@hasna/skills 0.10.24 → 0.10.25

package/dist/lib/codex-plugin-skill-controls.d.ts

@@ -9,10 +9,37 @@ export interface CodexPluginSkillControl {
     mcpSha256?: string;
     remotePluginId?: string;
 }
+/** A native nonremote installation disabled by the witnessed configuration.
+ * Its cache is inert; this makes no claim about reviewed hook capabilities. */
+export interface CodexInactivePluginControl {
+    pluginId: string;
+    namespace: string;
+    pluginParent: string;
+    sourceType: "local" | "git" | "npm";
+    sourceSha256: string;
+}
+export interface CodexPluginSourceInput {
+    pluginId: string;
+    namespace: string;
+    pluginParent: string;
+    sourceRoot: string;
+    sourceSha256: string;
+}
 type Read = (path: string) => string;
 /** Capability controls remain bound even after every native Skill body disappears. */
 export declare function reviewedCodexPluginCapabilitiesUnchanged(cache: string, controls: CodexPluginSkillControl[], read: Read): boolean;
-export declare function reviewCodexPluginSkillControls(catalog: CodexNativeSkillCatalog, documents: string[], cache: string, cwd: string, read: Read, rules: unknown): CodexPluginSkillControl[];
+export declare function reviewCodexPluginControls(catalog: CodexNativeSkillCatalog, documents: string[], cache: string, cwd: string, read: Read, rules: unknown, pluginSettings?: unknown): {
+    skills: CodexPluginSkillControl[];
+    inactivePlugins: CodexInactivePluginControl[];
+    sourceInputs: CodexPluginSourceInput[];
+};
+/** Validate installation-input roles before omitting them from runtime inventory.
+ * Discovery witnesses still cover the sources; migration inventory stays full. */
+export declare function reviewedCodexPluginSourceRoots(cache: string, inputs: CodexPluginSourceInput[], read: Read): string[];
+export declare function reviewCodexPluginSkillControls(catalog: CodexNativeSkillCatalog, documents: string[], cache: string, cwd: string, read: Read, rules: unknown, pluginSettings?: unknown): CodexPluginSkillControl[];
+/** Cache refresh cannot reactivate a config-controlled disabled installation.
+ * The caller verifies discovery/config witnesses before consuming this result. */
+export declare function isReviewedCodexPluginInactive(document: string, cache: string, controls: CodexInactivePluginControl[], pluginSettings: unknown, rules: unknown, read: Read): boolean;
 export declare function isReviewedCodexPluginSkillDisabled(document: string, cache: string, controls: CodexPluginSkillControl[], rules: unknown, read: Read): boolean;
 export declare function disableReviewedCodexPluginNames(text: string, controls: CodexPluginSkillControl[]): string;
 export {};

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.24",
+  version: "0.10.25",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -38175,6 +38175,10 @@ async function connectCodexHookRpc(options) {
 }
 
 // src/lib/codex-native-skill-catalog.ts
+function codexPluginSourceIsConfigControlled(plugin) {
+  const remoteRealms = ["openai-curated-remote", "created-by-me-remote", "workspace-directory", "workspace-shared-with-me", "workspace-shared-with-me-private", "workspace-shared-with-me-unlisted"];
+  return Boolean(plugin.sourceType && ["local", "git", "npm"].includes(plugin.sourceType) && plugin.sourceSha256 && /^[a-f0-9]{64}$/.test(plugin.sourceSha256) && !plugin.remotePluginId && !remoteRealms.includes(plugin.id.slice(plugin.id.lastIndexOf("@") + 1)));
+}
 var MAX_SKILLS = 4096;
 var MAX_NAME_BYTES = 1024;
 var MAX_PATH_BYTES = 16384;
@@ -38186,6 +38190,15 @@ var object2 = (value) => value !== null && typeof value === "object" && !Array.i
 var scalar = (value, max) => typeof value === "string" && value.length > 0 && value.trim() === value && Buffer.byteLength(value, "utf8") <= max && !/[\u0000-\u001f\u007f]/u.test(value);
 var remotePluginIdentifier = (value) => typeof value === "string" && /^[A-Za-z0-9_~-]{1,1024}$/.test(value);
 var absolutePath2 = (value) => scalar(value, MAX_PATH_BYTES) && isAbsolute5(value);
+function projectPluginSource(source) {
+  if (!object2(source))
+    return {};
+  if (source.type === "remote")
+    return { sourceType: "remote" };
+  const optionalText = (value) => value === undefined || value === null || scalar(value, MAX_PATH_BYTES);
+  const valid = source.type === "local" ? Object.keys(source).every((key) => ["type", "path"].includes(key)) && absolutePath2(source.path) : source.type === "git" ? Object.keys(source).every((key) => ["type", "url", "path", "refName", "sha"].includes(key)) && scalar(source.url, MAX_PATH_BYTES) && [source.path, source.refName, source.sha].every(optionalText) : source.type === "npm" ? Object.keys(source).every((key) => ["type", "package", "version", "registry"].includes(key)) && scalar(source.package, MAX_NAME_BYTES) && [source.version, source.registry].every(optionalText) : false;
+  return valid ? { sourceType: source.type, sourceSha256: hashNativeJsonControls(JSON.stringify(source)), ...source.type === "local" ? { sourcePath: source.path } : {} } : {};
+}
 function projectCodexNativeSkillCatalog(response, cwd) {
   if (!absolutePath2(cwd) || !object2(response) || !Array.isArray(response.data) || response.data.length !== 1)
     refuse2();
@@ -38215,7 +38228,10 @@ function projectCodexInstalledPlugins(response) {
       plugins.push({
         ...value,
         marketplace: marketplace.name,
-        sourceType: object2(value.source) && value.source.type === "remote" ? "remote" : undefined
+        sourceType: undefined,
+        sourceSha256: undefined,
