GUI-first setup

Cohent Connect is a small macOS setup companion, not an agent launcher. It bundles the Node runtime and the reviewed adapter; it never executes setup scripts from the selected repository. The Control Room's Connect agent panel explains the same flow. Command-line setup remains a collapsed fallback.

  1. Open Cohent Connect and choose the top-level folder of your GitHub repository.
  2. Select Claude Code or Codex and verify your team's Cohent service address.
  3. Read the disclosure and explicitly approve the connection/local changes.
  4. Select Connect in browser; approve repository access on the displayed service.
  5. Select Review exact changes, then Install integration.
  6. Open your coding agent normally and complete its separate host trust review.
  7. Select Check connection & coverage. Unknown trust is not protection.

The installer preserves other hooks and pins its executable/runtime outside the repository. Moving the setup app does not change those installed commands. It does not write host trust records. Changing installed hook configuration can invalidate Codex trust. Claude trust cannot be verified outside an observed hook invocation.

Remove integration removes only Cohent-owned hooks; Disconnect this device revokes repository access separately. Setup does not remove repository identity or unrelated settings. Private pinned executable caches are retained for recovery.

Development build and release boundary

Build on macOS 14 or newer with node scripts/build-connect.mjs. Output is outputs/Cohent Connect.app, with no changes to the developer's active integration. The build is native to the build machine's architecture. Automated tests use temporary repositories, never install hooks into Cohent's source checkout.

The local build is not a signed/notarized public release. Public distribution requires an Apple Developer signing identity, signing the bundled runtime and app, notarization, and release verification. Never disable Gatekeeper or tell users to bypass it. Only after that process should an operator set NEXT_PUBLIC_COHENT_CONNECT_DOWNLOAD_URL to the verified HTTPS release artifact. When unset, the web UI clearly states that a public download is unavailable.

Windows/Linux desktop packaging and automatic Cursor/Copilot installation are not implemented. Advisory coordination still uses the existing adapter protocol. The companion does not claim to provide host capabilities that do not exist.