@getpaseo/server 0.11.0-beta.1 → 0.11.0-beta.2

package/dist/server/builtin-plugins/claude-usage-source/index.server.ts

@@ -1,6 +1,6 @@
 import type { PluginServerContext } from "@getpaseo/plugin/server";
 import { inputSchema } from "./shared/input.js";
-import { fetchUsage, identify } from "./server/usage.js";
+import { discover, fetchUsage, identify } from "./server/usage.js";
 
 export default function contribute(server: PluginServerContext) {
   server.registerUsageSource({
@@ -8,7 +8,7 @@ export default function contribute(server: PluginServerContext) {
     label: "Claude",
     icon: "icon.svg",
     input: inputSchema,
-    discover: async () => [{}],
+    discover: () => discover(),
     identify,
     fetch: fetchUsage,
   });

package/dist/server/builtin-plugins/claude-usage-source/server/stores.ts

@@ -0,0 +1,132 @@
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { z } from "zod";
+import { routeSchema } from "../shared/input.js";
+
+export interface StoreLookup {
+  home?: string;
+  env?: NodeJS.ProcessEnv;
+  platform?: NodeJS.Platform;
+  now?: () => number;
+  sqlite?: () => Sqlite | undefined;
+}
+interface Database {
+  prepare(sql: string): { all(...args: string[]): unknown[] };
+  close(): void;
+}
+export interface Sqlite {
+  DatabaseSync: new (path: string, options: { readOnly: boolean }) => Database;
+}
+export const oauthSchema = z.object({
+  access: z.string().min(1),
+  accountId: z.string().optional(),
+  expires: z.number().optional(),
+});
+const rowSchema = z.object({ id: z.number().int().positive(), data: z.string() });
+export type Route = z.infer<typeof routeSchema>;
+
+export async function readJson(path: string): Promise<unknown> {
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export function piAuthPath(lookup: StoreLookup): string {
+  const home = lookup.home ?? homedir();
+  const env = lookup.env ?? process.env;
+  const configured = env.PI_CODING_AGENT_DIR?.trim();
+  if (!configured) return join(home, ".pi", "agent", "auth.json");
+  if (configured === "~") return join(home, "auth.json");
+  const directory = configured.startsWith("~/")
+    ? join(home, configured.slice(2))
+    : resolve(configured);
+  return join(directory, "auth.json");
+}
+
+function ompDatabasePath(lookup: StoreLookup): string {
+  const home = lookup.home ?? homedir();
+  const env = lookup.env ?? process.env;
+  const platform = lookup.platform ?? process.platform;
+  const profile = (env.OMP_PROFILE ?? env.PI_PROFILE)?.trim() || "default";
+  const base = join(home, env.PI_CONFIG_DIR || ".omp");
+  const configRoot = profile === "default" ? base : join(base, "profiles", profile);
+  const defaultAgentDir = join(configRoot, "agent");
+  const agentDir =
+    profile === "default" && env.PI_CODING_AGENT_DIR
+      ? resolve(env.PI_CODING_AGENT_DIR)
+      : defaultAgentDir;
+  if (
+    (platform === "linux" || platform === "darwin") &&
+    agentDir === defaultAgentDir &&
+    env.XDG_DATA_HOME
+  ) {
+    const xdgBase = join(env.XDG_DATA_HOME, "omp");
+    const xdgRoot = profile === "default" ? xdgBase : join(xdgBase, "profiles", profile);
+    if (existsSync(xdgRoot)) return join(xdgRoot, "agent.db");
+  }
+  return join(agentDir, "agent.db");
+}
+
+function builtinSqlite(): Sqlite | undefined {
+  // Node 20 must still compile/load the plugin; only OMP needs this newer builtin.
+  const parsed = z
+    .object({
+      DatabaseSync: z.custom<Sqlite["DatabaseSync"]>((value) => typeof value === "function"),
+    })
+    .safeParse(process.getBuiltinModule?.("node:sqlite"));
+  return parsed.success ? parsed.data : undefined;
+}
+
+function ompRows(path: string, lookup: StoreLookup) {
+  let db: Database | undefined;
+  try {
+    const sqlite = (lookup.sqlite ?? builtinSqlite)();
+    if (!sqlite) return [];
+    db = new sqlite.DatabaseSync(path, { readOnly: true });
+    const rows = db
+      .prepare(
+        "SELECT id, data FROM auth_credentials WHERE provider = ? AND credential_type = 'oauth' AND disabled_cause IS NULL ORDER BY id",
+      )
+      .all("anthropic");
+    return rows.flatMap((value) => {
+      const row = rowSchema.safeParse(value);
+      if (!row.success) return [];
+      try {
+        const oauth = oauthSchema.parse(JSON.parse(row.data.data));
+        if (oauth.expires === undefined || oauth.expires <= (lookup.now ?? Date.now)()) return [];
+        return [{ id: row.data.id, oauth }];
+      } catch {
+        return [];
+      }
+    });
+  } catch {
+    return [];
+  } finally {
+    db?.close();
+  }
+}
+
+export function discoverOmp(lookup: StoreLookup): Route[] {
+  const path = ompDatabasePath(lookup);
+  return ompRows(path, lookup).map(({ id }) => ({ store: "omp", path, credentialId: id }));
+}
+
+export function readOmp(route: Extract<Route, { store: "omp" }>, lookup: StoreLookup) {
+  return ompRows(route.path, lookup).find((row) => row.id === route.credentialId)?.oauth ?? null;
+}
+
+export async function readHarness(
+  route: Extract<Route, { path: string }>,
+  lookup: StoreLookup = {},
+) {
+  if (route.store === "omp") return readOmp(route, lookup);
+  const provider = "anthropic";
+  const parsed = z.record(z.string(), z.unknown()).safeParse(await readJson(route.path));
+  if (!parsed.success) return null;
+  const oauth = oauthSchema.extend({ type: z.literal("oauth") }).safeParse(parsed.data[provider]);
+  return oauth.success ? oauth.data : null;
+}

