Fullwell Agent Client

One shared skill package gives Codex and Claude a local-first food journal and an optional connection to the hosted fullwell-cloud MCP service. The published package supports grocery, recipe, and food-delivery history without a cloud account, plus provider-neutral delivery collections, meal sources, and cart preparation. Named provider support still requires authorized current installed-host validation. The service performs authentication and every cloud-household mutation; the published package contains no credentials or bundled household data and includes no Git client or background synchronization engine.

After installation, start with @Fullwell hi in Codex or Hi Fullwell. in Claude. A fresh greeting first asks What should I call you? and remembers the answer in a private revisioned local profile. It then says Hey <display_name>, nice to be acquainted. Do you already have a Fullwell cloud account? Existing cloud-account holders use hosted OAuth, copy the confirmed name to their cloud display name, and receive a first household named Name's Household (or Names' Household) only when they are not joining or resuming another household. If a person previously logged fullwell-cloud out and restarted Codex, a normal Fullwell chat can run Codex's fixed MCP login command after explicit reconnect consent; Codex owns the browser and keyring, and the person sends one continuation message so the next turn can prove the connection with hfj_get_context. They never copy a command or token. Everyone else initializes that named private guest household under ~/.codex/fullwell/local/household.json, begins one grocery-history pass for snacks, ingredients, condiments, and more, and advances to recipes without any Fullwell cloud call. The plugin-provided fullwell-local server exposes stable profile, household, runner-control, and collecting-only deletion tools, so narrow host permissions can survive package upgrades without allowing arbitrary Node commands. Local files use atomic revision-checked writes and exclude credentials, browser state, screenshots, and raw pages. After the journal is usable locally, the agent offers optional cloud-account creation and backup for WhatsApp, sharing, or family access.

Authenticated onboarding still checkpoints unconfirmed work under ~/.codex/fullwell/drafts, isolated by the stable Fullwell user and household IDs and bound to the current snapshot. One confirmed hosted commit persists it. Promoting a guest journal retains the local copy and records cloud linkage only after a successful hosted response.

Codex additionally bundles a private grocery-audit continuation hook. An actual order-detail audit explicitly arms only its current turn, restores aggregate progress after compaction, and continues a premature stop until the audit records completed, partially_completed, blocked, or cancelled. A normal new prompt disarms the prior turn before it is interpreted, so requests such as I'm out of cashews, delivery reorders, meal planning, and unrelated chat do not inherit audit continuation. The hook stores only an opaque run ID, revision, aggregate counts, and turn coordination under Codex's private plugin data; it never reads the transcript or stores food, store, order, household, browser, URL, or credential data. Codex requires the user to review and trust the exact packaged hook definition before it runs. Claude does not load the hook or expose its lifecycle tool and keeps the existing durable checkpoint behavior.

The food-delivery workflow can index history locally from an installed browser that is already signed in to a user-selected provider. DoorDash, Uber Eats, and Grubhub are examples, not current live-support claims: each named provider remains unverified until an authorized installed-host matrix proves its present UI. Fullwell uses the same bounded order-detail navigation the account holder could perform manually; it does not crawl public pages, run an unattended scraper, bypass access controls, or use undocumented provider interfaces. It stores only complete bounded order evidence and canonical provider/dish/location/fulfillment conclusions, includes alcohol under ordinary food-history rules, and excludes tobacco, cannabis, prescriptions, gift cards, and other regulated/non-food lines. It never stores credentials, raw pages, delivery destinations, payment state, or provider account identifiers.

When an older local delivery index uses a recognized pre-1.1.16 format, Fullwell proves the complete update in memory, repairs the private file atomically through its stable local tool, reloads, and resumes the interrupted request. The repair updates legacy IDs and exact references, separates mixed restaurant display names only when the saved order evidence proves the split, refreshes report summaries, and removes obsolete browser-label fields. It performs no cloud call and never asks the user to edit the private journal or understand Fullwell internals.

A successful local-only delivery audit offers to connect or sync the index to a Fullwell cloud household so members can collaborate, share dishes in collections, and use them in meal plans. The offer itself makes no remote call. Clear contextual responses such as yes or sync it are interpreted conversationally without requiring scripted text; ambiguity gets a natural clarification. Contribution proceeds one provider at a time only after an exact visibility and retention preview. Each provider receives a stable retry key; uncertain or rejected writes remain locally authoritative, and cloud linkage is recorded only after confirmed hosted success. Delivery auditing does not prepare a cart or check out.

