Merge branch 'main' into codex/define-env-key-rotation-and-recovery-flows-16o779

Author: roodboi

.github/workflows/release.yml

@@ -121,6 +121,8 @@ jobs:
           files=(
             "dist/release/hack-${RELEASE_VERSION}-install.sh"
             "dist/release/hack-install.sh"
+            "dist/release/hack-${RELEASE_VERSION}-codex-install.sh"
+            "dist/release/hack-codex-install.sh"
           )
           for file in "${files[@]}"; do
             if [ ! -f "${file}" ]; then

AGENTS.md

@@ -38,6 +38,19 @@ TypeScript (strict). Runtimes: Bun 1.3+, Node 23. Prettier: 2 spaces, no semicol
 Always default to useing named paramaters in functions eg myFunction({ ctx, other }) vs myFunction(ctx, other)
 Never use any types and always default to leveraging generics and smart types to sensure the best possible tpye inference across the project.
 
+## Commits And Releases
+
+- Use Conventional Commits for every commit you author in this repo.
+- Format commits as `<type>(<scope>): <summary>` when a scope is useful, or `<type>: <summary>` when it is not.
+- Prefer these types: `feat`, `fix`, `docs`, `refactor`, `test`, `chore`, `build`, `ci`, `perf`, `revert`.
+- Use `feat` for user-facing capability changes that should trigger a feature release signal.
+- Use `fix` for behavior corrections, regressions, and release-blocking repairs.
+- Use `build` or `ci` for release pipeline, packaging, notarization, versioning, or workflow-only changes.
+- Do not use vague commit subjects like `update stuff`, `misc fixes`, or `wip`.
+- If a change is breaking, mark it explicitly with `!` in the type or scope position and include a `BREAKING CHANGE:` footer explaining the migration impact.
+- If work lands through a squash merge, the PR title must also follow Conventional Commits so release automation can classify it correctly.
+- Before pushing or merging, make sure the final commit history or squash title still preserves the intended release signal.
+
 <!-- hack:tickets:start -->
 ## Tickets (git-backed)
 

CHANGELOG.md

@@ -1,3 +1,21 @@
+## <small>1.21.1 (2026-03-24)</small>
+
+* Merge branch 'main' into codex/fix-authorization-bypass-for-team-management ([3c4eee5](https://github.com/hack-dance/hack/commit/3c4eee5))
+* Merge pull request #25 from hack-dance/codex/fix-authorization-bypass-for-team-management ([4e0a5fd](https://github.com/hack-dance/hack/commit/4e0a5fd)), closes [#25](https://github.com/hack-dance/hack/issues/25)
+* fix(auth): restore team-scoped authorization ([5622392](https://github.com/hack-dance/hack/commit/5622392))
+
+## 1.21.0 (2026-03-24)
+
+* feat(release): publish codex slim installer ([b0451e0](https://github.com/hack-dance/hack/commit/b0451e0))
+
+## 1.20.0 (2026-03-24)
+
+* feat(codex): add slim install path for managed containers ([38f6b78](https://github.com/hack-dance/hack/commit/38f6b78))
+* improve linear routing status output ([64574f1](https://github.com/hack-dance/hack/commit/64574f1))
+* Merge branch 'main' into codex/linear-mention-hack-444-improve-status,-error,-and-help-ou ([7c08dd5](https://github.com/hack-dance/hack/commit/7c08dd5))
+* Merge pull request #26 from hack-dance/codex/linear-mention-hack-444-improve-status,-error,-and-help ([b88c8b7](https://github.com/hack-dance/hack/commit/b88c8b7)), closes [#26](https://github.com/hack-dance/hack/issues/26)
+* docs(agents): require conventional commits for release flow ([4a929c3](https://github.com/hack-dance/hack/commit/4a929c3))
+
 ## <small>1.19.1 (2026-03-23)</small>
 
 * Merge pull request #24 from hack-dance/fix/macos-ghostty-vt-latest ([2546af4](https://github.com/hack-dance/hack/commit/2546af4)), closes [#24](https://github.com/hack-dance/hack/issues/24)