+        sourcePath: undefined,
+        ...projectPluginSource(value.source)
       });
     }
   }
@@ -38226,7 +38242,7 @@ function projectCodexInstalledPluginEntries(value) {
     refuse2();
   const ids = new Set;
   return value.map((item) => {
-    if (!object2(item) || !scalar(item.id, MAX_PLUGIN_ID_BYTES) || !scalar(item.name, MAX_NAME_BYTES) || typeof item.installed !== "boolean" || typeof item.enabled !== "boolean" || item.localVersion !== null && !scalar(item.localVersion, MAX_NAME_BYTES) || item.remotePluginId !== undefined && item.remotePluginId !== null && !remotePluginIdentifier(item.remotePluginId) || item.sourceType !== undefined && item.sourceType !== "remote")
+    if (!object2(item) || !scalar(item.id, MAX_PLUGIN_ID_BYTES) || !scalar(item.name, MAX_NAME_BYTES) || typeof item.installed !== "boolean" || typeof item.enabled !== "boolean" || item.localVersion !== null && !scalar(item.localVersion, MAX_NAME_BYTES) || item.remotePluginId !== undefined && item.remotePluginId !== null && !remotePluginIdentifier(item.remotePluginId) || item.sourceType !== undefined && !["remote", "local", "git", "npm"].includes(item.sourceType) || (["local", "git", "npm"].includes(item.sourceType) ? typeof item.sourceSha256 !== "string" || !/^[a-f0-9]{64}$/.test(item.sourceSha256) : item.sourceSha256 !== undefined) || (item.sourceType === "local" ? !absolutePath2(item.sourcePath) || normalize(item.sourcePath) !== item.sourcePath || item.sourceSha256 !== hashNativeJsonControls(JSON.stringify({ type: "local", path: item.sourcePath })) : item.sourcePath !== undefined))
       refuse2();
     const at = item.id.lastIndexOf("@");
     if (at < 1 || item.id.slice(0, at) !== item.name || at === item.id.length - 1 || ids.has(item.id))
@@ -38238,7 +38254,9 @@ function projectCodexInstalledPluginEntries(value) {
       installed: item.installed,
       enabled: item.enabled,
       localVersion: item.localVersion ?? null,
-      ...item.sourceType === "remote" ? { sourceType: "remote" } : {},
+      ...item.sourceType === undefined ? {} : { sourceType: item.sourceType },
+      ...item.sourceSha256 === undefined ? {} : { sourceSha256: item.sourceSha256 },
+      ...item.sourcePath === undefined ? {} : { sourcePath: item.sourcePath },
       ...item.remotePluginId == null ? {} : { remotePluginId: item.remotePluginId }
     };
   });
@@ -38451,7 +38469,7 @@ function rootControls(root, read) {
   const appSha256 = present ? appControls(app, read) : undefined;
   return { namespace: manifest.name, manifestSha256, ...appSha256 ? { appSha256 } : {}, ...mcpSha256 ? { mcpSha256 } : {} };
 }
-function identity(document, cache, read) {
+function documentIdentity(document, cache, read) {
   if (!document.startsWith(cache + sep2) || !document.endsWith(sep2 + "SKILL.md"))
     refuse3();
   const text = read(document);
@@ -38479,11 +38497,33 @@ function identity(document, cache, read) {
     const path = join10(root, ".codex-plugin", "plugin.json");
     if (!lstatSync6(path, { throwIfNoEntry: false }))
       continue;
-    const controls = rootControls(root, read);
-    return { name: `${controls.namespace}:${front.name}`, pluginParent: dirname5(root), ...controls };
+    const manifestFile = lstatSync6(path);
+    if (!lstatSync6(join10(root, ".codex-plugin")).isDirectory() || !manifestFile.isFile() || manifestFile.size > 1024 * 1024)
+      refuse3();
+    let manifest;
+    try {
+      const text2 = read(path);
+      hashNativeJsonControls(text2);
+      manifest = JSON.parse(text2);
+    } catch {
+      refuse3();
+    }
+    if (!manifest || typeof manifest !== "object" || Array.isArray(manifest) || !identifier3(manifest.name))
+      refuse3();
+    const declaredVersion = manifest.version === undefined ? "" : typeof manifest.version === "string" ? manifest.version.trim() : null;
+    if (declaredVersion === null || (declaredVersion ? declaredVersion !== basename3(root) : basename3(root) !== CODEX_DEFAULT_AGENT_PLUGIN_VERSION))
+      refuse3();
+    return { name: `${manifest.name}:${front.name}`, namespace: manifest.name, pluginParent: dirname5(root), root };
   }
   refuse3();
 }
+function identity(document, cache, read) {
+  const parsed = documentIdentity(document, cache, read);
+  const controls = rootControls(parsed.root, read);
+  if (controls.namespace !== parsed.namespace)
+    refuse3();
+  return { name: parsed.name, pluginParent: parsed.pluginParent, ...controls };
+}
 function reviewedCodexPluginCapabilitiesUnchanged(cache, controls, read) {
   if (!Array.isArray(controls) || controls.length > 4096)
     return false;
@@ -38521,11 +38561,13 @@ function reviewedCodexPluginCapabilitiesUnchanged(cache, controls, read) {
     return false;
   }
 }
-function reviewCodexPluginSkillControls(catalog, documents, cache, cwd, read, rules) {
+function reviewCodexPluginControls(catalog, documents, cache, cwd, read, rules, pluginSettings) {
   if (!supportsCodexNativeCapability(catalog?.version, "qualified-skill-catalog") || catalog.cwd !== cwd)
     refuse3();
   const skills = projectCodexNativeSkillCatalog({ data: [{ cwd, errors: [], skills: catalog.skills }] }, cwd);
-  const allowed = new Set(documents), result = [];
+  const allowed = new Set(documents), result = [], inertDocuments = new Set;
+  const inactivePlugins = new Map;
+  const sourceInputs = new Map;
   let installedPlugins;
   try {
     installedPlugins = projectCodexInstalledPluginEntries(catalog.plugins ?? []);
@@ -38536,25 +38578,48 @@ function reviewCodexPluginSkillControls(catalog, documents, cache, cwd, read, ru
