@hasna/skills 0.10.23 → 0.10.25

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.23",
+    version: "0.10.25",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -39944,6 +39944,18 @@ function assertAgentPolicyCollections(policy) {
       if (control.appSha256 !== undefined)
         requireBound(typeof control.appSha256 === "string" && /^[a-f0-9]{64}$/.test(control.appSha256));
     }
+  if (bridge.codexInactivePlugins !== undefined) {
+    const controls = array(bridge.codexInactivePlugins, 4096), ids = new Set;
+    requireBound(controls.length === 0 || object(bridge.codexPluginSkillReview) && bridge.codexPluginSkillReview.version === "codex-cli 0.160.0" && typeof bridge.codexPluginSkillReview.catalogSha256 === "string" && /^[a-f0-9]{64}$/.test(bridge.codexPluginSkillReview.catalogSha256));
+    for (const control of controls) {
+      requireBound(object(control) && Object.keys(control).every((key) => ["pluginId", "namespace", "pluginParent", "sourceType", "sourceSha256"].includes(key)));
+      text(control.pluginId, 1024);
+      text(control.namespace, 64);
+      text(control.pluginParent);
+      requireBound(!ids.has(control.pluginId) && isAbsolute2(control.pluginParent) && resolve3(control.pluginParent) === control.pluginParent && ["local", "git", "npm"].includes(control.sourceType) && typeof control.sourceSha256 === "string" && /^[a-f0-9]{64}$/.test(control.sourceSha256));
+      ids.add(control.pluginId);
+    }
+  }
   if (bridge.disabledBuiltins !== undefined)
     for (const builtin of array(bridge.disabledBuiltins, AGENT_POLICY_LIMITS.builtinNames)) {
       requireBound(object(builtin));
@@ -39956,6 +39968,25 @@ function assertAgentPolicyCollections(policy) {
     text(agent, 128);
     requireBound(object(value));
     text(value.agent, 128);
+    if (value.codexInstallationInputs !== undefined) {
+      const proof = record(value.codexInstallationInputs, 4), inputs = array(proof.plugins, 4096), ids = new Set;
+      requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && proof.version === "codex-cli 0.160.0" && typeof proof.catalogSha256 === "string" && /^[a-f0-9]{64}$/.test(proof.catalogSha256) && inputs.length > 0 && object(bridge.codexPluginSkillReview) && bridge.codexPluginSkillReview.version === proof.version && bridge.codexPluginSkillReview.catalogSha256 === proof.catalogSha256);
+      for (const input of inputs) {
+        requireBound(object(input) && Object.keys(input).every((key) => ["pluginId", "namespace", "pluginParent", "sourceRoot", "sourceSha256"].includes(key)));
+        text(input.pluginId, 1024);
+        text(input.namespace, 64);
+        text(input.pluginParent);
+        text(input.sourceRoot);
+        requireBound(!ids.has(input.pluginId) && [input.pluginParent, input.sourceRoot].every((path) => isAbsolute2(path) && resolve3(path) === path) && typeof input.sourceSha256 === "string" && /^[a-f0-9]{64}$/.test(input.sourceSha256));
+        ids.add(input.pluginId);
+      }
+      if (proof.directories !== undefined)
+        for (const directory of array(proof.directories, AGENT_POLICY_LIMITS.discoveryDirectories)) {
+          requireBound(object(directory));
+          text(directory.path);
+          requireBound(directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256));
+        }
+    }
     for (const root of array(value.roots, AGENT_POLICY_LIMITS.discoveryRoots))
       text(root);
     for (const source of array(value.sources, AGENT_POLICY_LIMITS.discoverySources)) {
@@ -47235,7 +47266,7 @@ function safe(path) {
 function same(before2, after2) {
   return Boolean(after2 && after2.isDirectory() && before2.dev === after2.dev && before2.ino === after2.ino && before2.mtimeMs === after2.mtimeMs && before2.ctimeMs === after2.ctimeMs);
 }
-function capture(path, budget) {
+function capture(path, budget, excludedRoots) {
   safe(path);
   const root = lstatSync4(path, { throwIfNoEntry: false });
   if (!root)
@@ -47264,7 +47295,7 @@ function capture(path, budget) {
       budget.bytes += Buffer.byteLength(row);
       need(budget.bytes <= AGENT_POLICY_LIMITS.discoveryDirectoryBytes, "Native discovery directory metadata limit exceeded");
       hash.update(row);
-      if (stat.isDirectory())
+      if (stat.isDirectory() && !excludedRoots.includes(child))
         walk(child, childRelative, stat, depth + 1);
     }
     need(same(before2, lstatSync4(current, { throwIfNoEntry: false })), "Native discovery directory changed while reading");
@@ -47273,16 +47304,18 @@ function capture(path, budget) {
   safe(path);
   return { path, sha256: hash.digest("hex") };
 }
-function captureDiscoveryDirectories(paths) {
+function captureDiscoveryDirectories(paths, excludedRoots = []) {
   need(Array.isArray(paths) && paths.length <= AGENT_POLICY_LIMITS.discoveryDirectories && new Set(paths).size === paths.length, "Invalid native discovery directory collection");
   const budget = { entries: 0, bytes: 0 };
-  return paths.map((path) => capture(path, budget));
+  for (const root of excludedRoots)
+    safe(root);
+  return paths.map((path) => capture(path, budget, excludedRoots));
 }
-function verifyDiscoveryDirectories(directories) {
+function verifyDiscoveryDirectories(directories, excludedRoots = []) {
   need(Array.isArray(directories) && directories.length <= AGENT_POLICY_LIMITS.discoveryDirectories, "Invalid native discovery directory collection");
   for (const directory of directories)
     need(directory && typeof directory === "object" && (directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256)), "Invalid native discovery directory digest");
-  const current = captureDiscoveryDirectories(directories.map((directory) => directory.path));
+  const current = captureDiscoveryDirectories(directories.map((directory) => directory.path), excludedRoots);
   for (let i = 0;i < directories.length; i++)
     need(current[i].sha256 === directories[i].sha256, `Native discovery directory membership changed; run skills hook install with a fresh discovery review: ${directories[i].path}`);
 }
@@ -51059,9 +51092,22 @@ var init_codex_hook_rpc = __esm(() => {
 // src/lib/codex-native-skill-catalog.ts
 import { realpathSync as realpathSync4 } from "fs";
 import { isAbsolute as isAbsolute10, normalize as normalize2 } from "path";
+function codexPluginSourceIsConfigControlled(plugin) {
+  const remoteRealms = ["openai-curated-remote", "created-by-me-remote", "workspace-directory", "workspace-shared-with-me", "workspace-shared-with-me-private", "workspace-shared-with-me-unlisted"];
+  return Boolean(plugin.sourceType && ["local", "git", "npm"].includes(plugin.sourceType) && plugin.sourceSha256 && /^[a-f0-9]{64}$/.test(plugin.sourceSha256) && !plugin.remotePluginId && !remoteRealms.includes(plugin.id.slice(plugin.id.lastIndexOf("@") + 1)));
+}
 function refuse() {
   throw new Error("CODEX_NATIVE_SKILL_CATALOG_INVALID");
 }
+function projectPluginSource(source) {
+  if (!object4(source))
+    return {};
+  if (source.type === "remote")
+    return { sourceType: "remote" };
+  const optionalText = (value) => value === undefined || value === null || scalar(value, MAX_PATH_BYTES);
