dependencies:
  tools:
    - type: 'mcp'
      value: 'agent-relay'
      description: 'Agent Relay real-time messaging for multi-agent coordination'
      transport: 'stdio'
      command: 'agent-relay'
      args: ['mcp']

# Add this block to .codex/config.toml or ~/.codex/config.toml.

# Enable the hooks engine (required for auto-connect, inbox polling, stop guard)
features.codex_hooks = true

[mcp_servers.agent-relay]
command = "npx"
args = ["-y", "agent-relay", "mcp"]
env = { RELAY_API_KEY = "", RELAY_BASE_URL = "https://cast.agentrelay.com", RELAY_AGENT_TYPE = "agent" }

name = "relay-worker"
description = "Executes relay-coordinated tasks with ACK/DONE signaling"
developer_instructions = """
You are a relay-connected Codex worker.

Before doing substantive work:
1. Set the Relaycast workspace key from your assignment or environment. Do not print the key.
2. Register with Relaycast using your assigned relay name and type "agent" unless you were explicitly pre-registered.
3. Check your inbox with the same relay identity to load your task and lead context.
4. Send ACK to your lead with a one-sentence understanding of the assignment.
5. If you are blocked or the task is ambiguous, send BLOCKED instead of guessing.

Working rules:
- Include as: "<agent-name>" on relay calls that support explicit attribution.
- Stay within the assigned scope and do not spawn more workers unless the lead explicitly directs you to.
- Check inbox again after meaningful milestones, during long-running work, and before exit.
- Keep status updates concise and factual.

Completion:
- Send DONE before exiting.
- Include evidence when relevant: files changed, commands run, tests executed, or decisions made.
"""
mcp_servers = ["agent-relay"]

{
  "hooks": {
    "SessionStart": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "bash .agents/skills/agent-relay/hooks/session-start.sh",
            "timeoutSec": 15,
            "statusMessage": "Connecting Relaycast"
          }
        ]
      }
    ],
    "UserPromptSubmit": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "bash .agents/skills/agent-relay/hooks/prompt-inbox.sh",
            "timeoutSec": 5,
            "statusMessage": "Checking relay inbox"
          }
        ]
      }
    ],
    "Stop": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "bash .agents/skills/agent-relay/hooks/stop-inbox.sh",
            "timeoutSec": 5,
            "statusMessage": "Verifying relay inbox"
          }
        ]
      }
    ]
  }
}

#!/usr/bin/env bash

set -euo pipefail

SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
PLUGIN_DIR=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
ENV_FILE="${PLUGIN_DIR}/.env"
BASE_RELAY_DIR="${HOME}/.relay"
# Per-agent namespacing: use RELAY_AGENT_NAME to avoid concurrent agents
# overwriting each other's state files
_agent_ns=$(printf '%s' "${RELAY_AGENT_NAME:-}" | tr -c 'A-Za-z0-9._-' '-' | sed 's/^-*//; s/-*$//' | cut -c1-64)
if [ -n "$_agent_ns" ]; then
  RELAY_DIR="${BASE_RELAY_DIR}/agents/${_agent_ns}"
else
  RELAY_DIR="${BASE_RELAY_DIR}"
fi
TOKEN_FILE="${RELAY_DIR}/token"
STATE_FILE="${RELAY_DIR}/codex-session.json"
LAST_POLL_FILE="${RELAY_DIR}/last-poll"
DEFAULT_BASE_URL="https://cast.agentrelay.com"
EMPTY_OUTPUT='{}'
MAX_RENDERED_MESSAGES=20
MIN_POLL_INTERVAL=3

load_env() {
  if [ -f "$ENV_FILE" ]; then
    set -a
    # shellcheck disable=SC1090
    . "$ENV_FILE"
    set +a
  fi
}

command_exists() {
  command -v "$1" >/dev/null 2>&1
}

trim() {
  printf '%s' "${1:-}" | awk '{$1=$1;print}'
}

normalize_base_url() {
  local value
  value=$(trim "${1:-}")
  if [ -z "$value" ] && [ -f "$STATE_FILE" ] && command_exists jq; then
    value=$(jq -r '.baseUrl // empty' "$STATE_FILE" 2>/dev/null || true)
  fi
  value=$(trim "${value:-$DEFAULT_BASE_URL}")
  value=${value%/}
  printf '%s' "${value:-$DEFAULT_BASE_URL}"
}

