ln-011-agent-installer

어떤 스킬인가요?

Installs or updates Codex CLI and Claude Code. Use when CLI agents need installation or update.

설치 방법

프로젝트 폴더에서 아래 명령어를 실행하고, 설치할 에이전트를 선택하세요.

설치 명령을 직접 실행해야 적용됩니다. 지원 에이전트와 필요한 권한·라이선스는 제작자의 안내를 확인하세요.

스킬 원문 파일

<!-- SOURCE-OF-TRUTH: shared/references/audit_scoring.md. Edit ONLY here; run `node tools/marketplace/shared.mjs sync` -->

# Audit Scoring Algorithm

Mandatory scoring contract for audit workers.

## Formula

```text
penalty = (critical x 2.0) + (high x 1.0) + (medium x 0.5) + (low x 0.2)
score = max(0, 10 - penalty)
```

## Weights

| Severity | Weight | Use for |
|----------|--------|---------|
| CRITICAL | 2.0 | Security vulnerabilities, data loss, RFC/standard violations |
| HIGH | 1.0 | Architecture violations, CVE dependencies, blocking bugs |
| MEDIUM | 0.5 | Best-practice violations, code smells, minor performance issues |
| LOW | 0.2 | Style issues, minor inconsistencies, cosmetic problems |

## Score Bands

| Score | Action |
|-------|--------|
| 10 | No action |
| 8-9 | Low-priority fixes |
| 6-7 | Next-sprint fixes |
| 4-5 | Prioritized fixes |
| 1-3 | Immediate action |

Optional diagnostic sub-scores (`compliance`, `completeness`, `quality`, `implementation`) are informational only; the primary `score` always uses the formula above.

---
**Version:** 2.0.0
**Last Updated:** 2026-03-01

<!-- SOURCE-OF-TRUTH: shared/references/audit_summary_contract.md. Edit ONLY here; run `node tools/marketplace/shared.mjs sync` -->

# Audit Summary Contract

Audit payload rules for 6XX workers using the evaluation-worker summary envelope. Coordinators consume JSON summaries first and read markdown reports only for detailed evidence.

## Envelope

Audit workers emit the shared evaluation-worker envelope:

```json
{
  "schema_version": "1.0.0",
  "summary_kind": "evaluation-worker",
  "run_id": "ln-620-global-...",
  "identifier": "global",
  "producer_skill": "ln-621",
  "produced_at": "2026-03-27T10:00:00Z",
  "payload": {
    "worker": "ln-621",
    "status": "completed",
    "operation": "auditing",
    "warnings": [],
    "audit": {}
  }
}
```

Rules:
- `summary_kind` is `evaluation-worker`.
- `run_id` is mandatory; generate a standalone `run_id` when the caller does not pass one.
- `identifier` is stable inside the run and names the domain/target only.
- audit-specific fields live under `payload.audit`.

## Payload

Required `payload.audit` fields:

```json
{
  "category": "Security",
  "report_path": ".hex-skills/runtime-artifacts/runs/<run_id>/audit-report/ln-621--global.md",
  "score": 8.5,
  "issues_total": 3,
  "severity_counts": {
    "critical": 0,
    "high": 1,
    "medium": 2,
    "low": 0
  }
}
```

Allowed `payload.status`: `completed`, `skipped`, `error`. `complete` is invalid.

Optional audit fields: `diagnostic_scores`, `domain_name`, `scan_scope`, `metadata`.

## Paths

When `summaryArtifactPath` is passed, write the JSON summary to that exact path and managed filename, normally `{worker}--{identifier}.json`.

When absent, write to the standalone run-scoped path and optionally echo the same summary in structured output.

Canonical paths:
- managed: `.hex-skills/runtime-artifacts/runs/{parent_run_id}/evaluation-worker/{worker}--{identifier}.json`
- standalone: `.hex-skills/runtime-artifacts/runs/{run_id}/evaluation-worker/{worker}--{identifier}.json`

The JSON summary is the transport contract for scores, severity totals, category labels, and report location. The markdown report remains the evidence artifact for findings tables and extended data.

<!-- SOURCE-OF-TRUTH: shared/references/audit_worker_core_contract.md. Edit ONLY here; run `node tools/marketplace/shared.mjs sync` -->

# Audit Worker Core Contract

Hard envelope for audit workers that analyze one category and emit one markdown report plus one machine-readable summary.

## Inputs and Paths

Accepted inputs: `codebase_root`, `runId`, `output_dir`, `summaryArtifactPath`, `tech_stack`, `best_practices`, `domain_mode`, `current_domain`, `scan_path`.

