@hasna/hooks 0.12.3 → 0.12.4

package/bin/hooks-mcp.js

@@ -15,7 +15,6 @@ var __export = (target, all) => {
     });
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-var __require = import.meta.require;
 
 // src/lib/app-home.ts
 import { existsSync } from "fs";
@@ -1642,14 +1641,14 @@ function assertUsableCredential(appName, source, value) {
     return;
   throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
 }
-function sealCredential(fields) {
-  const { apiKey } = fields;
+function sealCredential(fields2) {
+  const { apiKey } = fields2;
   const visible = {
-    tier: fields.tier,
-    source: fields.source,
-    deliberate: fields.deliberate,
-    diskCandidates: Object.freeze([...fields.diskCandidates]),
-    warning: fields.warning
+    tier: fields2.tier,
+    source: fields2.source,
+    deliberate: fields2.deliberate,
+    diskCandidates: Object.freeze([...fields2.diskCandidates]),
+    warning: fields2.warning
   };
   const sealed = { ...visible };
   Object.defineProperty(sealed, "apiKey", {
@@ -1658,9 +1657,9 @@ function sealCredential(fields) {
     writable: false,
     configurable: false
   });
-  if (fields.pointerVaultKey !== undefined) {
+  if (fields2.pointerVaultKey !== undefined) {
     Object.defineProperty(sealed, "pointerVaultKey", {
-      value: fields.pointerVaultKey,
+      value: fields2.pointerVaultKey,
       enumerable: false,
       writable: false,
       configurable: false
@@ -2258,8 +2257,8 @@ var init_local_opt_in = __esm(() => {
 });
 
 // src/lib/hook-env.ts
-import { dirname as dirname11, isAbsolute as isAbsolute15 } from "path";
-import { existsSync as existsSync13, realpathSync as realpathSync7, statSync } from "fs";
+import { dirname as dirname12, isAbsolute as isAbsolute9 } from "path";
+import { existsSync as existsSync14, realpathSync as realpathSync10, statSync } from "fs";
 import { tmpdir } from "os";
 function isDeniedEnvName(name) {
   const upper = name.toUpperCase();
@@ -2278,7 +2277,7 @@ function isBashFunctionEnvName(name) {
   return name.startsWith("BASH_FUNC_");
 }
 function isUnsafePathEntry(entry, home) {
-  if (entry === "" || !isAbsolute15(entry))
+  if (entry === "" || !isAbsolute9(entry))
     return true;
   if (home && (entry === home || entry.startsWith(home + "/")))
     return true;
@@ -2286,16 +2285,16 @@ function isUnsafePathEntry(entry, home) {
     return true;
   if (entry === "/var/tmp" || entry.startsWith("/var/tmp/"))
     return true;
-  const canonical4 = (path) => {
+  const canonical6 = (path) => {
     try {
-      return realpathSync7(path);
+      return realpathSync10(path);
     } catch {
       return path;
     }
   };
-  const resolved = canonical4(entry);
+  const resolved = canonical6(entry);
   for (const root of [home, tmpdir(), "/tmp", "/var/tmp"].filter((value) => Boolean(value))) {
-    const blocked = canonical4(root);
+    const blocked = canonical6(root);
     if (resolved === blocked || resolved.startsWith(blocked + "/"))
       return true;
   }
@@ -2307,9 +2306,9 @@ function isUnsafePathEntry(entry, home) {
 }
 function sanitizeHookPath(pathValue, home) {
   const baseline = PATH_BASELINE.slice();
-  if (process.platform === "darwin" && existsSync13("/opt/homebrew/bin"))
+  if (process.platform === "darwin" && existsSync14("/opt/homebrew/bin"))
     baseline.push("/opt/homebrew/bin");
-  const bunDir = dirname11(process.execPath);
+  const bunDir = dirname12(process.execPath);
   const seen = new Set;
   const out = [];
   for (const dir of baseline) {
@@ -2434,9 +2433,9 @@ __export(exports_run, {
 });
 import { randomBytes as randomBytes2 } from "crypto";
 import { rmSync as rmSync2, writeFileSync as writeFileSync10 } from "fs";
-import { basename as basename5, dirname as dirname17, isAbsolute as isAbsolute17, join as join12 } from "path";
+import { basename as basename6, dirname as dirname18, isAbsolute as isAbsolute17, join as join13 } from "path";
 function extensionOf(scriptPath) {
-  const base = basename5(scriptPath);
+  const base = basename6(scriptPath);
   const dot = base.lastIndexOf(".");
   return dot > 0 ? base.slice(dot + 1) : "ts";
 }
@@ -2448,9 +2447,9 @@ function shebangInterpreter(firstLine) {
     return null;
   const parts = rest.split(/\s+/);
   if (parts[0] === "env" || parts[0] === "/usr/bin/env") {
-    return parts[1] && parts[1] !== "-S" ? basename5(parts[1]) : parts[2] ? basename5(parts[2]) : null;
+    return parts[1] && parts[1] !== "-S" ? basename6(parts[1]) : parts[2] ? basename6(parts[2]) : null;
   }
-  return basename5(parts[0]);
+  return basename6(parts[0]);
 }
 function interpreterFor(name, scriptPath, content) {
   const ext = extensionOf(scriptPath);
@@ -2503,9 +2502,9 @@ async function readPipeWithDeadline(stream, deadlineMs) {
   return chunks.join("");
 }
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname17(options.scriptPath);
+  const scriptDir = dirname18(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
-  const tempPath = join12(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
+  const tempPath = join13(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
   let timedOut = false;
   const timeoutTimer = options.timeout ? setTimeout(() => {
@@ -2664,29 +2663,29 @@ function resolveEventType(inputEvent, fallbackEvent) {
     return fromInput;
   return normalizeEventType(fallbackEvent ?? null);
 }
-function recordHookRun(record3) {
-  const eventType = record3.eventType ? normalizeEventType(record3.eventType) : null;
+function recordHookRun(record4) {
+  const eventType = record4.eventType ? normalizeEventType(record4.eventType) : null;
   if (!eventType) {
-    process.stderr.write(`[hooks db-writer] skipped event for '${record3.hookName}': unsupported event type '${String(record3.eventType)}'
+    process.stderr.write(`[hooks db-writer] skipped event for '${record4.hookName}': unsupported event type '${String(record4.eventType)}'
 `);
     return;
   }
   const metadata = {
-    ...record3.metadata ?? {},
-    version: record3.version ?? null,
-    sha256: record3.sha256 ?? null,
-    exit_code: record3.exitCode
+    ...record4.metadata ?? {},
+    version: record4.version ?? null,
+    sha256: record4.sha256 ?? null,
+    exit_code: record4.exitCode
   };
   writeHookEvent({
-    session_id: record3.sessionId ?? "cli",
-    hook_name: record3.hookName,
+    session_id: record4.sessionId ?? "cli",
+    hook_name: record4.hookName,
     event_type: eventType,
-    tool_name: record3.toolName ?? null,
-    tool_input: record3.toolInput !== undefined ? JSON.stringify(record3.toolInput) : null,
-    result: record3.result ?? null,
-    error: record3.error ?? null,
-    duration_ms: record3.durationMs,
-    project_dir: record3.projectDir ?? null,
+    tool_name: record4.toolName ?? null,
+    tool_input: record4.toolInput !== undefined ? JSON.stringify(record4.toolInput) : null,
+    result: record4.result ?? null,
+    error: record4.error ?? null,
+    duration_ms: record4.durationMs,
+    project_dir: record4.projectDir ?? null,
     metadata: JSON.stringify(metadata)
   });
 }
@@ -2713,15 +2712,15 @@ import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z as z3 } from "zod";
 init_registry();
-import { existsSync as existsSync14, readFileSync as readFileSync9 } from "fs";
-import { join as join13, dirname as dirname19 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync9 } from "fs";
+import { join as join18, dirname as dirname20 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/lib/installer.ts
 init_registry();
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync7, readdirSync as readdirSync4, realpathSync as realpathSync5, rmdirSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "fs";
-import { join as join10, dirname as dirname7, basename as basename3, resolve as resolve7 } from "path";
-import { homedir as homedir6 } from "os";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, readFileSync as readFileSync7, readdirSync as readdirSync4, realpathSync as realpathSync8, rmdirSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "fs";
+import { join as join11, dirname as dirname7, basename as basename3, resolve as resolve16 } from "path";
+import { homedir as homedir7 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/lib/readiness-process.ts
@@ -3332,16 +3331,16 @@ function assertSettingsPreimage(raw, expected) {
     throw new Error("Hook settings changed since planning; no settings were written.");
   }
 }
-function writeCodexSettings(path, settings, expectedSha256) {
+function writeCodexSettings(path, settings, expectedSha256, beforeWrite) {
   const snapshot = snapshots.get(settings);
   if (!snapshot || snapshot.path !== path)
     throw new Error("Codex settings require a complete current read before writing.");
   assertSettingsPreimage(snapshot.raw, expectedSha256);
-  writeHookSettingsPreimage(path, settings, snapshot.raw);
+  writeHookSettingsPreimage(path, settings, snapshot.raw, beforeWrite);
   snapshots.set(settings, { path, raw: JSON.stringify(settings, null, 2) + `
 ` });
 }
-function writeHookSettingsPreimage(path, settings, before) {
+function writeHookSettingsPreimage(path, settings, before, beforeWrite) {
   mkdirSync4(dirname5(path), { recursive: true, mode: 448 });
   const lock = `${path}.hooks-write.lock`;
   let fd;
@@ -3359,6 +3358,7 @@ function writeHookSettingsPreimage(path, settings, before) {
     writeFileSync3(temp, next, { flag: "wx", mode: 384 });
     if (current(path) !== before)
       throw new Error("Hook settings changed since reading; re-read before retrying.");
+    beforeWrite?.();
     renameSync2(temp, path);
   } finally {
     if (existsSync9(temp))
@@ -3370,8 +3370,11 @@ function writeHookSettingsPreimage(path, settings, before) {
 
 // src/lib/claude-skills-coordination.ts
 import { createHash as createHash6 } from "crypto";
+import { existsSync as existsSync11, lstatSync as lstatSync7 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join10, resolve as resolve7 } from "path";
 
-// ../../node_modules/.bun/@hasna+skills@0.9.17+a00d3064559565bb/node_modules/@hasna/skills/dist/index.js
+// ../../node_modules/.bun/@hasna+skills@0.10.28+a00d3064559565bb/node_modules/@hasna/skills/dist/index.js
 import { existsSync as existsSync10 } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join9, resolve as resolve3 } from "path";
@@ -3381,10 +3384,10 @@ import { createHash as createHash5 } from "crypto";
 import { existsSync as existsSync52, readdirSync as readdirSync3, readFileSync as readFileSync42, statSync as statSync3 } from "fs";
 import { join as join52, sep as sep2 } from "path";
 import { basename as basename2, isAbsolute as isAbsolute22, resolve as resolve22 } from "path";
-import { createHash as createHash16 } from "crypto";
-import { lstatSync as lstatSync20, readFileSync as readFileSync16, readdirSync as readdirSync9, realpathSync as realpathSync4 } from "fs";
-import { basename as basename8, dirname as dirname16, isAbsolute as isAbsolute14, join as join26, resolve as resolve14, sep as sep5 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
+import { createHash as createHash18 } from "crypto";
+import { lstatSync as lstatSync21, readFileSync as readFileSync17, readdirSync as readdirSync10, realpathSync as realpathSync7 } from "fs";
+import { basename as basename9, dirname as dirname17, isAbsolute as isAbsolute16, join as join27, resolve as resolve15, sep as sep6 } from "path";
+import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
 import { dirname as dirname32, isAbsolute as isAbsolute32, join as join72, resolve as resolve32 } from "path";
 import { lstatSync as lstatSync32, readFileSync as readFileSync62, opendirSync } from "fs";
 import { createHash as createHash22 } from "crypto";
@@ -3396,34 +3399,42 @@ import { dirname as dirname52, isAbsolute as isAbsolute5, resolve as resolve5 }
 import { createHash as createHash42 } from "crypto";
 import { lstatSync as lstatSync6, readlinkSync } from "fs";
 import { dirname as dirname6, isAbsolute as isAbsolute6, join as join92, parse, resolve as resolve6, sep as sep22 } from "path";
-import { closeSync as closeSync12, constants as constants9, fstatSync as fstatSync12, lstatSync as lstatSync17, openSync as openSync12, opendirSync as opendirSync5, readSync as readSync8 } from "fs";
-import { basename as basename6, dirname as dirname13, isAbsolute as isAbsolute12, join as join25, resolve as resolve12 } from "path";
-import { isAbsolute as isAbsolute11, join as join23, resolve as resolve11 } from "path";
+import { closeSync as closeSync10, constants as constants9, fstatSync as fstatSync10, lstatSync as lstatSync18, openSync as openSync10, opendirSync as opendirSync5, readSync as readSync8 } from "fs";
+import { basename as basename7, dirname as dirname14, isAbsolute as isAbsolute14, join as join26, resolve as resolve13 } from "path";
+import { isAbsolute as isAbsolute13, join as join25, resolve as resolve12 } from "path";
 import { createRequire } from "module";
-import { createHash as createHash10, randomUUID as randomUUID2 } from "crypto";
-import { existsSync as existsSync82, lstatSync as lstatSync14, statSync as statSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync11, readdirSync as readdirSync7, opendirSync as opendirSync3, readlinkSync as readlinkSync2, realpathSync as realpathSync32, renameSync as renameSync22, rmdirSync as rmdirSync2, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3, chmodSync, openSync as openSync10, closeSync as closeSync10, fsyncSync as fsyncSync2, fstatSync as fstatSync10, readSync as readSync6, constants as constants7, linkSync } from "fs";
-import { dirname as dirname10, join as join16, resolve as resolve9, relative as relative4, isAbsolute as isAbsolute9, sep as sep4 } from "path";
-import { homedir as homedir22 } from "os";
-import { closeSync as closeSync8, constants as constants5, fstatSync as fstatSync8, lstatSync as lstatSync11, openSync as openSync8, readSync as readSync4 } from "fs";
-import { join as join14 } from "path";
 import { createHash as createHash8 } from "crypto";
-import { lstatSync as lstatSync12, readFileSync as readFileSync10, readdirSync as readdirSync6 } from "fs";
-import { join as join15 } from "path";
-import { createHash as createHash9 } from "crypto";
-import { closeSync as closeSync9, constants as constants6, fstatSync as fstatSync9, lstatSync as lstatSync13, openSync as openSync9, readSync as readSync5 } from "fs";
+import { closeSync as closeSync6, constants as constants5, fstatSync as fstatSync6, lstatSync as lstatSync11, openSync as openSync6, readSync as readSync4 } from "fs";
 import { basename as basename4, dirname as dirname9, isAbsolute as isAbsolute8, resolve as resolve8 } from "path";
+import { basename as basename5, dirname as dirname10, join as join14, relative as relative4, resolve as resolve9, sep as sep4 } from "path";
+import { lstatSync as lstatSync12, readdirSync as readdirSync6, readlinkSync as readlinkSync3, realpathSync as realpathSync5 } from "fs";
+import { realpathSync as realpathSync4 } from "fs";
+import { isAbsolute as isAbsolute10, normalize as normalize2 } from "path";
+import { createHash as createHash9 } from "crypto";
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+import { createHash as createHash10 } from "crypto";
+import { createHash as createHash12, randomUUID as randomUUID2 } from "crypto";
+import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
+import { existsSync as existsSync82, lstatSync as lstatSync15, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync12, readdirSync as readdirSync8, opendirSync as opendirSync3, readlinkSync as readlinkSync4, realpathSync as realpathSync6, renameSync as renameSync22, rmdirSync as rmdirSync2, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3, chmodSync, openSync as openSync8, closeSync as closeSync8, fsyncSync as fsyncSync2, fstatSync as fstatSync8, readSync as readSync6, constants as constants7, linkSync } from "fs";
+import { dirname as dirname11, join as join17, resolve as resolve10, relative as relative5, isAbsolute as isAbsolute11, sep as sep5 } from "path";
+import { homedir as homedir22 } from "os";
+import { closeSync as closeSync7, constants as constants6, fstatSync as fstatSync7, lstatSync as lstatSync13, openSync as openSync7, readSync as readSync5 } from "fs";
+import { join as join15 } from "path";
 import { createHash as createHash11 } from "crypto";
-import { constants as constants8, closeSync as closeSync11, fchmodSync, fstatSync as fstatSync11, fsyncSync as fsyncSync3, linkSync as linkSync2, lstatSync as lstatSync16, mkdirSync as mkdirSync8, openSync as openSync11, opendirSync as opendirSync4, readSync as readSync7, renameSync as renameSync4, rmdirSync as rmdirSync3, rmSync as rmSync3, unlinkSync as unlinkSync4, writeSync as writeSync2 } from "fs";
-import { dirname as dirname12, isAbsolute as isAbsolute10, join as join21, parse as parse5, resolve as resolve10 } from "path";
+import { lstatSync as lstatSync14, readFileSync as readFileSync11, readdirSync as readdirSync7 } from "fs";
+import { join as join16 } from "path";
 import { createHash as createHash13 } from "crypto";
-import { closeSync as closeSync13, constants as constants10, fstatSync as fstatSync13, lstatSync as lstatSync18, openSync as openSync13, readSync as readSync9 } from "fs";
-import { basename as basename7, dirname as dirname14, isAbsolute as isAbsolute13, resolve as resolve13 } from "path";
+import { constants as constants8, closeSync as closeSync9, fchmodSync, fstatSync as fstatSync9, fsyncSync as fsyncSync3, linkSync as linkSync2, lstatSync as lstatSync17, mkdirSync as mkdirSync8, openSync as openSync9, opendirSync as opendirSync4, readSync as readSync7, renameSync as renameSync4, rmdirSync as rmdirSync3, rmSync as rmSync3, unlinkSync as unlinkSync4, writeSync as writeSync2 } from "fs";
+import { dirname as dirname13, isAbsolute as isAbsolute12, join as join23, parse as parse5, resolve as resolve11 } from "path";
 import { createHash as createHash15 } from "crypto";
-import { closeSync as closeSync14, constants as constants11, fstatSync as fstatSync14, fsyncSync as fsyncSync4, lstatSync as lstatSync19, openSync as openSync14, readSync as readSync10, writeFileSync as writeFileSync7 } from "fs";
-import { createHash as createHash14 } from "crypto";
-import { dirname as dirname15 } from "path";
-import { isAbsolute as isAbsolute16 } from "path";
-import { createHash as createHash20 } from "crypto";
+import { closeSync as closeSync11, constants as constants10, fstatSync as fstatSync11, lstatSync as lstatSync19, openSync as openSync11, readSync as readSync9 } from "fs";
+import { basename as basename8, dirname as dirname15, isAbsolute as isAbsolute15, resolve as resolve14 } from "path";
+import { createHash as createHash17 } from "crypto";
+import { closeSync as closeSync12, constants as constants11, fstatSync as fstatSync12, fsyncSync as fsyncSync4, lstatSync as lstatSync20, openSync as openSync12, readSync as readSync10, writeFileSync as writeFileSync7 } from "fs";
+import { createHash as createHash16 } from "crypto";
+import { dirname as dirname16 } from "path";
+import { isAbsolute as isAbsolute18 } from "path";
+import { createHash as createHash222 } from "crypto";
 var __defProp2 = Object.defineProperty;
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __returnValue2 = (v) => v;
@@ -3439,7 +3450,7 @@ var __export2 = (target, all) => {
       set: __exportSetter2.bind(all, name)
     });
 };
-var __require2 = import.meta.require;
+var __require = import.meta.require;
 var require_identity = __commonJS((exports) => {
   var ALIAS = Symbol.for("yaml.alias");
   var DOC = Symbol.for("yaml.document");
@@ -4977,7 +4988,7 @@ ${ctx.indent}`;
   exports.stringifyPair = stringifyPair;
 });
 var require_log = __commonJS((exports) => {
-  var node_process = __require2("process");
+  var node_process = __require("process");
   function debug(logLevel, ...messages) {
     if (logLevel === "debug")
       console.log(...messages);
@@ -5778,7 +5789,7 @@ var require_schema2 = __commonJS((exports) => {
   exports.schema = schema;
 });
 var require_binary = __commonJS((exports) => {
-  var node_buffer = __require2("buffer");
+  var node_buffer = __require("buffer");
   var Scalar = require_Scalar();
   var stringifyString = require_stringifyString();
   var binary = {
@@ -8085,7 +8096,7 @@ var require_compose_doc = __commonJS((exports) => {
   exports.composeDoc = composeDoc;
 });
 var require_composer = __commonJS((exports) => {
-  var node_process = __require2("process");
+  var node_process = __require("process");
   var directives = require_directives();
   var Document = require_Document();
   var errors = require_errors();
@@ -9296,7 +9307,7 @@ var require_line_counter = __commonJS((exports) => {
   exports.LineCounter = LineCounter;
 });
 var require_parser = __commonJS((exports) => {
-  var node_process = __require2("process");
+  var node_process = __require("process");
   var cst = require_cst();
   var lexer = require_lexer();
   function includesToken(list, type) {
@@ -10846,6 +10857,33 @@ function assertAgentPolicyCollections(policy) {
       for (const key of ["agent", "home", "alias", "target", "link", "aliasIdentity", "targetIdentity"])
         text(alias[key]);
     }
+  if (bridge.codexPluginSkills !== undefined)
+    for (const control of array(bridge.codexPluginSkills, 4096)) {
+      requireBound(object(control) && Object.keys(control).every((key) => ["name", "pluginId", "namespace", "pluginParent", "manifestSha256", "appSha256", "mcpSha256", "remotePluginId"].includes(key)));
+      text(control.name, 129);
+      text(control.pluginId, 1024);
+      text(control.namespace, 64);
+      text(control.pluginParent);
+      requireBound(isAbsolute22(control.pluginParent) && resolve22(control.pluginParent) === control.pluginParent && /^[a-f0-9]{64}$/.test(control.manifestSha256));
+      if (control.remotePluginId !== undefined)
+        requireBound(typeof control.remotePluginId === "string" && /^[A-Za-z0-9_~-]{1,1024}$/.test(control.remotePluginId));
+      if (control.mcpSha256 !== undefined)
+        requireBound(typeof control.mcpSha256 === "string" && /^[a-f0-9]{64}$/.test(control.mcpSha256));
+      if (control.appSha256 !== undefined)
+        requireBound(typeof control.appSha256 === "string" && /^[a-f0-9]{64}$/.test(control.appSha256));
+    }
+  if (bridge.codexInactivePlugins !== undefined) {
+    const controls = array(bridge.codexInactivePlugins, 4096), ids = new Set;
+    requireBound(controls.length === 0 || object(bridge.codexPluginSkillReview) && bridge.codexPluginSkillReview.version === "codex-cli 0.160.0" && typeof bridge.codexPluginSkillReview.catalogSha256 === "string" && /^[a-f0-9]{64}$/.test(bridge.codexPluginSkillReview.catalogSha256));
+    for (const control of controls) {
+      requireBound(object(control) && Object.keys(control).every((key) => ["pluginId", "namespace", "pluginParent", "sourceType", "sourceSha256"].includes(key)));
+      text(control.pluginId, 1024);
+      text(control.namespace, 64);
+      text(control.pluginParent);
+      requireBound(!ids.has(control.pluginId) && isAbsolute22(control.pluginParent) && resolve22(control.pluginParent) === control.pluginParent && ["local", "git", "npm"].includes(control.sourceType) && typeof control.sourceSha256 === "string" && /^[a-f0-9]{64}$/.test(control.sourceSha256));
+      ids.add(control.pluginId);
+    }
+  }
   if (bridge.disabledBuiltins !== undefined)
     for (const builtin of array(bridge.disabledBuiltins, AGENT_POLICY_LIMITS.builtinNames)) {
       requireBound(object(builtin));
@@ -10858,6 +10896,25 @@ function assertAgentPolicyCollections(policy) {
     text(agent, 128);
     requireBound(object(value));
     text(value.agent, 128);
+    if (value.codexInstallationInputs !== undefined) {
+      const proof = record(value.codexInstallationInputs, 4), inputs = array(proof.plugins, 4096), ids = new Set;
+      requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && proof.version === "codex-cli 0.160.0" && typeof proof.catalogSha256 === "string" && /^[a-f0-9]{64}$/.test(proof.catalogSha256) && inputs.length > 0 && object(bridge.codexPluginSkillReview) && bridge.codexPluginSkillReview.version === proof.version && bridge.codexPluginSkillReview.catalogSha256 === proof.catalogSha256);
+      for (const input of inputs) {
+        requireBound(object(input) && Object.keys(input).every((key) => ["pluginId", "namespace", "pluginParent", "sourceRoot", "sourceSha256"].includes(key)));
+        text(input.pluginId, 1024);
+        text(input.namespace, 64);
+        text(input.pluginParent);
+        text(input.sourceRoot);
+        requireBound(!ids.has(input.pluginId) && [input.pluginParent, input.sourceRoot].every((path) => isAbsolute22(path) && resolve22(path) === path) && typeof input.sourceSha256 === "string" && /^[a-f0-9]{64}$/.test(input.sourceSha256));
+        ids.add(input.pluginId);
+      }
+      if (proof.directories !== undefined)
+        for (const directory of array(proof.directories, AGENT_POLICY_LIMITS.discoveryDirectories)) {
+          requireBound(object(directory));
+          text(directory.path);
+          requireBound(directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256));
+        }
+    }
     for (const root of array(value.roots, AGENT_POLICY_LIMITS.discoveryRoots))
       text(root);
     for (const source of array(value.sources, AGENT_POLICY_LIMITS.discoverySources)) {
@@ -10865,7 +10922,9 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3")
+        requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute22(source.path) && resolve22(source.path) === source.path && basename2(source.path) === "config.toml");
       if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute22(source.path) && resolve22(source.path) === source.path && basename2(source.path) === "settings.json");
       if (source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2")
@@ -11136,7 +11195,7 @@ function safe(path) {
 function same(before, after) {
   return Boolean(after && after.isDirectory() && before.dev === after.dev && before.ino === after.ino && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs);
 }
-function capture(path, budget) {
+function capture(path, budget, excludedRoots) {
   safe(path);
   const root = lstatSync4(path, { throwIfNoEntry: false });
   if (!root)
@@ -11165,7 +11224,7 @@ function capture(path, budget) {
       budget.bytes += Buffer.byteLength(row);
       need(budget.bytes <= AGENT_POLICY_LIMITS.discoveryDirectoryBytes, "Native discovery directory metadata limit exceeded");
       hash.update(row);
-      if (stat.isDirectory())
+      if (stat.isDirectory() && !excludedRoots.includes(child))
         walk(child, childRelative, stat, depth + 1);
     }
     need(same(before, lstatSync4(current2, { throwIfNoEntry: false })), "Native discovery directory changed while reading");
@@ -11174,16 +11233,18 @@ function capture(path, budget) {
   safe(path);
   return { path, sha256: hash.digest("hex") };
 }
-function captureDiscoveryDirectories(paths) {
+function captureDiscoveryDirectories(paths, excludedRoots = []) {
   need(Array.isArray(paths) && paths.length <= AGENT_POLICY_LIMITS.discoveryDirectories && new Set(paths).size === paths.length, "Invalid native discovery directory collection");
   const budget = { entries: 0, bytes: 0 };
-  return paths.map((path) => capture(path, budget));
+  for (const root of excludedRoots)
+    safe(root);
+  return paths.map((path) => capture(path, budget, excludedRoots));
 }
-function verifyDiscoveryDirectories(directories) {
+function verifyDiscoveryDirectories(directories, excludedRoots = []) {
   need(Array.isArray(directories) && directories.length <= AGENT_POLICY_LIMITS.discoveryDirectories, "Invalid native discovery directory collection");
   for (const directory of directories)
     need(directory && typeof directory === "object" && (directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256)), "Invalid native discovery directory digest");
-  const current2 = captureDiscoveryDirectories(directories.map((directory) => directory.path));
+  const current2 = captureDiscoveryDirectories(directories.map((directory) => directory.path), excludedRoots);
   for (let i = 0;i < directories.length; i++)
     need(current2[i].sha256 === directories[i].sha256, `Native discovery directory membership changed; run skills hook install with a fresh discovery review: ${directories[i].path}`);
 }
@@ -11359,236 +11420,6 @@ function hashDiscoveryPathFile(path, budget, changes) {
     throw new Error("Discovery path input changed during read");
   return createHash42("sha256").update(JSON.stringify({ version: 1, path, rows: before.rows, content })).digest("hex");
 }
-var package_default = {
-  name: "@hasna/skills",
-  version: "0.9.17",
-  description: "Skills library for AI coding agents",
-  type: "module",
-  bin: {
-    skills: "bin/index.js",
-    "skills-mcp": "bin/mcp.js",
-    "skills-serve": "bin/server.js",
-    "skills-server": "bin/server.js",
-    "skills-worker": "bin/worker.js",
-    "skills-maintenance": "bin/maintenance.js",
-    "skills-migrate": "bin/migrate.js"
-  },
-  exports: {
-    ".": {
-      import: "./dist/index.js",
-      types: "./dist/index.d.ts"
-    },
-    "./storage": {
-      import: "./dist/storage.js",
-      types: "./dist/storage.d.ts"
-    },
-    "./sdk": {
-      import: "./dist/sdk/index.js",
-      types: "./dist/sdk/index.d.ts"
-    },
-    "./admin-contract": {
-      import: "./dist/admin-contract.js",
-      types: "./dist/admin-contract.d.ts"
-    }
-  },
-  files: [
-    "dist/",
-    "!dist/**/*.test.d.ts",
-    "!dist/**/*.fixture.d.ts",
-    "!dist/test-preload.d.ts",
-    "!dist/platform",
-    "bin/",
-    "migrations/",
-    "docs/skill-standard.md",
-    "docs/plugin-admission.md",
-    "schemas/",
-    "LICENSE",
-    "README.md",
-    "!dist/**/*test-utils.d.ts",
-    "!dist/**/*fixtures.d.ts"
-  ],
-  main: "./dist/index.js",
-  types: "./dist/index.d.ts",
-  scripts: {
-    clean: "rm -rf bin/ dist/",
-    build: "bun run clean && bun build ./src/cli/index.tsx --outdir ./bin --target bun && bun build ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
-    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
-    test: "bun test --timeout 30000",
-    dev: "bun run ./src/cli/index.tsx",
-    "dev:watch": "bun --watch run ./src/cli/index.tsx",
-    "dev:mcp": "bun --watch run ./src/mcp/index.ts",
-    "dev:server": "bun --watch run ./src/server/index.ts",
-    "dev:worker": "bun --watch run ./src/server/worker.ts",
-    "docker:check": "bash scripts/docker-build-check.sh",
-    migrate: "bun run ./src/server/migrate.ts",
-    typecheck: "tsc --noEmit",
-    "verify:release": "bun run scripts/release-guard.ts",
-    "verify:consumer-types": "bun run scripts/consumer-types.ts",
-    prepack: "bun run verify:generated && bun run verify:release && bun run verify:consumer-types",
-    prepublishOnly: "bun run verify:producer && bun run typecheck && bun run test",
-    "verify:producer": "bun run scripts/release-dependencies.ts",
-    "verify:generated": "HASNA_SKILLS_RELEASE_ARTIFACT_TEST=1 bun test src/lib/release-artifacts.test.ts",
-    "verify:consumer-credentials": "bun run scripts/consumer-credentials.ts"
-  },
-  keywords: [
-    "skills",
-    "ai",
-    "agent",
-    "cli",