read_token() {
  local token
  token=$(trim "${RELAY_TOKEN:-}")
  if [ -n "$token" ]; then
    printf '%s' "$token"
    return
  fi
  if [ -s "$TOKEN_FILE" ]; then
    trim "$(cat "$TOKEN_FILE" 2>/dev/null || true)"
    return
  fi
  printf ''
}

should_skip_poll() {
  local now last elapsed
  now=$(date +%s)
  if [ -f "$LAST_POLL_FILE" ]; then
    last=$(cat "$LAST_POLL_FILE" 2>/dev/null || printf '0')
    case "$last" in
      ''|*[!0-9]*) last=0 ;;
    esac
    elapsed=$((now - last))
    if [ "$elapsed" -lt "$MIN_POLL_INTERVAL" ]; then
      return 0
    fi
  fi
  mkdir -p "$RELAY_DIR"
  printf '%s\n' "$now" > "$LAST_POLL_FILE"
  return 1
}

main() {
  local token base_url messages count formatted overflow context

  load_env

  if ! command_exists curl || ! command_exists jq; then
    printf '%s\n' "$EMPTY_OUTPUT"
    exit 0
  fi

  if should_skip_poll; then
    printf '%s\n' "$EMPTY_OUTPUT"
    exit 0
  fi

  token=$(read_token)
  if [ -z "$token" ]; then
    printf '%s\n' "$EMPTY_OUTPUT"
    exit 0
  fi

  base_url=$(normalize_base_url "${RELAY_BASE_URL:-}")
  messages=$(
    curl -fsS \
      -X POST \
      -H "Authorization: Bearer ${token}" \
      -H 'Content-Type: application/json' \
      -d '{}' \
      "${base_url}/v1/inbox/check" 2>/dev/null || true
  )

  if [ -z "$messages" ]; then
    printf '%s\n' "$EMPTY_OUTPUT"
    exit 0
  fi

  count=$(printf '%s' "$messages" | jq -r '(.messages // []) | length' 2>/dev/null || printf '0')
  case "$count" in
    ''|*[!0-9]*) count=0 ;;
  esac

  if [ "$count" -eq 0 ]; then
    printf '%s\n' "$EMPTY_OUTPUT"
    exit 0
  fi

  formatted=$(
    printf '%s' "$messages" | jq -r --argjson limit "$MAX_RENDERED_MESSAGES" '
      (.messages // [])
      | .[:$limit]
      | map(
          if ((.channel // "") | length) > 0 then
            "Relay message from \(.from // "unknown") in #\(.channel)\(if ((.id // "") | length) > 0 then " [\(.id)]" else "" end): \((.text // "") | gsub("[\\r\\n]+"; " "))"
          else
            "Relay message from \(.from // "unknown")\(if ((.id // "") | length) > 0 then " [\(.id)]" else "" end): \((.text // "") | gsub("[\\r\\n]+"; " "))"
          end
        )
      | join("\n")
    ' 2>/dev/null || true
  )

  if [ -z "$formatted" ]; then
    printf '%s\n' "$EMPTY_OUTPUT"
    exit 0
  fi

  overflow=""
  if [ "$count" -gt "$MAX_RENDERED_MESSAGES" ]; then
    overflow=$(printf '\n... and %s more unread relay message(s).' "$((count - MAX_RENDERED_MESSAGES))")
  fi

  context=$(printf 'Relay inbox update (%s unread):\n%s%s\nRead and respond to any messages that affect the current task.' "$count" "$formatted" "$overflow")
  jq -nc \
    --arg context "$context" \
    '{
      hookSpecificOutput: {
        hookEventName: "UserPromptSubmit",
        additionalContext: $context
      }
    }'
}

main "$@"

