fix(installer): upgrade over any earlier install without --force

.agents/plugins/marketplace.json

@@ -11,7 +11,7 @@
         "path": "./plugins/ix-memory"
       },
       "description": "Ix Memory integration — cognitive skills, agent playbooks, and Codex hooks for graph-aware engineering",
-      "version": "2.4.3",
+      "version": "2.4.4",
       "policy": {
         "installation": "AVAILABLE",
         "authentication": "ON_INSTALL"

README.md

@@ -171,6 +171,26 @@ Hooks:
 MCP:
 - registered with Codex as `ix-memory`, served by the Ix CLI (`ix mcp`) — no file is installed
 
+### Upgrading
+
+Re-run the same installer; no flags are needed. Over any earlier version it:
+
+- overwrites the files the plugin owns and removes the ones it no longer ships (recorded in
+  `.codex/ix-plugin-version.json`), and never touches anything else in `.codex/`;
+- merges into an existing `hooks.json`: the plugin's entries from any earlier version are
+  replaced in place, and every other hook in the file is kept;
+- checks everything before writing, then swaps the new files in together — a failed install
+  leaves the previous one exactly as it was;
+- runs `ix mcp install --host codex` with a time limit and reports how it went. A registration
+  of the `mcp/server.py` that 2.4.1 and earlier shipped is replaced (and the old file removed);
+  any other server already named `ix-memory` is left alone unless you pass `--force`;
+- removes the `/tmp/ix-codex-hooks` cache older hooks used, if it is yours and holds only cache files.
+
+If `hooks.json` changed, Codex asks you to trust the hooks again on its next start.
+
+`--force` is only for replacing what is not the plugin's: a marketplace entry named `ix-memory`
+that points elsewhere, a `hooks.json` that is not valid JSON, or a different `ix-memory` MCP server.
+
 ### Home-local install
 
 ```bash
@@ -270,13 +290,13 @@ ix-memory plugin v2.3.0 active | installed 2026-04-29 | commit a1b2c3d
 
 **To confirm a reinstall took effect:**
 
-1. Reinstall: `./install.sh --repo /path/to/project --hooks --force`
+1. Reinstall: `./install.sh --repo /path/to/project --hooks`
 2. Check the new timestamp: `cat /path/to/project/.codex/ix-plugin-version.json`
 3. Start a new Codex session — the version line in the session context will reflect the new
    install date and commit.
 
 If the version line is missing, the hooks were installed manually without using the installer.
-Run `./install.sh --repo /path/to/project --hooks --force` to write the file.
+Run `./install.sh --repo /path/to/project --hooks` to write the file.
 
 ## Repo Guidance
 

hooks.md

@@ -19,6 +19,7 @@ Verified against the `codex` 0.155.1 binary and `openai/codex@rust-v0.155.1` (`c
 - **Model context.** `hookSpecificOutput.additionalContext` (with `hookEventName` set to the event) is the only output Codex adds to the model's input on `SessionStart`, `UserPromptSubmit`, `PreToolUse` and `PostToolUse`. A top-level `systemMessage` becomes a UI warning only. `Stop` has no model channel; its output is `{"continue": true}`. The output structs deny unknown fields, so a misspelt key fails the hook run. `tests/test_codex_hook_protocol.py` validates every hook against the generated schemas, vendored in `tests/fixtures/codex-0.155.1/`.
 - **Tool names.** Shell tools reach hooks as `Bash`. File edits use `apply_patch`, which Codex also matches as `Edit` and `Write`, with the raw patch as `tool_input.command`. Both pre and post tool hooks match `Bash|apply_patch`. The touched files are read from the patch's `*** Add File:` / `Update File:` / `Delete File:` / `Move to:` headers.
 - **Shell.** Codex runs each `command` through the session shell without a login profile (`<shell> -c`). The inner `/bin/sh -c` stays non-login too. A login shell would source the user's profile on every hook, and anything that profile prints corrupts the hook's JSON.
+- **Windows.** The session shell there is PowerShell (`shell-command/src/shell_detect.rs`, `default_user_shell`), so a hook runs as `powershell.exe -NoProfile -Command <commandWindows or command>` (`core/src/session/mod.rs` builds the hook shell with `derive_exec_args`). The installer gives each Ix hook a `commandWindows` of `& '<python>' '<...\.codex\hooks\_launch.py>' <hook>`: without `&`, a command that starts with a quoted path is a string expression to PowerShell, which is why the 2.4.x form `"python" "launcher" name` never ran. `command` keeps the POSIX form, so a repo-local `hooks.json` still works on macOS and Linux. Only when a session has no shell does Codex fall back to `%COMSPEC% /C`, where `&` is not valid.
 - **Feature flag.** `hooks` has been stable and on by default since Codex 0.124 (openai/codex#19012). `codex_hooks` is a deprecated alias (`codex-rs/features/src/legacy.rs`), so the installer no longer writes it.
 - **Trust.** User (`~/.codex/hooks.json`), project (`.codex/hooks.json`) and plugin-bundled hooks are all non-managed. Codex skips them until their exact definition is trusted, records trust as a `trusted_hash` of the normalised hook (event, matcher, command, timeout, statusMessage), and asks again whenever that hash changes (`codex-rs/hooks/src/engine/discovery.rs`). The TUI prompts "Hooks need review" at startup. `codex exec` cannot prompt, so it skips untrusted hooks unless it is run with `--dangerously-bypass-hook-trust`. Changing `hooks.json`, as this release does, requires the user to review the hooks again.
 

install.ps1

@@ -29,11 +29,12 @@ Examples:
 Flags:
   --plugin   Copy/register the ix-memory Codex plugin in a local marketplace
   --hooks    Install the .codex hook bundle (session, prompt, pre/post tool, stop)
-  --mcp      Install the ix-memory MCP server and print the codex mcp add command
+  --mcp      Register the Ix CLI's MCP server (`ix mcp`) with Codex
 
 Notes:
   - If none of --plugin, --hooks, or --mcp is passed, the installer defaults to
     --plugin --hooks --mcp.
+  - Re-running upgrades in place; --force is not needed for that.
   - --plugin does not activate the plugin in Codex. Restart Codex, then install or enable
     'ix-memory' from the marketplace before its skills appear.
   - This wrapper forwards all arguments to scripts/install_codex_integration.py.

install.sh

@@ -29,6 +29,7 @@ Flags:
 Notes:
   - If none of --plugin, --hooks, or --mcp is passed, the installer defaults to
     --plugin --hooks --mcp.
+  - Re-running upgrades in place; --force is not needed for that.
   - --plugin does not activate the plugin in Codex. Restart Codex, then install or enable
     'ix-memory' from the marketplace before its skills appear.
   - Local Codex plugins do not reliably expose skill autocomplete, so type `$ix-tutorial`

plugins/ix-memory/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ix-memory",
-  "version": "2.4.3",
+  "version": "2.4.4",
   "description": "Ix Memory integration — transforms Codex into a graph-reasoning agent with cognitive skills for understanding, investigation, impact analysis, planning, debugging, architecture auditing, and deep documentation synthesis.",
   "author": {
     "name": "Ix Memory"