Delivery dishes can be selected for public collections and imported into another household with public restaurant/location provenance only. Import never copies private order evidence or creates recurrence or reorder authority. Local and cloud meal plans may cite an exact current delivery-dish revision as ordered before or shared dish; that history is familiarity, not Liked evidence or an ingredient-safety claim.

When asked to start a previous delivery order, Fullwell resolves the provider first and then the exact restaurant location, asking about real ambiguities such as two same-name locations. Direct computer use prepares only the verified cart: it binds exact source lines, quantities, modifiers, fulfillment mode, current full-cart contents, and the ordinary automatic-add maximum; it preserves unrelated same-location lines, requires explicit confirmation before replacing a different-location cart, and re-reads the whole cart after uncertainty. A requested alcohol line follows the same maximum, while any age or identity UI remains entirely user-controlled and Fullwell never views, types, captures, or relays an ID. No skill, tool, or result can check out, place an order, pay, tip, schedule, change an address, or accept a membership or subscription.

The restocking skill reads only a private revisioned snapshot prepared by @fullwell/local-runner. Product selection and retailer cart control stay on the user's Mac; the WhatsApp gateway relays encrypted user-facing text and transport state only. Complete USD requests strictly below the profile's automatic cart-add maximum use bounded automatic authority, while equal or greater amounts require request-scoped confirmation. Direct conversations can change the maximum without granting the linked runner profile-write access. After a verified direct-local add, an unconnected guest resumes the optional Fullwell cloud offer; connected and linked WhatsApp use omits it.

Meal planning works locally without a cloud account and collaboratively in a connected cloud household. It records an explicit allergy and food-sensitivity answer plus a weekly review before recommending anything, can start from actual Liked evidence or separately approved internet research, and keeps multiple people's ideas in the same slot instead of overwriting them. Chat remains primary; after the user accepts, the local tool can render those recommendations as a private static image-forward recipe board that opens without a Fullwell login.

After successful setup, the agent can offer one personal native Codex or Claude task named Fullwell weekly meal planning, with Sunday at 9:00 AM in the confirmed time zone as the default. The task only starts a conversation and waits; it does not search or write automatically. Fullwell stores no scheduler state and creates no launchd job, cron, calendar event, server worker, or notification fallback.

In chat, a person can change their remembered name, rename an owner-managed household, stop the local WhatsApp runner without disconnecting it, or remove the exact weekly meal-planning task. Eligible cloud setup can also suggest inviting another household member or making a collection, for example: Make a Weeknight Favorites collection from the recipes we liked.

Removing the plugin does not delete an unfinished checkpoint or guest household. Delete ~/.codex/fullwell/drafts to remove authenticated onboarding drafts. Delete ~/.codex/fullwell/local only when you intentionally want to remove the local guest journal; neither action changes server household data.

Before removing or rolling back the meal-planning skill, pause or remove its native weekly task in the selected host. If the host cannot confirm cleanup, the task remains host-owned and Fullwell reports that follow-up instead of claiming removal.

Development

• npm run test:packaging --workspace @fullwell/fullwell validates host manifests, catalogs, skills, references, MCP metadata, packaged-file privacy, and isolated install/remove lifecycles when the host CLIs are available.
• npm run test:evals --workspace @fullwell/fullwell validates that the release eval matrix covers every normative client case on both hosts.
• node --test packages/agent-client/tests/packaging/codex-grocery-audit-hooks.test.mjs validates compaction, stop continuation, terminal release, failed transitions, private state, and next-turn isolation.
• Repository marketplace catalogs live at .agents/plugins/marketplace.json for Codex and .claude-plugin/marketplace.json for Claude. Both point to the same immutable npm package version.
• Official Codex and Claude validators remain part of the manual release matrix because their binaries and authenticated host surfaces are not CI prerequisites.

The production MCP URL is https://fullwell.ai/mcp. OAuth occurs in the service-controlled browser flow; users never paste a token into a conversation. Existing installations connected to the legacy host must disconnect and reconnect so the host registers a fresh client and grant for the new OAuth resource.

License

Copyright (C) 2026 Matthew Moore.

This package is free software licensed under the GNU Affero General Public License version 3 only (AGPL-3.0-only). See LICENSE for the complete terms.