thoth-agents 0.7.0 → 0.9.0

package/dist/cli/index.js

@@ -4,8 +4,9 @@ import {
   getOpenCodeVersion,
   isOpenCodeInstalled,
   opencodeAdapter
-} from "../chunk-3MHJGWS4.js";
+} from "../chunk-V5GDCWFR.js";
 import {
+  CODEX_PLUGIN_ID,
   CODEX_ROLE_NAMES,
   REQUIRED_SKILLS,
   SUPPORTED_OPERATION_HARNESSES,
@@ -17,6 +18,7 @@ import {
   applyOpenCodePlan,
   applyPiPlan,
   applyPiSetup,
+  assertSafeBackupDestination,
   buildClaudeCodeModelPlan,
   buildClaudeCodeSetupPlan,
   buildClaudeCodeSyncPlan,
@@ -33,9 +35,13 @@ import {
   buildPiSetupPlan,
   buildPiSyncPlan,
   buildPiUpdatePlan,
+  checkCodexHookCapability,
   claudeCodeAdapter,
   codexAdapter,
+  codexHookSource,
+  codexHookTrustEntries,
   defaultClaudeCodeModelRoles,
+  defaultCommandExecutor,
   defaultPiModelRoles,
   finalizeHarnessInstall,
   formatClaudeCodeSetupPlan,
@@ -55,15 +61,26 @@ import {
   getRequiredSkillInstallCommand,
   inspectPiPackageSkills,
   installRequiredSkill,
+  isMigratableLegacyRole,
   listOperationHarnesses,
   normalizeEffortSelection,
+  parseCodexToml,
+  parseManagedModelStateJson,
+  patchScalar,
+  planLegacyRootRemoval,
+  readCodexThreadsValue,
+  readInstallLedger,
   recordHarnessInstallCompletion,
+  resolveCodexTargets,
+  roleStructureFingerprint,
+  safeAtomicWriteFileSync,
+  scalarLocation,
   syncOpenCodeOwnedSkills
-} from "../chunk-W5TSNGEE.js";
+} from "../chunk-FBLIVTKM.js";
 import "../chunk-62L3ORXN.js";
 import {
   piAdapter
-} from "../chunk-P3GDM5RH.js";
+} from "../chunk-IJBKUC5J.js";
 import {
   ALL_AGENT_NAMES,
   detectCurrentConfig,
@@ -74,7 +91,7 @@ import {
   resolveExecutingPackageVersion,
   updateOpenCodeMainConfig,
   writeLiteConfig
-} from "../chunk-QOIZYJ5C.js";
+} from "../chunk-ARUBELNT.js";
 
 // src/cli/index.ts
 import { pathToFileURL } from "url";
@@ -91,10 +108,474 @@ function getHarnessAdapter(harness) {
   return HARNESS_ADAPTERS[harness];
 }
 
+// src/cli/codex-hook-consent.ts
+import { createInterface } from "readline/promises";
+
+// src/cli/runtime.ts
+var automationEnvironmentKeys = [
+  "CI",
+  "CONTINUOUS_INTEGRATION",
+  "BUILD_NUMBER",
+  "GITHUB_ACTIONS",
+  "GITLAB_CI",
+  "TF_BUILD",
+  "TEAMCITY_VERSION"
+];
+function isTruthyEnvValue(value) {
+  if (value === void 0 || value === "") return false;
+  const normalized = value.toLowerCase();
+  return normalized !== "0" && normalized !== "false";
+}
+function detectRuntimeContext(processLike = process) {
+  return {
+    stdinIsTTY: processLike.stdin?.isTTY === true,
+    stdoutIsTTY: processLike.stdout?.isTTY === true,
+    stderrIsTTY: processLike.stderr?.isTTY === true,
+    env: { ...processLike.env ?? {} }
+  };
+}
