@hasna/skills 0.10.33 → 0.10.35

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.33",
+    version: "0.10.35",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -52593,18 +52593,80 @@ var init_agent_sumi = __esm(() => {
   ];
 });
 
+// src/lib/codex-hook-trust-files.ts
+import { closeSync as closeSync8, constants as constants8, fstatSync as fstatSync8, fsyncSync as fsyncSync2, lstatSync as lstatSync16, openSync as openSync8, readSync as readSync6, writeFileSync as writeFileSync4 } from "fs";
+import { createHash as createHash12 } from "crypto";
+import { dirname as dirname11 } from "path";
+function need5(value, code) {
+  if (!value)
+    throw new Error(`CODEX_HOOK_TRUST_${code}`);
+}
+function safeParents(file) {
+  for (let p = dirname11(file);; p = dirname11(p)) {
+    const s = lstatSync16(p);
+    need5(s.isDirectory() && !s.isSymbolicLink(), "UNSAFE_PARENT");
+    need5((s.mode & 18) === 0 || s.uid === 0 && (s.mode & 512) !== 0, "UNSAFE_PARENT");
+    if (dirname11(p) === p)
+      break;
+  }
+}
+function snapshot(file, privateFile = false, options = {}) {
+  const readOnlyPackage = options.readOnlyPackage === true && !privateFile;
+  safeParents(file);
+  const initial2 = lstatSync16(file, { bigint: true });
+  need5(initial2.isFile() && initial2.uid === BigInt(process.getuid()) && (initial2.nlink === 1n || readOnlyPackage && initial2.nlink > 1n) && (initial2.mode & 0o022n) === 0n && (!privateFile || (initial2.mode & 0o777n) === 0o600n), "UNSAFE_FILE");
+  need5(initial2.size <= 8n * 1024n * 1024n, "FILE_BOUND");
+  const fd = openSync8(file, constants8.O_RDONLY | constants8.O_NOFOLLOW | constants8.O_NONBLOCK);
+  try {
+    const before2 = fstatSync8(fd, { bigint: true });
+    need5(sameStat(initial2, before2), "INPUT_CHANGED");
+    const bytes = Buffer.alloc(Number(before2.size) + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const n2 = readSync6(fd, bytes, length, bytes.length - length, null);
+      if (!n2)
+        break;
+      length += n2;
+    }
+    need5(length === Number(before2.size) && sameStat(before2, fstatSync8(fd, { bigint: true })) && sameStat(before2, lstatSync16(file, { bigint: true })), "INPUT_CHANGED");
+    const content = bytes.subarray(0, length), text2 = new TextDecoder("utf-8", { fatal: true }).decode(content);
+    return { file, privateFile, readOnlyPackage, text: text2, bytes: content, stat: before2, sha256: createHash12("sha256").update(content).digest("hex") };
+  } finally {
+    closeSync8(fd);
+  }
+}
+function unchanged2(before2) {
+  const after2 = snapshot(before2.file, before2.privateFile, before2.readOnlyPackage ? { readOnlyPackage: true } : {});
+  need5(sameStat(before2.stat, after2.stat) && after2.sha256 === before2.sha256, "INPUT_CHANGED");
+}
+function save(file, content) {
+  safeParents(file);
+  const fd = openSync8(file, constants8.O_WRONLY | constants8.O_CREAT | constants8.O_EXCL | constants8.O_NOFOLLOW, 384);
+  try {
+    writeFileSync4(fd, content);
+    fsyncSync2(fd);
+  } finally {
+    closeSync8(fd);
+  }
+}
+var sameStat = (a, b) => ["dev", "ino", "uid", "nlink", "mode", "size", "mtimeNs", "ctimeNs"].every((key) => a[key] === b[key]);
+var init_codex_hook_trust_files = () => {};
+
 // src/lib/agent-integration.ts
-import { createHash as createHash12, randomUUID as randomUUID5 } from "crypto";
+import { createHash as createHash13, randomUUID as randomUUID5 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
-import { existsSync as existsSync13, lstatSync as lstatSync16, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync13, readdirSync as readdirSync8, opendirSync as opendirSync3, readlinkSync as readlinkSync4, realpathSync as realpathSync7, renameSync as renameSync2, rmdirSync as rmdirSync2, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3, chmodSync, openSync as openSync8, closeSync as closeSync8, fsyncSync as fsyncSync2, fstatSync as fstatSync8, readSync as readSync6, constants as constants8, linkSync as linkSync2 } from "fs";
-import { dirname as dirname11, join as join23, resolve as resolve12, relative as relative5, isAbsolute as isAbsolute11, sep as sep5 } from "path";