-    "typescript",
-    "bun",
-    "claude",
-    "codex",
-    "gemini",
-    "mcp",
-    "model-context-protocol",
-    "open-source",
-    "skills-library",
-    "automation"
-  ],
-  author: "Hasna",
-  license: "Apache-2.0",
-  devDependencies: {
-    "@hasna/contracts": "1.1.0",
-    "@types/bun": "1.3.14",
-    "@types/node": "25.2.3",
-    "@types/react": "^18.2.0",
-    "bun-types": "1.3.14",
-    "react-devtools-core": "^7.0.1",
-    typescript: "^5",
-    yaml: "^2.9.0"
-  },
-  dependencies: {
-    "@aws-sdk/client-ecs": "^3.1079.0",
-    "@aws-sdk/client-s3": "^3.1079.0",
-    "@hasna/events": "0.1.18",
-    "@hasna/secrets": "0.4.2",
-    "@modelcontextprotocol/sdk": "^1.26.0",
-    chalk: "^5.3.0",
-    commander: "^12.1.0",
-    ink: "^5.0.1",
-    "ink-select-input": "^6.0.0",
-    "ink-spinner": "^5.0.0",
-    "ink-text-input": "^6.0.0",
-    react: "^18.2.0",
-    zod: "^4.3.6"
-  },
-  engines: {
-    bun: ">=1.0.0"
-  },
-  publishConfig: {
-    registry: "https://registry.npmjs.org",
-    access: "public"
-  },
-  repository: {
-    type: "git",
-    url: "https://github.com/hasna/apps.git",
-    directory: "apps/skills"
-  },
-  homepage: "https://github.com/hasna/apps/tree/main/apps/skills",
-  bugs: {
-    url: "https://github.com/hasna/apps/issues"
-  }
-};
-function envToken(name) {
-  return name.toUpperCase().replace(/-/g, "_");
-}
-function clientTransportEnvKeys(name) {
-  const envSegment = envToken(name);
-  return {
-    apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
-    apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
-  };
-}
-function credentialPointerEnvKey(name) {
-  return `HASNA_${envToken(name)}_API_KEY_REF`;
-}
-var MAX_PACKAGE_BYTES = 1024 * 1024;
-var MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
-var INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
-var CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
-var AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
-var requireSecretsSdk = createRequire(import.meta.url);
-var IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
-var AUTHORITY_OVERRIDE_HEADERS = new Set([
-  "host",
-  ":authority",
-  "forwarded",
-  "x-forwarded-host",
-  "x-original-host"
-]);
-var SKILLS_APP = "skills";
-var ENV_KEYS = clientTransportEnvKeys(SKILLS_APP);
-var SKILLS_API_URL_ENV_KEYS = ENV_KEYS.apiUrlKeys;
-var SKILLS_API_KEY_ENV_KEYS = ENV_KEYS.apiKeyKeys;
-var SKILLS_API_URL_ENV = SKILLS_API_URL_ENV_KEYS[0];
-var SKILLS_API_KEY_ENV = SKILLS_API_KEY_ENV_KEYS[0];
-
-class SkillsFleetCredentialError extends Error {
-  code;
-  constructor(message, code = "MISSING_API_CREDENTIAL") {
-    super(message);
-    this.name = "SkillsFleetCredentialError";
-    this.code = code;
-  }
-}
-function normalizeSkillsApiOrigin(apiUrl) {
-  const url = new URL(apiUrl);
-  if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))) {
-    throw new SkillsFleetCredentialError("A Skills API URL must use HTTPS (or loopback HTTP), without credentials, query or fragment", "INVALID_API_URL");
-  }
-  const pathname = url.pathname.replace(/\/+$/, "");
-  if (url.origin === "https://api.hasna.com" && pathname === "/skills/v1") {
-    url.pathname = "/skills";
-  } else if (pathname === "/api" || pathname === "/api/v1") {
-    url.pathname = "/";
-  } else if (pathname.endsWith("/api/v1")) {
-    url.pathname = pathname.slice(0, -"/api/v1".length) || "/";
-  } else if (pathname.endsWith("/api")) {
-    url.pathname = pathname.slice(0, -"/api".length) || "/";
-  }
-  return url.toString().replace(/\/+$/, "");
-}
-function skillsApiRequestUrl(apiUrl, route) {
-  const origin = normalizeSkillsApiOrigin(apiUrl);
-  if (!route.startsWith("/api/") || route.includes("#") || route.includes("\\")) {
-    throw new SkillsFleetCredentialError("Invalid Skills API route", "INVALID_API_URL");
-  }
-  if (origin === "https://api.hasna.com/skills") {
-    if (route === "/api/auth/whoami")
-      return `${origin}/v1/auth/whoami`;
-    if (!route.startsWith("/api/v1/")) {
-      throw new SkillsFleetCredentialError("The internal Skills gateway has no established login contract yet. Select an explicitly configured instance with supported authentication.", "GATEWAY_AUTH_UNAVAILABLE");
-    }
-    return `${origin}${route.slice("/api".length)}`;
-  }
-  return `${origin}${route}`;
-}
-var MAX_REMOTE_FILE_BYTES = 64 * 1024 * 1024;
-function selectionAliasError(selections) {
-  const names = new Set(selections.map((selection) => selection.slug));
-  for (const selection of selections) {
-    if (selection.aliases === undefined)
-      continue;
-    if (!Array.isArray(selection.aliases) || selection.aliases.length > 32)
-      return "Selection aliases must be an array of at most 32 names.";
-    for (const alias of selection.aliases) {
-      if (typeof alias !== "string" || alias.length > 128 || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(alias))
-        return "Selection aliases must be bounded kebab-case names.";
-      if (names.has(alias))
-        return "Selection aliases must be unique and cannot shadow a selected canonical name.";
-      names.add(alias);
-    }
-  }
-}
-var MAX_PROFILE_SELECTIONS = 4096;
-var MAX_PROFILE_DOCUMENT_BYTES = 8 * 1024 * 1024;
-var MAX_SKILL_SESSION_ID_CHARS = 256;
-var PROFILE_SESSION_ENVELOPE_BYTES = MAX_PROFILE_SELECTIONS * 67 + MAX_SKILL_SESSION_ID_CHARS * 12 + 512;
-var MAX_RESOLVED_PROFILE_BYTES = MAX_PROFILE_DOCUMENT_BYTES - PROFILE_SESSION_ENVELOPE_BYTES;
-function profileDocumentBytes(value) {
-  return new TextEncoder().encode(JSON.stringify(value)).byteLength;
-}
 var BLOCK = 512;
 var ANY_SEGMENT_EXCLUDES = new Set([
   ".git",
@@ -11853,6 +11684,30 @@ var SKILL_VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
 function isValidSkillVersion(value) {
   return typeof value === "string" && SKILL_VERSION_PATTERN.test(value) && !/^\.+$/.test(value) && !value.includes("..");
 }
+function selectionAliasError(selections) {
+  const names = new Set(selections.map((selection) => selection.slug));
+  for (const selection of selections) {
+    if (selection.aliases === undefined)
+      continue;
+    if (!Array.isArray(selection.aliases) || selection.aliases.length > 32)
+      return "Selection aliases must be an array of at most 32 names.";
+    for (const alias of selection.aliases) {
+      if (typeof alias !== "string" || alias.length > 128 || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(alias))
+        return "Selection aliases must be bounded kebab-case names.";
+      if (names.has(alias))
+        return "Selection aliases must be unique and cannot shadow a selected canonical name.";
+      names.add(alias);
+    }
+  }
+}
+var MAX_PROFILE_SELECTIONS = 4096;
+var MAX_PROFILE_DOCUMENT_BYTES = 8 * 1024 * 1024;
+var MAX_SKILL_SESSION_ID_CHARS = 256;
+var PROFILE_SESSION_ENVELOPE_BYTES = MAX_PROFILE_SELECTIONS * 67 + MAX_SKILL_SESSION_ID_CHARS * 12 + 512;
+var MAX_RESOLVED_PROFILE_BYTES = MAX_PROFILE_DOCUMENT_BYTES - PROFILE_SESSION_ENVELOPE_BYTES;
+function profileDocumentBytes(value) {
+  return new TextEncoder().encode(JSON.stringify(value)).byteLength;
+}
 class SkillSelectionError extends Error {
   code;
   constructor(code, message) {
@@ -11862,7 +11717,7 @@ class SkillSelectionError extends Error {
   }
 }
 var MAX_CACHED_PROFILE_AGE_MS = 24 * 60 * 60 * 1000;
-function validateSelection2(selection) {
+function validateSelection(selection) {
   if (!selection || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(selection.slug) || !isValidSkillVersion(selection.version) || !/^sha256:[a-f0-9]{64}$/.test(selection.bundleDigest) || typeof selection.workspaceId !== "string" || !selection.workspaceId.trim() || typeof selection.profileRevision !== "string" || !selection.profileRevision.trim()) {
     throw new SkillSelectionError("INVALID_SELECTION", "A skill selection must carry an exact version, digest, workspace and profile revision.");
   }
@@ -11885,7 +11740,7 @@ function validateResolvedProfile(profile, authority) {
     throw new SkillSelectionError("RECEIPT_TOO_LARGE", "The resolved Skills profile exceeds its size limit.");
   const slugs = new Set;
   for (const selection of profile.selections) {
-    validateSelection2(selection);
+    validateSelection(selection);
     if (selection.authority !== profile.authority || selection.workspaceId !== profile.workspaceId || selection.profileRevision !== profile.profileRevision || slugs.has(selection.slug)) {
       throw new SkillSelectionError("PROFILE_IDENTITY_MISMATCH", "The resolved profile contains conflicting selection identities.");
     }
@@ -11895,110 +11750,276 @@ function validateResolvedProfile(profile, authority) {
   if (aliasError)
     throw new SkillSelectionError("INVALID_SELECTION_ALIASES", aliasError);
 }
-function refusal(reason = "is unreadable") {
-  return new SkillSelectionError("INVALID_AGENT_POLICY", `The Skills agent loading policy ${reason}; refusing legacy fallback.`);
-}
-function parseManagedSkillPolicy(text2) {
-  if (Buffer.byteLength(text2) > AGENT_POLICY_LIMITS.bytes)
-    throw refusal("exceeds its size limit");
-  let value;
-  try {
-    value = JSON.parse(text2);
-  } catch {
-    throw refusal();
+var package_default = {
+  name: "@hasna/skills",
+  version: "0.10.28",
+  description: "Skills library for AI coding agents",
+  type: "module",
+  bin: {
+    skills: "bin/index.js",
+    "skills-mcp": "bin/mcp.js",
+    "skills-serve": "bin/server.js",
+    "skills-server": "bin/server.js",
+    "skills-worker": "bin/worker.js",
+    "skills-maintenance": "bin/maintenance.js",
+    "skills-migrate": "bin/migrate.js"
+  },
+  exports: {
+    ".": {
+      import: "./dist/index.js",
+      types: "./dist/index.d.ts"
+    },
+    "./storage": {
+      import: "./dist/storage.js",
+      types: "./dist/storage.d.ts"
+    },
+    "./sdk": {
+      import: "./dist/sdk/index.js",
+      types: "./dist/sdk/index.d.ts"
+    },
+    "./admin-contract": {
+      import: "./dist/admin-contract.js",
+      types: "./dist/admin-contract.d.ts"
+    }
+  },
+  files: [
+    "dist/",
+    "!dist/**/*.test.d.ts",
+    "!dist/**/*.fixture.d.ts",
+    "!dist/test-preload.d.ts",
+    "!dist/platform",
+    "bin/",
+    "migrations/",
+    "docs/skill-standard.md",
+    "docs/plugin-admission.md",
+    "schemas/",
+    "LICENSE",
+    "README.md",
+    "!dist/**/*test-utils.d.ts",
+    "!dist/**/*fixtures.d.ts"
+  ],
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  scripts: {
+    clean: "rm -rf bin/ dist/",
+    build: "bun run clean && bun build ./src/cli/index.tsx --outdir ./bin --target bun && bun build ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    test: "bun test --timeout 30000",
+    dev: "bun run ./src/cli/index.tsx",
+    "dev:watch": "bun --watch run ./src/cli/index.tsx",
+    "dev:mcp": "bun --watch run ./src/mcp/index.ts",
+    "dev:server": "bun --watch run ./src/server/index.ts",
+    "dev:worker": "bun --watch run ./src/server/worker.ts",
+    "docker:check": "bash scripts/docker-build-check.sh",
+    migrate: "bun run ./src/server/migrate.ts",
+    typecheck: "tsc --noEmit",
+    "verify:release": "bun run scripts/release-guard.ts",
+    "verify:release-review": "bun run scripts/verify-release-review.ts",
+    "verify:consumer-types": "bun run scripts/consumer-types.ts",
+    prepack: "bun run verify:generated && bun run verify:release && bun run verify:consumer-types",
+    prepublishOnly: "bun run verify:producer && bun run typecheck && bun run test",
+    "verify:producer": "bun run scripts/release-dependencies.ts",
+    "verify:generated": "HASNA_SKILLS_RELEASE_ARTIFACT_TEST=1 bun test src/lib/release-artifacts.test.ts",
+    "verify:consumer-credentials": "bun run scripts/consumer-credentials.ts"
+  },
+  keywords: [
+    "skills",
+    "ai",
+    "agent",
+    "cli",
+    "typescript",
+    "bun",
+    "claude",
+    "codex",
+    "gemini",
+    "mcp",
+    "model-context-protocol",
+    "open-source",
+    "skills-library",
+    "automation"
+  ],
+  author: "Hasna",
+  license: "Apache-2.0",
+  devDependencies: {
+    "@hasna/contracts": "1.1.0",
+    "@types/bun": "1.3.14",
+    "@types/node": "25.2.3",
+    "@types/react": "^18.2.0",
+    "bun-types": "1.3.14",
+    "react-devtools-core": "^7.0.1",
+    typescript: "^5",
+    yaml: "^2.9.0"
+  },
+  dependencies: {
+    "@aws-sdk/client-ecs": "^3.1079.0",
+    "@aws-sdk/client-s3": "^3.1079.0",
+    "@hasna/events": "0.1.18",
+    "@hasna/secrets": "0.4.2",
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    chalk: "^5.3.0",
+    commander: "^12.1.0",
+    ink: "^5.0.1",
+    "ink-select-input": "^6.0.0",
+    "ink-spinner": "^5.0.0",
+    "ink-text-input": "^6.0.0",
+    react: "^18.2.0",
+    zod: "^4.3.6"
+  },
+  engines: {
+    bun: ">=1.0.0"
+  },
+  publishConfig: {
+    registry: "https://registry.npmjs.org",
+    access: "public"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/hasna/skills.git",
+    directory: "apps/skills"
+  },
+  homepage: "https://github.com/hasna/skills/tree/main/apps/skills",
+  bugs: {
+    url: "https://github.com/hasna/skills/issues"
   }
-  if (!value || typeof value !== "object" || Array.isArray(value) || value.loading !== "cli" || value.version !== undefined && value.version !== 1)
-    throw refusal();
-  if (value.profileId !== undefined && (typeof value.profileId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(value.profileId) || value.profileId.includes("..")))
-    throw refusal();
-  try {
-    assertAgentPolicyCollections(value);
-  } catch {
-    throw refusal("has invalid collection bounds");
+};
+function envToken(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function clientTransportEnvKeys(name) {
+  const envSegment = envToken(name);
+  return {
+    apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
+    apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
+  };
+}
+function credentialPointerEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_REF`;
+}
+var MAX_PACKAGE_BYTES = 1024 * 1024;
+var MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
+var INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+var CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
+var AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+var requireSecretsSdk = createRequire(import.meta.url);
+var IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+var AUTHORITY_OVERRIDE_HEADERS = new Set([
+  "host",
+  ":authority",
+  "forwarded",
+  "x-forwarded-host",
+  "x-original-host"
+]);
+var SKILLS_APP = "skills";
+var ENV_KEYS = clientTransportEnvKeys(SKILLS_APP);
+var SKILLS_API_URL_ENV_KEYS = ENV_KEYS.apiUrlKeys;
+var SKILLS_API_KEY_ENV_KEYS = ENV_KEYS.apiKeyKeys;
+var SKILLS_API_URL_ENV = SKILLS_API_URL_ENV_KEYS[0];
+var SKILLS_API_KEY_ENV = SKILLS_API_KEY_ENV_KEYS[0];
+
+class SkillsFleetCredentialError extends Error {
+  code;
+  next;
+  constructor(message, code = "MISSING_API_CREDENTIAL", next) {
+    super(message);
+    this.name = "SkillsFleetCredentialError";
+    this.code = code;
+    if (next)
+      this.next = next;
   }
-  return value;
 }
-function serializeManagedSkillPolicy(value) {
-  const text2 = `${JSON.stringify(value, null, 2)}
-`;
-  parseManagedSkillPolicy(text2);
-  return text2;
+function normalizeSkillsApiOrigin(apiUrl) {
+  const url = new URL(apiUrl);
+  if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))) {
+    throw new SkillsFleetCredentialError("A Skills API URL must use HTTPS (or loopback HTTP), without credentials, query or fragment", "INVALID_API_URL");
+  }
+  const pathname = url.pathname.replace(/\/+$/, "");
+  if (url.origin === "https://api.hasna.com" && pathname === "/skills/v1") {
+    url.pathname = "/skills";
+  } else if (pathname === "/api" || pathname === "/api/v1") {
+    url.pathname = "/";
+  } else if (pathname.endsWith("/api/v1")) {
+    url.pathname = pathname.slice(0, -"/api/v1".length) || "/";
+  } else if (pathname.endsWith("/api")) {
+    url.pathname = pathname.slice(0, -"/api".length) || "/";
+  }
+  return url.toString().replace(/\/+$/, "");
 }
-function readManagedSkillPolicySnapshot(dataDir22 = getDataDirReadOnly()) {
-  const path = join14(dataDir22, "agent-policy.json");
-  let descriptor, observed = false;
-  try {
-    const stat = lstatSync11(path);
-    observed = true;
-    if (!stat.isFile() || stat.isSymbolicLink())
-      throw refusal();
-    if (stat.size > AGENT_POLICY_LIMITS.bytes)
-      throw refusal("exceeds its size limit");
-    descriptor = openSync8(path, constants5.O_RDONLY | (constants5.O_NOFOLLOW ?? 0) | constants5.O_NONBLOCK);
-    const opened = fstatSync8(descriptor);
-    if (!opened.isFile())
-      throw refusal();
-    if (opened.size > AGENT_POLICY_LIMITS.bytes)
-      throw refusal("exceeds its size limit");
-    const bytes = Buffer.allocUnsafe(AGENT_POLICY_LIMITS.bytes + 1);
-    let length = 0;
-    while (length < bytes.length) {
-      const count = readSync4(descriptor, bytes, length, bytes.length - length, null);
-      if (count === 0)
-        break;
-      length += count;
-    }
-    if (length > AGENT_POLICY_LIMITS.bytes)
-      throw refusal("exceeds its size limit");
-    const text2 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes.subarray(0, length));
-    return { text: text2, value: parseManagedSkillPolicy(text2) };
-  } catch (error) {
-    if (error.code === "ENOENT" && !observed) {
-      if (lstatSync11(path, { throwIfNoEntry: false }) === undefined)
-        return null;
+function skillsApiRequestUrl(apiUrl, route) {
+  const origin = normalizeSkillsApiOrigin(apiUrl);
+  if (!route.startsWith("/api/") || route.includes("#") || route.includes("\\")) {
+    throw new SkillsFleetCredentialError("Invalid Skills API route", "INVALID_API_URL");
+  }
+  if (origin === "https://api.hasna.com/skills") {
+    if (route === "/api/auth/whoami")
+      return `${origin}/v1/auth/whoami`;
+    if (!route.startsWith("/api/v1/")) {
+      throw new SkillsFleetCredentialError("The internal Skills gateway has no established login contract yet. Select an explicitly configured instance with supported authentication.", "GATEWAY_AUTH_UNAVAILABLE");
     }
-    if (error instanceof SkillSelectionError)
-      throw error;
-    throw refusal();
-  } finally {
-    if (descriptor !== undefined)
-      closeSync8(descriptor);
+    return `${origin}${route.slice("/api".length)}`;
   }
+  return `${origin}${route}`;
 }
-var CLI_BRIDGE_NAME = "skills-cli";
-var CLI_BRIDGE_VERSION = 1;
-var markdown = `---
-name: skills-cli
-description: Discover, load, author, and run versioned skills through the Skills CLI when a task needs reusable instructions or an executable skill.
----
-
-Use the Skills CLI as the skill authority for this station.
-
-- Discover available skills with \`skills list --json\` or \`skills search <query> --json\`.
-- Read selected instructions with \`skills load <slug>\`. Use \`skills sync\` to refresh the station's shared selection profile.
-- Create local drafts with \`skills new <name> --kind instruction\` or \`--kind executable\` in the Skills-owned source directory. Validate with \`skills validate <name>\`; use \`skills push --help\` for explicit versioned publication.
-- Run a skill only when the user's task calls for execution. Use \`skills run --help\` and select the intended local or cloud target explicitly.
-
-This bridge contains no skill payloads. Do not copy skill content into agent-native skill directories or load other native skill copies. If a Skills command refuses authority, selection, integrity, or native drift, report that refusal and use its repair guidance; do not substitute bundled or stale local content. Explicit local draft authoring remains available.
-`;
-var CLI_BRIDGE_DIGEST = createHash8("sha256").update(markdown).digest("hex");
-var CLI_BRIDGE_FILES = Object.freeze({
-  "SKILL.md": markdown,
-  ".hasna-skills.json": `${JSON.stringify({ managedBy: "@hasna/skills", kind: "cli-bridge", version: CLI_BRIDGE_VERSION, protocol: "selection-v1", contentSha256: CLI_BRIDGE_DIGEST }, null, 2)}
-`
-});
-function isOwnedCliBridge(path, expectedPaths) {
-  if (!expectedPaths.includes(path))
-    return false;
+var MAX_REMOTE_FILE_BYTES = 64 * 1024 * 1024;
+function isCodexLocalStdioMcpServer(name, server) {
+  const identifier2 = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(value);
+  const refuse = () => {
+    throw new Error("Unsupported Codex local stdio MCP controls");
+  };
+  const object4 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v) && !(v instanceof Date));
+  const textField = (v, empty = false) => typeof v === "string" && (empty || Boolean(v.trim())) && Buffer.byteLength(v) <= 16384 && !/[\x00-\x1f\x7f]/.test(v);
+  const envName = (v) => typeof v === "string" && /^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(v);
+  const optional = (v, valid2) => v === undefined || v === null || valid2(v);
+  const stringList = (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => textField(item));
+  const approval = (v) => ["auto", "prompt", "writes", "approve"].includes(v);
+  const duration = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+  const positiveInteger = (v) => Number.isSafeInteger(v) && v > 0;
+  const fields = [
+    "command",
+    "args",
+    "cwd",
+    "env",
+    "env_vars",
+    "enabled",
+    "required",
+    "environment_id",
+    "startup_readiness",
+    "supports_parallel_tool_calls",
+    "tool_input_schema_max_bytes",
+    "startup_timeout_sec",
+    "startup_timeout_ms",
+    "tool_timeout_sec",
+    "default_tools_approval_mode",
+    "enabled_tools",
+    "disabled_tools",
+    "omit_tools_from",
+    "tools",
+    "name"
+  ];
   try {
-    if (!lstatSync12(path).isDirectory())
-      return false;
-    if (JSON.stringify(readdirSync6(path).sort()) !== JSON.stringify(Object.keys(CLI_BRIDGE_FILES).sort()))
-      return false;
-    return Object.entries(CLI_BRIDGE_FILES).every(([name, content]) => {
-      const file = join15(path, name), stat = lstatSync12(file);
-      return stat.isFile() && !stat.isSymbolicLink() && stat.size === Buffer.byteLength(content) && readFileSync10(file, "utf8") === content;
-    });
+    if (!identifier2(name) || !object4(server) || !Object.keys(server).every((key) => fields.includes(key)) || !textField(server.command) || !optional(server.args, (v) => Array.isArray(v) && v.length <= 256 && v.every((arg) => textField(arg, true))) || !optional(server.cwd, textField) || !optional(server.env, (v) => object4(v) && Object.keys(v).length <= 256 && Object.entries(v).every(([key, value]) => envName(key) && textField(value, true))) || !["enabled", "required", "supports_parallel_tool_calls"].every((key) => optional(server[key], (v) => typeof v === "boolean")) || !optional(server.environment_id, (v) => v === "local") || !optional(server.startup_readiness, (v) => ["connection", "catalog"].includes(v)) || !optional(server.tool_input_schema_max_bytes, positiveInteger) || !["startup_timeout_sec", "tool_timeout_sec"].every((key) => optional(server[key], duration)) || !optional(server.startup_timeout_ms, (v) => Number.isSafeInteger(v) && v >= 0) || !optional(server.default_tools_approval_mode, approval) || !["enabled_tools", "disabled_tools"].every((key) => optional(server[key], stringList)) || !optional(server.omit_tools_from, (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => ["code_mode", "deferred", "direct"].includes(item))) || !optional(server.name, textField))
+      refuse();
+    if (server.env_vars !== undefined && server.env_vars !== null) {
+      if (!Array.isArray(server.env_vars) || server.env_vars.length > 256)
+        refuse();
+      const names = server.env_vars.map((entry) => {
+        if (envName(entry))
+          return entry;
+        if (!object4(entry) || !Object.keys(entry).every((key) => ["name", "source"].includes(key)) || !envName(entry.name) || !optional(entry.source, (v) => v === "local"))
+          refuse();
+        return entry.name;
+      });
+      if (new Set(names).size !== names.length)
+        refuse();
+    }
+    if (server.tools !== undefined && server.tools !== null) {
+      if (!object4(server.tools) || Object.keys(server.tools).length > 256)
+        refuse();
+      for (const [tool, config] of Object.entries(server.tools)) {
+        if (!textField(tool) || !object4(config) || !Object.keys(config).every((key) => ["approval_mode", "output_token_limit"].includes(key)) || !optional(config.approval_mode, approval) || !optional(config.output_token_limit, positiveInteger))
+          refuse();
+      }
+    }
+    return true;
   } catch {
     return false;
   }
@@ -12015,36 +12036,36 @@ var sameFile = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode
 function parents(path) {
   const result = [];
   for (let at = dirname9(path);; at = dirname9(at)) {
-    const stat = lstatSync13(at, { bigint: true });
+    const stat = lstatSync11(at, { bigint: true });
     need2(stat.isDirectory() && !stat.isSymbolicLink(), "path traverses a symlink or non-directory");
     result.push([at, stat]);
     if (at === dirname9(at))
       return result;
   }
 }
-function readSettings(path, budget) {
+function readNativeSettingsWitnessFile(path, budget, filename = "settings.json") {
   absolutePath(path);
-  need2(basename4(path) === "settings.json", "requires settings.json");
+  need2(basename4(path) === filename, `requires ${filename}`);
   need2(Number.isSafeInteger(budget.remaining) && budget.remaining >= 0, "has an invalid byte budget");
-  const ancestors = parents(path), initial = lstatSync13(path, { bigint: true });
+  const ancestors = parents(path), initial = lstatSync11(path, { bigint: true });
   need2(initial.isFile() && !initial.isSymbolicLink() && initial.size <= BigInt(CLAUDE_SETTINGS_WITNESS_LIMITS.bytes), "is not a bounded regular file");
   need2(initial.size <= BigInt(budget.remaining), "exceeds its aggregate byte limit");
-  const fd = openSync9(path, constants6.O_RDONLY | constants6.O_NOFOLLOW | constants6.O_NONBLOCK);
+  const fd = openSync6(path, constants5.O_RDONLY | constants5.O_NOFOLLOW | constants5.O_NONBLOCK);
   try {
-    const opened = fstatSync9(fd, { bigint: true });
+    const opened = fstatSync6(fd, { bigint: true });
     need2(opened.isFile() && sameFile(initial, opened), "changed during open");
     const bytes = Buffer.alloc(Number(opened.size) + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync5(fd, bytes, length, bytes.length - length, null);
+      const count = readSync4(fd, bytes, length, bytes.length - length, null);
       if (!count)
         break;
       length += count;
     }
-    const after = fstatSync9(fd, { bigint: true }), current2 = lstatSync13(path, { bigint: true });
+    const after = fstatSync6(fd, { bigint: true }), current2 = lstatSync11(path, { bigint: true });
     need2(current2.isFile() && sameFile(opened, after) && sameFile(after, current2) && BigInt(length) === opened.size, "changed during read");
     for (const [ancestor, before] of ancestors) {
-      const now = lstatSync13(ancestor, { bigint: true });
+      const now = lstatSync11(ancestor, { bigint: true });
       need2(now.isDirectory() && before.dev === now.dev && before.ino === now.ino && before.mode === now.mode, "parent changed during read");
     }
     budget.remaining -= length;
@@ -12054,7 +12075,7 @@ function readSettings(path, budget) {
       throw new Error("Claude settings witness is not strict UTF-8");
     }
   } finally {
-    closeSync9(fd);
+    closeSync6(fd);
   }
 }
 function parse3(text2) {
@@ -12256,7 +12277,7 @@ function settingsDigest(text2, version = 1) {
     }
     return true;
   });
-  return createHash9("sha256").update(`hasna.skills.claude-settings.v${version}\x00`).update(JSON.stringify(canonical2(value))).digest("hex");
+  return createHash8("sha256").update(`hasna.skills.claude-settings.v${version}\x00`).update(JSON.stringify(canonical2(value))).digest("hex");
 }
 function hashClaudeSettingsReplacement(text2, budget) {
   need2(typeof text2 === "string", "requires settings text");
@@ -12266,10 +12287,10 @@ function hashClaudeSettingsReplacement(text2, budget) {
   return settingsDigest(text2);
 }
 function captureClaudeSettings(path, budget = { remaining: 256 * 1024 * 1024 }) {
-  return { path, hashMode: "claude-settings-v1", sha256: settingsDigest(readSettings(path, budget)) };
+  return { path, hashMode: "claude-settings-v1", sha256: settingsDigest(readNativeSettingsWitnessFile(path, budget)) };
 }
 function captureClaudeSettingsV2(path, budget = { remaining: 256 * 1024 * 1024 }) {
-  return { path, hashMode: "claude-settings-v2", sha256: settingsDigest(readSettings(path, budget), 2) };
+  return { path, hashMode: "claude-settings-v2", sha256: settingsDigest(readNativeSettingsWitnessFile(path, budget), 2) };
 }
 function hashClaudeSettingsReplacementV2(text2, budget) {
   need2(typeof text2 === "string", "requires settings text");
@@ -12279,7 +12300,7 @@ function hashClaudeSettingsReplacementV2(text2, budget) {
   return settingsDigest(text2, 2);
 }
 function captureClaudeSettingsV3(path, budget = { remaining: 256 * 1024 * 1024 }) {
-  return { path, hashMode: "claude-settings-v3", sha256: settingsDigest(readSettings(path, budget), 3) };
+  return { path, hashMode: "claude-settings-v3", sha256: settingsDigest(readNativeSettingsWitnessFile(path, budget), 3) };
 }
 function hashClaudeSettingsReplacementV3(text2, budget) {
   need2(typeof text2 === "string", "requires settings text");
@@ -12288,14 +12309,849 @@ function hashClaudeSettingsReplacementV3(text2, budget) {
   budget.remaining -= bytes;
   return settingsDigest(text2, 3);
 }
-var sha = (data) => createHash10("sha256").update(data).digest("hex");
+function upgradeClaudeSettingsWitness(previous, reviewedSettingsPath) {
+  need2(previous && Object.keys(previous).every((key) => ["path", "hashMode", "sha256"].includes(key)) && (previous.hashMode === undefined || previous.hashMode === "bytes" || previous.hashMode === "claude-settings-v1" || previous.hashMode === "claude-settings-v2") && typeof previous.sha256 === "string" && /^[a-f0-9]{64}$/.test(previous.sha256), "requires an exact legacy settings witness");
+  const budget = { remaining: 2 * CLAUDE_SETTINGS_WITNESS_LIMITS.bytes };
+  const before = readNativeSettingsWitnessFile(reviewedSettingsPath, budget), current2 = readNativeSettingsWitnessFile(previous.path, budget);
+  const beforeDigest = previous.hashMode === undefined || previous.hashMode === "bytes" ? createHash8("sha256").update(before).digest("hex") : settingsDigest(before, previous.hashMode === "claude-settings-v1" ? 1 : 2);
+  need2(beforeDigest === previous.sha256, "reviewed preimage does not match the legacy witness");
+  const sha2562 = settingsDigest(current2, 3);
+  need2(settingsDigest(before, 3) === sha2562, "non-preference settings changed; explicit discovery review required");
+  return { path: previous.path, hashMode: "claude-settings-v3", sha256: sha2562 };
+}
+function hashNativeJsonControls(text2, excludedMetadata) {
+  need2(Buffer.byteLength(text2) <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes, "exceeds its byte limit");
+  const value = parse3(text2);
+  value.entries = value.entries.filter(([key, child]) => {
+    if (key !== excludedMetadata)
+      return true;
+    need2(child.kind === "string" && child.value.length <= 128, "has invalid version metadata");
+    return false;
