@hasna/skills 0.10.23 → 0.10.25

package/dist/index.js

@@ -9051,6 +9051,18 @@ function assertAgentPolicyCollections(policy) {
       if (control.appSha256 !== undefined)
         requireBound(typeof control.appSha256 === "string" && /^[a-f0-9]{64}$/.test(control.appSha256));
     }
+  if (bridge.codexInactivePlugins !== undefined) {
+    const controls = array(bridge.codexInactivePlugins, 4096), ids = new Set;
+    requireBound(controls.length === 0 || object(bridge.codexPluginSkillReview) && bridge.codexPluginSkillReview.version === "codex-cli 0.160.0" && typeof bridge.codexPluginSkillReview.catalogSha256 === "string" && /^[a-f0-9]{64}$/.test(bridge.codexPluginSkillReview.catalogSha256));
+    for (const control of controls) {
+      requireBound(object(control) && Object.keys(control).every((key) => ["pluginId", "namespace", "pluginParent", "sourceType", "sourceSha256"].includes(key)));
+      text(control.pluginId, 1024);
+      text(control.namespace, 64);
+      text(control.pluginParent);
+      requireBound(!ids.has(control.pluginId) && isAbsolute2(control.pluginParent) && resolve2(control.pluginParent) === control.pluginParent && ["local", "git", "npm"].includes(control.sourceType) && typeof control.sourceSha256 === "string" && /^[a-f0-9]{64}$/.test(control.sourceSha256));
+      ids.add(control.pluginId);
+    }
+  }
   if (bridge.disabledBuiltins !== undefined)
     for (const builtin of array(bridge.disabledBuiltins, AGENT_POLICY_LIMITS.builtinNames)) {
       requireBound(object(builtin));
@@ -9063,6 +9075,25 @@ function assertAgentPolicyCollections(policy) {
     text(agent, 128);
     requireBound(object(value));
     text(value.agent, 128);
+    if (value.codexInstallationInputs !== undefined) {
+      const proof = record(value.codexInstallationInputs, 4), inputs = array(proof.plugins, 4096), ids = new Set;
+      requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && proof.version === "codex-cli 0.160.0" && typeof proof.catalogSha256 === "string" && /^[a-f0-9]{64}$/.test(proof.catalogSha256) && inputs.length > 0 && object(bridge.codexPluginSkillReview) && bridge.codexPluginSkillReview.version === proof.version && bridge.codexPluginSkillReview.catalogSha256 === proof.catalogSha256);
+      for (const input of inputs) {
+        requireBound(object(input) && Object.keys(input).every((key) => ["pluginId", "namespace", "pluginParent", "sourceRoot", "sourceSha256"].includes(key)));
+        text(input.pluginId, 1024);
+        text(input.namespace, 64);
+        text(input.pluginParent);
+        text(input.sourceRoot);
+        requireBound(!ids.has(input.pluginId) && [input.pluginParent, input.sourceRoot].every((path) => isAbsolute2(path) && resolve2(path) === path) && typeof input.sourceSha256 === "string" && /^[a-f0-9]{64}$/.test(input.sourceSha256));
+        ids.add(input.pluginId);
+      }
+      if (proof.directories !== undefined)
+        for (const directory of array(proof.directories, AGENT_POLICY_LIMITS.discoveryDirectories)) {
+          requireBound(object(directory));
+          text(directory.path);
+          requireBound(directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256));
+        }
+    }
     for (const root of array(value.roots, AGENT_POLICY_LIMITS.discoveryRoots))
       text(root);
     for (const source of array(value.sources, AGENT_POLICY_LIMITS.discoverySources)) {
@@ -9384,7 +9415,7 @@ function safe(path) {
 function same(before, after) {
   return Boolean(after && after.isDirectory() && before.dev === after.dev && before.ino === after.ino && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs);
 }
-function capture(path, budget) {
+function capture(path, budget, excludedRoots) {
   safe(path);
   const root = lstatSync4(path, { throwIfNoEntry: false });
   if (!root)
@@ -9413,7 +9444,7 @@ function capture(path, budget) {
       budget.bytes += Buffer.byteLength(row);
       need(budget.bytes <= AGENT_POLICY_LIMITS.discoveryDirectoryBytes, "Native discovery directory metadata limit exceeded");
       hash.update(row);
-      if (stat.isDirectory())
+      if (stat.isDirectory() && !excludedRoots.includes(child))
         walk(child, childRelative, stat, depth + 1);
     }
     need(same(before, lstatSync4(current, { throwIfNoEntry: false })), "Native discovery directory changed while reading");
@@ -9422,16 +9453,18 @@ function capture(path, budget) {
   safe(path);
   return { path, sha256: hash.digest("hex") };
 }
-function captureDiscoveryDirectories(paths) {
+function captureDiscoveryDirectories(paths, excludedRoots = []) {
   need(Array.isArray(paths) && paths.length <= AGENT_POLICY_LIMITS.discoveryDirectories && new Set(paths).size === paths.length, "Invalid native discovery directory collection");
   const budget = { entries: 0, bytes: 0 };
-  return paths.map((path) => capture(path, budget));
+  for (const root of excludedRoots)
+    safe(root);
+  return paths.map((path) => capture(path, budget, excludedRoots));
 }
-function verifyDiscoveryDirectories(directories) {
+function verifyDiscoveryDirectories(directories, excludedRoots = []) {
   need(Array.isArray(directories) && directories.length <= AGENT_POLICY_LIMITS.discoveryDirectories, "Invalid native discovery directory collection");
   for (const directory of directories)
     need(directory && typeof directory === "object" && (directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256)), "Invalid native discovery directory digest");
-  const current = captureDiscoveryDirectories(directories.map((directory) => directory.path));
+  const current = captureDiscoveryDirectories(directories.map((directory) => directory.path), excludedRoots);
   for (let i = 0;i < directories.length; i++)
     need(current[i].sha256 === directories[i].sha256, `Native discovery directory membership changed; run skills hook install with a fresh discovery review: ${directories[i].path}`);
 }
@@ -10881,7 +10914,7 @@ function replaceSkillSession(expected, replacement, plan, options = {}, beforeCo
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.23",
+  version: "0.10.25",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -13197,6 +13230,10 @@ async function connectCodexHookRpc(options) {
 }
 
 // src/lib/codex-native-skill-catalog.ts
+function codexPluginSourceIsConfigControlled(plugin) {
+  const remoteRealms = ["openai-curated-remote", "created-by-me-remote", "workspace-directory", "workspace-shared-with-me", "workspace-shared-with-me-private", "workspace-shared-with-me-unlisted"];
+  return Boolean(plugin.sourceType && ["local", "git", "npm"].includes(plugin.sourceType) && plugin.sourceSha256 && /^[a-f0-9]{64}$/.test(plugin.sourceSha256) && !plugin.remotePluginId && !remoteRealms.includes(plugin.id.slice(plugin.id.lastIndexOf("@") + 1)));
+}
 var MAX_SKILLS = 4096;
 var MAX_NAME_BYTES = 1024;
 var MAX_PATH_BYTES = 16384;
@@ -13208,6 +13245,15 @@ var object4 = (value) => value !== null && typeof value === "object" && !Array.i