+import { existsSync as existsSync13, lstatSync as lstatSync17, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync13, readdirSync as readdirSync8, opendirSync as opendirSync3, readlinkSync as readlinkSync4, realpathSync as realpathSync7, renameSync as renameSync2, rmdirSync as rmdirSync2, writeFileSync as writeFileSync5, unlinkSync as unlinkSync3, chmodSync, openSync as openSync9, closeSync as closeSync9, fsyncSync as fsyncSync3, fstatSync as fstatSync9, readSync as readSync7, constants as constants9, linkSync as linkSync2 } from "fs";
+import { dirname as dirname12, join as join23, resolve as resolve12, relative as relative5, isAbsolute as isAbsolute11, sep as sep5 } from "path";
 import { homedir as homedir3 } from "os";
-function hasNoDarwinAcl(fd) {
+function hasTrustedDarwinAcl(fd, allowDenyOnly = false) {
   try {
-    const { dlopen, read: read2 } = __require("bun:ffi");
+    const { dlopen, read: read2, ptr } = __require("bun:ffi");
     const library = dlopen("/usr/lib/libSystem.B.dylib", {
       acl_get_fd: { args: ["i32"], returns: "ptr" },
       acl_free: { args: ["ptr"], returns: "i32" },
+      acl_valid: { args: ["ptr"], returns: "i32" },
+      acl_get_entry: { args: ["ptr", "i32", "ptr"], returns: "i32" },
+      acl_get_tag_type: { args: ["ptr", "ptr"], returns: "i32" },
       __error: { args: [], returns: "ptr" }
     });
     try {
@@ -52613,8 +52675,23 @@ function hasNoDarwinAcl(fd) {
         return false;
       const acl = library.symbols.acl_get_fd(fd);
       if (acl) {
-        library.symbols.acl_free(acl);
-        return false;
+        try {
+          if (!allowDenyOnly || library.symbols.acl_valid(acl) !== 0)
+            return false;
+          const entry = new BigUint64Array(1), tag = new Int32Array(1);
+          for (let count = 0;count <= 128; count++) {
+            const status = library.symbols.acl_get_entry(acl, count === 0 ? 0 : -1, ptr(entry));
+            if (status !== 0) {
+              return status === -1 && read2.i32(errno) === 22 && library.symbols.acl_valid(acl) === 0;
+            }
+            const value = read2.ptr(ptr(entry));
+            if (count === 128 || !value || library.symbols.acl_get_tag_type(value, ptr(tag)) !== 0 || tag[0] !== 2)
+              return false;
+          }
+          return false;
+        } finally {
+          library.symbols.acl_free(acl);
+        }
       }
       return (acl === null || acl === 0) && read2.i32(errno) === 2;
     } finally {
@@ -52630,11 +52707,11 @@ function isSystemRootAlias(path) {
   const target = `/private${path}`, link2 = `private${path}`;
   const identity5 = (stat) => `${stat.dev}:${stat.ino}:${stat.ctimeNs}:${stat.uid}:${stat.mode}`;
   try {
-    const before2 = lstatSync16(path, { bigint: true });
+    const before2 = lstatSync17(path, { bigint: true });
     if (!before2.isSymbolicLink() || before2.uid !== 0n || readlinkSync4(path) !== link2)
       return false;
     const directories = ["/", "/private", target].map((directory) => {
-      const stat = lstatSync16(directory, { bigint: true });
+      const stat = lstatSync17(directory, { bigint: true });
       if (!stat.isDirectory() || stat.uid !== 0n)
         throw new Error("Untrusted system alias directory");
       if (directory !== "/private/tmp") {
@@ -52642,23 +52719,23 @@ function isSystemRootAlias(path) {
           throw new Error("Writable system alias directory");
       } else if ((stat.mode & 0o1000n) === 0n)
         throw new Error("Unprotected system temporary directory");
-      const fd = openSync8(directory, constants8.O_RDONLY | constants8.O_DIRECTORY | constants8.O_NOFOLLOW);
+      const fd = openSync9(directory, constants9.O_RDONLY | constants9.O_DIRECTORY | constants9.O_NOFOLLOW);
       try {
-        if (identity5(fstatSync8(fd, { bigint: true })) !== identity5(stat) || !hasNoDarwinAcl(fd) || identity5(fstatSync8(fd, { bigint: true })) !== identity5(stat))
+        if (identity5(fstatSync9(fd, { bigint: true })) !== identity5(stat) || !hasTrustedDarwinAcl(fd) || identity5(fstatSync9(fd, { bigint: true })) !== identity5(stat))
           throw new Error("Unverified system alias directory ACL");
       } finally {
-        closeSync8(fd);
+        closeSync9(fd);
       }