+  });
+  return createHash8("sha256").update("hasna.skills.native-json-controls.v1\x00").update(JSON.stringify(canonical2(value))).digest("hex");
+}
+var MEASURED_CODEX_CAPABILITIES = {
+  "codex-cli 0.153.0": ["hooks"],
+  "codex-cli 0.154.0": ["hooks"],
+  "codex-cli 0.155.0": ["hooks"],
+  "codex-cli 0.155.1": ["hooks"],
+  "codex-cli 0.156.1": ["hooks"],
+  "codex-cli 0.157.0": ["hooks"],
+  "codex-cli 0.157.1": ["hooks"],
+  "codex-cli 0.158.0": ["hooks"],
+  "codex-cli 0.159.0": ["hooks"],
+  "codex-cli 0.159.2": ["hooks", "qualified-skill-catalog"],
+  "codex-cli 0.160.0": ["hooks", "qualified-skill-catalog"]
+};
+function supportsCodexNativeCapability(version, capability) {
+  return typeof version === "string" && Object.hasOwn(MEASURED_CODEX_CAPABILITIES, version) && MEASURED_CODEX_CAPABILITIES[version].includes(capability);
+}
+var SUPPORTED_CODEX_HOOK_VERSIONS = Object.freeze(Object.keys(MEASURED_CODEX_CAPABILITIES).filter((version) => supportsCodexNativeCapability(version, "hooks")));
+function codexPluginSourceIsConfigControlled(plugin) {
+  const remoteRealms = ["openai-curated-remote", "created-by-me-remote", "workspace-directory", "workspace-shared-with-me", "workspace-shared-with-me-private", "workspace-shared-with-me-unlisted"];
+  return Boolean(plugin.sourceType && ["local", "git", "npm"].includes(plugin.sourceType) && plugin.sourceSha256 && /^[a-f0-9]{64}$/.test(plugin.sourceSha256) && !plugin.remotePluginId && !remoteRealms.includes(plugin.id.slice(plugin.id.lastIndexOf("@") + 1)));
+}
+var MAX_SKILLS = 4096;
+var MAX_NAME_BYTES = 1024;
+var MAX_PATH_BYTES = 16384;
+function refuse() {
+  throw new Error("CODEX_NATIVE_SKILL_CATALOG_INVALID");
+}
+var object4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var scalar = (value, max) => typeof value === "string" && value.length > 0 && value.trim() === value && Buffer.byteLength(value, "utf8") <= max && !/[\u0000-\u001f\u007f]/u.test(value);
+var remotePluginIdentifier = (value) => typeof value === "string" && /^[A-Za-z0-9_~-]{1,1024}$/.test(value);
+var absolutePath2 = (value) => scalar(value, MAX_PATH_BYTES) && isAbsolute10(value);
+function canonicalPath(path) {
+  try {
+    return realpathSync4(path);
+  } catch {
+    return normalize2(path);
+  }
+}
+function isCodexNativeSkillDisabled(skill, rules) {
+  if (!scalar(skill.name, MAX_NAME_BYTES) || !absolutePath2(skill.path))
+    refuse();
+  if (rules === undefined)
+    return false;
+  if (!Array.isArray(rules) || rules.length > MAX_SKILLS)
+    refuse();
+  let disabled = false;
+  for (const rule of rules) {
+    if (!object4(rule) || typeof rule.enabled !== "boolean")
+      refuse();
+    const hasName = rule.name !== undefined && rule.name !== null;
+    const hasPath = rule.path !== undefined && rule.path !== null;
+    if (hasName === hasPath)
+      refuse();
+    let matches;
+    if (hasName) {
+      if (typeof rule.name !== "string" || !scalar(rule.name.trim(), MAX_NAME_BYTES))
+        refuse();
+      matches = rule.name.trim() === skill.name;
+    } else {
+      if (!absolutePath2(rule.path))
+        refuse();
+      matches = canonicalPath(rule.path) === canonicalPath(skill.path);
+    }
+    if (matches)
+      disabled = !rule.enabled;
+  }
+  return disabled;
+}
+var identifier2 = (v) => typeof v === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(v);
+var CODEX_DEFAULT_AGENT_PLUGIN_VERSION = "1.0.0";
+function refuse2() {
+  throw new Error("CODEX_NATIVE_SKILL_IDENTITY_UNSUPPORTED: review native plugin names and hook controls");
+}
+function remoteInstallationMatches(parent, remotePluginId, read2) {
+  try {
+    if (!remotePluginIdentifier(remotePluginId) || !lstatSync12(parent).isDirectory() || realpathSync5(parent) !== parent)
+      return false;
+    const path = join14(parent, ".codex-remote-plugin-install.json"), stat = lstatSync12(path, { throwIfNoEntry: false });
+    if (!stat?.isFile() || stat.isSymbolicLink() || stat.size > 16384)
+      return false;
+    const text2 = read2(path);
+    hashNativeJsonControls(text2);
+    const value = JSON.parse(text2);
+    return Boolean(value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 2 && value.schema_version === 1 && value.remote_plugin_id === remotePluginId);
+  } catch {
+    return false;
+  }
+}
+function appControls(path, read2) {
+  const text2 = read2(path);
+  let value, sha2562;
+  try {
+    sha2562 = hashNativeJsonControls(text2);
+    value = JSON.parse(text2);
+  } catch {
+    refuse2();
+  }
+  const object5 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v));
+  if (!object5(value) || Object.keys(value).length !== 1 || !object5(value.apps))
+    refuse2();
+  const apps = Object.entries(value.apps);
+  if (!apps.length || apps.length > 256)
+    refuse2();
+  for (const [name, entry] of apps) {
+    if (!identifier2(name) || !object5(entry) || !Object.keys(entry).every((key) => ["id", "category", "required"].includes(key)) || typeof entry.id !== "string" || !/^[A-Za-z0-9_-]{1,256}$/.test(entry.id) || entry.category !== undefined && (typeof entry.category !== "string" || !entry.category.trim() || entry.category.length > 256 || /[\x00-\x1f\x7f]/.test(entry.category)) || entry.required !== undefined && typeof entry.required !== "boolean")
+      refuse2();
+  }
+  return sha2562;
+}
+function mcpControls(path, read2) {
+  const text2 = read2(path);
+  let value, sha2562;
+  try {
+    sha2562 = hashNativeJsonControls(text2);
+    value = JSON.parse(text2);
+  } catch {
+    refuse2();
+  }
+  const object5 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v));
+  if (!object5(value) || Object.keys(value).length !== 1 || !object5(value.mcpServers))
+    refuse2();
+  const servers = Object.entries(value.mcpServers);
+  if (!servers.length || servers.length > 256)
+    refuse2();
+  for (const [name, server] of servers)
+    if (!isCodexLocalStdioMcpServer(name, server))
+      refuse2();
+  return sha2562;
+}
+function rootControls(root, read2) {
+  const manifestPath = join14(root, ".codex-plugin/plugin.json"), manifestFile = lstatSync12(manifestPath, { throwIfNoEntry: false });
+  if (!lstatSync12(join14(root, ".codex-plugin"), { throwIfNoEntry: false })?.isDirectory() || !manifestFile?.isFile() || manifestFile.size > 1024 * 1024)
+    refuse2();
+  let manifest, manifestSha256;
+  try {
+    const text2 = read2(manifestPath);
+    manifestSha256 = hashNativeJsonControls(text2, "version");
+    manifest = JSON.parse(text2);
+  } catch {
+    refuse2();
+  }
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest) || !identifier2(manifest.name))
+    refuse2();
+  const cacheVersion = basename5(root), declaredVersion = manifest.version === undefined ? "" : typeof manifest.version === "string" ? manifest.version.trim() : null;
+  if (declaredVersion === null || (declaredVersion ? declaredVersion !== cacheVersion : cacheVersion !== CODEX_DEFAULT_AGENT_PLUGIN_VERSION))
+    refuse2();
+  if (manifest.hooks !== undefined || manifest.commands !== undefined || manifest.mcpServers !== undefined && manifest.mcpServers !== "./.mcp.json" || manifest.apps !== undefined && manifest.apps !== "./.app.json" || lstatSync12(join14(root, "hooks"), { throwIfNoEntry: false }))
+    refuse2();
+  const mcp = join14(root, ".mcp.json"), mcpPresent = lstatSync12(mcp, { throwIfNoEntry: false });
+  if (mcpPresent && (!mcpPresent.isFile() || mcpPresent.isSymbolicLink() || mcpPresent.size > 1024 * 1024 || realpathSync5(mcp) !== mcp))
+    refuse2();
+  if (Boolean(mcpPresent) !== (manifest.mcpServers !== undefined))
+    refuse2();
+  const mcpSha256 = mcpPresent ? mcpControls(mcp, read2) : undefined;
+  const app = join14(root, ".app.json"), present = lstatSync12(app, { throwIfNoEntry: false });
+  if (present && (!present.isFile() || present.isSymbolicLink() || present.size > 1024 * 1024))
+    refuse2();
+  if (manifest.apps !== undefined && !present)
+    refuse2();
+  const appSha256 = present ? appControls(app, read2) : undefined;
+  return { namespace: manifest.name, manifestSha256, ...appSha256 ? { appSha256 } : {}, ...mcpSha256 ? { mcpSha256 } : {} };
+}
+function documentIdentity(document2, cache, read2) {
+  if (!document2.startsWith(cache + sep4) || !document2.endsWith(sep4 + "SKILL.md"))
+    refuse2();
+  const text2 = read2(document2);
+  if (Buffer.byteLength(text2) > 1024 * 1024)
+    refuse2();
+  const lines = text2.split(/\r?\n/);
+  if (lines[0]?.trim() !== "---")
+    refuse2();
+  const end = lines.findIndex((line, i) => i > 0 && line.trim() === "---");
+  if (end < 2)
+    refuse2();
+  const yaml = lines.slice(1, end).join(`
+`);
+  if (/(?:^|\s)[&*!]|<<\s*:/.test(yaml) || lines.slice(1, end).filter((line) => /^name\s*:/.test(line)).length !== 1)
+    refuse2();
+  let front;
+  try {
+    front = Bun.YAML.parse(yaml);
+  } catch {
+    refuse2();
+  }
+  if (!front || typeof front !== "object" || !identifier2(front.name) || typeof front.description !== "string" || !front.description.trim())
+    refuse2();
+  for (let root = dirname10(document2), depth = 0;root.startsWith(cache + sep4) && depth < 12; root = dirname10(root), depth++) {
+    const path = join14(root, ".codex-plugin", "plugin.json");
+    if (!lstatSync12(path, { throwIfNoEntry: false }))
+      continue;
+    const manifestFile = lstatSync12(path);
+    if (!lstatSync12(join14(root, ".codex-plugin")).isDirectory() || !manifestFile.isFile() || manifestFile.size > 1024 * 1024)
+      refuse2();
+    let manifest;
+    try {
+      const text3 = read2(path);
+      hashNativeJsonControls(text3);
+      manifest = JSON.parse(text3);
+    } catch {
+      refuse2();
+    }
+    if (!manifest || typeof manifest !== "object" || Array.isArray(manifest) || !identifier2(manifest.name))
+      refuse2();
+    const declaredVersion = manifest.version === undefined ? "" : typeof manifest.version === "string" ? manifest.version.trim() : null;
+    if (declaredVersion === null || (declaredVersion ? declaredVersion !== basename5(root) : basename5(root) !== CODEX_DEFAULT_AGENT_PLUGIN_VERSION))
+      refuse2();
+    return { name: `${manifest.name}:${front.name}`, namespace: manifest.name, pluginParent: dirname10(root), root };
+  }
+  refuse2();
+}
+function identity3(document2, cache, read2) {
+  const parsed = documentIdentity(document2, cache, read2);
+  const controls = rootControls(parsed.root, read2);
+  if (controls.namespace !== parsed.namespace)
+    refuse2();
+  return { name: parsed.name, pluginParent: parsed.pluginParent, ...controls };
+}
+function reviewedCodexPluginCapabilitiesUnchanged(cache, controls, read2) {
+  if (!Array.isArray(controls) || controls.length > 4096)
+    return false;
+  let entries = 0;
+  try {
+    for (const parent of new Set(controls.map((control) => control.pluginParent))) {
+      if (!parent.startsWith(cache + sep4) || !lstatSync12(parent, { throwIfNoEntry: false })?.isDirectory())
+        return false;
+      for (const control of controls.filter((control2) => control2.pluginParent === parent)) {
+        if (control.remotePluginId !== undefined && !remoteInstallationMatches(parent, control.remotePluginId, read2))
+          return false;
+      }
+      const names = readdirSync6(parent);
+      entries += names.length;
+      if (entries > 4096)
+        return false;
+      for (const name of names) {
+        let root = join14(parent, name), stat = lstatSync12(root);
+        if (stat.isSymbolicLink()) {
+          const target = resolve9(parent, readlinkSync3(root));
+          if (name !== "latest" || dirname10(target) !== parent || !lstatSync12(target).isDirectory() || realpathSync5(target) !== target)
+            return false;
+          root = target;
+          stat = lstatSync12(root);
+        }
+        if (!stat.isDirectory() || ![".codex-plugin/plugin.json", ".app.json", "hooks", ".mcp.json"].some((path) => lstatSync12(join14(root, path), { throwIfNoEntry: false })))
+          continue;
+        const parsed = rootControls(root, read2);
+        if (!controls.some((control) => control.pluginParent === parent && control.namespace === parsed.namespace && control.manifestSha256 === parsed.manifestSha256 && control.appSha256 === parsed.appSha256 && control.mcpSha256 === parsed.mcpSha256))
+          return false;
+      }
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function sourceInputUnchanged(input, cache, read2) {
+  try {
+    const parts = relative4(cache, input.pluginParent).split(sep4);
+    if (parts.length !== 2 || parts.some((part) => !identifier2(part)) || parts[1] !== input.namespace || input.pluginId !== `${parts[1]}@${parts[0]}` || !codexPluginSourceIsConfigControlled({ id: input.pluginId, sourceType: "local", sourceSha256: input.sourceSha256 }) || input.sourceSha256 !== hashNativeJsonControls(JSON.stringify({ type: "local", path: input.sourceRoot })) || resolve9(input.sourceRoot) !== input.sourceRoot || !lstatSync12(input.sourceRoot).isDirectory() || realpathSync5(input.sourceRoot) !== input.sourceRoot || input.sourceRoot === cache || input.sourceRoot.startsWith(cache + sep4) || cache.startsWith(input.sourceRoot + sep4))
+      return false;
+    const path = join14(input.sourceRoot, ".codex-plugin/plugin.json"), stat = lstatSync12(path);
+    if (!stat.isFile() || stat.size > 1024 * 1024 || realpathSync5(path) !== path)
+      return false;
+    const text2 = read2(path);
+    hashNativeJsonControls(text2);
+    const manifest = JSON.parse(text2);
+    return Boolean(manifest && typeof manifest === "object" && !Array.isArray(manifest) && manifest.name === input.namespace);
+  } catch {
+    return false;
+  }
+}
+function reviewedCodexPluginSourceRoots(cache, inputs, read2) {
+  if (!Array.isArray(inputs) || inputs.length > 4096 || new Set(inputs.map((input) => input.pluginId)).size !== inputs.length || new Set(inputs.map((input) => input.sourceRoot)).size !== inputs.length || inputs.some((input) => !sourceInputUnchanged(input, cache, read2)))
+    refuse2();
+  const roots = inputs.map((input) => input.sourceRoot);
+  if (roots.some((root) => roots.some((other) => root !== other && root.startsWith(other + sep4))))
+    refuse2();
+  return roots;
+}
+function isReviewedCodexPluginInactive(document2, cache, controls, pluginSettings, rules, read2) {
+  if (!Array.isArray(controls) || controls.length > 4096 || !pluginSettings || typeof pluginSettings !== "object" || Array.isArray(pluginSettings) || !Array.isArray(rules))
+    return false;
+  try {
+    const parsed = documentIdentity(document2, cache, read2), matches = controls.filter((control2) => control2.pluginParent === parsed.pluginParent && control2.namespace === parsed.namespace);
+    if (matches.length !== 1 || !lstatSync12(document2).isFile() || realpathSync5(document2) !== document2 || realpathSync5(parsed.root) !== parsed.root || realpathSync5(parsed.pluginParent) !== parsed.pluginParent || realpathSync5(join14(parsed.root, ".codex-plugin/plugin.json")) !== join14(parsed.root, ".codex-plugin/plugin.json"))
+      return false;
+    const control = matches[0], parts = relative4(cache, parsed.pluginParent).split(sep4);
+    if (parts.length !== 2 || parts.some((part) => !identifier2(part)) || parts[1] !== parsed.namespace || control.pluginId !== `${parts[1]}@${parts[0]}` || !codexPluginSourceIsConfigControlled({ ...control, id: control.pluginId }) || !Object.hasOwn(pluginSettings, control.pluginId) || pluginSettings[control.pluginId]?.enabled !== false)
+      return false;
+    return !rules.some((rule) => (rule?.path === document2 || typeof rule?.name === "string" && rule.name.trim() === parsed.name) && rule?.enabled !== false);
+  } catch {
+    return false;
+  }
+}
+function isReviewedCodexPluginSkillDisabled(document2, cache, controls, rules, read2) {
+  if (!document2.startsWith(cache + sep4) || !Array.isArray(controls) || controls.length > 4096)
+    return false;
+  let parsed;
+  try {
+    parsed = identity3(document2, cache, read2);
+  } catch {
+    return false;
+  }
+  const reviewed = controls.find((item) => item.name === parsed.name && item.namespace === parsed.namespace && item.pluginParent === parsed.pluginParent && item.manifestSha256 === parsed.manifestSha256 && item.appSha256 === parsed.appSha256 && item.mcpSha256 === parsed.mcpSha256);
+  if (!reviewed || reviewed.remotePluginId !== undefined && !remoteInstallationMatches(reviewed.pluginParent, reviewed.remotePluginId, read2))
+    return false;
+  return isCodexNativeSkillDisabled({ name: parsed.name, path: document2, pluginId: reviewed.pluginId, enabled: true }, rules);
+}
+var sha = (text2) => createHash9("sha256").update(text2).digest("hex");
+var EFFORT = new Set(["none", "minimal", "low", "medium", "high", "xhigh"]);
+var VERBOSITY = new Set(["low", "medium", "high"]);
+function need3(value) {
+  if (!value)
+    throw new Error("Invalid Codex settings witness");
+}
+function numericTokens(text2) {
+  const result = [];
+  for (let at = 0;at < text2.length; ) {
+    const char = text2[at];
+    if (char === "#") {
+      while (at < text2.length && text2[at] !== `
+`)
+        at++;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      const quote3 = char, triple = text2.slice(at, at + 3) === quote3.repeat(3);
+      at += triple ? 3 : 1;
+      while (at < text2.length) {
+        if (quote3 === '"' && text2[at] === "\\") {
+          at += 2;
+          continue;
+        }
+        if (text2.slice(at, at + (triple ? 3 : 1)) === quote3.repeat(triple ? 3 : 1)) {
+          at += triple ? 3 : 1;
+          break;
+        }
+        at++;
+      }
+      continue;
+    }
+    if (/[0-9+-]/.test(char)) {
+      const start = at;
+      while (at < text2.length && !/[\s,\]{}#=]/.test(text2[at]))
+        at++;
+      if (at > start) {
+        result.push(text2.slice(start, at));
+        continue;
+      }
+    }
+    at++;
+  }
+  return result;
+}
+function canonical3(value, depth = 0, budget = { remaining: 65536 }) {
+  need3(depth <= 32 && --budget.remaining >= 0);
+  if (value === null)
+    return ["null"];
+  if (typeof value === "string")
+    return ["string", value];
+  if (typeof value === "boolean")
+    return ["boolean", value];
+  if (typeof value === "number") {
+    need3(Number.isFinite(value));
+    return ["number", String(value)];
+  }
+  if (value instanceof Date) {
+    need3(Number.isFinite(value.getTime()));
+    return ["date", value.toISOString()];
+  }
+  if (Array.isArray(value))
+    return ["array", value.map((child) => canonical3(child, depth + 1, budget))];
+  need3(value && typeof value === "object");
+  return ["object", Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, child]) => [key, canonical3(child, depth + 1, budget)])];
+}
+function hashCodexSettingsReplacement(text2, budget = { remaining: 256 * 1024 * 1024 }) {
+  need3(Buffer.byteLength(text2) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text2));
+  budget.remaining -= Buffer.byteLength(text2);
+  let config;
+  try {
+    config = Bun.TOML.parse(text2);
+  } catch {
+    throw new Error("Invalid Codex settings witness");
+  }
+  need3(config && typeof config === "object" && !Array.isArray(config));
+  if (Object.hasOwn(config, "model")) {
+    need3(typeof config.model === "string" && /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/.test(config.model));
+    delete config.model;
+  }
+  for (const [key, values] of [["model_reasoning_effort", EFFORT], ["model_verbosity", VERBOSITY]])
+    if (Object.hasOwn(config, key)) {
+      need3(typeof config[key] === "string" && values.has(config[key]));
+      delete config[key];
+    }
+  return sha(`hasna.skills.codex-settings.v1\x00${JSON.stringify([canonical3(config), numericTokens(text2)])}`);
+}
+function captureCodexSettings(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  const text2 = readNativeSettingsWitnessFile(path, budget, "config.toml");
+  return { path, hashMode: "codex-settings-v1", sha256: hashCodexSettingsReplacement(text2) };
+}
+function record2(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
+}
+function localStdio(name, row) {
+  return name !== "codex_apps" && name !== "_codex_apps" && isCodexLocalStdioMcpServer(name, row);
+}
+function stripEmptyParent(config) {
+  if (record2(config.mcp_servers) && !Object.keys(config.mcp_servers).length)
+    delete config.mcp_servers;
+  return config;
+}
+function projectRegularCodexMcp(config, source) {
+  const unchanged2 = { config, numericSource: source };
+  if (!record2(config.mcp_servers))
+    return unchanged2;
+  const candidates = Object.entries(config.mcp_servers).filter(([name, row]) => localStdio(name, row)).map(([name]) => name);
+  if (!candidates.length)
+    return unchanged2;
+  const headers = [];
+  let attempts = 0;
+  for (const match of source.matchAll(/^[ \t]*\[{1,2}[^\r\n]*\]{1,2}[ \t]*(?:#[^\r\n]*)?(?:\r?\n|$)/gm)) {
+    if (++attempts > 256)
+      return unchanged2;
+    try {
+      Bun.TOML.parse(source.slice(0, match.index));
+    } catch {
+      continue;
+    }
+    let header;
+    try {
+      header = Bun.TOML.parse(match[0]);
+    } catch {
+      return unchanged2;
+    }
+    const path = [];
+    while (record2(header) && Object.keys(header).length === 1) {
+      const key = Object.keys(header)[0];
+      path.push(key);
+      header = header[key];
+    }
+    headers.push({ start: match.index, path });
+  }
+  const names = candidates.filter((name) => headers.filter((header) => header.path.length === 2 && header.path[0] === "mcp_servers" && header.path[1] === name).length === 1);
+  if (!names.length)
+    return unchanged2;
+  const selected = headers.map((header, index) => ({ ...header, end: headers[index + 1]?.start ?? source.length })).filter((header) => header.path[0] === "mcp_servers" && names.includes(header.path[1]));
+  let numericSource = source;
+  for (const range of selected.reverse())
+    numericSource = numericSource.slice(0, range.start) + numericSource.slice(range.end);
+  const expected = structuredClone(config);
+  for (const name of names)
+    delete expected.mcp_servers[name];
+  stripEmptyParent(expected);
+  try {
+    if (!isDeepStrictEqual2(stripEmptyParent(Bun.TOML.parse(numericSource)), expected))
+      return unchanged2;
+  } catch {
+    return unchanged2;
+  }
+  return { config: expected, numericSource };
+}
+var sha2 = (text2) => createHash10("sha256").update(text2).digest("hex");
+var EFFORT2 = new Set(["none", "minimal", "low", "medium", "high", "xhigh"]);
+var VERBOSITY2 = new Set(["low", "medium", "high"]);
+var MODEL = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/;
+var CODEX_DISCOVERY_PROJECTION_FIELDS = ["plugins", "marketplaces", "skills"];
+var INFERENCE = ["model", "model_reasoning_effort", "model_verbosity"];
+function need4(value) {
+  if (!value)
+    throw new Error("Invalid Codex settings witness");
+}
+function isRecord3(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function isDate(value) {
+  return value instanceof Date;
+}
+function numericTokens2(text2) {
+  const result = [];
+  for (let at = 0;at < text2.length; ) {
+    const char = text2[at];
+    if (char === "#") {
+      while (at < text2.length && text2[at] !== `
+`)
+        at++;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      const quote3 = char, triple = text2.slice(at, at + 3) === quote3.repeat(3);
+      at += triple ? 3 : 1;
+      while (at < text2.length) {
+        if (quote3 === '"' && text2[at] === "\\") {
+          at += 2;
+          continue;
+        }
+        if (text2.slice(at, at + (triple ? 3 : 1)) === quote3.repeat(triple ? 3 : 1)) {
+          at += triple ? 3 : 1;
+          break;
+        }
+        at++;
+      }
+      continue;
+    }
+    if (/[0-9+-]/.test(char)) {
+      const start = at;
+      while (at < text2.length && !/[\s,\]{}#=]/.test(text2[at]))
+        at++;
+      if (at > start) {
+        result.push(text2.slice(start, at));
+        continue;
+      }
+    }
+    at++;
+  }
+  return result.sort();
+}
+function canonical4(value, depth = 0, budget = { remaining: 65536 }) {
+  need4(depth <= 32 && --budget.remaining >= 0);
+  if (value === null)
+    return ["null"];
+  if (typeof value === "string")
+    return ["string", value];
+  if (typeof value === "boolean")
+    return ["boolean", value];
+  if (typeof value === "number") {
+    need4(Number.isFinite(value));
+    return ["number", String(value)];
+  }
+  if (isDate(value)) {
+    need4(Number.isFinite(value.getTime()));
+    return ["date", value.toISOString()];
+  }
+  if (Array.isArray(value))
+    return ["array", value.map((child) => canonical4(child, depth + 1, budget))];
+  need4(isRecord3(value));
+  return ["object", Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, child]) => [key, canonical4(child, depth + 1, budget)])];
+}
+function normalize3(config, version = 2) {
+  if (isRecord3(config.hooks)) {
+    delete config.hooks.state;
+    if (!Object.keys(config.hooks).length)
+      delete config.hooks;
+  }
+  if (isRecord3(config.skills) && Array.isArray(config.skills.config)) {
+    const skills = config.skills;
+    const retained = skills.config.filter((entry) => !disablesOneSkill(entry));
+    if (retained.length !== skills.config.length) {
+      if (retained.length)
+        skills.config = retained;
+      else
+        delete skills.config;
+    }
+    if (!Object.keys(skills).length)
+      delete config.skills;
+  }
+  inference(config, version);
+  if (isRecord3(config.profiles)) {
+    for (const profile of Object.values(config.profiles))
+      if (isRecord3(profile))
+        inference(profile, version);
+  }
+}
+function disablesOneSkill(entry) {
+  if (!isRecord3(entry) || entry.enabled !== false)
+    return false;
+  const keys = Object.keys(entry);
+  if (!keys.every((key) => key === "path" || key === "name" || key === "enabled"))
+    return false;
+  const selector = ["path", "name"].filter((key) => Object.hasOwn(entry, key));
+  return selector.length === 1 && typeof entry[selector[0]] === "string" && entry[selector[0]].length > 0;
+}
+function inference(target, version) {
+  const keys = version === 3 ? [...INFERENCE, "service_tier", "plan_mode_reasoning_effort", "personality"] : INFERENCE;
+  for (const key of keys)
+    if (Object.hasOwn(target, key)) {
+      const value = target[key];
+      if (key === "model")
+        need4(typeof value === "string" && MODEL.test(value));
+      else if (key === "personality")
+        need4(typeof value === "string" && ["none", "friendly", "pragmatic"].includes(value));
+      else if (version === 3 && key !== "model_verbosity") {
+        need4(typeof value === "string" && value.length <= 128 && !/[\x00-\x1f\x7f]/.test(value));
+        if (key !== "service_tier")
+          need4(value.length > 0);
+      } else
+        need4(typeof value === "string" && (key === "model_reasoning_effort" ? EFFORT2.has(value) : VERBOSITY2.has(value)));
+      delete target[key];
+    }
+}
+function settingsDigest2(text2, version = 2) {
+  let config;
+  try {
+    config = Bun.TOML.parse(text2);
+  } catch {
+    throw new Error("Invalid Codex settings witness");
+  }
+  need4(isRecord3(config));
+  const projected = version === 3 ? projectRegularCodexMcp(config, text2) : { config, numericSource: text2 };
+  normalize3(projected.config, version);
+  return sha2(`hasna.skills.codex-settings.v${version}\x00${JSON.stringify([canonical4(projected.config), numericTokens2(projected.numericSource)])}`);
+}
+function hashCodexSettingsReplacementV2(text2, budget = { remaining: 256 * 1024 * 1024 }) {
+  need4(Buffer.byteLength(text2) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text2));
+  budget.remaining -= Buffer.byteLength(text2);
+  return settingsDigest2(text2);
+}
+function captureCodexSettingsV2(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  const text2 = readNativeSettingsWitnessFile(path, budget, "config.toml");
+  return { path, hashMode: "codex-settings-v2", sha256: settingsDigest2(text2) };
+}
+function readCodexSettingsPreimage(path, budget = { remaining: 2 * 1024 * 1024 }) {
+  return readNativeSettingsWitnessFile(path, budget, "config.toml");
+}
+function upgradeCodexSettingsWitness(previous, reviewedSettingsPath) {
+  need4(previous && Object.keys(previous).every((key) => ["path", "hashMode", "sha256"].includes(key)) && (previous.hashMode === undefined || previous.hashMode === "bytes" || previous.hashMode === "codex-settings-v1") && /^[a-f0-9]{64}$/.test(previous.sha256));
+  const budget = { remaining: 2 * 1024 * 1024 };
+  const before = readNativeSettingsWitnessFile(reviewedSettingsPath, budget, "config.toml"), current2 = readNativeSettingsWitnessFile(previous.path, budget, "config.toml");
+  need4((previous.hashMode === "codex-settings-v1" ? hashCodexSettingsReplacement(before) : sha2(before)) === previous.sha256);
+  const sha2562 = settingsDigest2(current2);
+  if (settingsDigest2(before) !== sha2562)
+    throw new Error("Codex non-preference settings changed; explicit discovery review required");
+  return { path: previous.path, hashMode: "codex-settings-v2", sha256: sha2562 };
+}
+function hashCodexSettingsReplacementV3(text2, budget = { remaining: 256 * 1024 * 1024 }) {
+  need4(Buffer.byteLength(text2) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text2));
+  budget.remaining -= Buffer.byteLength(text2);
+  return settingsDigest2(text2, 3);
+}
+function captureCodexSettingsV3(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "codex-settings-v3", sha256: settingsDigest2(readNativeSettingsWitnessFile(path, budget, "config.toml"), 3) };
+}
+function upgradeCodexSettingsWitnessV3(previous, reviewedSettingsPath) {
+  need4(previous && Object.keys(previous).every((key) => ["path", "hashMode", "sha256"].includes(key)) && (previous.hashMode === undefined || ["bytes", "codex-settings-v1", "codex-settings-v2"].includes(previous.hashMode)) && /^[a-f0-9]{64}$/.test(previous.sha256));
+  const budget = { remaining: 2 * 1024 * 1024 };
+  const before = readNativeSettingsWitnessFile(reviewedSettingsPath, budget, "config.toml"), current2 = readNativeSettingsWitnessFile(previous.path, budget, "config.toml");
+  const original = previous.hashMode === "codex-settings-v2" ? settingsDigest2(before) : previous.hashMode === "codex-settings-v1" ? hashCodexSettingsReplacement(before) : sha2(before);
+  need4(original === previous.sha256);
+  const sha2562 = settingsDigest2(current2, 3);
+  if (settingsDigest2(before, 3) !== sha2562)
+    throw new Error("Codex settings outside the reviewed V3 contract changed; explicit discovery review required");
+  return { path: previous.path, hashMode: "codex-settings-v3", sha256: sha2562 };
+}
+function refusal(reason = "is unreadable") {
+  return new SkillSelectionError("INVALID_AGENT_POLICY", `The Skills agent loading policy ${reason}; refusing legacy fallback.`);
+}
+function parseManagedSkillPolicy(text2) {
+  if (Buffer.byteLength(text2) > AGENT_POLICY_LIMITS.bytes)
+    throw refusal("exceeds its size limit");
+  let value;
+  try {
+    value = JSON.parse(text2);
+  } catch {
+    throw refusal();
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value) || value.loading !== "cli" || value.version !== undefined && value.version !== 1)
+    throw refusal();
+  if (value.profileId !== undefined && (typeof value.profileId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(value.profileId) || value.profileId.includes("..")))
