-  return {
-    ...manifest,
-    skills: Object.fromEntries(
-      Object.entries(manifest.skills).filter(
-        ([skillName]) => !removedSkillNames.has(skillName)
-      )
-    )
-  };
-}
-function installCustomSkills(packageRoot = resolvePackageRoot()) {
-  const updateCheck = checkSkillsNeedUpdate(packageRoot);
-  if (!updateCheck.needsUpdate) {
-    return {
-      success: true,
-      updatedSkills: [],
-      skippedSkills: [...CUSTOM_SKILLS],
-      failedSkills: [],
-      removedSkills: []
-    };
-  }
-  const removedSkills = removeObsoleteSkills(updateCheck.removedSkills);
-  if (removedSkills.length > 0 && updateCheck.manifest) {
-    writeManifest(
-      pruneRemovedSkillsFromManifest(updateCheck.manifest, removedSkills)
-    );
-  }
-  if (updateCheck.skillsNeedingUpdate.length === 0) {
-    writeManifest(
-      buildManifest(
-        packageRoot,
-        [],
-        updateCheck.manifest,
-        updateCheck.pluginVersion,
-        updateCheck.sharedHash
-      )
-    );
-    return {
-      success: true,
-      updatedSkills: [],
-      skippedSkills: [...CUSTOM_SKILLS],
-      failedSkills: [],
-      removedSkills
-    };
-  }
-  if (!installSharedSkillAssets(packageRoot)) {
-    return {
-      success: false,
-      updatedSkills: [],
-      skippedSkills: [],
-      failedSkills: updateCheck.skillsNeedingUpdate.map(
-        ({ skill, reasons }) => ({
-          skill,
-          reasons
-        })
-      ),
-      removedSkills
-    };
-  }
-  const updatesBySkillName = new Map(
-    updateCheck.skillsNeedingUpdate.map((entry) => [entry.skill.name, entry])
-  );
-  const updatedSkills = [];
-  const skippedSkills = [];
-  const failedSkills = [];
-  for (const skill of CUSTOM_SKILLS) {
-    const pendingUpdate = updatesBySkillName.get(skill.name);
-    if (!pendingUpdate) {
-      skippedSkills.push(skill);
-      continue;
-    }
-    if (installCustomSkillFiles(skill, packageRoot)) {
-      updatedSkills.push({
-        skill,
-        reasons: pendingUpdate.reasons
-      });
-      continue;
-    }
-    failedSkills.push({
-      skill,
-      reasons: pendingUpdate.reasons
-    });
-  }
-  if (failedSkills.length > 0) {
-    return {
-      success: false,
-      updatedSkills,
-      skippedSkills,
-      failedSkills,
-      removedSkills
-    };
-  }
-  writeManifest(
-    buildManifest(
-      packageRoot,
-      updatedSkills,
-      updateCheck.manifest,
-      updateCheck.pluginVersion,
-      updateCheck.sharedHash
-    )
-  );
-  return {
-    success: true,
-    updatedSkills,
-    skippedSkills,
-    failedSkills,
-    removedSkills
-  };
-}
-
-// src/cli/codex-install.ts
-var ROOT_START = "<!-- thoth-agents:codex-root:start -->";
-var ROOT_END = "<!-- thoth-agents:codex-root:end -->";
-var MANAGED_MODEL_STATE_VERSION = 1;
-function mergeManagedBlock(existing, managedBlock) {
-  const start = existing.indexOf(ROOT_START);
-  const end = existing.indexOf(ROOT_END);
-  if (start !== -1 && end !== -1 && end > start) {
-    return `${existing.slice(0, start)}${managedBlock}${existing.slice(end + ROOT_END.length).replace(/^\s*\n/, "")}`;
-  }
-  return `${existing}${existing.endsWith("\n") || existing.length === 0 ? "" : "\n"}
-${managedBlock}`;
-}
-function writeTextWithBackup(path3, content) {
-  mkdirSync5(dirname5(path3), { recursive: true });
-  if (existsSync9(path3) && readFileSync7(path3, "utf8") === content) return false;
-  if (existsSync9(path3)) copyFileSync4(path3, `${path3}.bak`);
-  writeFileSync4(path3, content);
-  return true;
-}
-function packageArtifactTarget(packageRoot, artifact) {
-  return join8(packageRoot, codexPluginRootArtifactPath(artifact.path));
-}
-function resolvePackageRoot2(packageRoot) {
-  if (packageRoot) return packageRoot;
-  return findPackageRoot(fileURLToPath3(new URL(".", import.meta.url))) ?? void 0;
-}
-function normalizeRelativeMarketplacePath(path3) {
-  const normalized = path3.replaceAll("\\", "/");
-  if (isAbsolute(path3) || /^[A-Za-z]:\//.test(normalized)) return normalized;
-  if (normalized.startsWith("./")) return normalized;
-  return `./${normalized}`;
-}
-function marketplaceSourcePath(homeDir, personalPluginRoot) {
-  return normalizeRelativeMarketplacePath(
-    relative3(homeDir, personalPluginRoot)
-  );
-}
-function managedMarketplaceEntry(homeDir, personalPluginRoot) {
-  return {
-    name: "thoth-agents",
-    source: {
-      source: "local",
-      path: marketplaceSourcePath(homeDir, personalPluginRoot)
-    },
-    policy: {
-      installation: "AVAILABLE",
-      authentication: "ON_INSTALL"
-    },
-    category: "Productivity"
-  };
-}
-function stableJson3(value) {
-  return `${JSON.stringify(value, null, 2)}
-`;
-}
-function emptyManagedModelState() {
-  return {
-    version: MANAGED_MODEL_STATE_VERSION,
-    models: {}
-  };
-}
-function readManagedModelState(path3) {
-  if (!existsSync9(path3)) return emptyManagedModelState();
-  try {
-    const parsed = JSON.parse(readFileSync7(path3, "utf8"));
-    if (parsed.version !== MANAGED_MODEL_STATE_VERSION || !parsed.models || typeof parsed.models !== "object" || Array.isArray(parsed.models)) {
-      return emptyManagedModelState();
-    }
-    return {
-      version: MANAGED_MODEL_STATE_VERSION,
-      models: Object.fromEntries(
-        Object.entries(parsed.models).filter(
-          (entry) => typeof entry[0] === "string" && typeof entry[1] === "string"
-        )
-      )
-    };
-  } catch {
-    return emptyManagedModelState();
-  }
-}
-function parseRoleTomlModel(content) {
-  const match = /^model\s*=\s*"((?:\\.|[^"\\])*)"\s*$/m.exec(content);
-  if (!match) return void 0;
-  return match[1].replace(/\\n/g, "\n").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
-}
-function escapeTomlString2(value) {
-  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\t/g, "\\t").replace(/\n/g, "\\n").replace(/\f/g, "\\f").replace(/\r/g, "\\r");
-}
-function replaceRoleTomlModel(content, model) {
-  const rendered = `model = "${escapeTomlString2(model)}"`;
-  if (/^model\s*=\s*"(?:\\.|[^"\\])*"\s*$/m.test(content)) {
