ndisisnd · Aug 8, 2026 · Aug 8, 2026
diff --git a/.gitignore b/.gitignore
@@ -4,5 +4,3 @@ audit/
 .claude/.headroom_wrap_marker.json
 .tokensave
 improve/
-node_modules/
-*.tgz
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
@@ -84,12 +84,9 @@ plumbing only — see [Two-host model](#two-host-model).
 wdym/
 ├── SKILL.md                        Thin dispatcher → refs/protocol.md
 ├── pref.json                       Default mode template
-├── package.json                    npm package `wdym-prompt` (bin, files allowlist)
-├── install.sh                      Shell installer — Claude Code only, frozen
+├── install.sh                      The installer — both hosts, host/scope/activation flags
 ├── agents/
 │   └── openai.yaml                 Codex skill manifest (display name, invocation policy)
-├── bin/
-│   └── wdym-prompt.js              npx installer — both hosts, no dependencies
 ├── hooks/
 │   ├── prompt-detect.py            UserPromptSubmit pre-scorer
 │   └── telemetry-stats.py          --status report renderer
@@ -144,7 +141,7 @@ text. An override-shaped imperative there (`ACTION: invoke … BEFORE processing
 a prompt injection and was sometimes refused, silently skipping the skill. So the block
 carries only a neutral classification *signal* — host-neutral wording, naming no host's
 files — while the invoke instruction lives in the host's own instruction file, which the
-model treats as trusted user configuration. Both installers write a marker-delimited,
+model treats as trusted user configuration. `install.sh` writes a marker-delimited,
 idempotent contract there at the install scope: `~/.claude/CLAUDE.md` or the local project
 root on Claude Code, `$CODEX_HOME/AGENTS.md` on Codex. A fresh install therefore carries
 the same authority the dev repo does rather than leaving the block to fend for itself.
@@ -172,8 +169,8 @@ hook file, and the ask step — and those are the four the README's diagram note
 same tree there as a symlink rather than copying it. Two independent copies would drift the
 moment one host updated and the other didn't, and drift in a skill body is invisible until
 behaviour diverges. Where symlinks are unavailable (or `--copy` is passed) the installer
-copies instead and records which it did in `pref.json` as `codex_skill_mode`, so
-`--doctor` knows whether it needs to check the two paths for drift.
+copies instead and records which it did in `pref.json` as `codex_skill_mode`, so a later
+run knows whether it has two paths to keep in step.
 
 **One pref file, both hosts.** `~/.claude/wdym/pref.json` is canonical for Claude Code and
 Codex alike, even though the rest of the Codex wiring lives under `~/.codex`. Splitting it
@@ -193,10 +190,9 @@ contents, so any install, update, or re-run invalidates the previous approval an
 goes silent until the user runs `/hooks` in Codex and approves it again — with no warning
 that it stopped firing. Codex also records approval outside any file this tool can read, so
 there is neither a programmatic approval path nor a readable trust state. Both are handled
-by documentation loudness instead: the installer prints an action-required notice last on
-every Codex-touching run, `--doctor` reports trust as `unknown` and points at `/hooks`,
-`refs/heal.md` knows the "wired but silent" failure mode, and the README repeats it in the
-Codex notes.
+by documentation loudness instead: `install.sh` prints an action-required notice last on
+every Codex-touching run, `refs/heal.md` knows the "wired but silent" failure mode, and the
+README repeats it in the Codex notes.
 
 **Codex is global-scope only.** A repo-scoped Codex hook would live in a committed file,
 so every teammate pulling the repo would get an approval prompt for a tool they never

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,22 @@ All notable changes to this project will be documented here.
 