+function isInteractiveRuntime(context) {
+  if (!context.stdinIsTTY || !context.stdoutIsTTY) return false;
+  if (context.env.TERM?.toLowerCase() === "dumb") return false;
+  return !automationEnvironmentKeys.some(
+    (key) => isTruthyEnvValue(context.env[key])
+  );
+}
+
+// src/cli/codex-hook-consent.ts
+var CODEX_HOOK_CONSENT_PROMPT = "Trust thoth-agents SessionStart and SubagentStart hooks? Trusted hooks can run outside the sandbox. [y/N] ";
+async function requestCodexHookConsent(options) {
+  if (options.trustHooks) return true;
+  if (options.dryRun || !isInteractiveRuntime(detectRuntimeContext()))
+    return false;
+  const prompt = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  try {
+    return /^(y|yes)$/i.test(
+      (await prompt.question(CODEX_HOOK_CONSENT_PROMPT)).trim()
+    );
+  } finally {
+    prompt.close();
+  }
+}
+
+// src/cli/codex-lifecycle.ts
+import { spawnSync } from "child_process";
+import { createHash } from "crypto";
+import { copyFileSync, lstatSync, readFileSync, rmSync } from "fs";
+import { basename, dirname, join, parse, resolve } from "path";
+function repairCommand(context) {
+  return context.localPluginBundlePath || context.pluginId === "thoth-agents@personal" ? "pnpm run setup:codex:local" : "thoth-agents update --agent=codex --apply";
+}
+function readBytes(path) {
+  const absolute = resolve(path);
+  let cursor = parse(absolute).root;
+  for (const part of absolute.slice(cursor.length).split(/[\\/]/)) {
+    cursor = join(cursor, part);
+    try {
+      if (lstatSync(cursor).isSymbolicLink())
+        throw new Error(`Unsafe symlink: ${cursor}`);
+    } catch (error) {
+      if (error.code === "ENOENT") return void 0;
+      throw error;
+    }
+  }
+  return readFileSync(path);
+}
+function read(path) {
+  return readBytes(path)?.toString("utf8");
+}
+function readConfig(path) {
+  const bytes = readBytes(path);
+  const text = bytes?.toString("utf8") ?? "";
+  if (bytes && !Buffer.from(text, "utf8").equals(bytes))
+    throw new Error(
+      `Invalid UTF-8 config; preserve ${path} and review manually.`
+    );
+  return text;
+}
+function snapshot(context) {
+  const targets = resolveCodexTargets({
+    scope: "user",
+    projectRoot: context.cwd,
+    homeDir: context.homeDir,
+    codexHome: context.codexHome
+  });
+  const stateBytes = readBytes(targets.managedModelsPath);
+  const stateText = stateBytes?.toString("utf8");
+  if (stateText !== void 0) {
+    const raw = JSON.parse(stateText);
+    if (raw?.version !== 1 || !raw.models || typeof raw.models !== "object" || Array.isArray(raw.models))
+      throw new Error(
+        "Unreadable managed model state; repair it manually before uninstall."