package/dist/server/builtin-plugins/claude-usage-source/server/usage.ts

@@ -1,3 +1,4 @@
+import { discoverOmp, piAuthPath, readHarness, type StoreLookup } from "./stores.js";
 import type { UsageInput } from "../shared/input.js";
 import { execFile } from "node:child_process";
 import { existsSync, promises as fs } from "node:fs";
@@ -75,6 +76,7 @@ type ClaudeLimit = z.infer<typeof ClaudeLimitSchema>;
 const SCOPED_WEEKLY_KIND = "weekly_scoped";
 
 interface ClaudeCredentialRecord {
+  expires?: number;
   oauth: { accessToken: string } & NonNullable<ClaudeCredentials["claudeAiOauth"]>;
 }
 
@@ -332,21 +334,21 @@ export async function readClaudeKeychainCredentials(
   return null;
 }
 
-interface ClaudeCredentialLookup {
-  platform?: NodeJS.Platform;
+interface ClaudeCredentialLookup extends StoreLookup {
   readKeychainCredentials?: () => Promise<unknown | null>;
   claudeHome?: string;
-  accountHome?: string;
 }
 
-/** Shared credential lookup for usage fetches and account identification. */
-export async function resolveClaudeCredentials(
-  _input: UsageInput,
-  lookup: ClaudeCredentialLookup = {},
+function claudeCredentialPath(lookup: ClaudeCredentialLookup): string {
+  const home = lookup.home ?? homedir();
+  const env = lookup.env ?? process.env;
+  const claudeHome = lookup.claudeHome ?? env.CLAUDE_CONFIG_DIR ?? join(home, ".claude");
+  return join(claudeHome, ".credentials.json");
+}
+
+async function keychainCredentialRecord(
+  lookup: ClaudeCredentialLookup,
 ): Promise<ClaudeCredentialRecord | null> {
-  const claudeHome = lookup.claudeHome ?? process.env["CLAUDE_HOME"] ?? join(homedir(), ".claude");
-  const fileCredentials = await readCredentialFile(join(claudeHome, ".credentials.json"));
-  if (fileCredentials) return fileCredentials;
   if ((lookup.platform ?? process.platform) !== "darwin") return null;
   const parsed = ClaudeCredentialsSchema.safeParse(
     await (lookup.readKeychainCredentials ?? readClaudeKeychainCredentials)(),
@@ -354,6 +356,34 @@ export async function resolveClaudeCredentials(
   return parsed.success ? toCredentialRecord(parsed.data) : null;
 }
 