   for (const document of candidates) {
     if (!document.startsWith(cache + sep2))
       continue;
-    const parsed = identity(document, cache, read);
-    if (parsed.name === "skills-cli" || parsed.name.endsWith(":skills-cli"))
+    const located = documentIdentity(document, cache, read);
+    if (located.name === "skills-cli" || located.name.endsWith(":skills-cli"))
       refuse3();
-    const cacheParts = relative3(cache, parsed.pluginParent).split(sep2);
+    const cacheParts = relative3(cache, located.pluginParent).split(sep2);
     if (cacheParts.length !== 2 || cacheParts.some((part) => !identifier3(part)))
       refuse3();
     const [marketplace, pluginName] = cacheParts;
-    if (pluginName !== parsed.namespace)
+    if (pluginName !== located.namespace)
       refuse3();
     const expectedPluginId = `${pluginName}@${marketplace}`;
     const listed = skills.filter((skill) => skill.path === document);
     if (listed.length > 1)
       refuse3();
+    const installed = installedPlugins.filter((plugin) => plugin.id === expectedPluginId && plugin.name === pluginName);
+    if (catalog.version === "codex-cli 0.160.0" && installed.length === 1 && installed[0].installed && installed[0].localVersion === basename3(located.root) && installed[0].sourceType === "local" && codexPluginSourceIsConfigControlled(installed[0])) {
+      const plugin = installed[0], input = { pluginId: expectedPluginId, namespace: located.namespace, pluginParent: located.pluginParent, sourceRoot: plugin.sourcePath, sourceSha256: plugin.sourceSha256 };
+      if (input.sourceRoot !== located.root && !input.sourceRoot.startsWith(cache + sep2) && (lstatSync6(input.sourceRoot, { throwIfNoEntry: false }) || documents.some((path) => path.startsWith(input.sourceRoot + sep2)))) {
+        if (skills.some((skill) => skill.path === input.sourceRoot || skill.path.startsWith(input.sourceRoot + sep2)) || !sourceInputUnchanged(input, cache, read))
+          refuse3();
+        sourceInputs.set(expectedPluginId, input);
+      }
+    }
+    const settings = pluginSettings && typeof pluginSettings === "object" && !Array.isArray(pluginSettings) ? pluginSettings : undefined;
+    if (catalog.version === "codex-cli 0.160.0" && !listed.length && !skills.some((skill) => skill.pluginId === expectedPluginId) && installed.length === 1 && installed[0].installed && !installed[0].enabled && codexPluginSourceIsConfigControlled(installed[0]) && settings && Object.hasOwn(settings, expectedPluginId) && settings[expectedPluginId]?.enabled === false) {
+      if (!Array.isArray(rules))
+        refuse3();
+      const exactPathDeny = rules.some((rule) => rule?.path === document && rule?.enabled === false);
+      if (!lstatSync6(document).isFile() || realpathSync5(document) !== document || realpathSync5(located.root) !== located.root || realpathSync5(located.pluginParent) !== located.pluginParent || realpathSync5(join10(located.root, ".codex-plugin/plugin.json")) !== join10(located.root, ".codex-plugin/plugin.json") || !exactPathDeny || rules.some((rule) => typeof rule?.name === "string" && rule.name.trim() === located.name && rule?.enabled !== false) || !isCodexNativeSkillDisabled({ name: located.name, path: document, pluginId: expectedPluginId, enabled: true }, rules))
+        refuse3();
+      inertDocuments.add(document);
+      const plugin = installed[0];
+      inactivePlugins.set(expectedPluginId, { pluginId: expectedPluginId, namespace: located.namespace, pluginParent: located.pluginParent, sourceType: plugin.sourceType, sourceSha256: plugin.sourceSha256 });
+      continue;
+    }
+    const parsed = { name: located.name, pluginParent: located.pluginParent, ...rootControls(located.root, read) };
+    if (parsed.namespace !== located.namespace)
+      refuse3();
     let remotePluginId;
     if (listed.length === 1) {
       if (listed[0].name !== parsed.name || listed[0].pluginId !== expectedPluginId)
         refuse3();
     } else {
-      const installed = installedPlugins.filter((plugin2) => plugin2.id === expectedPluginId && plugin2.name === pluginName);
       if (installed.length !== 1 || !installed[0].installed || !installed[0].enabled)
         refuse3();
       const plugin = installed[0];
@@ -38572,9 +38637,48 @@ function reviewCodexPluginSkillControls(catalog, documents, cache, cwd, read, ru
     }
     result.push({ ...parsed, pluginId: expectedPluginId, ...remotePluginId ? { remotePluginId } : {} });
   }
-  if (!result.length && documents.some((document) => document.startsWith(cache + sep2)) || new Set(result.map((item) => item.name)).size !== result.length)
+  if (!result.length && documents.some((document) => document.startsWith(cache + sep2) && !inertDocuments.has(document)) || new Set(result.map((item) => item.name)).size !== result.length)
     refuse3();
-  return result;
+  return { skills: result, inactivePlugins: [...inactivePlugins.values()], sourceInputs: [...sourceInputs.values()] };
+}
+function sourceInputUnchanged(input, cache, read) {
+  try {
+    const parts = relative3(cache, input.pluginParent).split(sep2);
+    if (parts.length !== 2 || parts.some((part) => !identifier3(part)) || parts[1] !== input.namespace || input.pluginId !== `${parts[1]}@${parts[0]}` || !codexPluginSourceIsConfigControlled({ id: input.pluginId, sourceType: "local", sourceSha256: input.sourceSha256 }) || input.sourceSha256 !== hashNativeJsonControls(JSON.stringify({ type: "local", path: input.sourceRoot })) || resolve4(input.sourceRoot) !== input.sourceRoot || !lstatSync6(input.sourceRoot).isDirectory() || realpathSync5(input.sourceRoot) !== input.sourceRoot || input.sourceRoot === cache || input.sourceRoot.startsWith(cache + sep2) || cache.startsWith(input.sourceRoot + sep2))
