@hasna/skills 0.10.24 → 0.10.25

package/README.md

@@ -530,6 +530,17 @@ hooks, commands and unsupported MCP controls refuse. Referenced own-root
 tool, approval, timeout and environment metadata. Their complete fingerprints
 and presence remain bound; review never executes commands or resolves environment
 values. Name controls suppress Skills, not every plugin capability.
+A Codex 0.160 catalog may also prove a nonremote plugin is installed but disabled.
+With an exact current path deny and explicit witnessed plugin disable, its cache
+can remain inert across versions; re-enable, ambiguous identity, conflicting
+controls and unsafe paths refuse. This does not approve its hook declarations.
+Remote-controlled, missing or unknown source identities do not qualify.
+
+The catalog retains local source paths separately from installed cache identities.
+When a reviewed discovery witness binds a positively mapped installation input,
+runtime checks omit that input from plugin skill loading. Default home/project
+roots and installed caches are still checked, and migration inventory remains
+complete. Overlapping, linked, missing or contradictory mappings refuse.
 No prompt hook starts an app server to obtain this receipt:
 native startup can maintain caches. The explicit capture starts and closes only its
 own bounded native client; it does not reload an existing agent session.

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.24",
+    version: "0.10.25",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -39944,6 +39944,18 @@ function assertAgentPolicyCollections(policy) {
       if (control.appSha256 !== undefined)
         requireBound(typeof control.appSha256 === "string" && /^[a-f0-9]{64}$/.test(control.appSha256));
     }
+  if (bridge.codexInactivePlugins !== undefined) {
+    const controls = array(bridge.codexInactivePlugins, 4096), ids = new Set;
+    requireBound(controls.length === 0 || object(bridge.codexPluginSkillReview) && bridge.codexPluginSkillReview.version === "codex-cli 0.160.0" && typeof bridge.codexPluginSkillReview.catalogSha256 === "string" && /^[a-f0-9]{64}$/.test(bridge.codexPluginSkillReview.catalogSha256));
+    for (const control of controls) {
+      requireBound(object(control) && Object.keys(control).every((key) => ["pluginId", "namespace", "pluginParent", "sourceType", "sourceSha256"].includes(key)));
+      text(control.pluginId, 1024);
+      text(control.namespace, 64);
+      text(control.pluginParent);
+      requireBound(!ids.has(control.pluginId) && isAbsolute2(control.pluginParent) && resolve3(control.pluginParent) === control.pluginParent && ["local", "git", "npm"].includes(control.sourceType) && typeof control.sourceSha256 === "string" && /^[a-f0-9]{64}$/.test(control.sourceSha256));
+      ids.add(control.pluginId);
+    }
+  }
   if (bridge.disabledBuiltins !== undefined)
     for (const builtin of array(bridge.disabledBuiltins, AGENT_POLICY_LIMITS.builtinNames)) {
       requireBound(object(builtin));
@@ -39956,6 +39968,25 @@ function assertAgentPolicyCollections(policy) {
     text(agent, 128);
     requireBound(object(value));
     text(value.agent, 128);
+    if (value.codexInstallationInputs !== undefined) {
+      const proof = record(value.codexInstallationInputs, 4), inputs = array(proof.plugins, 4096), ids = new Set;
+      requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && proof.version === "codex-cli 0.160.0" && typeof proof.catalogSha256 === "string" && /^[a-f0-9]{64}$/.test(proof.catalogSha256) && inputs.length > 0 && object(bridge.codexPluginSkillReview) && bridge.codexPluginSkillReview.version === proof.version && bridge.codexPluginSkillReview.catalogSha256 === proof.catalogSha256);
+      for (const input of inputs) {
+        requireBound(object(input) && Object.keys(input).every((key) => ["pluginId", "namespace", "pluginParent", "sourceRoot", "sourceSha256"].includes(key)));
+        text(input.pluginId, 1024);
+        text(input.namespace, 64);
+        text(input.pluginParent);
+        text(input.sourceRoot);
+        requireBound(!ids.has(input.pluginId) && [input.pluginParent, input.sourceRoot].every((path) => isAbsolute2(path) && resolve3(path) === path) && typeof input.sourceSha256 === "string" && /^[a-f0-9]{64}$/.test(input.sourceSha256));
+        ids.add(input.pluginId);
+      }
+      if (proof.directories !== undefined)
+        for (const directory of array(proof.directories, AGENT_POLICY_LIMITS.discoveryDirectories)) {
+          requireBound(object(directory));
+          text(directory.path);
+          requireBound(directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256));
+        }
+    }
     for (const root of array(value.roots, AGENT_POLICY_LIMITS.discoveryRoots))
       text(root);
     for (const source of array(value.sources, AGENT_POLICY_LIMITS.discoverySources)) {
@@ -47235,7 +47266,7 @@ function safe(path) {
 function same(before2, after2) {
   return Boolean(after2 && after2.isDirectory() && before2.dev === after2.dev && before2.ino === after2.ino && before2.mtimeMs === after2.mtimeMs && before2.ctimeMs === after2.ctimeMs);
 }
-function capture(path, budget) {
+function capture(path, budget, excludedRoots) {
   safe(path);
   const root = lstatSync4(path, { throwIfNoEntry: false });
   if (!root)
@@ -47264,7 +47295,7 @@ function capture(path, budget) {
       budget.bytes += Buffer.byteLength(row);