+export async function discover(lookup: ClaudeCredentialLookup = {}): Promise<UsageInput[]> {
+  const candidates: UsageInput[] = [
+    { route: { store: "claude", path: claudeCredentialPath(lookup) } },
+  ];
+  if ((lookup.platform ?? process.platform) === "darwin")
+    candidates.push({ route: { store: "keychain" } });
+  candidates.push(
+    { route: { store: "pi", path: piAuthPath(lookup) } },
+    ...discoverOmp(lookup).map((route) => ({ route })),
+  );
+  const present: UsageInput[] = [];
+  for (const input of candidates)
+    if (await resolveClaudeCredentials(input, lookup)) present.push(input);
+  return present;
+}
+
+/** Re-read the selected login; the harness owns token refresh. */
+export async function resolveClaudeCredentials(
+  input: UsageInput,
+  lookup: ClaudeCredentialLookup = {},
+): Promise<ClaudeCredentialRecord | null> {
+  const route = input.route;
+  if (route.store === "claude") return readCredentialFile(route.path);
+  if (route.store === "keychain") return keychainCredentialRecord(lookup);
+  const oauth = await readHarness(route, lookup);
+  return oauth ? { oauth: { accessToken: oauth.access }, expires: oauth.expires } : null;
+}
+
 async function readCredentialFile(path: string): Promise<ClaudeCredentialRecord | null> {
   if (!existsSync(path)) return null;
   try {
@@ -418,7 +448,11 @@ export async function fetchUsage(
   }
 
   const credentials = await resolveClaudeCredentials(input, credentialLookup);
-  if (!credentials) {
+  if (
+    !credentials ||
+    (credentials.expires !== undefined &&
+      credentials.expires <= (credentialLookup.now ?? Date.now)())
+  ) {
     return unavailableUsage();
   }
 
@@ -464,11 +498,6 @@ export async function fetchUsage(
 }
 
 // The OAuth usage endpoint meters the active organization selected by the token.
-const ClaudeAccountSchema = z.object({
-  accountUuid: z.string().min(1),
-  organizationUuid: z.string().min(1),
-  emailAddress: z.string().optional(),
-});
 type ClaudeIdentity = { key: string; label?: string } | null;
 const PROFILE_TTL_MS = 300_000;
 const PROFILE_CACHE_LIMIT = 128;
@@ -486,19 +515,6 @@ export async function identify(
   now: () => number = Date.now,
   credentialLookup: ClaudeCredentialLookup = {},
 ) {
-  const directory = credentialLookup.accountHome ?? homedir();
-  try {
-    const config = z
-      .object({ oauthAccount: ClaudeAccountSchema })
-      .parse(JSON.parse(await fs.readFile(join(directory, ".claude.json"), "utf8")));
-    const account = config.oauthAccount;
-    return {
-      key: `${account.accountUuid}.${account.organizationUuid}`,
-      ...(account.emailAddress ? { label: account.emailAddress } : {}),
-    };
-  } catch {
-    // Credentials may still be present even when account metadata is absent.
-  }
   const credentials = await resolveClaudeCredentials(input, credentialLookup);
   if (!credentials) return null;
   const token = credentials.oauth.accessToken;

package/dist/server/builtin-plugins/claude-usage-source/shared/input.ts

@@ -1,3 +1,15 @@
 import { z } from "zod";
-export const inputSchema = z.object({}).strict();
+
+export const routeSchema = z.discriminatedUnion("store", [
+  z.object({ store: z.enum(["claude", "pi"]), path: z.string().min(1) }).strict(),
+  z
+    .object({
+      store: z.literal("omp"),
+      path: z.string().min(1),
+      credentialId: z.number().int().positive(),
+    })
+    .strict(),
+  z.object({ store: z.literal("keychain") }).strict(),
+]);
+export const inputSchema = z.object({ route: routeSchema }).strict();
 export type UsageInput = z.infer<typeof inputSchema>;

package/dist/server/builtin-plugins/codex-usage-source/index.server.ts

@@ -1,6 +1,6 @@
 import type { PluginServerContext } from "@getpaseo/plugin/server";
 import { inputSchema } from "./shared/input.js";
-import { fetchUsage, identify } from "./server/usage.js";
+import { discover, fetchUsage, identify } from "./server/usage.js";
 
 export default function contribute(server: PluginServerContext) {
   server.registerUsageSource({
@@ -8,7 +8,7 @@ export default function contribute(server: PluginServerContext) {
     label: "Codex",
     icon: "icon.svg",
     input: inputSchema,
-    discover: async () => [{}],
+    discover: () => discover(),
     identify,
     fetch: fetchUsage,
   });