+    throw refusal();
+  try {
+    assertAgentPolicyCollections(value);
+  } catch {
+    throw refusal("has invalid collection bounds");
+  }
+  return value;
+}
+function serializeManagedSkillPolicy(value) {
+  const text2 = `${JSON.stringify(value, null, 2)}
+`;
+  parseManagedSkillPolicy(text2);
+  return text2;
+}
+function readManagedSkillPolicySnapshot(dataDir22 = getDataDirReadOnly()) {
+  const path = join15(dataDir22, "agent-policy.json");
+  let descriptor, observed = false;
+  try {
+    const stat = lstatSync13(path);
+    observed = true;
+    if (!stat.isFile() || stat.isSymbolicLink())
+      throw refusal();
+    if (stat.size > AGENT_POLICY_LIMITS.bytes)
+      throw refusal("exceeds its size limit");
+    descriptor = openSync7(path, constants6.O_RDONLY | (constants6.O_NOFOLLOW ?? 0) | constants6.O_NONBLOCK);
+    const opened = fstatSync7(descriptor);
+    if (!opened.isFile())
+      throw refusal();
+    if (opened.size > AGENT_POLICY_LIMITS.bytes)
+      throw refusal("exceeds its size limit");
+    const bytes = Buffer.allocUnsafe(AGENT_POLICY_LIMITS.bytes + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const count = readSync5(descriptor, bytes, length, bytes.length - length, null);
+      if (count === 0)
+        break;
+      length += count;
+    }
+    if (length > AGENT_POLICY_LIMITS.bytes)
+      throw refusal("exceeds its size limit");
+    const text2 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes.subarray(0, length));
+    return { text: text2, value: parseManagedSkillPolicy(text2) };
+  } catch (error) {
+    if (error.code === "ENOENT" && !observed) {
+      if (lstatSync13(path, { throwIfNoEntry: false }) === undefined)
+        return null;
+    }
+    if (error instanceof SkillSelectionError)
+      throw error;
+    throw refusal();
+  } finally {
+    if (descriptor !== undefined)
+      closeSync7(descriptor);
+  }
+}
+var CLI_BRIDGE_NAME = "skills-cli";
+var CLI_BRIDGE_VERSION = 1;
+var markdown = `---
+name: skills-cli
+description: Discover, load, author, and run versioned skills through the Skills CLI when a task needs reusable instructions or an executable skill.
+---
+
+Use the Skills CLI as the skill authority for this station.
+
+- Discover available skills with \`skills list --json\` or \`skills search <query> --json\`.
+- Read selected instructions with \`skills load <slug>\`. Use \`skills sync\` to refresh the station's shared selection profile.
+- Create local drafts with \`skills new <name> --kind instruction\` or \`--kind executable\` in the Skills-owned source directory. Validate with \`skills validate <name>\`; use \`skills push --help\` for explicit versioned publication.
+- Run a skill only when the user's task calls for execution. Use \`skills run --help\` and select the intended local or cloud target explicitly.
+
+This bridge contains no skill payloads. Do not copy skill content into agent-native skill directories or load other native skill copies. If a Skills command refuses authority, selection, integrity, or native drift, report that refusal and use its repair guidance; do not substitute bundled or stale local content. Explicit local draft authoring remains available.
+`;
+var CLI_BRIDGE_DIGEST = createHash11("sha256").update(markdown).digest("hex");
+var CLI_BRIDGE_FILES = Object.freeze({
+  "SKILL.md": markdown,
+  ".hasna-skills.json": `${JSON.stringify({ managedBy: "@hasna/skills", kind: "cli-bridge", version: CLI_BRIDGE_VERSION, protocol: "selection-v1", contentSha256: CLI_BRIDGE_DIGEST }, null, 2)}
+`
+});
+function isOwnedCliBridge(path, expectedPaths) {
+  if (!expectedPaths.includes(path))
+    return false;
+  try {
+    if (!lstatSync14(path).isDirectory())
+      return false;
+    if (JSON.stringify(readdirSync7(path).sort()) !== JSON.stringify(Object.keys(CLI_BRIDGE_FILES).sort()))
+      return false;
+    return Object.entries(CLI_BRIDGE_FILES).every(([name, content]) => {
+      const file = join16(path, name), stat = lstatSync14(file);
+      return stat.isFile() && !stat.isSymbolicLink() && stat.size === Buffer.byteLength(content) && readFileSync11(file, "utf8") === content;
+    });
+  } catch {
+    return false;
+  }
+}
+var sha3 = (data) => createHash12("sha256").update(data).digest("hex");
 var ROOTS = NATIVE_SKILL_ROOTS;
+function hasNoDarwinAcl(fd) {
+  try {
+    const { dlopen, read: read2 } = __require("bun:ffi");
+    const library = dlopen("/usr/lib/libSystem.B.dylib", {
+      acl_get_fd: { args: ["i32"], returns: "ptr" },
+      acl_free: { args: ["ptr"], returns: "i32" },
+      __error: { args: [], returns: "ptr" }
+    });
+    try {
+      const errno = library.symbols.__error();
+      if (!errno)
+        return false;
+      const acl = library.symbols.acl_get_fd(fd);
+      if (acl) {
+        library.symbols.acl_free(acl);
+        return false;
+      }
+      return (acl === null || acl === 0) && read2.i32(errno) === 2;
+    } finally {
+      library.close();
+    }
+  } catch {
+    return false;
+  }
+}
+function isSystemRootAlias(path) {
+  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(path))
+    return false;
+  const target = `/private${path}`, link = `private${path}`;
+  const identity4 = (stat) => `${stat.dev}:${stat.ino}:${stat.ctimeNs}:${stat.uid}:${stat.mode}`;
+  try {
+    const before = lstatSync15(path, { bigint: true });
+    if (!before.isSymbolicLink() || before.uid !== 0n || readlinkSync4(path) !== link)
+      return false;
+    const directories = ["/", "/private", target].map((directory) => {
+      const stat = lstatSync15(directory, { bigint: true });
+      if (!stat.isDirectory() || stat.uid !== 0n)
+        throw new Error("Untrusted system alias directory");
+      if (directory !== "/private/tmp") {
+        if ((stat.mode & 0o022n) !== 0n)
+          throw new Error("Writable system alias directory");
+      } else if ((stat.mode & 0o1000n) === 0n)
+        throw new Error("Unprotected system temporary directory");
+      const fd = openSync8(directory, constants7.O_RDONLY | constants7.O_DIRECTORY | constants7.O_NOFOLLOW);
+      try {
+        if (identity4(fstatSync8(fd, { bigint: true })) !== identity4(stat) || !hasNoDarwinAcl(fd) || identity4(fstatSync8(fd, { bigint: true })) !== identity4(stat))
+          throw new Error("Unverified system alias directory ACL");
+      } finally {
+        closeSync8(fd);
+      }
+      return { directory, identity: identity4(stat) };
+    });
+    return realpathSync6(path) === target && readlinkSync4(path) === link && identity4(lstatSync15(path, { bigint: true })) === identity4(before) && directories.every((item) => identity4(lstatSync15(item.directory, { bigint: true })) === item.identity);
+  } catch {
+    return false;
+  }
+}
+function canonicalSystemPath(path) {
+  const absolute = resolve10(path), root = `/${absolute.split(sep5)[1]}`;
+  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(root) || !lstatSync15(root, { throwIfNoEntry: false })?.isSymbolicLink())
+    return absolute;
+  if (!isSystemRootAlias(root))
+    throw new Error(`Refusing symlink path: ${root}`);
+  return `/private${absolute}`;
+}
 function assertSafePath(path) {
-  let cursor = resolve9(path);
+  let cursor = resolve10(path);
   while (true) {
-    if (lstatSync14(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync15(cursor, { throwIfNoEntry: false })?.isSymbolicLink() && !isSystemRootAlias(cursor))
       throw new Error(`Refusing symlink path: ${cursor}`);
-    const parent = dirname10(cursor);
+    const parent = dirname11(cursor);
     if (parent === cursor)
       return;
     cursor = parent;
@@ -12303,17 +13159,17 @@ function assertSafePath(path) {
 }
 function readRootAlias(home, agent) {
   assertSafePath(home);
-  const realHome = realpathSync32(home), alias = join16(realHome, `.${agent}`);
-  const stat = lstatSync14(alias, { throwIfNoEntry: false, bigint: true });
+  const realHome = realpathSync6(home), alias = join17(realHome, `.${agent}`);
+  const stat = lstatSync15(alias, { throwIfNoEntry: false, bigint: true });
   if (!stat?.isSymbolicLink())
     throw new Error(`Agent root alias changed after planning: ${alias}`);
-  const link = readlinkSync2(alias), targetPath = resolve9(dirname10(alias), link);
+  const link = readlinkSync4(alias), targetPath = resolve10(dirname11(alias), link);
   assertSafePath(targetPath);
-  const targetStat = lstatSync14(targetPath, { throwIfNoEntry: false });
+  const targetStat = lstatSync15(targetPath, { throwIfNoEntry: false });
   if (!targetStat?.isDirectory())
     throw new Error(`Agent root alias must target an existing directory: ${alias}`);
-  const target = realpathSync32(targetPath), inside = relative4(realHome, target);
-  if (!inside || inside === ".." || inside.startsWith(`..${sep4}`) || isAbsolute9(inside))
+  const target = realpathSync6(targetPath), inside = relative5(realHome, target);
+  if (!inside || inside === ".." || inside.startsWith(`..${sep5}`) || isAbsolute11(inside))
     throw new Error(`Agent root alias target must be inside the real home: ${alias}`);
   return { agent, home: realHome, alias, target, link, aliasIdentity: `${stat.dev}:${stat.ino}:${stat.ctimeNs}`, targetIdentity: `${targetStat.dev}:${targetStat.ino}` };
 }
@@ -12322,19 +13178,46 @@ function rootAliases(home, allowed = false) {
     return [];
   const result = [];
   for (const agent of ["claude", "codex"])
-    if (lstatSync14(join16(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync15(join17(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
       result.push(readRootAlias(home, agent));
-  if (result.some((item, index) => result.slice(index + 1).some((other) => item.target === other.target || item.target.startsWith(other.target + sep4) || other.target.startsWith(item.target + sep4))))
+  if (result.some((item, index) => result.slice(index + 1).some((other) => item.target === other.target || item.target.startsWith(other.target + sep5) || other.target.startsWith(item.target + sep5))))
     throw new Error("Agent root alias targets must not overlap");
   return result;
 }
 function canonicalAgentPath(path, aliases) {
-  const absolute = resolve9(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep4));
-  return binding ? join16(binding.target, relative4(binding.alias, absolute)) : absolute;
+  const absolute = canonicalSystemPath(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep5));
+  return binding ? join17(binding.target, relative5(binding.alias, absolute)) : absolute;
+}
+function disabledCodexSkillPaths(config, aliases) {
+  const skills = config.skills;
+  if (!skills || typeof skills !== "object" || Array.isArray(skills))
+    return [];
+  const rows = skills.config;
+  if (!Array.isArray(rows))
+    return [];
+  if (rows.some((entry) => !entry || typeof entry !== "object" || Array.isArray(entry) || typeof entry.enabled !== "boolean" || entry.path !== undefined === (entry.name !== undefined) || entry.path !== undefined && (typeof entry.path !== "string" || !isAbsolute11(entry.path)) || entry.name !== undefined && (typeof entry.name !== "string" || !entry.name.trim())))
+    return [];
+  if (rows.some((entry) => entry.name !== undefined && entry.enabled !== false))
+    return [];
+  const settings = new Map;
+  for (const entry of rows) {
+    if (typeof entry.path !== "string" || !isAbsolute11(entry.path))
+      continue;
+    let document2;
+    try {
+      document2 = realpathSync6(canonicalAgentPath(entry.path, aliases));
+    } catch {
+      continue;
+    }
+    if (!document2.endsWith(`${sep5}SKILL.md`))
+      continue;
+    settings.set(document2, [...settings.get(document2) ?? [], entry.enabled === false]);
+  }
+  return [...settings].filter(([, values]) => values.length === 1 && values[0] === true).map(([document2]) => dirname11(document2));
 }
 function recheckRootAliases(aliases) {
   for (const binding of aliases) {
-    if (!["claude", "codex"].includes(binding.agent) || binding.alias !== join16(binding.home, `.${binding.agent}`))
+    if (!["claude", "codex"].includes(binding.agent) || binding.alias !== join17(binding.home, `.${binding.agent}`))
       throw new Error("Invalid agent root alias binding");
     const current2 = readRootAlias(binding.home, binding.agent);
     if (JSON.stringify(current2) !== JSON.stringify(binding))
@@ -12343,12 +13226,12 @@ function recheckRootAliases(aliases) {
 }
 function readNativeBytes(path, maximum = 64 * 1024 * 1024) {
   assertSafePath(path);
-  const before = lstatSync14(path);
+  const before = lstatSync15(path);
   if (!before.isFile() || before.size > maximum)
     throw new Error("Unsupported or oversized native skill file");
-  const descriptor = openSync10(path, constants7.O_RDONLY | constants7.O_NOFOLLOW | constants7.O_NONBLOCK);
+  const descriptor = openSync8(path, constants7.O_RDONLY | constants7.O_NOFOLLOW | constants7.O_NONBLOCK);
   try {
-    const opened = fstatSync10(descriptor);
+    const opened = fstatSync8(descriptor);
     if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino || opened.size !== before.size)
       throw new Error("Native skill file changed while reading");
     const bytes = Buffer.allocUnsafe(before.size + 1);
@@ -12359,26 +13242,26 @@ function readNativeBytes(path, maximum = 64 * 1024 * 1024) {
         break;
       length += count;
     }
-    const after = fstatSync10(descriptor);
-    if (length !== before.size || after.size !== before.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs)
+    const after = fstatSync8(descriptor), current2 = lstatSync15(path);
+    if (current2.dev !== opened.dev || current2.ino !== opened.ino || current2.size !== after.size || current2.mtimeMs !== after.mtimeMs || current2.ctimeMs !== after.ctimeMs || length !== before.size || after.size !== before.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs)
       throw new Error("Native skill file changed while reading");
     return bytes.subarray(0, length);
   } finally {
-    closeSync10(descriptor);
+    closeSync8(descriptor);
   }
 }
 function treeHash(root) {
-  const hash2 = createHash10("sha256");
+  const hash2 = createHash12("sha256");
   let bytes = 0, files = 0;
   function visit2(path) {
-    const stat = lstatSync14(path);
+    const stat = lstatSync15(path);
     if (stat.isSymbolicLink())
       throw new Error(`Refusing symlink in skill: ${path}`);
-    const rel = relative4(root, path);
+    const rel = relative5(root, path);
     if (stat.isDirectory()) {
       hash2.update(`d\x00${rel}\x00`);
-      for (const name of readdirSync7(path).sort())
-        visit2(join16(path, name));
+      for (const name of readdirSync8(path).sort())
+        visit2(join17(path, name));
       return;
     }
     if (!stat.isFile())
@@ -12397,11 +13280,11 @@ function treeHash(root) {
 function projectAncestorDirectories(projects) {
   const directories = new Set;
   for (const project of projects) {
-    for (let path = resolve9(project), depth = 0;; depth++) {
+    for (let path = canonicalSystemPath(project), depth = 0;; depth++) {
       if (depth >= 100)
         throw new Error("NATIVE_SKILL_DRIFT: project ancestor discovery limit exceeded");
       directories.add(path);
-      const parent = dirname10(path);
+      const parent = dirname11(path);
       if (parent === path)
         break;
       path = parent;
@@ -12410,16 +13293,26 @@ function projectAncestorDirectories(projects) {
   return [...directories];
 }
 function inventoryNativeSkills(home = homedir22(), options = {}) {
+  home = canonicalSystemPath(home);
+  if (options.reviewedCacheAlias !== undefined && (!options.includeVendor || !isAbsolute11(options.reviewedCacheAlias) || resolve10(options.reviewedCacheAlias) !== options.reviewedCacheAlias))
+    throw new Error("A reviewed cache alias requires vendor inventory and an exact absolute path");
+  if (options.disabledVendorPaths?.some((path) => !isAbsolute11(path) || resolve10(path) !== path))
+    throw new Error("Disabled vendor paths must be exact absolute paths");
+  const reviewedCacheAlias = options.reviewedCacheAlias === undefined ? undefined : canonicalSystemPath(options.reviewedCacheAlias);
+  const disabledVendorPaths = new Set((options.disabledVendorPaths ?? []).map(canonicalSystemPath));
   const aliases = rootAliases(home, options.allowRootAliases);
   const selectedAgents = options.agents ? new Set(options.agents) : undefined;
   const includesAgent = (agent) => !selectedAgents || selectedAgents.has(agent);
   const rootDefinitions = selectedAgents ? ROOTS.filter(([agent, path]) => selectedAgents.has(agent) || selectedAgents.has("hermes") && agent === "codex" && path === ".agents/skills") : ROOTS;
-  const roots = rootDefinitions.map(([agent, path]) => [agent, canonicalAgentPath(join16(home, path), aliases)]);
-  const bridgePaths = Object.values(AGENT_ADAPTERS).map((adapter) => canonicalAgentPath(join16(home, adapter.root, CLI_BRIDGE_NAME), aliases));
+  const roots = rootDefinitions.map(([agent, path]) => [agent, canonicalAgentPath(join17(home, path), aliases)]);
+  const bridgePaths = Object.values(AGENT_ADAPTERS).map((adapter) => canonicalAgentPath(join17(home, adapter.root, CLI_BRIDGE_NAME), aliases));
   for (const project of projectAncestorDirectories([...options.projectDirs ?? [], ...options.projectDir ? [options.projectDir] : []])) {
     for (const [agent, path] of rootDefinitions)
-      roots.push([agent, canonicalAgentPath(join16(project, path), aliases)]);
+      roots.push([agent, canonicalAgentPath(join17(project, path), aliases)]);
   }
+  const installationInputs = options.codexInstallationInputRoots ?? [];
+  if (installationInputs.some((input) => resolve10(input) !== input || realpathSync6(input) !== input || roots.some(([agent, path]) => agent === "codex" && (path === input || path.startsWith(input + sep5) || input.startsWith(path + sep5)))))
+    throw new Error("Native installation input overlaps an unconditional skill-loading root");
   const entries = [], seen = new Set;
   const cacheScans = new Map, maxAliasProofEntries = 1e4;
   let discoveryEntries = 0, discoveryPathBytes = 0;
@@ -12430,42 +13323,59 @@ function inventoryNativeSkills(home = homedir22(), options = {}) {
     if (discoveryPathBytes > 4 * 1024 * 1024)
       throw new Error("Native skill discovery metadata limit exceeded");
   }
-  function emptySiblingCacheAlias(path, parent) {
-    const link = readlinkSync2(path), target = resolve9(parent, link);
-    if (dirname10(target) !== parent || (isAbsolute9(link) ? link !== target : dirname10(link) !== "."))
+  let reviewedCacheAliasFound = false;
+  function verifiedSiblingCacheAlias(agent, path, parent) {
+    const link = readlinkSync4(path), lexicalTarget = resolve10(parent, link);
+    if (isAbsolute11(link) ? link !== lexicalTarget : dirname11(link) !== ".")
       return false;
-    if (!lstatSync14(target, { throwIfNoEntry: false })?.isDirectory())
+    const target = canonicalSystemPath(lexicalTarget);
+    if (dirname11(target) !== parent)
+      return false;
+    if (!lstatSync15(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
     const scan = cacheScans.get(target);
-    return Boolean(scan?.complete && !scan.hasSkills && scan.entries <= maxAliasProofEntries);
+    if (!scan?.complete || scan.entries > maxAliasProofEntries)
+      return false;
+    if (scan.hasSkills) {
+      const targetSkills = entries.filter((entry) => entry.agent === agent && entry.vendor && (entry.path === target || entry.path.startsWith(target + sep5)));
+      if (path === reviewedCacheAlias && targetSkills.length > 0)
+        reviewedCacheAliasFound = true;
+      if (agent === "codex" && targetSkills.length > 0 && targetSkills.every((entry) => disabledVendorPaths.has(entry.path) || options.disabledVendorSkill?.(entry) === true))
+        return true;
+      if (path !== reviewedCacheAlias)
+        return false;
+    }
+    return true;
   }
-  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false, admitted = false) {
+  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false, admitted = false, configuredRoot = false) {
     if (!admitted)
       admit(path);
     const scan = { complete: true, hasSkills: false, entries: 1 };
     assertSafePath(path);
+    if (configuredRoot && agent === "codex" && installationInputs.some((root) => path === root || path.startsWith(`${root}${sep5}`)))
+      return scan;
     if (!existsSync82(path))
       return scan;
-    const stat = lstatSync14(path);
+    const stat = lstatSync15(path);
     if (stat.isFile())
       return scan;
     if (!stat.isDirectory())
       throw new Error(`Unsupported native discovery entry: ${path}`);
-    if (existsSync82(join16(path, "SKILL.md"))) {
+    if (existsSync82(join17(path, "SKILL.md"))) {
       scan.hasSkills = true;
       if (seen.has(path))
         return scan;
       seen.add(path);
       let managed = false;
-      const marker = join16(path, ".hasna-skills.json");
+      const marker = join17(path, ".hasna-skills.json");
       if (existsSync82(marker)) {
         try {
-          managed = JSON.parse(readFileSync11(marker, "utf8")).managedBy === "@hasna/skills";
+          managed = JSON.parse(readFileSync12(marker, "utf8")).managedBy === "@hasna/skills";
         } catch {}
       }
       const bridge = !vendor && isOwnedCliBridge(path, bridgePaths);
-      const rootAlias = aliases.find((item) => path === item.target || path.startsWith(item.target + sep4));
-      entries.push({ agent, path, hash: treeHash(path), managed, vendor, ...agent === "codex" && path.startsWith(canonicalAgentPath(join16(home, ".codex", "skills", ".system"), aliases) + sep4) ? { system: true } : {}, ...bridge ? { bridge: true, bridgeHome: resolve9(home) } : {}, ...rootAlias ? { rootAlias } : {} });
+      const rootAlias = aliases.find((item) => path === item.target || path.startsWith(item.target + sep5));
+      entries.push({ agent, path, hash: treeHash(path), managed, vendor, ...agent === "codex" && path.startsWith(canonicalAgentPath(join17(home, ".codex", "skills", ".system"), aliases) + sep5) ? { system: true } : {}, ...bridge ? { bridge: true, bridgeHome: resolve10(home) } : {}, ...rootAlias ? { rootAlias } : {} });
       return scan;
     }
     if (depth > (vendor ? 32 : 3))
@@ -12474,7 +13384,7 @@ function inventoryNativeSkills(home = homedir22(), options = {}) {
     try {
       let child;
       while ((child = directory.readSync()) !== null) {
-        admit(join16(path, child.name));
+        admit(join17(path, child.name));
         children.push(child);
       }
     } finally {
@@ -12486,20 +13396,20 @@ function inventoryNativeSkills(home = homedir22(), options = {}) {
     for (const { name } of children) {
       if (name === "node_modules")
         continue;
-      if (name.startsWith(".") && name !== ".system" && agent !== "hermes" && !(options.guardHermes && `${path}${sep4}`.includes(`${sep4}.agents${sep4}skills${sep4}`)))
+      if (name.startsWith(".") && name !== ".system" && agent !== "hermes" && !(options.guardHermes && `${path}${sep5}`.includes(`${sep5}.agents${sep5}skills${sep5}`)))
         continue;
       const isVendor = vendor || name === ".system";
       if (isVendor && !options.includeVendor)
         continue;
-      const child = join16(path, name);
-      if (isVendor && lstatSync14(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
-        const target = statSync7(child, { throwIfNoEntry: false });
-        if (target?.isFile() || pluginCache && target?.isDirectory() && emptySiblingCacheAlias(child, path)) {
+      const child = join17(path, name);
+      if (isVendor && lstatSync15(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
+        const target = statSync8(child, { throwIfNoEntry: false });
+        if (target?.isFile() || pluginCache && target?.isDirectory() && verifiedSiblingCacheAlias(agent, child, path)) {
           scan.entries++;
           continue;
         }
       }
-      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache, true);
+      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache, true, configuredRoot);
       scan.complete &&= childScan.complete;
       scan.hasSkills ||= childScan.hasSkills;
       scan.entries += childScan.entries;
@@ -12508,32 +13418,34 @@ function inventoryNativeSkills(home = homedir22(), options = {}) {
       cacheScans.set(path, scan);
     return scan;
   }
-  function scanRoot(agent, path, vendor = false, pluginCache = false) {
-    if (agent === "hermes" || options.guardHermes && `${path}${sep4}`.includes(`${sep4}.agents${sep4}skills${sep4}`))
+  function scanRoot(agent, path, vendor = false, pluginCache = false, configuredRoot = false) {
+    if (agent === "hermes" || options.guardHermes && `${path}${sep5}`.includes(`${sep5}.agents${sep5}skills${sep5}`))
       assertNoHermesLegacyShadow(path);
-    if (!visit2(agent, path, vendor, 0, pluginCache).complete)
+    if (!visit2(agent, path, vendor, 0, pluginCache, false, configuredRoot).complete)
       throw new Error(`Native skill discovery limit exceeded; review this root before continuing: ${path}`);
   }
   for (const [agent, path] of roots)
     scanRoot(agent, path);
   if (options.includeVendor) {
     for (const agent of ["codex", "claude"].filter(includesAgent))
-      scanRoot(agent, canonicalAgentPath(join16(home, `.${agent}`, "plugins", "cache"), aliases), true, true);
+      scanRoot(agent, canonicalAgentPath(join17(home, `.${agent}`, "plugins", "cache"), aliases), true, true);
     if (includesAgent("claude"))
-      scanRoot("claude", canonicalAgentPath(join16(home, ".claude", "plugins", "synced"), aliases), true);
+      scanRoot("claude", canonicalAgentPath(join17(home, ".claude", "plugins", "synced"), aliases), true);
     if (includesAgent("gemini"))
-      scanRoot("gemini", join16(home, ".gemini", "extensions"), true);
+      scanRoot("gemini", join17(home, ".gemini", "extensions"), true);
   }
   const configured = options.configured ? INTEGRATION_AGENTS.filter(includesAgent).flatMap((agent) => resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, canonical: (path) => canonicalAgentPath(path, aliases) }).roots.map((path) => ({ agent, path }))) : [];
   for (const root of [...options.agentRoots ?? [], ...configured])
     if (includesAgent(root.agent))
-      scanRoot(root.agent, canonicalAgentPath(root.path, aliases), true);
+      scanRoot(root.agent, canonicalAgentPath(root.path, aliases), true, false, true);
+  if (options.reviewedCacheAlias !== undefined && !reviewedCacheAliasFound)
+    throw new Error("Reviewed cache alias was not an inventoried skill-containing sibling alias");
   recheckRootAliases(aliases);
   return entries;
 }
 function readOptional(path) {
   assertSafePath(path);
-  return existsSync82(path) ? readFileSync11(path, "utf8") : null;
+  return existsSync82(path) ? readFileSync12(path, "utf8") : null;
 }
 function jsonObject(text2, path) {
   if (text2 === null)
@@ -12631,12 +13543,12 @@ function configureHooks(config, agent, command, profileId, nativeReady) {
   }
 }
 function claudeSettingsConsumers(home, path, discoveries, aliases) {
-  const canonical3 = (value) => canonicalAgentPath(value, aliases);
+  const canonical5 = (value) => canonicalAgentPath(value, aliases);
   const containsSettings = (root) => {
-    const distance = relative4(canonical3(root), path);
-    return distance === "" || distance !== ".." && !distance.startsWith(`..${sep4}`) && !isAbsolute9(distance);
+    const distance = relative5(canonical5(root), path);
+    return distance === "" || distance !== ".." && !distance.startsWith(`..${sep5}`) && !isAbsolute11(distance);
   };
-  return discoveries.filter((binding) => binding.agent === "claude" || binding.agent === "opencode" || canonical3(join16(home, AGENT_ADAPTERS[binding.agent].config)) === path || binding.sources.some((source) => canonical3(source.path) === path) || binding.roots.some(containsSettings) || binding.directories?.some((directory) => containsSettings(directory.path))).map((binding) => binding.agent);
+  return discoveries.filter((binding) => binding.agent === "claude" || binding.agent === "opencode" || canonical5(join17(home, AGENT_ADAPTERS[binding.agent].config)) === path || binding.sources.some((source) => canonical5(source.path) === path) || binding.roots.some(containsSettings) || binding.directories?.some((directory) => containsSettings(directory.path))).map((binding) => binding.agent);
 }
 function verifyCoordinatedDiscovery(binding, home, aliases) {
   try {
@@ -12653,8 +13565,8 @@ function verifyCoordinatedDiscovery(binding, home, aliases) {
   }
 }
 function planClaudeHookEventsUpdate(options) {
-  const home = resolve9(options.home ?? homedir22()), dataDir22 = options.dataDir ?? getDataDirReadOnly();
-  const policyPath = join16(dataDir22, "agent-policy.json");
+  const home = resolve10(options.home ?? homedir22()), dataDir22 = options.dataDir ?? getDataDirReadOnly();
+  const policyPath = join17(dataDir22, "agent-policy.json");
   assertSafePath(policyPath);
   const snapshot = readManagedSkillPolicySnapshot(dataDir22);
   if (!snapshot)
@@ -12665,10 +13577,10 @@ function planClaudeHookEventsUpdate(options) {
   }
   const aliases = bridge.rootAliases ?? [];
   recheckRootAliases(aliases);
-  const path = canonicalAgentPath(join16(home, ".claude", "settings.json"), aliases);
+  const path = canonicalAgentPath(join17(home, ".claude", "settings.json"), aliases);
   assertSafePath(path);
-  const before = lstatSync14(path, { throwIfNoEntry: false }) ? new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(readNativeBytes(path, 1024 * 1024)) : null;
-  if ((before === null ? "absent" : sha(before)) !== options.expectedSettingsSha256)
+  const before = lstatSync15(path, { throwIfNoEntry: false }) ? new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(readNativeBytes(path, 1024 * 1024)) : null;
+  if ((before === null ? "absent" : sha3(before)) !== options.expectedSettingsSha256)
     throw new Error("Claude settings preimage changed");
   assertClaudeHookEventsReplacement(before, options.replacement, options.events);
   const agents = bridge.agents;
@@ -12721,7 +13633,7 @@ function planClaudeHookEventsUpdate(options) {
 }
 function atomicWrite2(path, content) {
   assertSafePath(path);
-  mkdirSync5(dirname10(path), { recursive: true, mode: 448 });
+  mkdirSync5(dirname11(path), { recursive: true, mode: 448 });
   const temporary = `${path}.skills-${randomUUID2()}`;
   try {
     writeFileSync4(temporary, content, { mode: 384, flag: "wx" });
@@ -12731,20 +13643,88 @@ function atomicWrite2(path, content) {
       unlinkSync3(temporary);
   }
 }
+function planAgentSettingsWitnessUpgrade(options) {
+  if (options.targetCodexVersion !== undefined && (options.agent !== "codex" || ![2, 3].includes(options.targetCodexVersion)))
+    throw new Error("Invalid Codex witness target version");
+  const home = resolve10(options.home ?? homedir22()), dataDir22 = options.dataDir ?? getDataDirReadOnly();
+  const snapshot = readManagedSkillPolicySnapshot(dataDir22);
+  if (!snapshot || sha3(snapshot.text) !== options.expectedPolicySha256)
+    throw new Error("Managed policy preimage changed");
+  const policy = snapshot.value, aliases = policy.bridge?.rootAliases ?? [];
+  recheckRootAliases(aliases);
+  const binding = policy.bridge?.discovery?.[options.agent];
+  if (!binding || binding.agent !== options.agent || binding.method !== "reviewed")
+    throw new Error("Settings witness upgrade requires an existing reviewed native binding");
+  const configPath = canonicalAgentPath(join17(home, options.agent === "claude" ? ".claude/settings.json" : ".codex/config.toml"), aliases);
+  const settings = readOptional(configPath);
+  if (settings === null || sha3(settings) !== options.expectedSettingsSha256)
+    throw new Error("Native settings preimage changed");
+  const sources = binding.sources.filter((source) => source.path === configPath && source.format === undefined && source.fields === undefined);
+  if (sources.length !== 1)
+    throw new Error("Settings witness upgrade requires one exact settings source");
+  const previous = sources[0];
+  if (typeof previous.sha256 !== "string")
+    throw new Error("Settings witness upgrade requires a preserved settings preimage");
+  const replaced = [previous];
+  if (options.agent === "codex") {
+    if (previous.hashMode !== undefined && previous.hashMode !== "bytes" && previous.hashMode !== "codex-settings-v1" && !(options.targetCodexVersion === 3 && previous.hashMode === "codex-settings-v2"))
+      throw new Error("Codex settings witness upgrade requires an eligible preserved configuration witness");
+    const preimage = readCodexSettingsPreimage(options.reviewedPreimage);
+    for (const source of binding.sources) {
+      if (source === previous || source.path !== configPath)
+        continue;
+      const fields = source.fields;
+      if (source.hashMode !== undefined || source.format !== "toml" || !Array.isArray(fields) || !isDeepStrictEqual4(fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]) || typeof source.sha256 !== "string")