 ## 2026-08-09
 
+### [15] — One installer, no npm package: `install.sh` absorbs Codex
+
+- `install.sh`: now installs and wires wdym on either host or both. New host flags `--claude` / `--codex` / `--both`, defaulting to whichever of `~/.claude` and `~/.codex` is present; new `--copy`; `--global` / `--local` / `--hook` / `--on-demand` / `--dir` / `--tarball` / `--force` unchanged
+- `install.sh`: Codex wiring is global scope only — canonical skill copy stays at `~/.claude/skills/wdym` and is exposed to Codex at `~/.agents/skills/wdym` as a symlink, falling back to a real copy automatically when the symlink is refused (`--copy` forces one) and recording which in `pref.json` as `codex_skill_mode`; hook entry goes into `$CODEX_HOME/hooks.json`, trust contract into `$CODEX_HOME/AGENTS.md` with the `$wdym` command prefix
+- `install.sh`: `--codex --local` exits 2 and writes nothing; `--both --local` warns and installs Claude Code at local scope only; a Codex-touching run ends with the hook re-approval notice (action, reason, failure mode, `$wdym --status` confirmation), never printed on a Claude-only run
+- `install.sh`: hook wiring now matches on `prompt-detect.py` content on both hosts, collapses duplicate entries to one, refuses a settings file that parses to a non-object, and writes only when bytes change so re-runs are byte-idempotent; trust-contract writer takes the host command prefix and drops duplicate marker blocks
+- `install.sh`: the installed skill set now includes `agents/`, so `agents/openai.yaml` reaches Codex — without it Codex has no display name and no `allow_implicit_invocation`, and never invokes the skill on its own
+- `install.sh`: removing a duplicate trust-contract block now closes the gap it leaves instead of stranding its blank lines, so re-runs over a hand-pasted duplicate stop growing the file
+- `bin/wdym-prompt.js`, `package.json`: deleted — the npm package was cancelled before publication, so the shell installer is the only installer
+- `.gitignore`: dropped the `node_modules/` and `*.tgz` pack-artifact lines
+- `README.md`: install section is two options again — `install.sh` (flag table now covers `--claude` / `--codex` / `--both` / `--copy`) and `npx skills add` for file delivery plus `/wdym --init`; comparison table loses the npm column and keeps the Codex facts; Codex requirements note, update section and FAQ repointed at `install.sh` and `/wdym --status`
+- `ARCHITECTURE.md`: file map drops `bin/wdym-prompt.js` and `package.json`; two-host notes name `install.sh` as the installer and no longer reference a `--doctor` command
+- `llms.txt`: index entry for `bin/wdym-prompt.js` replaced with `install.sh`
+- `RELEASES.md`: v1.2.0 notes repointed at `install.sh` — the `npx wdym-prompt`, `--doctor` and `--uninstall` headline items are gone, `--copy` takes their place, and the "shell installer is frozen, Claude Code only" limitation is replaced by the `npx skills add` one
+- `improve/v1.2-test.md`: dropped T3 (Node 18) and T5 (npm publish preflight); T1 installs with `./install.sh --codex`
+
 ### [14] — Both installers write the same trust contract, and the live checks have a script
 
 - `install.sh`: contract line is now host-neutral ("invoke the `wdym` skill" — no "via the Skill tool"), byte-identical to what `bin/wdym-prompt.js` writes, so alternating installers no longer rewrite one line back and forth; verified in a sandbox that a stale block is refreshed in place and a re-run reports already-current

diff --git a/README.md b/README.md
@@ -57,28 +57,33 @@ after that it's automatic.
 
 ## Installation
 
-Three ways in. The npx installer is the only one that covers both hosts and finishes the
-job in one command; the other two exist for people already committed to a particular tool.
+Two ways in. The installer is the one that finishes the job — both hosts, hook, trust
+contract, prefs, in one command. The second option is for people already managing skills
+with the skills CLI.
 
-### Option 1 — `npx wdym-prompt` _(recommended)_
+### Option 1 — the installer _(recommended)_
 
 ```bash
-npx wdym-prompt
+curl -fsSL https://raw.githubusercontent.com/ndisisnd/wdym/main/install.sh | bash
 ```
 
 That is the whole install. It detects which hosts you have — `~/.claude`, `~/.codex`, or
 both — lays down the skill files, wires the `UserPromptSubmit` hook, writes the trust
 contract into the host's instruction file, and creates your `pref.json`. **Global is the
-default**, so wdym fires in every project you touch.
+default**, so wdym fires in every project you touch. It pulls a tarball into a temp dir —
+no clone, nothing left behind.
 