+  const valid = source.type === "local" ? Object.keys(source).every((key) => ["type", "path"].includes(key)) && absolutePath2(source.path) : source.type === "git" ? Object.keys(source).every((key) => ["type", "url", "path", "refName", "sha"].includes(key)) && scalar(source.url, MAX_PATH_BYTES) && [source.path, source.refName, source.sha].every(optionalText) : source.type === "npm" ? Object.keys(source).every((key) => ["type", "package", "version", "registry"].includes(key)) && scalar(source.package, MAX_NAME_BYTES) && [source.version, source.registry].every(optionalText) : false;
+  return valid ? { sourceType: source.type, sourceSha256: hashNativeJsonControls(JSON.stringify(source)), ...source.type === "local" ? { sourcePath: source.path } : {} } : {};
+}
 function projectCodexNativeSkillCatalog(response, cwd2) {
   if (!absolutePath2(cwd2) || !object4(response) || !Array.isArray(response.data) || response.data.length !== 1)
     refuse();
@@ -51091,7 +51137,10 @@ function projectCodexInstalledPlugins(response) {
       plugins.push({
         ...value,
         marketplace: marketplace.name,
-        sourceType: object4(value.source) && value.source.type === "remote" ? "remote" : undefined
+        sourceType: undefined,
+        sourceSha256: undefined,
+        sourcePath: undefined,
+        ...projectPluginSource(value.source)
       });
     }
   }
@@ -51102,7 +51151,7 @@ function projectCodexInstalledPluginEntries(value) {
     refuse();
   const ids = new Set;
   return value.map((item) => {
-    if (!object4(item) || !scalar(item.id, MAX_PLUGIN_ID_BYTES) || !scalar(item.name, MAX_NAME_BYTES) || typeof item.installed !== "boolean" || typeof item.enabled !== "boolean" || item.localVersion !== null && !scalar(item.localVersion, MAX_NAME_BYTES) || item.remotePluginId !== undefined && item.remotePluginId !== null && !remotePluginIdentifier(item.remotePluginId) || item.sourceType !== undefined && item.sourceType !== "remote")
+    if (!object4(item) || !scalar(item.id, MAX_PLUGIN_ID_BYTES) || !scalar(item.name, MAX_NAME_BYTES) || typeof item.installed !== "boolean" || typeof item.enabled !== "boolean" || item.localVersion !== null && !scalar(item.localVersion, MAX_NAME_BYTES) || item.remotePluginId !== undefined && item.remotePluginId !== null && !remotePluginIdentifier(item.remotePluginId) || item.sourceType !== undefined && !["remote", "local", "git", "npm"].includes(item.sourceType) || (["local", "git", "npm"].includes(item.sourceType) ? typeof item.sourceSha256 !== "string" || !/^[a-f0-9]{64}$/.test(item.sourceSha256) : item.sourceSha256 !== undefined) || (item.sourceType === "local" ? !absolutePath2(item.sourcePath) || normalize2(item.sourcePath) !== item.sourcePath || item.sourceSha256 !== hashNativeJsonControls(JSON.stringify({ type: "local", path: item.sourcePath })) : item.sourcePath !== undefined))
       refuse();
     const at2 = item.id.lastIndexOf("@");
     if (at2 < 1 || item.id.slice(0, at2) !== item.name || at2 === item.id.length - 1 || ids.has(item.id))
@@ -51114,7 +51163,9 @@ function projectCodexInstalledPluginEntries(value) {
       installed: item.installed,
       enabled: item.enabled,
       localVersion: item.localVersion ?? null,
-      ...item.sourceType === "remote" ? { sourceType: "remote" } : {},
+      ...item.sourceType === undefined ? {} : { sourceType: item.sourceType },
+      ...item.sourceSha256 === undefined ? {} : { sourceSha256: item.sourceSha256 },
+      ...item.sourcePath === undefined ? {} : { sourcePath: item.sourcePath },
       ...item.remotePluginId == null ? {} : { remotePluginId: item.remotePluginId }
     };
   });
@@ -51184,6 +51235,7 @@ var MAX_SKILLS = 4096, MAX_NAME_BYTES = 1024, MAX_PATH_BYTES = 16384, MAX_PLUGIN
 var init_codex_native_skill_catalog = __esm(() => {
   init_codex_hook_rpc();
   init_codex_native_compatibility();
+  init_claude_settings_witness();
 });
 
 // src/lib/codex-plugin-skill-controls.ts
@@ -51240,27 +51292,62 @@ function mcpControls(path, read2) {
   const object5 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v));
   const textField = (v, empty = false) => typeof v === "string" && (empty || Boolean(v.trim())) && Buffer.byteLength(v) <= 16384 && !/[\x00-\x1f\x7f]/.test(v);
   const envName = (v) => typeof v === "string" && /^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(v);
+  const optional = (v, valid) => v === undefined || v === null || valid(v);
+  const stringList = (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => textField(item));
+  const approval = (v) => ["auto", "prompt", "writes", "approve"].includes(v);
+  const duration = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+  const positiveInteger = (v) => Number.isSafeInteger(v) && v > 0;
+  const fields = [
+    "command",
+    "args",
+    "cwd",
+    "env",
+    "env_vars",
+    "enabled",
+    "required",
+    "environment_id",
+    "startup_readiness",
+    "supports_parallel_tool_calls",
+    "tool_input_schema_max_bytes",
+    "startup_timeout_sec",
+    "startup_timeout_ms",
+    "tool_timeout_sec",
+    "default_tools_approval_mode",
+    "enabled_tools",
+    "disabled_tools",
+    "omit_tools_from",
+    "tools",
+    "name"
+  ];
   if (!object5(value) || Object.keys(value).length !== 1 || !object5(value.mcpServers))
     refuse2();
   const servers = Object.entries(value.mcpServers);
   if (!servers.length || servers.length > 256)
     refuse2();
   for (const [name, server] of servers) {
-    if (!identifier2(name) || !object5(server) || !Object.keys(server).every((key) => ["command", "args", "cwd", "env_vars"].includes(key)) || !textField(server.command) || server.args !== undefined && (!Array.isArray(server.args) || server.args.length > 256 || !server.args.every((arg) => textField(arg, true))) || server.cwd !== undefined && !textField(server.cwd))
+    if (!identifier2(name) || !object5(server) || !Object.keys(server).every((key) => fields.includes(key)) || !textField(server.command) || !optional(server.args, (v) => Array.isArray(v) && v.length <= 256 && v.every((arg) => textField(arg, true))) || !optional(server.cwd, textField) || !optional(server.env, (v) => object5(v) && Object.keys(v).length <= 256 && Object.entries(v).every(([key, value2]) => envName(key) && textField(value2, true))) || !["enabled", "required", "supports_parallel_tool_calls"].every((key) => optional(server[key], (v) => typeof v === "boolean")) || !optional(server.environment_id, (v) => v === "local") || !optional(server.startup_readiness, (v) => ["connection", "catalog"].includes(v)) || !optional(server.tool_input_schema_max_bytes, positiveInteger) || !["startup_timeout_sec", "tool_timeout_sec"].every((key) => optional(server[key], duration)) || !optional(server.startup_timeout_ms, (v) => Number.isSafeInteger(v) && v >= 0) || !optional(server.default_tools_approval_mode, approval) || !["enabled_tools", "disabled_tools"].every((key) => optional(server[key], stringList)) || !optional(server.omit_tools_from, (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => ["code_mode", "deferred", "direct"].includes(item))) || !optional(server.name, textField))
       refuse2();
-    if (server.env_vars !== undefined) {
+    if (server.env_vars !== undefined && server.env_vars !== null) {
       if (!Array.isArray(server.env_vars) || server.env_vars.length > 256)
