公開リリース候補と価格改定後のサブエージェント構成を整備

.gitattributes

@@ -1,4 +1,4 @@
-* text=auto
+* text=auto eol=lf
 .gitattributes text eol=lf
 *.md text eol=lf
 *.toml text eol=lf

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,52 @@
+name: バグ報告
+description: 再現可能な不具合を報告します
+title: "[Bug] "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        セキュリティ上の問題は公開 issue に書かず、Security advisory から報告してください。
+  - type: input
+    id: codex-version
+    attributes:
+      label: Codex のバージョン
+      placeholder: codex-cli 0.145.0
+    validations:
+      required: true
+  - type: dropdown
+    id: platform
+    attributes:
+      label: 実行環境
+      options:
+        - Windows / PowerShell
+        - Linux / Bash
+        - WSL / Bash
+        - その他
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: 再現手順
+      description: 使用したコマンドと、最小の再現手順を書いてください。秘密情報は削除してください。
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: 期待した結果
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: 実際の結果
+    validations:
+      required: true
+  - type: textarea
+    id: diagnostics
+    attributes:
+      label: 検証結果
+      description: validator と `codex doctor --summary --no-color --ascii` の、秘密情報を除いた結果を書いてください。

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/pull_request_template.md

@@ -0,0 +1,14 @@
+## 変更内容
+
+- （ここに記入）
+
+## 検証
+
+- [ ] Windows の clean-home round trip
+- [ ] Linux の clean-home round trip
+- [ ] `git diff --check`
+- [ ] README、CHANGELOG、公開契約への影響を確認
+
+## リスクと互換性
+
+- （ここに記入）

.github/workflows/ci.yml

@@ -0,0 +1,217 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+      - "codex/**"
+  pull_request:
+  workflow_dispatch:
+  workflow_call:
+  schedule:
+    - cron: "17 3 * * 1"
+
+permissions:
+  contents: read
+
+env:
+  CODEX_PACKAGE: ${{ github.event_name == 'schedule' && '@openai/codex@latest' || '@openai/codex@0.145.0' }}
+
+jobs:
+  windows:
+    name: Windows clean-home round trip
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+
+      - name: Install validation runtime
+        shell: pwsh
+        run: |
+          npm install --global $env:CODEX_PACKAGE
+          codex --version
+
+      - name: Parse PowerShell scripts
+        shell: pwsh
+        run: |
+          $failed = $false
+          Get-ChildItem -LiteralPath ./scripts -Filter '*.ps1' | ForEach-Object {
+            $tokens = $null
+            $errors = $null
+            [void][System.Management.Automation.Language.Parser]::ParseFile(
+              $_.FullName,
+              [ref]$tokens,
+              [ref]$errors
+            )
+            if ($errors.Count -gt 0) {
+              $failed = $true
+              $errors | ForEach-Object { Write-Error $_ }
+            }
+          }
+          if ($failed) { throw 'PowerShell parsing failed.' }
+
+      - name: Validate installer behavior
+        shell: pwsh
+        run: |
+          $cleanHome = Join-Path $env:RUNNER_TEMP 'task-aware-clean'
+          & ./scripts/Install-TaskAwareAgent.ps1 -CodexHome $cleanHome
+          & ./scripts/Test-TaskAwareAgent.ps1 -CodexHome $cleanHome -ConfigOnlyRuntime
+          & ./scripts/Install-TaskAwareAgent.ps1 -CodexHome $cleanHome
+          $backupCount = @(Get-ChildItem -Directory -LiteralPath (Join-Path $cleanHome 'task-aware-backups')).Count
+          if ($backupCount -lt 2) { throw 'Repeated installation reused a backup directory.' }
+
+          $migrationHome = Join-Path $env:RUNNER_TEMP 'task-aware-migration'
+          New-Item -ItemType Directory -Force -Path $migrationHome | Out-Null
+          $migrationConfig = @(
+            '[features] # legacy feature section'
+            '  multi_agent = true'
+            ''
+            '[agents] # preserve this user comment'
+            '  enabled = false'
+            '  max_concurrent_threads_per_session = 9'
+            '  max_threads = 4'
+            '  max_depth = 1'
+            ''
+          ) -join "`r`n"
+          [IO.File]::WriteAllText(
+            (Join-Path $migrationHome 'config.toml'),
+            $migrationConfig,
+            [Text.UTF8Encoding]::new($false)
+          )
+          & ./scripts/Install-TaskAwareAgent.ps1 -CodexHome $migrationHome
+          $migrated = Get-Content -Raw -LiteralPath (Join-Path $migrationHome 'config.toml')
+          if ($migrated -match '(?m)^\s*(multi_agent|max_threads|max_depth)\s*=') {
+            throw 'A legacy multi-agent key remained after migration.'
+          }
+          if ([regex]::Matches($migrated, '(?m)^\s*\[agents\]\s*(?:#.*)?$').Count -ne 1) {
+            throw 'The agents table was duplicated during migration.'
+          }
+          if ([regex]::Matches($migrated, '(?m)^\s*enabled\s*=').Count -ne 1) {
+            throw 'The enabled key was duplicated during migration.'
+          }
+          if ([regex]::Matches($migrated, '(?m)^\s*max_concurrent_threads_per_session\s*=').Count -ne 1) {
+            throw 'The thread limit key was duplicated during migration.'
+          }
+          & ./scripts/Test-TaskAwareAgent.ps1 -CodexHome $migrationHome -ConfigOnlyRuntime
+
+          $conflictHome = Join-Path $env:RUNNER_TEMP 'task-aware-conflict'
+          New-Item -ItemType Directory -Force -Path $conflictHome | Out-Null
+          'default_permissions = ":workspace"' |
+            Set-Content -LiteralPath (Join-Path $conflictHome 'config.toml') -Encoding utf8
+          $stopped = $false
+          try {
+            & ./scripts/Install-TaskAwareAgent.ps1 `
+              -CodexHome $conflictHome -EnableFullAccess -ErrorAction Stop
+          }
+          catch {
+            $stopped = $true
+          }
+          if (-not $stopped) { throw 'The permission conflict was not rejected.' }
+
+          $malformedHome = Join-Path $env:RUNNER_TEMP 'task-aware-malformed-markers'
+          New-Item -ItemType Directory -Force -Path $malformedHome | Out-Null
+          '<!-- BEGIN CODEX TASK-AWARE AGENT -->' |
+            Set-Content -LiteralPath (Join-Path $malformedHome 'AGENTS.md') -Encoding utf8
+          $stopped = $false
+          try {
+            & ./scripts/Install-TaskAwareAgent.ps1 `
+              -CodexHome $malformedHome -ErrorAction Stop
+          }
+          catch {
+            $stopped = $true
+          }
+          if (-not $stopped) { throw 'Malformed AGENTS.md markers were not rejected.' }
+
+  linux:
+    name: Linux clean-home round trip
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+
+      - name: Install validation runtime
+        run: |
+          npm install --global "$CODEX_PACKAGE"
+          codex --version
+
+      - name: Parse Bash scripts
+        run: |
+          bash -n scripts/install-task-aware-agent.sh
+          bash -n scripts/test-task-aware-agent.sh
+          shellcheck -S warning \
+            scripts/install-task-aware-agent.sh \
+            scripts/test-task-aware-agent.sh
+
+      - name: Validate installer behavior
+        run: |
+          set -Eeuo pipefail
+
+          clean_home="$RUNNER_TEMP/task-aware-clean"
+          scripts/install-task-aware-agent.sh --codex-home "$clean_home"
+          scripts/test-task-aware-agent.sh \
+            --codex-home "$clean_home" \
+            --config-only-runtime
+          scripts/install-task-aware-agent.sh --codex-home "$clean_home"
+          backup_count=$(find "$clean_home/task-aware-backups" -mindepth 1 -maxdepth 1 -type d | wc -l)
+          if ((backup_count < 2)); then
+            printf '%s\n' 'Repeated installation reused a backup directory.' >&2
+            exit 1
+          fi
+
+          migration_home="$RUNNER_TEMP/task-aware-migration"
+          mkdir -p -- "$migration_home"
+          cat > "$migration_home/config.toml" <<'EOF'
+          [features] # legacy feature section
+            multi_agent = true
+
+          [agents] # preserve this user comment
+            enabled = false
+            max_concurrent_threads_per_session = 9
+            max_threads = 4
+            max_depth = 1
+          EOF
+          scripts/install-task-aware-agent.sh --codex-home "$migration_home"
+          if grep -Eq '^[[:space:]]*(multi_agent|max_threads|max_depth)[[:space:]]*=' \
+            "$migration_home/config.toml"; then
+            printf '%s\n' 'A legacy multi-agent key remained after migration.' >&2
+            exit 1
+          fi
+          if [[ $(grep -Ec '^[[:space:]]*\[agents\][[:space:]]*(#.*)?$' "$migration_home/config.toml") -ne 1 ]]; then
+            printf '%s\n' 'The agents table was duplicated during migration.' >&2
+            exit 1
+          fi
+          if [[ $(grep -Ec '^[[:space:]]*enabled[[:space:]]*=' "$migration_home/config.toml") -ne 1 ]]; then
+            printf '%s\n' 'The enabled key was duplicated during migration.' >&2
+            exit 1
+          fi
+          if [[ $(grep -Ec '^[[:space:]]*max_concurrent_threads_per_session[[:space:]]*=' "$migration_home/config.toml") -ne 1 ]]; then
+            printf '%s\n' 'The thread limit key was duplicated during migration.' >&2
+            exit 1
+          fi
+          scripts/test-task-aware-agent.sh \
+            --codex-home "$migration_home" \
+            --config-only-runtime
+
+          conflict_home="$RUNNER_TEMP/task-aware-conflict"
+          mkdir -p -- "$conflict_home"
+          printf '%s\n' 'default_permissions = ":workspace"' > "$conflict_home/config.toml"
+          if scripts/install-task-aware-agent.sh \
+            --codex-home "$conflict_home" \
+            --enable-full-access; then
+            printf '%s\n' 'The permission conflict was not rejected.' >&2
+            exit 1
+          fi
+
+          malformed_home="$RUNNER_TEMP/task-aware-malformed-markers"
+          mkdir -p -- "$malformed_home"
+          printf '%s\n' '<!-- BEGIN CODEX TASK-AWARE AGENT -->' > "$malformed_home/AGENTS.md"
+          if scripts/install-task-aware-agent.sh --codex-home "$malformed_home"; then
+            printf '%s\n' 'Malformed AGENTS.md markers were not rejected.' >&2
+            exit 1
+          fi

.github/workflows/release.yml

@@ -0,0 +1,69 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+jobs:
+  validation:
+    uses: ./.github/workflows/ci.yml
+
+  publish:
+    name: Package and publish
+    needs: validation
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Validate release tag and metadata
+        run: |
+          set -Eeuo pipefail
+          [[ "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]
+          test -f LICENSE
+          test -f CHANGELOG.md
+          version="${GITHUB_REF_NAME#v}"
+          heading_prefix="## [$version] - "
+          heading=$(grep -F -m1 "$heading_prefix" CHANGELOG.md)
+          release_date="${heading#"$heading_prefix"}"
+          [[ "$release_date" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]
+          grep -Fqx \
+            "[$version]: https://github.com/Eonshore/Codex-Task-Aware-Agent/releases/tag/$GITHUB_REF_NAME" \
+            CHANGELOG.md
+
+      - name: Build source archives and checksums
+        run: |
+          set -Eeuo pipefail
+          package="codex-task-aware-agent-${GITHUB_REF_NAME#v}"
+          mkdir -p dist
+          git archive \
+            --format=zip \
+            --prefix="$package/" \
+            --output="dist/$package.zip" \
+            "$GITHUB_SHA"
+          git archive \
+            --format=tar.gz \
+            --prefix="$package/" \
+            --output="dist/$package.tar.gz" \
+            "$GITHUB_SHA"
+          cd dist
+          sha256sum "$package.zip" "$package.tar.gz" > SHA256SUMS
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "$GITHUB_REF_NAME" \
+            dist/*.zip \
+            dist/*.tar.gz \
+            dist/SHA256SUMS \
+            --verify-tag \
+            --generate-notes \
+            --title "Codex Task-Aware Agent $GITHUB_REF_NAME"

.gitignore

@@ -2,3 +2,5 @@
 Thumbs.db
 *.log
 task-aware-backups/
+.codex/
+dist/