-Say so explicitly when the defaults aren't what you want:
+Say so explicitly when the defaults aren't what you want. Piped into `bash`, flags go after
+`-s --`:
 
 ```bash
-npx wdym-prompt --both              # Claude Code and Codex
-npx wdym-prompt --claude --local    # this project only (Claude Code)
-npx wdym-prompt --on-demand         # install inert; runs only via /wdym
+curl -fsSL .../install.sh | bash -s -- --both            # Claude Code and Codex
+curl -fsSL .../install.sh | bash -s -- --claude --local  # this project only (Claude Code)
+curl -fsSL .../install.sh | bash -s -- --on-demand       # install inert; runs only via /wdym
 ```
 
+Or with the script on disk: `./install.sh --both`.
+
 | Flag | What it does |
 |---|---|
 | `--claude` / `--codex` / `--both` | Pick the host. Default: whichever of `~/.claude` and `~/.codex` exists |
@@ -88,14 +93,16 @@ npx wdym-prompt --on-demand         # install inert; runs only via /wdym
 | `--hook` | Fire on every prompt — the default |
 | `--on-demand` | Install inert; run only via `/wdym`, no hook wired |
 | `--copy` | Copy the skill for Codex instead of symlinking it |
-| `--doctor` | Report what is installed, wired, and in sync |
-| `--uninstall` | Remove skill dirs, hook entries, and contract blocks |
-| `--force` | Skip the guards (source-repo check, prefs on uninstall) |
+| `--tarball <url\|path>` | Install from a specific tarball instead of `main` |
+| `--force` | Skip the "you're inside the wdym repo" guard |
 
 Local always wins over global when both exist, so you can install globally and still
 override one repo. Re-run the installer any time — it is idempotent, keeps your `pref.json`
 and telemetry, and collapses a duplicated hook entry back to one if an earlier install left
-two behind. It needs Node 18 or newer and installs no dependencies.
+two behind. It needs `python3`, `tar`, and either `curl` or `wget`.
+
+Already have the files on disk and just want to rewire? `/wdym --init` does the init half
+on its own.
 
 #### Installing for Codex
 
@@ -116,37 +123,7 @@ Four things worth knowing, none of them blockers:
 
 Codex users type `$wdym` where this README writes `/wdym`. Everything else is identical.
 
-### Option 2 — the shell installer _(Claude Code only)_
-
-`install.sh` is frozen at what it does today: Claude Code, no Codex support, no new flags.
-It stays fully supported for anyone already using it.
-
-```bash
-curl -fsSL https://raw.githubusercontent.com/ndisisnd/wdym/main/install.sh | bash
-```
-
-It pulls a tarball into a temp dir — no clone, nothing left behind. Global by default; add
-`-s -- --local` for one project:
-
-```bash
-curl -fsSL https://raw.githubusercontent.com/ndisisnd/wdym/main/install.sh | bash -s -- --local
-```
-
-| Flag | What it does |
-|---|---|
-| _(none)_ | Global install into `~/.claude` — the default |
-| `--local` | Local install into `./.claude` for this project |
-| `--hook` | Fire on every prompt — the default |
-| `--on-demand` | Install inert; run only via `/wdym`, no hook wired |
-| `--dir <path>` | Local install into another project |
-| `--tarball <url\|path>` | Install from a specific tarball instead of `main` |
-| `--force` | Skip the "you're inside the wdym repo" guard |
-
-Like the npx installer it writes your `pref.json`, wires the detector, and is safe to
-re-run. Already have the files on disk and just want to rewire? `/wdym --init` does the
-init half on its own.
-
-### Option 3 — `npx skills add`
+### Option 2 — `npx skills add`
 
 If you already manage skills with the [skills CLI](https://github.com/vercel-labs/skills),
 wdym installs like any other package:
@@ -172,26 +149,27 @@ skill that only answers to `/wdym` and never fires on its own.
 