         refuse2();
       const names = server.env_vars.map((entry) => {
         if (envName(entry))
           return entry;
-        if (!object5(entry) || !Object.keys(entry).every((key) => ["name", "source"].includes(key)) || !envName(entry.name) || entry.source !== undefined && entry.source !== "local")
+        if (!object5(entry) || !Object.keys(entry).every((key) => ["name", "source"].includes(key)) || !envName(entry.name) || !optional(entry.source, (v) => v === "local"))
           refuse2();
         return entry.name;
       });
       if (new Set(names).size !== names.length)
         refuse2();
     }
+    if (server.tools !== undefined && server.tools !== null) {
+      if (!object5(server.tools) || Object.keys(server.tools).length > 256)
+        refuse2();
+      for (const [tool, config] of Object.entries(server.tools)) {
+        if (!textField(tool) || !object5(config) || !Object.keys(config).every((key) => ["approval_mode", "output_token_limit"].includes(key)) || !optional(config.approval_mode, approval) || !optional(config.output_token_limit, positiveInteger))
+          refuse2();
+      }
+    }
   }
   return sha2562;
 }
@@ -51297,7 +51384,7 @@ function rootControls(root, read2) {
   const appSha256 = present ? appControls(app, read2) : undefined;
   return { namespace: manifest.name, manifestSha256, ...appSha256 ? { appSha256 } : {}, ...mcpSha256 ? { mcpSha256 } : {} };
 }
-function identity4(document3, cache3, read2) {
+function documentIdentity(document3, cache3, read2) {
   if (!document3.startsWith(cache3 + sep4) || !document3.endsWith(sep4 + "SKILL.md"))
     refuse2();
   const text2 = read2(document3);
@@ -51325,11 +51412,33 @@ function identity4(document3, cache3, read2) {
     const path = join18(root, ".codex-plugin", "plugin.json");
     if (!lstatSync12(path, { throwIfNoEntry: false }))
       continue;
-    const controls = rootControls(root, read2);
-    return { name: `${controls.namespace}:${front.name}`, pluginParent: dirname10(root), ...controls };
+    const manifestFile = lstatSync12(path);
+    if (!lstatSync12(join18(root, ".codex-plugin")).isDirectory() || !manifestFile.isFile() || manifestFile.size > 1024 * 1024)
+      refuse2();
+    let manifest;
+    try {
+      const text3 = read2(path);
+      hashNativeJsonControls(text3);
+      manifest = JSON.parse(text3);
+    } catch {
+      refuse2();
+    }
+    if (!manifest || typeof manifest !== "object" || Array.isArray(manifest) || !identifier2(manifest.name))
+      refuse2();
+    const declaredVersion = manifest.version === undefined ? "" : typeof manifest.version === "string" ? manifest.version.trim() : null;
+    if (declaredVersion === null || (declaredVersion ? declaredVersion !== basename5(root) : basename5(root) !== CODEX_DEFAULT_AGENT_PLUGIN_VERSION))
+      refuse2();
+    return { name: `${manifest.name}:${front.name}`, namespace: manifest.name, pluginParent: dirname10(root), root };
   }
   refuse2();
 }
+function identity4(document3, cache3, read2) {
+  const parsed = documentIdentity(document3, cache3, read2);
+  const controls = rootControls(parsed.root, read2);
+  if (controls.namespace !== parsed.namespace)
+    refuse2();
+  return { name: parsed.name, pluginParent: parsed.pluginParent, ...controls };
+}
 function reviewedCodexPluginCapabilitiesUnchanged(cache3, controls, read2) {
   if (!Array.isArray(controls) || controls.length > 4096)
     return false;
@@ -51367,11 +51476,13 @@ function reviewedCodexPluginCapabilitiesUnchanged(cache3, controls, read2) {
     return false;
   }
 }
-function reviewCodexPluginSkillControls(catalog, documents, cache3, cwd2, read2, rules) {
+function reviewCodexPluginControls(catalog, documents, cache3, cwd2, read2, rules, pluginSettings) {
   if (!supportsCodexNativeCapability(catalog?.version, "qualified-skill-catalog") || catalog.cwd !== cwd2)
     refuse2();
   const skills = projectCodexNativeSkillCatalog({ data: [{ cwd: cwd2, errors: [], skills: catalog.skills }] }, cwd2);
-  const allowed = new Set(documents), result2 = [];
+  const allowed = new Set(documents), result2 = [], inertDocuments = new Set;
+  const inactivePlugins = new Map;
+  const sourceInputs = new Map;
   let installedPlugins;
   try {
     installedPlugins = projectCodexInstalledPluginEntries(catalog.plugins ?? []);
@@ -51382,25 +51493,48 @@ function reviewCodexPluginSkillControls(catalog, documents, cache3, cwd2, read2,
   for (const document3 of candidates) {
     if (!document3.startsWith(cache3 + sep4))
       continue;
-    const parsed = identity4(document3, cache3, read2);
-    if (parsed.name === "skills-cli" || parsed.name.endsWith(":skills-cli"))
+    const located = documentIdentity(document3, cache3, read2);
+    if (located.name === "skills-cli" || located.name.endsWith(":skills-cli"))
       refuse2();
-    const cacheParts = relative4(cache3, parsed.pluginParent).split(sep4);
+    const cacheParts = relative4(cache3, located.pluginParent).split(sep4);
     if (cacheParts.length !== 2 || cacheParts.some((part) => !identifier2(part)))
       refuse2();
     const [marketplace, pluginName] = cacheParts;
-    if (pluginName !== parsed.namespace)
+    if (pluginName !== located.namespace)
       refuse2();
     const expectedPluginId = `${pluginName}@${marketplace}`;
     const listed = skills.filter((skill) => skill.path === document3);
     if (listed.length > 1)
       refuse2();
+    const installed = installedPlugins.filter((plugin) => plugin.id === expectedPluginId && plugin.name === pluginName);
+    if (catalog.version === "codex-cli 0.160.0" && installed.length === 1 && installed[0].installed && installed[0].localVersion === basename5(located.root) && installed[0].sourceType === "local" && codexPluginSourceIsConfigControlled(installed[0])) {
+      const plugin = installed[0], input = { pluginId: expectedPluginId, namespace: located.namespace, pluginParent: located.pluginParent, sourceRoot: plugin.sourcePath, sourceSha256: plugin.sourceSha256 };
+      if (input.sourceRoot !== located.root && !input.sourceRoot.startsWith(cache3 + sep4) && (lstatSync12(input.sourceRoot, { throwIfNoEntry: false }) || documents.some((path) => path.startsWith(input.sourceRoot + sep4)))) {
+        if (skills.some((skill) => skill.path === input.sourceRoot || skill.path.startsWith(input.sourceRoot + sep4)) || !sourceInputUnchanged(input, cache3, read2))
+          refuse2();
+        sourceInputs.set(expectedPluginId, input);
+      }
+    }
+    const settings = pluginSettings && typeof pluginSettings === "object" && !Array.isArray(pluginSettings) ? pluginSettings : undefined;
+    if (catalog.version === "codex-cli 0.160.0" && !listed.length && !skills.some((skill) => skill.pluginId === expectedPluginId) && installed.length === 1 && installed[0].installed && !installed[0].enabled && codexPluginSourceIsConfigControlled(installed[0]) && settings && Object.hasOwn(settings, expectedPluginId) && settings[expectedPluginId]?.enabled === false) {
+      if (!Array.isArray(rules))
+        refuse2();
+      const exactPathDeny = rules.some((rule) => rule?.path === document3 && rule?.enabled === false);
+      if (!lstatSync12(document3).isFile() || realpathSync5(document3) !== document3 || realpathSync5(located.root) !== located.root || realpathSync5(located.pluginParent) !== located.pluginParent || realpathSync5(join18(located.root, ".codex-plugin/plugin.json")) !== join18(located.root, ".codex-plugin/plugin.json") || !exactPathDeny || rules.some((rule) => typeof rule?.name === "string" && rule.name.trim() === located.name && rule?.enabled !== false) || !isCodexNativeSkillDisabled({ name: located.name, path: document3, pluginId: expectedPluginId, enabled: true }, rules))
+        refuse2();
+      inertDocuments.add(document3);
+      const plugin = installed[0];
+      inactivePlugins.set(expectedPluginId, { pluginId: expectedPluginId, namespace: located.namespace, pluginParent: located.pluginParent, sourceType: plugin.sourceType, sourceSha256: plugin.sourceSha256 });
+      continue;
+    }
+    const parsed = { name: located.name, pluginParent: located.pluginParent, ...rootControls(located.root, read2) };
+    if (parsed.namespace !== located.namespace)
+      refuse2();
     let remotePluginId;
     if (listed.length === 1) {
       if (listed[0].name !== parsed.name || listed[0].pluginId !== expectedPluginId)
         refuse2();
     } else {
-      const installed = installedPlugins.filter((plugin2) => plugin2.id === expectedPluginId && plugin2.name === pluginName);
       if (installed.length !== 1 || !installed[0].installed || !installed[0].enabled)
         refuse2();
       const plugin = installed[0];
@@ -51418,9 +51552,48 @@ function reviewCodexPluginSkillControls(catalog, documents, cache3, cwd2, read2,
     }
     result2.push({ ...parsed, pluginId: expectedPluginId, ...remotePluginId ? { remotePluginId } : {} });
   }
-  if (!result2.length && documents.some((document3) => document3.startsWith(cache3 + sep4)) || new Set(result2.map((item) => item.name)).size !== result2.length)
+  if (!result2.length && documents.some((document3) => document3.startsWith(cache3 + sep4) && !inertDocuments.has(document3)) || new Set(result2.map((item) => item.name)).size !== result2.length)
     refuse2();
-  return result2;
+  return { skills: result2, inactivePlugins: [...inactivePlugins.values()], sourceInputs: [...sourceInputs.values()] };
+}
+function sourceInputUnchanged(input, cache3, read2) {
+  try {
+    const parts = relative4(cache3, input.pluginParent).split(sep4);
+    if (parts.length !== 2 || parts.some((part) => !identifier2(part)) || parts[1] !== input.namespace || input.pluginId !== `${parts[1]}@${parts[0]}` || !codexPluginSourceIsConfigControlled({ id: input.pluginId, sourceType: "local", sourceSha256: input.sourceSha256 }) || input.sourceSha256 !== hashNativeJsonControls(JSON.stringify({ type: "local", path: input.sourceRoot })) || resolve10(input.sourceRoot) !== input.sourceRoot || !lstatSync12(input.sourceRoot).isDirectory() || realpathSync5(input.sourceRoot) !== input.sourceRoot || input.sourceRoot === cache3 || input.sourceRoot.startsWith(cache3 + sep4) || cache3.startsWith(input.sourceRoot + sep4))
+      return false;
+    const path = join18(input.sourceRoot, ".codex-plugin/plugin.json"), stat = lstatSync12(path);
+    if (!stat.isFile() || stat.size > 1024 * 1024 || realpathSync5(path) !== path)
+      return false;
+    const text2 = read2(path);
+    hashNativeJsonControls(text2);
+    const manifest = JSON.parse(text2);
+    return Boolean(manifest && typeof manifest === "object" && !Array.isArray(manifest) && manifest.name === input.namespace);
+  } catch {
+    return false;
+  }
+}
+function reviewedCodexPluginSourceRoots(cache3, inputs, read2) {
+  if (!Array.isArray(inputs) || inputs.length > 4096 || new Set(inputs.map((input) => input.pluginId)).size !== inputs.length || new Set(inputs.map((input) => input.sourceRoot)).size !== inputs.length || inputs.some((input) => !sourceInputUnchanged(input, cache3, read2)))
+    refuse2();
+  const roots = inputs.map((input) => input.sourceRoot);
+  if (roots.some((root) => roots.some((other) => root !== other && root.startsWith(other + sep4))))
+    refuse2();
+  return roots;
+}
+function isReviewedCodexPluginInactive(document3, cache3, controls, pluginSettings, rules, read2) {
+  if (!Array.isArray(controls) || controls.length > 4096 || !pluginSettings || typeof pluginSettings !== "object" || Array.isArray(pluginSettings) || !Array.isArray(rules))
+    return false;
+  try {
+    const parsed = documentIdentity(document3, cache3, read2), matches2 = controls.filter((control2) => control2.pluginParent === parsed.pluginParent && control2.namespace === parsed.namespace);
+    if (matches2.length !== 1 || !lstatSync12(document3).isFile() || realpathSync5(document3) !== document3 || realpathSync5(parsed.root) !== parsed.root || realpathSync5(parsed.pluginParent) !== parsed.pluginParent || realpathSync5(join18(parsed.root, ".codex-plugin/plugin.json")) !== join18(parsed.root, ".codex-plugin/plugin.json"))
+      return false;
+    const control = matches2[0], parts = relative4(cache3, parsed.pluginParent).split(sep4);
+    if (parts.length !== 2 || parts.some((part) => !identifier2(part)) || parts[1] !== parsed.namespace || control.pluginId !== `${parts[1]}@${parts[0]}` || !codexPluginSourceIsConfigControlled({ ...control, id: control.pluginId }) || !Object.hasOwn(pluginSettings, control.pluginId) || pluginSettings[control.pluginId]?.enabled !== false)
+      return false;
+    return !rules.some((rule) => (rule?.path === document3 || typeof rule?.name === "string" && rule.name.trim() === parsed.name) && rule?.enabled !== false);
+  } catch {
+    return false;
+  }
 }
 function isReviewedCodexPluginSkillDisabled(document3, cache3, controls, rules, read2) {
   if (!document3.startsWith(cache3 + sep4) || !Array.isArray(controls) || controls.length > 4096)
@@ -52121,10 +52294,75 @@ import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
 import { existsSync as existsSync12, lstatSync as lstatSync15, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync13, readdirSync as readdirSync8, opendirSync as opendirSync3, readlinkSync as readlinkSync4, realpathSync as realpathSync6, renameSync as renameSync2, rmdirSync as rmdirSync2, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3, chmodSync, openSync as openSync8, closeSync as closeSync8, fsyncSync as fsyncSync2, fstatSync as fstatSync8, readSync as readSync6, constants as constants8, linkSync } from "fs";
 import { dirname as dirname11, join as join21, resolve as resolve11, relative as relative5, isAbsolute as isAbsolute11, sep as sep5 } from "path";
 import { homedir as homedir3 } from "os";
+function hasNoDarwinAcl(fd) {
+  try {
+    const { dlopen, read: read2 } = __require("bun:ffi");
+    const library = dlopen("/usr/lib/libSystem.B.dylib", {
+      acl_get_fd: { args: ["i32"], returns: "ptr" },
+      acl_free: { args: ["ptr"], returns: "i32" },
+      __error: { args: [], returns: "ptr" }
+    });
+    try {
+      const errno = library.symbols.__error();
+      if (!errno)
+        return false;
+      const acl = library.symbols.acl_get_fd(fd);
+      if (acl) {
+        library.symbols.acl_free(acl);
+        return false;
+      }
+      return (acl === null || acl === 0) && read2.i32(errno) === 2;
+    } finally {
+      library.close();
+    }
+  } catch {
+    return false;
+  }
+}
+function isSystemRootAlias(path) {
+  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(path))
+    return false;
+  const target = `/private${path}`, link2 = `private${path}`;
+  const identity5 = (stat) => `${stat.dev}:${stat.ino}:${stat.ctimeNs}:${stat.uid}:${stat.mode}`;
+  try {
+    const before2 = lstatSync15(path, { bigint: true });
+    if (!before2.isSymbolicLink() || before2.uid !== 0n || readlinkSync4(path) !== link2)
+      return false;
+    const directories = ["/", "/private", target].map((directory) => {
+      const stat = lstatSync15(directory, { bigint: true });
+      if (!stat.isDirectory() || stat.uid !== 0n)
+        throw new Error("Untrusted system alias directory");
+      if (directory !== "/private/tmp") {
+        if ((stat.mode & 0o022n) !== 0n)
+          throw new Error("Writable system alias directory");
+      } else if ((stat.mode & 0o1000n) === 0n)
+        throw new Error("Unprotected system temporary directory");
+      const fd = openSync8(directory, constants8.O_RDONLY | constants8.O_DIRECTORY | constants8.O_NOFOLLOW);
+      try {
+        if (identity5(fstatSync8(fd, { bigint: true })) !== identity5(stat) || !hasNoDarwinAcl(fd) || identity5(fstatSync8(fd, { bigint: true })) !== identity5(stat))
+          throw new Error("Unverified system alias directory ACL");
+      } finally {
+        closeSync8(fd);
+      }
+      return { directory, identity: identity5(stat) };
+    });
+    return realpathSync6(path) === target && readlinkSync4(path) === link2 && identity5(lstatSync15(path, { bigint: true })) === identity5(before2) && directories.every((item) => identity5(lstatSync15(item.directory, { bigint: true })) === item.identity);
+  } catch {
+    return false;
+  }
+}
+function canonicalSystemPath(path) {
+  const absolute = resolve11(path), root = `/${absolute.split(sep5)[1]}`;
+  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(root) || !lstatSync15(root, { throwIfNoEntry: false })?.isSymbolicLink())
+    return absolute;
+  if (!isSystemRootAlias(root))
+    throw new Error(`Refusing symlink path: ${root}`);
+  return `/private${absolute}`;
+}
 function assertSafePath(path) {
   let cursor = resolve11(path);
   while (true) {
-    if (lstatSync15(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync15(cursor, { throwIfNoEntry: false })?.isSymbolicLink() && !isSystemRootAlias(cursor))
       throw new Error(`Refusing symlink path: ${cursor}`);
     const parent = dirname11(cursor);
     if (parent === cursor)
@@ -52160,7 +52398,7 @@ function rootAliases(home, allowed = false) {
   return result2;
 }
 function canonicalAgentPath(path, aliases) {
-  const absolute = resolve11(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep5));
+  const absolute = canonicalSystemPath(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep5));
   return binding ? join21(binding.target, relative5(binding.alias, absolute)) : absolute;
 }
 function disabledCodexSkillPaths(config, aliases) {
@@ -52277,8 +52515,10 @@ function parseNativeMigrationTargetManifest(input) {
       throw new Error("Invalid native migration target fields");
     if (!ROOTS.some(([agent]) => agent === item.agent))
       throw new Error(`Unsupported native migration target agent: ${item.agent}`);
-    const projectRoot = resolve11(item.projectRoot);
-    if (!isAbsolute11(item.projectRoot) || projectRoot !== item.projectRoot || !existsSync12(projectRoot) || !lstatSync15(projectRoot).isDirectory())
+    if (!isAbsolute11(item.projectRoot) || resolve11(item.projectRoot) !== item.projectRoot)
+      throw new Error(`Native migration target project root must be an existing absolute directory: ${item.projectRoot}`);
+    const projectRoot = canonicalSystemPath(item.projectRoot);
+    if (!existsSync12(projectRoot) || !lstatSync15(projectRoot).isDirectory())
       throw new Error(`Native migration target project root must be an existing absolute directory: ${item.projectRoot}`);
     assertSafePath(projectRoot);
     if (isAbsolute11(item.path) || item.path.includes("\\") || item.path.length === 0 || item.path.includes("\x00"))
@@ -52288,7 +52528,7 @@ function parseNativeMigrationTargetManifest(input) {
       throw new Error(`Native migration target path escapes or is not normalized: ${item.path}`);
     if (!/^[0-9a-f]{64}$/.test(item.treeSha256))
       throw new Error(`Invalid native migration tree digest for ${item.path}`);
-    const identity5 = `${item.agent}\x00${projectRoot}\x00${normalized}`;
+    const identity5 = `${item.agent}\x00${canonicalSystemPath(projectRoot)}\x00${normalized}`;
     if (identities.has(identity5))
       throw new Error(`Duplicate native migration target: ${item.path}`);
     identities.add(identity5);
@@ -52305,17 +52545,19 @@ function selectNativeMigrationTargets(inventory, manifest) {
   const identities = new Set;
   const selected = [];
   for (const target of manifest.targets) {
-    const projectRoot = resolve11(target.projectRoot), normalized = relative5(projectRoot, resolve11(projectRoot, target.path));
-    if (!isAbsolute11(target.projectRoot) || projectRoot !== target.projectRoot || !existsSync12(projectRoot) || !lstatSync15(projectRoot).isDirectory())
+    if (!isAbsolute11(target.projectRoot) || resolve11(target.projectRoot) !== target.projectRoot)
+      throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
+    const projectRoot = canonicalSystemPath(target.projectRoot), normalized = relative5(projectRoot, resolve11(projectRoot, target.path));
+    if (!existsSync12(projectRoot) || !lstatSync15(projectRoot).isDirectory())
       throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
     assertSafePath(projectRoot);
     if (isAbsolute11(target.path) || target.path.includes("\\") || target.path.includes("\x00") || !normalized || normalized === ".." || normalized.startsWith(`..${sep5}`) || normalized !== target.path || !/^[0-9a-f]{64}$/.test(target.treeSha256))
       throw new Error(`Invalid native migration target: ${target.path}`);
-    const identity5 = `${target.agent}\x00${projectRoot}\x00${normalized}`;
+    const identity5 = `${target.agent}\x00${canonicalSystemPath(projectRoot)}\x00${normalized}`;
     if (identities.has(identity5))
       throw new Error(`Duplicate native migration target: ${target.path}`);
     identities.add(identity5);
-    const expected = resolve11(target.projectRoot, target.path);
+    const expected = canonicalSystemPath(resolve11(target.projectRoot, target.path));
     const matches2 = inventory.filter((entry2) => entry2.agent === target.agent && resolve11(entry2.path) === expected);
     if (matches2.length !== 1)
       throw new Error(`Native migration target was not found exactly once: ${target.agent} ${target.projectRoot}/${target.path}`);
@@ -52331,7 +52573,7 @@ function selectNativeMigrationTargets(inventory, manifest) {
 function projectAncestorDirectories(projects) {
   const directories = new Set;
   for (const project of projects) {
-    for (let path = resolve11(project), depth = 0;; depth++) {
+    for (let path = canonicalSystemPath(project), depth = 0;; depth++) {
       if (depth >= 100)
         throw new Error("NATIVE_SKILL_DRIFT: project ancestor discovery limit exceeded");
       directories.add(path);
@@ -52344,11 +52586,13 @@ function projectAncestorDirectories(projects) {
   return [...directories];
 }
 function inventoryNativeSkills(home = homedir3(), options = {}) {
+  home = canonicalSystemPath(home);
   if (options.reviewedCacheAlias !== undefined && (!options.includeVendor || !isAbsolute11(options.reviewedCacheAlias) || resolve11(options.reviewedCacheAlias) !== options.reviewedCacheAlias))
     throw new Error("A reviewed cache alias requires vendor inventory and an exact absolute path");
   if (options.disabledVendorPaths?.some((path) => !isAbsolute11(path) || resolve11(path) !== path))
     throw new Error("Disabled vendor paths must be exact absolute paths");
-  const disabledVendorPaths = new Set(options.disabledVendorPaths ?? []);
+  const reviewedCacheAlias = options.reviewedCacheAlias === undefined ? undefined : canonicalSystemPath(options.reviewedCacheAlias);
+  const disabledVendorPaths = new Set((options.disabledVendorPaths ?? []).map(canonicalSystemPath));
   const aliases = rootAliases(home, options.allowRootAliases);
   const selectedAgents = options.agents ? new Set(options.agents) : undefined;
   const includesAgent = (agent) => !selectedAgents || selectedAgents.has(agent);
@@ -52359,6 +52603,9 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
     for (const [agent, path] of rootDefinitions)
       roots.push([agent, canonicalAgentPath(join21(project, path), aliases)]);
   }
+  const installationInputs = options.codexInstallationInputRoots ?? [];
+  if (installationInputs.some((input) => resolve11(input) !== input || realpathSync6(input) !== input || roots.some(([agent, path]) => agent === "codex" && (path === input || path.startsWith(input + sep5) || input.startsWith(path + sep5)))))
+    throw new Error("Native installation input overlaps an unconditional skill-loading root");
   const entries = [], seen = new Set;
   const cacheScans = new Map, maxAliasProofEntries = 1e4;
   let discoveryEntries = 0, discoveryPathBytes = 0;
@@ -52371,8 +52618,11 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
   }
   let reviewedCacheAliasFound = false;
   function verifiedSiblingCacheAlias(agent, path, parent) {
-    const link2 = readlinkSync4(path), target = resolve11(parent, link2);
-    if (dirname11(target) !== parent || (isAbsolute11(link2) ? link2 !== target : dirname11(link2) !== "."))
+    const link2 = readlinkSync4(path), lexicalTarget = resolve11(parent, link2);
+    if (isAbsolute11(link2) ? link2 !== lexicalTarget : dirname11(link2) !== ".")
+      return false;
+    const target = canonicalSystemPath(lexicalTarget);
+    if (dirname11(target) !== parent)
       return false;
     if (!lstatSync15(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
@@ -52381,20 +52631,22 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       return false;
     if (scan.hasSkills) {
       const targetSkills = entries.filter((entry) => entry.agent === agent && entry.vendor && (entry.path === target || entry.path.startsWith(target + sep5)));
-      if (path === options.reviewedCacheAlias && targetSkills.length > 0)
+      if (path === reviewedCacheAlias && targetSkills.length > 0)
         reviewedCacheAliasFound = true;
       if (agent === "codex" && targetSkills.length > 0 && targetSkills.every((entry) => disabledVendorPaths.has(entry.path) || options.disabledVendorSkill?.(entry) === true))
         return true;
-      if (path !== options.reviewedCacheAlias)
+      if (path !== reviewedCacheAlias)
         return false;
     }
     return true;
   }
-  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false, admitted = false) {
+  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false, admitted = false, configuredRoot = false) {
     if (!admitted)
       admit(path);
     const scan = { complete: true, hasSkills: false, entries: 1 };
     assertSafePath(path);
+    if (configuredRoot && agent === "codex" && installationInputs.includes(path))
+      return scan;
     if (!existsSync12(path))
       return scan;
     const stat = lstatSync15(path);
@@ -52450,7 +52702,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
           continue;
         }
       }
-      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache, true);
+      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache, true, configuredRoot);
       scan.complete &&= childScan.complete;
       scan.hasSkills ||= childScan.hasSkills;
       scan.entries += childScan.entries;
@@ -52459,10 +52711,10 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       cacheScans.set(path, scan);
     return scan;
   }
-  function scanRoot(agent, path, vendor = false, pluginCache = false) {
+  function scanRoot(agent, path, vendor = false, pluginCache = false, configuredRoot = false) {
     if (agent === "hermes" || options.guardHermes && `${path}${sep5}`.includes(`${sep5}.agents${sep5}skills${sep5}`))
       assertNoHermesLegacyShadow(path);
-    if (!visit2(agent, path, vendor, 0, pluginCache).complete)
+    if (!visit2(agent, path, vendor, 0, pluginCache, false, configuredRoot).complete)
       throw new Error(`Native skill discovery limit exceeded; review this root before continuing: ${path}`);
   }
   for (const [agent, path] of roots)
@@ -52478,7 +52730,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
   const configured = options.configured ? INTEGRATION_AGENTS.filter(includesAgent).flatMap((agent) => resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, canonical: (path) => canonicalAgentPath(path, aliases) }).roots.map((path) => ({ agent, path }))) : [];
   for (const root of [...options.agentRoots ?? [], ...configured])
     if (includesAgent(root.agent))
-      scanRoot(root.agent, canonicalAgentPath(root.path, aliases), true);
+      scanRoot(root.agent, canonicalAgentPath(root.path, aliases), true, false, true);
   if (options.reviewedCacheAlias !== undefined && !reviewedCacheAliasFound)
     throw new Error("Reviewed cache alias was not an inventoried skill-containing sibling alias");
   recheckRootAliases(aliases);
@@ -52618,6 +52870,11 @@ enabled = false
   Bun.TOML.parse(result2);
   return result2;
 }
+function assertCodexInstallationInputs(home, projectDirs, inputs) {
+  const nativeRoots = [home, ...projectAncestorDirectories(projectDirs)].flatMap((directory) => ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => resolve11(directory, path)));
+  if (inputs.some((input) => nativeRoots.some((root) => root === input || root.startsWith(input + sep5) || input.startsWith(root + sep5))))
+    throw new Error("Native installation input overlaps an unconditional skill-loading root");
+}
 function planAgentIntegration(options) {
   const home = options.home ?? homedir3(), dataDir3 = options.dataDir ?? getDataDirReadOnly();
   const aliases = rootAliases(home, options.allowRootAliases);
@@ -52656,11 +52913,16 @@ function planAgentIntegration(options) {
   const codexConfig = options.agents.includes("codex") ? Bun.TOML.parse(readOptional(canonicalAgentPath(join21(home, ".codex", "config.toml"), aliases)) ?? "") : {};
   const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases, reviewedCacheAlias: options.reviewedCacheAlias, disabledVendorPaths: disabledCodexSkillPaths(codexConfig, aliases) });
   const observedNativeSources = [];
-  const codexPluginSkills = options.codexNativeCatalog ? reviewCodexPluginSkillControls(options.codexNativeCatalog, nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor).map((entry) => join21(entry.path, "SKILL.md")), canonicalAgentPath(join21(home, ".codex/plugins/cache"), aliases), resolve11(options.projectDir ?? home), (path) => {
+  const codexPluginControls = options.codexNativeCatalog ? reviewCodexPluginControls(options.codexNativeCatalog, nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor).map((entry) => join21(entry.path, "SKILL.md")), canonicalAgentPath(join21(home, ".codex/plugins/cache"), aliases), resolve11(options.projectDir ?? home), (path) => {
     const bytes = readNativeBytes(path, 1024 * 1024);
     observedNativeSources.push({ path, sha256: sha3(bytes) });
     return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-  }, codexConfig.skills?.config ?? []) : policy.bridge?.codexPluginSkills ?? [];
+  }, codexConfig.skills?.config ?? [], codexConfig.plugins) : { skills: policy.bridge?.codexPluginSkills ?? [], inactivePlugins: policy.bridge?.codexInactivePlugins ?? [], sourceInputs: policy.bridge?.discovery?.codex?.codexInstallationInputs?.plugins ?? [] };
+  const codexPluginSkills = codexPluginControls.skills;
+  const codexInactivePlugins = codexPluginControls.inactivePlugins;
+  const codexDiscovery = discoveries.find((binding) => binding.agent === "codex");
+  const codexPluginSourceInputs = codexPluginControls.sourceInputs.filter((input) => codexDiscovery?.method === "reviewed" && codexDiscovery.roots.some((root) => root === input.sourceRoot || root.startsWith(input.sourceRoot + sep5) || input.sourceRoot.startsWith(root + sep5)) && codexDiscovery.sources.some((source) => source.path === join21(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined));
+  assertCodexInstallationInputs(home, [options.projectDir ?? home], codexPluginSourceInputs.map((input) => input.sourceRoot));
   const changes = [];
   for (const agent of [...new Set(options.agents)]) {
     if (!INTEGRATION_AGENTS.includes(agent))
@@ -52725,7 +52987,16 @@ function planAgentIntegration(options) {
         changes.push({ path: configPath, before: previous, after: next });
     }
   }
-  const discoveryAfter = discoveries.map((binding) => rebindAgentDiscovery(binding, new Map(changes.map((change) => [change.path, change.after]))));
+  const codexPluginSkillReview = options.codexNativeCatalog ? { version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, catalogSha256: sha3(JSON.stringify({ version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, skills: projectCodexNativeSkillCatalog({ data: [{ cwd: options.codexNativeCatalog.cwd, errors: [], skills: options.codexNativeCatalog.skills }] }, options.codexNativeCatalog.cwd), ...options.codexNativeCatalog.plugins === undefined ? {} : { plugins: projectCodexInstalledPluginEntries(options.codexNativeCatalog.plugins) } })), configSha256: changes.find((change) => change.path === canonicalAgentPath(join21(home, ".codex/config.toml"), aliases))?.before === null ? null : sha3(readOptional(canonicalAgentPath(join21(home, ".codex/config.toml"), aliases)) ?? "") } : policy.bridge?.codexPluginSkillReview;
+  const discoveryAfter = discoveries.map((binding) => {
+    const rebound = rebindAgentDiscovery(binding, new Map(changes.map((change) => [change.path, change.after])));
+    if (binding.agent !== "codex")
+      return rebound;
+    const { codexInstallationInputs: previousInputs, ...current } = rebound;
+    const inputs = codexPluginSourceInputs.map((input) => input.sourceRoot);
+    const directories = options.codexNativeCatalog || !previousInputs ? captureDiscoveryDirectories((binding.directories ?? []).filter((directory) => inputs.some((root) => root.startsWith(directory.path + sep5))).map((directory) => directory.path), inputs) : previousInputs.directories;
+    return codexPluginSourceInputs.length ? { ...current, codexInstallationInputs: { version: "codex-cli 0.160.0", catalogSha256: codexPluginSkillReview.catalogSha256, plugins: codexPluginSourceInputs, ...directories?.length ? { directories } : {} } } : current;
+  });
   const nextPolicy = { ...policy, version: 1, loading: "cli", profileId, bridge: {
     ...policy.bridge,
     version: CLI_BRIDGE_VERSION,
@@ -52738,7 +53009,7 @@ function planAgentIntegration(options) {
     profiles: Object.fromEntries([...new Set([...priorAgents, ...options.agents])].sort().map((agent) => [agent, bindings.get(agent)?.profileId ?? policy.bridge?.profiles?.[agent] ?? policy.profileId])),
     disabledBuiltins: options.agents.includes("codex") ? nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor && entry.path.startsWith(canonicalAgentPath(join21(home, ".codex", "skills", ".system"), aliases) + sep5)).map((entry) => ({ path: entry.path, hash: entry.hash })) : policy.bridge?.disabledBuiltins ?? [],
     rootAliases: aliases,
-    ...codexPluginSkills.length ? { codexPluginSkills, codexPluginSkillReview: options.codexNativeCatalog ? { version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, catalogSha256: sha3(JSON.stringify({ version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, skills: projectCodexNativeSkillCatalog({ data: [{ cwd: options.codexNativeCatalog.cwd, errors: [], skills: options.codexNativeCatalog.skills }] }, options.codexNativeCatalog.cwd), ...options.codexNativeCatalog.plugins === undefined ? {} : { plugins: projectCodexInstalledPluginEntries(options.codexNativeCatalog.plugins) } })), configSha256: changes.find((change) => change.path === canonicalAgentPath(join21(home, ".codex/config.toml"), aliases))?.before === null ? null : sha3(readOptional(canonicalAgentPath(join21(home, ".codex/config.toml"), aliases)) ?? "") } : policy.bridge?.codexPluginSkillReview } : {},
+    ...options.codexNativeCatalog || codexPluginSkills.length || codexInactivePlugins.length || codexPluginSourceInputs.length ? { codexPluginSkills, codexInactivePlugins, codexPluginSkillReview } : {},
     discovery: { ...policy.bridge?.discovery, ...Object.fromEntries(discoveryAfter.map((binding) => [binding.agent, binding])) }
   } };
   const serializedPolicy = serializeManagedSkillPolicy(nextPolicy);
@@ -53148,7 +53419,12 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
     throw new Error("NATIVE_SKILL_DRIFT: the Codex CLI bridge is disabled; run skills hook install");
   if (agent === "codex" && !reviewedCodexPluginCapabilitiesUnchanged(canonicalAgentPath(join21(home, ".codex/plugins/cache"), aliases), binding.codexPluginSkills ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024))))
     throw new Error("NATIVE_SKILL_DRIFT: reviewed native plugin capability controls changed; run skills hook install with a fresh discovery review");
-  const disabledPlugin = (entry) => agent === "codex" && entry.vendor && isReviewedCodexPluginSkillDisabled(join21(entry.path, "SKILL.md"), canonicalAgentPath(join21(home, ".codex/plugins/cache"), aliases), binding.codexPluginSkills ?? [], codexConfig.skills?.config, (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024)));
+  const disabledPlugin = (entry) => {
+    if (agent !== "codex" || !entry.vendor)
+      return false;