+      );
+    if (raw.priorThreadsValue !== void 0 && raw.priorThreadsValue !== null && (typeof raw.priorThreadsValue !== "string" || !/^\+?\d[\d_]*$/.test(raw.priorThreadsValue)))
+      throw new Error("Invalid prior threads ownership state.");
+    for (const field of ["roleDigests", "roleStructureDigests"])
+      if (raw[field] !== void 0 && (typeof raw[field] !== "object" || raw[field] === null || Array.isArray(raw[field]) || Object.values(raw[field]).some(
+        (value) => typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)
+      )))
+        throw new Error(`Invalid ${field} ownership state.`);
+    if (raw.ownedHookTrustKeys !== void 0 && (!Array.isArray(raw.ownedHookTrustKeys) || raw.ownedHookTrustKeys.some(
+      (key) => typeof key !== "string" || !key.startsWith(`${codexHookSource(context.pluginId)}:`)
+    )))
+      throw new Error("Invalid hook ownership state.");
+  }
+  const state = parseManagedModelStateJson(stateText, 1);
+  const config = readConfig(targets.configPath);
+  parseCodexToml(config);
+  const roles = targets.roleAgentPaths.map((target) => {
+    const bytes = readBytes(target.path);
+    const content = bytes?.toString("utf8");
+    const key = basename(target.path);
+    const status = bytes === void 0 ? "missing" : createHash("sha256").update(bytes).digest("hex") === state.roleDigests?.[key] ? "owned" : roleStructureFingerprint(content ?? "") === state.roleStructureDigests?.[key] ? "model-edited" : "drifted";
+    return { ...target, content, bytes, status };
+  });
+  return { targets, state, stateBytes, config, roles };
+}
+function trust(context) {
+  const capability = checkCodexHookCapability({
+    projectRoot: context.cwd,
+    homeDir: context.homeDir,
+    codexHome: context.codexHome,
+    commandExecutor: context.codexPluginCommandExecutor,
+    pluginId: context.pluginId,
+    localPluginBundlePath: context.localPluginBundlePath
+  });
+  const entries = capability.bundlePath ? codexHookTrustEntries(
+    JSON.parse(
+      readFileSync(
+        join(capability.bundlePath, "codex-hooks", "hooks.json"),
+        "utf8"
+      )
+    ),
+    codexHookSource(context.pluginId),
+    process.platform
+  ) : {};
+  return { capability, entries };
+}
+function storedHash(content, key) {
+  const document = parseCodexToml(content);
+  const hooks = document.hooks;
+  if (!hooks || typeof hooks !== "object" || Array.isArray(hooks))
+    return void 0;
+  const state = hooks.state;
+  if (!state || typeof state !== "object" || Array.isArray(state))
+    return void 0;
+  const entry = state[key];
+  return entry && typeof entry === "object" && !Array.isArray(entry) ? entry.trusted_hash : void 0;
+}
+function removeScalar(content, path) {
+  const { lines, match, sectionStart, sectionEnd } = scalarLocation(
+    content,
+    path
+  );
+  if (match) {
+    if (path[0] === "hooks" && sectionStart >= 0 && lines.slice(sectionStart + 1, sectionEnd).every(
+      (line, index) => sectionStart + 1 + index === match.index || /^\s*(?:#.*)?$/.test(line.text)
+    ))
+      lines[sectionStart].text = "";
+    lines.splice(match.index, 1);
+  }
+  return lines.map((line) => line.text + line.eol).join("");
+}
+function uninstallCodex(context, dryRun = false) {
+  const messages = [];
+  const mutations = [];
+  try {
+    let unchanged2 = function(path, expected) {
+      try {
+        const current = readBytes(path);
+        if (current === void 0 ? expected === void 0 : expected !== void 0 && current.equals(expected))
+          return true;
+      } catch {
+      }
+      messages.push(`Preserve concurrently changed ${path}; review manually.`);
+      return false;
+    }, ownershipUnchanged2 = function() {
+      return unchanged2(targets.managedModelsPath, stateBytes);
+    };
+    var unchanged = unchanged2, ownershipUnchanged = ownershipUnchanged2;
+    const { targets, state, stateBytes, config, roles } = snapshot(context);
+    const ledger = readInstallLedger(
+      context.installLedgerOptions ?? { homeDir: context.homeDir }
+    );
+    if (ledger.status === "invalid") throw new Error(ledger.error);
+    const recovery = join(
+      dirname(targets.managedModelsPath),
+      ".thoth-agents-install-recovery.json"
+    );
+    const recoveryText = read(recovery);
+    if (recoveryText !== void 0) {
+      const raw = JSON.parse(recoveryText);
+      if (raw?.version !== 1 || !raw.roles || typeof raw.roles !== "object" || Array.isArray(raw.roles) || Object.values(raw.roles).some(