       return { directory, identity: identity5(stat) };
     });
-    return realpathSync7(path) === target && readlinkSync4(path) === link2 && identity5(lstatSync16(path, { bigint: true })) === identity5(before2) && directories.every((item) => identity5(lstatSync16(item.directory, { bigint: true })) === item.identity);
+    return realpathSync7(path) === target && readlinkSync4(path) === link2 && identity5(lstatSync17(path, { bigint: true })) === identity5(before2) && directories.every((item) => identity5(lstatSync17(item.directory, { bigint: true })) === item.identity);
   } catch {
     return false;
   }
 }
 function canonicalSystemPath(path) {
   const absolute = resolve12(path), root = `/${absolute.split(sep5)[1]}`;
-  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(root) || !lstatSync16(root, { throwIfNoEntry: false })?.isSymbolicLink())
+  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(root) || !lstatSync17(root, { throwIfNoEntry: false })?.isSymbolicLink())
     return absolute;
   if (!isSystemRootAlias(root))
     throw new Error(`Refusing symlink path: ${root}`);
@@ -52667,9 +52744,9 @@ function canonicalSystemPath(path) {
 function assertSafePath(path) {
   let cursor = resolve12(path);
   while (true) {
-    if (lstatSync16(cursor, { throwIfNoEntry: false })?.isSymbolicLink() && !isSystemRootAlias(cursor))
+    if (lstatSync17(cursor, { throwIfNoEntry: false })?.isSymbolicLink() && !isSystemRootAlias(cursor))
       throw new Error(`Refusing symlink path: ${cursor}`);
-    const parent = dirname11(cursor);
+    const parent = dirname12(cursor);
     if (parent === cursor)
       return;
     cursor = parent;
@@ -52678,12 +52755,12 @@ function assertSafePath(path) {
 function readRootAlias(home, agent) {
   assertSafePath(home);
   const realHome = realpathSync7(home), alias = join23(realHome, `.${agent}`);
-  const stat = lstatSync16(alias, { throwIfNoEntry: false, bigint: true });
+  const stat = lstatSync17(alias, { throwIfNoEntry: false, bigint: true });
   if (!stat?.isSymbolicLink())
     throw new Error(`Agent root alias changed after planning: ${alias}`);
-  const link2 = readlinkSync4(alias), targetPath = resolve12(dirname11(alias), link2);
+  const link2 = readlinkSync4(alias), targetPath = resolve12(dirname12(alias), link2);
   assertSafePath(targetPath);
-  const targetStat = lstatSync16(targetPath, { throwIfNoEntry: false });
+  const targetStat = lstatSync17(targetPath, { throwIfNoEntry: false });
   if (!targetStat?.isDirectory())
     throw new Error(`Agent root alias must target an existing directory: ${alias}`);
   const target = realpathSync7(targetPath), inside = relative5(realHome, target);
@@ -52696,7 +52773,7 @@ function rootAliases(home, allowed = false) {
     return [];
   const result2 = [];
   for (const agent of ["claude", "codex"])
-    if (lstatSync16(join23(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync17(join23(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
       result2.push(readRootAlias(home, agent));
   if (result2.some((item, index) => result2.slice(index + 1).some((other) => item.target === other.target || item.target.startsWith(other.target + sep5) || other.target.startsWith(item.target + sep5))))
     throw new Error("Agent root alias targets must not overlap");
@@ -52731,7 +52808,7 @@ function disabledCodexSkillPaths(config, aliases) {
       continue;
     settings.set(document3, [...settings.get(document3) ?? [], entry.enabled === false]);
   }
-  return [...settings].filter(([, values2]) => values2.length === 1 && values2[0] === true).map(([document3]) => dirname11(document3));
+  return [...settings].filter(([, values2]) => values2.length === 1 && values2[0] === true).map(([document3]) => dirname12(document3));
 }
 function recheckRootAliases(aliases) {
   for (const binding of aliases) {
@@ -52744,35 +52821,35 @@ function recheckRootAliases(aliases) {
 }
 function readNativeBytes(path, maximum = 64 * 1024 * 1024) {
   assertSafePath(path);
-  const before2 = lstatSync16(path);
+  const before2 = lstatSync17(path);
   if (!before2.isFile() || before2.size > maximum)
     throw new Error("Unsupported or oversized native skill file");