package/dist/server/builtin-plugins/codex-usage-source/server/stores.ts

@@ -0,0 +1,132 @@
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { z } from "zod";
+import { routeSchema } from "../shared/input.js";
+
+export interface StoreLookup {
+  home?: string;
+  env?: NodeJS.ProcessEnv;
+  platform?: NodeJS.Platform;
+  now?: () => number;
+  sqlite?: () => Sqlite | undefined;
+}
+interface Database {
+  prepare(sql: string): { all(...args: string[]): unknown[] };
+  close(): void;
+}
+export interface Sqlite {
+  DatabaseSync: new (path: string, options: { readOnly: boolean }) => Database;
+}
+export const oauthSchema = z.object({
+  access: z.string().min(1),
+  accountId: z.string().optional(),
+  expires: z.number().optional(),
+});
+const rowSchema = z.object({ id: z.number().int().positive(), data: z.string() });
+export type Route = z.infer<typeof routeSchema>;
+
+export async function readJson(path: string): Promise<unknown> {
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export function piAuthPath(lookup: StoreLookup): string {
+  const home = lookup.home ?? homedir();
+  const env = lookup.env ?? process.env;
+  const configured = env.PI_CODING_AGENT_DIR?.trim();
+  if (!configured) return join(home, ".pi", "agent", "auth.json");
+  if (configured === "~") return join(home, "auth.json");
+  const directory = configured.startsWith("~/")
+    ? join(home, configured.slice(2))
+    : resolve(configured);
+  return join(directory, "auth.json");
+}
+
+function ompDatabasePath(lookup: StoreLookup): string {
+  const home = lookup.home ?? homedir();
+  const env = lookup.env ?? process.env;
+  const platform = lookup.platform ?? process.platform;
+  const profile = (env.OMP_PROFILE ?? env.PI_PROFILE)?.trim() || "default";
+  const base = join(home, env.PI_CONFIG_DIR || ".omp");
+  const configRoot = profile === "default" ? base : join(base, "profiles", profile);
+  const defaultAgentDir = join(configRoot, "agent");
+  const agentDir =
+    profile === "default" && env.PI_CODING_AGENT_DIR
+      ? resolve(env.PI_CODING_AGENT_DIR)
+      : defaultAgentDir;
+  if (
+    (platform === "linux" || platform === "darwin") &&
+    agentDir === defaultAgentDir &&
+    env.XDG_DATA_HOME
+  ) {
+    const xdgBase = join(env.XDG_DATA_HOME, "omp");
+    const xdgRoot = profile === "default" ? xdgBase : join(xdgBase, "profiles", profile);
+    if (existsSync(xdgRoot)) return join(xdgRoot, "agent.db");
+  }
+  return join(agentDir, "agent.db");
+}
+
+function builtinSqlite(): Sqlite | undefined {
+  // Node 20 must still compile/load the plugin; only OMP needs this newer builtin.
+  const parsed = z
+    .object({
+      DatabaseSync: z.custom<Sqlite["DatabaseSync"]>((value) => typeof value === "function"),
+    })
+    .safeParse(process.getBuiltinModule?.("node:sqlite"));
+  return parsed.success ? parsed.data : undefined;
+}
+
+function ompRows(path: string, lookup: StoreLookup) {
+  let db: Database | undefined;
+  try {
+    const sqlite = (lookup.sqlite ?? builtinSqlite)();
+    if (!sqlite) return [];
+    db = new sqlite.DatabaseSync(path, { readOnly: true });
+    const rows = db
+      .prepare(
+        "SELECT id, data FROM auth_credentials WHERE provider = ? AND credential_type = 'oauth' AND disabled_cause IS NULL ORDER BY id",
+      )
+      .all("openai-codex");
+    return rows.flatMap((value) => {
+      const row = rowSchema.safeParse(value);
+      if (!row.success) return [];
+      try {
+        const oauth = oauthSchema.parse(JSON.parse(row.data.data));
+        if (oauth.expires === undefined || oauth.expires <= (lookup.now ?? Date.now)()) return [];
+        return [{ id: row.data.id, oauth }];
+      } catch {
+        return [];
+      }
+    });
+  } catch {
+    return [];
+  } finally {
+    db?.close();
+  }
+}
+
+export function discoverOmp(lookup: StoreLookup): Route[] {
+  const path = ompDatabasePath(lookup);
+  return ompRows(path, lookup).map(({ id }) => ({ store: "omp", path, credentialId: id }));
+}
+
+export function readOmp(route: Extract<Route, { store: "omp" }>, lookup: StoreLookup) {
+  return ompRows(route.path, lookup).find((row) => row.id === route.credentialId)?.oauth ?? null;
+}
+
+export async function readHarness(
+  route: Extract<Route, { path: string }>,
+  lookup: StoreLookup = {},
+) {
+  if (route.store === "omp") return readOmp(route, lookup);
+  const provider = route.store === "opencode" ? "openai" : "openai-codex";
+  const parsed = z.record(z.string(), z.unknown()).safeParse(await readJson(route.path));
+  if (!parsed.success) return null;
+  const oauth = oauthSchema.extend({ type: z.literal("oauth") }).safeParse(parsed.data[provider]);
+  return oauth.success ? oauth.data : null;
+}

