zyndo 0.1.2 → 0.1.4

package/dist/config.js

@@ -48,6 +48,33 @@ export function loadSellerConfig(configPath) {
     }
     const harness = rawHarness;
     const claudeCodeBinary = optionalString(data, 'claude_code_binary');
+    // Validate that an explicit harness matches the binary it will spawn.
+    // Mismatch produces silent failure: e.g. harness=codex with binary=claude
+    // sends codex-style flags (--quiet, --approval-mode) to the Claude Code
+    // CLI, which rejects them and exits 1 on every task. Catch it at config
+    // load instead of at first-task time.
+    if (harness !== undefined && harness !== 'generic') {
+        const effectiveBinary = claudeCodeBinary ?? 'claude';
+        const binaryBaseName = effectiveBinary.split(/[\\/]/).pop()?.toLowerCase().replace(/\.(exe|cmd|bat|ps1)$/, '') ?? '';
+        let detected = 'generic';
+        if (binaryBaseName === 'codex' || binaryBaseName.startsWith('codex-'))
+            detected = 'codex';
+        else if (binaryBaseName === 'claude' || binaryBaseName.startsWith('claude-'))
+            detected = 'claude';
+        if (detected !== 'generic' && detected !== harness) {
+            throw new Error(`Config: harness="${harness}" does not match binary "${effectiveBinary}" (detected as "${detected}" harness). ` +
+                `Pick one: either set "harness: ${detected}" to match the binary, or set "claude_code_binary" to a ${harness} binary path.`);
+        }
+        // Bare names on Windows are fragile because spawn uses shell:true to
+        // resolve .cmd shims, and a bare name passed through cmd.exe gets
+        // re-tokenized in surprising ways when the cwd contains spaces. Warn
+        // (do not fail) so existing configs keep working but the user knows
+        // to re-run init for a fully-qualified path.
+        if (process.platform === 'win32' && !effectiveBinary.includes('\\') && !effectiveBinary.includes('/')) {
+            process.stderr.write(`[zyndo] Warning: claude_code_binary "${effectiveBinary}" is a bare name. ` +
+                `On Windows this is fragile. Re-run \`zyndo init\` to write a fully-qualified path.\n`);
+        }
+    }
     const claudeCodeTimeoutMs = typeof data.claude_code_timeout_ms === 'number' ? data.claude_code_timeout_ms : undefined;
     const claudeCodeMaxBudgetUsd = typeof data.claude_code_max_budget_usd === 'number' ? data.claude_code_max_budget_usd : undefined;
     const skills = requireArray(data, 'skills').map((s) => {

package/dist/index.js

@@ -27,7 +27,7 @@ async function main() {
         }
         case 'init': {
             const { runInit } = await import('./init.js');
-            await runInit();
+            await runInit(args.slice(1));
             break;
         }
         case 'mcp': {
@@ -47,7 +47,7 @@ async function main() {
             break;
         }
         case 'version':
-            process.stdout.write('zyndo 0.1.0\n');
+            process.stdout.write('zyndo 0.1.4\n');
             break;
         case 'help':
         case undefined:
@@ -65,6 +65,7 @@ zyndo — AI agent daemon for the Zyndo marketplace
 
 Usage:
   zyndo init                      Interactive setup (create seller config)
+  zyndo init --non-interactive    Non-interactive setup (use --name, --skill-id, etc.)
   zyndo serve [--config <path>]   Start seller daemon
   zyndo mcp                       Start MCP server for buyers
   zyndo wallet [balance|topup|ledger]  Manage wallet (opens dashboard)

package/dist/init.d.ts

@@ -1 +1 @@
-export declare function runInit(): Promise<void>;
+export declare function runInit(argv?: ReadonlyArray<string>): Promise<void>;

package/dist/init.js

@@ -1,131 +1,447 @@
 // ---------------------------------------------------------------------------
-// zyndo init — interactive seller config setup
+// zyndo init — interactive and non-interactive seller config setup
+//
+// Cross-platform: works on Windows (USERPROFILE, PATHEXT, .cmd shims) and
+// POSIX. Resolves binaries via manual PATH walk so we never depend on the
+// `which` command being present, and always writes a fully-qualified binary
+// path into the config so the daemon never has to re-resolve at runtime.
 // ---------------------------------------------------------------------------
 import { createInterface } from 'node:readline';
 import { writeFileSync, mkdirSync, existsSync, accessSync, readdirSync, constants as fsConstants } from 'node:fs';
-import { resolve } from 'node:path';
-import { execFileSync } from 'node:child_process';
+import { resolve, delimiter, sep, isAbsolute } from 'node:path';
+import { spawnSync } from 'node:child_process';
 import { stringify as yamlStringify } from 'yaml';
 import { printBanner } from './banner.js';
 // ---------------------------------------------------------------------------
-// Readline helper
-// ---------------------------------------------------------------------------
-function createPrompt() {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    const ask = (question, defaultValue) => new Promise((resolve) => {
-        const suffix = defaultValue !== undefined ? ` (${defaultValue})` : '';
-        rl.question(`  \x1b[36m?\x1b[0m ${question}${suffix}: `, (answer) => {
-            resolve(answer.trim() || defaultValue || '');
-        });
-    });
-    return { ask, close: () => rl.close() };
-}
-// ---------------------------------------------------------------------------
-// Harness detection
+// Cross-platform binary resolution
 // ---------------------------------------------------------------------------
-function binaryExists(name) {
-    // If it looks like an absolute path, check file exists and is executable
-    if (name.startsWith('/')) {
+/**
+ * Resolve a binary name to an absolute path. Returns undefined if not found.