-  const descriptor = openSync8(path, constants8.O_RDONLY | constants8.O_NOFOLLOW | constants8.O_NONBLOCK);
+  const descriptor = openSync9(path, constants9.O_RDONLY | constants9.O_NOFOLLOW | constants9.O_NONBLOCK);
   try {
-    const opened = fstatSync8(descriptor);
+    const opened = fstatSync9(descriptor);
     if (!opened.isFile() || opened.dev !== before2.dev || opened.ino !== before2.ino || opened.size !== before2.size)
       throw new Error("Native skill file changed while reading");
     const bytes = Buffer.allocUnsafe(before2.size + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync6(descriptor, bytes, length, bytes.length - length, null);
+      const count = readSync7(descriptor, bytes, length, bytes.length - length, null);
       if (!count)
         break;
       length += count;
     }
-    const after2 = fstatSync8(descriptor), current = lstatSync16(path);
+    const after2 = fstatSync9(descriptor), current = lstatSync17(path);
     if (current.dev !== opened.dev || current.ino !== opened.ino || current.size !== after2.size || current.mtimeMs !== after2.mtimeMs || current.ctimeMs !== after2.ctimeMs || length !== before2.size || after2.size !== before2.size || after2.mtimeMs !== opened.mtimeMs || after2.ctimeMs !== opened.ctimeMs)
       throw new Error("Native skill file changed while reading");
     return bytes.subarray(0, length);
   } finally {
-    closeSync8(descriptor);
+    closeSync9(descriptor);
   }
 }
 function treeHash(root) {
-  const hash2 = createHash12("sha256");
+  const hash2 = createHash13("sha256");
   let bytes = 0, files = 0;
   function visit2(path) {
-    const stat = lstatSync16(path);
+    const stat = lstatSync17(path);
     if (stat.isSymbolicLink())
       throw new Error(`Refusing symlink in skill: ${path}`);
     const rel = relative5(root, path);
@@ -52823,7 +52900,7 @@ function parseNativeMigrationTargetManifest(input) {
     if (!isAbsolute11(item.projectRoot) || resolve12(item.projectRoot) !== item.projectRoot)
       throw new Error(`Native migration target project root must be an existing absolute directory: ${item.projectRoot}`);
     const projectRoot = canonicalSystemPath(item.projectRoot);
-    if (!existsSync13(projectRoot) || !lstatSync16(projectRoot).isDirectory())
+    if (!existsSync13(projectRoot) || !lstatSync17(projectRoot).isDirectory())
       throw new Error(`Native migration target project root must be an existing absolute directory: ${item.projectRoot}`);
     assertSafePath(projectRoot);
     if (isAbsolute11(item.path) || item.path.includes("\\") || item.path.length === 0 || item.path.includes("\x00"))
@@ -52853,7 +52930,7 @@ function selectNativeMigrationTargets(inventory, manifest) {
     if (!isAbsolute11(target.projectRoot) || resolve12(target.projectRoot) !== target.projectRoot)
       throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
     const projectRoot = canonicalSystemPath(target.projectRoot), normalized = relative5(projectRoot, resolve12(projectRoot, target.path));
-    if (!existsSync13(projectRoot) || !lstatSync16(projectRoot).isDirectory())
+    if (!existsSync13(projectRoot) || !lstatSync17(projectRoot).isDirectory())
       throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
     assertSafePath(projectRoot);
     if (isAbsolute11(target.path) || target.path.includes("\\") || target.path.includes("\x00") || !normalized || normalized === ".." || normalized.startsWith(`..${sep5}`) || normalized !== target.path || !/^[0-9a-f]{64}$/.test(target.treeSha256))
@@ -52882,7 +52959,7 @@ function projectAncestorDirectories(projects) {
       if (depth >= 100)
         throw new Error("NATIVE_SKILL_DRIFT: project ancestor discovery limit exceeded");
       directories.add(path);
-      const parent = dirname11(path);
+      const parent = dirname12(path);
       if (parent === path)
         break;
       path = parent;
@@ -52928,12 +53005,12 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
   let reviewedCacheAliasFound = false;
   function verifiedSiblingCacheAlias(agent, path, parent) {
     const link2 = readlinkSync4(path), lexicalTarget = resolve12(parent, link2);
-    if (isAbsolute11(link2) ? link2 !== lexicalTarget : dirname11(link2) !== ".")