package/dist/server/builtin-plugins/codex-usage-source/server/usage.ts

@@ -1,4 +1,4 @@
-import { readFile } from "node:fs/promises";
+import { discoverOmp, piAuthPath, readHarness, readJson, type StoreLookup } from "./stores.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import {
@@ -32,28 +32,56 @@ const responseSchema = z.object({
   credits: z.object({ balance: number.optional() }).nullish(),
 });
 
-export async function readAuth(
-  _input: CodexUsageInput,
-): Promise<{ token: string; accountId?: string; idToken?: string } | null> {
-  const candidates = [
-    ...(process.env["CODEX_HOME"] ? [join(process.env["CODEX_HOME"], "auth.json")] : []),
-    join(homedir(), ".config", "codex", "auth.json"),
-    join(homedir(), ".codex", "auth.json"),
+interface Auth {
+  token: string;
+  accountId?: string;
+  idToken?: string;
+  expires?: number;
+}
+
+export async function discover(lookup: StoreLookup = {}): Promise<CodexUsageInput[]> {
+  const env = lookup.env ?? process.env;
+  const home = lookup.home ?? homedir();
+  const paths = [
+    ...(env.CODEX_HOME ? [join(env.CODEX_HOME, "auth.json")] : []),
+    join(home, ".codex", "auth.json"),
   ];
-  for (const path of candidates) {
-    try {
-      const auth = authSchema.parse(JSON.parse(await readFile(path, "utf8")));
-      if (auth.tokens?.access_token)
-        return {
-          token: auth.tokens.access_token,
-          accountId: auth.tokens.account_id,
-          idToken: auth.tokens.id_token,
-        };
-    } catch {
-      continue;
-    }
+  const candidates: CodexUsageInput[] = [...new Set(paths)].map((path) => ({
+    route: { store: "codex", path },
+  }));
+  candidates.push(
+    {
+      route: {
+        store: "opencode",
+        path: join(env.XDG_DATA_HOME || join(home, ".local", "share"), "opencode", "auth.json"),
+      },
+    },
+    { route: { store: "pi", path: piAuthPath(lookup) } },
+    ...discoverOmp(lookup).map((route) => ({ route })),
+  );
+  const present: CodexUsageInput[] = [];
+  for (const input of candidates) if (await readAuth(input, lookup)) present.push(input);
+  return present;
+}
+
+export async function readAuth(
+  input: CodexUsageInput,
+  lookup: StoreLookup = {},
+): Promise<Auth | null> {
+  const route = input.route;
+  if (route.store !== "codex") {
+    const oauth = await readHarness(route, lookup);
+    return oauth
+      ? { token: oauth.access, accountId: oauth.accountId, expires: oauth.expires }
+      : null;
   }
-  return null;
+  const auth = authSchema.safeParse(await readJson(route.path));
+  if (!auth.success || !auth.data.tokens?.access_token) return null;
+  return {
+    token: auth.data.tokens.access_token,
+    accountId: auth.data.tokens.account_id,
+    idToken: auth.data.tokens.id_token,
+  };
 }
 
 function usageWindow(
@@ -73,9 +101,11 @@ function usageWindow(
 export async function fetchUsage(
   input: CodexUsageInput,
   fetchApi: typeof fetch = fetch,
+  lookup: StoreLookup = {},
 ): Promise<UsageReport> {
-  const auth = await readAuth(input);
-  if (!auth) return { status: "unavailable", windows: [] };
+  const auth = await readAuth(input, lookup);
+  if (!auth || (auth.expires !== undefined && auth.expires <= (lookup.now ?? Date.now)()))
+    return { status: "unavailable", windows: [] };
   const headers: Record<string, string> = {
     Authorization: `Bearer ${auth.token}`,
     Accept: "application/json",
@@ -151,8 +181,8 @@ function claimString(value: unknown): string | null {
   return typeof value === "string" && value.length > 0 ? value : null;
 }
 