+        (value) => typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)
+      ))
+        throw new Error("Unreadable recovery journal; repair manually.");
+    }
+    for (const role of roles) {
+      if (role.status === "owned" || role.status === "model-edited") {
+        messages.push(`Remove ${role.path} (${role.status})`);
+        mutations.push(() => {
+          if (ownershipUnchanged2() && unchanged2(role.path, role.bytes))
+            rmSync(role.path);
+        });
+      } else
+        messages.push(
+          `Preserve ${role.path} (${role.status}); review manually.`
+        );
+    }
+    const root = planLegacyRootRemoval(targets.rootInstructionsPath);
+    messages.push(...root.diagnostics);
+    for (const item of root.items) {
+      const bytes = item.remainingRootBytes;
+      if (!bytes)
+        throw new Error("Legacy root removal is missing its preserved bytes.");
+      messages.push(item.description);
+      mutations.push(() => {
+        if (!unchanged2(item.targetPath, item.legacyRootBytes)) return;
+        assertSafeBackupDestination(`${item.targetPath}.bak`);
+        copyFileSync(item.targetPath, `${item.targetPath}.bak`);
+        if (bytes.every((byte) => byte === 32 || byte >= 9 && byte <= 13))
+          rmSync(item.targetPath);
+        else safeAtomicWriteFileSync(item.targetPath, bytes);
+      });
+    }
+    let patched = config;
+    const configPaths = [];
+    if (state.priorThreadsValue !== void 0) {
+      const current = readCodexThreadsValue(config);
+      if (current !== null && Number(current.replaceAll("_", "")) === 6) {
+        configPaths.push(["agents", "max_concurrent_threads_per_session"]);
+        patched = state.priorThreadsValue === null ? removeScalar(patched, [
+          "agents",
+          "max_concurrent_threads_per_session"
+        ]) : patchScalar(
+          patched,
+          ["agents", "max_concurrent_threads_per_session"],
+          state.priorThreadsValue
+        );
+        messages.push(
+          `Restore threads setting to ${state.priorThreadsValue ?? "absent"}`
+        );
+      } else
+        messages.push(
+          "Preserve operator-changed threads setting; review config.toml manually."
+        );
+    }
+    if (state.ownedHookTrustKeys?.length) {
+      const { entries } = trust(context);
+      for (const key of state.ownedHookTrustKeys) {
+        const path = ["hooks", "state", key, "trusted_hash"];
+        const value = storedHash(patched, key);
+        if (entries[key] && value === entries[key]) {
+          configPaths.push(path);
+          patched = removeScalar(patched, path);
+          messages.push(`Remove owned hook trust ${key}`);
+        } else
+          messages.push(
+            `Preserve hook trust ${key}: changed or original hash unverifiable; review in Codex.`
+          );
+      }
+    }
+    if (patched !== config)
+      mutations.push(() => {
+        if (!ownershipUnchanged2()) return;
+        let current;
+        try {
+          current = readConfig(targets.configPath);
+        } catch {
+          messages.push(
+            `Preserve concurrently changed ${targets.configPath}; review manually.`
+          );
+          return;
+        }
+        let rebased = current;
+        for (const path of configPaths) {
+          const before = scalarLocation(config, path).match?.value;
+          if (scalarLocation(current, path).match?.value !== before) {
+            messages.push(
+              `Preserve concurrently changed ${path.join(".")}; review config.toml manually.`
+            );
+            continue;
+          }
+          const after = scalarLocation(patched, path).match?.value;
+          rebased = after === void 0 ? removeScalar(rebased, path) : patchScalar(rebased, path, after);
+        }
+        if (rebased !== current) {
+          assertSafeBackupDestination(`${targets.configPath}.bak`);
+          copyFileSync(targets.configPath, `${targets.configPath}.bak`);
+          safeAtomicWriteFileSync(targets.configPath, rebased);
+        }
+      });
+    messages.push(
+      `Run codex plugin remove ${context.pluginId ?? CODEX_PLUGIN_ID} --json`
+    );
+    messages.push(
+      `Preserve ${(context.pluginId ?? CODEX_PLUGIN_ID).split("@")[1]} marketplace: registration ownership/other consumers not determinable.`,
+      "Not removed: provider-owned thoth-mem surfaces and external skills."