Rules:
- `output_dir` is run-scoped runtime output, not public docs.
- Managed mode passes both `runId` and `summaryArtifactPath`.
- Standalone mode lets the worker runtime create the summary path.
- Domain-aware mode scans only `scan_path` and tags findings with `current_domain`.

## Required Runtime Refs

**MANDATORY READ:** Load `references/audit_summary_contract.md`, `references/audit_scoring.md`, and `references/templates/audit_worker_report_template.md`. Load evaluation runtime refs only when directly invoking that runtime.

## Execution Rules

- Report only unless fixes are explicitly allowed.
- Verify Layer 1 candidates before reporting.
- Use precise `file:line` locations when available.
- Apply worker-specific false-positive filters.
- Score with the shared formula.
- Write the markdown report once under `output_dir`.
- Write JSON summary to `summaryArtifactPath` or the standalone runtime path.

## Summary Payload

Minimum payload fields: `worker`, `status`, `operation=auditing`, `warnings`, `audit.category`, `audit.report_path`, `audit.score`, `audit.issues_total`, `audit.severity_counts`, optional `evidence_basis_counts`.

Default omitted finding evidence to `code_evidence`.

## Definition of Done

Input parsed; scan scope resolved; checks completed; findings include severity, location, recommendation, and effort; report and JSON summary written.

<!-- SOURCE-OF-TRUTH: shared/references/coordinator_summary_contract.md. Edit ONLY here; run `node tools/marketplace/shared.mjs sync` -->

# Coordinator Summary Contract

Runtime summary envelope for cross-skill routing. Domain fields live in the active family runtime or summary contract.

## Hard Rules

- Write summaries only under the active run output directory or the explicit caller-provided summary path.
- Never write outside `.hex-skills/runtime-artifacts/runs/{run_id}/` unless the active skill contract names another path.
- Resolve the target path before writing and reject absolute or traversal paths from user input.
- Include this envelope; add only active-family fields.

## Shared Envelope

Required fields:

```json
{
  "schema_version": "1.0",
  "run_id": "string",
  "skill": "string",
  "status": "completed|partial|failed|skipped",
  "summary_type": "string",
  "artifacts": [],
  "findings": [],
  "next_actions": []
}
```

Load only the active family contract for specialized fields.

<!-- SOURCE-OF-TRUTH: shared/references/environment_worker_runtime_contract.md. Edit ONLY here; run `node tools/marketplace/shared.mjs sync` -->

# Environment Worker Runtime Contract

Runtime contract for `ln-011` through `ln-015`.

Canonical phase/status names: `references/runtime_status_catalog.md`

## Runtime Family

- family: `environment-worker-runtime`
- terminal phases: `PAUSED`, `DONE`
- workers remain standalone-first
- managed mode requires both `runId` and `summaryArtifactPath`

## Manifest Fields

- all workers may receive `targets`, `dry_run`, `runId`, and `summaryArtifactPath`
- `ln-012` consumes `apply_ide_override`
- `ln-013` consumes `plugins` and `auto_install_providers`

## Summary Kinds

| Skill | Summary Kind |
|-------|--------------|
| `ln-011` | `env-agent-install` |
| `ln-012` | `env-mcp-config` |
| `ln-013` | `env-marketplace-align` |
| `ln-014` | `env-instructions` |
| `ln-015` | `env-cleanup` |

Payload shape follows `references/coordinator_summary_contract.md` environment worker rules.

## Guard Rules

- No transition without a checkpoint for the current phase.
- No `DONE` before a validated summary artifact is recorded.
- No `DONE` before self-check passes.
- Managed runs must write the summary to the exact caller-provided path.
- Standalone runs generate their own `run_id` and write to the family-scoped artifact path.

## Worker Independence

- Workers must not require coordinator runtime state.
- Workers may consume coordinator-provided manifests, but the public contract stays standalone-capable.
- Upward ownership stays out of worker public contracts.

---
**Version:** 1.0.0
**Last Updated:** 2026-04-10

<!-- SOURCE-OF-TRUTH: shared/templates/audit_worker_report_template.md. Edit ONLY here; run `node tools/marketplace/shared.mjs sync` -->

# Audit Worker Report Template

Markdown evidence envelope for audit workers. Coordinators consume JSON summaries first; this report supports the verdict.

## Path

Write once under `.hex-skills/runtime-artifacts/runs/{run_id}/audit-report/` using a stable name such as `{worker-id}-{slug}.md` or `{worker-id}-{slug}-{domain}.md`.