-export async function identify(input: CodexUsageInput) {
-  const auth = await readAuth(input);
+export async function identify(input: CodexUsageInput, lookup: StoreLookup = {}) {
+  const auth = await readAuth(input, lookup);
   if (!auth) return null;
   const access = jwtClaims(auth.token);
   const id = jwtClaims(auth.idToken);

package/dist/server/builtin-plugins/codex-usage-source/shared/input.ts

@@ -1,4 +1,14 @@
 import { z } from "zod";
 
-export const inputSchema = z.object({}).strict();
+export const routeSchema = z.discriminatedUnion("store", [
+  z.object({ store: z.enum(["codex", "opencode", "pi"]), path: z.string().min(1) }).strict(),
+  z
+    .object({
+      store: z.literal("omp"),
+      path: z.string().min(1),
+      credentialId: z.number().int().positive(),
+    })
+    .strict(),
+]);
+export const inputSchema = z.object({ route: routeSchema }).strict();
 export type CodexUsageInput = z.infer<typeof inputSchema>;

package/dist/server/builtin-plugins/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/builtin-plugins",
-  "version": "0.11.0-beta.1",
+  "version": "0.11.0-beta.2",
   "private": true,
   "type": "module",
   "scripts": {

package/dist/server/server/orchestration-skills/internal/operations.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { promises as fs } from "node:fs";
 import path from "node:path";
-import { listFilesRecursive, removeSkill, syncSkills } from "./sync.js";
+import { isLegacyCodexCopy, listFilesRecursive, readManagedFilesManifest, removeSkill, syncSkills, } from "./sync.js";
 // Names the bundle used to ship. They are never selectable, but every scan still
 // covers them so an older install's copies get cleaned up.
 export const LEGACY_SKILL_NAMES = [
@@ -110,10 +110,24 @@ export async function getSkillsStatus(targets, selection) {
         hashSkills(targets.claudeDir, names),
         hashSkills(targets.codexDir, names),
     ]);
-    const disks = [agentsDisk, claudeDisk, codexDisk];
-    const ops = diff(bundle, disks, names, resolveDesiredSkills(selection, available));
-    const installed = installedSkillNames(disks, names);
-    if (!hasInstalledPaseoSkill(disks))
+    const disks = [agentsDisk, claudeDisk];
+    const desired = resolveDesiredSkills(selection, available);
+    const ops = diff(bundle, disks, names, desired);
+    for (const name of codexDisk.keys()) {
+        if (ops.some((op) => op.name === name))
+            continue;
+        if (!(await isLegacyCodexCopy(name, targets)))
+            continue;
+        if (!desired.has(name))
+            ops.push({ kind: "delete", name });
+        else if (await readManagedFilesManifest(path.join(targets.codexDir, name))) {
+            ops.push({ kind: "update", name });
+        }
+    }
+    ops.sort((a, b) => compareStrings(a.name, b.name));
+    const allDisks = [...disks, codexDisk];
+    const installed = installedSkillNames(allDisks, names);
+    if (!hasInstalledPaseoSkill(allDisks))
         return { state: "not-installed", ops, available, installed };
     if (ops.length === 0)
         return { state: "up-to-date", ops, available, installed };

package/dist/server/server/orchestration-skills/internal/sync.d.ts

@@ -10,12 +10,24 @@ export interface SkillSyncResult {
     changedFiles: number;
     processedSkills: number;
 }
+interface ManagedFilesManifest {
+    version: 1;
+    files: Record<string, string>;
+}
 export declare function listFilesRecursive(rootDir: string): Promise<string[]>;
+export declare function readManagedFilesManifest(dstDir: string): Promise<ManagedFilesManifest | null>;
 export interface RemoveSkillTargets {
     agentsDir: string;
     claudeDir: string;
     codexDir: string;
 }
 export declare function removeSkill(skillName: string, targets: RemoveSkillTargets): Promise<void>;
+/**
+ * Codex also discovers .agents/skills, so its dedicated copy is a leftover. When
+ * the Codex skill directory resolves to the shared or Claude copy, it is that
+ * copy, and retiring it would delete the install.
+ */
+export declare function isLegacyCodexCopy(skillName: string, targets: RemoveSkillTargets): Promise<boolean>;
 export declare function syncSkills(options: SkillSyncOptions): Promise<SkillSyncResult>;
+export {};
 //# sourceMappingURL=sync.d.ts.map