#!/usr/bin/env bash

set -euo pipefail

SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
PLUGIN_DIR=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
ENV_FILE="${PLUGIN_DIR}/.env"
BASE_RELAY_DIR="${HOME}/.relay"
# Per-agent namespacing: use RELAY_AGENT_NAME to avoid concurrent agents
# overwriting each other's state files
_agent_ns=$(printf '%s' "${RELAY_AGENT_NAME:-}" | tr -c 'A-Za-z0-9._-' '-' | sed 's/^-*//; s/-*$//' | cut -c1-64)
if [ -n "$_agent_ns" ]; then
  RELAY_DIR="${BASE_RELAY_DIR}/agents/${_agent_ns}"
else
  RELAY_DIR="${BASE_RELAY_DIR}"
fi
KEY_FILE="${RELAY_DIR}/workspace-key"
TOKEN_FILE="${RELAY_DIR}/token"
STATE_FILE="${RELAY_DIR}/codex-session.json"
DEFAULT_BASE_URL="https://cast.agentrelay.com"

load_env() {
  if [ -f "$ENV_FILE" ]; then
    set -a
    # shellcheck disable=SC1090
    . "$ENV_FILE"
    set +a
  fi
}

run_local_setup() {
  if [ -x "${PLUGIN_DIR}/scripts/setup.sh" ]; then
    "${PLUGIN_DIR}/scripts/setup.sh" "$PWD" >/dev/null 2>&1 || true
  fi
}

command_exists() {
  command -v "$1" >/dev/null 2>&1
}

trim() {
  printf '%s' "${1:-}" | awk '{$1=$1;print}'
}

normalize_base_url() {
  local value
  value=$(trim "${1:-$DEFAULT_BASE_URL}")
  value=${value%/}
  printf '%s' "${value:-$DEFAULT_BASE_URL}"
}

json_value() {
  local payload="$1"
  local query="$2"
  printf '%s' "$payload" | jq -r "$query // empty" 2>/dev/null || true
}

sanitize() {
  printf '%s' "${1:-}" | tr -c 'A-Za-z0-9._-' '-' | sed 's/^-*//; s/-*$//' | cut -c1-64
}

derive_workspace_name() {
  local user host suffix
  user=$(sanitize "${USER:-${USERNAME:-codex}}")
  host=$(hostname 2>/dev/null | cut -d '.' -f 1 | tr -c 'A-Za-z0-9._-' '-' | sed 's/^-*//; s/-*$//' | cut -c1-20)
  suffix=$(date +%s)
  printf 'codex-%s-%s-%s' "${user:-codex}" "${host:-local}" "$suffix" | cut -c1-64
}

read_existing_agent_name() {
  if [ -f "$STATE_FILE" ] && command_exists jq; then
    jq -r '.agentName // empty' "$STATE_FILE" 2>/dev/null || true
  fi
}

derive_agent_name() {
  local explicit existing user host suffix
  explicit=$(trim "${RELAY_AGENT_NAME:-}")
  if [ -n "$explicit" ]; then
    sanitize "$explicit"
    return
  fi

  existing=$(trim "$(read_existing_agent_name)")
  if [ -n "$existing" ]; then
    sanitize "$existing"
    return
  fi

  user=$(sanitize "${USER:-${USERNAME:-codex}}")
  host=$(hostname 2>/dev/null | cut -d '.' -f 1 | tr -c 'A-Za-z0-9._-' '-' | sed 's/^-*//; s/-*$//' | cut -c1-20)
  suffix=$(date +%s | tail -c 7)
  printf 'codex-%s-%s-%s' "${user:-codex}" "${host:-local}" "$suffix" | cut -c1-64
}

write_file() {
  local path="$1"
  local content="$2"
  printf '%s' "$content" > "$path"
}

create_workspace() {
  local base_url="$1"
  local name="$2"
  curl -fsS \
    -X POST \
    -H 'Content-Type: application/json' \
    -d "$(jq -nc --arg name "$name" '{name: $name}')" \
    "${base_url}/v1/workspaces" 2>/dev/null || true
}

register_v1_agents() {
  local base_url="$1"
  local workspace_key="$2"
  local agent_name="$3"
  curl -fsS \
    -X POST \
    -H "Authorization: Bearer ${workspace_key}" \
    -H 'Content-Type: application/json' \
    -d "$(jq -nc --arg name "$agent_name" '{name: $name, agent_type: "agent", type: "agent"}')" \
    "${base_url}/v1/agents" 2>/dev/null || true
}