-    return content.replace(/^model\s*=\s*"(?:\\.|[^"\\])*"\s*$/m, rendered);
-  }
-  return `${rendered}
-${content}`;
-}
-function roleManagedModelStateKey(path3) {
-  return basename(path3);
-}
-function resolveRoleTomlContent(options) {
-  const renderedModel = parseRoleTomlModel(options.renderedContent);
-  const key = roleManagedModelStateKey(options.targetPath);
-  if (!renderedModel) return options.renderedContent;
-  if (options.reset || !existsSync9(options.targetPath)) {
-    options.nextState.models[key] = renderedModel;
-    return options.renderedContent;
-  }
-  const currentModel = parseRoleTomlModel(
-    readFileSync7(options.targetPath, "utf8")
-  );
-  const trackedModel = options.state.models[key];
-  const isUserOwned = currentModel !== void 0 && (trackedModel === void 0 ? currentModel !== renderedModel : currentModel !== trackedModel);
-  if (isUserOwned) {
-    if (trackedModel !== void 0)
-      options.nextState.models[key] = trackedModel;
-    return replaceRoleTomlModel(options.renderedContent, currentModel);
-  }
-  options.nextState.models[key] = renderedModel;
-  return options.renderedContent;
-}
-function mergePersonalMarketplace(existing, homeDir, personalPluginRoot) {
-  const parsed = existing.trim() ? JSON.parse(existing) : {};
-  const plugins = Array.isArray(parsed.plugins) ? parsed.plugins : [];
-  const managedEntry = managedMarketplaceEntry(homeDir, personalPluginRoot);
-  const nextPlugins = plugins.filter(
-    (entry) => !(entry && typeof entry === "object" && "name" in entry && entry.name === "thoth-agents")
-  ).concat(managedEntry);
-  return stableJson3({
-    ...parsed,
-    name: typeof parsed.name === "string" ? parsed.name : "personal-marketplace",
-    interface: parsed.interface && typeof parsed.interface === "object" ? parsed.interface : { displayName: "Personal Plugin Marketplace" },
-    plugins: nextPlugins
-  });
-}
-function roleArtifactContent(role, artifacts) {
-  const path3 = `.codex/agents/thoth-agents-${role}.toml`;
-  const artifact = artifacts.find((candidate) => candidate.path === path3);
-  if (!artifact?.content)
-    throw new Error(`Missing Codex role artifact: ${path3}`);
-  return String(artifact.content);
-}
-function buildCodexSetupPlan(config) {
-  const targets = resolveCodexTargets({
-    scope: config.scope,
-    projectRoot: config.projectRoot,
-    homeDir: config.homeDir,
-    codexHome: config.codexHome
-  });
-  const packageRoot = resolvePackageRoot2(config.packageRoot);
-  const render = codexAdapter.render({
-    projectRoot: config.projectRoot,
-    ...packageRoot ? { packageRoot } : {}
-  });
-  const packageArtifacts = render.artifacts.filter(
-    (artifact) => artifact.path.startsWith(".codex-plugin/")
-  );
-  const rootBlock = renderCodexRootInstructions();
-  const managedModelState = readManagedModelState(targets.managedModelsPath);
-  const nextManagedModelState = emptyManagedModelState();
-  const items = [
-    {
-      kind: "root-instructions",
-      action: "merge-managed-block",
-      targetPath: targets.rootInstructionsPath,
-      description: `Merge managed Codex root instructions into ${targets.rootInstructionsPath}.`,
-      requiresBackup: true,
-      content: rootBlock
-    },
-    ...targets.roleAgentPaths.map(
-      (target) => ({
-        kind: "role-subagent-toml",
-        action: "write-role-toml",
-        targetPath: target.path,
-        description: `Materialize Codex role subagent ${target.role}.`,
-        requiresBackup: existsSync9(target.path),
-        role: target.role,
-        content: resolveRoleTomlContent({
-          renderedContent: roleArtifactContent(target.role, render.artifacts),
-          targetPath: target.path,
-          state: managedModelState,
-          nextState: nextManagedModelState,
-          reset: config.reset
-        })
-      })
-    ),
-    {
-      kind: "managed-model-state",
-      action: "write-managed-model-state",
-      targetPath: targets.managedModelsPath,
-      description: "Record thoth-agents-managed Codex role model ownership state.",
-      requiresBackup: existsSync9(targets.managedModelsPath),
-      content: stableJson3(nextManagedModelState)
-    },
-    ...packageArtifacts.map(
-      (artifact) => ({
-        kind: "personal-plugin-source",
-        action: "refresh-package",
-        targetPath: packageArtifactTarget(targets.personalPluginRoot, artifact),
-        description: `Refresh Personal Codex plugin source asset ${artifact.path}.`,
-        requiresBackup: false,
-        content: String(artifact.content ?? "")
-      })
-    ),
-    {
-      kind: "personal-marketplace",
-      action: "merge-marketplace",
-      targetPath: targets.personalMarketplacePath,
-      description: "Register Personal Codex marketplace entry for the local thoth-agents plugin source.",
-      requiresBackup: existsSync9(targets.personalMarketplacePath),
-      content: targets.personalPluginRoot
-    },
-    {
-      kind: "user-config",
-      action: "merge-toml",
-      targetPath: targets.configPath,
-      description: "Merge managed Codex feature gates into user config.toml.",
-      requiresBackup: true
-    },
-    {
-      kind: "diagnostic",
-      action: "diagnose-only",
-      targetPath: targets.codexHome,
-      description: "Report /plugins, /hooks, precedence, and capability review steps.",
-      requiresBackup: false
-    }
-  ];
-  return {
-    dryRun: config.dryRun === true,
-    reset: config.reset,
-    items,
-    configPath: targets.configPath,
-    pluginId: config.pluginId,
-    diagnostics: [
-      "Restart Codex, then run /plugins to review and enable the Personal thoth-agents plugin registered through ~/.agents/plugins/marketplace.json.",
-      "Run /hooks to review and trust plugin hooks; features.plugin_hooks does not bypass hook trust review.",
-      "Codex Default mode user-input requests require features.default_mode_request_user_input = true and use the request_user_input tool; other modes may not expose it.",
-      "Higher-precedence Codex config (project, profile, CLI, system, or admin) may override user config feature flags."