       need(budget.bytes <= AGENT_POLICY_LIMITS.discoveryDirectoryBytes, "Native discovery directory metadata limit exceeded");
       hash.update(row);
-      if (stat.isDirectory())
+      if (stat.isDirectory() && !excludedRoots.includes(child))
         walk(child, childRelative, stat, depth + 1);
     }
     need(same(before2, lstatSync4(current, { throwIfNoEntry: false })), "Native discovery directory changed while reading");
@@ -47273,16 +47304,18 @@ function capture(path, budget) {
   safe(path);
   return { path, sha256: hash.digest("hex") };
 }
-function captureDiscoveryDirectories(paths) {
+function captureDiscoveryDirectories(paths, excludedRoots = []) {
   need(Array.isArray(paths) && paths.length <= AGENT_POLICY_LIMITS.discoveryDirectories && new Set(paths).size === paths.length, "Invalid native discovery directory collection");
   const budget = { entries: 0, bytes: 0 };
-  return paths.map((path) => capture(path, budget));
+  for (const root of excludedRoots)
+    safe(root);
+  return paths.map((path) => capture(path, budget, excludedRoots));
 }
-function verifyDiscoveryDirectories(directories) {
+function verifyDiscoveryDirectories(directories, excludedRoots = []) {
   need(Array.isArray(directories) && directories.length <= AGENT_POLICY_LIMITS.discoveryDirectories, "Invalid native discovery directory collection");
   for (const directory of directories)
     need(directory && typeof directory === "object" && (directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256)), "Invalid native discovery directory digest");
-  const current = captureDiscoveryDirectories(directories.map((directory) => directory.path));
+  const current = captureDiscoveryDirectories(directories.map((directory) => directory.path), excludedRoots);
   for (let i = 0;i < directories.length; i++)
     need(current[i].sha256 === directories[i].sha256, `Native discovery directory membership changed; run skills hook install with a fresh discovery review: ${directories[i].path}`);
 }
@@ -51059,9 +51092,22 @@ var init_codex_hook_rpc = __esm(() => {
 // src/lib/codex-native-skill-catalog.ts
 import { realpathSync as realpathSync4 } from "fs";
 import { isAbsolute as isAbsolute10, normalize as normalize2 } from "path";
+function codexPluginSourceIsConfigControlled(plugin) {
+  const remoteRealms = ["openai-curated-remote", "created-by-me-remote", "workspace-directory", "workspace-shared-with-me", "workspace-shared-with-me-private", "workspace-shared-with-me-unlisted"];
+  return Boolean(plugin.sourceType && ["local", "git", "npm"].includes(plugin.sourceType) && plugin.sourceSha256 && /^[a-f0-9]{64}$/.test(plugin.sourceSha256) && !plugin.remotePluginId && !remoteRealms.includes(plugin.id.slice(plugin.id.lastIndexOf("@") + 1)));
+}
 function refuse() {
   throw new Error("CODEX_NATIVE_SKILL_CATALOG_INVALID");
 }
+function projectPluginSource(source) {
+  if (!object4(source))
+    return {};
+  if (source.type === "remote")
+    return { sourceType: "remote" };
+  const optionalText = (value) => value === undefined || value === null || scalar(value, MAX_PATH_BYTES);
+  const valid = source.type === "local" ? Object.keys(source).every((key) => ["type", "path"].includes(key)) && absolutePath2(source.path) : source.type === "git" ? Object.keys(source).every((key) => ["type", "url", "path", "refName", "sha"].includes(key)) && scalar(source.url, MAX_PATH_BYTES) && [source.path, source.refName, source.sha].every(optionalText) : source.type === "npm" ? Object.keys(source).every((key) => ["type", "package", "version", "registry"].includes(key)) && scalar(source.package, MAX_NAME_BYTES) && [source.version, source.registry].every(optionalText) : false;
+  return valid ? { sourceType: source.type, sourceSha256: hashNativeJsonControls(JSON.stringify(source)), ...source.type === "local" ? { sourcePath: source.path } : {} } : {};
+}
 function projectCodexNativeSkillCatalog(response, cwd2) {
   if (!absolutePath2(cwd2) || !object4(response) || !Array.isArray(response.data) || response.data.length !== 1)
     refuse();
@@ -51091,7 +51137,10 @@ function projectCodexInstalledPlugins(response) {
       plugins.push({
         ...value,
         marketplace: marketplace.name,
-        sourceType: object4(value.source) && value.source.type === "remote" ? "remote" : undefined
+        sourceType: undefined,
+        sourceSha256: undefined,
+        sourcePath: undefined,
+        ...projectPluginSource(value.source)
       });
     }
   }
@@ -51102,7 +51151,7 @@ function projectCodexInstalledPluginEntries(value) {
     refuse();
   const ids = new Set;
   return value.map((item) => {
-    if (!object4(item) || !scalar(item.id, MAX_PLUGIN_ID_BYTES) || !scalar(item.name, MAX_NAME_BYTES) || typeof item.installed !== "boolean" || typeof item.enabled !== "boolean" || item.localVersion !== null && !scalar(item.localVersion, MAX_NAME_BYTES) || item.remotePluginId !== undefined && item.remotePluginId !== null && !remotePluginIdentifier(item.remotePluginId) || item.sourceType !== undefined && item.sourceType !== "remote")