register_v1_register() {
  local base_url="$1"
  local workspace_key="$2"
  local agent_name="$3"
  curl -fsS \
    -X POST \
    -H 'Content-Type: application/json' \
    -d "$(jq -nc --arg workspace "$workspace_key" --arg name "$agent_name" '{workspace: $workspace, name: $name, cli: "codex", type: "agent"}')" \
    "${base_url}/v1/register" 2>/dev/null || true
}

persist_state() {
  local base_url="$1"
  local workspace_key="$2"
  local workspace_id="$3"
  local agent_id="$4"
  local agent_name="$5"
  local token="$6"

  write_file "$KEY_FILE" "$workspace_key"
  chmod 600 "$KEY_FILE"
  write_file "$TOKEN_FILE" "$token"
  chmod 600 "$TOKEN_FILE"
  jq -nc \
    --arg baseUrl "$base_url" \
    --arg workspaceKey "$workspace_key" \
    --arg workspaceId "$workspace_id" \
    --arg agentId "$agent_id" \
    --arg agentName "$agent_name" \
    --arg token "$token" \
    --arg updatedAt "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
    '{
      baseUrl: $baseUrl,
      workspaceKey: $workspaceKey,
      workspaceId: $workspaceId,
      agentId: $agentId,
      agentName: $agentName,
      token: $token,
      cli: "codex",
      updatedAt: $updatedAt
    }' > "$STATE_FILE"
  chmod 600 "$STATE_FILE"
}

main() {
  run_local_setup
  load_env

  if ! command_exists curl || ! command_exists jq; then
    exit 0
  fi

  mkdir -p "$RELAY_DIR"

  local base_url workspace_key workspace_id agent_name registration token registered_name agent_id
  base_url=$(normalize_base_url "${RELAY_BASE_URL:-}")
  workspace_key=$(trim "${RELAY_API_KEY:-}")
  workspace_id=""

  if [ -z "$workspace_key" ] && [ -s "$KEY_FILE" ]; then
    workspace_key=$(trim "$(cat "$KEY_FILE" 2>/dev/null || true)")
  fi

  if [ -z "$workspace_key" ]; then
    local created
    created=$(create_workspace "$base_url" "$(derive_workspace_name)")
    workspace_key=$(json_value "$created" '.api_key')
    [ -z "$workspace_key" ] && workspace_key=$(json_value "$created" '.apiKey')
    [ -z "$workspace_key" ] && workspace_key=$(json_value "$created" '.data.api_key')
    [ -z "$workspace_key" ] && workspace_key=$(json_value "$created" '.data.apiKey')
    workspace_id=$(json_value "$created" '.workspace_id')
    [ -z "$workspace_id" ] && workspace_id=$(json_value "$created" '.workspaceId')
    [ -z "$workspace_id" ] && workspace_id=$(json_value "$created" '.data.workspace_id')
    [ -z "$workspace_id" ] && workspace_id=$(json_value "$created" '.data.workspaceId')
  fi

  [ -z "$workspace_key" ] && exit 0

  agent_name=$(derive_agent_name)

  # Re-namespace state directory now that we know the agent name
  RELAY_DIR="${BASE_RELAY_DIR}/agents/${agent_name}"
  KEY_FILE="${RELAY_DIR}/workspace-key"
  TOKEN_FILE="${RELAY_DIR}/token"
  STATE_FILE="${RELAY_DIR}/codex-session.json"
  mkdir -p "$RELAY_DIR"

  registration=$(register_v1_agents "$base_url" "$workspace_key" "$agent_name")
  if [ -z "$registration" ]; then
    registration=$(register_v1_register "$base_url" "$workspace_key" "$agent_name")
  fi
  [ -z "$registration" ] && exit 0