README.md

@@ -102,6 +102,16 @@ curl -fsSL \
   | bash
 ```
 
+Managed Codex or CI container:
+
+```bash
+curl -fsSL \
+  https://github.com/hack-dance/hack/releases/latest/download/hack-codex-install.sh \
+  | bash
+```
+
+This slim install path skips `hack global install`, Caddy/CoreDNS, and Loki/Grafana.
+
 CLI + desktop app:
 
 - Download the latest DMG from [GitHub Releases](https://github.com/hack-dance/hack/releases/latest)

apps/macos/Config/Base.xcconfig

@@ -9,5 +9,5 @@ PRODUCT_NAME = Hack Desktop
 PRODUCT_BUNDLE_IDENTIFIER = dance.hack.desktop
 HACK_URL_SCHEME = hack
 MACOSX_DEPLOYMENT_TARGET = 14.0
-MARKETING_VERSION = 1.19.1
+MARKETING_VERSION = 1.21.1
 CURRENT_PROJECT_VERSION = $(MARKETING_VERSION)

docs/beta.md

@@ -12,6 +12,7 @@ local model instead of replacing it.
 - [Run laptop-to-laptop node pairing e2e](guides/remote-node-laptop-e2e.md)
 - [Bootstrap a remote node on Railway](guides/remote-node-railway.md)
 - [Run a remote node via container image](guides/remote-node-container.md)
+- [Use Hack in managed Codex containers](guides/codex-managed-environments.md)
 - [Expose the gateway over SSH](guides/remote-ssh.md)
 - [Expose the gateway with Cloudflare](guides/remote-cloudflare.md)
 - [Expose the gateway with Tailscale](guides/remote-tailscale.md)

docs/guides/codex-managed-environments.md

@@ -0,0 +1,92 @@
+# Managed Codex Containers
+
+This guide is for managed Codex or CI-style containers where you control a repo checkout and setup script,
+but do not control the host machine or a long-lived Docker Desktop style environment.
+
+Use this path when:
+
+- the container is ephemeral or cache-backed
+- you only have a setup script and optional maintenance script
+- `hack global install` is too heavy or not applicable
+- you want tickets, integrations, docs, and repo-local CLI workflows without the full local host stack
+
+## What slim mode does
+
+Slim mode is enabled by setting `HACK_EXECUTION_MODE=codex` or `HACK_EXECUTION_MODE=slim`.
+
+It is designed to skip machine-level Hack surfaces:
+
+- Caddy
+- CoreDNS
+- Loki
+- Grafana
+- local CA and TLS bootstrap
+- Docker event watching in `hackd`
+
+This mode is intentionally not a substitute for a full local workstation setup.
+
+## Install from a release
+
+Run this in your managed Codex setup script:
+
+```bash
+curl -fsSL \
+  https://github.com/hack-dance/hack/releases/latest/download/hack-codex-install.sh \
+  | bash
+```
+
+The installer downloads the latest Hack release tarball, installs the binary into `~/.hack/bin`,
+and writes a thin `hack` wrapper with these defaults:
+
+- `HACK_EXECUTION_MODE=codex`
+- `HACK_DAEMON_DISABLE_DOCKER_EVENTS=1`
+- `HACK_SETUP_SYNC_MODE=warn`
+
+## Recommended setup script
+
+```bash
+set -euo pipefail
+
+mise install bun@1.3.5
+export PATH="$HOME/.local/share/mise/shims:$PATH"
+
+bun install
+curl -fsSL \
+  https://github.com/hack-dance/hack/releases/latest/download/hack-codex-install.sh \
+  | bash
+```
+
+## Recommended maintenance script
+
+```bash
+set -euo pipefail
+
+export PATH="$HOME/.local/share/mise/shims:$PATH"
+bun install --frozen-lockfile || bun install
+```
+
+If you are developing inside the Hack repo itself, the repo-local helpers are still available:
+
+```bash
+bash scripts/install-codex-slim.sh
+bash scripts/maintain-codex-slim.sh
+```
+
+## Good fit for slim mode
+
+- `hack tickets`
+- `hack linear`
+- `hack x github`
+- repo-local docs, specs, and agent setup
+- command and config surfaces that do not require the machine-wide runtime stack
+
+## Not available in slim mode
+
+- `hack global install`
+- `hack global up`
+- `hack global status`
+- `hack global logs`
+- explicit Loki-backed log paths such as `hack logs --loki`
+
+When you need full remote runtime orchestration instead of repo-local agent workflows, use the
+[remote node container image](remote-node-container.md) instead.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hack-cli",
-  "version": "1.19.1",
+  "version": "1.21.1",
   "packageManager": "bun@1.3.9",
   "module": "index.ts",
   "type": "module",
@@ -19,7 +19,9 @@
     "commit": "cz",
     "install:dev": "bun run --cwd packages/cli install:dev",
     "install:bin": "bun run build && bun run --cwd packages/cli install:bin",
+    "install:codex": "bash scripts/install-codex-slim.sh",
     "install:status": "bun run --cwd packages/cli install:status",
+    "maintain:codex": "bash scripts/maintain-codex-slim.sh",
     "lint": "bun run check",
     "macos:project-gen": "bun run --cwd packages/cli macos:project-gen",
     "macos:open": "bun run --cwd packages/cli macos:open",

packages/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hack/cli",
   "private": true,
-  "version": "1.19.1",
+  "version": "1.21.1",
   "type": "module",
   "module": "index.ts",
   "scripts": {

packages/db/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hack/db",
   "private": true,
-  "version": "1.19.1",
+  "version": "1.21.1",
   "type": "module",
   "main": "src/client.ts",
   "module": "src/client.ts",