-    ],
-    disclaimers: [
-      "Role permissions, provider-per-agent settings, memory governance, and hook enforcement are instruction-level or user-managed unless documented Codex runtime controls are available.",
-      "Codex v1 reset is managed-only; no broad destructive --force behavior is implemented."
-    ]
-  };
-}
-function formatCodexSetupPlan(plan) {
-  const refreshPackageGroups = /* @__PURE__ */ new Map();
-  for (const item of plan.items) {
-    if (item.action !== "refresh-package") continue;
-    const group = refreshPackageGroups.get(item.kind) ?? [];
-    group.push(item);
-    refreshPackageGroups.set(item.kind, group);
-  }
-  const renderedRefreshKinds = /* @__PURE__ */ new Set();
-  const lines = [];
-  for (const item of plan.items) {
-    if (item.action !== "refresh-package") {
-      lines.push(`- ${item.action}: ${item.targetPath} (${item.description})`);
-      continue;
-    }
-    if (renderedRefreshKinds.has(item.kind)) continue;
-    renderedRefreshKinds.add(item.kind);
-    lines.push(formatRefreshPackageGroup(item.kind, refreshPackageGroups));
-  }
-  return ["Codex setup plan:", ...lines].join("\n");
-}
-function formatRefreshPackageGroup(kind, groups) {
-  const items = groups.get(kind) ?? [];
-  const description = kind === "personal-plugin-source" ? "Refresh Personal Codex plugin source" : "Refresh documented .codex-plugin package";
-  return `- refresh-package: ${commonTargetDirectory(items)} (${description}, ${items.length} files.)`;
-}
-function commonTargetDirectory(items) {
-  if (items.length === 0) return "";
-  let common = dirname5(items[0]?.targetPath ?? "");
-  for (const item of items.slice(1)) {
-    while (!isSameOrChildPath(item.targetPath, common)) {
-      const parent = dirname5(common);
-      if (parent === common) return common;
-      common = parent;
-    }
-  }
-  return common;
-}
-function isSameOrChildPath(path3, parent) {
-  return path3 === parent || path3.startsWith(`${parent}\\`) || path3.startsWith(`${parent}/`);
-}
-function uniqueMessages(messages) {
-  return [...new Set(messages)];
-}
-function applyCodexSetup(plan) {
-  const changed = [];
-  const diagnostics = uniqueMessages([
-    ...plan.diagnostics,
-    ...plan.disclaimers
-  ]);
-  if (plan.dryRun) return { success: true, changed, diagnostics };
-  try {
-    for (const targetPath of managedRefreshRoots(plan)) {
-      rmSync2(targetPath, { recursive: true, force: true });
-    }
-    for (const item of plan.items) {
-      if (item.action === "diagnose-only") continue;
-      if (item.action === "merge-toml") {
-        const result = writeCodexConfigMerge({
-          configPath: item.targetPath,
-          dryRun: false,
-          pluginId: plan.pluginId
-        });
-        diagnostics.push(...result.diffSummary, ...result.warnings);
-        if (!result.success) throw new Error(result.error);
-        if (result.changed) changed.push(item.targetPath);
-        continue;
-      }
-      if (item.action === "merge-marketplace") {
-        if (item.content === void 0) continue;
-        const content2 = mergePersonalMarketplace(
-          existsSync9(item.targetPath) ? readFileSync7(item.targetPath, "utf8") : "",
-          dirname5(dirname5(dirname5(item.targetPath))),
-          item.content
-        );
-        if (writeTextWithBackup(item.targetPath, content2))
-          changed.push(item.targetPath);
-        continue;
-      }
-      if (item.content === void 0) continue;
-      const content = item.action === "merge-managed-block" ? mergeManagedBlock(
-        existsSync9(item.targetPath) ? readFileSync7(item.targetPath, "utf8") : "",
-        item.content
-      ) : item.content;
-      if (writeTextWithBackup(item.targetPath, content))
-        changed.push(item.targetPath);
-    }
-    return { success: true, changed, diagnostics: uniqueMessages(diagnostics) };
-  } catch (error) {
-    return {
-      success: false,
-      changed,
-      diagnostics: uniqueMessages(diagnostics),
-      error: error instanceof Error ? error.message : String(error)
-    };
-  }
-}
-function managedRefreshRoots(plan) {
-  const refreshGroups = /* @__PURE__ */ new Map();
-  for (const item of plan.items) {
-    if (item.action !== "refresh-package") continue;
-    const group = refreshGroups.get(item.kind) ?? [];
-    group.push(item);
-    refreshGroups.set(item.kind, group);
-  }
-  return [...refreshGroups].filter(([kind]) => kind === "personal-plugin-source").map(([, items]) => commonTargetDirectory(items)).filter((path3) => path3.length > 0);
-}
-
-// src/cli/system.ts
-import { statSync as statSync4 } from "fs";
-
-// src/utils/subprocess.ts
-import {
-  spawn as nodeSpawn,
-  spawnSync as nodeSpawnSync
-} from "child_process";
-import { Readable } from "stream";
-function emptyReadableStream() {
-  return new ReadableStream({
-    start(controller) {
-      controller.close();
-    }
-  });
-}
-function toWebReadable(stream) {
-  if (!stream) {
-    return emptyReadableStream();
-  }
-  return Readable.toWeb(
-    stream
-  );
-}
-function fallbackStdin() {
-  return {
-    write: () => void 0,
-    end: () => void 0
-  };
-}
-function spawn(command, options = {}) {
-  const child = nodeSpawn(command[0], command.slice(1), {
-    cwd: options.cwd,
-    env: options.env,
-    stdio: [
-      options.stdin ?? "pipe",
-      options.stdout ?? "pipe",
-      options.stderr ?? "pipe"
-    ]
-  });
-  const managed = {
-    stdin: child.stdin ?? fallbackStdin(),