+      return false;
+    const path = join10(input.sourceRoot, ".codex-plugin/plugin.json"), stat = lstatSync6(path);
+    if (!stat.isFile() || stat.size > 1024 * 1024 || realpathSync5(path) !== path)
+      return false;
+    const text = read(path);
+    hashNativeJsonControls(text);
+    const manifest = JSON.parse(text);
+    return Boolean(manifest && typeof manifest === "object" && !Array.isArray(manifest) && manifest.name === input.namespace);
+  } catch {
+    return false;
+  }
+}
+function reviewedCodexPluginSourceRoots(cache, inputs, read) {
+  if (!Array.isArray(inputs) || inputs.length > 4096 || new Set(inputs.map((input) => input.pluginId)).size !== inputs.length || new Set(inputs.map((input) => input.sourceRoot)).size !== inputs.length || inputs.some((input) => !sourceInputUnchanged(input, cache, read)))
+    refuse3();
+  const roots = inputs.map((input) => input.sourceRoot);
+  if (roots.some((root) => roots.some((other) => root !== other && root.startsWith(other + sep2))))
+    refuse3();
+  return roots;
+}
+function isReviewedCodexPluginInactive(document, cache, controls, pluginSettings, rules, read) {
+  if (!Array.isArray(controls) || controls.length > 4096 || !pluginSettings || typeof pluginSettings !== "object" || Array.isArray(pluginSettings) || !Array.isArray(rules))
+    return false;
+  try {
+    const parsed = documentIdentity(document, cache, read), matches = controls.filter((control2) => control2.pluginParent === parsed.pluginParent && control2.namespace === parsed.namespace);
+    if (matches.length !== 1 || !lstatSync6(document).isFile() || realpathSync5(document) !== document || realpathSync5(parsed.root) !== parsed.root || realpathSync5(parsed.pluginParent) !== parsed.pluginParent || realpathSync5(join10(parsed.root, ".codex-plugin/plugin.json")) !== join10(parsed.root, ".codex-plugin/plugin.json"))
+      return false;
+    const control = matches[0], parts = relative3(cache, parsed.pluginParent).split(sep2);
+    if (parts.length !== 2 || parts.some((part) => !identifier3(part)) || parts[1] !== parsed.namespace || control.pluginId !== `${parts[1]}@${parts[0]}` || !codexPluginSourceIsConfigControlled({ ...control, id: control.pluginId }) || !Object.hasOwn(pluginSettings, control.pluginId) || pluginSettings[control.pluginId]?.enabled !== false)
+      return false;
+    return !rules.some((rule) => (rule?.path === document || typeof rule?.name === "string" && rule.name.trim() === parsed.name) && rule?.enabled !== false);
+  } catch {
+    return false;
+  }
 }
 function isReviewedCodexPluginSkillDisabled(document, cache, controls, rules, read) {
   if (!document.startsWith(cache + sep2) || !Array.isArray(controls) || controls.length > 4096)
@@ -38950,6 +39054,18 @@ function assertAgentPolicyCollections(policy) {
       if (control.appSha256 !== undefined)
         requireBound(typeof control.appSha256 === "string" && /^[a-f0-9]{64}$/.test(control.appSha256));
     }
+  if (bridge.codexInactivePlugins !== undefined) {
+    const controls = array(bridge.codexInactivePlugins, 4096), ids = new Set;
+    requireBound(controls.length === 0 || object3(bridge.codexPluginSkillReview) && bridge.codexPluginSkillReview.version === "codex-cli 0.160.0" && typeof bridge.codexPluginSkillReview.catalogSha256 === "string" && /^[a-f0-9]{64}$/.test(bridge.codexPluginSkillReview.catalogSha256));
+    for (const control of controls) {
+      requireBound(object3(control) && Object.keys(control).every((key) => ["pluginId", "namespace", "pluginParent", "sourceType", "sourceSha256"].includes(key)));
+      text(control.pluginId, 1024);
+      text(control.namespace, 64);
+      text(control.pluginParent);
+      requireBound(!ids.has(control.pluginId) && isAbsolute6(control.pluginParent) && resolve5(control.pluginParent) === control.pluginParent && ["local", "git", "npm"].includes(control.sourceType) && typeof control.sourceSha256 === "string" && /^[a-f0-9]{64}$/.test(control.sourceSha256));
+      ids.add(control.pluginId);
+    }
+  }
   if (bridge.disabledBuiltins !== undefined)
     for (const builtin of array(bridge.disabledBuiltins, AGENT_POLICY_LIMITS.builtinNames)) {
       requireBound(object3(builtin));
@@ -38962,6 +39078,25 @@ function assertAgentPolicyCollections(policy) {
     text(agent, 128);
     requireBound(object3(value));
     text(value.agent, 128);
+    if (value.codexInstallationInputs !== undefined) {
+      const proof = record2(value.codexInstallationInputs, 4), inputs = array(proof.plugins, 4096), ids = new Set;
+      requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && proof.version === "codex-cli 0.160.0" && typeof proof.catalogSha256 === "string" && /^[a-f0-9]{64}$/.test(proof.catalogSha256) && inputs.length > 0 && object3(bridge.codexPluginSkillReview) && bridge.codexPluginSkillReview.version === proof.version && bridge.codexPluginSkillReview.catalogSha256 === proof.catalogSha256);
+      for (const input of inputs) {
+        requireBound(object3(input) && Object.keys(input).every((key) => ["pluginId", "namespace", "pluginParent", "sourceRoot", "sourceSha256"].includes(key)));
+        text(input.pluginId, 1024);
+        text(input.namespace, 64);
+        text(input.pluginParent);
+        text(input.sourceRoot);
