fix(ce-setup): detect leftover Codex tool-map sentinels

skills/ce-setup/SKILL.md

@@ -70,6 +70,7 @@ Also remediate these project issues when the report names them:
 - `.compound-engineering/config.example.yaml` is missing or outdated
 - the health report marks the `ce-work` skill implementation engine unavailable or invalid, detects retired scalar routing keys, or reports malformed dormant `work_engine_preferences`
 - the health report marks `docs_root` invalid (`Invalid docs_root ...`) — CE artifacts will not be written until it is fixed
+- the health report names a **legacy Compound Codex tool map** in `$CODEX_HOME/AGENTS.md` (or a profile copy) — session-level; point at `docs/install/upgrading.md`. Do not rewrite `ce-work` skip phrases in this skill.
 
 If optional tools are missing, do not offer a bulk install. The diagnostic already printed the relevant install command or project URL. Say: "Install optional tools only for the workflows you use."
 

skills/ce-setup/scripts/check-health

@@ -289,6 +289,25 @@ read_work_engine_preferences() {
 has_brew=$(command -v brew >/dev/null 2>&1 && echo "yes" || echo "no")
 in_repo=$(git rev-parse --is-inside-work-tree >/dev/null 2>&1 && echo "yes" || echo "no")
 
+# Retired Bun-era Codex tool map (#1099 / #1559). Exact sentinels from docs/install/upgrading.md.
+CODEX_TOOL_MAP_START="<!-- BEGIN COMPOUND CODEX TOOL MAP -->"
+CODEX_TOOL_MAP_END="<!-- END COMPOUND CODEX TOOL MAP -->"
+codex_home="${CODEX_HOME:-$HOME/.codex}"
+legacy_codex_map_files=()
+scan_codex_agents_file() {
+  local f="$1"
+  [ -f "$f" ] || return 0
+  if grep -F -q -- "$CODEX_TOOL_MAP_START" "$f" && grep -F -q -- "$CODEX_TOOL_MAP_END" "$f"; then
+    legacy_codex_map_files+=("$f")
+  fi
+}
+scan_codex_agents_file "$codex_home/AGENTS.md"
+if [ -d "$codex_home/profiles" ]; then
+  for f in "$codex_home/profiles"/*/AGENTS.md; do
+    scan_codex_agents_file "$f"
+  done
+fi
+
 # =====================================================
 #  Check optional capabilities
 # =====================================================
@@ -627,4 +646,14 @@ if [ "$capability_missing" -gt 0 ]; then
   echo "     Missing optional tools do not block setup; install them only for the workflows you use."
 fi
 
+if [ "${#legacy_codex_map_files[@]}" -gt 0 ]; then
+  echo ""
+  section "Codex instructions"
+  for f in "${legacy_codex_map_files[@]}"; do
+    warn "Legacy Compound Codex tool map still present in $f"
+  done
+  detail "This retired block can make Codex skip ce-code-review as if no runner exists."
+  detail "Remove only the BEGIN/END COMPOUND CODEX TOOL MAP span — see docs/install/upgrading.md"
+fi
+
 echo ""

tests/skills/ce-setup-check-health.test.ts

@@ -57,6 +57,44 @@ describe("ce-setup check-health", () => {
     expect(script).not.toMatch(/<<<\s/)
   })
 
+  test("reports the legacy Codex tool map when both sentinels are present", async () => {
+    const root = await mkdtemp(path.join(os.tmpdir(), "ce-setup-health-"))
+    try {
+      await initGitRepo(root)
+      await mkdir(path.join(root, ".codex"), { recursive: true })
+      await writeFile(
+        path.join(root, ".codex", "AGENTS.md"),
+        [
+          "keep this",
+          "<!-- BEGIN COMPOUND CODEX TOOL MAP -->",
+          "Task (subagent dispatch) / Subagent / Parallel: run sequentially in main thread",
+          "<!-- END COMPOUND CODEX TOOL MAP -->",
+          "",
+        ].join("\n"),
+      )
+      const result = await runCheckHealth(root, "/usr/bin:/bin")
+      expect(result.exitCode).toBe(0)
+      expect(result.stdout).toContain("Legacy Compound Codex tool map still present")
+      expect(result.stdout).toContain("docs/install/upgrading.md")
+    } finally {
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
+  test("does not warn when Codex AGENTS.md has no tool-map sentinels", async () => {
+    const root = await mkdtemp(path.join(os.tmpdir(), "ce-setup-health-"))
+    try {
+      await initGitRepo(root)
+      await mkdir(path.join(root, ".codex"), { recursive: true })
+      await writeFile(path.join(root, ".codex", "AGENTS.md"), "# user instructions\n")
+      const result = await runCheckHealth(root, "/usr/bin:/bin")
+      expect(result.exitCode).toBe(0)
+      expect(result.stdout).not.toContain("Legacy Compound Codex tool map still present")
+    } finally {
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
   test("advertises agent-browser only for its current consumers", async () => {
     const [script, setupDocs, polishSkill, polishRun, polishDocs] = await Promise.all([
       readFile(checkHealthScript, "utf8"),