-    stdout: toWebReadable(child.stdout),
-    stderr: toWebReadable(child.stderr),
-    exited: new Promise((resolve2) => {
-      child.on("exit", (code) => {
-        managed.exitCode = code;
-        resolve2(code ?? 1);
-      });
-      child.on("error", () => {
-        managed.exitCode = 1;
-        resolve2(1);
-      });
-    }),
-    exitCode: child.exitCode,
-    kill: () => {
-      child.kill();
-    }
-  };
-  return managed;
-}
-
-// src/cli/system.ts
-var cachedOpenCodePath = null;
-function getOpenCodePaths() {
-  const home = process.env.HOME || process.env.USERPROFILE || "";
-  return [
-    // PATH (try this first)
-    "opencode",
-    // User local installations (Linux & macOS)
-    `${home}/.local/bin/opencode`,
-    `${home}/.opencode/bin/opencode`,
-    `${home}/bin/opencode`,
-    // System-wide installations
-    "/usr/local/bin/opencode",
-    "/opt/opencode/bin/opencode",
-    "/usr/bin/opencode",
-    "/bin/opencode",
-    // macOS specific
-    "/Applications/OpenCode.app/Contents/MacOS/opencode",
-    `${home}/Applications/OpenCode.app/Contents/MacOS/opencode`,
-    // Homebrew (macOS & Linux)
-    "/opt/homebrew/bin/opencode",
-    "/home/linuxbrew/.linuxbrew/bin/opencode",
-    `${home}/homebrew/bin/opencode`,
-    // macOS user Library
-    `${home}/Library/Application Support/opencode/bin/opencode`,
-    // Snap (Linux)
-    "/snap/bin/opencode",
-    "/var/snap/opencode/current/bin/opencode",
-    // Flatpak (Linux)
-    "/var/lib/flatpak/exports/bin/ai.opencode.OpenCode",
-    `${home}/.local/share/flatpak/exports/bin/ai.opencode.OpenCode`,
-    // Nix (Linux/macOS)
-    "/nix/store/opencode/bin/opencode",
-    `${home}/.nix-profile/bin/opencode`,
-    "/run/current-system/sw/bin/opencode",
-    // Cargo (Rust toolchain)
-    `${home}/.cargo/bin/opencode`,
-    // npm/npx global
-    `${home}/.npm-global/bin/opencode`,
-    "/usr/local/lib/node_modules/opencode/bin/opencode",
-    // Yarn global
-    `${home}/.yarn/bin/opencode`,
-    // PNPM
-    `${home}/.pnpm-global/bin/opencode`
-  ];
-}
-function resolveOpenCodePath() {
-  if (cachedOpenCodePath) {
-    return cachedOpenCodePath;
-  }
-  const paths = getOpenCodePaths();
-  for (const opencodePath of paths) {
-    if (opencodePath === "opencode") continue;
-    try {
-      const stat = statSync4(opencodePath);
-      if (stat.isFile()) {
-        cachedOpenCodePath = opencodePath;
-        return opencodePath;
-      }
-    } catch {
-    }
-  }
-  return "opencode";
-}
-async function isOpenCodeInstalled() {
-  const paths = getOpenCodePaths();
-  for (const opencodePath of paths) {
-    try {
-      const proc = spawn([opencodePath, "--version"], {
-        stdout: "pipe",
-        stderr: "pipe"
-      });
-      await proc.exited;
-      if (proc.exitCode === 0) {
-        cachedOpenCodePath = opencodePath;
-        return true;
-      }
-    } catch {
-    }
-  }
-  return false;
-}
-async function getOpenCodeVersion() {
-  const opencodePath = resolveOpenCodePath();
-  try {
-    const proc = spawn([opencodePath, "--version"], {
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    const output = await new Response(proc.stdout).text();
-    await proc.exited;
-    if (proc.exitCode === 0) {
-      return output.trim();
-    }
-  } catch {
-  }
-  return null;
-}
-function getOpenCodePath() {
-  const path3 = resolveOpenCodePath();
-  return path3 === "opencode" ? null : path3;
-}
-
-// src/cli/skills.ts
-import { spawnSync } from "child_process";
-var RECOMMENDED_SKILLS = [
-  {
-    name: "simplify",
-    repo: "https://github.com/brianlovin/claude-config",
-    skillName: "simplify",
-    description: "YAGNI code simplification expert"
-  },
-  {
-    name: "playwright-cli",
-    repo: "https://github.com/microsoft/playwright-cli",
-    skillName: "playwright-cli",
-    description: "Browser automation for visual checks and testing"
-  }
-];
-function installSkill(skill) {
-  const args = [
-    "skills",
-    "add",
-    skill.repo,
-    "--skill",
-    skill.skillName,
-    "-a",
-    "opencode",
-    "-y",
-    "--global"
-  ];
-  try {
-    const result = spawnSync("npx", args, { stdio: "inherit" });
-    if (result.status !== 0) {
-      return false;
-    }
-    if (skill.postInstallCommands && skill.postInstallCommands.length > 0) {
-      console.log(`Running post-install commands for ${skill.name}...`);
-      for (const cmd of skill.postInstallCommands) {
-        console.log(`> ${cmd}`);
-        const [command, ...cmdArgs] = cmd.split(" ");
-        const cmdResult = spawnSync(command, cmdArgs, { stdio: "inherit" });
-        if (cmdResult.status !== 0) {
-          console.warn(`Post-install command failed: ${cmd}`);
-        }
-      }
-    }
-    return true;
-  } catch (error) {
-    console.error(`Failed to install skill: ${skill.name}`, error);
-    return false;
-  }
-}
+// src/cli/index.ts
+import { pathToFileURL } from "url";
 
 // src/cli/install.ts
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { cwd } from "process";
 var GREEN = "\x1B[32m";
 var BLUE = "\x1B[34m";
 var YELLOW = "\x1B[33m";
@@ -4125,11 +104,11 @@ async function checkOpenCodeInstalled() {
     return { ok: false };
   }
   const version = await getOpenCodeVersion();
-  const path3 = getOpenCodePath();
+  const path = getOpenCodePath();
   const detectedVersion = version ?? "";
-  const pathInfo = path3 ? ` (${DIM}${path3}${RESET})` : "";
+  const pathInfo = path ? ` (${DIM}${path}${RESET})` : "";