+        requireBound(!ids.has(input.pluginId) && [input.pluginParent, input.sourceRoot].every((path) => isAbsolute6(path) && resolve5(path) === path) && typeof input.sourceSha256 === "string" && /^[a-f0-9]{64}$/.test(input.sourceSha256));
+        ids.add(input.pluginId);
+      }
+      if (proof.directories !== undefined)
+        for (const directory of array(proof.directories, AGENT_POLICY_LIMITS.discoveryDirectories)) {
+          requireBound(object3(directory));
+          text(directory.path);
+          requireBound(directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256));
+        }
+    }
     for (const root of array(value.roots, AGENT_POLICY_LIMITS.discoveryRoots))
       text(root);
     for (const source of array(value.sources, AGENT_POLICY_LIMITS.discoverySources)) {
@@ -39404,7 +39539,7 @@ function safe(path) {
 function same(before, after) {
   return Boolean(after && after.isDirectory() && before.dev === after.dev && before.ino === after.ino && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs);
 }
-function capture(path, budget) {
+function capture(path, budget, excludedRoots) {
   safe(path);
   const root = lstatSync10(path, { throwIfNoEntry: false });
   if (!root)
@@ -39433,7 +39568,7 @@ function capture(path, budget) {
       budget.bytes += Buffer.byteLength(row);
       need4(budget.bytes <= AGENT_POLICY_LIMITS.discoveryDirectoryBytes, "Native discovery directory metadata limit exceeded");
       hash2.update(row);
-      if (stat.isDirectory())
+      if (stat.isDirectory() && !excludedRoots.includes(child))
         walk2(child, childRelative, stat, depth + 1);
     }
     need4(same(before, lstatSync10(current, { throwIfNoEntry: false })), "Native discovery directory changed while reading");
@@ -39442,16 +39577,18 @@ function capture(path, budget) {
   safe(path);
   return { path, sha256: hash2.digest("hex") };
 }
-function captureDiscoveryDirectories(paths) {
+function captureDiscoveryDirectories(paths, excludedRoots = []) {
   need4(Array.isArray(paths) && paths.length <= AGENT_POLICY_LIMITS.discoveryDirectories && new Set(paths).size === paths.length, "Invalid native discovery directory collection");
   const budget = { entries: 0, bytes: 0 };
-  return paths.map((path) => capture(path, budget));
+  for (const root of excludedRoots)
+    safe(root);
+  return paths.map((path) => capture(path, budget, excludedRoots));
 }
-function verifyDiscoveryDirectories(directories) {
+function verifyDiscoveryDirectories(directories, excludedRoots = []) {
   need4(Array.isArray(directories) && directories.length <= AGENT_POLICY_LIMITS.discoveryDirectories, "Invalid native discovery directory collection");
   for (const directory of directories)
     need4(directory && typeof directory === "object" && (directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256)), "Invalid native discovery directory digest");
-  const current = captureDiscoveryDirectories(directories.map((directory) => directory.path));
+  const current = captureDiscoveryDirectories(directories.map((directory) => directory.path), excludedRoots);
   for (let i = 0;i < directories.length; i++)
     need4(current[i].sha256 === directories[i].sha256, `Native discovery directory membership changed; run skills hook install with a fresh discovery review: ${directories[i].path}`);
 }
@@ -41538,8 +41675,16 @@ function verifyAgentDiscovery(binding, codexRecovery) {
     throw new Error("Invalid native discovery binding");
   if (binding.agent === "hermes" && !binding.directories?.length)
     throw new Error("Hermes discovery requires directory membership coverage; run skills hook install with a fresh discovery review");
-  if (binding.directories !== undefined)
-    verifyDiscoveryDirectories(binding.directories);
+  const installationRoots = codexInstallationRoots(binding);
+  const installationInput = (path) => installationRoots.some((root2) => path === root2 || path.startsWith(root2 + sep4));
+  if (binding.directories !== undefined) {
+    const projected2 = binding.codexInstallationInputs?.directories ?? [];
+    const ancestors2 = binding.directories.filter((directory) => installationRoots.some((root2) => root2.startsWith(directory.path + sep4)));
+    if (projected2.length !== ancestors2.length || projected2.some((directory) => !ancestors2.some((original) => original.path === directory.path)))
+      throw new Error("Missing installation input directory projection");
+    verifyDiscoveryDirectories(binding.directories.filter((directory) => !installationInput(directory.path) && !ancestors2.includes(directory)));
+    verifyDiscoveryDirectories(projected2, installationRoots);
+  }
   const budget = discoveryByteBudget();
   for (const source of binding.sources) {
     assertMarketplaceBinding(binding, source);
@@ -41549,6 +41694,10 @@ function verifyAgentDiscovery(binding, codexRecovery) {
       throw new Error("Invalid native discovery projection");
     if (source.sha256 !== null && !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Invalid native discovery digest");
+    if (installationInput(source.path)) {
+      safe4(source.path);
+      continue;
+    }
     const current = projected(source, undefined, budget);
     if (current !== source.sha256 && !verifiesCodexHookDiscoverySource(binding, source, current, codexRecovery))
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
@@ -41556,6 +41705,27 @@ function verifyAgentDiscovery(binding, codexRecovery) {
   for (const root2 of binding.roots)
     safe4(root2);
 }
+function codexInstallationRoots(binding) {
+  const proof = binding.codexInstallationInputs;