+    if (!object4(item) || !scalar(item.id, MAX_PLUGIN_ID_BYTES) || !scalar(item.name, MAX_NAME_BYTES) || typeof item.installed !== "boolean" || typeof item.enabled !== "boolean" || item.localVersion !== null && !scalar(item.localVersion, MAX_NAME_BYTES) || item.remotePluginId !== undefined && item.remotePluginId !== null && !remotePluginIdentifier(item.remotePluginId) || item.sourceType !== undefined && !["remote", "local", "git", "npm"].includes(item.sourceType) || (["local", "git", "npm"].includes(item.sourceType) ? typeof item.sourceSha256 !== "string" || !/^[a-f0-9]{64}$/.test(item.sourceSha256) : item.sourceSha256 !== undefined) || (item.sourceType === "local" ? !absolutePath2(item.sourcePath) || normalize2(item.sourcePath) !== item.sourcePath || item.sourceSha256 !== hashNativeJsonControls(JSON.stringify({ type: "local", path: item.sourcePath })) : item.sourcePath !== undefined))
       refuse();
     const at2 = item.id.lastIndexOf("@");
     if (at2 < 1 || item.id.slice(0, at2) !== item.name || at2 === item.id.length - 1 || ids.has(item.id))
@@ -51114,7 +51163,9 @@ function projectCodexInstalledPluginEntries(value) {
       installed: item.installed,
       enabled: item.enabled,
       localVersion: item.localVersion ?? null,
-      ...item.sourceType === "remote" ? { sourceType: "remote" } : {},
+      ...item.sourceType === undefined ? {} : { sourceType: item.sourceType },
+      ...item.sourceSha256 === undefined ? {} : { sourceSha256: item.sourceSha256 },
+      ...item.sourcePath === undefined ? {} : { sourcePath: item.sourcePath },
       ...item.remotePluginId == null ? {} : { remotePluginId: item.remotePluginId }
     };
   });
@@ -51184,6 +51235,7 @@ var MAX_SKILLS = 4096, MAX_NAME_BYTES = 1024, MAX_PATH_BYTES = 16384, MAX_PLUGIN
 var init_codex_native_skill_catalog = __esm(() => {
   init_codex_hook_rpc();
   init_codex_native_compatibility();
+  init_claude_settings_witness();
 });
 
 // src/lib/codex-plugin-skill-controls.ts
@@ -51332,7 +51384,7 @@ function rootControls(root, read2) {
   const appSha256 = present ? appControls(app, read2) : undefined;
   return { namespace: manifest.name, manifestSha256, ...appSha256 ? { appSha256 } : {}, ...mcpSha256 ? { mcpSha256 } : {} };
 }
-function identity4(document3, cache3, read2) {
+function documentIdentity(document3, cache3, read2) {
   if (!document3.startsWith(cache3 + sep4) || !document3.endsWith(sep4 + "SKILL.md"))
     refuse2();
   const text2 = read2(document3);
@@ -51360,11 +51412,33 @@ function identity4(document3, cache3, read2) {
     const path = join18(root, ".codex-plugin", "plugin.json");
     if (!lstatSync12(path, { throwIfNoEntry: false }))
       continue;
-    const controls = rootControls(root, read2);
-    return { name: `${controls.namespace}:${front.name}`, pluginParent: dirname10(root), ...controls };
+    const manifestFile = lstatSync12(path);
+    if (!lstatSync12(join18(root, ".codex-plugin")).isDirectory() || !manifestFile.isFile() || manifestFile.size > 1024 * 1024)
+      refuse2();
+    let manifest;
+    try {
+      const text3 = read2(path);
+      hashNativeJsonControls(text3);
+      manifest = JSON.parse(text3);
+    } catch {
+      refuse2();
+    }
+    if (!manifest || typeof manifest !== "object" || Array.isArray(manifest) || !identifier2(manifest.name))
+      refuse2();
+    const declaredVersion = manifest.version === undefined ? "" : typeof manifest.version === "string" ? manifest.version.trim() : null;
+    if (declaredVersion === null || (declaredVersion ? declaredVersion !== basename5(root) : basename5(root) !== CODEX_DEFAULT_AGENT_PLUGIN_VERSION))
+      refuse2();
+    return { name: `${manifest.name}:${front.name}`, namespace: manifest.name, pluginParent: dirname10(root), root };
   }
   refuse2();
 }
+function identity4(document3, cache3, read2) {
+  const parsed = documentIdentity(document3, cache3, read2);
+  const controls = rootControls(parsed.root, read2);
+  if (controls.namespace !== parsed.namespace)
+    refuse2();
+  return { name: parsed.name, pluginParent: parsed.pluginParent, ...controls };
+}
 function reviewedCodexPluginCapabilitiesUnchanged(cache3, controls, read2) {
   if (!Array.isArray(controls) || controls.length > 4096)
     return false;
@@ -51402,11 +51476,13 @@ function reviewedCodexPluginCapabilitiesUnchanged(cache3, controls, read2) {
     return false;
   }
 }
-function reviewCodexPluginSkillControls(catalog, documents, cache3, cwd2, read2, rules) {
+function reviewCodexPluginControls(catalog, documents, cache3, cwd2, read2, rules, pluginSettings) {
   if (!supportsCodexNativeCapability(catalog?.version, "qualified-skill-catalog") || catalog.cwd !== cwd2)
     refuse2();
   const skills = projectCodexNativeSkillCatalog({ data: [{ cwd: cwd2, errors: [], skills: catalog.skills }] }, cwd2);
-  const allowed = new Set(documents), result2 = [];
+  const allowed = new Set(documents), result2 = [], inertDocuments = new Set;
+  const inactivePlugins = new Map;
+  const sourceInputs = new Map;
   let installedPlugins;
   try {
     installedPlugins = projectCodexInstalledPluginEntries(catalog.plugins ?? []);
@@ -51417,25 +51493,48 @@ function reviewCodexPluginSkillControls(catalog, documents, cache3, cwd2, read2,
   for (const document3 of candidates) {
     if (!document3.startsWith(cache3 + sep4))
       continue;
-    const parsed = identity4(document3, cache3, read2);
-    if (parsed.name === "skills-cli" || parsed.name.endsWith(":skills-cli"))
+    const located = documentIdentity(document3, cache3, read2);
+    if (located.name === "skills-cli" || located.name.endsWith(":skills-cli"))
       refuse2();
-    const cacheParts = relative4(cache3, parsed.pluginParent).split(sep4);
+    const cacheParts = relative4(cache3, located.pluginParent).split(sep4);