+        throw new Error("Codex settings witness upgrade found an unrecognized configuration witness");
+      if (projectNativeDiscoveryFields(preimage, "toml", fields, configPath) !== source.sha256)
+        throw new Error("Reviewed preimage does not explain the Codex discovery projection witness");
+      replaced.push(source);
+    }
+  }
+  const next = options.agent === "claude" ? upgradeClaudeSettingsWitness(previous, options.reviewedPreimage) : options.targetCodexVersion === 3 ? upgradeCodexSettingsWitnessV3(previous, options.reviewedPreimage) : upgradeCodexSettingsWitness(previous, options.reviewedPreimage);
+  const rebound = [];
+  for (const source of binding.sources) {
+    if (!replaced.includes(source)) {
+      rebound.push(source);
+      continue;
+    }
+    if (source === replaced[0])
+      rebound.push(next);
+  }
+  const replacement = { ...binding, sources: rebound };
+  verifyAgentDiscovery(replacement);
+  const after = serializeManagedSkillPolicy({ ...policy, bridge: { ...policy.bridge, discovery: { ...policy.bridge.discovery, [options.agent]: replacement } } });
+  return { dataDir: dataDir22, profileId: policy.profileId, changes: [{ path: join17(dataDir22, "agent-policy.json"), before: snapshot.text, after }], nativeSkills: [], observedPolicy: { path: join17(dataDir22, "agent-policy.json"), before: snapshot.text }, observedSettings: { path: configPath, before: settings }, discoveryBefore: [replacement], discoveryAfter: [replacement], rootAliases: aliases, managedAgentChecks: { home, agents: [options.agent] }, settingsWitnessUpgrade: { agent: options.agent, path: configPath, fromHashMode: previous.hashMode ?? "bytes", fromSha256: previous.sha256, toHashMode: next.hashMode, toSha256: next.sha256, reviewedPreimage: options.reviewedPreimage, currentSettingsSha256: options.expectedSettingsSha256, replacedWitnesses: replaced.map((source) => ({ hashMode: source.hashMode ?? "bytes", sha256: source.sha256 })) } };
+}
 function applyAgentIntegration(plan) {
-  const policyPath = join16(plan.dataDir, "agent-policy.json");
+  for (const source of plan.observedNativeSources ?? [])
+    if (sha3(readNativeBytes(source.path, 1024 * 1024)) !== source.sha256)
+      throw new Error("Native identity source changed after planning");
+  if (plan.observedSettings && readOptional(plan.observedSettings.path) !== plan.observedSettings.before)
+    throw new Error("Native settings changed after witness planning");
+  const policyPath = join17(plan.dataDir, "agent-policy.json");
   assertSafePath(policyPath);
-  const currentText = (path) => resolve9(path) === resolve9(policyPath) ? readManagedSkillPolicySnapshot(plan.dataDir)?.text ?? null : readOptional(path);
+  const currentText = (path) => resolve10(path) === resolve10(policyPath) ? readManagedSkillPolicySnapshot(plan.dataDir)?.text ?? null : readOptional(path);
   readManagedSkillPolicySnapshot(plan.dataDir);
   for (const change of plan.changes)
-    if (resolve9(change.path) === resolve9(policyPath))
+    if (resolve10(change.path) === resolve10(policyPath))
       parseManagedSkillPolicy(change.after);
   const aliases = plan.rootAliases ?? [];
   recheckRootAliases(aliases);
   for (const agent of plan.retainedReviewChecks?.agents ?? [])
     assertManagedAgentBridge(agent, { ...plan.retainedReviewChecks, dataDir: plan.dataDir });
+  let provenDiscovery;
+  if (plan.settingsWitnessUpgrade) {
+    const upgrade = plan.settingsWitnessUpgrade;
+    if (!plan.managedAgentChecks || !plan.observedPolicy?.before)
+      throw new Error("Invalid settings witness upgrade plan");
+    const verified = planAgentSettingsWitnessUpgrade({ agent: upgrade.agent, ...upgrade.agent === "codex" ? { targetCodexVersion: upgrade.toHashMode === "codex-settings-v3" ? 3 : 2 } : {}, reviewedPreimage: upgrade.reviewedPreimage, home: plan.managedAgentChecks.home, dataDir: plan.dataDir, expectedPolicySha256: sha3(plan.observedPolicy.before), expectedSettingsSha256: upgrade.currentSettingsSha256 });
+    if (JSON.stringify(verified.changes) !== JSON.stringify(plan.changes) || JSON.stringify(verified.settingsWitnessUpgrade) !== JSON.stringify(upgrade))
+      throw new Error("Settings witness upgrade plan changed");
+    provenDiscovery = verified.discoveryBefore[0];
+  }
   for (const agent of plan.managedAgentChecks?.agents ?? [])
-    assertManagedAgentBridge(agent, { home: plan.managedAgentChecks.home, dataDir: plan.dataDir, projectDir: plan.managedAgentChecks.home });
+    assertManagedAgentBridgeWithDiscovery(agent, { home: plan.managedAgentChecks.home, dataDir: plan.dataDir, projectDir: plan.managedAgentChecks.home }, provenDiscovery?.agent === agent ? provenDiscovery : undefined);
   for (const binding of plan.discoveryBefore ?? []) {
     if (plan.managedAgentChecks)
       verifyCoordinatedDiscovery(binding, plan.managedAgentChecks.home, aliases);
@@ -12756,7 +13736,7 @@ function applyAgentIntegration(plan) {
   for (const change of plan.changes)
     if (currentText(change.path) !== change.before)
       throw new Error(`Configuration changed after planning: ${change.path}`);
-  const backupRoot = join16(plan.dataDir, "migration", randomUUID2()), backups = [], written = [], createdDirectories = new Set;
+  const backupRoot = join17(plan.dataDir, "migration", randomUUID2()), backups = [], written = [], createdDirectories = new Set;
   if (!plan.changes.length) {
     recheckRootAliases(aliases);
     return { changed: [], backups, ...aliases.length ? { rootAliases: aliases } : {} };
@@ -12766,8 +13746,10 @@ function applyAgentIntegration(plan) {
   chmodSync(backupRoot, 448);
   for (const [index, change] of plan.changes.entries())
     if (change.before !== null) {
-      const backup = join16(backupRoot, `${index}-${sha(change.path).slice(0, 12)}.backup`);
+      const backup = join17(backupRoot, `${index}-${sha3(change.path).slice(0, 12)}.backup`);
       writeFileSync4(backup, change.before, { mode: 384, flag: "wx" });
+      if (readFileSync12(backup, "utf8") !== change.before)
+        throw new Error("Native configuration preservation readback failed");
       backups.push(backup);
     }
   try {
@@ -12775,13 +13757,18 @@ function applyAgentIntegration(plan) {
       recheckRootAliases(aliases);
       if (currentText(change.path) !== change.before)
         throw new Error(`Configuration changed after planning: ${change.path}`);
-      for (let directory = dirname10(change.path);!existsSync82(directory); directory = dirname10(directory))
+      for (let directory = dirname11(change.path);!existsSync82(directory); directory = dirname11(directory))
         createdDirectories.add(directory);
       const after = change.after;
       atomicWrite2(change.path, after);
       written.push({ path: change.path, before: change.before, after });
     }
     recheckRootAliases(aliases);
+    for (const source of plan.observedNativeSources ?? [])
+      if (sha3(readNativeBytes(source.path, 1024 * 1024)) !== source.sha256)
+        throw new Error("Native identity source changed during application");
+    if (plan.observedSettings && readOptional(plan.observedSettings.path) !== plan.observedSettings.before)
+      throw new Error("Native settings changed during witness application");
     for (const binding of plan.discoveryAfter ?? []) {
       if (plan.managedAgentChecks)
         verifyCoordinatedDiscovery(binding, plan.managedAgentChecks.home, aliases);
@@ -12790,7 +13777,7 @@ function applyAgentIntegration(plan) {
     }
     for (const agent of plan.managedAgentChecks?.agents ?? [])
       assertManagedAgentBridge(agent, { home: plan.managedAgentChecks.home, dataDir: plan.dataDir, projectDir: plan.managedAgentChecks.home });
-    atomicWrite2(join16(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha(change.before), afterHash: sha(change.after) })), backups, ...aliases.length ? { rootAliases: aliases } : {} }) + `
+    atomicWrite2(join17(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha3(change.before), afterHash: sha3(change.after) })), backups, ...aliases.length ? { rootAliases: aliases } : {} }) + `
 `);
   } catch (error) {
     for (const change of written.reverse()) {
@@ -12820,8 +13807,11 @@ function applyAgentIntegration(plan) {
   return { changed: plan.changes.map((change) => change.path), backups, ...aliases.length ? { rootAliases: aliases } : {} };
 }
 function assertManagedAgentBridge(agent, options = {}) {
-  const home = resolve9(options.home ?? homedir22()), dataDir22 = options.dataDir ?? getDataDirReadOnly();
-  assertSafePath(join16(dataDir22, "agent-policy.json"));
+  assertManagedAgentBridgeWithDiscovery(agent, options);
+}
+function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscovery) {
+  const home = resolve10(options.home ?? homedir22()), dataDir22 = options.dataDir ?? getDataDirReadOnly();
+  assertSafePath(join17(dataDir22, "agent-policy.json"));
   const snapshot = readManagedSkillPolicySnapshot(dataDir22);
   if (!snapshot)
     throw new Error("NATIVE_SKILL_DRIFT: install the Skills bridge with skills hook install");
@@ -12832,14 +13822,14 @@ function assertManagedAgentBridge(agent, options = {}) {
   if (!Array.isArray(aliases))
     throw new Error("NATIVE_SKILL_DRIFT: invalid root alias binding");
   recheckRootAliases(aliases);
-  const expected = canonicalAgentPath(join16(home, AGENT_ADAPTERS[agent].root, CLI_BRIDGE_NAME), aliases);
+  const expected = canonicalAgentPath(join17(home, AGENT_ADAPTERS[agent].root, CLI_BRIDGE_NAME), aliases);
   if (!isOwnedCliBridge(expected, [expected]))
     throw new Error("NATIVE_SKILL_DRIFT: the native Skills bridge is missing or modified; repair it before continuing");
   const roots = projectAncestorDirectories([options.projectDir ?? process.cwd(), ...options.projectDirs ?? [], ...agent === "hermes" && process.env.TERMINAL_CWD ? [process.cwd()] : []]);
-  const visible = (entry) => entry.agent === agent || ["codex", "gemini", "opencode", "hermes"].includes(agent) && entry.path.includes(`${sep4}.agents${sep4}skills${sep4}`) || agent === "opencode" && entry.agent === "claude";
-  const discovery = binding.discovery?.[agent];
+  const visible = (entry) => entry.agent === agent || ["codex", "gemini", "opencode", "hermes"].includes(agent) && entry.path.includes(`${sep5}.agents${sep5}skills${sep5}`) || agent === "opencode" && entry.agent === "claude";
+  const discovery = provenDiscovery ?? binding.discovery?.[agent];
   assertProjectDiscovery(agent, [...roots], home, (path) => canonicalAgentPath(path, aliases), discovery);
-  const configPath = canonicalAgentPath(join16(home, AGENT_ADAPTERS[agent].config), aliases), config = agent === "hermes" ? parseHermesConfig(readOptional(configPath)) : jsonObject(readOptional(configPath), configPath);
+  const configPath = canonicalAgentPath(join17(home, AGENT_ADAPTERS[agent].config), aliases), config = agent === "hermes" ? parseHermesConfig(readOptional(configPath)) : jsonObject(readOptional(configPath), configPath);
   const command = binding.commands?.[agent], profile = binding.profiles?.[agent];
   if (typeof command !== "string" || typeof profile !== "string")
     throw new Error("NATIVE_SKILL_DRIFT: the native hook command/profile binding is missing");
@@ -12847,11 +13837,11 @@ function assertManagedAgentBridge(agent, options = {}) {
     throw new Error("NATIVE_SKILL_DRIFT: the hook selection profile differs from its managed binding; restart the native client after reviewing skills hook install");
   if (agent === "hermes") {
     const supervisor2 = binding.supervisors?.hermes;
-    if (supervisor2?.path !== join16(dataDir22, "agent-hooks", "hermes.js") || supervisor2?.sha256 !== sha(renderHermesSupervisor(command, profile)))
+    if (supervisor2?.path !== join17(dataDir22, "agent-hooks", "hermes.js") || supervisor2?.sha256 !== sha3(renderHermesSupervisor(command, profile)))
       throw new Error("NATIVE_SKILL_DRIFT: Hermes supervisor binding changed; run skills hook install");
     assertHermesProtection(home, config, command, profile, supervisor2);
   } else if (agent === "opencode") {
-    if (JSON.stringify(config.permission?.skill) !== JSON.stringify({ "*": "deny", [CLI_BRIDGE_NAME]: "allow" }) || readOptional(join16(home, ".config", "opencode", "plugins", "skills-cli.js")) !== renderOpenCodePlugin(command, profile))
+    if (JSON.stringify(config.permission?.skill) !== JSON.stringify({ "*": "deny", [CLI_BRIDGE_NAME]: "allow" }) || readOptional(join17(home, ".config", "opencode", "plugins", "skills-cli.js")) !== renderOpenCodePlugin(command, profile))
       throw new Error("NATIVE_SKILL_DRIFT: OpenCode bridge protection changed; run skills hook install");
   } else {
     const required = {};
@@ -12868,21 +13858,44 @@ function assertManagedAgentBridge(agent, options = {}) {
     if (agent === "gemini" && (config.hooksConfig?.enabled === false || config.skills?.enabled !== true || !["antigravity-support", "skill-creator"].every((name) => config.skills?.disabled?.includes(name)) || config.skills?.disabled?.includes(CLI_BRIDGE_NAME)))
       throw new Error("NATIVE_SKILL_DRIFT: Gemini bridge or bundled-skill protection changed; run skills hook install");
   }
-  const codexPath = canonicalAgentPath(join16(home, ".codex", "config.toml"), aliases);
+  const codexPath = canonicalAgentPath(join17(home, ".codex", "config.toml"), aliases);
   if (options.codexDiscoveryRecovery && (agent !== "codex" || options.codexDiscoveryRecovery.configPath !== codexPath))
     throw new Error("NATIVE_SKILL_DRIFT: Codex trust recovery names a different configuration root");
   const codexConfig = agent === "codex" ? Bun.TOML.parse(readOptional(codexPath) ?? "") : {};
   if (agent === "codex" && codexConfig.skills?.bundled?.enabled !== false)
     throw new Error("NATIVE_SKILL_DRIFT: Codex bundled skill reseeding is not disabled (skills.bundled.enabled); run skills hook install");
-  const setting = (path) => (codexConfig.skills?.config ?? []).filter((entry) => typeof entry.path === "string" && [path, join16(path, "SKILL.md")].includes(canonicalAgentPath(entry.path, aliases)));
+  const setting = (path) => (codexConfig.skills?.config ?? []).filter((entry) => typeof entry.path === "string" && [path, join17(path, "SKILL.md")].includes(canonicalAgentPath(entry.path, aliases)));
   if (agent === "codex" && [...setting(expected), ...(codexConfig.skills?.config ?? []).filter((entry) => typeof entry.name === "string" && entry.name.trim() === CLI_BRIDGE_NAME)].some((entry) => entry.enabled === false))
     throw new Error("NATIVE_SKILL_DRIFT: the Codex CLI bridge is disabled; run skills hook install");
-  const disabledBuiltin = (entry) => {
-    if (agent !== "codex" || !entry.vendor || !entry.path.startsWith(canonicalAgentPath(join16(home, ".codex", "skills", ".system"), aliases) + sep4))
+  if (agent === "codex" && !reviewedCodexPluginCapabilitiesUnchanged(canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), binding.codexPluginSkills ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024))))
+    throw new Error("NATIVE_SKILL_DRIFT: reviewed native plugin capability controls changed; run skills hook install with a fresh discovery review");
+  const disabledPlugin = (entry) => {
+    if (agent !== "codex" || !entry.vendor)
+      return false;
+    const document2 = join17(entry.path, "SKILL.md"), cache = canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), read2 = (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024));
+    return isReviewedCodexPluginInactive(document2, cache, binding.codexInactivePlugins ?? [], codexConfig.plugins, codexConfig.skills?.config ?? [], read2) || isReviewedCodexPluginSkillDisabled(document2, cache, binding.codexPluginSkills ?? [], codexConfig.skills?.config, read2);
+  };
+  const disabledPaths = new Set(disabledCodexSkillPaths(codexConfig, aliases));
+  const disabledVendorSkill = (entry) => {
+    if (agent !== "codex" || !entry.vendor)
       return false;
-    const matched = Array.isArray(binding.disabledBuiltins) && binding.disabledBuiltins.some((item) => item.path === entry.path && item.hash === entry.hash);
-    const settings = setting(entry.path);
-    return matched && settings.length === 1 && settings[0]?.enabled === false;
+    if ((binding.codexPluginSkills ?? []).some((control) => entry.path.startsWith(control.pluginParent + sep5)))
+      return disabledPlugin(entry);
+    if (disabledPlugin(entry))
+      return true;
+    if (!disabledPaths.has(entry.path))
+      return false;
+    if (entry.path.startsWith(canonicalAgentPath(join17(home, ".codex", "plugins", "cache"), aliases) + sep5))
+      return true;
+    const runtimeCache = canonicalAgentPath(join17(home, ".cache", "codex-runtimes"), aliases);
+    if (entry.path.startsWith(runtimeCache + sep5) && discovery?.method === "automatic" && discovery.roots.some((root) => entry.path.startsWith(root + sep5)))
+      return true;
+    const bundledMarketplaces = canonicalAgentPath(join17(home, ".codex", ".tmp", "bundled-marketplaces"), aliases);
+    if (entry.path.startsWith(bundledMarketplaces + sep5) && discovery?.method === "automatic" && discovery.roots.some((root) => entry.path.startsWith(root + sep5)))
+      return true;
+    if (!entry.path.startsWith(canonicalAgentPath(join17(home, ".codex", "skills", ".system"), aliases) + sep5))
+      return false;
+    return Array.isArray(binding.disabledBuiltins) && binding.disabledBuiltins.some((item) => item.path === entry.path && item.hash === entry.hash);
   };
   if (!discovery || discovery.agent !== agent)
     throw new Error("NATIVE_SKILL_DRIFT: native discovery coverage is missing; run skills hook install");
@@ -12898,8 +13911,16 @@ function assertManagedAgentBridge(agent, options = {}) {
   } catch (error) {
     throw new Error(`NATIVE_SKILL_DRIFT: ${error.message}`);
   }
-  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0 });
-  const unexpected = inventory.filter((entry) => visible(entry) && !entry.bridge && !disabledBuiltin(entry));
+  let installationInputRoots = [];
+  if (agent === "codex") {
+    try {
+      installationInputRoots = reviewedCodexPluginSourceRoots(canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), discovery.codexInstallationInputs?.plugins ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024)));
+    } catch {
+      throw new Error("NATIVE_SKILL_DRIFT: native installation input identity changed; review discovery and catalog");
+    }
+  }
+  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0, disabledVendorPaths: agent === "codex" ? disabledCodexSkillPaths(codexConfig, aliases) : [], disabledVendorSkill: disabledPlugin, codexInstallationInputRoots: installationInputRoots });
+  const unexpected = inventory.filter((entry) => visible(entry) && !entry.bridge && !disabledVendorSkill(entry));
   if (unexpected.length) {
     const paths = unexpected.slice(0, 3).map((entry) => {
       const escaped = JSON.stringify(entry.path).replace(/[\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/g, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`);
@@ -12918,7 +13939,7 @@ function pluginNeed(value, message) {
   if (!value)
     pluginRefusal(message);
 }
-var pluginHash = (bytes) => createHash11("sha256").update(bytes).digest("hex");
+var pluginHash = (bytes) => createHash13("sha256").update(bytes).digest("hex");
 function pluginObject(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -12974,7 +13995,7 @@ function validatePluginManifest(value) {
     pluginNeed(item.kind === "skill" || item.kind === "command", "Unknown plugin payload kind");
     pluginDigest(item.sourceDigest);
     pluginKeys(item.target, ["slug", "version", "bundleDigest"]);
-    validateSelection2({ ...item.target, authority: "https://example.com/skills/v1", workspaceId: "validation", profileRevision: "validation" });
+    validateSelection({ ...item.target, authority: "https://example.com/skills/v1", workspaceId: "validation", profileRevision: "validation" });
   }
 }
 function pluginFileWitnesses(entries) {
@@ -12995,15 +14016,15 @@ var uid = () => typeof process.getuid === "function" ? BigInt(process.getuid())
 var missing = (error) => Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
 function stat(path) {
   try {
-    return lstatSync16(path, { bigint: true });
+    return lstatSync17(path, { bigint: true });
   } catch (error) {
     if (missing(error))
       return null;
     return pluginRefusal("Cannot inspect plugin filesystem entry");
   }
 }
-function canonical3(path) {
-  pluginNeed(typeof path === "string" && path.length <= 8192 && isAbsolute10(path) && resolve10(path) === path && !/[\x00-\x1f\x7f]/.test(path), "Plugin storage paths must be canonical absolute paths");
+function canonical5(path) {
+  pluginNeed(typeof path === "string" && path.length <= 8192 && isAbsolute12(path) && resolve11(path) === path && !/[\x00-\x1f\x7f]/.test(path), "Plugin storage paths must be canonical absolute paths");
 }
 function owner(stats, system = false) {
   const current2 = uid();
@@ -13013,12 +14034,12 @@ function same3(left, right, identityOnly = false) {
   pluginNeed(right && left.dev === right.dev && left.ino === right.ino && left.mode === right.mode && left.uid === right.uid && left.gid === right.gid && (identityOnly || left.size === right.size && left.nlink === right.nlink && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs), "Plugin filesystem entry changed during access");
 }
 function ancestors(path, create = false) {
-  canonical3(path);
-  const result = [], parent = dirname12(path), filesystemRoot = parse5(parent).root;
+  canonical5(path);
+  const result = [], parent = dirname13(path), filesystemRoot = parse5(parent).root;
   let current2 = filesystemRoot;
   for (const segment of ["", ...parent.slice(filesystemRoot.length).split("/").filter(Boolean)]) {
     if (segment)
-      current2 = join21(current2, segment);
+      current2 = join23(current2, segment);
     let currentStat = stat(current2);
     if (!currentStat && create) {
       try {
@@ -13064,8 +14085,8 @@ function readBytes(path, maximum, kind) {
   fileShape(before, maximum, kind);
   let fd;
   try {
-    fd = openSync11(path, READ_FLAGS);
-    const opened = fstatSync11(fd, { bigint: true });
+    fd = openSync9(path, READ_FLAGS);
+    const opened = fstatSync9(fd, { bigint: true });
     same3(before, opened);
     fileShape(opened, maximum, kind);
     const bytes = new Uint8Array(Number(opened.size));
@@ -13076,7 +14097,7 @@ function readBytes(path, maximum, kind) {
       offset += count;
     }
     pluginNeed(readSync7(fd, new Uint8Array(1), 0, 1, null) === 0, "Plugin file grew while being read");
-    same3(opened, fstatSync11(fd, { bigint: true }));
+    same3(opened, fstatSync9(fd, { bigint: true }));
     same3(opened, stat(path));
     verifyAncestors(chain);
     return bytes;
@@ -13086,7 +14107,7 @@ function readBytes(path, maximum, kind) {
     return pluginRefusal("Cannot safely read plugin file");
   } finally {
     if (fd !== undefined)
-      closeSync11(fd);
+      closeSync9(fd);
   }
 }
 function exactPaths(entries) {
@@ -13116,7 +14137,7 @@ function directoryNames(path) {
 function snapshotPluginTree(root, options = {}) {
   const chain = ancestors(root), entries = [], files = [], directories = [];
   let bytes = 0, visited = 0;
-  const visit2 = (directory, relative5) => {
+  const visit2 = (directory, relative6) => {
     const before = stat(directory);
     pluginNeed(before && before.isDirectory() && !before.isSymbolicLink(), "Plugin tree must contain real directories");
     const names = directoryNames(directory);
@@ -13124,18 +14145,18 @@ function snapshotPluginTree(root, options = {}) {
     directories.push({ path: directory, stat: before, names });
     for (const name of names) {
       pluginNeed(++visited <= PLUGIN_PROJECTION_LIMITS.files * 50, "Plugin tree membership exceeds its limit");
-      const path = relative5 ? `${relative5}/${name}` : name;
+      const path = relative6 ? `${relative6}/${name}` : name;
       pluginNeed(new TextEncoder().encode(path).byteLength <= 100 && !/[\\:\x00-\x1f\x7f]/u.test(path), "Plugin entry path exceeds its limit or is unsafe");
-      const absolute = join21(directory, name), entryStat = stat(absolute);
+      const absolute = join23(directory, name), entryStat = stat(absolute);
       pluginNeed(entryStat, "Plugin tree member disappeared");
-      if (relative5 === "" && name === ".orphaned_at" && (options.nativeRuntime === "claude-2.1.274" || options.nativeRuntime === "claude-2.1.276")) {
+      if (relative6 === "" && name === ".orphaned_at" && (options.nativeRuntime === "claude-2.1.274" || options.nativeRuntime === "claude-2.1.276")) {
         const bytes2 = readBytes(absolute, 32, "native-pin");
         pluginNeed(/^[1-9][0-9]{12}$/.test(new TextDecoder().decode(bytes2)), "Malformed native orphan timestamp");
         same3(entryStat, stat(absolute));
         files.push({ path: absolute, stat: entryStat });
         continue;
       }
-      if (relative5 === "" && name === ".in_use" && (options.nativeRuntime === "claude-2.1.274" || options.nativeRuntime === "claude-2.1.276")) {
+      if (relative6 === "" && name === ".in_use" && (options.nativeRuntime === "claude-2.1.274" || options.nativeRuntime === "claude-2.1.276")) {
         pluginNeed(entryStat.isDirectory() && !entryStat.isSymbolicLink(), "Native plugin pins require a real directory");
         owner(entryStat);
         const pins = directoryNames(absolute);
@@ -13143,7 +14164,7 @@ function snapshotPluginTree(root, options = {}) {
         directories.push({ path: absolute, stat: entryStat, names: pins });
         for (const pin2 of pins) {
           pluginNeed(/^[1-9][0-9]{0,9}$/.test(pin2) && Number(pin2) <= 2147483647, "Unrecognized native plugin pin name");
-          const pinPath = join21(absolute, pin2), pinStat = stat(pinPath);
+          const pinPath = join23(absolute, pin2), pinStat = stat(pinPath);
           pluginNeed(pinStat, "Native plugin pin disappeared");
           const bytes2 = readBytes(pinPath, 4096, "native-pin");
           let value;
@@ -13215,7 +14236,7 @@ function validatePluginTarget(value) {
   for (const registration of value.registrations) {
     pluginKeys(registration, ["scope", "projectPath"]);
     pluginNeed(registration.scope === "user" || registration.scope === "project", "Unsupported plugin registration scope");
-    pluginNeed(registration.scope === "user" ? registration.projectPath === null : typeof registration.projectPath === "string" && isAbsolute11(registration.projectPath) && resolve11(registration.projectPath) === registration.projectPath, "Plugin scope requires its exact project path");
+    pluginNeed(registration.scope === "user" ? registration.projectPath === null : typeof registration.projectPath === "string" && isAbsolute13(registration.projectPath) && resolve12(registration.projectPath) === registration.projectPath, "Plugin scope requires its exact project path");
     const key = JSON.stringify([registration.scope, registration.projectPath]);
     pluginNeed(!scopes.has(key), "Duplicate plugin registration scope");
     scopes.add(key);
@@ -13223,7 +14244,7 @@ function validatePluginTarget(value) {
   for (const key of ["native", "resolver"]) {
     pluginKeys(value[key], key === "native" ? ["version", "executable", "digest"] : ["executable", "digest"]);
     pluginText(value[key].executable);
-    pluginNeed(isAbsolute11(value[key].executable) && resolve11(value[key].executable) === value[key].executable, "Plugin executable must have a canonical absolute path");
+    pluginNeed(isAbsolute13(value[key].executable) && resolve12(value[key].executable) === value[key].executable, "Plugin executable must have a canonical absolute path");
     pluginDigest(value[key].digest);
   }
   pluginNeed(["2.1.274", "2.1.276"].includes(value.native.version), "Plugin admission requires a certified Claude command-source runtime (2.1.274 or 2.1.276)");
@@ -13269,11 +14290,11 @@ function validateBinding2(value) {
   for (const key of ["authority", "workspaceId", "profileId", "bundleSlug"])
     pluginText(value[key]);
   pluginNeed(value.principal.accountId === value.workspaceId, "Plugin principal account differs from its workspace");
-  validateSelection2({ slug: value.bundleSlug, version: "1.0.0", bundleDigest: `sha256:${"0".repeat(64)}`, authority: value.authority, workspaceId: value.workspaceId, profileRevision: "validation" });
+  validateSelection({ slug: value.bundleSlug, version: "1.0.0", bundleDigest: `sha256:${"0".repeat(64)}`, authority: value.authority, workspaceId: value.workspaceId, profileRevision: "validation" });
 }
 function validateObservedSelection(value) {
   pluginKeys(value, ["slug", "version", "bundleDigest", "aliases", "triggers", "authority", "workspaceId", "profileRevision"]);
-  validateSelection2(value);
+  validateSelection(value);
   if (value.triggers !== undefined) {
     pluginKeys(value.triggers, ["keywords", "paths", "always"]);
     pluginNeed(value.triggers.always === undefined || typeof value.triggers.always === "boolean", "Invalid plugin selection trigger");
@@ -13368,12 +14389,12 @@ function pluginResolverCommand(binding) {
 }
 function pluginBindingPath(storeRoot, id) {
   pluginNeed(/^[a-f0-9]{64}$/.test(id), "Invalid plugin binding identifier");
-  return join23(storeRoot, "bindings", `${id}.json`);
+  return join25(storeRoot, "bindings", `${id}.json`);
 }
 function pluginReceiptPath(storeRoot, id, digest) {
   pluginNeed(/^[a-f0-9]{64}$/.test(id), "Invalid plugin binding identifier");
   pluginDigest(digest);
-  return join23(storeRoot, "receipts", id, `${digest.slice(7)}.json`);
+  return join25(storeRoot, "receipts", id, `${digest.slice(7)}.json`);
 }
 function readPluginBinding(storeRoot, id) {
   const value = readPluginJson(pluginBindingPath(storeRoot, id));
@@ -13393,7 +14414,7 @@ function readPluginAdmissionReceipt(storeRoot, id, digest) {
   pluginNeed(receipt.plan.bindingId === id && receipt.plan.planDigest === digest, "Plugin receipt identity differs from its filename");
   const binding = readPluginBinding(storeRoot, id);
   pluginNeed(canonicalJson(binding) === canonicalJson(receipt.plan.binding) && receipt.plan.sourceCommand === pluginResolverCommand(binding), "Plugin receipt binding changed");
-  pluginNeed(receipt.materializedPath === join23(storeRoot, "objects", id, digest.slice(7)), "Plugin receipt points outside its immutable materialization");
+  pluginNeed(receipt.materializedPath === join25(storeRoot, "objects", id, digest.slice(7)), "Plugin receipt points outside its immutable materialization");
   pluginText(receipt.admittedAt, 64);
   pluginNeed(Number.isFinite(Date.parse(receipt.admittedAt)), "Invalid plugin admission time");
   return receipt;
@@ -13406,25 +14427,25 @@ function validateManagedPluginWitnesses(value) {
     pluginNeed(typeof item.bindingId === "string" && /^[a-f0-9]{64}$/.test(item.bindingId) && !seen.has(item.bindingId), "Invalid or duplicate managed plugin witness");
     seen.add(item.bindingId);
     pluginText(item.storeRoot);
-    pluginNeed(isAbsolute12(item.storeRoot) && resolve12(item.storeRoot) === item.storeRoot, "Invalid plugin receipt store path");
+    pluginNeed(isAbsolute14(item.storeRoot) && resolve13(item.storeRoot) === item.storeRoot, "Invalid plugin receipt store path");
   }
 }
 function safe3(path) {
   pluginText(path);
-  pluginNeed(isAbsolute12(path) && resolve12(path) === path, "Invalid plugin registry path");
-  for (let at = path;; at = dirname13(at)) {
-    pluginNeed(!lstatSync17(at, { throwIfNoEntry: false })?.isSymbolicLink(), "Plugin registry path traverses a symlink");
-    if (at === dirname13(at))
+  pluginNeed(isAbsolute14(path) && resolve13(path) === path, "Invalid plugin registry path");
+  for (let at = path;; at = dirname14(at)) {
+    pluginNeed(!lstatSync18(at, { throwIfNoEntry: false })?.isSymbolicLink(), "Plugin registry path traverses a symlink");
+    if (at === dirname14(at))
       break;
   }
 }
 function readRegistry(path) {
   safe3(path);
-  const initial = lstatSync17(path);
+  const initial = lstatSync18(path);
   pluginNeed(initial.isFile() && initial.size <= 1024 * 1024, "Plugin registry is not a bounded regular file");
-  const fd = openSync12(path, constants9.O_RDONLY | constants9.O_NOFOLLOW | constants9.O_NONBLOCK);
+  const fd = openSync10(path, constants9.O_RDONLY | constants9.O_NOFOLLOW | constants9.O_NONBLOCK);
   try {
-    const opened = fstatSync12(fd);
+    const opened = fstatSync10(fd);
     pluginNeed(opened.isFile() && opened.ino === initial.ino && opened.dev === initial.dev, "Plugin registry changed during open");
     const bytes = Buffer.alloc(1024 * 1024 + 1);
     let length = 0;
@@ -13434,7 +14455,7 @@ function readRegistry(path) {
         break;
       length += count;
     }
-    const after = fstatSync12(fd), current2 = lstatSync17(path);
+    const after = fstatSync10(fd), current2 = lstatSync18(path);
     safe3(path);