+  if (proof === undefined)
+    return [];
+  if (binding.agent !== "codex" || binding.method !== "reviewed" || proof.version !== "codex-cli 0.160.0" || !/^[a-f0-9]{64}$/.test(proof.catalogSha256) || !Array.isArray(proof.plugins) || !proof.plugins.length)
+    throw new Error("Invalid native installation input proof");
+  const cache = dirname14(dirname14(proof.plugins[0].pluginParent));
+  const config = join21(dirname14(dirname14(cache)), "config.toml"), home = dirname14(dirname14(dirname14(cache)));
+  const configSource = binding.sources.find((source) => source.path === config && source.sha256 !== null && (!source.format || source.format === "toml" && source.fields?.includes("plugins")));
+  const nativeRoots = NATIVE_SKILL_ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => join21(home, path));
+  if (!configSource || proof.plugins.some((input) => nativeRoots.some((root2) => root2 === input.sourceRoot || root2.startsWith(input.sourceRoot + sep4) || input.sourceRoot.startsWith(root2 + sep4)) || binding.sources.some((source) => basename7(source.path) === "config.toml" && (source.path === input.sourceRoot || source.path.startsWith(input.sourceRoot + sep4)))))
+    throw new Error("Native installation input overlaps configuration or loading roots");
+  if (proof.plugins.some((input) => dirname14(dirname14(input.pluginParent)) !== cache || !binding.sources.some((source) => source.path === join21(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined)))
+    throw new Error("Missing native installation input source witness");
+  return reviewedCodexPluginSourceRoots(cache, proof.plugins, (path) => {
+    const text2 = read2(path);
+    if (text2 === null)
+      throw new Error("Missing native installation input");
+    return text2;
+  });
+}
 function assertMarketplaceBinding(binding, source) {
   if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2") && (binding.agent !== "codex" || binding.method !== "reviewed" || basename7(source.path) !== "config.toml"))
     throw new Error("Codex settings witnesses require explicit reviewed Codex configuration");
@@ -41566,8 +41736,11 @@ function assertMarketplaceBinding(binding, source) {
 }
 function rebindAgentDiscovery(binding, changes) {
   const budget = discoveryByteBudget();
+  const installationRoots = codexInstallationRoots(binding);
   return { ...binding, sources: binding.sources.map((source) => {
     assertMarketplaceBinding(binding, source);
+    if (!changes.has(source.path) && installationRoots.some((root2) => source.path.startsWith(root2 + sep4)))
+      return source;
     const sha2562 = projected(source, changes, budget);
     if (!changes.has(source.path) && sha2562 !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
@@ -42435,6 +42608,9 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
     for (const [agent, path] of rootDefinitions)
       roots.push([agent, canonicalAgentPath(join22(project, path), aliases)]);
   }
+  const installationInputs = options.codexInstallationInputRoots ?? [];
+  if (installationInputs.some((input) => resolve15(input) !== input || realpathSync7(input) !== input || roots.some(([agent, path]) => agent === "codex" && (path === input || path.startsWith(input + sep5) || input.startsWith(path + sep5)))))
+    throw new Error("Native installation input overlaps an unconditional skill-loading root");
   const entries = [], seen = new Set;
   const cacheScans = new Map, maxAliasProofEntries = 1e4;
   let discoveryEntries = 0, discoveryPathBytes = 0;
@@ -42469,11 +42645,13 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
     }
     return true;
   }
-  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false, admitted = false) {
+  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false, admitted = false, configuredRoot = false) {
     if (!admitted)
       admit(path);
     const scan = { complete: true, hasSkills: false, entries: 1 };
     assertSafePath(path);
+    if (configuredRoot && agent === "codex" && installationInputs.includes(path))
+      return scan;
     if (!existsSync6(path))
       return scan;
     const stat2 = lstatSync19(path);
@@ -42529,7 +42707,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
           continue;
         }
       }
-      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache, true);
+      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache, true, configuredRoot);
       scan.complete &&= childScan.complete;
       scan.hasSkills ||= childScan.hasSkills;
       scan.entries += childScan.entries;
@@ -42538,10 +42716,10 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       cacheScans.set(path, scan);
     return scan;
   }
-  function scanRoot(agent, path, vendor = false, pluginCache = false) {
+  function scanRoot(agent, path, vendor = false, pluginCache = false, configuredRoot = false) {
     if (agent === "hermes" || options.guardHermes && `${path}${sep5}`.includes(`${sep5}.agents${sep5}skills${sep5}`))
       assertNoHermesLegacyShadow(path);
-    if (!visit2(agent, path, vendor, 0, pluginCache).complete)
+    if (!visit2(agent, path, vendor, 0, pluginCache, false, configuredRoot).complete)
       throw new Error(`Native skill discovery limit exceeded; review this root before continuing: ${path}`);
   }
   for (const [agent, path] of roots)
@@ -42557,7 +42735,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
   const configured = options.configured ? INTEGRATION_AGENTS.filter(includesAgent).flatMap((agent) => resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, canonical: (path) => canonicalAgentPath(path, aliases) }).roots.map((path) => ({ agent, path }))) : [];