+    const document3 = join21(entry.path, "SKILL.md"), cache3 = canonicalAgentPath(join21(home, ".codex/plugins/cache"), aliases), read2 = (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024));
+    return isReviewedCodexPluginInactive(document3, cache3, binding.codexInactivePlugins ?? [], codexConfig.plugins, codexConfig.skills?.config ?? [], read2) || isReviewedCodexPluginSkillDisabled(document3, cache3, binding.codexPluginSkills ?? [], codexConfig.skills?.config, read2);
+  };
   const disabledPaths = new Set(disabledCodexSkillPaths(codexConfig, aliases));
   const disabledVendorSkill = (entry) => {
     if (agent !== "codex" || !entry.vendor)
@@ -53185,7 +53461,15 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
   } catch (error) {
     throw new Error(`NATIVE_SKILL_DRIFT: ${error.message}`);
   }
-  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0, disabledVendorPaths: agent === "codex" ? disabledCodexSkillPaths(codexConfig, aliases) : [], disabledVendorSkill: disabledPlugin });
+  let installationInputRoots = [];
+  if (agent === "codex") {
+    try {
+      installationInputRoots = reviewedCodexPluginSourceRoots(canonicalAgentPath(join21(home, ".codex/plugins/cache"), aliases), discovery.codexInstallationInputs?.plugins ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024)));
+    } catch {
+      throw new Error("NATIVE_SKILL_DRIFT: native installation input identity changed; review discovery and catalog");
+    }
+  }
+  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0, disabledVendorPaths: agent === "codex" ? disabledCodexSkillPaths(codexConfig, aliases) : [], disabledVendorSkill: disabledPlugin, codexInstallationInputRoots: installationInputRoots });
   const unexpected = inventory.filter((entry) => visible(entry) && !entry.bridge && !disabledVendorSkill(entry));
   if (unexpected.length) {
     const paths = unexpected.slice(0, 3).map((entry) => {
@@ -56557,8 +56841,16 @@ function verifyAgentDiscovery(binding, codexRecovery) {
     throw new Error("Invalid native discovery binding");
   if (binding.agent === "hermes" && !binding.directories?.length)
     throw new Error("Hermes discovery requires directory membership coverage; run skills hook install with a fresh discovery review");
-  if (binding.directories !== undefined)
-    verifyDiscoveryDirectories(binding.directories);
+  const installationRoots = codexInstallationRoots(binding);
+  const installationInput = (path) => installationRoots.some((root2) => path === root2 || path.startsWith(root2 + sep6));
+  if (binding.directories !== undefined) {
+    const projected2 = binding.codexInstallationInputs?.directories ?? [];
+    const ancestors2 = binding.directories.filter((directory) => installationRoots.some((root2) => root2.startsWith(directory.path + sep6)));
+    if (projected2.length !== ancestors2.length || projected2.some((directory) => !ancestors2.some((original) => original.path === directory.path)))
+      throw new Error("Missing installation input directory projection");
+    verifyDiscoveryDirectories(binding.directories.filter((directory) => !installationInput(directory.path) && !ancestors2.includes(directory)));
+    verifyDiscoveryDirectories(projected2, installationRoots);
+  }
   const budget = discoveryByteBudget();
   for (const source of binding.sources) {
     assertMarketplaceBinding(binding, source);
@@ -56568,6 +56860,10 @@ function verifyAgentDiscovery(binding, codexRecovery) {
       throw new Error("Invalid native discovery projection");
     if (source.sha256 !== null && !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Invalid native discovery digest");
+    if (installationInput(source.path)) {
+      safe4(source.path);
+      continue;
+    }
     const current = projected(source, undefined, budget);
     if (current !== source.sha256 && !verifiesCodexHookDiscoverySource(binding, source, current, codexRecovery))
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
@@ -56575,6 +56871,27 @@ function verifyAgentDiscovery(binding, codexRecovery) {
   for (const root2 of binding.roots)
     safe4(root2);
 }
+function codexInstallationRoots(binding) {
+  const proof = binding.codexInstallationInputs;
+  if (proof === undefined)
+    return [];
+  if (binding.agent !== "codex" || binding.method !== "reviewed" || proof.version !== "codex-cli 0.160.0" || !/^[a-f0-9]{64}$/.test(proof.catalogSha256) || !Array.isArray(proof.plugins) || !proof.plugins.length)
+    throw new Error("Invalid native installation input proof");
+  const cache3 = dirname17(dirname17(proof.plugins[0].pluginParent));
+  const config = join32(dirname17(dirname17(cache3)), "config.toml"), home = dirname17(dirname17(dirname17(cache3)));
+  const configSource = binding.sources.find((source) => source.path === config && source.sha256 !== null && (!source.format || source.format === "toml" && source.fields?.includes("plugins")));
+  const nativeRoots = NATIVE_SKILL_ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => join32(home, path));
+  if (!configSource || proof.plugins.some((input) => nativeRoots.some((root2) => root2 === input.sourceRoot || root2.startsWith(input.sourceRoot + sep6) || input.sourceRoot.startsWith(root2 + sep6)) || binding.sources.some((source) => basename9(source.path) === "config.toml" && (source.path === input.sourceRoot || source.path.startsWith(input.sourceRoot + sep6)))))
+    throw new Error("Native installation input overlaps configuration or loading roots");
+  if (proof.plugins.some((input) => dirname17(dirname17(input.pluginParent)) !== cache3 || !binding.sources.some((source) => source.path === join32(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined)))
+    throw new Error("Missing native installation input source witness");
+  return reviewedCodexPluginSourceRoots(cache3, proof.plugins, (path) => {
+    const text3 = read2(path);
+    if (text3 === null)
+      throw new Error("Missing native installation input");
+    return text3;
+  });
+}
 function assertMarketplaceBinding(binding, source) {
   if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2") && (binding.agent !== "codex" || binding.method !== "reviewed" || basename9(source.path) !== "config.toml"))
     throw new Error("Codex settings witnesses require explicit reviewed Codex configuration");
@@ -56585,8 +56902,11 @@ function assertMarketplaceBinding(binding, source) {
 }
 function rebindAgentDiscovery(binding, changes) {
   const budget = discoveryByteBudget();
+  const installationRoots = codexInstallationRoots(binding);
   return { ...binding, sources: binding.sources.map((source) => {
     assertMarketplaceBinding(binding, source);
+    if (!changes.has(source.path) && installationRoots.some((root2) => source.path.startsWith(root2 + sep6)))
+      return source;
     const sha2562 = projected(source, changes, budget);
     if (!changes.has(source.path) && sha2562 !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
@@ -56857,6 +57177,8 @@ var init_agent_discovery = __esm(() => {
   init_claude_settings_witness();
   init_codex_hook_discovery_recovery();
   init_codex_settings_witness();
+  init_codex_plugin_skill_controls();
+  init_native_discovery_roots();
   init_agent_discovery_directories();
 });