## Required Shape

```markdown
# {Category Name} Audit Report

<!-- AUDIT-META
worker: ln-62X
category: {Category Name}
domain: {domain_name|global}
scan_path: {scan_path|.}
score: {X.X}
total_issues: {N}
critical: {N}
high: {N}
medium: {N}
low: {N}
status: completed
-->

## Checks

| ID | Check | Status | Details |
|----|-------|--------|---------|
| {check_id} | {name} | {passed|failed|warning|skipped} | {brief evidence} |

## Findings

| Severity | Location | Issue | Principle | Recommendation | Effort |
|----------|----------|-------|-----------|----------------|--------|
| HIGH | path/file.ts:42 | What is wrong | Rule | How to fix | M |
```

## Optional Machine Blocks

Add only when consumed by the worker or coordinator: `FINDINGS-EXTENDED`, `DATA-EXTENDED`, or extra informational score fields. The primary penalty-based `score` remains canonical.

## Writing Rules

- Build the full report before writing; never leave partial reports.
- Sort findings by severity: CRITICAL, HIGH, MEDIUM, LOW.
- Keep recommendations actionable and effort as `S`, `M`, or `L`.
- Also write the JSON summary to the path required by `audit_worker_core_contract.md`.

---
**Version:** 2.0.0
**Last Updated:** 2026-02-15

<!-- SOURCE-OF-TRUTH: shared/references/worker_runtime_contract.md. Edit ONLY here; run `node tools/marketplace/shared.mjs sync` -->

# Worker Runtime Contract

Small deterministic runtime contract for stateful L3 workers.

## Runtime Files

Every stateful worker runtime uses:
- `manifest.json` for immutable invocation inputs
- `state.json` for mutable execution snapshot
- `checkpoints.json` for latest checkpoint per phase plus history
- `history.jsonl` for append-only runtime events

Terminal phases: `DONE`, `PAUSED`.

## Required Fields

`run_id`, `skill`, `identifier`, `phase`, `complete`, `paused_reason`, `pending_decision`, `final_result`, `resume_action`.

`resume_action` must be derived from `state.json` and checkpoints only, never from chat memory.

## Artifact Contract

Coordinator-invoked workers must receive `runId` and `summaryArtifactPath`, then write a validated summary artifact before `DONE`. Standalone workers may generate a run id and write the summary to the family-specific run-scoped path. Coordinators consume worker artifacts, not worker prose.

## Independence and Guards

- Workers depend only on shared contracts and their own domain inputs.
- Workers must not encode `Parent`, `Coordinator`, caller hierarchy, or upward orchestration state.
- No transition without a checkpoint for the current phase.
- No `DONE` before self-checks pass and the summary artifact is written.
- Public outputs and runtime artifacts stay separate.

## Family Contracts

Load the matching family contract only when it applies: environment worker, audit worker, task worker, quality worker, test planning, task planning, or planning worker.

---
**Version:** 1.0.0
**Last Updated:** 2026-04-06

---
name: ln-011-agent-installer
description: "Installs or updates Codex CLI and Claude Code. Use when CLI agents need installation or update."
license: MIT
model: claude-sonnet-4-6
---

> **Paths:** File paths (`references/`) are relative to this skill directory.

# Agent Installer

**Type:** L3 Worker
**Category:** 0XX Shared

Installs or updates the two supported CLI agents: Codex CLI and Claude Code. Single pass per agent: install then immediately verify.

**MANDATORY READ:** Load `references/coordinator_summary_contract.md`, `references/environment_worker_runtime_contract.md`, and `references/worker_runtime_contract.md`

---

## Input / Output

| Direction | Content |
|-----------|----------|
| **Input** | OS info, `disabled` flags per agent, `dry_run` flag, optional `runId`, optional `summaryArtifactPath` |
| **Output** | Structured summary envelope with `payload.status` = `completed` / `skipped` / `error`, plus per-agent install outcomes in `changes` / `detail` |

If `summaryArtifactPath` is provided, write the same summary JSON there. If not provided, return the summary inline and remain fully standalone. If `runId` is not provided, generate a standalone `run_id` before emitting the summary envelope.