   printSuccess(`OpenCode ${detectedVersion} detected${pathInfo}`);
-  return { ok: true, version: version ?? void 0, path: path3 ?? void 0 };
+  return { ok: true, version: version ?? void 0, path: path ?? void 0 };
 }
 function handleStepResult(result, successMsg) {
   if (!result.success) {
@@ -4195,7 +174,7 @@ ${JSON.stringify(liteConfig, null, 2)}
 `);
   } else {
     const configPath = getExistingLiteConfigPath();
-    const configExists = existsSync10(configPath);
+    const configExists = existsSync(configPath);
     if (configExists && !config.reset) {
       printInfo(
         `Configuration already exists at ${configPath}. Use --reset to overwrite.`
@@ -4221,17 +200,23 @@ ${JSON.stringify(liteConfig, null, 2)}
       }
     } else {
       let skillsInstalled = 0;
+      let skillsAlreadyInstalled = 0;
       for (const skill of RECOMMENDED_SKILLS) {
         printInfo(`Installing ${skill.name}...`);
-        if (installSkill(skill)) {
+        const result = installRecommendedSkill(skill);
+        if (result.status === "installed") {
           printSuccess(`Installed: ${skill.name}`);
           skillsInstalled++;
-        } else {
+        } else if (result.status === "already-installed") {
           printInfo(`Skipped: ${skill.name} (already installed)`);
+          skillsAlreadyInstalled++;
+        } else {
+          printError(`Failed to install recommended skill: ${skill.name}`);
+          return 1;
         }
       }
       printSuccess(
-        `${skillsInstalled}/${RECOMMENDED_SKILLS.length} skills processed`
+        `${skillsInstalled} installed, ${skillsAlreadyInstalled} already installed`
       );
     }
   }
@@ -4312,7 +297,7 @@ async function install(args) {
       reset: config.reset,
       scope: "user",
       projectRoot: cwd(),
-      homeDir: homedir3()
+      homeDir: homedir()
     });
     console.log(formatCodexSetupPlan(plan));
     const result = applyCodexSetup(plan);
@@ -4329,7 +314,446 @@ async function install(args) {
   return runInstall(config);
 }
 
-// src/cli/index.ts
+// src/cli/commands.ts
+function formatHarnessName(harness) {
+  const metadata = getOperationHarness(harness);
+  return `${metadata.displayName} (${metadata.id})`;
+}
+function formatTarget(target) {
+  const label = target.label ? `${target.label}: ` : "";
+  const location = target.path ?? target.description ?? target.kind;
+  const state = target.state ? ` [${target.state}]` : "";
+  const expected = target.expected ? ` expected ${target.expected}` : "";
+  const observed = target.observed ? ` observed ${target.observed}` : "";
+  return `- ${label}${location}${state}${expected}${observed}`;
+}
+function formatPaths(paths) {
+  return paths.map((path) => {
+    const label = path.label ? `${path.label}: ` : "";
+    return `- ${label}${path.path}`;
+  });
+}
+function formatWarnings(warnings) {
+  return warnings.map(
+    (warning) => `- [${warning.severity}] ${warning.message}`
+  );
+}
+function formatDisclaimers(disclaimers) {
+  return disclaimers.map((disclaimer) => `- ${disclaimer.message}`);
+}
+function formatBackup(backup) {
+  const lines = [
+    `Backup: ${backup.required ? "required" : "not required"} (${backup.strategy})`
+  ];
+  if (backup.description) {
+    lines.push(`Backup note: ${backup.description}`);
+  }
+  if (backup.destinations && backup.destinations.length > 0) {
+    lines.push("Backup paths:", ...formatPaths(backup.destinations));
+  }
+  return lines;
+}
+function joinSections(sections) {
+  return sections.filter((section) => section.length > 0).map((section) => section.join("\n")).join("\n\n");
+}
+function formatHarnessStatusReport(reports) {
+  return joinSections(
+    reports.map((report) => [
+      `${report.displayName ?? getOperationHarness(report.harness).displayName} (${report.harness})`,
+      `State: ${report.state}`,
+      `Summary: ${report.summary}`,
+      ...report.targets.length > 0 ? ["Targets:", ...report.targets.map(formatTarget)] : [],
+      ...report.diagnostics.length > 0 ? ["Warnings:", ...formatWarnings(report.diagnostics)] : [],
+      ...report.disclaimers && report.disclaimers.length > 0 ? ["Disclaimers:", ...formatDisclaimers(report.disclaimers)] : [],
+      ...report.actions.length > 0 ? [
+        "Actions:",
+        ...report.actions.map(
+          (action) => `- ${action.label} - ${action.description}`
+        )
+      ] : []
+    ])
+  );
+}
+function formatHarnessList(harnesses) {
+  return joinSections(
+    harnesses.map((harness) => [
+      `${harness.displayName} [${harness.available ? "available" : "unavailable"}]`,
+      harness.description,
+      ...harness.reason ? [`Reason: ${harness.reason}`] : [],
+      ...harness.actions.length > 0 ? [
+        "Actions:",
+        ...harness.actions.map(
+          (action) => `- ${action.label} - ${action.description}`
+        )
+      ] : []
+    ])
+  );
+}
+function formatOperationPlan(plan) {
+  return joinSections([
+    [
+      plan.title,
+      `Target harness: ${formatHarnessName(plan.harness)}`,
+      `Action: ${plan.action}`,
+      `Dry run: ${plan.dryRun ? "yes" : "no"}`,
+      `Can apply: ${plan.canApply ? "yes" : "no"}`,
+      `Summary: ${plan.summary}`
+    ],
+    plan.targets.length > 0 ? ["Targets:", ...plan.targets.map(formatTarget)] : [],
+    plan.surfaces.length > 0 ? [
+      "Managed surfaces:",
+      ...plan.surfaces.map(
+        (surface) => `- ${surface.label}${surface.path ? `: ${surface.path}` : ""}${surface.state ? ` [${surface.state}]` : ""}`