     pluginNeed(length <= 1024 * 1024 && length === opened.size && after.size === opened.size && after.mtimeMs === opened.mtimeMs && after.ctimeMs === opened.ctimeMs && current2.dev === opened.dev && current2.ino === opened.ino && current2.mtimeMs === opened.mtimeMs && current2.ctimeMs === opened.ctimeMs, "Plugin registry changed during read");
     let value;
@@ -13446,7 +14467,7 @@ function readRegistry(path) {
     pluginNeed(pluginObject(value) && value.version === 2 && pluginObject(value.plugins), "Unsupported native plugin registry schema");
     return { value, rawDigest: pluginHash(bytes.subarray(0, length)) };
   } finally {
-    closeSync12(fd);
+    closeSync10(fd);
   }
 }
 function nativeVersionMatches(version, receipt) {
@@ -13464,7 +14485,7 @@ function hashManagedPluginRegistry(path, managed) {
     seen.add(target.pluginId);
     const rows = plugins[target.pluginId];
     pluginNeed(Array.isArray(rows) && rows.length === target.registrations.length, "Managed plugin registration membership changed");
-    const [name, market] = target.pluginId.split("@"), cacheRoot = join25(dirname13(path), "cache", market, name);
+    const [name, market] = target.pluginId.split("@"), cacheRoot = join26(dirname14(path), "cache", market, name);
     const scopes = new Set, approvals = new Map, currentFiles = new Map;
     plugins[target.pluginId] = rows.map((row) => {
       pluginNeed(pluginObject(row), "Invalid managed plugin registration");
@@ -13477,10 +14498,10 @@ function hashManagedPluginRegistry(path, managed) {
       pluginText(row.sourceProducerPath);
       pluginText(row.lastUpdated, 64);
       pluginNeed(Number.isFinite(Date.parse(row.lastUpdated)), "Invalid managed plugin update timestamp");
-      pluginNeed(/^(?:[A-Za-z0-9][A-Za-z0-9._+-]*-)?[a-f0-9]{12}$/.test(row.version) && row.installPath === join25(cacheRoot, row.version), "Managed plugin cache path or version is outside its registration");
+      pluginNeed(/^(?:[A-Za-z0-9][A-Za-z0-9._+-]*-)?[a-f0-9]{12}$/.test(row.version) && row.installPath === join26(cacheRoot, row.version), "Managed plugin cache path or version is outside its registration");
       const approval = (producer) => {
         pluginText(producer);
-        const digest = `sha256:${basename6(producer)}`;
+        const digest = `sha256:${basename7(producer)}`;
         const receipt2 = readPluginAdmissionReceipt(witness.storeRoot, witness.bindingId, digest);
         pluginNeed(receipt2.materializedPath === producer, "Managed producer path is not an approved immutable projection");
         if (!verified.has(producer)) {
@@ -13507,7 +14528,7 @@ function hashManagedPluginRegistry(path, managed) {
       return Object.fromEntries(Object.entries(row).filter(([key]) => !["version", "installPath", "sourceProducerPath", "previousProducerPaths", "lastUpdated"].includes(key)));
     });
     safe3(cacheRoot);
-    const before = lstatSync17(cacheRoot);
+    const before = lstatSync18(cacheRoot);
     pluginNeed(before.isDirectory(), "Invalid managed plugin cache root");
     const directory = opendirSync5(cacheRoot), names = [];
     try {
@@ -13520,17 +14541,17 @@ function hashManagedPluginRegistry(path, managed) {
       directory.closeSync();
     }
     for (const version of names.sort()) {
-      const files = pluginFileWitnesses(snapshotPluginTree(join25(cacheRoot, version), { nativeRuntime: `claude-${target.native.version}` }));
+      const files = pluginFileWitnesses(snapshotPluginTree(join26(cacheRoot, version), { nativeRuntime: `claude-${target.native.version}` }));
       verifiedBytes += files.reduce((total, file) => total + file.size, 0);
       pluginNeed(verifiedBytes <= 256 * 1024 * 1024, "Managed plugin verification exceeds its aggregate byte budget");
       const serialized = JSON.stringify(files);
-      const expected = currentFiles.get(join25(cacheRoot, version));
+      const expected = currentFiles.get(join26(cacheRoot, version));
       pluginNeed(expected === undefined || serialized === expected, "Current native cache differs from its exact registered producer receipt");
       pluginNeed([...approvals.values()].some((receipt) => nativeVersionMatches(version, receipt) && JSON.stringify(receipt.plan.files) === serialized), "A retained native plugin cache version differs from every approved projection");
     }
     for (const row of rows)
       pluginNeed(names.includes(row.version), "Managed native plugin installation is missing");
-    const after = lstatSync17(cacheRoot);
+    const after = lstatSync18(cacheRoot);
     safe3(cacheRoot);
     pluginNeed(before.dev === after.dev && before.ino === after.ino && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs, "Managed cache version membership changed during verification");
   }
@@ -13538,35 +14559,35 @@ function hashManagedPluginRegistry(path, managed) {
   return pluginHash(JSON.stringify(snapshot.value));
 }
 var CLAUDE_MARKETPLACE_REGISTRY_LIMITS = Object.freeze({ bytes: 1024 * 1024, rows: 1024, depth: 32, nodes: 65536, stringCharacters: 16384, pathCharacters: 4096 });
-function need3(value, reason) {
+function need5(value, reason) {
   if (!value)
     throw new Error(`Claude marketplace registry ${reason}`);
 }
-function absolutePath2(value) {
-  need3(typeof value === "string" && value.length > 0 && value.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.pathCharacters && !/[\x00-\x1f\x7f]/.test(value) && isAbsolute13(value) && resolve13(value) === value, "requires a normalized absolute path");
+function absolutePath3(value) {
+  need5(typeof value === "string" && value.length > 0 && value.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.pathCharacters && !/[\x00-\x1f\x7f]/.test(value) && isAbsolute15(value) && resolve14(value) === value, "requires a normalized absolute path");
 }
 var sameFile2 = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode && a.uid === b.uid && a.gid === b.gid && a.nlink === b.nlink && a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs;
 function parents2(path) {
   const result = [];
-  for (let at = dirname14(path);; at = dirname14(at)) {
-    const stat2 = lstatSync18(at, { bigint: true });
-    need3(stat2.isDirectory() && !stat2.isSymbolicLink(), "path traverses a symlink or non-directory");
+  for (let at = dirname15(path);; at = dirname15(at)) {
+    const stat2 = lstatSync19(at, { bigint: true });
+    need5(stat2.isDirectory() && !stat2.isSymbolicLink(), "path traverses a symlink or non-directory");
     result.push([at, stat2]);
-    if (at === dirname14(at))
+    if (at === dirname15(at))
       return result;
   }
 }
 function readRegistry2(path, budget) {
-  absolutePath2(path);
-  need3(basename7(path) === "known_marketplaces.json", "requires known_marketplaces.json");
-  need3(Number.isSafeInteger(budget.remaining) && budget.remaining >= 0, "has an invalid byte budget");
-  const ancestors2 = parents2(path), initial = lstatSync18(path, { bigint: true });
-  need3(initial.isFile() && !initial.isSymbolicLink() && initial.size <= BigInt(CLAUDE_MARKETPLACE_REGISTRY_LIMITS.bytes), "is not a bounded regular file");
-  need3(initial.size <= BigInt(budget.remaining), "exceeds its aggregate byte limit");
-  const fd = openSync13(path, constants10.O_RDONLY | constants10.O_NOFOLLOW | constants10.O_NONBLOCK);
+  absolutePath3(path);
+  need5(basename8(path) === "known_marketplaces.json", "requires known_marketplaces.json");
+  need5(Number.isSafeInteger(budget.remaining) && budget.remaining >= 0, "has an invalid byte budget");
+  const ancestors2 = parents2(path), initial = lstatSync19(path, { bigint: true });
+  need5(initial.isFile() && !initial.isSymbolicLink() && initial.size <= BigInt(CLAUDE_MARKETPLACE_REGISTRY_LIMITS.bytes), "is not a bounded regular file");
+  need5(initial.size <= BigInt(budget.remaining), "exceeds its aggregate byte limit");
+  const fd = openSync11(path, constants10.O_RDONLY | constants10.O_NOFOLLOW | constants10.O_NONBLOCK);
   try {
-    const opened = fstatSync13(fd, { bigint: true });
-    need3(opened.isFile() && sameFile2(initial, opened), "changed during open");
+    const opened = fstatSync11(fd, { bigint: true });
+    need5(opened.isFile() && sameFile2(initial, opened), "changed during open");
     const bytes = Buffer.alloc(Number(opened.size) + 1);
     let length = 0;
     while (length < bytes.length) {
@@ -13575,11 +14596,11 @@ function readRegistry2(path, budget) {
         break;
       length += count;
     }
-    const after = fstatSync13(fd, { bigint: true }), current2 = lstatSync18(path, { bigint: true });
-    need3(current2.isFile() && sameFile2(opened, after) && sameFile2(after, current2) && BigInt(length) === opened.size, "changed during read");
+    const after = fstatSync11(fd, { bigint: true }), current2 = lstatSync19(path, { bigint: true });
+    need5(current2.isFile() && sameFile2(opened, after) && sameFile2(after, current2) && BigInt(length) === opened.size, "changed during read");
     for (const [ancestor, before] of ancestors2) {
-      const now = lstatSync18(ancestor, { bigint: true });
-      need3(now.isDirectory() && before.dev === now.dev && before.ino === now.ino && before.mode === now.mode, "parent changed during read");
+      const now = lstatSync19(ancestor, { bigint: true });
+      need5(now.isDirectory() && before.dev === now.dev && before.ino === now.ino && before.mode === now.mode, "parent changed during read");
     }
     budget.remaining -= length;
     try {
@@ -13588,7 +14609,7 @@ function readRegistry2(path, budget) {
       throw new Error("Claude marketplace registry is not strict UTF-8");
     }
   } finally {
-    closeSync13(fd);
+    closeSync11(fd);
   }
 }
 function parse6(text2) {
@@ -13599,7 +14620,7 @@ function parse6(text2) {
       at++;
   };
   function string() {
-    need3(text2[at] === '"', "contains invalid JSON");
+    need5(text2[at] === '"', "contains invalid JSON");
     const start = at++;
     while (at < text2.length) {
       const character = text2[at++];
@@ -13610,7 +14631,7 @@ function parse6(text2) {
         } catch {
           throw new Error("Claude marketplace registry contains invalid JSON string");
         }
-        need3(value2.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.stringCharacters, "exceeds its string limit");
+        need5(value2.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.stringCharacters, "exceeds its string limit");
         return value2;
       }
       if (character === "\\")
@@ -13619,7 +14640,7 @@ function parse6(text2) {
     throw new Error("Claude marketplace registry contains an unterminated JSON string");
   }
   function value(depth) {
-    need3(depth <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.depth && ++nodes <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.nodes, "exceeds its nesting or node limit");
+    need5(depth <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.depth && ++nodes <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.nodes, "exceeds its nesting or node limit");
     space();
     const character = text2[at];
     if (character === '"')
@@ -13627,26 +14648,26 @@ function parse6(text2) {
     if (character === "{" || character === "[") {
       at++;
       space();
-      const object4 = character === "{", end = object4 ? "}" : "]", entries = [], items = [], keys = new Set;
+      const object5 = character === "{", end = object5 ? "}" : "]", entries = [], items = [], keys = new Set;
       if (text2[at] !== end)
         while (true) {
-          if (object4) {
+          if (object5) {
             space();
             const key = string();
-            need3(!keys.has(key), "contains a duplicate JSON key");
+            need5(!keys.has(key), "contains a duplicate JSON key");
             keys.add(key);
             space();
-            need3(text2[at++] === ":", "contains invalid JSON");
+            need5(text2[at++] === ":", "contains invalid JSON");
             entries.push([key, value(depth + 1)]);
           } else
             items.push(value(depth + 1));
           space();
           if (text2[at] === end)
             break;
-          need3(text2[at++] === ",", "contains invalid JSON");
+          need5(text2[at++] === ",", "contains invalid JSON");
         }
       at++;
-      return object4 ? { kind: "object", entries } : { kind: "array", items };
+      return object5 ? { kind: "object", entries } : { kind: "array", items };
     }
     for (const literal of ["true", "false", "null"])
       if (text2.startsWith(literal, at)) {
@@ -13655,22 +14676,22 @@ function parse6(text2) {
       }
     numberPattern.lastIndex = at;
     const number = numberPattern.exec(text2);
-    need3(number, "contains invalid JSON");
+    need5(number, "contains invalid JSON");
     at += number[0].length;
     return { kind: "number", value: number[0] };
   }
   const root2 = value(0);
   space();
-  need3(at === text2.length && root2.kind === "object", "requires a JSON object without trailing content");
-  need3(root2.entries.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.rows, "exceeds its marketplace row limit");
+  need5(at === text2.length && root2.kind === "object", "requires a JSON object without trailing content");
+  need5(root2.entries.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.rows, "exceeds its marketplace row limit");
   return root2;
 }
 function exactKeys(value, keys) {
   return value?.kind === "object" && value.entries.length === keys.length && value.entries.every(([key]) => keys.includes(key));
 }
-var field = (object4, key) => object4.entries.find(([name]) => name === key)?.[1];
+var field = (object5, key) => object5.entries.find(([name]) => name === key)?.[1];
 function textField(value) {
-  need3(value?.kind === "string" && value.value.length > 0 && !/[\x00-\x1f\x7f]/.test(value.value), "contains an invalid recognized field");
+  need5(value?.kind === "string" && value.value.length > 0 && !/[\x00-\x1f\x7f]/.test(value.value), "contains an invalid recognized field");
   return value.value;
 }
 function normalizeRow(row, version = 1) {
@@ -13678,7 +14699,7 @@ function normalizeRow(row, version = 1) {
     if (version !== 2 || !exactKeys(row, ["source", "installLocation", "lastUpdated", "autoUpdate"]))
       return;
     const autoUpdate = field(row, "autoUpdate");
-    need3(autoUpdate?.kind === "literal" && (autoUpdate.value === "true" || autoUpdate.value === "false"), "contains an invalid automatic-update preference");
+    need5(autoUpdate?.kind === "literal" && (autoUpdate.value === "true" || autoUpdate.value === "false"), "contains an invalid automatic-update preference");
   }
   const source = field(row, "source");
   if (source?.kind !== "object")
@@ -13691,52 +14712,52 @@ function normalizeRow(row, version = 1) {
     return;
   const sourceLocation = textField(field(source, location));
   if (type.value === "directory")
-    absolutePath2(sourceLocation);
-  absolutePath2(textField(field(row, "installLocation")));
+    absolutePath3(sourceLocation);
+  absolutePath3(textField(field(row, "installLocation")));
   const updated = textField(field(row, "lastUpdated"));
-  need3(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(updated), "contains an invalid recognized update timestamp");
+  need5(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(updated), "contains an invalid recognized update timestamp");
   const millis = Date.parse(updated);
-  need3(Number.isFinite(millis) && new Date(millis).toISOString() === updated, "contains an invalid recognized update timestamp");
+  need5(Number.isFinite(millis) && new Date(millis).toISOString() === updated, "contains an invalid recognized update timestamp");
   row.entries = row.entries.map(([key, value]) => [key, key === "lastUpdated" ? { kind: "validated-update-time" } : value]);
 }
 function captureClaudeMarketplaceRegistry(path, budget = { remaining: 256 * 1024 * 1024 }) {
   const value = parse6(readRegistry2(path, budget));
   for (const [, row] of value.entries)
     normalizeRow(row);
-  const sha2562 = createHash13("sha256").update("hasna.skills.claude-marketplace-registry.v1\x00").update(JSON.stringify(value)).digest("hex");
+  const sha2562 = createHash15("sha256").update("hasna.skills.claude-marketplace-registry.v1\x00").update(JSON.stringify(value)).digest("hex");
   return { path, hashMode: "claude-marketplace-registry", sha256: sha2562 };
 }
 function captureClaudeMarketplaceRegistryV2(path, budget = { remaining: 256 * 1024 * 1024 }) {
   const value = parse6(readRegistry2(path, budget));
   for (const [, row] of value.entries)
     normalizeRow(row, 2);
-  const sha2562 = createHash13("sha256").update("hasna.skills.claude-marketplace-registry.v2\x00").update(JSON.stringify(value)).digest("hex");
+  const sha2562 = createHash15("sha256").update("hasna.skills.claude-marketplace-registry.v2\x00").update(JSON.stringify(value)).digest("hex");
   return { path, hashMode: "claude-marketplace-registry-v2", sha256: sha2562 };
 }
-function need4(value, code) {
+function need6(value, code) {
   if (!value)
     throw new Error(`CODEX_HOOK_TRUST_${code}`);
 }
 var sameStat = (a, b) => ["dev", "ino", "uid", "nlink", "mode", "size", "mtimeNs", "ctimeNs"].every((key) => a[key] === b[key]);
 function safeParents(file) {
-  for (let p = dirname15(file);; p = dirname15(p)) {
-    const s = lstatSync19(p);
-    need4(s.isDirectory() && !s.isSymbolicLink(), "UNSAFE_PARENT");
-    need4((s.mode & 18) === 0 || s.uid === 0 && (s.mode & 512) !== 0, "UNSAFE_PARENT");
-    if (dirname15(p) === p)
+  for (let p = dirname16(file);; p = dirname16(p)) {
+    const s = lstatSync20(p);
+    need6(s.isDirectory() && !s.isSymbolicLink(), "UNSAFE_PARENT");
+    need6((s.mode & 18) === 0 || s.uid === 0 && (s.mode & 512) !== 0, "UNSAFE_PARENT");
+    if (dirname16(p) === p)
       break;
   }
 }
 function snapshot(file, privateFile = false, options = {}) {
   const readOnlyPackage = options.readOnlyPackage === true && !privateFile;
   safeParents(file);
-  const initial = lstatSync19(file, { bigint: true });
-  need4(initial.isFile() && initial.uid === BigInt(process.getuid()) && (initial.nlink === 1n || readOnlyPackage && initial.nlink > 1n) && (initial.mode & 0o022n) === 0n && (!privateFile || (initial.mode & 0o777n) === 0o600n), "UNSAFE_FILE");
-  need4(initial.size <= 8n * 1024n * 1024n, "FILE_BOUND");
-  const fd = openSync14(file, constants11.O_RDONLY | constants11.O_NOFOLLOW | constants11.O_NONBLOCK);
+  const initial = lstatSync20(file, { bigint: true });
+  need6(initial.isFile() && initial.uid === BigInt(process.getuid()) && (initial.nlink === 1n || readOnlyPackage && initial.nlink > 1n) && (initial.mode & 0o022n) === 0n && (!privateFile || (initial.mode & 0o777n) === 0o600n), "UNSAFE_FILE");
+  need6(initial.size <= 8n * 1024n * 1024n, "FILE_BOUND");
+  const fd = openSync12(file, constants11.O_RDONLY | constants11.O_NOFOLLOW | constants11.O_NONBLOCK);
   try {
-    const before = fstatSync14(fd, { bigint: true });
-    need4(sameStat(initial, before), "INPUT_CHANGED");
+    const before = fstatSync12(fd, { bigint: true });
+    need6(sameStat(initial, before), "INPUT_CHANGED");
     const bytes = Buffer.alloc(Number(before.size) + 1);
     let length = 0;
     while (length < bytes.length) {
@@ -13745,25 +14766,26 @@ function snapshot(file, privateFile = false, options = {}) {
         break;
       length += n2;
     }
-    need4(length === Number(before.size) && sameStat(before, fstatSync14(fd, { bigint: true })) && sameStat(before, lstatSync19(file, { bigint: true })), "INPUT_CHANGED");
+    need6(length === Number(before.size) && sameStat(before, fstatSync12(fd, { bigint: true })) && sameStat(before, lstatSync20(file, { bigint: true })), "INPUT_CHANGED");
     const content = bytes.subarray(0, length), text2 = new TextDecoder("utf-8", { fatal: true }).decode(content);
-    return { file, privateFile, readOnlyPackage, text: text2, bytes: content, stat: before, sha256: createHash14("sha256").update(content).digest("hex") };
+    return { file, privateFile, readOnlyPackage, text: text2, bytes: content, stat: before, sha256: createHash16("sha256").update(content).digest("hex") };
   } finally {
-    closeSync14(fd);
+    closeSync12(fd);
   }
 }
 function unchanged2(before) {
   const after = snapshot(before.file, before.privateFile, before.readOnlyPackage ? { readOnlyPackage: true } : {});
-  need4(sameStat(before.stat, after.stat) && after.sha256 === before.sha256, "INPUT_CHANGED");
+  need6(sameStat(before.stat, after.stat) && after.sha256 === before.sha256, "INPUT_CHANGED");
 }
 var events = { UserPromptSubmit: ["userPromptSubmit", "user_prompt_submit"], SessionStart: ["sessionStart", "session_start"], SubagentStart: ["subagentStart", "subagent_start"] };
 var matchedEvents = { ...events, PreToolUse: ["preToolUse", "pre_tool_use"] };
 var proofs = new WeakMap;
-var sha2 = (text2) => createHash15("sha256").update(text2).digest("hex");
+var sha4 = (text2) => createHash17("sha256").update(text2).digest("hex");
+var fields = [...CODEX_DISCOVERY_PROJECTION_FIELDS];
 var proofs2 = new WeakMap;
 function assertCodexHookDiscoveryRecovery(binding, witness) {
   const proof = proofs2.get(witness);
-  need4(!!proof && binding.agent === "codex" && witness.discoverySha256 === sha2(JSON.stringify(binding)), "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
+  need6(!!proof && binding.agent === "codex" && witness.discoverySha256 === sha4(JSON.stringify(binding)), "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
   unchanged2(proof.before);
   unchanged2(proof.current);
   proof.recheckAdditions();
@@ -13772,10 +14794,10 @@ function verifiesCodexHookDiscoverySource(binding, source, currentDigest, witnes
   if (!witness || source.path !== witness.configPath || source.hashMode !== "bytes")
     return false;
   assertCodexHookDiscoveryRecovery(binding, witness);
-  need4(source.sha256 === witness.beforeSha256 && currentDigest === witness.currentSha256, "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
+  need6(source.sha256 === witness.beforeSha256 && currentDigest === witness.currentSha256, "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
   return true;
 }
-var digest = (text2) => createHash16("sha256").update(text2).digest("hex");
+var digest = (text2) => createHash18("sha256").update(text2).digest("hex");
 function parseConfig(text2, path, toml = false) {
   try {
     const value = toml ? Bun.TOML.parse(text2) : JSON.parse(text2);
@@ -13787,12 +14809,12 @@ function parseConfig(text2, path, toml = false) {
   }
 }
 function safe4(path) {
-  if (!isAbsolute14(path) || path.includes("\x00"))
+  if (!isAbsolute16(path) || path.includes("\x00"))
     throw new Error("Expected an absolute native discovery path");
-  for (let cursor = path;; cursor = dirname16(cursor)) {
-    if (lstatSync20(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+  for (let cursor = path;; cursor = dirname17(cursor)) {
+    if (lstatSync21(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink native discovery input: ${cursor}`);
-    if (dirname16(cursor) === cursor)
+    if (dirname17(cursor) === cursor)
       break;
   }
 }
@@ -13800,14 +14822,34 @@ function read2(path, changes) {
   safe4(path);
   if (changes?.has(path))
     return changes.get(path);
-  const stat2 = lstatSync20(path, { throwIfNoEntry: false });
+  const stat2 = lstatSync21(path, { throwIfNoEntry: false });
   if (!stat2)
     return null;
   if (!stat2.isFile() || stat2.size > 16 * 1024 * 1024)
     throw new Error(`Unsupported or oversized native discovery input: ${path}`);
-  return readFileSync16(path, "utf8");
+  return readFileSync17(path, "utf8");
+}
+function projectNativeDiscoveryFields(text2, format, fields2, path) {
+  const object5 = format === "yaml" ? parseHermesConfig(text2) : parseConfig(text2, path, format === "toml");
+  if (!object5 || typeof object5 !== "object" || Array.isArray(object5))
+    throw new Error("Expected native discovery configuration object");
+  return digest(JSON.stringify(Object.fromEntries(fields2.map((field2) => [field2, object5[field2] ?? null]))));
+}
+function isSupersededCodexProjection(agent, configPath, source) {
+  return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual5(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
+}
+function supersedesCodexProjection(sources, configPath) {
+  return sources.some((source) => source.path === configPath && (source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"));
 }
 function projected(source, changes, budget = discoveryByteBudget()) {
+  if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3") {
+    if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
+      throw new Error("Codex settings witnesses require exact typed metadata");
+    const current2 = (source.hashMode === "codex-settings-v3" ? captureCodexSettingsV3 : source.hashMode === "codex-settings-v2" ? captureCodexSettingsV2 : captureCodexSettings)(source.path, budget).sha256;
+    if (current2 !== source.sha256)
+      throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
+    return changes?.has(source.path) ? (source.hashMode === "codex-settings-v3" ? hashCodexSettingsReplacementV3 : source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget) : current2;
+  }
   if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Claude settings witnesses require exact typed metadata");
@@ -13845,10 +14887,7 @@ function projected(source, changes, budget = discoveryByteBudget()) {
     return null;
   if (!source.format)
     return digest(text2);
-  const object4 = source.format === "yaml" ? parseHermesConfig(text2) : parseConfig(text2, source.path, source.format === "toml");
-  if (!object4 || typeof object4 !== "object" || Array.isArray(object4))
-    throw new Error("Expected native discovery configuration object");
-  return digest(JSON.stringify(Object.fromEntries((source.fields ?? []).map((field2) => [field2, object4[field2] ?? null]))));
+  return projectNativeDiscoveryFields(text2, source.format, source.fields ?? [], source.path);
 }
 function verifyAgentDiscovery(binding, codexRecovery) {
   if (codexRecovery)
@@ -13857,8 +14896,16 @@ function verifyAgentDiscovery(binding, codexRecovery) {
     throw new Error("Invalid native discovery binding");
   if (binding.agent === "hermes" && !binding.directories?.length)
     throw new Error("Hermes discovery requires directory membership coverage; run skills hook install with a fresh discovery review");
-  if (binding.directories !== undefined)
-    verifyDiscoveryDirectories(binding.directories);
+  const installationRoots = codexInstallationRoots(binding);
+  const installationInput = (path) => installationRoots.some((root2) => path === root2 || path.startsWith(root2 + sep6));
+  if (binding.directories !== undefined) {
+    const projected2 = binding.codexInstallationInputs?.directories ?? [];
+    const ancestors2 = binding.directories.filter((directory) => installationRoots.some((root2) => root2.startsWith(directory.path + sep6)));
+    if (projected2.length !== ancestors2.length || projected2.some((directory) => !ancestors2.some((original) => original.path === directory.path)))
+      throw new Error("Missing installation input directory projection");
+    verifyDiscoveryDirectories(binding.directories.filter((directory) => !installationInput(directory.path) && !ancestors2.includes(directory)));
+    verifyDiscoveryDirectories(projected2, installationRoots);
+  }
   const budget = discoveryByteBudget();
   for (const source of binding.sources) {
     assertMarketplaceBinding(binding, source);
@@ -13868,6 +14915,10 @@ function verifyAgentDiscovery(binding, codexRecovery) {
       throw new Error("Invalid native discovery projection");
     if (source.sha256 !== null && !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Invalid native discovery digest");
+    if (installationInput(source.path)) {
+      safe4(source.path);
+      continue;
+    }
     const current2 = projected(source, undefined, budget);
     if (current2 !== source.sha256 && !verifiesCodexHookDiscoverySource(binding, source, current2, codexRecovery))
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
@@ -13875,25 +14926,52 @@ function verifyAgentDiscovery(binding, codexRecovery) {
   for (const root2 of binding.roots)
     safe4(root2);
 }
+function codexInstallationRoots(binding) {
+  const proof = binding.codexInstallationInputs;
+  if (proof === undefined)
+    return [];
+  if (binding.agent !== "codex" || binding.method !== "reviewed" || proof.version !== "codex-cli 0.160.0" || !/^[a-f0-9]{64}$/.test(proof.catalogSha256) || !Array.isArray(proof.plugins) || !proof.plugins.length)
+    throw new Error("Invalid native installation input proof");
+  const cache = dirname17(dirname17(proof.plugins[0].pluginParent));
+  const config = join27(dirname17(dirname17(cache)), "config.toml"), home = dirname17(dirname17(dirname17(cache)));
+  const configSource = binding.sources.find((source) => source.path === config && source.sha256 !== null && (!source.format || source.format === "toml" && source.fields?.includes("plugins")));
+  const nativeRoots = NATIVE_SKILL_ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => join27(home, path));
+  if (!configSource || proof.plugins.some((input) => nativeRoots.some((root2) => root2 === input.sourceRoot || root2.startsWith(input.sourceRoot + sep6) || input.sourceRoot.startsWith(root2 + sep6)) || binding.sources.some((source) => basename9(source.path) === "config.toml" && (source.path === input.sourceRoot || source.path.startsWith(input.sourceRoot + sep6)))))
+    throw new Error("Native installation input overlaps configuration or loading roots");
+  if (proof.plugins.some((input) => dirname17(dirname17(input.pluginParent)) !== cache || !binding.sources.some((source) => source.path === join27(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined)))
+    throw new Error("Missing native installation input source witness");
+  return reviewedCodexPluginSourceRoots(cache, proof.plugins, (path) => {
+    const text2 = read2(path);
+    if (text2 === null)
+      throw new Error("Missing native installation input");
+    return text2;
+  });
+}
 function assertMarketplaceBinding(binding, source) {
-  if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename8(source.path) !== "settings.json"))
+  if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3") && (binding.agent !== "codex" || binding.method !== "reviewed" || basename9(source.path) !== "config.toml"))
+    throw new Error("Codex settings witnesses require explicit reviewed Codex configuration");
+  if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename9(source.path) !== "settings.json"))
     throw new Error("Claude settings witnesses require explicit reviewed Claude configuration");
   if ((source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2") && (binding.agent !== "claude" || binding.method !== "reviewed"))
     throw new Error("Claude marketplace witnesses require explicit reviewed Claude discovery");
 }
 function rebindAgentDiscovery(binding, changes) {
   const budget = discoveryByteBudget();
+  const installationRoots = codexInstallationRoots(binding);
   return { ...binding, sources: binding.sources.map((source) => {
     assertMarketplaceBinding(binding, source);
+    if (!changes.has(source.path) && installationRoots.some((root2) => source.path.startsWith(root2 + sep6)))
+      return source;
     const sha2562 = projected(source, changes, budget);
     if (!changes.has(source.path) && sha2562 !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
     return { ...source, sha256: sha2562 };
   }) };
 }
-function assertProjectDiscovery(agent, directories, home, canonical4 = resolve14, reviewed) {
+function assertProjectDiscovery(agent, directories, home, canonical6 = resolve15, reviewed) {
+  const homeConfigPath = canonical6(agentDiscoveryConfigPath(home, agent));
   for (const directory of directories) {
-    const isHome = resolve14(directory) === resolve14(home);
+    const isHome = resolve15(directory) === resolve15(home);
     if (agent === "hermes") {
       assertHermesEnvironment(home);
       continue;
@@ -13902,10 +14980,11 @@ function assertProjectDiscovery(agent, directories, home, canonical4 = resolve14
       continue;
     const paths = agent === "claude" ? [...isHome ? [] : [".claude/settings.json"], ".claude/settings.local.json"] : agent === "codex" ? [".codex/config.toml"] : agent === "gemini" ? [".gemini/settings.json"] : agent === "opencode" ? ["opencode.json", "opencode.jsonc", ".opencode/opencode.json", ".opencode/opencode.jsonc"] : [".cursor/hooks.json"];
     for (const suffix of paths) {
-      const path = canonical4(join26(directory, suffix)), raw = read2(path);
+      const path = canonical6(join27(directory, suffix)), raw = read2(path);
       if (raw === null)
         continue;
-      if (agent === "claude" && suffix === ".claude/settings.json" && path === canonical4(join26(home, suffix)))