## Runtime

Runtime family: `environment-worker-runtime`

Phase profile:
1. `PHASE_0_CONFIG`
2. `PHASE_1_INSTALL_VERIFY`
3. `PHASE_2_POST_CODEX_SANITY_CHECK`
4. `PHASE_3_WRITE_SUMMARY`
5. `PHASE_4_SELF_CHECK`

Runtime rules:
- emit `summary_kind=env-agent-install`
- standalone runs generate their own `run_id` and write the default worker-family artifact path
- managed runs require both `runId` and `summaryArtifactPath` and must write the summary to the exact provided path
- always write the validated summary artifact before terminal outcome

## Output Contract

Always build a structured `env-agent-install` summary envelope per:
- `references/coordinator_summary_contract.md`
- `references/environment_worker_runtime_contract.md`

Payload fields:
- `targets`
- `agents_processed`
- `agents_skipped`
- `versions`
- `codex_drift_detected`
- `status`

---

## Agent Registry

| Agent | Install Command | Health Check | Interactive |
|-------|----------------|--------------|-------------|
| Codex | `npm i -g @openai/codex` | `codex --version` | `codex` or `codex "prompt"` |
| Claude | `npm i -g @anthropic-ai/claude-code` or `claude update` | `claude --version` | `claude` or `claude "prompt"` |

Automation uses:
- Codex: `codex exec ...`
- Claude: `claude -p ...`

Note: `codex` / `codex "prompt"` are interactive TTY entrypoints. Non-interactive validation and review automation must use `codex exec ...`, because Codex rejects direct interactive mode when stdin is not a terminal.

---

## Workflow

```text
For each enabled agent: Install or Update -> Verify -> Record
```

### Phase 1: Install & Verify

For each agent in registry, apply first matching rule:

| Condition | Action | Report |
|-----------|--------|--------|
| `disabled: true` | SKIP | `disabled by user` |
| `dry_run: true` | Show planned command | `dry run` |
| Codex | `npm install -g @openai/codex` then `codex --version` | version or error |
| Claude installed | `claude update` then `claude --version` | version or error |
| Claude missing | `npm install -g @anthropic-ai/claude-code` then `claude --version` | version or error |

**Single pass:** install and verify happen atomically per agent. No separate scan phase; the install result is the state.

**Error handling:**

| Error | Detection | Response |
|-------|-----------|----------|
| npm not in PATH | `npm --version` fails | FAIL gracefully, report `npm not found in PATH` |
| Permission denied | stderr contains `EACCES` | FAIL, suggest `npm install -g --prefix ~/.local {pkg}` |
| Network error | stderr contains `ETIMEDOUT` or `ENETUNREACH` | FAIL, report `network error` |
| Unknown error | Any other non-zero exit | FAIL, include stderr |

**Output table:**

```text
Agent Installation:
| Agent  | Action    | Version  | Status |
|--------|-----------|----------|--------|
| Codex  | installed | 0.124.0  | ok     |
| Claude | updated   | 2.1.119  | ok     |
```

### Phase 2: Post-Install Codex Sanity Check

After successful Codex install/update:

1. Check `~/.codex/config.toml` top-level `approval_policy` and `sandbox_mode`.
2. Check configured Codex marketplaces for duplicate active paths to this repo.
3. If drift is found, report a WARN and defer remediation to `ln-013-config-syncer`.

This installer does not install marketplace plugins, rewrite Codex marketplace layout, or manage Codex execution defaults. It only reports drift so install success is not mistaken for a healthy two-agent environment.

---

## Critical Rules

1. **Never modify `disabled` flags.** Respect them, never change them.
2. **Fail gracefully.** One agent failure does not block the other.
3. **Global install only.** CLI tools must be in PATH.
4. **Report all changes.** Include config observations in the final summary table.
5. **Idempotent.** Safe to run multiple times.
6. **Claude and Codex only.** Do not add unrelated agent branches.
7. **Codex marketplace/plugin and execution-default remediation belongs to ln-013.** This skill may detect drift, but must not rewrite marketplace/cache layout or Codex top-level permission defaults itself.

## Anti-Patterns

| DON'T | DO |
|-------|-----|
| Separate check/install/verify phases | Single pass: install then verify |
| Retry failed installs automatically | One attempt, report failure |
| Use `sudo npm install` | Suggest `--prefix` for permission issues |
| Install agents marked `disabled` | Skip with clear report |
| Configure MCP settings or marketplace plugins here | Route environment alignment to `ln-013-config-syncer` |

---

## Definition of Done

- [ ] Codex and Claude processed in single pass (install + verify)
- [ ] Disabled agents skipped with report
- [ ] Version verified immediately after each install
- [ ] Codex marketplace/plugin and execution-default sanity checked or explicitly reported for ln-013 follow-up
- [ ] Status table displayed
- [ ] Structured summary returned
- [ ] Summary artifact written to the managed or standalone runtime path

---

**Version:** 1.1.0
**Last Updated:** 2026-03-23