+      )
+    ] : [],
+    formatBackup(plan.backup),
+    plan.items.length > 0 ? [
+      "Plan items:",
+      ...plan.items.flatMap((item) => [
+        `- ${item.title}`,
+        `  Target: ${item.target.path ?? item.target.label ?? item.target.kind}`,
+        ...item.state ? [`  State: ${item.state}`] : [],
+        ...item.preview ? [`  Preview: ${item.preview}`] : []
+      ])
+    ] : [],
+    plan.warnings.length > 0 ? ["Warnings:", ...formatWarnings(plan.warnings)] : [],
+    plan.disclaimers.length > 0 ? ["Disclaimers:", ...formatDisclaimers(plan.disclaimers)] : []
+  ]);
+}
+function formatOperationApplyResult(result) {
+  return joinSections([
+    [
+      `Target harness: ${formatHarnessName(result.harness)}`,
+      `Action: ${result.action}`,
+      `Applied: ${result.applied ? "yes" : "no"}`,
+      `Summary: ${result.summary}`
+    ],
+    result.changedTargets.length > 0 ? ["Changed targets:", ...result.changedTargets.map(formatTarget)] : [],
+    result.backups.length > 0 ? ["Backups:", ...formatPaths(result.backups)] : [],
+    result.warnings.length > 0 ? ["Warnings:", ...formatWarnings(result.warnings)] : [],
+    result.disclaimers.length > 0 ? ["Disclaimers:", ...formatDisclaimers(result.disclaimers)] : []
+  ]);
+}
+function printHelp() {
+  console.log(`
+thoth-agents CLI (npm binary: thoth-agents)
+
+Usage: thoth-agents [COMMAND] [OPTIONS]
+       npx thoth-agents@latest [COMMAND] [OPTIONS]
+       pnpm dlx thoth-agents@latest [COMMAND] [OPTIONS]
+       pnpm dlx thoth-agents install [OPTIONS]
+       pnpm dlx thoth-agents generate --harness=codex --dry-run
+
+Commands:
+  (no command)          Open the interactive TUI in a TTY; fall back to OpenCode install in CI/non-TTY
+  install               Install OpenCode or Codex agent assets
+  generate              Generate harness-specific artifacts
+  status                Show managed install status
+  list                  List managed surfaces and actions
+  update                Preview managed updates
+  sync                  Preview managed configuration sync
+  model                 Preview role model/provider settings
+
+Options:
+  --tmux=yes|no          Enable tmux integration (yes/no)
+  --skills=yes|no        Install recommended external skills
+  --no-tui               Non-interactive mode
+  --dry-run              Simulate install without writing files
+  --reset                Repair managed installer-owned targets
+  --agent=opencode|codex Select OpenCode plugin install (default) or Codex agent-pack setup
+  -h, --help             Show this help message
+
+Generate options:
+  --harness=codex        Explicitly select Codex artifact generation
+  --output-root=PATH     Override generation root metadata
+
+OpenCode plugin config and the npm binary are separate surfaces.
+OpenCode loads the plugin with config such as:
+  plugin: ["thoth-agents@latest"]
+
+That plugin entry does not create a global thoth-agents command.
+Run this CLI through a global install, npx, or pnpm dlx.
+
+OpenCode install configures the seven-agent roster, thoth-mem defaults,
+native task delegation, and bundled SDD skills for OpenCode.
+
+Bundled thoth-agents skills are always installed.
+Use --skills=no to skip only recommended external skills.
+
+The generated config uses OpenAI by default.
+For alternative providers, see docs/provider-configurations.md.
+
+Examples:
+  thoth-agents
+  pnpm dlx thoth-agents@latest
+  pnpm dlx thoth-agents@latest install
+  pnpm dlx thoth-agents@latest install --agent=opencode
+  pnpm dlx thoth-agents@latest install --agent=codex
+  pnpm dlx thoth-agents@latest install --agent=codex --dry-run
+  pnpm dlx thoth-agents install --no-tui --tmux=no --skills=yes
+  pnpm dlx thoth-agents install --dry-run
+  pnpm dlx thoth-agents install --reset
+  pnpm dlx thoth-agents generate --harness=codex --dry-run
+`);
+}
+function operationContext() {
+  return { cwd: process.cwd() };
+}
+function selectedHarness(args, fallback = "opencode") {
+  return args.harness ?? fallback;
+}
+function statusReports(args) {
+  const harnesses = args.all || !args.harness ? SUPPORTED_OPERATION_HARNESSES : [args.harness];
+  const context = operationContext();
+  return harnesses.map(
+    (harness) => harness === "opencode" ? getOpenCodeStatus(context) : getCodexStatus(context)
+  );
+}
+function buildOperationPlan(command, args) {
+  const harness = selectedHarness(args);
+  const context = operationContext();
+  if (harness === "opencode") {
+    return command === "update" ? buildOpenCodeUpdatePlan(context) : buildOpenCodeSyncPlan(context);
+  }
+  return command === "update" ? buildCodexUpdatePlan(context) : buildCodexSyncPlan(context);
+}
+function defaultModelRoles(harness) {
+  if (harness === "codex") {
+    return CODEX_ROLE_NAMES.map((role) => ({
+      role,
+      model: "openai/gpt-5.4-mini"
+    }));
+  }
+  return ALL_AGENT_NAMES.map((role) => ({
+    role,
+    model: DEFAULT_MODELS[role] ?? "openai/gpt-5.4"
+  }));
+}
+function modelRoles(harness, roles) {
+  return roles.length > 0 ? [...roles] : defaultModelRoles(harness);
+}
+function printModelGuidance() {
+  console.log(
+    [
+      "Model command requires explicit model input.",
+      "Examples:",
+      "  thoth-agents model --harness=codex --role=deep --model=openai/gpt-5.4-mini",
+      "  thoth-agents model --harness=opencode --role-model=deep=openai/gpt-5.4",
+      "Preview is the default. Add --apply only after reviewing the plan."