  token=$(json_value "$registration" '.token')
  [ -z "$token" ] && token=$(json_value "$registration" '.data.token')
  registered_name=$(json_value "$registration" '.name')
  [ -z "$registered_name" ] && registered_name=$(json_value "$registration" '.data.name')
  agent_id=$(json_value "$registration" '.id')
  [ -z "$agent_id" ] && agent_id=$(json_value "$registration" '.agent_id')
  [ -z "$agent_id" ] && agent_id=$(json_value "$registration" '.data.id')
  [ -z "$agent_id" ] && agent_id=$(json_value "$registration" '.data.agent_id')
  [ -z "$workspace_id" ] && workspace_id=$(json_value "$registration" '.workspace_id')
  [ -z "$workspace_id" ] && workspace_id=$(json_value "$registration" '.workspaceId')
  [ -z "$workspace_id" ] && workspace_id=$(json_value "$registration" '.data.workspace_id')
  [ -z "$workspace_id" ] && workspace_id=$(json_value "$registration" '.data.workspaceId')

  [ -z "$token" ] && exit 0
  [ -z "$registered_name" ] && registered_name="$agent_name"
  [ -z "$agent_id" ] && agent_id="$registered_name"
  [ -z "$workspace_id" ] && workspace_id="ws_unknown"

  persist_state "$base_url" "$workspace_key" "$workspace_id" "$agent_id" "$registered_name" "$token"
}

main "$@"

#!/usr/bin/env bash

set -euo pipefail

SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
PLUGIN_DIR=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
ENV_FILE="${PLUGIN_DIR}/.env"
BASE_RELAY_DIR="${HOME}/.relay"
# Per-agent namespacing: use RELAY_AGENT_NAME to avoid concurrent agents
# overwriting each other's state files
_agent_ns=$(printf '%s' "${RELAY_AGENT_NAME:-}" | tr -c 'A-Za-z0-9._-' '-' | sed 's/^-*//; s/-*$//' | cut -c1-64)
if [ -n "$_agent_ns" ]; then
  RELAY_DIR="${BASE_RELAY_DIR}/agents/${_agent_ns}"
else
  RELAY_DIR="${BASE_RELAY_DIR}"
fi
TOKEN_FILE="${RELAY_DIR}/token"
STATE_FILE="${RELAY_DIR}/codex-session.json"
DEFAULT_BASE_URL="https://cast.agentrelay.com"
EMPTY_OUTPUT='{}'
MAX_RENDERED_MESSAGES=20

load_env() {
  if [ -f "$ENV_FILE" ]; then
    set -a
    # shellcheck disable=SC1090
    . "$ENV_FILE"
    set +a
  fi
}

command_exists() {
  command -v "$1" >/dev/null 2>&1
}

trim() {
  printf '%s' "${1:-}" | awk '{$1=$1;print}'
}

normalize_base_url() {
  local value
  value=$(trim "${1:-}")
  if [ -z "$value" ] && [ -f "$STATE_FILE" ] && command_exists jq; then
    value=$(jq -r '.baseUrl // empty' "$STATE_FILE" 2>/dev/null || true)
  fi
  value=$(trim "${value:-$DEFAULT_BASE_URL}")
  value=${value%/}
  printf '%s' "${value:-$DEFAULT_BASE_URL}"
}

json_number() {
  local payload="$1"
  local query="$2"
  printf '%s' "$payload" | jq -r "$query" 2>/dev/null || printf '0'
}

read_stop_hook_active() {
  if ! command_exists jq; then
    printf 'false'
    return
  fi

  jq -r '.stop_hook_active // false' 2>/dev/null || printf 'false'
}

read_token() {
  local token
  token=$(trim "${RELAY_TOKEN:-}")
  if [ -n "$token" ]; then
    printf '%s' "$token"
    return
  fi
  if [ -s "$TOKEN_FILE" ]; then
    trim "$(cat "$TOKEN_FILE" 2>/dev/null || true)"
    return
  fi
  printf ''
}

main() {
  local input stop_hook_active token base_url messages count formatted overflow reason

  load_env

  if ! command_exists curl || ! command_exists jq; then
    printf '%s\n' "$EMPTY_OUTPUT"
    exit 0
  fi

  input=$(cat)
  stop_hook_active=$(printf '%s' "$input" | read_stop_hook_active)
  if [ "$stop_hook_active" = "true" ]; then
    printf '%s\n' "$EMPTY_OUTPUT"
    exit 0
  fi

