From 16a1959074fdbbf253c0418efe54e2b1ca46d3f8 Mon Sep 17 00:00:00 2001
From: disqualifier <dev@disqualifier.me>
Date: Thu, 15 Oct 2026 15:42:21 -0400
Subject: [PATCH] Codex is wired up where codex is installed

Synced from the source repo. install.sh and install.ps1 now run
`standup install --runtime codex` machine-wide where codex is on PATH,
with --no-codex / -NoCodex to opt out, and name the per-project
AGENTS.md step in their closing lines.

Signed-off-by: disqualifier <dev@disqualifier.me>
---
 install.ps1 | 19 +++++++++++++------
 install.sh  | 22 +++++++++++++++-------
 2 files changed, 28 insertions(+), 13 deletions(-)

diff --git a/install.ps1 b/install.ps1
index dcd1809..f2d80d3 100644
--- a/install.ps1
+++ b/install.ps1
@@ -243,6 +243,15 @@ if (-not $serviceOnly) {
   & standup install --runtime claude
   if ($LASTEXITCODE -ne 0) { Warn 'runtime install reported a problem; see doctor below' }
 
+  # Codex where its binary exists. Machine-wide: the skill and the hooks. The
+  # AGENTS.md step needs a project and is skipped here -- named in the closing
+  # lines instead. Not run at all without codex, so no marked blocks are left
+  # for a tool that is not installed; -NoCodex opts out where it is.
+  if (-not $NoCodex -and $codexBin) {
+    & standup install --runtime codex
+    if ($LASTEXITCODE -ne 0) { Warn 'codex runtime install reported a problem; see doctor below' }
+  }
+
   if ($probe -and -not $probe.HasExited) { Stop-Process -Id $probe.Id -Force -ErrorAction SilentlyContinue }
   Remove-Item -Recurse -Force $probeDir -ErrorAction SilentlyContinue
 }
@@ -300,13 +309,11 @@ Write-Host ''
 & standup code
 Write-Host ''
 Write-Host 'Next: cd <your project>; standup create'
-# Codex's runtime is per-project -- one of its three targets is the project's
-# own AGENTS.md -- so the installer cannot wire it from here: there is no
-# project yet, and the runtime step's throwaway is deleted. Name the command
-# instead, only where codex exists and the user has not opted out.
 if (-not $NoCodex -and $codexBin) {
   Write-Host ''
-  Write-Host 'Codex is installed here. In each project you want it in:'
-  Write-Host '  standup install --runtime codex    # hooks, skill, a block in AGENTS.md'
+  Write-Host 'Codex: the skill and hooks are wired machine-wide. Codex must TRUST them:'
+  Write-Host '  run /hooks inside Codex and approve.'
+  Write-Host 'Per project, for the room rules in AGENTS.md:'
+  Write-Host '  standup install --runtime codex'
 }
 }
diff --git a/install.sh b/install.sh
index 9b4d399..b8f6fcf 100755
--- a/install.sh
+++ b/install.sh
@@ -426,6 +426,13 @@ if [ "$SERVICE_ONLY" = 0 ]; then
     done
   fi
   standup install --runtime claude || warn "runtime install reported a problem; see doctor below"
+  # Codex where its binary exists. Machine-wide: the skill and the hooks. The
+  # AGENTS.md step needs a project and is skipped here -- named in the closing
+  # lines instead. Not run at all without codex, so no marked blocks are left
+  # for a tool that is not installed; --no-codex opts out where it is.
+  if [ "$NO_CODEX" = 0 ] && [ -n "$CODEX_BIN" ]; then
+    standup install --runtime codex || warn "codex runtime install reported a problem; see doctor below"
+  fi
   [ -n "$PROBE_PID" ] && { kill "$PROBE_PID" 2>/dev/null || true; wait "$PROBE_PID" 2>/dev/null || true; PROBE_PID=""; }
   rm -rf "$PROBE_DIR"; PROBE_DIR=""
 fi
@@ -471,9 +478,12 @@ if [ -n "$DAEMON_NODE" ]; then
     service_as_operator start >/dev/null 2>&1 \
       || warn "service installed but did not start; see 'standup service status'"
   elif printf '%s' "$SVC_OUT" | grep -qi 'connect to bus'; then
+    # By hand on the unit's home, `standup daemon` is operator-only once a
+    # code exists (P8-06), so the hint carries the flag (R213 C1).
     warn "no systemd --user bus here, so the unit was written but not enabled.
          If this is WSL2: add [boot] systemd=true to /etc/wsl.conf, then 'wsl --shutdown'.
-         Until then run 'standup daemon' yourself; single mode needs nothing."
+         Until then run 'standup daemon --code <operator code>' yourself ('standup code'
+         prints it); single mode needs nothing."
   else
     warn "service install failed; single mode still works. See 'standup service status'."
   fi
@@ -494,12 +504,10 @@ say ""
 standup code 2>/dev/null || say "  (run 'standup code' for the operator code)"
 say ""
 say "Next: cd <your project> && standup create"
-# Codex's runtime is per-project -- one of its three targets is the project's
-# own AGENTS.md -- so the installer cannot wire it from here: there is no
-# project yet, and step 7's throwaway is deleted. Name the command instead,
-# only where codex exists and the user has not opted out.
 if [ "$NO_CODEX" = 0 ] && [ -n "$CODEX_BIN" ]; then
   say ""
-  say "Codex is installed here. In each project you want it in:"
-  say "  standup install --runtime codex    # hooks, skill, a block in AGENTS.md"
+  say "Codex: the skill and hooks are wired machine-wide. Codex must TRUST them:"
+  say "  run /hooks inside Codex and approve."
+  say "Per project, for the room rules in AGENTS.md:"
+  say "  standup install --runtime codex"
 fi