+ *
+ * Honors PATHEXT on Windows so `codex` resolves to `codex.cmd`. Skips the
+ * external `which` command entirely (Linux-only) and walks PATH manually.
+ *
+ * If `name` already contains a path separator or is absolute, just verifies
+ * the file exists.
+ */
+function resolveBinary(name) {
+    if (name === '')
+        return undefined;
+    if (isAbsolute(name) || name.includes(sep) || name.includes('/')) {
         try {
-            accessSync(name, fsConstants.X_OK);
-            return true;
+            accessSync(name, fsConstants.F_OK);
+            return name;
         }
         catch {
-            return false;
+            return undefined;
         }
     }
-    // Otherwise check PATH via `which` (using execFileSync to avoid shell injection)
-    try {
-        execFileSync('which', [name], { stdio: 'pipe' });
-        return true;
-    }
-    catch {
-        return false;
+    const pathDirs = (process.env.PATH ?? '').split(delimiter).filter((d) => d.length > 0);
+    const exts = process.platform === 'win32'
+        ? ['', ...(process.env.PATHEXT ?? '.COM;.EXE;.BAT;.CMD').split(';').map((e) => e.toLowerCase())]
+        : [''];
+    for (const dir of pathDirs) {
+        for (const ext of exts) {
+            const candidate = resolve(dir, `${name}${ext}`);
+            try {
+                accessSync(candidate, fsConstants.F_OK);
+                return candidate;
+            }
+            catch {
+                // try next
+            }
+        }
     }
+    return undefined;
 }
+/**
+ * Try harder to find Claude Code by checking common VS Code / Cursor
+ * extension paths on macOS, Linux, and Windows.
+ */
 function findClaudeBinary() {
-    // Check PATH first
-    if (binaryExists('claude'))
-        return 'claude';
-    // Search common VS Code extension locations
-    const home = process.env.HOME ?? '';
+    const onPath = resolveBinary('claude');
+    if (onPath !== undefined)
+        return onPath;
+    const home = process.env.HOME ?? process.env.USERPROFILE ?? '';
     if (home === '')
         return undefined;
-    const vscodeDirs = [
+    const candidateDirs = [
         resolve(home, '.vscode', 'extensions'),
         resolve(home, '.vscode-insiders', 'extensions'),
         resolve(home, '.cursor', 'extensions')
     ];
-    for (const extDir of vscodeDirs) {
+    // Windows VS Code per-user extension dirs
+    if (process.platform === 'win32') {
+        const appData = process.env.APPDATA ?? '';
+        const localAppData = process.env.LOCALAPPDATA ?? '';
+        if (appData !== '')
+            candidateDirs.push(resolve(appData, 'Code', 'User', 'extensions'));
+        if (localAppData !== '')
+            candidateDirs.push(resolve(localAppData, 'Programs', 'Microsoft VS Code', 'resources', 'app', 'extensions'));
+    }
+    for (const extDir of candidateDirs) {
         if (!existsSync(extDir))
             continue;
         try {
             const entries = readdirSync(extDir).filter((e) => e.startsWith('anthropic.claude-code-'));
-            // Sort descending to prefer latest version
             entries.sort().reverse();
             for (const entry of entries) {
-                const candidate = resolve(extDir, entry, 'resources', 'native-binary', 'claude');
-                if (binaryExists(candidate))
+                const binName = process.platform === 'win32' ? 'claude.exe' : 'claude';
+                const candidate = resolve(extDir, entry, 'resources', 'native-binary', binName);
+                try {
+                    accessSync(candidate, fsConstants.F_OK);
                     return candidate;
+                }
+                catch {
+                    // try next
+                }
             }
         }
         catch {
-            // Permission denied or other FS error, skip
+            // permission denied or read failure, skip
         }
     }
     return undefined;
 }
+/**
+ * Codex is usually installed via npm-global. On Windows that puts a
+ * `codex.cmd` shim under `%APPDATA%\npm`. Check that explicitly in case
+ * PATH does not include it (some shells launched without inheriting the
+ * user PATH).
+ */
+function findCodexBinary() {
+    const onPath = resolveBinary('codex');
+    if (onPath !== undefined)
+        return onPath;
+    if (process.platform === 'win32') {
+        const appData = process.env.APPDATA ?? '';
+        if (appData !== '') {
+            const candidate = resolve(appData, 'npm', 'codex.cmd');
+            try {
+                accessSync(candidate, fsConstants.F_OK);
+                return candidate;
+            }
+            catch { /* not there */ }
+        }
+    }
+    return undefined;
+}
+/**
+ * Run `<binary> --version` to confirm the binary actually starts. Catches
+ * the silent-failure case where init writes a config that crashes at first
+ * task because the binary is broken or wrong.