  token=$(read_token)
  if [ -z "$token" ]; then
    printf '%s\n' "$EMPTY_OUTPUT"
    exit 0
  fi

  base_url=$(normalize_base_url "${RELAY_BASE_URL:-}")
  messages=$(
    curl -fsS \
      -X POST \
      -H "Authorization: Bearer ${token}" \
      -H 'Content-Type: application/json' \
      -d '{}' \
      "${base_url}/v1/inbox/check" 2>/dev/null || true
  )

  if [ -z "$messages" ]; then
    printf '%s\n' "$EMPTY_OUTPUT"
    exit 0
  fi

  count=$(json_number "$messages" '(.messages // []) | length')
  case "$count" in
    ''|*[!0-9]*) count=0 ;;
  esac

  if [ "$count" -eq 0 ]; then
    printf '%s\n' "$EMPTY_OUTPUT"
    exit 0
  fi

  formatted=$(
    printf '%s' "$messages" | jq -r --argjson limit "$MAX_RENDERED_MESSAGES" '
      (.messages // [])
      | .[:$limit]
      | map(
          if ((.channel // "") | length) > 0 then
            "Relay message from \(.from // "unknown") in #\(.channel)\(if ((.id // "") | length) > 0 then " [\(.id)]" else "" end): \((.text // "") | gsub("[\\r\\n]+"; " "))"
          else
            "Relay message from \(.from // "unknown")\(if ((.id // "") | length) > 0 then " [\(.id)]" else "" end): \((.text // "") | gsub("[\\r\\n]+"; " "))"
          end
        )
      | join("\n")
    ' 2>/dev/null || true
  )

  if [ -z "$formatted" ]; then
    printf '%s\n' "$EMPTY_OUTPUT"
    exit 0
  fi

  overflow=""
  if [ "$count" -gt "$MAX_RENDERED_MESSAGES" ]; then
    overflow=$(printf '\n... and %s more unread relay message(s).' "$((count - MAX_RENDERED_MESSAGES))")
  fi

  reason=$(printf 'You have %s unread relay message(s). Please read and respond before stopping:\n%s%s' "$count" "$formatted" "$overflow")
  jq -nc --arg reason "$reason" '{decision: "block", reason: $reason}'
}

main "$@"

#!/usr/bin/env bash

set -euo pipefail

SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
SKILL_DIR=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
TARGET_ROOT="${1:-$PWD}"
CODEX_DIR="${TARGET_ROOT}/.codex"
AGENTS_DIR="${CODEX_DIR}/agents"
CONFIG_FILE="${CODEX_DIR}/config.toml"
HOOKS_FILE="${CODEX_DIR}/hooks.json"
WORKER_SOURCE="${SKILL_DIR}/codex-config/relay-worker.toml"
WORKER_TARGET="${AGENTS_DIR}/relay-worker.toml"

command_exists() {
  command -v "$1" >/dev/null 2>&1
}

shell_quote() {
  printf "'%s'" "$(printf '%s' "$1" | sed "s/'/'\\\\''/g")"
}

write_if_changed() {
  local path="$1"
  local tmp="$2"

  if [ -f "$path" ] && cmp -s "$path" "$tmp"; then
    rm -f "$tmp"
    return
  fi

  mv "$tmp" "$path"
}

ensure_features_codex_hooks() {
  local file="$1"
  local tmp
  tmp=$(mktemp)

  awk '
    BEGIN {
      in_features = 0
      features_seen = 0
      codex_hooks_written = 0
    }
    function write_codex_hooks() {
      if (!codex_hooks_written) {
        print "codex_hooks = true"
        codex_hooks_written = 1
      }
    }
    {
      if ($0 ~ /^[[:space:]]*features[.]codex_hooks[[:space:]]*=/) {
        print "features.codex_hooks = true"
        codex_hooks_written = 1
        next
      }

      if ($0 ~ /^\[[^]]+\][[:space:]]*$/) {
        if (in_features) {
          write_codex_hooks()
        }
        if ($0 == "[features]") {
          in_features = 1
          features_seen = 1
        } else {
          in_features = 0
        }
        print
        next
      }