     if (cacheParts.length !== 2 || cacheParts.some((part) => !identifier2(part)))
       refuse2();
     const [marketplace, pluginName] = cacheParts;
-    if (pluginName !== parsed.namespace)
+    if (pluginName !== located.namespace)
       refuse2();
     const expectedPluginId = `${pluginName}@${marketplace}`;
     const listed = skills.filter((skill) => skill.path === document3);
     if (listed.length > 1)
       refuse2();
+    const installed = installedPlugins.filter((plugin) => plugin.id === expectedPluginId && plugin.name === pluginName);
+    if (catalog.version === "codex-cli 0.160.0" && installed.length === 1 && installed[0].installed && installed[0].localVersion === basename5(located.root) && installed[0].sourceType === "local" && codexPluginSourceIsConfigControlled(installed[0])) {
+      const plugin = installed[0], input = { pluginId: expectedPluginId, namespace: located.namespace, pluginParent: located.pluginParent, sourceRoot: plugin.sourcePath, sourceSha256: plugin.sourceSha256 };
+      if (input.sourceRoot !== located.root && !input.sourceRoot.startsWith(cache3 + sep4) && (lstatSync12(input.sourceRoot, { throwIfNoEntry: false }) || documents.some((path) => path.startsWith(input.sourceRoot + sep4)))) {
+        if (skills.some((skill) => skill.path === input.sourceRoot || skill.path.startsWith(input.sourceRoot + sep4)) || !sourceInputUnchanged(input, cache3, read2))
+          refuse2();
+        sourceInputs.set(expectedPluginId, input);
+      }
+    }
+    const settings = pluginSettings && typeof pluginSettings === "object" && !Array.isArray(pluginSettings) ? pluginSettings : undefined;
+    if (catalog.version === "codex-cli 0.160.0" && !listed.length && !skills.some((skill) => skill.pluginId === expectedPluginId) && installed.length === 1 && installed[0].installed && !installed[0].enabled && codexPluginSourceIsConfigControlled(installed[0]) && settings && Object.hasOwn(settings, expectedPluginId) && settings[expectedPluginId]?.enabled === false) {
+      if (!Array.isArray(rules))
+        refuse2();
+      const exactPathDeny = rules.some((rule) => rule?.path === document3 && rule?.enabled === false);
+      if (!lstatSync12(document3).isFile() || realpathSync5(document3) !== document3 || realpathSync5(located.root) !== located.root || realpathSync5(located.pluginParent) !== located.pluginParent || realpathSync5(join18(located.root, ".codex-plugin/plugin.json")) !== join18(located.root, ".codex-plugin/plugin.json") || !exactPathDeny || rules.some((rule) => typeof rule?.name === "string" && rule.name.trim() === located.name && rule?.enabled !== false) || !isCodexNativeSkillDisabled({ name: located.name, path: document3, pluginId: expectedPluginId, enabled: true }, rules))
+        refuse2();
+      inertDocuments.add(document3);
+      const plugin = installed[0];
+      inactivePlugins.set(expectedPluginId, { pluginId: expectedPluginId, namespace: located.namespace, pluginParent: located.pluginParent, sourceType: plugin.sourceType, sourceSha256: plugin.sourceSha256 });
+      continue;
+    }
+    const parsed = { name: located.name, pluginParent: located.pluginParent, ...rootControls(located.root, read2) };
+    if (parsed.namespace !== located.namespace)
+      refuse2();
     let remotePluginId;
     if (listed.length === 1) {
       if (listed[0].name !== parsed.name || listed[0].pluginId !== expectedPluginId)
         refuse2();
     } else {
-      const installed = installedPlugins.filter((plugin2) => plugin2.id === expectedPluginId && plugin2.name === pluginName);
       if (installed.length !== 1 || !installed[0].installed || !installed[0].enabled)
         refuse2();
       const plugin = installed[0];
@@ -51453,9 +51552,48 @@ function reviewCodexPluginSkillControls(catalog, documents, cache3, cwd2, read2,
     }
     result2.push({ ...parsed, pluginId: expectedPluginId, ...remotePluginId ? { remotePluginId } : {} });
   }
-  if (!result2.length && documents.some((document3) => document3.startsWith(cache3 + sep4)) || new Set(result2.map((item) => item.name)).size !== result2.length)
+  if (!result2.length && documents.some((document3) => document3.startsWith(cache3 + sep4) && !inertDocuments.has(document3)) || new Set(result2.map((item) => item.name)).size !== result2.length)
     refuse2();
-  return result2;
+  return { skills: result2, inactivePlugins: [...inactivePlugins.values()], sourceInputs: [...sourceInputs.values()] };
+}
+function sourceInputUnchanged(input, cache3, read2) {
+  try {
+    const parts = relative4(cache3, input.pluginParent).split(sep4);
+    if (parts.length !== 2 || parts.some((part) => !identifier2(part)) || parts[1] !== input.namespace || input.pluginId !== `${parts[1]}@${parts[0]}` || !codexPluginSourceIsConfigControlled({ id: input.pluginId, sourceType: "local", sourceSha256: input.sourceSha256 }) || input.sourceSha256 !== hashNativeJsonControls(JSON.stringify({ type: "local", path: input.sourceRoot })) || resolve10(input.sourceRoot) !== input.sourceRoot || !lstatSync12(input.sourceRoot).isDirectory() || realpathSync5(input.sourceRoot) !== input.sourceRoot || input.sourceRoot === cache3 || input.sourceRoot.startsWith(cache3 + sep4) || cache3.startsWith(input.sourceRoot + sep4))
+      return false;
+    const path = join18(input.sourceRoot, ".codex-plugin/plugin.json"), stat = lstatSync12(path);