   for (const root2 of [...options.agentRoots ?? [], ...configured])
     if (includesAgent(root2.agent))
-      scanRoot(root2.agent, canonicalAgentPath(root2.path, aliases), true);
+      scanRoot(root2.agent, canonicalAgentPath(root2.path, aliases), true, false, true);
   if (options.reviewedCacheAlias !== undefined && !reviewedCacheAliasFound)
     throw new Error("Reviewed cache alias was not an inventoried skill-containing sibling alias");
   recheckRootAliases(aliases);
@@ -42697,6 +42875,11 @@ enabled = false
   Bun.TOML.parse(result);
   return result;
 }
+function assertCodexInstallationInputs(home, projectDirs, inputs) {
+  const nativeRoots = [home, ...projectAncestorDirectories(projectDirs)].flatMap((directory) => ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => resolve15(directory, path)));
+  if (inputs.some((input) => nativeRoots.some((root2) => root2 === input || root2.startsWith(input + sep5) || input.startsWith(root2 + sep5))))
+    throw new Error("Native installation input overlaps an unconditional skill-loading root");
+}
 function planAgentIntegration(options) {
   const home = options.home ?? homedir3(), dataDir2 = options.dataDir ?? getDataDirReadOnly();
   const aliases = rootAliases(home, options.allowRootAliases);
@@ -42735,11 +42918,16 @@ function planAgentIntegration(options) {
   const codexConfig = options.agents.includes("codex") ? Bun.TOML.parse(readOptional(canonicalAgentPath(join22(home, ".codex", "config.toml"), aliases)) ?? "") : {};
   const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases, reviewedCacheAlias: options.reviewedCacheAlias, disabledVendorPaths: disabledCodexSkillPaths(codexConfig, aliases) });
   const observedNativeSources = [];
-  const codexPluginSkills = options.codexNativeCatalog ? reviewCodexPluginSkillControls(options.codexNativeCatalog, nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor).map((entry) => join22(entry.path, "SKILL.md")), canonicalAgentPath(join22(home, ".codex/plugins/cache"), aliases), resolve15(options.projectDir ?? home), (path) => {
+  const codexPluginControls = options.codexNativeCatalog ? reviewCodexPluginControls(options.codexNativeCatalog, nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor).map((entry) => join22(entry.path, "SKILL.md")), canonicalAgentPath(join22(home, ".codex/plugins/cache"), aliases), resolve15(options.projectDir ?? home), (path) => {
     const bytes = readNativeBytes(path, 1024 * 1024);
     observedNativeSources.push({ path, sha256: sha4(bytes) });
     return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-  }, codexConfig.skills?.config ?? []) : policy.bridge?.codexPluginSkills ?? [];
+  }, codexConfig.skills?.config ?? [], codexConfig.plugins) : { skills: policy.bridge?.codexPluginSkills ?? [], inactivePlugins: policy.bridge?.codexInactivePlugins ?? [], sourceInputs: policy.bridge?.discovery?.codex?.codexInstallationInputs?.plugins ?? [] };
+  const codexPluginSkills = codexPluginControls.skills;
+  const codexInactivePlugins = codexPluginControls.inactivePlugins;
+  const codexDiscovery = discoveries.find((binding) => binding.agent === "codex");
+  const codexPluginSourceInputs = codexPluginControls.sourceInputs.filter((input) => codexDiscovery?.method === "reviewed" && codexDiscovery.roots.some((root2) => root2 === input.sourceRoot || root2.startsWith(input.sourceRoot + sep5) || input.sourceRoot.startsWith(root2 + sep5)) && codexDiscovery.sources.some((source) => source.path === join22(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined));
+  assertCodexInstallationInputs(home, [options.projectDir ?? home], codexPluginSourceInputs.map((input) => input.sourceRoot));
   const changes = [];
   for (const agent of [...new Set(options.agents)]) {
     if (!INTEGRATION_AGENTS.includes(agent))
@@ -42804,7 +42992,16 @@ function planAgentIntegration(options) {
         changes.push({ path: configPath, before: previous, after: next });
     }
   }
-  const discoveryAfter = discoveries.map((binding) => rebindAgentDiscovery(binding, new Map(changes.map((change) => [change.path, change.after]))));
+  const codexPluginSkillReview = options.codexNativeCatalog ? { version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, catalogSha256: sha4(JSON.stringify({ version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, skills: projectCodexNativeSkillCatalog({ data: [{ cwd: options.codexNativeCatalog.cwd, errors: [], skills: options.codexNativeCatalog.skills }] }, options.codexNativeCatalog.cwd), ...options.codexNativeCatalog.plugins === undefined ? {} : { plugins: projectCodexInstalledPluginEntries(options.codexNativeCatalog.plugins) } })), configSha256: changes.find((change) => change.path === canonicalAgentPath(join22(home, ".codex/config.toml"), aliases))?.before === null ? null : sha4(readOptional(canonicalAgentPath(join22(home, ".codex/config.toml"), aliases)) ?? "") } : policy.bridge?.codexPluginSkillReview;
+  const discoveryAfter = discoveries.map((binding) => {
+    const rebound = rebindAgentDiscovery(binding, new Map(changes.map((change) => [change.path, change.after])));
+    if (binding.agent !== "codex")
+      return rebound;
+    const { codexInstallationInputs: previousInputs, ...current } = rebound;
+    const inputs = codexPluginSourceInputs.map((input) => input.sourceRoot);