+    ].join("\n")
+  );
+  return 1;
+}
+function buildModelPlan(args) {
+  if (args.roles.length === 0) return void 0;
+  const harness = selectedHarness(args);
+  const context = operationContext();
+  const input = {
+    harness,
+    dryRun: true,
+    roles: modelRoles(harness, args.roles)
+  };
+  return harness === "opencode" ? buildOpenCodeModelPlan(input, context) : buildCodexModelPlan(input, context);
+}
+function applyOperationPlan(plan) {
+  return plan.harness === "opencode" ? applyOpenCodePlan(plan) : applyCodexPlan(plan);
+}
+function printPlanOrApply(plan, args) {
+  if (args.apply && args.dryRun) {
+    console.error("--apply cannot be combined with --dry-run.");
+    return 1;
+  }
+  if (!args.apply) {
+    console.log(formatOperationPlan(plan));
+    return 0;
+  }
+  console.log(formatOperationApplyResult(applyOperationPlan(plan)));
+  return 0;
+}
+function runOperationCommand(command, args) {
+  if (command === "status") {
+    console.log(formatHarnessStatusReport(statusReports(args)));
+    return 0;
+  }
+  if (command === "list") {
+    console.log(formatHarnessList(listOperationHarnesses()));
+    return 0;
+  }
+  if (command === "update" || command === "sync") {
+    return printPlanOrApply(buildOperationPlan(command, args), args);
+  }
+  const plan = buildModelPlan(args);
+  if (!plan) return printModelGuidance();
+  return printPlanOrApply(plan, args);
+}
+function printCodexGeneration(args) {
+  if (!args.dryRun) {
+    console.error(
+      "Codex generation is dry-run only in this MVP. Pass --dry-run."
+    );
+    return 1;
+  }
+  const result = codexAdapter.render({
+    projectRoot: process.cwd(),
+    options: {
+      dryRun: true,
+      outputRoot: args.outputRoot,
+      targetHarness: "codex"
+    }
+  });
+  console.log(JSON.stringify(result, null, 2));
+  return 0;
+}
+async function runCliCommand(parsed) {
+  if (parsed.command === "install") {
+    return install(parsed.installArgs);
+  }
+  if (parsed.command === "generate") {
+    return printCodexGeneration(parsed.generateArgs);
+  }
+  if (parsed.command === "help") {
+    printHelp();
+    return 0;
+  }
+  if (parsed.command === "tui") {
+    const { runInteractiveTui } = await import("./tui/index.js");
+    return runInteractiveTui();
+  }
+  if (parsed.command === "error") {
+    console.error(parsed.message);
+    console.error("Run with --help for usage information");
+    return 1;
+  }
+  return runOperationCommand(parsed.command, parsed.operationArgs);
+}
+
+// src/cli/runtime.ts
+var automationEnvironmentKeys = [
+  "CI",
+  "CONTINUOUS_INTEGRATION",
+  "BUILD_NUMBER",
+  "GITHUB_ACTIONS",
+  "GITLAB_CI",
+  "TF_BUILD",
+  "TEAMCITY_VERSION"
+];
+function isTruthyEnvValue(value) {
+  if (value === void 0 || value === "") return false;
+  const normalized = value.toLowerCase();
+  return normalized !== "0" && normalized !== "false";
+}
+function detectRuntimeContext(processLike = process) {
+  return {
+    stdinIsTTY: processLike.stdin?.isTTY === true,
+    stdoutIsTTY: processLike.stdout?.isTTY === true,
+    stderrIsTTY: processLike.stderr?.isTTY === true,
+    env: { ...processLike.env ?? {} }
+  };
+}
+function isInteractiveRuntime(context) {
+  if (!context.stdinIsTTY || !context.stdoutIsTTY) return false;
+  if (context.env.TERM?.toLowerCase() === "dumb") return false;
+  return !automationEnvironmentKeys.some(
+    (key) => isTruthyEnvValue(context.env[key])
+  );
+}
+
+// src/cli/parser.ts
+var defaultRuntimeContext = {
+  stdinIsTTY: false,
+  stdoutIsTTY: false,
+  env: {}
+};
+var operationCommands = /* @__PURE__ */ new Set([
+  "status",
+  "list",
+  "update",
+  "sync",
+  "model"
+]);
+function parseBooleanArg(name, value) {
+  if (value !== "yes" && value !== "no") {
+    throw new Error(`${name} must be yes or no.`);
+  }
+  return value;
+}
+function parseOperationHarness(value) {
+  if (value !== "opencode" && value !== "codex") {
+    throw new Error(
+      `Unsupported operation harness: ${value}. Supported harnesses: opencode, codex.`
+    );
+  }
+  return value;
+}
+function parseRoleModel(value) {
+  const separator = value.includes("=") ? "=" : ":";
+  const [role, ...modelParts] = value.split(separator);
+  const model = modelParts.join(separator);
+  if (!role || !model) {
+    throw new Error(
+      "--role-model must use role=model or role:model, for example --role-model=deep=openai/gpt-5.4-mini."
+    );
+  }
+  return { role, model };
+}
+function parseOperationArgs(args) {
+  const result = { roles: [] };
+  let pendingRole;
+  let pendingProvider;
+  function pushPendingRole(model) {
+    if (!pendingRole) {
+      throw new Error(
+        "--model requires --role, or pass --role-model=role=model."