+      const isRootAliasedHomeConfig = agent === "claude" && suffix === ".claude/settings.json" || agent === "codex" && suffix === ".codex/config.toml";
+      if (isRootAliasedHomeConfig && path === homeConfigPath)
         continue;
       if (suffix.endsWith(".jsonc"))
         throw new Error(`NATIVE_SKILL_DRIFT: project JSONC discovery configuration requires review: ${path}`);
@@ -13917,28 +14996,28 @@ function assertProjectDiscovery(agent, directories, home, canonical4 = resolve14
         const managed = reviewed.sources.flatMap((source) => source.hashMode === "claude-plugin-registry" ? source.managedPlugins ?? [] : []);
         if (exact && projected(exact) === exact.sha256 && managed.length) {
           const bindings = managed.map((item) => readPluginBinding(item.storeRoot, item.bindingId));
-          admittedPlugins = Object.entries(config.enabledPlugins).every(([id, enabled]) => typeof enabled === "boolean" && bindings.some((binding) => binding.target.pluginId === id && binding.target.registrations.some((scope) => scope.scope === "project" && scope.projectPath === canonical4(directory))));
+          admittedPlugins = Object.entries(config.enabledPlugins).every(([id, enabled]) => typeof enabled === "boolean" && bindings.some((binding) => binding.target.pluginId === id && binding.target.registrations.some((scope) => scope.scope === "project" && scope.projectPath === canonical6(directory))));
         }
       }
       if (keys.some((key) => config[key] !== undefined && !(key === "enabledPlugins" && admittedPlugins)) || config.disableAllHooks === true || config.disableBundledSkills === false || config.hooksConfig?.enabled === false || config.permission?.skill !== undefined || config.permissions?.deny?.some((rule) => typeof rule === "string" && /^Skill(?:\(|$)/.test(rule)))
         throw new Error(`NATIVE_SKILL_DRIFT: higher-precedence project skill or hook configuration requires review: ${path}`);
     }
     if (agent === "claude") {
-      const commands = canonical4(join26(directory, ".claude/commands"));
+      const commands = canonical6(join27(directory, ".claude/commands"));
       safe4(commands);
-      if (lstatSync20(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length)
+      if (lstatSync21(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync10(commands).length)
         throw new Error("NATIVE_SKILL_DRIFT: legacy project command discovery requires a dedicated format adapter");
     }
   }
 }
 function agentDiscoveryConfigPath(home, agent) {
-  return join26(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
+  return join27(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
 }
 function resolveAgentDiscovery(options) {
-  const canonical4 = options.canonical ?? resolve14, home = resolve14(options.home), agent = options.agent;
+  const canonical6 = options.canonical ?? resolve15, home = resolve15(options.home), agent = options.agent;
   const sources = [], roots = new Set, builtinNames = [];
-  const witness = (path, format, fields) => {
-    const source = { path: canonical4(path), sha256: null, ...format ? { format, fields } : {} };
+  const witness = (path, format, fields2) => {
+    const source = { path: canonical6(path), sha256: null, ...format ? { format, fields: fields2 } : {} };
     source.sha256 = projected(source);
     sources.push(source);
     return read2(source.path);
@@ -13946,13 +15025,13 @@ function resolveAgentDiscovery(options) {
   if (agent === "hermes")
     assertHermesEnvironment(home);
   const configPath = agentDiscoveryConfigPath(home, agent);
-  const configText = witness(configPath, agent === "hermes" ? "yaml" : agent === "codex" ? "toml" : "json", agent === "hermes" ? ["skills", "plugins", "hooks"] : agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces"] : agent === "codex" ? ["plugins", "marketplaces", "skills"] : agent === "gemini" ? ["skills", "extensions", "security"] : agent === "opencode" ? ["plugin", "skills"] : ["version"]);
+  const configText = witness(configPath, agent === "hermes" ? "yaml" : agent === "codex" ? "toml" : "json", agent === "hermes" ? ["skills", "plugins", "hooks"] : agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces"] : agent === "codex" ? [...CODEX_DISCOVERY_PROJECTION_FIELDS] : agent === "gemini" ? ["skills", "extensions", "security"] : agent === "opencode" ? ["plugin", "skills"] : ["version"]);
   const config = configText === null ? {} : agent === "hermes" ? parseHermesConfig(configText) : parseConfig(configText, configPath, agent === "codex");
   const unresolved = (detail) => {
     throw new Error(`Native discovery is unresolved (${agent}: ${detail}); provide a reviewed --discovery-inputs file`);
   };
   if (agent === "hermes") {
-    const profile = witness(join26(home, ".hermes/active_profile"));
+    const profile = witness(join27(home, ".hermes/active_profile"));
     if (profile?.trim() && profile.trim() !== "default")
       unresolved("a non-default profile is active");
     const declared = config.skills?.external_dirs ?? [], paths = typeof declared === "string" ? [declared] : declared;
@@ -13966,7 +15045,7 @@ function resolveAgentDiscovery(options) {
         continue;
       if (normalized.startsWith("~") && normalized !== "~" && !normalized.startsWith("~/"))
         unresolved("user-specific tilde expansion requires a separate discovery adapter");
-      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join26(home, normalized.slice(2)) : resolve14(home, ".hermes", normalized);
+      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join27(home, normalized.slice(2)) : resolve15(home, ".hermes", normalized);
       safe4(path);
       roots.add(path);
     }
@@ -13975,24 +15054,24 @@ function resolveAgentDiscovery(options) {
     const executable = Bun.which("gemini");
     if (executable) {
       let packageRoot;
-      for (let directory = dirname16(realpathSync4(executable)), depth = 0;depth < 8; directory = dirname16(directory), depth++) {
-        const path = join26(directory, "package.json"), raw = read2(path);
+      for (let directory = dirname17(realpathSync7(executable)), depth = 0;depth < 8; directory = dirname17(directory), depth++) {
+        const path = join27(directory, "package.json"), raw = read2(path);
         if (raw !== null && parseConfig(raw, path).name === "@google/gemini-cli") {
           packageRoot = directory;
           witness(path);
           break;
         }
-        if (dirname16(directory) === directory)
+        if (dirname17(directory) === directory)
           break;
       }
       if (!packageRoot)
         unresolved("installed Gemini package layout is not recognized");
-      const builtinRoot = join26(packageRoot, "bundle/builtin");
+      const builtinRoot = join27(packageRoot, "bundle/builtin");
       safe4(builtinRoot);
-      if (!lstatSync20(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
+      if (!lstatSync21(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
         unresolved("installed Gemini builtin root is missing");
-      for (const name of readdirSync9(builtinRoot).sort()) {
-        const text2 = witness(join26(builtinRoot, name, "SKILL.md"));
+      for (const name of readdirSync10(builtinRoot).sort()) {
+        const text2 = witness(join27(builtinRoot, name, "SKILL.md"));
         const match = text2?.match(/^---\r?\n[\s\S]*?^name:\s*([a-z0-9][a-z0-9-]*)\s*$/m);
         if (!match?.[1] || builtinNames.includes(match[1]))
           unresolved("installed Gemini builtin name is missing or ambiguous");
@@ -14005,11 +15084,12 @@ function resolveAgentDiscovery(options) {
     if (retained.agent !== agent || retained.method !== "reviewed")
       unresolved("invalid retained review");
     verifyAgentDiscovery(retained);
-    if (!retained.sources.some((source) => source.path === canonical4(configPath) && source.format === undefined && source.fields === undefined))
+    if (!retained.sources.some((source) => source.path === canonical6(configPath) && source.format === undefined && source.fields === undefined))
       unresolved("retained review is missing the full agent configuration source");
-    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && source.path !== canonical4(configPath)))
+    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"))) && source.path !== canonical6(configPath)))
       unresolved("retained settings witness names another configuration source");
-    if (sources.some((source) => !retained.sources.some((saved) => isDeepStrictEqual3(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
+    const covered = supersedesCodexProjection(retained.sources, canonical6(configPath)) ? sources.filter((source) => !isSupersededCodexProjection(agent, canonical6(configPath), source)) : sources;
+    if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual5(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
       unresolved("retained review is missing current runtime discovery coverage");
     return retained;
   }
@@ -14023,48 +15103,49 @@ function resolveAgentDiscovery(options) {
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
-    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && source.path !== canonical4(configPath)))
+    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"))) && source.path !== canonical6(configPath)))
       throw new Error("Semantic settings witnesses must name the configured Claude configuration source");
-    if (!review.sources.some((source) => source.path === canonical4(configPath)))
+    if (!review.sources.some((source) => source.path === canonical6(configPath)))
       throw new Error("Discovery review must include the agent configuration source");
-    return { ...supplied, roots: [...new Set([...roots, ...supplied.roots])].sort(), sources: [...sources, ...review.sources], ...agent === "gemini" ? { builtinNames } : {} };
+    const reviewedSources = supersedesCodexProjection(review.sources, canonical6(configPath)) ? sources.filter((source) => !isSupersededCodexProjection(agent, canonical6(configPath), source)) : sources;
+    return { ...supplied, roots: [...new Set([...roots, ...supplied.roots])].sort(), sources: [...reviewedSources, ...review.sources], ...agent === "gemini" ? { builtinNames } : {} };
   }
   function plugin(root2) {
-    root2 = canonical4(root2);
+    root2 = canonical6(root2);
     safe4(root2);
-    const manifestPath = join26(root2, agent === "claude" ? ".claude-plugin/plugin.json" : ".codex-plugin/plugin.json");
+    const manifestPath = join27(root2, agent === "claude" ? ".claude-plugin/plugin.json" : ".codex-plugin/plugin.json");
     const raw = witness(manifestPath);
     if (raw === null)
       unresolved("plugin manifest missing");
     const manifest = parseConfig(raw, manifestPath);
-    const hooks = witness(join26(root2, "hooks/hooks.json"));
+    const hooks = witness(join27(root2, "hooks/hooks.json"));
     if (manifest.hooks !== undefined || hooks !== null)
       unresolved("plugin hooks require a separate no-skill-injection review");
-    const commands = join26(root2, "commands");
+    const commands = join27(root2, "commands");
     safe4(commands);
-    if (agent === "claude" && (manifest.commands !== undefined || lstatSync20(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length))
+    if (agent === "claude" && (manifest.commands !== undefined || lstatSync21(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync10(commands).length))
       unresolved("legacy command discovery requires retirement or a dedicated format adapter");
-    const rootSkill = witness(join26(root2, "SKILL.md"));
+    const rootSkill = witness(join27(root2, "SKILL.md"));
     if (rootSkill !== null)
       roots.add(root2);
     const declared = manifest.skills === undefined ? ["./skills"] : typeof manifest.skills === "string" ? [manifest.skills] : manifest.skills;
     if (!Array.isArray(declared) || declared.some((path) => typeof path !== "string"))
       unresolved("unsupported plugin skill paths");
     if (agent === "claude")
-      roots.add(join26(root2, "skills"));
+      roots.add(join27(root2, "skills"));
     for (const value of declared) {
-      const path = resolve14(root2, value);
-      if (path !== root2 && !path.startsWith(root2 + sep5))
+      const path = resolve15(root2, value);
+      if (path !== root2 && !path.startsWith(root2 + sep6))
         unresolved("plugin skill path escapes its root");
-      roots.add(path.endsWith(`${sep5}SKILL.md`) ? dirname16(path) : path);
+      roots.add(path.endsWith(`${sep6}SKILL.md`) ? dirname17(path) : path);
     }
   }
   if (agent === "claude") {
-    const registrations = witness(join26(home, ".claude/plugins/installed_plugins.json"));
-    const installed = registrations === null ? {} : parseConfig(registrations, join26(home, ".claude/plugins/installed_plugins.json")).plugins;
-    const commands = canonical4(join26(home, ".claude/commands"));
+    const registrations = witness(join27(home, ".claude/plugins/installed_plugins.json"));
+    const installed = registrations === null ? {} : parseConfig(registrations, join27(home, ".claude/plugins/installed_plugins.json")).plugins;
+    const commands = canonical6(join27(home, ".claude/commands"));
     safe4(commands);
-    if (lstatSync20(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length)
+    if (lstatSync21(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync10(commands).length)
       unresolved("legacy home command discovery requires a dedicated format adapter");
     for (const [id, enabled] of Object.entries(config.enabledPlugins ?? {})) {
       if (enabled === false)
@@ -14084,34 +15165,34 @@ function resolveAgentDiscovery(options) {
         unresolved("unsupported plugin enablement");
       const split = id.lastIndexOf("@"), name = id.slice(0, split), marketplace = id.slice(split + 1);
       const market = config.marketplaces?.[marketplace] ?? (marketplace === "personal" ? { source_type: "local", source: home } : undefined);
-      if (split < 1 || market?.source_type !== "local" || typeof market.source !== "string" || !isAbsolute14(market.source))
+      if (split < 1 || market?.source_type !== "local" || typeof market.source !== "string" || !isAbsolute16(market.source))
         unresolved("enabled plugin marketplace is not an explicit local source");
-      const catalogText = witness(join26(market.source, ".agents/plugins/marketplace.json"));
+      const catalogText = witness(join27(market.source, ".agents/plugins/marketplace.json"));
       if (catalogText === null)
         unresolved("marketplace catalog missing");
-      const catalog = parseConfig(catalogText, join26(market.source, ".agents/plugins/marketplace.json")), matches = Array.isArray(catalog.plugins) ? catalog.plugins.filter((item) => item.name === name) : [];
+      const catalog = parseConfig(catalogText, join27(market.source, ".agents/plugins/marketplace.json")), matches = Array.isArray(catalog.plugins) ? catalog.plugins.filter((item) => item.name === name) : [];
       if (matches.length !== 1 || matches[0]?.source?.source !== "local" || typeof matches[0]?.source?.path !== "string")
         unresolved("plugin catalog source is missing or ambiguous");
-      plugin(resolve14(market.source, matches[0].source.path));
+      plugin(resolve15(market.source, matches[0].source.path));
     }
   } else if (agent === "opencode") {
-    if (witness(join26(home, ".config/opencode/opencode.jsonc")) !== null || witness(join26(home, ".config/opencode/config.json")) !== null)
+    if (witness(join27(home, ".config/opencode/opencode.jsonc")) !== null || witness(join27(home, ".config/opencode/config.json")) !== null)
       unresolved("additional config layers require review");
     if ((config.plugin?.length ?? 0) > 0 || config.skills?.urls?.length)
       unresolved("external plugin or remote skill source");
     for (const path of config.skills?.paths ?? []) {
-      if (typeof path !== "string" || !isAbsolute14(path))
+      if (typeof path !== "string" || !isAbsolute16(path))
         unresolved("relative or malformed added skill root");
       roots.add(path);
     }
-    const localPlugins = join26(home, ".config/opencode/plugins");
+    const localPlugins = join27(home, ".config/opencode/plugins");
     safe4(localPlugins);
-    if (lstatSync20(localPlugins, { throwIfNoEntry: false }) && readdirSync9(localPlugins).some((name) => name !== "skills-cli.js"))
+    if (lstatSync21(localPlugins, { throwIfNoEntry: false }) && readdirSync10(localPlugins).some((name) => name !== "skills-cli.js"))
       unresolved("additional local plugin hooks require review");
   } else if (agent === "hermes") {
-    for (const directory of [join26(home, ".hermes/plugins"), join26(home, ".hermes/hermes-agent")]) {
+    for (const directory of [join27(home, ".hermes/plugins"), join27(home, ".hermes/hermes-agent")]) {
       safe4(directory);
-      if (lstatSync20(directory, { throwIfNoEntry: false }))
+      if (lstatSync21(directory, { throwIfNoEntry: false }))
         unresolved("installed runtime/plugin discovery requires reviewed source bindings");
     }
     if (Bun.which("hermes") || Object.keys(config.plugins ?? {}).length)
@@ -14119,24 +15200,24 @@ function resolveAgentDiscovery(options) {
   } else if (agent === "gemini") {
     if (Object.keys(config.extensions ?? {}).length || config.skills?.paths?.length)
       unresolved("custom extension or skill paths");
-    const directory = join26(home, ".gemini/extensions");
+    const directory = join27(home, ".gemini/extensions");
     safe4(directory);
-    if (lstatSync20(directory, { throwIfNoEntry: false }))
-      for (const name of readdirSync9(directory)) {
-        const root2 = join26(directory, name);
+    if (lstatSync21(directory, { throwIfNoEntry: false }))
+      for (const name of readdirSync10(directory)) {
+        const root2 = join27(directory, name);
         safe4(root2);
-        if (!lstatSync20(root2)?.isDirectory())
+        if (!lstatSync21(root2)?.isDirectory())
           continue;
-        const raw = witness(join26(root2, "gemini-extension.json"));
+        const raw = witness(join27(root2, "gemini-extension.json"));
         if (raw === null)
           unresolved("extension registration missing");
-        const manifest = parseConfig(raw, join26(root2, "gemini-extension.json"));
-        if (manifest.hooks !== undefined || witness(join26(root2, "hooks/hooks.json")) !== null || witness(join26(root2, ".gemini-extension-install.json")) !== null)
+        const manifest = parseConfig(raw, join27(root2, "gemini-extension.json"));
+        if (manifest.hooks !== undefined || witness(join27(root2, "hooks/hooks.json")) !== null || witness(join27(root2, ".gemini-extension-install.json")) !== null)
           unresolved("extension hooks or linked registration require review");
-        roots.add(join26(root2, "skills"));
+        roots.add(join27(root2, "skills"));
       }
   }
-  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {}, ...agent === "hermes" ? { directories: captureDiscoveryDirectories([join26(home, ".hermes/plugins"), join26(home, ".hermes/hermes-agent")].map((path) => canonical4(path))) } : {} };
+  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {}, ...agent === "hermes" ? { directories: captureDiscoveryDirectories([join27(home, ".hermes/plugins"), join27(home, ".hermes/hermes-agent")].map((path) => canonical6(path))) } : {} };
 }
 var NATIVE_DISCOVERY_ROOTS = NATIVE_SKILL_ROOTS.map(([, path]) => path.split("/"));
 var OFFICIAL_SKILL_NAMES = new Set(SKILLS.map((skill) => skill.name));
@@ -14191,7 +15272,7 @@ __export2(exports_external, {
   regexes: () => exports_regexes,
   regex: () => _regex,
   refine: () => refine,
-  record: () => record2,
+  record: () => record3,
   readonly: () => readonly,
   property: () => _property,
   properties: () => _properties,
@@ -14207,7 +15288,7 @@ __export2(exports_external, {
   overwrite: () => _overwrite,
   output: () => output,
   optional: () => optional,
-  object: () => object4,
+  object: () => object5,
   number: () => number2,
   nullish: () => nullish2,
   nullable: () => nullable,
@@ -14256,7 +15337,7 @@ __export2(exports_external, {
   input: () => input,
   includes: () => _includes,
   httpUrl: () => httpUrl,
-  hostname: () => hostname2,
+  hostname: () => hostname3,
   hex: () => hex2,
   hash: () => hash2,
   guid: () => guid2,
@@ -14833,9 +15914,9 @@ function floatSafeRemainder(val, step) {
   return ratio - roundedRatio;
 }
 var EVALUATING = /* @__PURE__ */ Symbol("evaluating");
-function defineLazy(object4, key, getter) {
+function defineLazy(object5, key, getter) {
   let value = undefined;
-  Object.defineProperty(object4, key, {
+  Object.defineProperty(object5, key, {
     get() {
       if (value === EVALUATING) {
         return;
@@ -14847,7 +15928,7 @@ function defineLazy(object4, key, getter) {
       return value;
     },
     set(v) {
-      Object.defineProperty(object4, key, {
+      Object.defineProperty(object5, key, {
         value: v
       });
     },
@@ -16032,7 +17113,7 @@ __export2(exports_regexes, {
   idnEmail: () => idnEmail,
   httpProtocol: () => httpProtocol,
   html5Email: () => html5Email,
-  hostname: () => hostname,
+  hostname: () => hostname2,
   hex: () => hex,
   guid: () => guid,
   extendedDuration: () => extendedDuration,
@@ -16094,7 +17175,7 @@ var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]
 var cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
 var base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
 var base64url = /^[A-Za-z0-9_-]*$/;
-var hostname = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
+var hostname2 = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
 var domain = /^(?=.{1,253}$)([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,63}$/;
 var httpProtocol = /^https?$/;
 var e164 = /^\+[1-9]\d{6,14}$/;
@@ -16924,9 +18005,9 @@ var asciiTabOrNewline = /[\t\n\r]/g;
 function stripTabAndNewline(value) {
   return value.replace(asciiTabOrNewline, "");
 }
-function urlHostnameOk(url, hostname2) {
-  hostname2.lastIndex = 0;
-  return hostname2.test(url.hostname);
+function urlHostnameOk(url, hostname3) {
+  hostname3.lastIndex = 0;
+  return hostname3.test(url.hostname);
 }
 function urlProtocolOk(url, protocol) {
   protocol.lastIndex = 0;
@@ -17416,15 +18497,15 @@ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => {
       } catch (_err) {}
     }
     const input = payload.value;
-    const isDate = input instanceof Date;
-    const isValidDate = isDate && !Number.isNaN(input.getTime());
+    const isDate2 = input instanceof Date;
+    const isValidDate = isDate2 && !Number.isNaN(input.getTime());
     if (isValidDate)
       return payload;
     payload.issues.push({
       expected: "date",
       code: "invalid_type",
       input,
-      ...isDate ? { received: "Invalid Date" } : {},
+      ...isDate2 ? { received: "Invalid Date" } : {},
       inst
     });
     return payload;
@@ -29176,8 +30257,8 @@ function foldObjects(members2) {
   }
   const properties = {};
   const required2 = new Set;
-  for (const object4 of objects) {
-    for (const key in object4.properties) {
+  for (const object5 of objects) {
+    for (const key in object5.properties) {
       if (Object.prototype.hasOwnProperty.call(properties, key))
         continue;
       const parts = [];
@@ -29191,18 +30272,18 @@ function foldObjects(members2) {
       const merged = parts.length === 1 ? parts[0] : foldObjects(parts) ?? { allOf: parts };
       assignProp(properties, key, merged);
     }
-    for (const key of object4.required ?? [])
+    for (const key of object5.required ?? [])
       required2.add(key);
   }
   const folded = { type: "object", properties };
   if (required2.size)
     folded.required = [...required2];
-  if (objects.every((object4) => object4.additionalProperties === false)) {
+  if (objects.every((object5) => object5.additionalProperties === false)) {
     folded.additionalProperties = false;
   } else {
     const constraints = [];
-    for (const object4 of objects) {
-      const constraint = undeclaredConstraint(object4);
+    for (const object5 of objects) {
+      const constraint = undeclaredConstraint(object5);
       if (constraint && !constraints.some((seen) => JSON.stringify(seen) === JSON.stringify(constraint)))
         constraints.push(constraint);
     }
@@ -29877,8 +30958,8 @@ function rewriteKeyNames(ctx) {
       bySchema.set(entry.schema, entry);
   }
   const rewrites = new Map;
-  for (const record2 of pendingRecords.get(ctx) ?? []) {
-    const seen = ctx.seen.get(record2);
+  for (const record3 of pendingRecords.get(ctx) ?? []) {
+    const seen = ctx.seen.get(record3);
     const names = (seen?.def ?? seen?.schema)?.propertyNames;
     if (!names || names === true || rewrites.has(names))
       continue;
@@ -30203,7 +31284,7 @@ __export2(exports_schemas2, {
   strictObject: () => strictObject,
   set: () => set,
   refine: () => refine,
-  record: () => record2,
+  record: () => record3,
   readonly: () => readonly,
   promise: () => promise,
   preprocess: () => preprocess,
@@ -30211,7 +31292,7 @@ __export2(exports_schemas2, {
   pipe: () => pipe,
   partialRecord: () => partialRecord,
   optional: () => optional,
-  object: () => object4,
+  object: () => object5,
   number: () => number2,
   nullish: () => nullish2,
   nullable: () => nullable,
@@ -30241,7 +31322,7 @@ __export2(exports_schemas2, {
   int: () => int,
   instanceof: () => _instanceof,
   httpUrl: () => httpUrl,
-  hostname: () => hostname2,
+  hostname: () => hostname3,
   hex: () => hex2,
   hash: () => hash2,
   guid: () => guid2,
@@ -30943,7 +32024,7 @@ var ZodCustomStringFormat = /* @__PURE__ */ $constructor("ZodCustomStringFormat"
 function stringFormat(format, fnOrRegex, _params = {}) {
   return _stringFormat(ZodCustomStringFormat, format, fnOrRegex, _params);
 }
-function hostname2(_params) {
+function hostname3(_params) {
   return _stringFormat(ZodCustomStringFormat, "hostname", exports_regexes.hostname, _params);
 }
 function hex2(_params) {
@@ -31249,7 +32330,7 @@ var ZodObject = /* @__PURE__ */ $constructor("ZodObject", (inst, def) => {
     return exports_util.required(ZodNonOptional, this, args[0]);
   }
 });
-function object4(shape, params) {
+function object5(shape, params) {
   const def = {
     type: "object",
     shape: shape ?? {},
@@ -31365,7 +32446,7 @@ var ZodRecord = /* @__PURE__ */ $constructor("ZodRecord", (inst, def) => {
   inst.keyType = def.keyType;
   inst.valueType = def.valueType;
 });
-function record2(keyType, valueType, params) {
+function record3(keyType, valueType, params) {
   if (!valueType || !valueType._zod) {
     return new ZodRecord({
       type: "record",
@@ -31831,7 +32912,7 @@ var stringbool = (...args) => _stringbool({
 }, ...args);
 function json(params) {
   const jsonSchema = lazy(() => {
-    return union([string2(params), number2(), boolean2(), _null3(), array2(jsonSchema), record2(string2(), jsonSchema)]);
+    return union([string2(params), number2(), boolean2(), _null3(), array2(jsonSchema), record3(string2(), jsonSchema)]);
   });
   return jsonSchema;
 }
@@ -32622,7 +33703,7 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 var API_URL_ENV_VAR = SKILLS_API_URL_ENV;
-var MISSING_API_URL_HINT = `run: skills auth login, or set ${API_URL_ENV_VAR}=<your Skills instance origin>, ` + `or run: skills setup --api-url <your Skills instance origin>`;
+var MISSING_API_URL_HINT = `run: skills login, or set ${API_URL_ENV_VAR}=<your Skills instance origin>, ` + `or run: skills setup --api-url <your Skills instance origin>`;
 var VENDOR_TERMS = [
   "Google Gemini",
   "OpenAI Sora",
@@ -33018,7 +34099,7 @@ var revocation = exports_external.object({
 });
 var page = (item) => exports_external.object({ contractVersion: exports_external.literal(1), items: exports_external.array(item).max(100), nextCursor: exports_external.string().min(1).max(2048).nullable() });
 var results = { preview, draft: preview.nullable(), activate: exports_external.object({ replayed: exports_external.boolean(), consent }), list: page(consent), get: consent.nullable(), occurrences: page(occurrence), revoke: revocation };
-var record4 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var record5 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var uuid8 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
 var text2 = (v, max = 1024) => typeof v === "string" && !!v.trim() && v.length <= max && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v);
 var role2 = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v);
@@ -33033,15 +34114,15 @@ function invalid3() {
   throw new Error(invalidWorkspaceResult);
 }
 function organization(v) {
-  if (!record4(v) || !uuid8(v.id) || !text2(v.slug) || !text2(v.name))
+  if (!record5(v) || !uuid8(v.id) || !text2(v.slug) || !text2(v.name))
     return invalid3();
   return { id: v.id, slug: v.slug, name: v.name };
 }
 function parseWorkspaceIdentity(value, expectedUserId) {
-  if (!record4(value))
+  if (!record5(value))
     return invalid3();
   const user = value.user;
-  if (!record4(user) || !uuid8(user.id) || !uuid8(user.membershipId) || !text2(user.email, 320) || !(user.displayName === null || text2(user.displayName)) || !role2(user.role))
+  if (!record5(user) || !uuid8(user.id) || !uuid8(user.membershipId) || !text2(user.email, 320) || !(user.displayName === null || text2(user.displayName)) || !role2(user.role))
     return invalid3();
   if (user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
@@ -33053,10 +34134,10 @@ function sessionToken(value) {
   return value;
 }
 function parseWorkspaceSession(value, expected) {
-  const identity3 = parseWorkspaceIdentity(value, expected.userId);
-  if (identity3.user.membershipId !== expected.membershipId)
+  const identity4 = parseWorkspaceIdentity(value, expected.userId);
+  if (identity4.user.membershipId !== expected.membershipId)
     throw new WorkspaceIdentityMismatchError;
-  return { token: sessionToken(value.token), ...identity3 };
+  return { token: sessionToken(value.token), ...identity4 };
 }
 var SKILLS_API_KEY_REF = credentialPointerEnvKey("skills");
 var quoteUnavailableMessages = Object.freeze({
@@ -33111,16 +34192,16 @@ var invalid4 = () => {
 };
 var publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
 var hash3 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v);
-var record8 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-var exact = (v, keys) => record8(v) && Object.keys(v).sort().join(",") === keys.sort().join(",");
+var record9 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var exact = (v, keys) => record9(v) && Object.keys(v).sort().join(",") === keys.sort().join(",");
 var date5 = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v));
-var publicationSha256 = (bytes) => createHash20("sha256").update(bytes).digest("hex");
+var publicationSha256 = (bytes) => createHash222("sha256").update(bytes).digest("hex");
 function checkedPublicationDeclaration(value) {
   if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash3(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
     return bad();
   try {
     const manifest = JSON.parse(value.manifestText);
-    if (!record8(manifest) || manifest.version !== value.version || validatePortableManifestContract(manifest, { strict: true }).length || !hash3(manifest.provenance?.content_hash))
+    if (!record9(manifest) || manifest.version !== value.version || validatePortableManifestContract(manifest, { strict: true }).length || !hash3(manifest.provenance?.content_hash))
       return bad();
   } catch {
     return bad();
@@ -33178,7 +34259,7 @@ async function boundedJson(url2, init, token, mutation, budget2 = 15000, signal)
         return invalid4();
       }
       if (!response.ok) {
-        const code = record8(body) && typeof body.code === "string" && Object.hasOwn(failures2, body.code) ? body.code : null;
+        const code = record9(body) && typeof body.code === "string" && Object.hasOwn(failures2, body.code) ? body.code : null;
         if (code && failures2[code][0] === response.status)
           throw new PrivatePublicationError(code, failures2[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
         throw new PrivatePublicationError("PUBLICATION_REQUEST_FAILED", "The publication request was refused. Inspect its status before retrying.", mutation && response.status >= 500, response.status);
@@ -33233,8 +34314,8 @@ class RemotePrivatePublicationsClient {
     if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
       return bad();
     const response = await boundedJson(skillsApiRequestUrl(this.apiOrigin, "/api/v1/capabilities"), {}, this.#token, false, options.timeoutMs, options.signal);
-    const p = record8(response) && response.privatePublishing;