 ### Which one to use
 
-| | `npx wdym-prompt` | `install.sh` | `npx skills add` |
-|---|---|---|---|
-| Claude Code | ✅ | ✅ | files only |
-| Codex | ✅ | ❌ frozen, never supported it | ❌ use `npx wdym-prompt` |
-| Skill files | ✅ | ✅ | ✅ |
-| `pref.json`, hook, trust contract | ✅ | ✅ Claude Code only | via `/wdym --init` |
-| Updates | re-run it | re-run it | `npx skills update` |
-| What lands in the skill dir | curated runtime files only | curated runtime files only | the whole repo, `install.sh` and `tests/` included |
-| Also writes | nothing else | nothing else | `skills-lock.json` at your project root |
-
-All three land the skill in the same place — `.claude/skills/wdym` for project scope,
+| | `install.sh` | `npx skills add` |
+|---|---|---|
+| Claude Code | ✅ | files only |
+| Codex | ✅ global scope only | ❌ use `install.sh --codex` |
+| Skill files | ✅ | ✅ |
+| `pref.json`, hook, trust contract | ✅ | via `/wdym --init` |
+| Updates | re-run it | `npx skills update` |
+| What lands in the skill dir | curated runtime files only | the whole repo, `install.sh` and `tests/` included |
+| Also writes | nothing else | `skills-lock.json` at your project root |
+
+Both land the skill in the same place — `.claude/skills/wdym` for project scope,
 `~/.claude/skills/wdym` for global — so pick whichever fits your workflow. `/wdym --init`
-is idempotent across all of them.
+is idempotent across both.
 
 ### Confirming it works
 
 To confirm it's wired up, submit any normal prompt: in the default mode you'll see the
-rewrite and a gate before it runs. `npx wdym-prompt --doctor` checks the same thing from
-the outside — which hosts are wired, and on Codex it reminds you to confirm hook approval
-with `/hooks`, which only Codex itself can tell you.
+rewrite and a gate before it runs. `/wdym --status` reports the same thing from inside the
+session — scope, activation, and where the files came from. On Codex, run `$wdym --status`
+after approving the hook with `/hooks`; hook approval is the one thing only Codex itself
+can confirm.
 
 ## How it works
 
@@ -269,12 +247,11 @@ these into a prompt _(or run them standalone)_:
 
 ## How to update
 
-**Update wdym itself** by re-running the installer you used. Both are idempotent and
-neither touches your `pref.json` or telemetry:
+**Update wdym itself** by re-running the installer. It is idempotent and never touches your
+`pref.json` or telemetry:
 
 ```bash
-npx wdym-prompt                                                                   # either host
-curl -fsSL https://raw.githubusercontent.com/ndisisnd/wdym/main/install.sh | bash  # Claude Code
+curl -fsSL https://raw.githubusercontent.com/ndisisnd/wdym/main/install.sh | bash
 ```
 
 **If you installed with `npx skills add`**, update through the same CLI:
@@ -291,9 +268,10 @@ again, or it goes quiet without saying so.
 hook came unwired, or after a `skills update` — with `/wdym --init`, which redoes the init
 half without reinstalling.
 
-**Check what's actually wired** with `npx wdym-prompt --doctor`: it reports each host, the
-skill copies, and whether they are in sync. Codex hook approval is the one thing it can't
-read — it lives inside Codex, so `--doctor` points you at `/hooks` to confirm it.
+**Check what's actually wired** with `/wdym --status` (`$wdym --status` on Codex): it
+reports the resolved scope, activation, and run mode from inside the session. Codex hook
+approval is the one thing it can't read — that lives inside Codex, so confirm it with
+`/hooks` there.
 