+    );
+    for (const path of [recovery, targets.managedModelsPath]) {
+      const expected = readBytes(path);
+      if (expected !== void 0) {
+        messages.push(`Remove managed state ${path}`);
+        mutations.push(() => {
+          if (unchanged2(path, expected)) rmSync(path);
+        });
+      }
+    }
+    if (ledger.status === "valid" && ledger.ledger.harnesses.codex) {
+      const next = {
+        ...ledger.ledger,
+        harnesses: { ...ledger.ledger.harnesses }
+      };
+      delete next.harnesses.codex;
+      const ledgerBytes = readBytes(ledger.path);
+      messages.push("Remove codex install ledger entry");
+      mutations.push(() => {
+        if (unchanged2(ledger.path, ledgerBytes))
+          safeAtomicWriteFileSync(
+            ledger.path,
+            `${JSON.stringify(next, null, 2)}
+`
+          );
+      });
+    }
+    if (!dryRun) {
+      if (patched !== config)
+        assertSafeBackupDestination(`${targets.configPath}.bak`);
+      for (const item of root.items)
+        assertSafeBackupDestination(`${item.targetPath}.bak`);
+      const result = (context.codexPluginCommandExecutor ?? defaultCommandExecutor)(
+        "codex",
+        ["plugin", "remove", context.pluginId ?? CODEX_PLUGIN_ID, "--json"],
+        {
+          cwd: context.cwd
+        }
+      );
+      if (result.exitCode !== 0)
+        throw new Error(
+          `Native plugin removal failed: ${result.stderr}; local ownership state retained.`
+        );
+      for (const mutate of mutations) mutate();
+    }
+    return { success: true, messages };
+  } catch (error) {
+    return { success: false, messages: [...messages, String(error)] };
+  }
+}
+function doctorCodex(context) {
+  const messages = [];
+  let success = true;
+  let fix = repairCommand(context);
+  function finding(label, ok, fix2) {
+    messages.push(ok ? label : `${label}; Fix: ${fix2}`);
+    if (!ok) success = false;
+  }
+  try {
+    const executor = context.codexPluginCommandExecutor ?? defaultCommandExecutor;
+    let selectedContext = context;
+    let pluginKnown = false;
+    try {
+      const result = executor("codex", ["plugin", "list", "--json"], {
+        cwd: context.cwd
+      });
+      if (result.exitCode !== 0)
+        throw new Error(
+          `codex plugin list --json exited ${result.exitCode}; stderr: ${result.stderr || "(empty)"}; stdout: ${result.stdout || "(empty)"}`
+        );
+      const plugins = JSON.parse(result.stdout).installed;
+      if (!Array.isArray(plugins))
+        throw new Error("Unreadable native installed plugin list.");
+      const candidates = plugins.filter(
+        (item) => item && typeof item.pluginId === "string" && item.pluginId.startsWith("thoth-agents@")
+      );
+      const plugin = candidates.length === 1 ? candidates[0] : void 0;
+      if (plugin) {
+        pluginKnown = true;
+        selectedContext = {
+          ...context,
+          pluginId: plugin.pluginId,
+          localPluginBundlePath: plugin.source?.source === "local" && typeof plugin.source.path === "string" ? plugin.source.path : context.localPluginBundlePath
+        };
+      }
+      fix = repairCommand(selectedContext);
+      finding(
+        `Plugin: ${candidates.length > 1 ? `ambiguous (${candidates.map((item) => `${item.pluginId}, enabled=${item.enabled}`).join("; ")})` : plugin ? `installed (${plugin.pluginId})` : "missing"}, enabled=${plugin?.enabled ?? false}, version=${plugin?.version ?? "unknown"}`,
+        !!plugin?.enabled,
+        candidates.length > 1 ? "Select exactly one thoth-agents plugin in Codex native plugin management." : fix
+      );
+    } catch (error) {
+      finding(
+        `Plugin inspection failed: ${String(error)}`,
+        false,
+        "Run codex plugin list --json; resolve the captured native error."