+    if (!stat.isFile() || stat.size > 1024 * 1024 || realpathSync5(path) !== path)
+      return false;
+    const text2 = read2(path);
+    hashNativeJsonControls(text2);
+    const manifest = JSON.parse(text2);
+    return Boolean(manifest && typeof manifest === "object" && !Array.isArray(manifest) && manifest.name === input.namespace);
+  } catch {
+    return false;
+  }
+}
+function reviewedCodexPluginSourceRoots(cache3, inputs, read2) {
+  if (!Array.isArray(inputs) || inputs.length > 4096 || new Set(inputs.map((input) => input.pluginId)).size !== inputs.length || new Set(inputs.map((input) => input.sourceRoot)).size !== inputs.length || inputs.some((input) => !sourceInputUnchanged(input, cache3, read2)))
+    refuse2();
+  const roots = inputs.map((input) => input.sourceRoot);
+  if (roots.some((root) => roots.some((other) => root !== other && root.startsWith(other + sep4))))
+    refuse2();
+  return roots;
+}
+function isReviewedCodexPluginInactive(document3, cache3, controls, pluginSettings, rules, read2) {
+  if (!Array.isArray(controls) || controls.length > 4096 || !pluginSettings || typeof pluginSettings !== "object" || Array.isArray(pluginSettings) || !Array.isArray(rules))
+    return false;
+  try {
+    const parsed = documentIdentity(document3, cache3, read2), matches2 = controls.filter((control2) => control2.pluginParent === parsed.pluginParent && control2.namespace === parsed.namespace);
+    if (matches2.length !== 1 || !lstatSync12(document3).isFile() || realpathSync5(document3) !== document3 || realpathSync5(parsed.root) !== parsed.root || realpathSync5(parsed.pluginParent) !== parsed.pluginParent || realpathSync5(join18(parsed.root, ".codex-plugin/plugin.json")) !== join18(parsed.root, ".codex-plugin/plugin.json"))
+      return false;
+    const control = matches2[0], parts = relative4(cache3, parsed.pluginParent).split(sep4);
+    if (parts.length !== 2 || parts.some((part) => !identifier2(part)) || parts[1] !== parsed.namespace || control.pluginId !== `${parts[1]}@${parts[0]}` || !codexPluginSourceIsConfigControlled({ ...control, id: control.pluginId }) || !Object.hasOwn(pluginSettings, control.pluginId) || pluginSettings[control.pluginId]?.enabled !== false)
+      return false;
+    return !rules.some((rule) => (rule?.path === document3 || typeof rule?.name === "string" && rule.name.trim() === parsed.name) && rule?.enabled !== false);
+  } catch {
+    return false;
+  }
 }
 function isReviewedCodexPluginSkillDisabled(document3, cache3, controls, rules, read2) {
   if (!document3.startsWith(cache3 + sep4) || !Array.isArray(controls) || controls.length > 4096)
@@ -52465,6 +52603,9 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
     for (const [agent, path] of rootDefinitions)
       roots.push([agent, canonicalAgentPath(join21(project, path), aliases)]);
   }
+  const installationInputs = options.codexInstallationInputRoots ?? [];
+  if (installationInputs.some((input) => resolve11(input) !== input || realpathSync6(input) !== input || roots.some(([agent, path]) => agent === "codex" && (path === input || path.startsWith(input + sep5) || input.startsWith(path + sep5)))))
+    throw new Error("Native installation input overlaps an unconditional skill-loading root");
   const entries = [], seen = new Set;
   const cacheScans = new Map, maxAliasProofEntries = 1e4;
   let discoveryEntries = 0, discoveryPathBytes = 0;
@@ -52499,11 +52640,13 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
     }
     return true;
   }
-  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false, admitted = false) {
+  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false, admitted = false, configuredRoot = false) {
     if (!admitted)
       admit(path);
     const scan = { complete: true, hasSkills: false, entries: 1 };
     assertSafePath(path);
+    if (configuredRoot && agent === "codex" && installationInputs.includes(path))
+      return scan;
     if (!existsSync12(path))
       return scan;
     const stat = lstatSync15(path);
@@ -52559,7 +52702,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
           continue;
         }
       }
-      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache, true);
+      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache, true, configuredRoot);
       scan.complete &&= childScan.complete;
       scan.hasSkills ||= childScan.hasSkills;
       scan.entries += childScan.entries;
@@ -52568,10 +52711,10 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       cacheScans.set(path, scan);
     return scan;
   }
-  function scanRoot(agent, path, vendor = false, pluginCache = false) {
+  function scanRoot(agent, path, vendor = false, pluginCache = false, configuredRoot = false) {
     if (agent === "hermes" || options.guardHermes && `${path}${sep5}`.includes(`${sep5}.agents${sep5}skills${sep5}`))
       assertNoHermesLegacyShadow(path);
-    if (!visit2(agent, path, vendor, 0, pluginCache).complete)
+    if (!visit2(agent, path, vendor, 0, pluginCache, false, configuredRoot).complete)
       throw new Error(`Native skill discovery limit exceeded; review this root before continuing: ${path}`);
   }
   for (const [agent, path] of roots)
@@ -52587,7 +52730,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
   const configured = options.configured ? INTEGRATION_AGENTS.filter(includesAgent).flatMap((agent) => resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, canonical: (path) => canonicalAgentPath(path, aliases) }).roots.map((path) => ({ agent, path }))) : [];