 ## FAQ
 
@@ -317,7 +295,7 @@ leaves your machine.
 `--local` when you want it scoped to one repo; a local install always wins over the global
 one, so you can do both. Codex is global-only — see the Codex notes under Installation.
 
-**Does it work with Codex?** Yes, from v1.2.0. `npx wdym-prompt --codex` (or `--both`)
+**Does it work with Codex?** Yes, from v1.2.0. `./install.sh --codex` (or `--both`)
 wires it: the skill is exposed at `~/.agents/skills/wdym`, the hook goes into
 `~/.codex/hooks.json`, and the trust contract into `~/.codex/AGENTS.md`. One manual step
 remains — approve the hook with `/hooks` inside Codex after every install or update.

diff --git a/RELEASES.md b/RELEASES.md
@@ -5,21 +5,19 @@ What's new for you, release by release.
 ## v1.2.0 — 2026-08-09
 
 > wdym is no longer a Claude Code tool. It runs on Codex too, and one command —
-> `npx wdym-prompt` — now installs and wires it on either host, or both at once. The README
+> `install.sh` — now installs and wires it on either host, or both at once. The README
 > finally shows you the whole flow in a single picture instead of describing it in prose.
 
 ### ✨ New
 - **Codex support.** wdym classifies, rewrites, and gates prompts in Codex the same way it
-  does in Claude Code. Install it with `npx wdym-prompt --codex`, or `--both` to cover both
+  does in Claude Code. Install it with `./install.sh --codex`, or `--both` to cover both
   hosts at once.
-- **One install command.** `npx wdym-prompt` detects which hosts you have, lays down the
+- **One install command.** The installer detects which hosts you have, lays down the
   skill, wires the hook, writes the trust contract, and creates your preferences — no
   follow-up step. Re-run it any time to update.
-- **`--doctor`.** Ask wdym what is actually installed: which hosts are wired and whether
-  the two skill copies agree. Codex keeps hook approval to itself, so `--doctor` reminds
-  you to confirm it with `/hooks` rather than pretending to know.
-- **`--uninstall`.** Removes the skill, the hook entry, and the contract block, and leaves
-  your preferences and usage history alone unless you pass `--force`.
+- **`--copy`.** Codex normally reads the same skill copy Claude Code does, through a link.
+  Where links are unavailable, the installer falls back to a real copy on its own; `--copy`
+  forces one.
 - **A flow diagram in the README.** One picture covering both activation modes, the
   prompts that pass straight through, and both run modes — with a short table naming the
   four things that differ between Claude Code and Codex.
@@ -32,10 +30,10 @@ What's new for you, release by release.
   Claude Code and Codex.
 - Your Codex copy of the skill is a link to the Claude Code copy, so updating one updates
   the other and the two cannot quietly drift apart.
-- Re-running an installer over an install that ended up with two wdym hooks now collapses
+- Re-running the installer over an install that ended up with two wdym hooks now collapses
   them back to one, which stops the double rewrite and double usage counting that caused.
-- Both installers now write the exact same trust contract, so switching between
-  `npx wdym-prompt` and the shell installer no longer rewrites one line back and forth.
+- The installer only writes a file when its contents actually change, so re-running it over
+  a healthy install is a genuine no-op.
 
 ### 🐛 Fixed
 - Launching your agent inside a subfolder of a project no longer misses that project's
@@ -53,9 +51,9 @@ What's new for you, release by release.
   you will see a one-line signal above each answer. Cosmetic only.
 - **Codex is global-only.** wdym applies to every project there; per-repo Codex installs
   are deliberately refused.
-- **The shell installer is frozen and stays Claude Code only.** `curl … install.sh` keeps
-  working exactly as it did; it will not gain Codex support. Use `npx wdym-prompt` for
-  that.
+- **`npx skills add` still only delivers files.** It copies the skill in but wires nothing,
+  so follow it with `/wdym --init` to get the hook, the preferences, and the trust
+  contract.
 
 ## v1.1.0 — 2026-07-30