+      );
+    }
+    const { targets, state, config, roles } = snapshot(selectedContext);
+    const { capability, entries } = pluginKnown ? trust(selectedContext) : { capability: { success: false }, entries: {} };
+    finding(
+      `Hook capability: ${capability.success ? "available" : "unavailable"}`,
+      capability.success,
+      fix
+    );
+    if (!Object.keys(entries).length)
+      for (const event of ["session_start", "subagent_start"])
+        finding(
+          `Hook ${codexHookSource(selectedContext.pluginId)}:${event}:0:0: not applicable (no hook-capable bundle)`,
+          true,
+          fix
+        );
+    for (const [key, hash] of Object.entries(entries)) {
+      const raw = storedHash(config, key);
+      const status = raw === void 0 ? "untrusted" : raw === hash ? "trusted" : "modified";
+      finding(
+        `Hook ${key}: ${status}`,
+        status === "trusted",
+        `Review and trust this handler in Codex native hook review; refresh declarations if needed with ${fix}.`
+      );
+    }
+    const node = context.nodeAvailable?.() ?? spawnSync("node", ["--version"], { encoding: "utf8", timeout: 1e4 }).status === 0;
+    finding(
+      `Node on PATH: ${node ? "available" : "missing"}`,
+      node,
+      "Install Node.js >=22.19 and restart Codex with Node on PATH."
+    );
+    for (const role of roles)
+      finding(
+        `Agent ${role.role}: ${role.content && isMigratableLegacyRole(role.content, role.role) ? "legacy full TOML (migratable)" : role.status}`,
+        !isMigratableLegacyRole(role.content ?? "", role.role) && (role.status === "owned" || role.status === "model-edited"),
+        role.content && isMigratableLegacyRole(role.content, role.role) ? `Review/back up edits, then run ${fix} --replace-legacy-agents` : role.status === "drifted" ? `Review/back up edits, then run ${fix}` : fix
+      );
+    const threads = readCodexThreadsValue(config);
+    const managed = state.priorThreadsValue !== void 0 && threads !== null && Number(threads.replaceAll("_", "")) === 6;
+    finding(
+      `Threads: ${threads === null ? "absent" : managed ? "managed" : "operator-changed"} (${threads ?? "none"})`,
+      managed,
+      `Review config.toml; set agents.max_concurrent_threads_per_session = 6 and restart Codex; ${fix}.`
+    );
+    const legacy = planLegacyRootRemoval(targets.rootInstructionsPath);
+    const present = legacy.items.length > 0 || legacy.diagnostics.length > 0;
+    finding(
+      `Legacy AGENTS.md block: ${present ? "present" : "absent"}`,
+      !present,
+      legacy.diagnostics.length ? "Repair ambiguous markers manually." : fix
+    );
+  } catch (error) {
+    success = false;
+    messages.push(
+      `${String(error)} Fix: inspect state/config manually, then ${fix}.`
+    );
+  }
+  return { success, messages };
+}
+
 // src/cli/install.ts
 import { existsSync } from "fs";
 import { homedir } from "os";
-import { join } from "path";
+import { join as join2 } from "path";
 import { cwd } from "process";
 var GREEN = "\x1B[32m";
 var BLUE = "\x1B[34m";
@@ -441,7 +922,7 @@ async function runPiInstall(config, dependencies, packageVersion, executingPacka
     const packageSkills = (dependencies.inspectPiPackageSkills ?? inspectPiPackageSkills)({ packageRoot: applied.configuredPackageRoot });
     for (const skill of packageSkills.skills)
       printInfo(
-        `  - ${skill.name}: ${join(skill.destinationPath, "SKILL.md")}`
+        `  - ${skill.name}: ${join2(skill.destinationPath, "SKILL.md")}`
       );
     if (!packageSkills.success) {
       printError(
@@ -516,7 +997,9 @@ async function install(args, dependencies = {}) {
       printError(`Codex plugin install failed: ${pluginResult.error}`);
       return 1;
     }
+    const trustHooks = await requestCodexHookConsent(args);
     const plan = buildCodexSetupPlan({
+      trustHooks,
       dryRun: config.dryRun,
       reset: config.reset,
       scope: "user",
@@ -752,6 +1235,8 @@ Commands:
   (no command)          Open the interactive TUI in a TTY; fall back to OpenCode install in CI/non-TTY
   install               Install OpenCode, Codex, Claude Code, or Pi agent assets
   generate              Generate harness-specific artifacts
+  uninstall             Remove attributable Codex surfaces (--agent=codex; --dry-run previews)
+  doctor                Diagnose Codex installation, read-only (--agent=codex)
   status                Show official CLI-managed versions and managed install status
   list                  List managed surfaces and actions
   update                Preview a complete selected-harness CLI refresh
@@ -763,6 +1248,7 @@ Options:
   --no-tui               Non-interactive mode
   --dry-run              Simulate install without writing files
   --apply                Apply a reviewed update, sync, or model plan
+  --trust-hooks          Consent to Codex plugin hooks running outside the sandbox (install/update)
   --reset                Repair managed installer-owned targets
   --agent=opencode|codex|claude|pi
                          Select OpenCode plugin install (default), Codex/Claude setup, or complete Pi-native setup
@@ -796,7 +1282,7 @@ OpenCode install configures the adaptive six-role roster and native task delegat
 Provider capability is external and reported only from caller-supplied evidence.
 
 External required skills are installed for every harness:
-  simplify, tdd, progressive-context-router, and architectural-grilling.
+  simplify, tdd, progressive-context-router, and grill-me.
 Their installation is mandatory and cannot be skipped.
 
 The generated OpenCode config supports the built-in OpenAI preset only.
@@ -947,6 +1433,26 @@ function printPlanOrApply(plan, args, applyPlan) {
   return result.applied ? 0 : 1;
 }
 async function runOperationCommand(command, args, services) {
+  if (command === "doctor" || command === "uninstall") {
+    if (args.harness !== "codex" || args.all || args.roles.length || args.trustHooks || args.replaceLegacyAgents || command === "doctor" && args.apply) {
+      console.error(
+        `${command} supports only --agent=codex with no model/trust options.`
+      );
+      return 1;
+    }
+    if (args.apply && args.dryRun) {
+      console.error("--apply cannot be combined with --dry-run.");
+      return 1;
+    }
+    const result = command === "doctor" ? doctorCodex(services.operationContext()) : uninstallCodex(services.operationContext(), args.dryRun ?? false);
+    console.log(
+      [
+        `Codex ${command}${args.dryRun ? " (dry-run)" : ""}`,
+        ...result.messages
+      ].join("\n")
+    );
+    return result.success ? 0 : 1;
+  }
   if (command === "status") {
     console.log(
       formatHarnessStatusReport(
@@ -959,9 +1465,23 @@ async function runOperationCommand(command, args, services) {
     console.log(formatHarnessList(listOperationHarnesses()));
     return 0;
   }
+  if (args.replaceLegacyAgents && (command !== "update" || selectedHarness(args) !== "codex")) {
+    console.error(
+      "--replace-legacy-agents supports only update --agent=codex."
+    );
+    return 1;
+  }
   if (command === "update" || command === "sync") {
+    const trustHooks = selectedHarness(args) === "codex" && command === "update" ? await requestCodexHookConsent({
+      trustHooks: args.trustHooks,
+      dryRun: !args.apply || args.dryRun
+    }) : false;
     return printPlanOrApply(
-      buildOperationPlan(command, args, services.operationContext()),
+      buildOperationPlan(command, args, {
+        ...services.operationContext(),
+        trustHooks,
+        replaceLegacyAgents: args.replaceLegacyAgents
+      }),
       args,
       services.applyOperationPlan ?? applyOperationPlan
     );
@@ -1019,46 +1539,15 @@ async function runCliCommand(parsed, modelServices = defaultModelCommandServices
 }
 
 // src/cli/parser.ts
-import { isAbsolute, resolve } from "path";
-
-// src/cli/runtime.ts
-var automationEnvironmentKeys = [
-  "CI",
-  "CONTINUOUS_INTEGRATION",
-  "BUILD_NUMBER",
-  "GITHUB_ACTIONS",
-  "GITLAB_CI",
-  "TF_BUILD",
-  "TEAMCITY_VERSION"
-];
-function isTruthyEnvValue(value) {
-  if (value === void 0 || value === "") return false;
-  const normalized = value.toLowerCase();
-  return normalized !== "0" && normalized !== "false";
-}
-function detectRuntimeContext(processLike = process) {
-  return {
-    stdinIsTTY: processLike.stdin?.isTTY === true,
-    stdoutIsTTY: processLike.stdout?.isTTY === true,
-    stderrIsTTY: processLike.stderr?.isTTY === true,
-    env: { ...processLike.env ?? {} }
-  };
-}
-function isInteractiveRuntime(context) {
-  if (!context.stdinIsTTY || !context.stdoutIsTTY) return false;
-  if (context.env.TERM?.toLowerCase() === "dumb") return false;
-  return !automationEnvironmentKeys.some(
-    (key) => isTruthyEnvValue(context.env[key])
-  );
-}
-
-// src/cli/parser.ts
+import { isAbsolute, resolve as resolve2 } from "path";
 var defaultRuntimeContext = {
   stdinIsTTY: false,
   stdoutIsTTY: false,
   env: {}
 };
 var operationCommands = /* @__PURE__ */ new Set([
+  "uninstall",
+  "doctor",
   "status",
   "list",
   "update",
@@ -1145,6 +1634,10 @@ function parseOperationArgs(args) {
       result.all = true;
     } else if (arg === "--apply") {
       result.apply = true;
+    } else if (arg === "--replace-legacy-agents") {
+      result.replaceLegacyAgents = true;
+    } else if (arg === "--trust-hooks") {
+      result.trustHooks = true;
     } else if (arg === "--dry-run") {
       result.dryRun = true;
     } else if (arg.startsWith("--role=")) {
@@ -1191,6 +1684,8 @@ function parseInstallArgs(args) {
       result.tui = false;
     } else if (arg.startsWith("--tmux=")) {
       result.tmux = parseBooleanArg("--tmux", arg.split("=")[1] ?? "");
+    } else if (arg === "--trust-hooks") {
+      result.trustHooks = true;
     } else if (arg === "--dry-run") {
       result.dryRun = true;
     } else if (arg === "--reset") {
@@ -1217,7 +1712,7 @@ function parseInstallArgs(args) {
       if (!localPackageRoot || localPackageRoot.startsWith("--")) {
         throw new Error("--local-package-root requires a value.");
       }
-      if (!isAbsolute(localPackageRoot) || resolve(localPackageRoot) !== localPackageRoot) {
+      if (!isAbsolute(localPackageRoot) || resolve2(localPackageRoot) !== localPackageRoot) {
         throw new Error(
           "--local-package-root requires a normalized absolute path."
         );
@@ -1237,7 +1732,7 @@ function parseInstallArgs(args) {
       if (!localPiRuntimeRoot || localPiRuntimeRoot.startsWith("--")) {
         throw new Error("--local-pi-runtime-root requires a value.");
       }
-      if (!isAbsolute(localPiRuntimeRoot) || resolve(localPiRuntimeRoot) !== localPiRuntimeRoot) {
+      if (!isAbsolute(localPiRuntimeRoot) || resolve2(localPiRuntimeRoot) !== localPiRuntimeRoot) {
         throw new Error(
           "--local-pi-runtime-root requires a normalized absolute path."
         );