   for (const root of [...options.agentRoots ?? [], ...configured])
     if (includesAgent(root.agent))
-      scanRoot(root.agent, canonicalAgentPath(root.path, aliases), true);
+      scanRoot(root.agent, canonicalAgentPath(root.path, aliases), true, false, true);
   if (options.reviewedCacheAlias !== undefined && !reviewedCacheAliasFound)
     throw new Error("Reviewed cache alias was not an inventoried skill-containing sibling alias");
   recheckRootAliases(aliases);
@@ -52727,6 +52870,11 @@ enabled = false
   Bun.TOML.parse(result2);
   return result2;
 }
+function assertCodexInstallationInputs(home, projectDirs, inputs) {
+  const nativeRoots = [home, ...projectAncestorDirectories(projectDirs)].flatMap((directory) => ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => resolve11(directory, path)));
+  if (inputs.some((input) => nativeRoots.some((root) => root === input || root.startsWith(input + sep5) || input.startsWith(root + sep5))))
+    throw new Error("Native installation input overlaps an unconditional skill-loading root");
+}
 function planAgentIntegration(options) {
   const home = options.home ?? homedir3(), dataDir3 = options.dataDir ?? getDataDirReadOnly();
   const aliases = rootAliases(home, options.allowRootAliases);
@@ -52765,11 +52913,16 @@ function planAgentIntegration(options) {
   const codexConfig = options.agents.includes("codex") ? Bun.TOML.parse(readOptional(canonicalAgentPath(join21(home, ".codex", "config.toml"), aliases)) ?? "") : {};
   const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases, reviewedCacheAlias: options.reviewedCacheAlias, disabledVendorPaths: disabledCodexSkillPaths(codexConfig, aliases) });
   const observedNativeSources = [];
-  const codexPluginSkills = options.codexNativeCatalog ? reviewCodexPluginSkillControls(options.codexNativeCatalog, nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor).map((entry) => join21(entry.path, "SKILL.md")), canonicalAgentPath(join21(home, ".codex/plugins/cache"), aliases), resolve11(options.projectDir ?? home), (path) => {
+  const codexPluginControls = options.codexNativeCatalog ? reviewCodexPluginControls(options.codexNativeCatalog, nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor).map((entry) => join21(entry.path, "SKILL.md")), canonicalAgentPath(join21(home, ".codex/plugins/cache"), aliases), resolve11(options.projectDir ?? home), (path) => {
     const bytes = readNativeBytes(path, 1024 * 1024);
     observedNativeSources.push({ path, sha256: sha3(bytes) });
     return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-  }, codexConfig.skills?.config ?? []) : policy.bridge?.codexPluginSkills ?? [];
+  }, codexConfig.skills?.config ?? [], codexConfig.plugins) : { skills: policy.bridge?.codexPluginSkills ?? [], inactivePlugins: policy.bridge?.codexInactivePlugins ?? [], sourceInputs: policy.bridge?.discovery?.codex?.codexInstallationInputs?.plugins ?? [] };
+  const codexPluginSkills = codexPluginControls.skills;
+  const codexInactivePlugins = codexPluginControls.inactivePlugins;
+  const codexDiscovery = discoveries.find((binding) => binding.agent === "codex");
+  const codexPluginSourceInputs = codexPluginControls.sourceInputs.filter((input) => codexDiscovery?.method === "reviewed" && codexDiscovery.roots.some((root) => root === input.sourceRoot || root.startsWith(input.sourceRoot + sep5) || input.sourceRoot.startsWith(root + sep5)) && codexDiscovery.sources.some((source) => source.path === join21(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined));
+  assertCodexInstallationInputs(home, [options.projectDir ?? home], codexPluginSourceInputs.map((input) => input.sourceRoot));
   const changes = [];
   for (const agent of [...new Set(options.agents)]) {
     if (!INTEGRATION_AGENTS.includes(agent))
@@ -52834,7 +52987,16 @@ function planAgentIntegration(options) {
         changes.push({ path: configPath, before: previous, after: next });
     }
   }
-  const discoveryAfter = discoveries.map((binding) => rebindAgentDiscovery(binding, new Map(changes.map((change) => [change.path, change.after]))));
+  const codexPluginSkillReview = options.codexNativeCatalog ? { version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, catalogSha256: sha3(JSON.stringify({ version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, skills: projectCodexNativeSkillCatalog({ data: [{ cwd: options.codexNativeCatalog.cwd, errors: [], skills: options.codexNativeCatalog.skills }] }, options.codexNativeCatalog.cwd), ...options.codexNativeCatalog.plugins === undefined ? {} : { plugins: projectCodexInstalledPluginEntries(options.codexNativeCatalog.plugins) } })), configSha256: changes.find((change) => change.path === canonicalAgentPath(join21(home, ".codex/config.toml"), aliases))?.before === null ? null : sha3(readOptional(canonicalAgentPath(join21(home, ".codex/config.toml"), aliases)) ?? "") } : policy.bridge?.codexPluginSkillReview;
+  const discoveryAfter = discoveries.map((binding) => {
+    const rebound = rebindAgentDiscovery(binding, new Map(changes.map((change) => [change.path, change.after])));
+    if (binding.agent !== "codex")
+      return rebound;
+    const { codexInstallationInputs: previousInputs, ...current } = rebound;
+    const inputs = codexPluginSourceInputs.map((input) => input.sourceRoot);