+    const directories = options.codexNativeCatalog || !previousInputs ? captureDiscoveryDirectories((binding.directories ?? []).filter((directory) => inputs.some((root2) => root2.startsWith(directory.path + sep5))).map((directory) => directory.path), inputs) : previousInputs.directories;
+    return codexPluginSourceInputs.length ? { ...current, codexInstallationInputs: { version: "codex-cli 0.160.0", catalogSha256: codexPluginSkillReview.catalogSha256, plugins: codexPluginSourceInputs, ...directories?.length ? { directories } : {} } } : current;
+  });
   const nextPolicy = { ...policy, version: 1, loading: "cli", profileId, bridge: {
     ...policy.bridge,
     version: CLI_BRIDGE_VERSION,
@@ -42817,7 +43014,7 @@ function planAgentIntegration(options) {
     profiles: Object.fromEntries([...new Set([...priorAgents, ...options.agents])].sort().map((agent) => [agent, bindings.get(agent)?.profileId ?? policy.bridge?.profiles?.[agent] ?? policy.profileId])),
     disabledBuiltins: options.agents.includes("codex") ? nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor && entry.path.startsWith(canonicalAgentPath(join22(home, ".codex", "skills", ".system"), aliases) + sep5)).map((entry) => ({ path: entry.path, hash: entry.hash })) : policy.bridge?.disabledBuiltins ?? [],
     rootAliases: aliases,
-    ...codexPluginSkills.length ? { codexPluginSkills, codexPluginSkillReview: options.codexNativeCatalog ? { version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, catalogSha256: sha4(JSON.stringify({ version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, skills: projectCodexNativeSkillCatalog({ data: [{ cwd: options.codexNativeCatalog.cwd, errors: [], skills: options.codexNativeCatalog.skills }] }, options.codexNativeCatalog.cwd), ...options.codexNativeCatalog.plugins === undefined ? {} : { plugins: projectCodexInstalledPluginEntries(options.codexNativeCatalog.plugins) } })), configSha256: changes.find((change) => change.path === canonicalAgentPath(join22(home, ".codex/config.toml"), aliases))?.before === null ? null : sha4(readOptional(canonicalAgentPath(join22(home, ".codex/config.toml"), aliases)) ?? "") } : policy.bridge?.codexPluginSkillReview } : {},
+    ...options.codexNativeCatalog || codexPluginSkills.length || codexInactivePlugins.length || codexPluginSourceInputs.length ? { codexPluginSkills, codexInactivePlugins, codexPluginSkillReview } : {},
     discovery: { ...policy.bridge?.discovery, ...Object.fromEntries(discoveryAfter.map((binding) => [binding.agent, binding])) }
   } };
   const serializedPolicy = serializeManagedSkillPolicy(nextPolicy);
@@ -43308,7 +43505,12 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
     throw new Error("NATIVE_SKILL_DRIFT: the Codex CLI bridge is disabled; run skills hook install");
   if (agent === "codex" && !reviewedCodexPluginCapabilitiesUnchanged(canonicalAgentPath(join22(home, ".codex/plugins/cache"), aliases), binding.codexPluginSkills ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024))))
     throw new Error("NATIVE_SKILL_DRIFT: reviewed native plugin capability controls changed; run skills hook install with a fresh discovery review");
-  const disabledPlugin = (entry) => agent === "codex" && entry.vendor && isReviewedCodexPluginSkillDisabled(join22(entry.path, "SKILL.md"), canonicalAgentPath(join22(home, ".codex/plugins/cache"), aliases), binding.codexPluginSkills ?? [], codexConfig.skills?.config, (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024)));
+  const disabledPlugin = (entry) => {
+    if (agent !== "codex" || !entry.vendor)
+      return false;
+    const document2 = join22(entry.path, "SKILL.md"), cache = canonicalAgentPath(join22(home, ".codex/plugins/cache"), aliases), read3 = (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024));
+    return isReviewedCodexPluginInactive(document2, cache, binding.codexInactivePlugins ?? [], codexConfig.plugins, codexConfig.skills?.config ?? [], read3) || isReviewedCodexPluginSkillDisabled(document2, cache, binding.codexPluginSkills ?? [], codexConfig.skills?.config, read3);
+  };
   const disabledPaths = new Set(disabledCodexSkillPaths(codexConfig, aliases));
   const disabledVendorSkill = (entry) => {
     if (agent !== "codex" || !entry.vendor)
@@ -43345,7 +43547,15 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
   } catch (error) {
     throw new Error(`NATIVE_SKILL_DRIFT: ${error.message}`);
   }
-  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0, disabledVendorPaths: agent === "codex" ? disabledCodexSkillPaths(codexConfig, aliases) : [], disabledVendorSkill: disabledPlugin });
+  let installationInputRoots = [];
+  if (agent === "codex") {
+    try {
+      installationInputRoots = reviewedCodexPluginSourceRoots(canonicalAgentPath(join22(home, ".codex/plugins/cache"), aliases), discovery.codexInstallationInputs?.plugins ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024)));
+    } catch {
+      throw new Error("NATIVE_SKILL_DRIFT: native installation input identity changed; review discovery and catalog");
+    }
+  }
+  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0, disabledVendorPaths: agent === "codex" ? disabledCodexSkillPaths(codexConfig, aliases) : [], disabledVendorSkill: disabledPlugin, codexInstallationInputRoots: installationInputRoots });
   const unexpected = inventory.filter((entry) => visible(entry) && !entry.bridge && !disabledVendorSkill(entry));
   if (unexpected.length) {
     const paths = unexpected.slice(0, 3).map((entry) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.24",
+  "version": "0.10.25",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {