feat(install): Codex opt-out and credential-free attestation verification

AGENTS.md

@@ -149,7 +149,11 @@ claude --plugin-dir ./apps/hook
 | `PLANNOTATOR_GLIMPSE` | Set to `0` / `false` to disable the Glimpse native window even when `glimpseui` is installed. Default: enabled. Can also be set via `~/.plannotator/config.json` (`{ "glimpse": false }`). |
 | `PLANNOTATOR_GLIMPSE_WIDTH` | Width in pixels for the Glimpse native window. Default: `1280`. |
 | `PLANNOTATOR_GLIMPSE_HEIGHT` | Height in pixels for the Glimpse native window. Default: `900`. |
-| `PLANNOTATOR_VERIFY_ATTESTATION` | **Read by the install scripts only**, not by the runtime binary. Set to `1` / `true` to have `scripts/install.sh` / `install.ps1` / `install.cmd` run `gh attestation verify` on every install. Off by default. Can also be set persistently via `~/.plannotator/config.json` (`{ "verifyAttestation": true }`) or per-invocation via `--verify-attestation`. Requires `gh` installed and authenticated. |
+| `PLANNOTATOR_VERIFY_ATTESTATION` | **Read by the install scripts only**, not by the runtime binary. Set to `1` / `true` to have `scripts/install.sh` / `install.ps1` / `install.cmd` run `gh attestation verify` on every install. Off by default. Can also be set persistently via `~/.plannotator/config.json` (`{ "verifyAttestation": true }`) or per-invocation via `--verify-attestation`. Requires the `gh` CLI, but not a login: the attestation bundle is fetched from GitHub's public attestations API (single unauthenticated attempt, never retried; the endpoint allows 60 requests/hour per IP) and verified with `--bundle`; the extraction needs one JSON tool on PATH (node, python3, or jq). gh's authenticated fetch is the fallback whenever the bundle path is unavailable or does not complete (missing extractor, fetch failure, or a gh that cannot verify the fetched bundle, e.g. an older gh without `--bundle`). Verification still needs network on every run because the Sigstore TUF trust root is fetched per-run; that failure is reported as connectivity, distinct from a real provenance failure, and both fail closed. |
+| `PLANNOTATOR_SKIP_CODEX_INSTALL` | **Read by the install scripts only.** Set to `1` / `true` to skip writing the Codex integration (`hooks.json` / `config.toml` under `CODEX_HOME`, and the Codex-home stale-skill cleanup) even when Codex is detected. The installer reports the honest state ("Codex: detected, skipped (...)" vs "not detected" vs installed) and never removes an integration a previous install wired. Also settable via `~/.plannotator/config.json` (`{ "skipInstall": { "codex": true } }`); precedence is `--skip-codex` flag > env var > config. Off by default. |
+| `PLANNOTATOR_SKIP_GEMINI_INSTALL` | **Read by the install scripts only.** Same opt-out shape for the Gemini CLI integration (`~/.gemini` policy file, settings hook, slash commands). Config key: `skipInstall.gemini`; flag: `--skip-gemini`. Off by default. |
+| `PLANNOTATOR_SKIP_KIRO_INSTALL` | **Read by the install scripts only.** Same opt-out shape for the Kiro CLI integration (`~/.kiro` skills and agent, including the `~/.kiro` stale-skill sweep). Config key: `skipInstall.kiro`; flag: `--skip-kiro`. Off by default. |
+| `PLANNOTATOR_SKIP_OPENCODE_INSTALL` | **Read by the install scripts only.** Do-not-write switch for the OpenCode integration (command stubs under `~/.config/opencode/commands`, the OpenCode plugin cache clear, and the stale command-stub sweep). OpenCode has no detection leg, so there is no detected/not-detected reporting, just a skip note. Config key: `skipInstall.opencode`; flag: `--skip-opencode`. Off by default. |
 | `PLANNOTATOR_SKIP_AGENT_TERMINAL_INSTALL` | Set to `1` / `true` to skip installing the managed Node/WebTUI runtime used by compiled Bun builds for the annotate-mode agent terminal. Read by `plannotator install-runtime agent-terminal`, which the installers call automatically. |
 | `PLANNOTATOR_MINIMAL` | **Read by the install scripts only**, not by the runtime binary. Set to `1` / `true` / `yes` to have `scripts/install.sh` / `install.ps1` / `install.cmd` install **only** the `plannotator` binary — skipping the sem sidecar, the agent-terminal runtime, and all per-agent skills, hooks, slash commands, and config. Equivalent to the `--minimal` (aliased `--binary-only`) flag; `--no-minimal` overrides it. Off by default. |
 | `PLANNOTATOR_SKIP_SEM_INSTALL` | **Read by the install scripts only.** Set to `1` / `true` to skip installing the optional `sem` semantic-diff sidecar (used by code review). Off by default. |

README.md

@@ -393,7 +393,7 @@ To verify on install:
 curl -fsSL https://plannotator.ai/install.sh | bash -s -- --verify-attestation
 ```
 
-Requires `gh` installed and authenticated. Can also be set persistently in `~/.plannotator/config.json`:
+Requires the `gh` CLI, but no login: the installer fetches the attestation bundle from GitHub's public attestations API and verifies it with `gh attestation verify --bundle` (the extraction needs node, python3, or jq on PATH; gh's authenticated fetch is the fallback). Can also be set persistently in `~/.plannotator/config.json`:
 
 ```json
 { "verifyAttestation": true }

apps/marketing/src/content/docs/getting-started/installation.md

@@ -83,6 +83,27 @@ For `curl … | bash` pipelines you can set `PLANNOTATOR_MINIMAL=1` in the envir
 
 </details>
 
+<details>
+<summary><strong>Skipping individual agent integrations</strong></summary>
+
+Want the full install but not every agent integration? Each one has its own opt-out. `--skip-codex` keeps the installer from writing `hooks.json` / `config.toml` under your Codex home even when Codex is detected; `--skip-gemini` and `--skip-kiro` do the same for `~/.gemini` and `~/.kiro`; `--skip-opencode` skips the OpenCode command stubs and cache clear. Skipping never removes an integration a previous install already wired, and the installer reports the state honestly (for example `Codex: detected, skipped (--skip-codex)`, never a false "not detected").
+
+```bash
+curl -fsSL https://plannotator.ai/install.sh | bash -s -- --skip-codex
+```
+
+PowerShell: `-SkipCodex` / `-SkipGemini` / `-SkipKiro` / `-SkipOpencode`. Windows CMD: same `--skip-*` flags as bash.
+
+For unattended updates, set the environment variables `PLANNOTATOR_SKIP_CODEX_INSTALL=1` (likewise `_GEMINI_`, `_KIRO_`, `_OPENCODE_`) or persist the choice in `~/.plannotator/config.json`:
+
+```json
+{ "skipInstall": { "codex": true } }
+```
+
+Precedence: flag over environment variable over config file.
+
+</details>
+
 ## Uninstall
 
 `plannotator uninstall` removes recognized installed components while

apps/marketing/src/content/docs/reference/environment-variables.md

@@ -71,9 +71,13 @@ When running your own paste service binary, these variables configure it:
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `PLANNOTATOR_VERIFY_ATTESTATION` | off | Set to `1` or `true` to have the install script run `gh attestation verify` on the downloaded binary. Requires `gh` CLI installed and authenticated. Can also be set via `~/.plannotator/config.json` (`{ "verifyAttestation": true }`) or per-invocation via `--verify-attestation`. |
+| `PLANNOTATOR_VERIFY_ATTESTATION` | off | Set to `1` or `true` to have the install script run `gh attestation verify` on the downloaded binary. Requires the `gh` CLI but no login: the attestation bundle is fetched from GitHub's public attestations API and verified with `--bundle` (extraction needs node, python3, or jq on macOS/Linux); gh's authenticated fetch is the fallback. Can also be set via `~/.plannotator/config.json` (`{ "verifyAttestation": true }`) or per-invocation via `--verify-attestation`. |
 | `PLANNOTATOR_MINIMAL` | off | Set to `1` / `true` / `yes` to install **only** the `plannotator` binary — no sem sidecar, agent-terminal runtime, skills, hooks, slash commands, or per-agent config. Equivalent to passing `--minimal` (aliased `--binary-only`); pass `--no-minimal` to override. Read by the install scripts only, not the runtime binary. |
 | `PLANNOTATOR_SKIP_SEM_INSTALL` | off | Set to `1` / `true` to skip installing the optional `sem` semantic-diff sidecar used by code review. Read by the install scripts only. |
+| `PLANNOTATOR_SKIP_CODEX_INSTALL` | off | Set to `1` / `true` to skip writing the Codex integration (`hooks.json` / `config.toml` under `CODEX_HOME`) even when Codex is detected. The installer reports "detected, skipped" honestly and never removes an existing integration. Also via `~/.plannotator/config.json` (`{ "skipInstall": { "codex": true } }`) or the `--skip-codex` flag (flag wins over env var, which wins over config). Read by the install scripts only. |
+| `PLANNOTATOR_SKIP_GEMINI_INSTALL` | off | Same opt-out for the Gemini CLI integration (`~/.gemini` policy, settings hook, commands). Config key `skipInstall.gemini`; flag `--skip-gemini`. Read by the install scripts only. |
+| `PLANNOTATOR_SKIP_KIRO_INSTALL` | off | Same opt-out for the Kiro CLI integration (`~/.kiro` skills and agent). Config key `skipInstall.kiro`; flag `--skip-kiro`. Read by the install scripts only. |
+| `PLANNOTATOR_SKIP_OPENCODE_INSTALL` | off | Do-not-write switch for the OpenCode integration (command stubs, plugin cache clear). Config key `skipInstall.opencode`; flag `--skip-opencode`. Read by the install scripts only. |
 | `CLAUDE_CONFIG_DIR` | `~/.claude` | Custom Claude Code config directory. The install script places hooks here instead of the default location. |
 
 ## Remote mode behavior

apps/marketing/src/content/docs/reference/verifying-your-install.md

@@ -39,6 +39,8 @@ gh attestation verify "%USERPROFILE%\.local\bin\plannotator.exe" ^
   --signer-workflow backnotprop/plannotator/.github/workflows/release.yml
 ```
 
+**No gh login?** The attestations endpoint is world-readable for public repositories, so you can verify without authenticating: compute the binary's SHA256, fetch `https://api.github.com/repos/backnotprop/plannotator/attestations/sha256:<digest>` with plain `curl`, write each `attestations[].bundle` value to a file (one JSON document per line), and pass it via `--bundle <file>` alongside the same `--repo`/`--source-ref`/`--signer-workflow` flags. This is exactly what the installer's automatic verification does. Note the unauthenticated API allows 60 requests per hour per IP, and `gh` still needs network access to fetch the Sigstore trust root on every run.
+
 For air-gapped or no-auth environments, see GitHub's docs on [verifying attestations offline](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/verifying-attestations-offline).
 
 ## Automatic verification during install
@@ -66,7 +68,7 @@ mkdir -p ~/.plannotator
 echo '{ "verifyAttestation": true }' > ~/.plannotator/config.json
 ```
 
-When enabled, the installer requires `gh` CLI installed and authenticated (`gh auth login`). If `gh` is missing or the check fails, the install hard-fails so you don't silently skip verification. To force-skip for a single install, pass `--skip-attestation` (bash/cmd) or `-SkipAttestation` (PowerShell).
+When enabled, the installer requires the `gh` CLI but **not** a `gh auth login`: it fetches the attestation bundle from GitHub's public attestations API (a single unauthenticated request) and verifies with `gh attestation verify --bundle`, pinning the same source ref and signer workflow as the manual commands above. On macOS/Linux the bundle extraction needs one JSON tool on PATH (node, python3, or jq); Windows uses PowerShell. If the bundle path is unavailable or does not complete, the installer falls back to gh's own authenticated fetch, which is where a login still helps. Verification always needs network access because the Sigstore trust root is fetched on every run; that failure is reported as a connectivity problem, distinct from a real provenance failure. Either way the install hard-fails rather than silently skipping verification. To force-skip for a single install, pass `--skip-attestation` (bash/cmd) or `-SkipAttestation` (PowerShell).
 
 ## Supported versions
 

packages/shared/config.ts

@@ -99,6 +99,25 @@ export interface PlannotatorConfig {
    * (`gh auth login`). OS-level opt-in only — no UI surface. Default: false.
    */
   verifyAttestation?: boolean;
+  /**
+   * Per-agent installer integration opt-outs. Read by
+   * scripts/install.sh|ps1|cmd on every run (not by any runtime code).
+   * When an agent's flag is true, the installer does not write that agent's
+   * integration even when the agent is detected, reports the detected state
+   * honestly ("detected, skipped"), and never removes an integration a
+   * previous install already wired. Overridden by the
+   * PLANNOTATOR_SKIP_CODEX_INSTALL / PLANNOTATOR_SKIP_GEMINI_INSTALL /
+   * PLANNOTATOR_SKIP_KIRO_INSTALL / PLANNOTATOR_SKIP_OPENCODE_INSTALL env
+   * vars, which are in turn overridden by the --skip-codex / --skip-gemini /
+   * --skip-kiro / --skip-opencode flags. OpenCode has no detection leg, so
+   * its entry is a plain do-not-write switch. Default: all off.
+   */
+  skipInstall?: {
+    codex?: boolean;
+    gemini?: boolean;
+    kiro?: boolean;
+    opencode?: boolean;
+  };
   /**
    * Enable Jina Reader for URL-to-markdown conversion during annotation.
    * When true (default), `plannotator annotate <url>` routes through