+    const directories = options.codexNativeCatalog || !previousInputs ? captureDiscoveryDirectories((binding.directories ?? []).filter((directory) => inputs.some((root) => root.startsWith(directory.path + sep5))).map((directory) => directory.path), inputs) : previousInputs.directories;
+    return codexPluginSourceInputs.length ? { ...current, codexInstallationInputs: { version: "codex-cli 0.160.0", catalogSha256: codexPluginSkillReview.catalogSha256, plugins: codexPluginSourceInputs, ...directories?.length ? { directories } : {} } } : current;
+  });
   const nextPolicy = { ...policy, version: 1, loading: "cli", profileId, bridge: {
     ...policy.bridge,
     version: CLI_BRIDGE_VERSION,
@@ -52847,7 +53009,7 @@ function planAgentIntegration(options) {
     profiles: Object.fromEntries([...new Set([...priorAgents, ...options.agents])].sort().map((agent) => [agent, bindings.get(agent)?.profileId ?? policy.bridge?.profiles?.[agent] ?? policy.profileId])),
     disabledBuiltins: options.agents.includes("codex") ? nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor && entry.path.startsWith(canonicalAgentPath(join21(home, ".codex", "skills", ".system"), aliases) + sep5)).map((entry) => ({ path: entry.path, hash: entry.hash })) : policy.bridge?.disabledBuiltins ?? [],
     rootAliases: aliases,
-    ...codexPluginSkills.length ? { codexPluginSkills, codexPluginSkillReview: options.codexNativeCatalog ? { version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, catalogSha256: sha3(JSON.stringify({ version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, skills: projectCodexNativeSkillCatalog({ data: [{ cwd: options.codexNativeCatalog.cwd, errors: [], skills: options.codexNativeCatalog.skills }] }, options.codexNativeCatalog.cwd), ...options.codexNativeCatalog.plugins === undefined ? {} : { plugins: projectCodexInstalledPluginEntries(options.codexNativeCatalog.plugins) } })), configSha256: changes.find((change) => change.path === canonicalAgentPath(join21(home, ".codex/config.toml"), aliases))?.before === null ? null : sha3(readOptional(canonicalAgentPath(join21(home, ".codex/config.toml"), aliases)) ?? "") } : policy.bridge?.codexPluginSkillReview } : {},
+    ...options.codexNativeCatalog || codexPluginSkills.length || codexInactivePlugins.length || codexPluginSourceInputs.length ? { codexPluginSkills, codexInactivePlugins, codexPluginSkillReview } : {},
     discovery: { ...policy.bridge?.discovery, ...Object.fromEntries(discoveryAfter.map((binding) => [binding.agent, binding])) }
   } };
   const serializedPolicy = serializeManagedSkillPolicy(nextPolicy);
@@ -53257,7 +53419,12 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
     throw new Error("NATIVE_SKILL_DRIFT: the Codex CLI bridge is disabled; run skills hook install");
   if (agent === "codex" && !reviewedCodexPluginCapabilitiesUnchanged(canonicalAgentPath(join21(home, ".codex/plugins/cache"), aliases), binding.codexPluginSkills ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024))))
     throw new Error("NATIVE_SKILL_DRIFT: reviewed native plugin capability controls changed; run skills hook install with a fresh discovery review");
-  const disabledPlugin = (entry) => agent === "codex" && entry.vendor && isReviewedCodexPluginSkillDisabled(join21(entry.path, "SKILL.md"), canonicalAgentPath(join21(home, ".codex/plugins/cache"), aliases), binding.codexPluginSkills ?? [], codexConfig.skills?.config, (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024)));
+  const disabledPlugin = (entry) => {
+    if (agent !== "codex" || !entry.vendor)
+      return false;
+    const document3 = join21(entry.path, "SKILL.md"), cache3 = canonicalAgentPath(join21(home, ".codex/plugins/cache"), aliases), read2 = (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024));
+    return isReviewedCodexPluginInactive(document3, cache3, binding.codexInactivePlugins ?? [], codexConfig.plugins, codexConfig.skills?.config ?? [], read2) || isReviewedCodexPluginSkillDisabled(document3, cache3, binding.codexPluginSkills ?? [], codexConfig.skills?.config, read2);
+  };
   const disabledPaths = new Set(disabledCodexSkillPaths(codexConfig, aliases));
   const disabledVendorSkill = (entry) => {
     if (agent !== "codex" || !entry.vendor)
@@ -53294,7 +53461,15 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
   } catch (error) {
     throw new Error(`NATIVE_SKILL_DRIFT: ${error.message}`);
   }
-  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0, disabledVendorPaths: agent === "codex" ? disabledCodexSkillPaths(codexConfig, aliases) : [], disabledVendorSkill: disabledPlugin });
+  let installationInputRoots = [];
+  if (agent === "codex") {
+    try {
+      installationInputRoots = reviewedCodexPluginSourceRoots(canonicalAgentPath(join21(home, ".codex/plugins/cache"), aliases), discovery.codexInstallationInputs?.plugins ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024)));
+    } catch {
+      throw new Error("NATIVE_SKILL_DRIFT: native installation input identity changed; review discovery and catalog");
+    }
+  }
+  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0, disabledVendorPaths: agent === "codex" ? disabledCodexSkillPaths(codexConfig, aliases) : [], disabledVendorSkill: disabledPlugin, codexInstallationInputRoots: installationInputRoots });
   const unexpected = inventory.filter((entry) => visible(entry) && !entry.bridge && !disabledVendorSkill(entry));