      if (in_features && $0 ~ /^[[:space:]]*codex_hooks[[:space:]]*=/) {
        write_codex_hooks()
        next
      }

      print
    }
    END {
      if (in_features) {
        write_codex_hooks()
      }
      if (!features_seen && !codex_hooks_written) {
        if (NR > 0) {
          print ""
        }
        print "[features]"
        print "codex_hooks = true"
      }
    }
  ' "$file" > "$tmp"

  write_if_changed "$file" "$tmp"
}

ensure_top_level_approval_policy() {
  local file="$1"
  local tmp
  tmp=$(mktemp)

  awk '
    BEGIN {
      found = 0
      first_section = 0
      inserted = 0
    }
    {
      # If we find approval_policy at top level (before any section or as dotted key), mark found
      if (!first_section && $0 ~ /^[[:space:]]*approval_policy[[:space:]]*=/) {
        found = 1
        print
        next
      }

      # Detect first section header
      if ($0 ~ /^\[[^]]+\][[:space:]]*$/) {
        if (!first_section && !found && !inserted) {
          # Insert approval_policy before the first section header
          print "approval_policy = \"on-request\""
          print ""
          inserted = 1
        }
        first_section = 1
      }

      print
    }
    END {
      # File has no sections at all
      if (!found && !inserted) {
        if (NR > 0) {
          print ""
        }
        print "approval_policy = \"on-request\""
      }
    }
  ' "$file" > "$tmp"

  write_if_changed "$file" "$tmp"
}

ensure_agent_relay_mcp_block() {
  local file="$1"
  local tmp
  tmp=$(mktemp)

  awk '
    BEGIN {
      in_block = 0
      block_seen = 0
      dotted_seen = 0
      command_seen = 0
      args_seen = 0
      env_seen = 0
      command_line = "command = \"npx\""
      args_line = "args = [\"-y\", \"agent-relay\", \"mcp\"]"
      env_line = "env = { RELAY_API_KEY = \"\", RELAY_BASE_URL = \"https://cast.agentrelay.com\", RELAY_AGENT_TYPE = \"agent\" }"
    }
    function write_missing_keys() {
      if (!command_seen) {
        print command_line
        command_seen = 1
      }
      if (!args_seen) {
        print args_line
        args_seen = 1
      }
      if (!env_seen) {
        print env_line
        env_seen = 1
      }
    }
    {
      if (!in_block && $0 ~ /^[[:space:]]*mcp_servers[.]agent-relay[.]command[[:space:]]*=/) {
        block_seen = 1
        dotted_seen = 1
        command_seen = 1
        command_line = $0
        sub(/^[[:space:]]*mcp_servers[.]agent-relay[.]command[[:space:]]*=/, "command =", command_line)
        print
        next
      }
      if (!in_block && $0 ~ /^[[:space:]]*mcp_servers[.]agent-relay[.]args[[:space:]]*=/) {
        block_seen = 1
        dotted_seen = 1
        args_seen = 1
        args_line = $0
        sub(/^[[:space:]]*mcp_servers[.]agent-relay[.]args[[:space:]]*=/, "args =", args_line)
        print
        next
      }
      if (!in_block && $0 ~ /^[[:space:]]*mcp_servers[.]agent-relay[.]env[[:space:]]*=/) {
        block_seen = 1
        dotted_seen = 1
        env_seen = 1
        env_line = $0
        sub(/^[[:space:]]*mcp_servers[.]agent-relay[.]env[[:space:]]*=/, "env =", env_line)
        print
        next
      }

      if ($0 ~ /^\[[^]]+\][[:space:]]*$/) {
        if (in_block) {
          write_missing_keys()
        }
        if ($0 == "[mcp_servers.agent-relay]") {
          in_block = 1
          block_seen = 1
        } else {
          in_block = 0
        }
        print
        next
      }

      if (in_block) {
        if ($0 ~ /^[[:space:]]*command[[:space:]]*=/) {
          command_seen = 1
          print
          next
        }
        if ($0 ~ /^[[:space:]]*args[[:space:]]*=/) {
          args_seen = 1
          print
          next
        }
        if ($0 ~ /^[[:space:]]*env[[:space:]]*=/) {
          env_seen = 1
          print
          next
        }
      }