-    if (!record8(response) || response.contractVersion !== 1 || response.apiVersion !== 1 || !exact(p, ["contractVersion", "enabled", "authentication", "maxArchiveBytes", "uploadMaxTtlSeconds", "executionEnabled"]) || p.contractVersion !== 1 || typeof p.enabled !== "boolean" || p.authentication !== "interactive-session" || p.maxArchiveBytes !== PRIVATE_PUBLICATION_MAX_BYTES || p.uploadMaxTtlSeconds !== 300 || typeof p.executionEnabled !== "boolean")
+    const p = record9(response) && response.privatePublishing;
+    if (!record9(response) || response.contractVersion !== 1 || response.apiVersion !== 1 || !exact(p, ["contractVersion", "enabled", "authentication", "maxArchiveBytes", "uploadMaxTtlSeconds", "executionEnabled"]) || p.contractVersion !== 1 || typeof p.enabled !== "boolean" || p.authentication !== "interactive-session" || p.maxArchiveBytes !== PRIVATE_PUBLICATION_MAX_BYTES || p.uploadMaxTtlSeconds !== 300 || typeof p.executionEnabled !== "boolean")
       throw new PrivatePublicationError("PUBLICATION_CONTRACT_UNAVAILABLE", "This server does not support the hosted private publication contract.");
     return Object.freeze({ ...p });
   }
@@ -33250,7 +34331,7 @@ class RemotePrivatePublicationsClient {
   async#view(path, method, skillId, intentId, declaration, options = {}) {
     const value = await boundedJson(path, { method, ...method === "GET" ? {} : { body: JSON.stringify(declaration ?? {}) } }, this.#token, method !== "GET", options.timeoutMs, options.signal);
     try {
-      if (!record8(value) || !Object.keys(value).every((k) => k === "upload" || k === "changed") || value.changed !== undefined && typeof value.changed !== "boolean")
+      if (!record9(value) || !Object.keys(value).every((k) => k === "upload" || k === "changed") || value.changed !== undefined && typeof value.changed !== "boolean")
         return invalid4();
       return checkedPublicationView(value.upload, skillId, intentId, declaration);
     } catch (error61) {
@@ -33359,12 +34440,12 @@ class RemotePrivatePublicationsClient {
       previous = view;
       if (!["queued", "verifying"].includes(view.state) || Date.now() >= until)
         return view;
-      await new Promise((resolve17) => {
+      await new Promise((resolve18) => {
         const timer = setTimeout(done, Math.min(1000, until - Date.now()));
         function done() {
           clearTimeout(timer);
           options.signal?.removeEventListener("abort", done);
-          resolve17();
+          resolve18();
         }
         options.signal?.addEventListener("abort", done, { once: true });
       });
@@ -33372,7 +34453,7 @@ class RemotePrivatePublicationsClient {
   }
 }
 var uuid12 = exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/);
-var sha3 = exports_external.string().regex(/^[a-f0-9]{64}$/);
+var sha5 = exports_external.string().regex(/^[a-f0-9]{64}$/);
 var common = exports_external.object({
   contractVersion: exports_external.literal(1),
   apiOrigin: exports_external.string().min(1).max(4096),
@@ -33385,7 +34466,7 @@ var intentSchema = exports_external.discriminatedUnion("operation", [
   common.extend({
     operation: exports_external.literal("activate"),
     draftId: uuid12,
-    termsSha256: sha3,
+    termsSha256: sha5,
     approvalDeadline: exports_external.string().datetime(),
     approval: recurringActivationSchema
   }).strict(),
@@ -33393,14 +34474,14 @@ var intentSchema = exports_external.discriminatedUnion("operation", [
 ]);
 var stateSchema = exports_external.object({
   contractVersion: exports_external.literal(1),
-  intentSha256: sha3,
+  intentSha256: sha5,
   phase: exports_external.enum(["prepared", "pending", "observed"]),
   consentId: uuid12.nullable()
 }).strict();
 var uuid13 = exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/);
 var context = { userId: uuid13.optional(), membershipId: uuid13.optional() };
 var page2 = { limit: exports_external.number().int().min(1).max(100).optional(), cursor: exports_external.string().min(1).max(2048).optional() };
-var directory = exports_external.string().max(4096).refine(isAbsolute16, "Use an absolute recovery directory");
+var directory = exports_external.string().max(4096).refine(isAbsolute18, "Use an absolute recovery directory");
 var email4 = exports_external.string().trim().toLowerCase().email().max(254);
 var code = exports_external.string().regex(/^\d{6}$/);
 var recurringSurfaceSchemas = {
@@ -34531,7 +35612,73 @@ var MANIFEST_HASH_KEY_SEP = String.fromCharCode(0);
 var SESSION_RECONCILIATION_PLAN_TTL_MS = 5 * 60 * 1000;
 
 // src/lib/claude-skills-coordination.ts
-function coordinateClaudeSettings(before, replacement, options) {
+class ClaudeSettingsRefusal extends Error {
+  code;
+  constructor(code2, message) {
+    super(`${code2}: ${message}`);
+    this.code = code2;
+    this.name = "ClaudeSettingsRefusal";
+  }
+}
+var SKILLS_HOOK_COMMAND = /(?:^|\s)hook user-prompt --agent (?:claude|codex|gemini)(?:\s|$)/;
+function claudeSkillsUsage(before, home) {
+  const evidence = [], events2 = [];
+  const hooks = before === null ? undefined : JSON.parse(before)?.hooks;
+  if (hooks && typeof hooks === "object" && !Array.isArray(hooks)) {
+    for (const [event, entries] of Object.entries(hooks)) {
+      if (!Array.isArray(entries))
+        continue;
+      const commands = entries.flatMap((entry) => [entry?.command, ...Array.isArray(entry?.hooks) ? entry.hooks.map((hook) => hook?.command) : []]);
+      if (commands.some((command) => typeof command === "string" && SKILLS_HOOK_COMMAND.test(command)))
+        events2.push(event);
+    }
+  }
+  if (events2.length)
+    evidence.push(`Skills-managed hook entries in ${events2.join(", ")}`);
+  const bridge = join10(home, ".claude", "skills", "skills-cli", "SKILL.md");
+  let bridgePresent;
+  try {
+    bridgePresent = lstatSync7(bridge, { throwIfNoEntry: false }) !== undefined;
+  } catch (error61) {
+    bridgePresent = !["ENOENT", "ENOTDIR"].includes(error61.code ?? "");
+  }
+  if (bridgePresent)
+    evidence.push(`the Skills bridge ${bridge}`);
+  return evidence;
+}
+function skillsPolicyLocations(dataDir3) {
+  const state = (path) => existsSync11(path) ? "present" : "absent";
+  if (dataDir3 !== undefined)
+    return [`${join10(resolve7(dataDir3), "agent-policy.json")} (explicit data directory, absent)`];
+  const env = process.env, home = env.HOME || env.USERPROFILE || homedir6() || "/tmp", searched = [];
+  let selected = false;
+  for (const key of ["HASNA_SKILLS_DIR", "HASNA_SKILLS_HOME", "SKILLS_HOME"]) {
+    const value = env[key]?.trim();
+    if (selected)
+      searched.push(`$${key} (not consulted: an earlier override is set)`);
+    else if (!value)
+      searched.push(`$${key} (unset)`);
+    else {
+      selected = true;
+      searched.push(`$${key} -> ${join10(resolve7(value), "agent-policy.json")} (selected, absent)`);
+    }
+  }
+  const override = env.HASNA_DATA_HOME;
+  const base = typeof override === "string" && override.length > 0 ? override : process.platform === "darwin" ? join10(home, "Library", "Application Support", "Hasna") : join10(home, ".local", "share", "hasna");
+  const xdg = join10(base, "skills"), xdgPolicy = join10(xdg, "agent-policy.json");
+  const adopted = typeof override === "string" && override.trim().length > 0 || existsSync11(join10(xdg, "server.db")) || existsSync11(join10(xdg, "config.json"));
+  if (selected)
+    searched.push(`${xdgPolicy} (not consulted, ${state(xdgPolicy)})`);
+  else if (adopted) {
+    selected = true;
+    searched.push(`${xdgPolicy} (selected, absent)`);
+  } else
+    searched.push(`${xdgPolicy} (not selected: the directory holds no server.db or config.json and HASNA_DATA_HOME is unset; ${state(xdgPolicy)})`);
+  const legacy = join10(home, ".hasna", "skills", "agent-policy.json");
+  searched.push(selected ? `${legacy} (not consulted, ${state(legacy)})` : `${legacy} (selected, absent)`);
+  return searched;
+}
+function coordinateClaudeSettings(before, replacement, options, beforeWrite) {
   const prior = JSON.parse(before ?? "{}"), next = JSON.parse(replacement);
   const events2 = new Set([...Object.keys(prior.hooks ?? {}), ...Object.keys(next.hooks ?? {})]);
   const changed = [...events2].filter((event) => JSON.stringify(prior.hooks?.[event]) !== JSON.stringify(next.hooks?.[event]));
@@ -34542,15 +35689,20 @@ function coordinateClaudeSettings(before, replacement, options) {
     expectedSettingsSha256: before === null ? "absent" : createHash6("sha256").update(before).digest("hex"),
     replacement
   });
-  if (!plan)
+  if (!plan) {
+    const usage = claudeSkillsUsage(before, options.home);
+    if (usage.length)
+      throw new ClaudeSettingsRefusal("skills_policy_unresolved", `Skills manages ${join10(options.home, ".claude", "settings.json")} (${usage.join("; ")}), but no Skills agent policy resolved, ` + "so Hooks cannot coordinate this change and wrote nothing. Locations searched, in Skills resolution order: " + skillsPolicyLocations(options.dataDir).map((location, index) => `${index + 1}) ${location}`).join("; ") + ". Run hooks with the environment that selects the Skills data directory (for example HASNA_SKILLS_DIR), " + "or repair the integration with `skills hook install`.");
     return false;
+  }
+  beforeWrite?.();
   applyAgentIntegration(plan);
   return true;
 }
 
 // src/lib/installer.ts
 var __dirname2 = dirname7(fileURLToPath2(import.meta.url));
-var HOOKS_DIR = existsSync11(join10(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join10(__dirname2, "..", "..", "hooks") : join10(__dirname2, "..", "hooks");
+var HOOKS_DIR = existsSync12(join11(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join11(__dirname2, "..", "..", "hooks") : join11(__dirname2, "..", "hooks");
 function normalizeHookName(name) {
   return name.startsWith("hook-") ? name : `hook-${name}`;
 }
@@ -34620,9 +35772,9 @@ function getTargetSettingsDir(target) {
 }
 function getGlobalSettingsPathOverride(target) {
   if (target === "codex")
-    return process.env.HASNA_HOOKS_CODEX_SETTINGS_PATH ?? (process.env.CODEX_HOME ? resolve7(process.env.CODEX_HOME, "hooks.json") : undefined);
+    return process.env.HASNA_HOOKS_CODEX_SETTINGS_PATH ?? (process.env.CODEX_HOME ? resolve16(process.env.CODEX_HOME, "hooks.json") : undefined);
   if (target === "claude")
-    return process.env.HASNA_HOOKS_CLAUDE_SETTINGS_PATH ?? (process.env.CLAUDE_CONFIG_DIR ? resolve7(process.env.CLAUDE_CONFIG_DIR, "settings.json") : undefined);
+    return process.env.HASNA_HOOKS_CLAUDE_SETTINGS_PATH ?? (process.env.CLAUDE_CONFIG_DIR ? resolve16(process.env.CLAUDE_CONFIG_DIR, "settings.json") : undefined);
   if (target === "gemini")
     return process.env.HASNA_HOOKS_GEMINI_SETTINGS_PATH;
   return;
@@ -34638,71 +35790,95 @@ function getSettingsPath(scope = "global", target = "claude", codewithConfigPath
     return globalOverride;
   const dir = getTargetSettingsDir(target);
   if (target === "codex")
-    return join10(scope === "project" ? process.cwd() : homedir6(), dir, "hooks.json");
+    return join11(scope === "project" ? process.cwd() : homedir7(), dir, "hooks.json");
   if (scope === "project") {
-    return target === "codewith" ? join10(process.cwd(), dir, "config.toml") : join10(process.cwd(), dir, "settings.json");
+    return target === "codewith" ? join11(process.cwd(), dir, "config.toml") : join11(process.cwd(), dir, "settings.json");
   }
-  return target === "codewith" ? join10(homedir6(), dir, "config.toml") : join10(homedir6(), dir, "settings.json");
+  return target === "codewith" ? join11(homedir7(), dir, "config.toml") : join11(homedir7(), dir, "settings.json");
 }
 function getHookPath(name) {
   const shortName = shortHookName(name);
   const resolved = resolveHookDir(shortName);
   if (resolved)
     return resolved;
-  return join10(HOOKS_DIR, normalizeHookName(shortName));
+  return join11(HOOKS_DIR, normalizeHookName(shortName));
 }
 function hookExists(name) {
-  return existsSync11(getHookPath(name));
+  return existsSync12(getHookPath(name));
 }
 var settingsPreimages = new WeakMap;
-function readSettings2(scope = "global", target = "claude") {
+var unreadableSettings = new WeakMap;
+function readSettings(scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
   if (target === "codex")
     return readCodexSettings(path);
+  let reason = "cannot be read";
   try {
-    if (existsSync11(path)) {
-      const text3 = readFileSync7(path, "utf-8"), value = JSON.parse(text3);
+    if (existsSync12(path)) {
+      const text3 = readFileSync7(path, "utf-8");
+      reason = "is not valid JSON";
+      const value = JSON.parse(text3);
+      reason = "does not hold a JSON object";
+      if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError(reason);
       settingsPreimages.set(value, { path, text: text3 });
       return value;
     }
   } catch (error61) {
+    const code2 = error61?.code;
+    if (reason === "cannot be read" && typeof code2 === "string")
+      reason += ` (${code2})`;
     console.warn("[hooks] Cannot read hook settings; repair the selected file before installation.");
   }
   const empty = {};
-  if (!existsSync11(path))
+  if (!existsSync12(path))
     settingsPreimages.set(empty, { path, text: null });
+  else
+    unreadableSettings.set(empty, { path, reason });
   return empty;
 }
+function unreadableSettingsRefusal(settings, path) {
+  const captured = settingsPreimages.get(settings);
+  if (captured?.path === path && captured.text !== null || !existsSync12(path))
+    return;
+  const failed = unreadableSettings.get(settings);
+  const reason = captured?.path === path ? "was created after Hooks read the settings" : failed?.path === path ? failed.reason : "was not read as a settings object";
+  return new ClaudeSettingsRefusal("settings_unreadable", `${path} ${reason}, so Hooks wrote nothing. Repair the file or move it aside, then retry.`);
+}
 function settingsIdentity(path) {
-  if (existsSync11(path))
-    return realpathSync5(path);
-  return existsSync11(dirname7(path)) ? join10(realpathSync5(dirname7(path)), basename3(path)) : resolve7(path);
+  if (existsSync12(path))
+    return realpathSync8(path);
+  return existsSync12(dirname7(path)) ? join11(realpathSync8(dirname7(path)), basename3(path)) : resolve16(path);
 }
-function writeSettings(settings, scope = "global", target = "claude", expectedSettingsSha256) {
+function writeSettings(settings, scope = "global", target = "claude", expectedSettingsSha256, beforeWrite) {
   const path = getSettingsPath(scope, target);
   if (target === "codex")
-    return writeCodexSettings(path, settings, expectedSettingsSha256);
+    return writeCodexSettings(path, settings, expectedSettingsSha256, beforeWrite);
+  const refusal3 = unreadableSettingsRefusal(settings, path);
+  if (refusal3)
+    throw refusal3;
   const captured = settingsPreimages.get(settings);
   if (expectedSettingsSha256 !== undefined) {
     if (!captured || captured.path !== path)
       throw new Error("Hook settings require a valid captured preimage.");
     assertSettingsPreimage(captured.text, expectedSettingsSha256);
   }
-  if (target === "claude" && settingsIdentity(path) === settingsIdentity(join10(homedir6(), ".claude/settings.json"))) {
+  if (target === "claude" && settingsIdentity(path) === settingsIdentity(join11(homedir7(), ".claude/settings.json"))) {
     const before = settingsPreimages.get(settings);
     if (!before || before.path !== path)
       throw new Error("Claude settings require a valid captured preimage before installation.");
-    const current2 = existsSync11(path) ? readFileSync7(path, "utf8") : null;
+    const current2 = existsSync12(path) ? readFileSync7(path, "utf8") : null;
     if (current2 !== before.text)
       throw new Error("Claude settings changed during installation; no settings were written.");
     if (coordinateClaudeSettings(before.text, JSON.stringify(settings, null, 2) + `
-`, { home: homedir6() }))
+`, { home: homedir7() }, beforeWrite))
       return;
   }
   if (expectedSettingsSha256 !== undefined)
-    return writeHookSettingsPreimage(path, settings, captured.text);
+    return writeHookSettingsPreimage(path, settings, captured.text, beforeWrite);
+  beforeWrite?.();
   const dir = dirname7(path);
-  if (!existsSync11(dir)) {
+  if (!existsSync12(dir)) {
     mkdirSync6(dir, { recursive: true });
   }
   writeFileSync5(path, JSON.stringify(settings, null, 2) + `
@@ -34801,7 +35977,7 @@ function buildCodewithTomlFragment(name, profile, mementos) {
 function readCodewithConfig(scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
   try {
-    return existsSync11(path) ? readFileSync7(path, "utf-8") : "";
+    return existsSync12(path) ? readFileSync7(path, "utf-8") : "";
   } catch {
     return "";
   }
@@ -34809,9 +35985,9 @@ function readCodewithConfig(scope, configPath) {
 function appendCodewithFragment(fragment, scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
   const dir = dirname7(path);
-  if (!existsSync11(dir))
+  if (!existsSync12(dir))
     mkdirSync6(dir, { recursive: true });
-  const existing = existsSync11(path) ? readFileSync7(path, "utf-8") : "";
+  const existing = existsSync12(path) ? readFileSync7(path, "utf-8") : "";
   const sep3 = existing.trim() ? `
 
 ` : "";
@@ -34858,7 +36034,7 @@ function detectRewriteConflict(name, scope, target, lookup = getHook) {
   }
   return;
 }
-function installForTarget(name, scope, overwrite, target, profile, codewithMode = "fragment", codewithConfigPath, mementos, expectedSettingsSha256) {
+function installForTarget(name, scope, overwrite, target, profile, codewithMode = "fragment", codewithConfigPath, mementos, expectedSettingsSha256, beforeWrite) {
   const shortName = shortHookName(name);
   if (isNativeSafetyName(shortName) && (profile || target === "gemini" || target === "codewith" && codewithMode === "write")) {
     return { hook: shortName, success: false, error: "Bundled native safety guards support Claude/Codex and managed Codewith fragments, without registry profiles.", target };
@@ -34925,7 +36101,7 @@ function installForTarget(name, scope, overwrite, target, profile, codewithMode
     if (rewriteConflict) {
       return { hook: shortName, success: false, error: `Refused: ${rewriteConflict}`, scope, target };
     }
-    registerHook(shortName, scope, target, profile, mementos, (settings, selectedScope, selectedTarget) => writeSettings(settings, selectedScope, selectedTarget, expectedSettingsSha256));
+    registerHook(shortName, scope, target, profile, mementos, (settings, selectedScope, selectedTarget) => writeSettings(settings, selectedScope, selectedTarget, expectedSettingsSha256, beforeWrite));
     return {
       hook: shortName,
       success: true,
@@ -34939,12 +36115,13 @@ function installForTarget(name, scope, overwrite, target, profile, codewithMode
       hook: shortName,
       success: false,
       error: error61 instanceof Error ? error61.message : "Unknown error",
-      target
+      target,
+      ...error61 instanceof ClaudeSettingsRefusal ? { code: error61.code } : {}
     };
   }
 }
 function installHook(name, options = {}) {
-  const { scope = "global", overwrite = false, target = "claude", profile, codewithMode = "fragment", codewithConfigPath, mementos, expectedSettingsSha256 } = options;
+  const { scope = "global", overwrite = false, target = "claude", profile, codewithMode = "fragment", codewithConfigPath, mementos, expectedSettingsSha256, beforeWrite } = options;
   if (expectedSettingsSha256 !== undefined && (!/^(?:absent|[a-f0-9]{64})$/.test(expectedSettingsSha256) || !isNativeSafetyName(shortHookName(name)) || target !== "codex" && target !== "claude")) {
     return { hook: name, success: false, target, error: "An exact settings predecessor requires a Claude or Codex native safety guard." };
   }
@@ -34988,7 +36165,7 @@ function installHook(name, options = {}) {
     }
     return { ...claudeResult, target: "all" };
   }
-  return installForTarget(name, scope, overwrite, target, profile, codewithMode, codewithConfigPath, mementos, expectedSettingsSha256);
+  return installForTarget(name, scope, overwrite, target, profile, codewithMode, codewithConfigPath, mementos, expectedSettingsSha256, beforeWrite);
 }
 function registerHook(name, scope = "global", target = "claude", profile, mementos, write = writeSettings) {
   const readiness = name === "trash-readiness";
@@ -35019,7 +36196,7 @@ function registerHook(name, scope = "global", target = "claude", profile, mement
     throw new Error(`Hook '${name}' has no installable events for target '${target}'`);
   }
   const matcher = matcherFor(meta3, target);
-  const settings = readSettings2(scope, target);
+  const settings = readSettings(scope, target);
   if (!settings.hooks)
     settings.hooks = {};
   if (isNativeSafetyName(name) || readiness) {
@@ -35096,7 +36273,7 @@ function removeHookFromAllEvents(settings, name) {
   }
 }
 function unregisterHook(name, scope = "global", target = "claude") {
-  const settings = readSettings2(scope, target);
+  const settings = readSettings(scope, target);
   if (!settings.hooks)
     return;
   removeHookFromAllEvents(settings, name);
@@ -35126,7 +36303,7 @@ function getRegisteredHooksForTarget(scope = "global", target = "claude") {
     }
     return [...new Set(registered2)];
   }
-  const settings = readSettings2(scope, target);
+  const settings = readSettings(scope, target);
   if (!settings.hooks)
     return [];
   const registered = [];
@@ -35168,12 +36345,12 @@ function removeHookForTarget(name, scope, target) {
 
 // src/lib/profiles.ts
 init_app_home();
-import { existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync8, readdirSync as readdirSync8, rmSync, cpSync as cpSync2 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync8, readdirSync as readdirSync9, rmSync, cpSync as cpSync2 } from "fs";
+import { join as join12 } from "path";
 function getProfilesDir() {
-  const newDir = join11(getEffectiveDataRoot(), "profiles");
-  const oldDir = join11(getHomeDir(), ".hooks", "profiles");
-  if (!existsSync12(newDir) && existsSync12(oldDir)) {
+  const newDir = join12(getEffectiveDataRoot(), "profiles");
+  const oldDir = join12(getHomeDir(), ".hooks", "profiles");
+  if (!existsSync13(newDir) && existsSync13(oldDir)) {
     mkdirSync9(newDir, { recursive: true });
     cpSync2(oldDir, newDir, { recursive: true });
   }
@@ -35181,12 +36358,12 @@ function getProfilesDir() {
 }
 function ensureProfilesDir() {
   const dir = getProfilesDir();
-  if (!existsSync12(dir)) {
+  if (!existsSync13(dir)) {
     mkdirSync9(dir, { recursive: true });
   }
 }
 function profilePath(id) {
-  return join11(getProfilesDir(), `${id}.json`);
+  return join12(getProfilesDir(), `${id}.json`);
 }
 function shortUuid() {
   return crypto.randomUUID().slice(0, 8);
@@ -35212,7 +36389,7 @@ function createProfile(input2) {
 function getProfile(id) {
   const path = profilePath(id);
   try {
-    if (!existsSync12(path))
+    if (!existsSync13(path))
       return null;
     return JSON.parse(readFileSync8(path, "utf-8"));
   } catch {
@@ -35221,14 +36398,14 @@ function getProfile(id) {
 }
 function listProfiles() {
   const dir = getProfilesDir();
-  if (!existsSync12(dir))
+  if (!existsSync13(dir))
     return [];
   try {
-    const files = readdirSync8(dir).filter((f) => f.endsWith(".json"));
+    const files = readdirSync9(dir).filter((f) => f.endsWith(".json"));
     const profiles = [];
     for (const file2 of files) {
       try {
-        const content = readFileSync8(join11(dir, file2), "utf-8");
+        const content = readFileSync8(join12(dir, file2), "utf-8");
         profiles.push(JSON.parse(content));
       } catch {}
     }
@@ -35763,12 +36940,12 @@ function coerceForSqlite(value) {
   return String(value);
 }
 // src/mcp/server.ts
-var __dirname3 = dirname19(fileURLToPath3(import.meta.url));
+var __dirname3 = dirname20(fileURLToPath3(import.meta.url));
 var pkg = { name: "@hasna/hooks", version: "0.0.0" };
 try {
   for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
-    const p = join13(__dirname3, rel);
-    if (existsSync14(p)) {
+    const p = join18(__dirname3, rel);
+    if (existsSync15(p)) {
       pkg = JSON.parse(readFileSync9(p, "utf-8"));
       break;
     }
@@ -35778,12 +36955,12 @@ async function runVerifiedHook(name, stdin, timeoutMs) {
   const { resolveHook: resolveHook2, resolveScriptPath: resolveScriptPath2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
   const resolved = resolveHook2(name);
   const hookScript = resolveScriptPath2(name);
-  if (!resolved || !hookScript || !existsSync14(hookScript)) {
+  if (!resolved || !hookScript || !existsSync15(hookScript)) {
     throw new Error(`Hook '${name}' not found`);
   }
   const content = readFileSync9(hookScript);
-  const sha4 = sha256Of(content);
-  const check2 = checkScriptHash(name, sha4);
+  const sha6 = sha256Of(content);
+  const check2 = checkScriptHash(name, sha6);
   if (!check2.ok) {
     throw new Error(`Hook '${name}' script changed since it was trusted (sha256 ${check2.expected} != ${check2.actual}). Run 'hooks trust ${name}' to trust the new content.`);
   }
@@ -35803,7 +36980,7 @@ async function runVerifiedHook(name, stdin, timeoutMs) {
         hookName: name,
         eventType: resolveEventType2(inputJson.hook_event_name, resolved.events[0] ?? "PostToolUse"),
         version: resolved.version,
-        sha256: sha4,
+        sha256: sha6,
         sessionId: typeof inputJson.session_id === "string" ? inputJson.session_id : null,
         toolName: typeof inputJson.tool_name === "string" ? inputJson.tool_name : null,
         toolInput: inputJson.tool_input,
@@ -35833,7 +37010,7 @@ async function runVerifiedHook(name, stdin, timeoutMs) {
       hookName: name,
       eventType: resolveEventType2(inputJson.hook_event_name, resolved.events[0] ?? "PostToolUse"),
       version: resolved.version,
-      sha256: sha4,
+      sha256: sha6,
       sessionId: typeof inputJson.session_id === "string" ? inputJson.session_id : null,
       toolName: typeof inputJson.tool_name === "string" ? inputJson.tool_name : null,
       toolInput: inputJson.tool_input,
@@ -35856,6 +37033,12 @@ function formatInstallResults(results2, extra) {
     }]
   };
 }
+function settingsChangeError(hook, scope, error61, code2) {
+  return {
+    content: [{ type: "text", text: JSON.stringify({ hook, scope, error: error61, ...code2 ? { code: code2 } : {} }) }],
+    isError: true
+  };
+}
 function truncateText(value, max = 160) {
   const text3 = String(value ?? "").replace(/\s+/g, " ").trim();
   if (text3.length <= max)
@@ -35987,7 +37170,7 @@ function createHooksServer() {
     const settingsPath = getSettingsPath(scope);
     const issues = [];
     const healthy = [];
-    const settingsExist = existsSync14(settingsPath);
+    const settingsExist = existsSync15(settingsPath);
     if (!settingsExist) {
       issues.push({ hook: "(settings)", issue: `${settingsPath} not found`, severity: "warning" });
     }
@@ -35997,7 +37180,7 @@ function createHooksServer() {
       const meta3 = custom2 ? resolveHookMeta(name) : getHook(name);
       let hookHealthy = true;
       if (custom2) {
-        if (!existsSync14(custom2.scriptPath)) {
+        if (!existsSync15(custom2.scriptPath)) {
           issues.push({ hook: name, issue: `Custom hook script missing: ${custom2.scriptPath}`, severity: "error" });
           hookHealthy = false;
         }
@@ -36007,7 +37190,7 @@ function createHooksServer() {
           continue;
         }
         const hookDir = getHookPath(name);
-        if (!existsSync14(join13(hookDir, "src", "hook.ts"))) {
+        if (!existsSync15(join18(hookDir, "src", "hook.ts"))) {
           issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
           hookHealthy = false;
         }
@@ -36051,9 +37234,9 @@ function createHooksServer() {
         return { content: [{ type: "text", text: JSON.stringify({ error: `Hook '${name}' not found` }) }] };
       }
       const hookPath = getHookPath(name);
-      const readmePath = join13(hookPath, "README.md");
+      const readmePath = join18(hookPath, "README.md");
       let readme = "";
-      if (existsSync14(readmePath)) {
+      if (existsSync15(readmePath)) {
         readme = readFileSync9(readmePath, "utf-8");
       }
       if (verbose) {
@@ -36237,7 +37420,7 @@ function createHooksServer() {
     const ctx = {
       scope,
       settings_path: settingsPath,
-      settings_exists: existsSync14(settingsPath),
+      settings_exists: existsSync15(settingsPath),
       registered_hooks: hooks,
       hook_count: hooks.length,
       healthy,
@@ -36376,48 +37559,31 @@ function createHooksServer() {
     }));
     return { content: [{ type: "text", text: JSON.stringify({ results: results2, count: results2.length }) }] };
   });
-  defineTool("hooks_disable", "Temporarily disable a registered hook without removing it. Stores disabled list in settings under hooks.__disabled.", {
+  defineTool("hooks_disable", "Disable a registered hook: remove its Claude registration through the same coordinated settings writer as hooks_remove. The hook stays installed (trust pin, custom manifest), so hooks_enable can register it again with default options, unless it is outside the installable registry (trash-readiness, stale registrations). For trash-guard and workspace-repos-guard this removes their protection until re-enabled. Refusals are errors with a code, for example skills_policy_unresolved; nothing is written then.", {
     name: z3.string().describe("Hook name to disable"),
     scope: z3.enum(["global", "project"]).default("global").describe("Scope")
   }, async ({ name, scope }) => {
-    const settingsPath = getSettingsPath(scope);
-    let settings = {};
+    let changed;
     try {
-      if (existsSync14(settingsPath))
-        settings = JSON.parse(readFileSync9(settingsPath, "utf-8"));
-    } catch {}
-    if (!settings.hooks)
-      settings.hooks = {};
-    const disabled = settings.hooks.__disabled ?? [];
-    if (!disabled.includes(name))
-      disabled.push(name);
-    settings.hooks.__disabled = disabled;
-    const { writeFileSync: writeFileSync6, mkdirSync: mkdirSync7 } = await import("fs");
-    const { dirname: dirname8 } = await import("path");
-    mkdirSync7(dirname8(settingsPath), { recursive: true });
-    writeFileSync6(settingsPath, JSON.stringify(settings, null, 2) + `
-`);
-    return { content: [{ type: "text", text: JSON.stringify({ hook: name, disabled: true, scope }) }] };
+      changed = removeHook(name, scope, "claude");
+    } catch (error61) {
+      return settingsChangeError(name, scope, error61 instanceof Error ? error61.message : String(error61), error61 instanceof ClaudeSettingsRefusal ? error61.code : undefined);
+    }
+    return { content: [{ type: "text", text: JSON.stringify({ hook: name, disabled: true, changed, scope }) }] };
   });
-  defineTool("hooks_enable", "Re-enable a previously disabled hook.", {
+  defineTool("hooks_enable", "Enable a hook: register it in Claude settings, as hooks_install does, unless it is already registered. Writes go through the coordinated settings writer; refusals are errors with a code, for example skills_policy_unresolved or settings_unreadable, and nothing is written then.", {
     name: z3.string().describe("Hook name to enable"),
-    scope: z3.enum(["global", "project"]).default("global").describe("Scope")
-  }, async ({ name, scope }) => {
-    const settingsPath = getSettingsPath(scope);
-    let settings = {};
-    try {
-      if (existsSync14(settingsPath))
-        settings = JSON.parse(readFileSync9(settingsPath, "utf-8"));
-    } catch {}
-    if (settings.hooks?.__disabled) {
-      settings.hooks.__disabled = settings.hooks.__disabled.filter((n) => n !== name);
-      if (settings.hooks.__disabled.length === 0)
-        delete settings.hooks.__disabled;
-      const { writeFileSync: writeFileSync6 } = await import("fs");
-      writeFileSync6(settingsPath, JSON.stringify(settings, null, 2) + `
-`);
-    }
-    return { content: [{ type: "text", text: JSON.stringify({ hook: name, disabled: false, scope }) }] };
+    scope: z3.enum(["global", "project"]).default("global").describe("Scope"),
+    profile: z3.string().optional().describe("Agent profile ID to scope the registration to, as in hooks_install")
+  }, async ({ name, scope, profile }) => {
+    const shortName = name.startsWith("hook-") ? name.slice("hook-".length) : name;
+    if (getRegisteredHooks(scope).includes(shortName)) {
+      return { content: [{ type: "text", text: JSON.stringify({ hook: name, disabled: false, changed: false, scope }) }] };
+    }
+    const result = installHook(name, { scope, profile });
+    if (!result.success)
+      return settingsChangeError(name, scope, result.error ?? "Hook registration failed", result.code);
+    return { content: [{ type: "text", text: JSON.stringify({ hook: name, disabled: false, changed: true, scope }) }] };
   });
   defineTool("hooks_init", "Register a new agent profile \u2014 returns a unique agent_id for use with hook installation and execution", {
     agent_type: z3.enum(["claude", "gemini", "custom"]).default("claude").describe("Type of AI agent"),