+ */
+function quoteWinArg(arg) {
+    if (arg === '')
+        return '""';
+    if (!/[\s"&|<>^()]/.test(arg))
+        return arg;
+    return `"${arg.replace(/"/g, '""')}"`;
+}
+function testBinary(binary) {
+    try {
+        // Same DEP0190 dance as the harness spawn: on Windows pass a quoted
+        // command string with shell:true (no args array) so .cmd shims work
+        // without triggering the deprecation. On POSIX spawn directly.
+        const result = process.platform === 'win32'
+            ? spawnSync(`${quoteWinArg(binary)} --version`, {
+                stdio: ['ignore', 'pipe', 'pipe'],
+                timeout: 5000,
+                shell: true,
+                encoding: 'utf-8'
+            })
+            : spawnSync(binary, ['--version'], {
+                stdio: ['ignore', 'pipe', 'pipe'],
+                timeout: 5000,
+                encoding: 'utf-8'
+            });
+        if (result.error)
+            return { ok: false, error: result.error.message };
+        if (result.status !== 0) {
+            return { ok: false, error: `exit code ${result.status}: ${(result.stderr ?? '').trim().slice(0, 200)}` };
+        }
+        const version = ((result.stdout ?? '') + (result.stderr ?? '')).trim().split('\n')[0] ?? '';
+        return { ok: true, version };
+    }
+    catch (err) {
+        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+    }
+}
 const HARNESS_OPTIONS = [
     { label: 'Claude Code', harness: 'claude', binary: 'claude', defaultModel: 'sonnet' },
-    { label: 'Codex CLI', harness: 'codex', binary: 'codex', defaultModel: 'o4-mini' },
+    { label: 'Codex CLI', harness: 'codex', binary: 'codex', defaultModel: 'gpt-5-codex' },
     { label: 'Other / Custom binary', harness: 'generic', binary: '', defaultModel: 'default' }
 ];
+function detectInstalledHarness() {
+    const claudeBin = findClaudeBinary();
+    if (claudeBin !== undefined)
+        return { harness: 'claude', binary: claudeBin, model: 'sonnet' };
+    const codexBin = findCodexBinary();
+    if (codexBin !== undefined)
+        return { harness: 'codex', binary: codexBin, model: 'gpt-5-codex' };
+    return undefined;
+}
+function parseFlags(argv) {
+    const flags = {};
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (!a.startsWith('--'))
+            continue;
+        const key = a.slice(2);
+        const next = argv[i + 1];
+        if (next === undefined || next.startsWith('--')) {
+            flags[key] = true;
+        }
+        else {
+            flags[key] = next;
+            i++;
+        }
+    }
+    const harnessRaw = typeof flags.harness === 'string' ? flags.harness : undefined;
+    const harness = harnessRaw === 'claude' || harnessRaw === 'codex' || harnessRaw === 'generic' ? harnessRaw : undefined;
+    const skillPriceRaw = typeof flags['skill-price-cents'] === 'string' ? flags['skill-price-cents'] : undefined;
+    const skillPriceCents = skillPriceRaw !== undefined ? Number.parseInt(skillPriceRaw, 10) : undefined;
+    return {
+        nonInteractive: flags['non-interactive'] === true,
+        name: typeof flags.name === 'string' ? flags.name : undefined,
+        description: typeof flags.description === 'string' ? flags.description : undefined,
+        harness,
+        binary: typeof flags.binary === 'string' ? flags.binary : undefined,
+        model: typeof flags.model === 'string' ? flags.model : undefined,
+        workingDirectory: typeof flags['working-directory'] === 'string' ? flags['working-directory'] : undefined,
+        apiKey: typeof flags['api-key'] === 'string' ? flags['api-key'] : undefined,
+        bridgeUrl: typeof flags['bridge-url'] === 'string' ? flags['bridge-url'] : undefined,
+        skillId: typeof flags['skill-id'] === 'string' ? flags['skill-id'] : undefined,
+        skillName: typeof flags['skill-name'] === 'string' ? flags['skill-name'] : undefined,
+        skillDesc: typeof flags['skill-desc'] === 'string' ? flags['skill-desc'] : undefined,
+        skillPriceCents,
+        force: flags.force === true
+    };
+}
 // ---------------------------------------------------------------------------
-// Main
+// Readline helper
 // ---------------------------------------------------------------------------
-export async function runInit() {
+function createPrompt() {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const ask = (question, defaultValue) => new Promise((resolveAns) => {
+        const suffix = defaultValue !== undefined ? ` (${defaultValue})` : '';
+        rl.question(`  \x1b[36m?\x1b[0m ${question}${suffix}: `, (answer) => {
+            resolveAns(answer.trim() || defaultValue || '');
+        });
+    });
+    return { ask, close: () => rl.close() };
+}
+const YAML_HEADER = `# Zyndo seller configuration.
+#
+# Generated by \`zyndo init\`. Edit fields as needed and re-run \`zyndo serve\`.
+# Get an API key from https://zyndo.ai/dashboard (API Keys tab).
+#
+# Field reference:
+#   name                  Display name shown to buyer agents on the marketplace.
+#   description           One-line pitch shown next to your name in browse results.
+#   bridge_url            Zyndo broker URL. Leave as default unless self-hosting.
+#   api_key               Your Zyndo API key (zyndo_live_sk_...). Required to connect.
+#   provider              Always 'claude-code' (the spawn-a-CLI provider).
+#   harness               'claude' | 'codex' | 'generic'. MUST match the binary below.
+#   claude_code_binary    Absolute path to your harness binary. Set by \`zyndo init\`.
+#   model                 Model name passed to the harness (e.g. 'sonnet', 'gpt-5-codex').
+#   working_directory     Where the seller can read/write files.
+#   max_concurrent_tasks  How many tasks the daemon will run in parallel.
+#   skills                What you offer. price_cents is REQUIRED ($0.10 floor).
+#   categories            Free-form tags used in marketplace browse filters.
+`;
+function writeConfig(out, force) {
+    const configDir = resolve(process.cwd(), '.zyndo');
+    const configPath = resolve(configDir, 'seller.yaml');
+    const configObj = {
+        name: out.name,
+        description: out.description,
+        bridge_url: out.bridgeUrl,
+        api_key: out.apiKey,
+        provider: 'claude-code',
+        harness: out.harness,
+        claude_code_binary: out.binary,
+        model: out.model,
+        working_directory: out.workingDirectory,
+        max_concurrent_tasks: 1,
+        skills: [
+            {
+                id: out.skillId,
+                name: out.skillName,
+                description: out.skillDesc,
+                price_cents: out.skillPriceCents
+            }
+        ],
+        categories: [out.skillId.split('.')[0] || 'general']
+    };
+    const yaml = YAML_HEADER + '\n' + yamlStringify(configObj);
+    mkdirSync(configDir, { recursive: true });
+    if (existsSync(configPath) && !force) {
+        return { path: configPath, written: false };
+    }
+    writeFileSync(configPath, yaml, 'utf-8');
+    return { path: configPath, written: true };
+}
+// ---------------------------------------------------------------------------
+// Non-interactive entry
+// ---------------------------------------------------------------------------
+function runNonInteractive(flags) {
+    const missing = [];
+    if (flags.name === undefined)
+        missing.push('--name');
+    if (flags.skillId === undefined)
+        missing.push('--skill-id');
+    if (flags.skillName === undefined)
+        missing.push('--skill-name');
+    if (flags.skillDesc === undefined)
+        missing.push('--skill-desc');
+    if (flags.skillPriceCents === undefined)
+        missing.push('--skill-price-cents');
+    if (flags.apiKey === undefined)
+        missing.push('--api-key');
+    if (missing.length > 0) {
+        throw new Error(`Non-interactive init requires: ${missing.join(', ')}\n\n` +
+            `Example:\n` +
+            `  zyndo init --non-interactive \\\n` +
+            `    --name "My Code Reviewer" \\\n` +
+            `    --skill-id coding.review.v1 \\\n` +
+            `    --skill-name "Code Review" \\\n` +
+            `    --skill-desc "Reviews TypeScript code for bugs" \\\n` +
+            `    --skill-price-cents 500 \\\n` +
+            `    --api-key zyndo_live_sk_xxxxx`);
+    }
+    if (!Number.isInteger(flags.skillPriceCents) || flags.skillPriceCents < 10) {
+        throw new Error(`--skill-price-cents must be an integer >= 10 ($0.10 minimum). Got: ${flags.skillPriceCents}`);
+    }
+    // Resolve harness + binary
+    let harness;
+    let binary;
+    let model;
+    if (flags.harness !== undefined && flags.binary !== undefined) {
+        harness = flags.harness;
+        const resolved = resolveBinary(flags.binary);
+        if (resolved === undefined) {
+            throw new Error(`Binary "${flags.binary}" not found on PATH. Pass an absolute path with --binary.`);
+        }
+        binary = resolved;
+    }
+    else if (flags.harness !== undefined) {
+        // Harness specified, binary not. Look up the default binary for that harness.
+        harness = flags.harness;
+        const lookup = harness === 'claude' ? findClaudeBinary() : harness === 'codex' ? findCodexBinary() : undefined;
+        if (lookup === undefined) {
+            throw new Error(`--harness ${harness} specified but no ${harness} binary found on PATH. Install it or pass --binary <path>.`);
+        }
+        binary = lookup;
+    }
+    else {
+        // Auto-detect
+        const detected = detectInstalledHarness();
+        if (detected === undefined) {
+            throw new Error('No AI harness found. Install Claude Code or Codex CLI, or pass --harness and --binary explicitly.');
+        }
+        harness = detected.harness;
+        binary = detected.binary;
+    }
+    // Pick model: explicit > harness default
+    if (flags.model !== undefined) {
+        model = flags.model;
+    }
+    else if (harness === 'claude') {
+        model = 'sonnet';
+    }
+    else if (harness === 'codex') {
+        model = 'gpt-5-codex';
+    }
+    else {
+        model = 'default';
+    }
+    // Functional test
+    const test = testBinary(binary);
+    if (!test.ok) {
+        throw new Error(`Binary at ${binary} failed --version test: ${test.error}`);
+    }
+    process.stdout.write(`  \x1b[32mBinary OK:\x1b[0m ${binary} (${test.version})\n`);
+    const result = writeConfig({
+        name: flags.name,
+        description: flags.description ?? `AI agent offering ${flags.skillName} on the Zyndo marketplace`,
+        harness,
+        binary,
+        model,
+        workingDirectory: flags.workingDirectory ?? process.cwd(),
+        apiKey: flags.apiKey,
+        bridgeUrl: flags.bridgeUrl ?? 'https://bridge.zyndo.ai',
+        skillId: flags.skillId,
+        skillName: flags.skillName,
+        skillDesc: flags.skillDesc,
+        skillPriceCents: flags.skillPriceCents
+    }, flags.force === true);
+    if (!result.written) {
+        throw new Error(`${result.path} already exists. Pass --force to overwrite.`);
+    }
+    process.stdout.write(`\n  \x1b[32mConfig saved to ${result.path}\x1b[0m\n`);
+    process.stdout.write(`  Run: \x1b[1mzyndo serve\x1b[0m  (from this directory)\n\n`);
+}
+// ---------------------------------------------------------------------------
+// Interactive entry
+// ---------------------------------------------------------------------------
+async function runInteractive() {
     printBanner();
     process.stdout.write('  Welcome to the Zyndo marketplace agent CLI.\n');
     process.stdout.write('  This will create your seller agent config.\n\n');
     const { ask, close } = createPrompt();
     try {
-        // Harness selection
+        // Auto-detect available harnesses up front so the menu shows what is found.
+        const detectedClaude = findClaudeBinary();
+        const detectedCodex = findCodexBinary();
+        const autoPick = detectedClaude !== undefined ? 0 : detectedCodex !== undefined ? 1 : -1;
         process.stdout.write('  \x1b[1mSelect your AI harness:\x1b[0m\n');
         for (let i = 0; i < HARNESS_OPTIONS.length; i++) {
             const opt = HARNESS_OPTIONS[i];
-            const available = opt.binary !== '' && (binaryExists(opt.binary) || (opt.harness === 'claude' && findClaudeBinary() !== undefined));
-            const tag = available ? '\x1b[32m (found)\x1b[0m' : '';
-            process.stdout.write(`    ${i + 1}) ${opt.label}${tag}\n`);
+            let tag = '';
+            if (opt.harness === 'claude' && detectedClaude !== undefined)
+                tag = '\x1b[32m (found)\x1b[0m';
+            if (opt.harness === 'codex' && detectedCodex !== undefined)
+                tag = '\x1b[32m (found)\x1b[0m';
+            const marker = i === autoPick ? ' \x1b[33m← default\x1b[0m' : '';
+            process.stdout.write(`    ${i + 1}) ${opt.label}${tag}${marker}\n`);
         }
         process.stdout.write('\n');
-        const choiceRaw = await ask('Choice [1-3]', '1');
-        const parsed = parseInt(choiceRaw, 10);
+        const defaultChoice = autoPick === -1 ? '1' : String(autoPick + 1);
+        const choiceRaw = await ask('Choice [1-3]', defaultChoice);
+        const parsed = Number.parseInt(choiceRaw, 10);
         const choiceIdx = Number.isNaN(parsed) ? 0 : Math.max(0, Math.min(HARNESS_OPTIONS.length - 1, parsed - 1));
         const selected = HARNESS_OPTIONS[choiceIdx];
-        let binary = selected.binary;
-        if (selected.harness === 'generic') {
-            binary = await ask('Binary path or command');
-            if (binary === '') {
+        let binary = '';
+        if (selected.harness === 'claude') {
+            binary = detectedClaude ?? '';
+        }
+        else if (selected.harness === 'codex') {
+            binary = detectedCodex ?? '';
+        }
+        if (binary === '') {
+            const promptDefault = selected.binary !== '' ? selected.binary : '';
+            const entered = await ask('Binary path or command', promptDefault);
+            if (entered === '') {
                 process.stdout.write('  No binary specified. Exiting.\n');
                 return;
             }
-        }
-        // Auto-detect claude binary in VS Code extensions if not on PATH
-        if (selected.harness === 'claude' && !binaryExists(binary)) {
-            const found = findClaudeBinary();
-            if (found !== undefined) {
-                process.stdout.write(`  \x1b[32mFound:\x1b[0m ${found}\n`);
-                binary = found;
+            const resolved = resolveBinary(entered);
+            if (resolved === undefined) {
+                process.stdout.write(`  \x1b[31mNot found:\x1b[0m "${entered}" is not on PATH and is not an absolute path.\n`);
+                return;
             }
+            binary = resolved;
         }
-        // Verify binary exists
-        if (binary !== '' && !binaryExists(binary)) {
-            process.stdout.write(`  \x1b[33mWarning:\x1b[0m "${binary}" not found on PATH. You may need to provide the full path.\n`);
-            const fullPath = await ask('Full path to binary (or press Enter to keep as-is)', binary);
-            if (fullPath !== '')
-                binary = fullPath;
+        process.stdout.write(`  \x1b[32mUsing:\x1b[0m ${binary}\n`);
+        // Functional test
+        const test = testBinary(binary);
+        if (!test.ok) {
+            process.stdout.write(`  \x1b[31mBinary test failed:\x1b[0m ${test.error}\n`);
+            process.stdout.write(`  Make sure ${selected.label} is installed correctly, then re-run \`zyndo init\`.\n`);
+            return;
         }
-        process.stdout.write('\n');
+        process.stdout.write(`  \x1b[32mVersion:\x1b[0m ${test.version}\n\n`);
         // Agent details
         const name = await ask('Agent name', 'My Zyndo Seller');
         const description = await ask('Description', 'AI agent offering services on the Zyndo marketplace');
@@ -139,41 +455,40 @@ export async function runInit() {
         if (!Number.isInteger(skillPriceCents) || skillPriceCents < 10) {
             throw new Error(`Skill price must be an integer of at least 10 cents ($0.10). Got: "${skillPriceRaw}"`);
         }
-        const category = skillId.split('.')[0] || 'coding';
         process.stdout.write('\n');
         const model = await ask('Model', selected.defaultModel);
-        const workingDir = await ask('Working directory', '.');
+        const workingDir = await ask('Working directory', process.cwd());
         process.stdout.write('\n  \x1b[1mZyndo Marketplace\x1b[0m\n');
-        const bridgeApiKey = await ask('Bridge API key (leave empty if not required)', '');
-        // Build config object and serialize with yaml library
-        // Save to .zyndo/ in cwd (per-folder seller identity)
-        const configDir = resolve(process.cwd(), '.zyndo');
-        const configPath = resolve(configDir, 'seller.yaml');
-        const configObj = {
-            name,
-            description,
-            provider: 'claude-code',
-            harness: selected.harness,
-            ...(binary !== selected.binary ? { claude_code_binary: binary } : {}),
-            model,
-            ...(bridgeApiKey !== '' ? { api_key: bridgeApiKey } : {}),
-            working_directory: workingDir,
-            max_concurrent_tasks: 1,
-            skills: [{ id: skillId, name: skillName, description: skillDesc, price_cents: skillPriceCents }],
-            categories: [category]
-        };
-        const yaml = yamlStringify(configObj);
-        mkdirSync(configDir, { recursive: true });
+        process.stdout.write('  Get an API key at https://zyndo.ai/dashboard (API Keys tab)\n');
+        const bridgeApiKey = await ask('Bridge API key', '');
+        const bridgeUrl = await ask('Bridge URL', 'https://bridge.zyndo.ai');
+        // Confirm overwrite if exists
+        const configPath = resolve(process.cwd(), '.zyndo', 'seller.yaml');
+        let force = true;
         if (existsSync(configPath)) {
             const overwrite = await ask(`${configPath} already exists. Overwrite? [y/N]`, 'N');
             if (overwrite.toLowerCase() !== 'y') {
                 process.stdout.write('  Aborted. Config not changed.\n');
                 return;
             }
+            force = true;
         }
-        writeFileSync(configPath, yaml, 'utf-8');
+        const result = writeConfig({
+            name,
+            description,
+            harness: selected.harness,
+            binary,
+            model,
+            workingDirectory: workingDir,
+            apiKey: bridgeApiKey,
+            bridgeUrl,
+            skillId,
+            skillName,
+            skillDesc,
+            skillPriceCents
+        }, force);
         process.stdout.write('\n');
-        process.stdout.write(`  \x1b[32mConfig saved to ${configPath}\x1b[0m\n`);
+        process.stdout.write(`  \x1b[32mConfig saved to ${result.path}\x1b[0m\n`);
         process.stdout.write(`  This seller lives in this folder. Add a CLAUDE.md for custom skills/rules.\n`);
         process.stdout.write(`  Run: \x1b[1mzyndo serve\x1b[0m  (from this directory)\n\n`);
     }
@@ -181,3 +496,14 @@ export async function runInit() {
         close();
     }
 }
+// ---------------------------------------------------------------------------
+// Main entry
+// ---------------------------------------------------------------------------
+export async function runInit(argv = []) {
+    const flags = parseFlags(argv);
+    if (flags.nonInteractive) {
+        runNonInteractive(flags);
+        return;
+    }
+    await runInteractive();
+}

package/dist/providers/claudeCode.js

@@ -3,7 +3,10 @@
 // instead of making raw LLM API calls.
 // ---------------------------------------------------------------------------
 import { spawn } from 'node:child_process';
-import { basename } from 'node:path';
+import { basename, join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { randomBytes } from 'node:crypto';
+import { readFileSync, unlinkSync } from 'node:fs';
 // ---------------------------------------------------------------------------
 // Harness detection and args
 // ---------------------------------------------------------------------------
@@ -15,7 +18,7 @@ export function detectHarness(binary) {
         return 'claude';
     return 'generic';
 }
-function buildHarnessArgs(harness, config, systemPrompt) {
+function buildHarnessSpawn(harness, config, systemPrompt) {
     switch (harness) {
         case 'claude': {
             const args = [
@@ -30,16 +33,33 @@ function buildHarnessArgs(harness, config, systemPrompt) {
             if (config.claudeCodeMaxBudgetUsd !== undefined) {
                 args.push('--max-budget-usd', String(config.claudeCodeMaxBudgetUsd));
             }
-            return args;
+            return { args };
         }
-        case 'codex':
-            return [
-                '--quiet',
-                '--model', config.model,
-                '--approval-mode', 'full-auto'
+        case 'codex': {
+            // Codex CLI 0.110+ uses `codex exec` for non-interactive runs.
+            // - `-` reads the prompt from stdin (we still pipe the seller prompt in).
+            // - `--dangerously-bypass-approvals-and-sandbox` is required because
+            //   the seller daemon spawns codex headless and there is nobody to
+            //   approve commands. The user explicitly opted in by running `zyndo serve`.
+            // - `-o <tempfile>` captures only the agent's last message, which is
+            //   what we want as the deliverable text. Stdout includes progress
+            //   events that would otherwise pollute parseOutput.
+            // - `--color never` strips ANSI escapes from any stderr we might log.
+            const outputFile = join(tmpdir(), `zyndo-codex-${Date.now()}-${randomBytes(4).toString('hex')}.txt`);
+            const args = [
+                'exec',
+                '-',
+                '-m', config.model,
+                '--dangerously-bypass-approvals-and-sandbox',
+                '--skip-git-repo-check',
+                '-C', config.workingDirectory,
+                '--color', 'never',
+                '-o', outputFile
             ];
+            return { args, outputFile };
+        }
         case 'generic':
-            return [];
+            return { args: [] };
     }
 }
 // ---------------------------------------------------------------------------
@@ -120,6 +140,49 @@ function parseOutput(raw, harness) {
     return { output: trimmed, paused: false };
 }
 // ---------------------------------------------------------------------------
+// Cross-platform spawn helpers
+// ---------------------------------------------------------------------------
+/**
+ * Quote a single arg for cmd.exe. Wraps in double quotes if it contains
+ * any whitespace, quote, or shell metacharacter. Internal double quotes are
+ * doubled per cmd.exe convention. We only ever pass flag values and paths
+ * here (the prompt goes via stdin), so this is sufficient.
+ */
+function quoteWinArg(arg) {
+    if (arg === '')
+        return '""';
+    if (!/[\s"&|<>^()]/.test(arg))
+        return arg;
+    return `"${arg.replace(/"/g, '""')}"`;
+}
+/**
+ * Spawn a child process. On Windows, builds a single shell-quoted command
+ * string and passes shell:true so .cmd / .bat shims (codex.cmd, claude.cmd)
+ * resolve correctly. On POSIX, spawns the binary directly with the args
+ * array — no shell, no quoting concerns.
+ *
+ * Avoids Node DEP0190 (the warning fires when you pass shell:true together
+ * with an args array, because Node concatenates without escaping).
+ */
+function spawnHarness(binary, args, opts) {
+    if (process.platform === 'win32') {
+        const cmdLine = [binary, ...args].map(quoteWinArg).join(' ');
+        return spawn(cmdLine, {
+            cwd: opts.cwd,
+            signal: opts.signal,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            env: opts.env,
+            shell: true
+        });
+    }
+    return spawn(binary, [...args], {
+        cwd: opts.cwd,
+        signal: opts.signal,
+        stdio: ['pipe', 'pipe', 'pipe'],
+        env: opts.env
+    });
+}
+// ---------------------------------------------------------------------------
 // Main entry point
 // ---------------------------------------------------------------------------
 const DEFAULT_TIMEOUT_MS = 600_000; // 10 minutes
@@ -129,19 +192,24 @@ export async function runClaudeCodeTask(taskContext, config, logger) {
     const timeoutMs = config.claudeCodeTimeoutMs ?? DEFAULT_TIMEOUT_MS;
     const prompt = buildPrompt(taskContext, config);
     const systemPrompt = config.systemPrompt;
-    const args = buildHarnessArgs(harness, config, systemPrompt);
+    const { args, outputFile } = buildHarnessSpawn(harness, config, systemPrompt);
     logger.info(`Spawning ${harness} harness: ${binary} ${args.join(' ')}`);
     return new Promise((resolve) => {
         const controller = new AbortController();
         const timeoutHandle = setTimeout(() => controller.abort(), timeoutMs);
-        const proc = spawn(binary, [...args], {
+        // Windows .cmd shims need shell:true to resolve. spawnHarness builds a
+        // pre-quoted command string for that case so we don't trigger DEP0190
+        // (passing shell:true + args array). On POSIX we spawn directly.
+        const proc = spawnHarness(binary, args, {
             cwd: config.workingDirectory,
             signal: controller.signal,
-            stdio: ['pipe', 'pipe', 'pipe'],
             env: { ...process.env }
         });
         const stdoutChunks = [];
         const stderrChunks = [];
+        // stdio is always ['pipe','pipe','pipe'] in spawnHarness, so the
+        // streams are guaranteed non-null at runtime. The wrapped return type
+        // does not narrow that, so assert.
         proc.stdout.on('data', (chunk) => stdoutChunks.push(chunk));
         proc.stderr.on('data', (chunk) => stderrChunks.push(chunk));
         proc.on('error', (err) => {
@@ -161,12 +229,28 @@ export async function runClaudeCodeTask(taskContext, config, logger) {
             if (stderr.length > 0) {
                 logger.info(`Harness stderr: ${stderr.slice(0, 500)}`);
             }
-            if (code !== 0 && stdout.length === 0) {
+            // Codex writes the agent's final message to a tempfile via `-o`.
+            // Read it back, then unlink. If the file is missing or unreadable
+            // (e.g. codex crashed before writing it), fall through to stdout.
+            let agentOutput = stdout;
+            if (outputFile !== undefined) {
+                try {
+                    agentOutput = readFileSync(outputFile, 'utf-8');
+                }
+                catch {
+                    // Tempfile not written. Keep stdout as a best-effort fallback.
+                }
+                try {
+                    unlinkSync(outputFile);
+                }
+                catch { /* ignore */ }
+            }
+            if (code !== 0 && agentOutput.length === 0) {
                 logger.error(`Harness exited with code ${code}`);
                 resolve({ output: `Harness failed (exit ${code}): ${stderr.slice(0, 1000)}`, paused: false });
                 return;
             }
-            resolve(parseOutput(stdout, harness));
+            resolve(parseOutput(agentOutput, harness));
         });
         proc.stdin.write(prompt);
         proc.stdin.end();

package/examples/seller.yaml.example

@@ -0,0 +1,73 @@
+# Zyndo seller configuration — annotated example.
+#
+# Copy this file to .zyndo/seller.yaml in the directory you want your seller
+# to live in, then run `zyndo serve` from that directory. Most users should
+# run `zyndo init` instead, which writes this file with the right defaults
+# and a verified binary path.
+#
+# Get an API key at https://zyndo.ai/dashboard (API Keys tab).
+
+# Display name shown to buyer agents on the marketplace.
+name: My Code Reviewer
+
+# One-line pitch shown next to your name in browse results.
+description: Reviews TypeScript and Python code for bugs and improvements.
+
+# Zyndo broker URL. Leave as default unless self-hosting the broker.
+bridge_url: https://bridge.zyndo.ai
+
+# Your Zyndo API key. REQUIRED. Format: zyndo_live_sk_xxxxx
+api_key: zyndo_live_sk_REPLACE_ME
+
+# Always 'claude-code' for now. This selects the spawn-a-CLI provider that
+# routes tasks to your local Claude Code or Codex binary.
+provider: claude-code
+
+# Which CLI harness to use. MUST match the binary below.
+#   claude  → Anthropic Claude Code (`claude` or `claude.exe`)
+#   codex   → OpenAI Codex CLI (`codex` or `codex.cmd`)
+#   generic → any other CLI; you handle args via env / wrapper
+harness: claude
+
+# Absolute path to the harness binary. Always use a full path here.
+# zyndo init writes this for you. Examples:
+#   macOS/Linux: /usr/local/bin/claude
+#   Windows:     C:\Users\you\AppData\Roaming\npm\codex.cmd
+claude_code_binary: /usr/local/bin/claude
+
+# Model name passed to the harness.
+#   claude harness:  sonnet | opus | haiku | claude-sonnet-4-6 | ...
+#   codex harness:   gpt-5-codex | o4-mini | ...
+model: sonnet
+
+# The directory the seller can read/write inside. Use an absolute path
+# for clarity. The seller daemon does NOT chroot — the harness binary's
+# own permission model controls what is reachable.
+working_directory: /Users/you/projects/zyndo-seller-workspace
+
+# How many buyer tasks the daemon will process in parallel. Start at 1.
+max_concurrent_tasks: 1
+
+# What you offer. Each skill MUST have price_cents (minimum 10 = $0.10).
+# The marketplace adds a 25% buyer markup on top of price_cents, so a
+# price_cents of 500 ($5.00) is shown to buyers as $6.25.
+skills:
+  - id: coding.review.v1
+    name: Code Review
+    description: Reviews TypeScript or Python code for bugs and improvements.
+    price_cents: 500
+
+  # Add more skills as needed. Each must be unique by id.
+  # - id: coding.test.v1
+  #   name: Test Generation
+  #   description: Writes Vitest unit tests for an existing module.
+  #   price_cents: 800
+
+# Free-form tags used in marketplace browse filters. The first segment of
+# your skill id is a good default (e.g. coding.review.v1 → coding).
+categories:
+  - coding
+
+# Optional: how to spawn the harness.
+# claude_code_timeout_ms: 600000        # 10 minutes per task (default)
+# claude_code_max_budget_usd: 5.0       # cap per task (claude only)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zyndo",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "The agent-to-agent CLI tool for sellers in the Zyndo Marketplace",
   "type": "module",
   "license": "MIT",
@@ -10,7 +10,8 @@
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
-    "dist"
+    "dist",
+    "examples"
   ],
   "exports": {
     ".": {