   if (unexpected.length) {
     const paths = unexpected.slice(0, 3).map((entry) => {
@@ -56666,8 +56841,16 @@ function verifyAgentDiscovery(binding, codexRecovery) {
     throw new Error("Invalid native discovery binding");
   if (binding.agent === "hermes" && !binding.directories?.length)
     throw new Error("Hermes discovery requires directory membership coverage; run skills hook install with a fresh discovery review");
-  if (binding.directories !== undefined)
-    verifyDiscoveryDirectories(binding.directories);
+  const installationRoots = codexInstallationRoots(binding);
+  const installationInput = (path) => installationRoots.some((root2) => path === root2 || path.startsWith(root2 + sep6));
+  if (binding.directories !== undefined) {
+    const projected2 = binding.codexInstallationInputs?.directories ?? [];
+    const ancestors2 = binding.directories.filter((directory) => installationRoots.some((root2) => root2.startsWith(directory.path + sep6)));
+    if (projected2.length !== ancestors2.length || projected2.some((directory) => !ancestors2.some((original) => original.path === directory.path)))
+      throw new Error("Missing installation input directory projection");
+    verifyDiscoveryDirectories(binding.directories.filter((directory) => !installationInput(directory.path) && !ancestors2.includes(directory)));
+    verifyDiscoveryDirectories(projected2, installationRoots);
+  }
   const budget = discoveryByteBudget();
   for (const source of binding.sources) {
     assertMarketplaceBinding(binding, source);
@@ -56677,6 +56860,10 @@ function verifyAgentDiscovery(binding, codexRecovery) {
       throw new Error("Invalid native discovery projection");
     if (source.sha256 !== null && !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Invalid native discovery digest");
+    if (installationInput(source.path)) {
+      safe4(source.path);
+      continue;
+    }
     const current = projected(source, undefined, budget);
     if (current !== source.sha256 && !verifiesCodexHookDiscoverySource(binding, source, current, codexRecovery))
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
@@ -56684,6 +56871,27 @@ function verifyAgentDiscovery(binding, codexRecovery) {
   for (const root2 of binding.roots)
     safe4(root2);
 }
+function codexInstallationRoots(binding) {
+  const proof = binding.codexInstallationInputs;
+  if (proof === undefined)
+    return [];
+  if (binding.agent !== "codex" || binding.method !== "reviewed" || proof.version !== "codex-cli 0.160.0" || !/^[a-f0-9]{64}$/.test(proof.catalogSha256) || !Array.isArray(proof.plugins) || !proof.plugins.length)
+    throw new Error("Invalid native installation input proof");
+  const cache3 = dirname17(dirname17(proof.plugins[0].pluginParent));
+  const config = join32(dirname17(dirname17(cache3)), "config.toml"), home = dirname17(dirname17(dirname17(cache3)));
+  const configSource = binding.sources.find((source) => source.path === config && source.sha256 !== null && (!source.format || source.format === "toml" && source.fields?.includes("plugins")));
+  const nativeRoots = NATIVE_SKILL_ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => join32(home, path));
+  if (!configSource || proof.plugins.some((input) => nativeRoots.some((root2) => root2 === input.sourceRoot || root2.startsWith(input.sourceRoot + sep6) || input.sourceRoot.startsWith(root2 + sep6)) || binding.sources.some((source) => basename9(source.path) === "config.toml" && (source.path === input.sourceRoot || source.path.startsWith(input.sourceRoot + sep6)))))
+    throw new Error("Native installation input overlaps configuration or loading roots");
+  if (proof.plugins.some((input) => dirname17(dirname17(input.pluginParent)) !== cache3 || !binding.sources.some((source) => source.path === join32(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined)))
+    throw new Error("Missing native installation input source witness");
+  return reviewedCodexPluginSourceRoots(cache3, proof.plugins, (path) => {
+    const text3 = read2(path);
+    if (text3 === null)
+      throw new Error("Missing native installation input");
+    return text3;
+  });
+}
 function assertMarketplaceBinding(binding, source) {
   if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2") && (binding.agent !== "codex" || binding.method !== "reviewed" || basename9(source.path) !== "config.toml"))
     throw new Error("Codex settings witnesses require explicit reviewed Codex configuration");
@@ -56694,8 +56902,11 @@ function assertMarketplaceBinding(binding, source) {
 }
 function rebindAgentDiscovery(binding, changes) {
   const budget = discoveryByteBudget();
+  const installationRoots = codexInstallationRoots(binding);
   return { ...binding, sources: binding.sources.map((source) => {
     assertMarketplaceBinding(binding, source);
+    if (!changes.has(source.path) && installationRoots.some((root2) => source.path.startsWith(root2 + sep6)))
+      return source;
     const sha2562 = projected(source, changes, budget);
     if (!changes.has(source.path) && sha2562 !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
@@ -56966,6 +57177,8 @@ var init_agent_discovery = __esm(() => {
   init_claude_settings_witness();
   init_codex_hook_discovery_recovery();
   init_codex_settings_witness();
+  init_codex_plugin_skill_controls();
+  init_native_discovery_roots();
   init_agent_discovery_directories();
 });