      print
    }
    END {
      if (in_block) {
        write_missing_keys()
      }
      if (!block_seen && !dotted_seen) {
        if (NR > 0) {
          print ""
        }
        print "[mcp_servers.agent-relay]"
        print command_line
        print args_line
        print env_line
      }
    }
  ' "$file" > "$tmp"

  write_if_changed "$file" "$tmp"
}

desired_hooks_json() {
  local session_cmd prompt_cmd stop_cmd
  session_cmd="bash $(shell_quote "${SKILL_DIR}/hooks/session-start.sh")"
  prompt_cmd="bash $(shell_quote "${SKILL_DIR}/hooks/prompt-inbox.sh")"
  stop_cmd="bash $(shell_quote "${SKILL_DIR}/hooks/stop-inbox.sh")"

  jq -n \
    --arg session_cmd "$session_cmd" \
    --arg prompt_cmd "$prompt_cmd" \
    --arg stop_cmd "$stop_cmd" \
    '{
      hooks: {
        SessionStart: [
          {
            hooks: [
              {
                type: "command",
                command: $session_cmd,
                timeoutSec: 15,
                statusMessage: "Connecting Relaycast"
              }
            ]
          }
        ],
        UserPromptSubmit: [
          {
            hooks: [
              {
                type: "command",
                command: $prompt_cmd,
                timeoutSec: 5,
                statusMessage: "Checking relay inbox"
              }
            ]
          }
        ],
        Stop: [
          {
            hooks: [
              {
                type: "command",
                command: $stop_cmd,
                timeoutSec: 5,
                statusMessage: "Verifying relay inbox"
              }
            ]
          }
        ]
      }
    }'
}

merge_hooks_file() {
  local desired_json="$1"
  local tmp
  tmp=$(mktemp)

  if [ -f "$HOOKS_FILE" ] && jq empty "$HOOKS_FILE" >/dev/null 2>&1; then
    jq \
      --argjson desired "$desired_json" \
      '
        def remove_owned_groups($event; $status; $script):
          .hooks[$event] = (
            (.hooks[$event] // [])
            | map(
                select(
                  (
                    (.hooks // [])
                    | any(
                        ((.statusMessage // "") == $status) or
                        (((.command // "") | tostring) | contains($script))
                      )
                  ) | not
                )
              )
          );

        .hooks = (.hooks // {})
        | remove_owned_groups("SessionStart"; "Connecting Relaycast"; "session-start.sh")
        | remove_owned_groups("UserPromptSubmit"; "Checking relay inbox"; "prompt-inbox.sh")
        | remove_owned_groups("Stop"; "Verifying relay inbox"; "stop-inbox.sh")
        | .hooks.SessionStart = ((.hooks.SessionStart // []) + $desired.hooks.SessionStart)
        | .hooks.UserPromptSubmit = ((.hooks.UserPromptSubmit // []) + $desired.hooks.UserPromptSubmit)
        | .hooks.Stop = ((.hooks.Stop // []) + $desired.hooks.Stop)
      ' "$HOOKS_FILE" > "$tmp"
  else
    printf '%s\n' "$desired_json" > "$tmp"
  fi

  write_if_changed "$HOOKS_FILE" "$tmp"
}

install_worker_agent() {
  if [ ! -f "$WORKER_SOURCE" ]; then
    return
  fi

  local tmp
  tmp=$(mktemp)
  cp "$WORKER_SOURCE" "$tmp"
  write_if_changed "$WORKER_TARGET" "$tmp"
}

main() {
  if ! command_exists jq; then
    exit 0
  fi

  mkdir -p "$CODEX_DIR" "$AGENTS_DIR"
  touch "$CONFIG_FILE"

  chmod +x "${SKILL_DIR}/scripts/setup.sh" "${SKILL_DIR}/hooks/"*.sh 2>/dev/null || true

  ensure_features_codex_hooks "$CONFIG_FILE"
  ensure_top_level_approval_policy "$CONFIG_FILE"
  ensure_agent_relay_mcp_block "$CONFIG_FILE"
  merge_hooks_file "$(desired_hooks_json)"
  install_worker_agent
}

main "$@"