 var scalar = (value, max) => typeof value === "string" && value.length > 0 && value.trim() === value && Buffer.byteLength(value, "utf8") <= max && !/[\u0000-\u001f\u007f]/u.test(value);
 var remotePluginIdentifier = (value) => typeof value === "string" && /^[A-Za-z0-9_~-]{1,1024}$/.test(value);
 var absolutePath2 = (value) => scalar(value, MAX_PATH_BYTES) && isAbsolute10(value);
+function projectPluginSource(source) {
+  if (!object4(source))
+    return {};
+  if (source.type === "remote")
+    return { sourceType: "remote" };
+  const optionalText = (value) => value === undefined || value === null || scalar(value, MAX_PATH_BYTES);
+  const valid = source.type === "local" ? Object.keys(source).every((key) => ["type", "path"].includes(key)) && absolutePath2(source.path) : source.type === "git" ? Object.keys(source).every((key) => ["type", "url", "path", "refName", "sha"].includes(key)) && scalar(source.url, MAX_PATH_BYTES) && [source.path, source.refName, source.sha].every(optionalText) : source.type === "npm" ? Object.keys(source).every((key) => ["type", "package", "version", "registry"].includes(key)) && scalar(source.package, MAX_NAME_BYTES) && [source.version, source.registry].every(optionalText) : false;
+  return valid ? { sourceType: source.type, sourceSha256: hashNativeJsonControls(JSON.stringify(source)), ...source.type === "local" ? { sourcePath: source.path } : {} } : {};
+}
 function projectCodexNativeSkillCatalog(response, cwd) {
   if (!absolutePath2(cwd) || !object4(response) || !Array.isArray(response.data) || response.data.length !== 1)
     refuse();
@@ -13237,7 +13283,10 @@ function projectCodexInstalledPlugins(response) {
       plugins.push({
         ...value,
         marketplace: marketplace.name,
-        sourceType: object4(value.source) && value.source.type === "remote" ? "remote" : undefined
+        sourceType: undefined,
+        sourceSha256: undefined,
+        sourcePath: undefined,
+        ...projectPluginSource(value.source)
       });
     }
   }
@@ -13248,7 +13297,7 @@ function projectCodexInstalledPluginEntries(value) {
     refuse();
   const ids = new Set;
   return value.map((item) => {
-    if (!object4(item) || !scalar(item.id, MAX_PLUGIN_ID_BYTES) || !scalar(item.name, MAX_NAME_BYTES) || typeof item.installed !== "boolean" || typeof item.enabled !== "boolean" || item.localVersion !== null && !scalar(item.localVersion, MAX_NAME_BYTES) || item.remotePluginId !== undefined && item.remotePluginId !== null && !remotePluginIdentifier(item.remotePluginId) || item.sourceType !== undefined && item.sourceType !== "remote")
+    if (!object4(item) || !scalar(item.id, MAX_PLUGIN_ID_BYTES) || !scalar(item.name, MAX_NAME_BYTES) || typeof item.installed !== "boolean" || typeof item.enabled !== "boolean" || item.localVersion !== null && !scalar(item.localVersion, MAX_NAME_BYTES) || item.remotePluginId !== undefined && item.remotePluginId !== null && !remotePluginIdentifier(item.remotePluginId) || item.sourceType !== undefined && !["remote", "local", "git", "npm"].includes(item.sourceType) || (["local", "git", "npm"].includes(item.sourceType) ? typeof item.sourceSha256 !== "string" || !/^[a-f0-9]{64}$/.test(item.sourceSha256) : item.sourceSha256 !== undefined) || (item.sourceType === "local" ? !absolutePath2(item.sourcePath) || normalize2(item.sourcePath) !== item.sourcePath || item.sourceSha256 !== hashNativeJsonControls(JSON.stringify({ type: "local", path: item.sourcePath })) : item.sourcePath !== undefined))
       refuse();
     const at = item.id.lastIndexOf("@");
     if (at < 1 || item.id.slice(0, at) !== item.name || at === item.id.length - 1 || ids.has(item.id))
@@ -13260,7 +13309,9 @@ function projectCodexInstalledPluginEntries(value) {
       installed: item.installed,
       enabled: item.enabled,
       localVersion: item.localVersion ?? null,
-      ...item.sourceType === "remote" ? { sourceType: "remote" } : {},
+      ...item.sourceType === undefined ? {} : { sourceType: item.sourceType },
+      ...item.sourceSha256 === undefined ? {} : { sourceSha256: item.sourceSha256 },
+      ...item.sourcePath === undefined ? {} : { sourcePath: item.sourcePath },
       ...item.remotePluginId == null ? {} : { remotePluginId: item.remotePluginId }
     };
   });
@@ -13381,27 +13432,62 @@ function mcpControls(path, read2) {
   const object5 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v));
   const textField = (v, empty = false) => typeof v === "string" && (empty || Boolean(v.trim())) && Buffer.byteLength(v) <= 16384 && !/[\x00-\x1f\x7f]/.test(v);
   const envName = (v) => typeof v === "string" && /^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(v);
+  const optional = (v, valid) => v === undefined || v === null || valid(v);
+  const stringList = (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => textField(item));
+  const approval = (v) => ["auto", "prompt", "writes", "approve"].includes(v);
+  const duration = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+  const positiveInteger = (v) => Number.isSafeInteger(v) && v > 0;
+  const fields = [
+    "command",
+    "args",
+    "cwd",
+    "env",
+    "env_vars",
+    "enabled",
+    "required",
+    "environment_id",
+    "startup_readiness",
+    "supports_parallel_tool_calls",
+    "tool_input_schema_max_bytes",
+    "startup_timeout_sec",
+    "startup_timeout_ms",
+    "tool_timeout_sec",
+    "default_tools_approval_mode",
+    "enabled_tools",
+    "disabled_tools",
+    "omit_tools_from",
+    "tools",
+    "name"
+  ];
   if (!object5(value) || Object.keys(value).length !== 1 || !object5(value.mcpServers))
     refuse2();
   const servers = Object.entries(value.mcpServers);
   if (!servers.length || servers.length > 256)
     refuse2();
   for (const [name, server] of servers) {
-    if (!identifier2(name) || !object5(server) || !Object.keys(server).every((key) => ["command", "args", "cwd", "env_vars"].includes(key)) || !textField(server.command) || server.args !== undefined && (!Array.isArray(server.args) || server.args.length > 256 || !server.args.every((arg) => textField(arg, true))) || server.cwd !== undefined && !textField(server.cwd))
+    if (!identifier2(name) || !object5(server) || !Object.keys(server).every((key) => fields.includes(key)) || !textField(server.command) || !optional(server.args, (v) => Array.isArray(v) && v.length <= 256 && v.every((arg) => textField(arg, true))) || !optional(server.cwd, textField) || !optional(server.env, (v) => object5(v) && Object.keys(v).length <= 256 && Object.entries(v).every(([key, value2]) => envName(key) && textField(value2, true))) || !["enabled", "required", "supports_parallel_tool_calls"].every((key) => optional(server[key], (v) => typeof v === "boolean")) || !optional(server.environment_id, (v) => v === "local") || !optional(server.startup_readiness, (v) => ["connection", "catalog"].includes(v)) || !optional(server.tool_input_schema_max_bytes, positiveInteger) || !["startup_timeout_sec", "tool_timeout_sec"].every((key) => optional(server[key], duration)) || !optional(server.startup_timeout_ms, (v) => Number.isSafeInteger(v) && v >= 0) || !optional(server.default_tools_approval_mode, approval) || !["enabled_tools", "disabled_tools"].every((key) => optional(server[key], stringList)) || !optional(server.omit_tools_from, (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => ["code_mode", "deferred", "direct"].includes(item))) || !optional(server.name, textField))
       refuse2();
-    if (server.env_vars !== undefined) {
+    if (server.env_vars !== undefined && server.env_vars !== null) {
       if (!Array.isArray(server.env_vars) || server.env_vars.length > 256)
         refuse2();
       const names = server.env_vars.map((entry) => {
         if (envName(entry))
           return entry;
-        if (!object5(entry) || !Object.keys(entry).every((key) => ["name", "source"].includes(key)) || !envName(entry.name) || entry.source !== undefined && entry.source !== "local")
+        if (!object5(entry) || !Object.keys(entry).every((key) => ["name", "source"].includes(key)) || !envName(entry.name) || !optional(entry.source, (v) => v === "local"))
           refuse2();
         return entry.name;
       });
       if (new Set(names).size !== names.length)
         refuse2();
     }
+    if (server.tools !== undefined && server.tools !== null) {
+      if (!object5(server.tools) || Object.keys(server.tools).length > 256)
+        refuse2();
+      for (const [tool, config] of Object.entries(server.tools)) {
+        if (!textField(tool) || !object5(config) || !Object.keys(config).every((key) => ["approval_mode", "output_token_limit"].includes(key)) || !optional(config.approval_mode, approval) || !optional(config.output_token_limit, positiveInteger))
+          refuse2();
+      }
+    }
   }
   return sha2562;
 }
@@ -13438,7 +13524,7 @@ function rootControls(root, read2) {
   const appSha256 = present ? appControls(app, read2) : undefined;
   return { namespace: manifest.name, manifestSha256, ...appSha256 ? { appSha256 } : {}, ...mcpSha256 ? { mcpSha256 } : {} };
 }
-function identity3(document2, cache, read2) {
+function documentIdentity(document2, cache, read2) {
   if (!document2.startsWith(cache + sep4) || !document2.endsWith(sep4 + "SKILL.md"))
     refuse2();
   const text2 = read2(document2);
@@ -13466,11 +13552,33 @@ function identity3(document2, cache, read2) {
     const path = join14(root, ".codex-plugin", "plugin.json");
     if (!lstatSync12(path, { throwIfNoEntry: false }))
       continue;
-    const controls = rootControls(root, read2);
-    return { name: `${controls.namespace}:${front.name}`, pluginParent: dirname10(root), ...controls };
+    const manifestFile = lstatSync12(path);
+    if (!lstatSync12(join14(root, ".codex-plugin")).isDirectory() || !manifestFile.isFile() || manifestFile.size > 1024 * 1024)
+      refuse2();
+    let manifest;
+    try {
+      const text3 = read2(path);
+      hashNativeJsonControls(text3);
+      manifest = JSON.parse(text3);
+    } catch {
+      refuse2();
+    }
+    if (!manifest || typeof manifest !== "object" || Array.isArray(manifest) || !identifier2(manifest.name))
+      refuse2();
+    const declaredVersion = manifest.version === undefined ? "" : typeof manifest.version === "string" ? manifest.version.trim() : null;
+    if (declaredVersion === null || (declaredVersion ? declaredVersion !== basename5(root) : basename5(root) !== CODEX_DEFAULT_AGENT_PLUGIN_VERSION))
+      refuse2();
+    return { name: `${manifest.name}:${front.name}`, namespace: manifest.name, pluginParent: dirname10(root), root };
   }
   refuse2();
 }
+function identity3(document2, cache, read2) {
+  const parsed = documentIdentity(document2, cache, read2);
+  const controls = rootControls(parsed.root, read2);
+  if (controls.namespace !== parsed.namespace)
+    refuse2();
+  return { name: parsed.name, pluginParent: parsed.pluginParent, ...controls };
+}
 function reviewedCodexPluginCapabilitiesUnchanged(cache, controls, read2) {
   if (!Array.isArray(controls) || controls.length > 4096)
     return false;
@@ -13508,11 +13616,13 @@ function reviewedCodexPluginCapabilitiesUnchanged(cache, controls, read2) {
     return false;
   }
 }
-function reviewCodexPluginSkillControls(catalog, documents, cache, cwd, read2, rules) {
+function reviewCodexPluginControls(catalog, documents, cache, cwd, read2, rules, pluginSettings) {
   if (!supportsCodexNativeCapability(catalog?.version, "qualified-skill-catalog") || catalog.cwd !== cwd)
     refuse2();
   const skills = projectCodexNativeSkillCatalog({ data: [{ cwd, errors: [], skills: catalog.skills }] }, cwd);
-  const allowed = new Set(documents), result = [];
+  const allowed = new Set(documents), result = [], inertDocuments = new Set;
+  const inactivePlugins = new Map;
+  const sourceInputs = new Map;
   let installedPlugins;
   try {
     installedPlugins = projectCodexInstalledPluginEntries(catalog.plugins ?? []);
@@ -13523,25 +13633,48 @@ function reviewCodexPluginSkillControls(catalog, documents, cache, cwd, read2, r
   for (const document2 of candidates) {
     if (!document2.startsWith(cache + sep4))
       continue;
-    const parsed = identity3(document2, cache, read2);
-    if (parsed.name === "skills-cli" || parsed.name.endsWith(":skills-cli"))
+    const located = documentIdentity(document2, cache, read2);
+    if (located.name === "skills-cli" || located.name.endsWith(":skills-cli"))
       refuse2();
-    const cacheParts = relative4(cache, parsed.pluginParent).split(sep4);
+    const cacheParts = relative4(cache, located.pluginParent).split(sep4);
     if (cacheParts.length !== 2 || cacheParts.some((part) => !identifier2(part)))
       refuse2();
     const [marketplace, pluginName] = cacheParts;
-    if (pluginName !== parsed.namespace)
+    if (pluginName !== located.namespace)
       refuse2();
     const expectedPluginId = `${pluginName}@${marketplace}`;
     const listed = skills.filter((skill) => skill.path === document2);
     if (listed.length > 1)
       refuse2();
+    const installed = installedPlugins.filter((plugin) => plugin.id === expectedPluginId && plugin.name === pluginName);
+    if (catalog.version === "codex-cli 0.160.0" && installed.length === 1 && installed[0].installed && installed[0].localVersion === basename5(located.root) && installed[0].sourceType === "local" && codexPluginSourceIsConfigControlled(installed[0])) {
+      const plugin = installed[0], input = { pluginId: expectedPluginId, namespace: located.namespace, pluginParent: located.pluginParent, sourceRoot: plugin.sourcePath, sourceSha256: plugin.sourceSha256 };
+      if (input.sourceRoot !== located.root && !input.sourceRoot.startsWith(cache + sep4) && (lstatSync12(input.sourceRoot, { throwIfNoEntry: false }) || documents.some((path) => path.startsWith(input.sourceRoot + sep4)))) {
+        if (skills.some((skill) => skill.path === input.sourceRoot || skill.path.startsWith(input.sourceRoot + sep4)) || !sourceInputUnchanged(input, cache, read2))
+          refuse2();
+        sourceInputs.set(expectedPluginId, input);
+      }
+    }
+    const settings = pluginSettings && typeof pluginSettings === "object" && !Array.isArray(pluginSettings) ? pluginSettings : undefined;
+    if (catalog.version === "codex-cli 0.160.0" && !listed.length && !skills.some((skill) => skill.pluginId === expectedPluginId) && installed.length === 1 && installed[0].installed && !installed[0].enabled && codexPluginSourceIsConfigControlled(installed[0]) && settings && Object.hasOwn(settings, expectedPluginId) && settings[expectedPluginId]?.enabled === false) {
+      if (!Array.isArray(rules))
+        refuse2();
+      const exactPathDeny = rules.some((rule) => rule?.path === document2 && rule?.enabled === false);
+      if (!lstatSync12(document2).isFile() || realpathSync5(document2) !== document2 || realpathSync5(located.root) !== located.root || realpathSync5(located.pluginParent) !== located.pluginParent || realpathSync5(join14(located.root, ".codex-plugin/plugin.json")) !== join14(located.root, ".codex-plugin/plugin.json") || !exactPathDeny || rules.some((rule) => typeof rule?.name === "string" && rule.name.trim() === located.name && rule?.enabled !== false) || !isCodexNativeSkillDisabled({ name: located.name, path: document2, pluginId: expectedPluginId, enabled: true }, rules))
+        refuse2();
+      inertDocuments.add(document2);
+      const plugin = installed[0];
+      inactivePlugins.set(expectedPluginId, { pluginId: expectedPluginId, namespace: located.namespace, pluginParent: located.pluginParent, sourceType: plugin.sourceType, sourceSha256: plugin.sourceSha256 });
+      continue;
+    }
+    const parsed = { name: located.name, pluginParent: located.pluginParent, ...rootControls(located.root, read2) };
+    if (parsed.namespace !== located.namespace)
+      refuse2();
     let remotePluginId;
     if (listed.length === 1) {
       if (listed[0].name !== parsed.name || listed[0].pluginId !== expectedPluginId)
         refuse2();
     } else {
-      const installed = installedPlugins.filter((plugin2) => plugin2.id === expectedPluginId && plugin2.name === pluginName);
       if (installed.length !== 1 || !installed[0].installed || !installed[0].enabled)
         refuse2();
       const plugin = installed[0];
@@ -13559,9 +13692,48 @@ function reviewCodexPluginSkillControls(catalog, documents, cache, cwd, read2, r
     }
     result.push({ ...parsed, pluginId: expectedPluginId, ...remotePluginId ? { remotePluginId } : {} });
   }
-  if (!result.length && documents.some((document2) => document2.startsWith(cache + sep4)) || new Set(result.map((item) => item.name)).size !== result.length)
+  if (!result.length && documents.some((document2) => document2.startsWith(cache + sep4) && !inertDocuments.has(document2)) || new Set(result.map((item) => item.name)).size !== result.length)
     refuse2();
-  return result;
+  return { skills: result, inactivePlugins: [...inactivePlugins.values()], sourceInputs: [...sourceInputs.values()] };
+}
+function sourceInputUnchanged(input, cache, read2) {
+  try {
+    const parts = relative4(cache, input.pluginParent).split(sep4);
+    if (parts.length !== 2 || parts.some((part) => !identifier2(part)) || parts[1] !== input.namespace || input.pluginId !== `${parts[1]}@${parts[0]}` || !codexPluginSourceIsConfigControlled({ id: input.pluginId, sourceType: "local", sourceSha256: input.sourceSha256 }) || input.sourceSha256 !== hashNativeJsonControls(JSON.stringify({ type: "local", path: input.sourceRoot })) || resolve9(input.sourceRoot) !== input.sourceRoot || !lstatSync12(input.sourceRoot).isDirectory() || realpathSync5(input.sourceRoot) !== input.sourceRoot || input.sourceRoot === cache || input.sourceRoot.startsWith(cache + sep4) || cache.startsWith(input.sourceRoot + sep4))
+      return false;
+    const path = join14(input.sourceRoot, ".codex-plugin/plugin.json"), stat = lstatSync12(path);
+    if (!stat.isFile() || stat.size > 1024 * 1024 || realpathSync5(path) !== path)
+      return false;
+    const text2 = read2(path);
+    hashNativeJsonControls(text2);
+    const manifest = JSON.parse(text2);
+    return Boolean(manifest && typeof manifest === "object" && !Array.isArray(manifest) && manifest.name === input.namespace);
+  } catch {
+    return false;
+  }
+}
+function reviewedCodexPluginSourceRoots(cache, inputs, read2) {
+  if (!Array.isArray(inputs) || inputs.length > 4096 || new Set(inputs.map((input) => input.pluginId)).size !== inputs.length || new Set(inputs.map((input) => input.sourceRoot)).size !== inputs.length || inputs.some((input) => !sourceInputUnchanged(input, cache, read2)))
+    refuse2();
+  const roots = inputs.map((input) => input.sourceRoot);
+  if (roots.some((root) => roots.some((other) => root !== other && root.startsWith(other + sep4))))
+    refuse2();
+  return roots;
+}
+function isReviewedCodexPluginInactive(document2, cache, controls, pluginSettings, rules, read2) {
+  if (!Array.isArray(controls) || controls.length > 4096 || !pluginSettings || typeof pluginSettings !== "object" || Array.isArray(pluginSettings) || !Array.isArray(rules))
+    return false;
+  try {
+    const parsed = documentIdentity(document2, cache, read2), matches = controls.filter((control2) => control2.pluginParent === parsed.pluginParent && control2.namespace === parsed.namespace);
+    if (matches.length !== 1 || !lstatSync12(document2).isFile() || realpathSync5(document2) !== document2 || realpathSync5(parsed.root) !== parsed.root || realpathSync5(parsed.pluginParent) !== parsed.pluginParent || realpathSync5(join14(parsed.root, ".codex-plugin/plugin.json")) !== join14(parsed.root, ".codex-plugin/plugin.json"))
+      return false;
+    const control = matches[0], parts = relative4(cache, parsed.pluginParent).split(sep4);
+    if (parts.length !== 2 || parts.some((part) => !identifier2(part)) || parts[1] !== parsed.namespace || control.pluginId !== `${parts[1]}@${parts[0]}` || !codexPluginSourceIsConfigControlled({ ...control, id: control.pluginId }) || !Object.hasOwn(pluginSettings, control.pluginId) || pluginSettings[control.pluginId]?.enabled !== false)
+      return false;
+    return !rules.some((rule) => (rule?.path === document2 || typeof rule?.name === "string" && rule.name.trim() === parsed.name) && rule?.enabled !== false);
+  } catch {
+    return false;
+  }
 }
 function isReviewedCodexPluginSkillDisabled(document2, cache, controls, rules, read2) {
   if (!document2.startsWith(cache + sep4) || !Array.isArray(controls) || controls.length > 4096)
@@ -14245,10 +14417,75 @@ function disableCodexBundledSkills(text2) {
 // src/lib/agent-integration.ts
 var sha3 = (data) => createHash12("sha256").update(data).digest("hex");
 var ROOTS = NATIVE_SKILL_ROOTS;
+function hasNoDarwinAcl(fd) {
+  try {
+    const { dlopen, read: read2 } = __require("bun:ffi");
+    const library = dlopen("/usr/lib/libSystem.B.dylib", {
+      acl_get_fd: { args: ["i32"], returns: "ptr" },
+      acl_free: { args: ["ptr"], returns: "i32" },
+      __error: { args: [], returns: "ptr" }
+    });
+    try {
+      const errno = library.symbols.__error();
+      if (!errno)
+        return false;
+      const acl = library.symbols.acl_get_fd(fd);
+      if (acl) {
+        library.symbols.acl_free(acl);
+        return false;
+      }
+      return (acl === null || acl === 0) && read2.i32(errno) === 2;
+    } finally {
+      library.close();
+    }
+  } catch {
+    return false;
+  }
+}
+function isSystemRootAlias(path) {
+  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(path))
+    return false;
+  const target = `/private${path}`, link = `private${path}`;
+  const identity4 = (stat) => `${stat.dev}:${stat.ino}:${stat.ctimeNs}:${stat.uid}:${stat.mode}`;
+  try {
+    const before = lstatSync15(path, { bigint: true });
+    if (!before.isSymbolicLink() || before.uid !== 0n || readlinkSync4(path) !== link)
+      return false;
+    const directories = ["/", "/private", target].map((directory) => {
+      const stat = lstatSync15(directory, { bigint: true });
+      if (!stat.isDirectory() || stat.uid !== 0n)
+        throw new Error("Untrusted system alias directory");
+      if (directory !== "/private/tmp") {
+        if ((stat.mode & 0o022n) !== 0n)
+          throw new Error("Writable system alias directory");
+      } else if ((stat.mode & 0o1000n) === 0n)
+        throw new Error("Unprotected system temporary directory");
+      const fd = openSync8(directory, constants7.O_RDONLY | constants7.O_DIRECTORY | constants7.O_NOFOLLOW);
+      try {
+        if (identity4(fstatSync8(fd, { bigint: true })) !== identity4(stat) || !hasNoDarwinAcl(fd) || identity4(fstatSync8(fd, { bigint: true })) !== identity4(stat))
+          throw new Error("Unverified system alias directory ACL");
+      } finally {
+        closeSync8(fd);
+      }
+      return { directory, identity: identity4(stat) };
+    });
+    return realpathSync6(path) === target && readlinkSync4(path) === link && identity4(lstatSync15(path, { bigint: true })) === identity4(before) && directories.every((item) => identity4(lstatSync15(item.directory, { bigint: true })) === item.identity);
+  } catch {
+    return false;
+  }
+}
+function canonicalSystemPath(path) {
+  const absolute = resolve10(path), root = `/${absolute.split(sep5)[1]}`;
+  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(root) || !lstatSync15(root, { throwIfNoEntry: false })?.isSymbolicLink())
+    return absolute;
+  if (!isSystemRootAlias(root))
+    throw new Error(`Refusing symlink path: ${root}`);
+  return `/private${absolute}`;
+}
 function assertSafePath(path) {
   let cursor = resolve10(path);
   while (true) {
-    if (lstatSync15(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync15(cursor, { throwIfNoEntry: false })?.isSymbolicLink() && !isSystemRootAlias(cursor))
       throw new Error(`Refusing symlink path: ${cursor}`);
     const parent = dirname11(cursor);
     if (parent === cursor)
@@ -14284,7 +14521,7 @@ function rootAliases(home, allowed = false) {
   return result;
 }
 function canonicalAgentPath(path, aliases) {
-  const absolute = resolve10(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep5));
+  const absolute = canonicalSystemPath(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep5));
   return binding ? join17(binding.target, relative5(binding.alias, absolute)) : absolute;
 }
 function disabledCodexSkillPaths(config, aliases) {
@@ -14382,17 +14619,19 @@ function selectNativeMigrationTargets(inventory, manifest) {
   const identities = new Set;
   const selected = [];
   for (const target of manifest.targets) {
-    const projectRoot = resolve10(target.projectRoot), normalized = relative5(projectRoot, resolve10(projectRoot, target.path));
-    if (!isAbsolute11(target.projectRoot) || projectRoot !== target.projectRoot || !existsSync8(projectRoot) || !lstatSync15(projectRoot).isDirectory())
+    if (!isAbsolute11(target.projectRoot) || resolve10(target.projectRoot) !== target.projectRoot)
+      throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
+    const projectRoot = canonicalSystemPath(target.projectRoot), normalized = relative5(projectRoot, resolve10(projectRoot, target.path));
+    if (!existsSync8(projectRoot) || !lstatSync15(projectRoot).isDirectory())
       throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
     assertSafePath(projectRoot);
     if (isAbsolute11(target.path) || target.path.includes("\\") || target.path.includes("\x00") || !normalized || normalized === ".." || normalized.startsWith(`..${sep5}`) || normalized !== target.path || !/^[0-9a-f]{64}$/.test(target.treeSha256))
       throw new Error(`Invalid native migration target: ${target.path}`);
-    const identity4 = `${target.agent}\x00${projectRoot}\x00${normalized}`;
+    const identity4 = `${target.agent}\x00${canonicalSystemPath(projectRoot)}\x00${normalized}`;
     if (identities.has(identity4))
       throw new Error(`Duplicate native migration target: ${target.path}`);
     identities.add(identity4);
-    const expected = resolve10(target.projectRoot, target.path);
+    const expected = canonicalSystemPath(resolve10(target.projectRoot, target.path));
     const matches = inventory.filter((entry2) => entry2.agent === target.agent && resolve10(entry2.path) === expected);
     if (matches.length !== 1)
       throw new Error(`Native migration target was not found exactly once: ${target.agent} ${target.projectRoot}/${target.path}`);
@@ -14408,7 +14647,7 @@ function selectNativeMigrationTargets(inventory, manifest) {
 function projectAncestorDirectories(projects) {
   const directories = new Set;
   for (const project of projects) {
-    for (let path = resolve10(project), depth = 0;; depth++) {
+    for (let path = canonicalSystemPath(project), depth = 0;; depth++) {
       if (depth >= 100)
         throw new Error("NATIVE_SKILL_DRIFT: project ancestor discovery limit exceeded");
       directories.add(path);
@@ -14421,11 +14660,13 @@ function projectAncestorDirectories(projects) {
   return [...directories];
 }
 function inventoryNativeSkills(home = homedir2(), options = {}) {
+  home = canonicalSystemPath(home);
   if (options.reviewedCacheAlias !== undefined && (!options.includeVendor || !isAbsolute11(options.reviewedCacheAlias) || resolve10(options.reviewedCacheAlias) !== options.reviewedCacheAlias))
     throw new Error("A reviewed cache alias requires vendor inventory and an exact absolute path");
   if (options.disabledVendorPaths?.some((path) => !isAbsolute11(path) || resolve10(path) !== path))
     throw new Error("Disabled vendor paths must be exact absolute paths");
-  const disabledVendorPaths = new Set(options.disabledVendorPaths ?? []);
+  const reviewedCacheAlias = options.reviewedCacheAlias === undefined ? undefined : canonicalSystemPath(options.reviewedCacheAlias);
+  const disabledVendorPaths = new Set((options.disabledVendorPaths ?? []).map(canonicalSystemPath));
   const aliases = rootAliases(home, options.allowRootAliases);
   const selectedAgents = options.agents ? new Set(options.agents) : undefined;
   const includesAgent = (agent) => !selectedAgents || selectedAgents.has(agent);
@@ -14436,6 +14677,9 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
     for (const [agent, path] of rootDefinitions)
       roots.push([agent, canonicalAgentPath(join17(project, path), aliases)]);
   }
+  const installationInputs = options.codexInstallationInputRoots ?? [];
+  if (installationInputs.some((input) => resolve10(input) !== input || realpathSync6(input) !== input || roots.some(([agent, path]) => agent === "codex" && (path === input || path.startsWith(input + sep5) || input.startsWith(path + sep5)))))
+    throw new Error("Native installation input overlaps an unconditional skill-loading root");
   const entries = [], seen = new Set;
   const cacheScans = new Map, maxAliasProofEntries = 1e4;
   let discoveryEntries = 0, discoveryPathBytes = 0;
@@ -14448,8 +14692,11 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
   }
   let reviewedCacheAliasFound = false;
   function verifiedSiblingCacheAlias(agent, path, parent) {
-    const link = readlinkSync4(path), target = resolve10(parent, link);
-    if (dirname11(target) !== parent || (isAbsolute11(link) ? link !== target : dirname11(link) !== "."))
+    const link = readlinkSync4(path), lexicalTarget = resolve10(parent, link);
+    if (isAbsolute11(link) ? link !== lexicalTarget : dirname11(link) !== ".")
+      return false;
+    const target = canonicalSystemPath(lexicalTarget);
+    if (dirname11(target) !== parent)
       return false;
     if (!lstatSync15(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
@@ -14458,20 +14705,22 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
       return false;
     if (scan.hasSkills) {
       const targetSkills = entries.filter((entry) => entry.agent === agent && entry.vendor && (entry.path === target || entry.path.startsWith(target + sep5)));
-      if (path === options.reviewedCacheAlias && targetSkills.length > 0)
+      if (path === reviewedCacheAlias && targetSkills.length > 0)
         reviewedCacheAliasFound = true;
       if (agent === "codex" && targetSkills.length > 0 && targetSkills.every((entry) => disabledVendorPaths.has(entry.path) || options.disabledVendorSkill?.(entry) === true))
         return true;
-      if (path !== options.reviewedCacheAlias)
+      if (path !== reviewedCacheAlias)
         return false;
     }
     return true;
   }
-  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false, admitted = false) {
+  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false, admitted = false, configuredRoot = false) {
     if (!admitted)
       admit(path);
     const scan = { complete: true, hasSkills: false, entries: 1 };
     assertSafePath(path);
+    if (configuredRoot && agent === "codex" && installationInputs.includes(path))
+      return scan;
     if (!existsSync8(path))
       return scan;
     const stat = lstatSync15(path);
@@ -14527,7 +14776,7 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
           continue;
         }
       }
-      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache, true);
+      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache, true, configuredRoot);
       scan.complete &&= childScan.complete;
       scan.hasSkills ||= childScan.hasSkills;
       scan.entries += childScan.entries;
@@ -14536,10 +14785,10 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
       cacheScans.set(path, scan);
     return scan;
   }
-  function scanRoot(agent, path, vendor = false, pluginCache = false) {
+  function scanRoot(agent, path, vendor = false, pluginCache = false, configuredRoot = false) {
     if (agent === "hermes" || options.guardHermes && `${path}${sep5}`.includes(`${sep5}.agents${sep5}skills${sep5}`))
       assertNoHermesLegacyShadow(path);
-    if (!visit2(agent, path, vendor, 0, pluginCache).complete)
+    if (!visit2(agent, path, vendor, 0, pluginCache, false, configuredRoot).complete)
       throw new Error(`Native skill discovery limit exceeded; review this root before continuing: ${path}`);
   }
   for (const [agent, path] of roots)
@@ -14555,7 +14804,7 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
   const configured = options.configured ? INTEGRATION_AGENTS.filter(includesAgent).flatMap((agent) => resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, canonical: (path) => canonicalAgentPath(path, aliases) }).roots.map((path) => ({ agent, path }))) : [];
   for (const root of [...options.agentRoots ?? [], ...configured])
     if (includesAgent(root.agent))
-      scanRoot(root.agent, canonicalAgentPath(root.path, aliases), true);
+      scanRoot(root.agent, canonicalAgentPath(root.path, aliases), true, false, true);
   if (options.reviewedCacheAlias !== undefined && !reviewedCacheAliasFound)
     throw new Error("Reviewed cache alias was not an inventoried skill-containing sibling alias");
   recheckRootAliases(aliases);
@@ -14695,6 +14944,11 @@ enabled = false
   Bun.TOML.parse(result);
   return result;
 }
+function assertCodexInstallationInputs(home, projectDirs, inputs) {
+  const nativeRoots = [home, ...projectAncestorDirectories(projectDirs)].flatMap((directory) => ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => resolve10(directory, path)));
+  if (inputs.some((input) => nativeRoots.some((root) => root === input || root.startsWith(input + sep5) || input.startsWith(root + sep5))))
+    throw new Error("Native installation input overlaps an unconditional skill-loading root");
+}
 function planAgentIntegration(options) {
   const home = options.home ?? homedir2(), dataDir2 = options.dataDir ?? getDataDirReadOnly();
   const aliases = rootAliases(home, options.allowRootAliases);
@@ -14733,11 +14987,16 @@ function planAgentIntegration(options) {
   const codexConfig = options.agents.includes("codex") ? Bun.TOML.parse(readOptional(canonicalAgentPath(join17(home, ".codex", "config.toml"), aliases)) ?? "") : {};
   const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases, reviewedCacheAlias: options.reviewedCacheAlias, disabledVendorPaths: disabledCodexSkillPaths(codexConfig, aliases) });
   const observedNativeSources = [];
-  const codexPluginSkills = options.codexNativeCatalog ? reviewCodexPluginSkillControls(options.codexNativeCatalog, nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor).map((entry) => join17(entry.path, "SKILL.md")), canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), resolve10(options.projectDir ?? home), (path) => {
+  const codexPluginControls = options.codexNativeCatalog ? reviewCodexPluginControls(options.codexNativeCatalog, nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor).map((entry) => join17(entry.path, "SKILL.md")), canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), resolve10(options.projectDir ?? home), (path) => {
     const bytes = readNativeBytes(path, 1024 * 1024);
     observedNativeSources.push({ path, sha256: sha3(bytes) });
     return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-  }, codexConfig.skills?.config ?? []) : policy.bridge?.codexPluginSkills ?? [];
+  }, codexConfig.skills?.config ?? [], codexConfig.plugins) : { skills: policy.bridge?.codexPluginSkills ?? [], inactivePlugins: policy.bridge?.codexInactivePlugins ?? [], sourceInputs: policy.bridge?.discovery?.codex?.codexInstallationInputs?.plugins ?? [] };
+  const codexPluginSkills = codexPluginControls.skills;
+  const codexInactivePlugins = codexPluginControls.inactivePlugins;
+  const codexDiscovery = discoveries.find((binding) => binding.agent === "codex");
+  const codexPluginSourceInputs = codexPluginControls.sourceInputs.filter((input) => codexDiscovery?.method === "reviewed" && codexDiscovery.roots.some((root) => root === input.sourceRoot || root.startsWith(input.sourceRoot + sep5) || input.sourceRoot.startsWith(root + sep5)) && codexDiscovery.sources.some((source) => source.path === join17(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined));
+  assertCodexInstallationInputs(home, [options.projectDir ?? home], codexPluginSourceInputs.map((input) => input.sourceRoot));
   const changes = [];
   for (const agent of [...new Set(options.agents)]) {
     if (!INTEGRATION_AGENTS.includes(agent))
@@ -14802,7 +15061,16 @@ function planAgentIntegration(options) {
         changes.push({ path: configPath, before: previous, after: next });
     }
   }
-  const discoveryAfter = discoveries.map((binding) => rebindAgentDiscovery(binding, new Map(changes.map((change) => [change.path, change.after]))));
+  const codexPluginSkillReview = options.codexNativeCatalog ? { version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, catalogSha256: sha3(JSON.stringify({ version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, skills: projectCodexNativeSkillCatalog({ data: [{ cwd: options.codexNativeCatalog.cwd, errors: [], skills: options.codexNativeCatalog.skills }] }, options.codexNativeCatalog.cwd), ...options.codexNativeCatalog.plugins === undefined ? {} : { plugins: projectCodexInstalledPluginEntries(options.codexNativeCatalog.plugins) } })), configSha256: changes.find((change) => change.path === canonicalAgentPath(join17(home, ".codex/config.toml"), aliases))?.before === null ? null : sha3(readOptional(canonicalAgentPath(join17(home, ".codex/config.toml"), aliases)) ?? "") } : policy.bridge?.codexPluginSkillReview;
+  const discoveryAfter = discoveries.map((binding) => {
+    const rebound = rebindAgentDiscovery(binding, new Map(changes.map((change) => [change.path, change.after])));
+    if (binding.agent !== "codex")
+      return rebound;
+    const { codexInstallationInputs: previousInputs, ...current } = rebound;
+    const inputs = codexPluginSourceInputs.map((input) => input.sourceRoot);
+    const directories = options.codexNativeCatalog || !previousInputs ? captureDiscoveryDirectories((binding.directories ?? []).filter((directory) => inputs.some((root) => root.startsWith(directory.path + sep5))).map((directory) => directory.path), inputs) : previousInputs.directories;
+    return codexPluginSourceInputs.length ? { ...current, codexInstallationInputs: { version: "codex-cli 0.160.0", catalogSha256: codexPluginSkillReview.catalogSha256, plugins: codexPluginSourceInputs, ...directories?.length ? { directories } : {} } } : current;
+  });
   const nextPolicy = { ...policy, version: 1, loading: "cli", profileId, bridge: {
     ...policy.bridge,
     version: CLI_BRIDGE_VERSION,
@@ -14815,7 +15083,7 @@ function planAgentIntegration(options) {
     profiles: Object.fromEntries([...new Set([...priorAgents, ...options.agents])].sort().map((agent) => [agent, bindings.get(agent)?.profileId ?? policy.bridge?.profiles?.[agent] ?? policy.profileId])),
     disabledBuiltins: options.agents.includes("codex") ? nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor && entry.path.startsWith(canonicalAgentPath(join17(home, ".codex", "skills", ".system"), aliases) + sep5)).map((entry) => ({ path: entry.path, hash: entry.hash })) : policy.bridge?.disabledBuiltins ?? [],
     rootAliases: aliases,
-    ...codexPluginSkills.length ? { codexPluginSkills, codexPluginSkillReview: options.codexNativeCatalog ? { version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, catalogSha256: sha3(JSON.stringify({ version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, skills: projectCodexNativeSkillCatalog({ data: [{ cwd: options.codexNativeCatalog.cwd, errors: [], skills: options.codexNativeCatalog.skills }] }, options.codexNativeCatalog.cwd), ...options.codexNativeCatalog.plugins === undefined ? {} : { plugins: projectCodexInstalledPluginEntries(options.codexNativeCatalog.plugins) } })), configSha256: changes.find((change) => change.path === canonicalAgentPath(join17(home, ".codex/config.toml"), aliases))?.before === null ? null : sha3(readOptional(canonicalAgentPath(join17(home, ".codex/config.toml"), aliases)) ?? "") } : policy.bridge?.codexPluginSkillReview } : {},
+    ...options.codexNativeCatalog || codexPluginSkills.length || codexInactivePlugins.length || codexPluginSourceInputs.length ? { codexPluginSkills, codexInactivePlugins, codexPluginSkillReview } : {},
     discovery: { ...policy.bridge?.discovery, ...Object.fromEntries(discoveryAfter.map((binding) => [binding.agent, binding])) }
   } };
   const serializedPolicy = serializeManagedSkillPolicy(nextPolicy);
@@ -15306,7 +15574,12 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
     throw new Error("NATIVE_SKILL_DRIFT: the Codex CLI bridge is disabled; run skills hook install");
   if (agent === "codex" && !reviewedCodexPluginCapabilitiesUnchanged(canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), binding.codexPluginSkills ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024))))
     throw new Error("NATIVE_SKILL_DRIFT: reviewed native plugin capability controls changed; run skills hook install with a fresh discovery review");
-  const disabledPlugin = (entry) => agent === "codex" && entry.vendor && isReviewedCodexPluginSkillDisabled(join17(entry.path, "SKILL.md"), canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), binding.codexPluginSkills ?? [], codexConfig.skills?.config, (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024)));
+  const disabledPlugin = (entry) => {
+    if (agent !== "codex" || !entry.vendor)
+      return false;
+    const document2 = join17(entry.path, "SKILL.md"), cache = canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), read2 = (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024));
+    return isReviewedCodexPluginInactive(document2, cache, binding.codexInactivePlugins ?? [], codexConfig.plugins, codexConfig.skills?.config ?? [], read2) || isReviewedCodexPluginSkillDisabled(document2, cache, binding.codexPluginSkills ?? [], codexConfig.skills?.config, read2);
+  };
   const disabledPaths = new Set(disabledCodexSkillPaths(codexConfig, aliases));
   const disabledVendorSkill = (entry) => {
     if (agent !== "codex" || !entry.vendor)
@@ -15343,7 +15616,15 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
   } catch (error) {
     throw new Error(`NATIVE_SKILL_DRIFT: ${error.message}`);
   }
-  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0, disabledVendorPaths: agent === "codex" ? disabledCodexSkillPaths(codexConfig, aliases) : [], disabledVendorSkill: disabledPlugin });
+  let installationInputRoots = [];
+  if (agent === "codex") {
+    try {
+      installationInputRoots = reviewedCodexPluginSourceRoots(canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), discovery.codexInstallationInputs?.plugins ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024)));
+    } catch {
+      throw new Error("NATIVE_SKILL_DRIFT: native installation input identity changed; review discovery and catalog");
+    }
+  }
+  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0, disabledVendorPaths: agent === "codex" ? disabledCodexSkillPaths(codexConfig, aliases) : [], disabledVendorSkill: disabledPlugin, codexInstallationInputRoots: installationInputRoots });
   const unexpected = inventory.filter((entry) => visible(entry) && !entry.bridge && !disabledVendorSkill(entry));
   if (unexpected.length) {
     const paths = unexpected.slice(0, 3).map((entry) => {
@@ -18027,8 +18308,16 @@ function verifyAgentDiscovery(binding, codexRecovery) {
     throw new Error("Invalid native discovery binding");
   if (binding.agent === "hermes" && !binding.directories?.length)
     throw new Error("Hermes discovery requires directory membership coverage; run skills hook install with a fresh discovery review");
-  if (binding.directories !== undefined)
-    verifyDiscoveryDirectories(binding.directories);
+  const installationRoots = codexInstallationRoots(binding);
+  const installationInput = (path) => installationRoots.some((root2) => path === root2 || path.startsWith(root2 + sep6));
+  if (binding.directories !== undefined) {
+    const projected2 = binding.codexInstallationInputs?.directories ?? [];
+    const ancestors2 = binding.directories.filter((directory) => installationRoots.some((root2) => root2.startsWith(directory.path + sep6)));
+    if (projected2.length !== ancestors2.length || projected2.some((directory) => !ancestors2.some((original) => original.path === directory.path)))
+      throw new Error("Missing installation input directory projection");
+    verifyDiscoveryDirectories(binding.directories.filter((directory) => !installationInput(directory.path) && !ancestors2.includes(directory)));
+    verifyDiscoveryDirectories(projected2, installationRoots);
+  }
   const budget = discoveryByteBudget();
   for (const source of binding.sources) {
     assertMarketplaceBinding(binding, source);
@@ -18038,6 +18327,10 @@ function verifyAgentDiscovery(binding, codexRecovery) {
       throw new Error("Invalid native discovery projection");
     if (source.sha256 !== null && !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Invalid native discovery digest");
+    if (installationInput(source.path)) {
+      safe4(source.path);
+      continue;
+    }
     const current = projected(source, undefined, budget);
     if (current !== source.sha256 && !verifiesCodexHookDiscoverySource(binding, source, current, codexRecovery))
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
@@ -18045,6 +18338,27 @@ function verifyAgentDiscovery(binding, codexRecovery) {
   for (const root2 of binding.roots)
     safe4(root2);
 }
+function codexInstallationRoots(binding) {
+  const proof = binding.codexInstallationInputs;
+  if (proof === undefined)
+    return [];
+  if (binding.agent !== "codex" || binding.method !== "reviewed" || proof.version !== "codex-cli 0.160.0" || !/^[a-f0-9]{64}$/.test(proof.catalogSha256) || !Array.isArray(proof.plugins) || !proof.plugins.length)
+    throw new Error("Invalid native installation input proof");
+  const cache = dirname17(dirname17(proof.plugins[0].pluginParent));
+  const config = join27(dirname17(dirname17(cache)), "config.toml"), home = dirname17(dirname17(dirname17(cache)));
+  const configSource = binding.sources.find((source) => source.path === config && source.sha256 !== null && (!source.format || source.format === "toml" && source.fields?.includes("plugins")));
+  const nativeRoots = NATIVE_SKILL_ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => join27(home, path));
+  if (!configSource || proof.plugins.some((input) => nativeRoots.some((root2) => root2 === input.sourceRoot || root2.startsWith(input.sourceRoot + sep6) || input.sourceRoot.startsWith(root2 + sep6)) || binding.sources.some((source) => basename9(source.path) === "config.toml" && (source.path === input.sourceRoot || source.path.startsWith(input.sourceRoot + sep6)))))
+    throw new Error("Native installation input overlaps configuration or loading roots");
+  if (proof.plugins.some((input) => dirname17(dirname17(input.pluginParent)) !== cache || !binding.sources.some((source) => source.path === join27(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined)))
+    throw new Error("Missing native installation input source witness");
+  return reviewedCodexPluginSourceRoots(cache, proof.plugins, (path) => {
+    const text2 = read2(path);
+    if (text2 === null)
+      throw new Error("Missing native installation input");
+    return text2;
+  });
+}
 function assertMarketplaceBinding(binding, source) {
   if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2") && (binding.agent !== "codex" || binding.method !== "reviewed" || basename9(source.path) !== "config.toml"))
     throw new Error("Codex settings witnesses require explicit reviewed Codex configuration");
@@ -18055,8 +18369,11 @@ function assertMarketplaceBinding(binding, source) {
 }
 function rebindAgentDiscovery(binding, changes) {
   const budget = discoveryByteBudget();
+  const installationRoots = codexInstallationRoots(binding);
   return { ...binding, sources: binding.sources.map((source) => {
     assertMarketplaceBinding(binding, source);
+    if (!changes.has(source.path) && installationRoots.some((root2) => source.path.startsWith(root2 + sep6)))
+      return source;
     const sha2562 = projected(source, changes, budget);
     if (!changes.has(source.path) && sha2562 !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);