+      );
+    }
+    result.roles.push({
+      role: pendingRole,
+      model,
+      provider: pendingProvider
+    });
+    pendingRole = void 0;
+    pendingProvider = void 0;
+  }
+  for (const arg of args) {
+    if (arg.startsWith("--harness=")) {
+      result.harness = parseOperationHarness(arg.split("=")[1] ?? "");
+    } else if (arg.startsWith("--agent=")) {
+      result.harness = parseOperationHarness(arg.split("=")[1] ?? "");
+    } else if (arg === "--all") {
+      result.all = true;
+    } else if (arg === "--apply") {
+      result.apply = true;
+    } else if (arg === "--dry-run") {
+      result.dryRun = true;
+    } else if (arg.startsWith("--role=")) {
+      pendingRole = arg.split("=")[1] ?? "";
+      if (!pendingRole) throw new Error("--role requires a value.");
+    } else if (arg.startsWith("--provider=")) {
+      pendingProvider = arg.split("=")[1] ?? "";
+      if (!pendingProvider) throw new Error("--provider requires a value.");
+    } else if (arg.startsWith("--model=")) {
+      pushPendingRole(arg.split("=")[1] ?? "");
+    } else if (arg.startsWith("--role-model=")) {
+      const parsed = parseRoleModel(arg.slice("--role-model=".length));
+      result.roles.push({
+        ...parsed,
+        provider: pendingProvider
+      });
+      pendingProvider = void 0;
+    } else if (arg === "-h" || arg === "--help") {
+      throw new Error("help");
+    } else {
+      throw new Error(`Unsupported operation option: ${arg}`);
+    }
+  }
+  if (pendingRole) {
+    throw new Error("--role requires a matching --model.");
+  }
+  if (result.all && result.harness) {
+    throw new Error("--all cannot be combined with --harness or --agent.");
+  }
+  return result;
+}
 function parseInstallArgs(args) {
   const result = {
     tui: true,
@@ -4339,9 +763,9 @@ function parseInstallArgs(args) {
     if (arg === "--no-tui") {
       result.tui = false;
     } else if (arg.startsWith("--tmux=")) {
-      result.tmux = arg.split("=")[1];
+      result.tmux = parseBooleanArg("--tmux", arg.split("=")[1] ?? "");
     } else if (arg.startsWith("--skills=")) {
-      result.skills = arg.split("=")[1];
+      result.skills = parseBooleanArg("--skills", arg.split("=")[1] ?? "");
     } else if (arg === "--dry-run") {
       result.dryRun = true;
     } else if (arg === "--reset") {
@@ -4355,8 +779,7 @@ function parseInstallArgs(args) {
       }
       result.agent = agent;
     } else if (arg === "-h" || arg === "--help") {
-      printHelp();
-      process.exit(0);
+      throw new Error("help");
     }
   }
   return result;
@@ -4394,13 +817,26 @@ function parseGenerateArgs(args) {
     }
   };
 }
-function parseCliArgs(args) {
-  if (args.length === 0 || args[0] === "install") {
-    const hasSubcommand = args[0] === "install";
+function parseCliArgs(args, runtimeContext = defaultRuntimeContext) {
+  if (args.length === 0) {
+    if (isInteractiveRuntime(runtimeContext)) {
+      return { command: "tui" };
+    }
+    return {
+      command: "install",
+      installArgs: { tui: false, agent: "opencode" }
+    };
+  }
+  if (args[0] === "install") {
     try {
-      const installArgs = parseInstallArgs(args.slice(hasSubcommand ? 1 : 0));
-      return { command: "install", installArgs };
+      return {
+        command: "install",
+        installArgs: parseInstallArgs(args.slice(1))
+      };
     } catch (error) {
+      if (error instanceof Error && error.message === "help") {
+        return { command: "help" };
+      }
       return {
         command: "error",
         message: error instanceof Error ? error.message : String(error)
@@ -4413,81 +849,32 @@ function parseCliArgs(args) {
   if (args[0] === "-h" || args[0] === "--help") {
     return { command: "help" };
   }
+  if (operationCommands.has(args[0])) {
+    try {
+      return {
+        command: args[0],
+        operationArgs: parseOperationArgs(args.slice(1))
+      };
+    } catch (error) {
+      if (error instanceof Error && error.message === "help") {
+        return { command: "help" };
+      }
+      return {
+        command: "error",
+        message: error instanceof Error ? error.message : String(error)
+      };
+    }
+  }
   return { command: "error", message: `Unknown command: ${args[0]}` };
 }
-function printHelp() {
-  console.log(`
-thoth-agents installer (thoth-agents)
-
-Usage: pnpm dlx thoth-agents install [OPTIONS]
-       pnpm dlx thoth-agents generate --harness=codex --dry-run
-
-Options:
-  --tmux=yes|no          Enable tmux integration (yes/no)
-  --skills=yes|no        Install recommended external skills
-  --no-tui               Non-interactive mode
-  --dry-run              Simulate install without writing files
-  --reset                Repair managed installer-owned targets
-  --agent=opencode|codex Select OpenCode plugin install (default) or Codex agent-pack setup
-  -h, --help             Show this help message
-
-Generate options:
-  --harness=codex        Explicitly select Codex artifact generation
-  --output-root=PATH     Override generation root metadata
-
-thoth-agents installs the seven-agent roster, thoth-mem defaults,
-native task delegation, and bundled SDD skills for OpenCode.
-
-Bundled thoth-agents skills are always installed.
-Use --skills=no to skip only recommended external skills.
-
-The generated config uses OpenAI by default.
-For alternative providers, see docs/provider-configurations.md.
 
-Examples:
-  pnpm dlx thoth-agents@latest install
-  pnpm dlx thoth-agents@latest install --agent=opencode
-  pnpm dlx thoth-agents@latest install --agent=codex
-  pnpm dlx thoth-agents@latest install --agent=codex --dry-run
-  pnpm dlx thoth-agents install --no-tui --tmux=no --skills=yes
-  pnpm dlx thoth-agents install --dry-run
-  pnpm dlx thoth-agents install --reset
-  pnpm dlx thoth-agents generate --harness=codex --dry-run
-`);
-}
-function printCodexGeneration(args) {
-  if (!args.dryRun) {
-    console.error(
-      "Codex generation is dry-run only in this MVP. Pass --dry-run."
-    );
-    return 1;
-  }
-  const result = codexAdapter.render({
-    projectRoot: process.cwd(),
-    options: {
-      dryRun: true,
-      outputRoot: args.outputRoot,
-      targetHarness: "codex"
-    }
-  });
-  console.log(JSON.stringify(result, null, 2));
-  return 0;
-}
+// src/cli/index.ts
 async function main() {
-  const parsed = parseCliArgs(process.argv.slice(2));
-  if (parsed.command === "install") {
-    const exitCode = await install(parsed.installArgs);
-    process.exit(exitCode);
-  } else if (parsed.command === "generate") {
-    process.exit(printCodexGeneration(parsed.generateArgs));
-  } else if (parsed.command === "help") {
-    printHelp();
-    process.exit(0);
-  } else {
-    console.error(parsed.message);
-    console.error("Run with --help for usage information");
-    process.exit(1);
-  }
+  const parsed = parseCliArgs(
+    process.argv.slice(2),
+    detectRuntimeContext(process)
+  );
+  process.exit(await runCliCommand(parsed));
 }
 var entrypointUrl = process.argv[1] ? pathToFileURL(process.argv[1]).href : void 0;
 if (import.meta.url === entrypointUrl) {
@@ -4497,5 +884,7 @@ if (import.meta.url === entrypointUrl) {
   });
 }
 export {
+  detectRuntimeContext,
+  isInteractiveRuntime,
   parseCliArgs
 };