+    if (isAbsolute11(link2) ? link2 !== lexicalTarget : dirname12(link2) !== ".")
       return false;
     const target = canonicalSystemPath(lexicalTarget);
-    if (dirname11(target) !== parent)
+    if (dirname12(target) !== parent)
       return false;
-    if (!lstatSync16(target, { throwIfNoEntry: false })?.isDirectory())
+    if (!lstatSync17(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
     const scan = cacheScans.get(target);
     if (!scan?.complete || scan.entries > maxAliasProofEntries)
@@ -52958,7 +53035,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       return scan;
     if (!existsSync13(path))
       return scan;
-    const stat = lstatSync16(path);
+    const stat = lstatSync17(path);
     if (stat.isFile()) {
       if (agent === "sumi" && depth === 1 && path.endsWith(".md"))
         throw new Error("NATIVE_SKILL_DRIFT: flat Sumi skill documents require a dedicated migration adapter");
@@ -53007,7 +53084,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       if (isVendor && !options.includeVendor)
         continue;
       const child = join23(path, name);
-      if (isVendor && lstatSync16(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      if (isVendor && lstatSync17(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
         const target = statSync8(child, { throwIfNoEntry: false });
         if (target?.isFile() || pluginCache && target?.isDirectory() && verifiedSiblingCacheAlias(agent, child, path)) {
           scan.entries++;
@@ -53341,6 +53418,171 @@ function planAgentIntegration(options) {
   recheckRootAliases(aliases);
   return { dataDir: dataDir3, profileId, changes, nativeSkills, ...observedNativeSources.length ? { observedNativeSources } : {}, ...nextPolicy.bridge.codexPluginSkillReview ? { codexPluginSkillReview: nextPolicy.bridge.codexPluginSkillReview } : {}, observedPolicy: { path: policyPath, before: previousPolicy }, discoveryBefore: discoveries, discoveryAfter, ...aliases.length ? { rootAliases: aliases } : {}, ...retainedAgents.length ? { retainedReviewChecks: { home, projectDir: options.projectDir ?? home, agents: retainedAgents } } : {} };
 }
+function hookProjectionRefusal(reason) {
+  throw new Error(`CLAUDE_MANAGED_HOOK_${reason}`);
+}
+function projectedHookAcl(path, observed) {
+  if (process.platform !== "darwin")
+    return;
+  const identity5 = (stat) => `${stat.dev}:${stat.ino}:${stat.ctimeNs}:${stat.uid}:${stat.mode}:${stat.nlink}:${stat.size}:${stat.mtimeNs}`;
+  const fd = openSync9(path, constants9.O_RDONLY | constants9.O_NOFOLLOW | constants9.O_NONBLOCK | (observed.isDirectory() ? constants9.O_DIRECTORY : 0));
+  try {
+    if (identity5(fstatSync9(fd, { bigint: true })) !== identity5(observed) || !hasTrustedDarwinAcl(fd, true) || identity5(fstatSync9(fd, { bigint: true })) !== identity5(observed) || identity5(lstatSync17(path, { bigint: true })) !== identity5(observed))
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+  } finally {
+    closeSync9(fd);
+  }
+}
+function projectedHookExecutable(command, expectedResolved) {
+  try {
+    if (!isAbsolute11(command) || /[\0\r\n]/.test(command) || resolve12(command) !== command)
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    command = canonicalSystemPath(command);
+    const parents2 = (file = command) => {
+      const result2 = [];
+      for (let path = dirname12(file);; path = dirname12(path)) {
+        const stat = lstatSync17(path, { bigint: true });
+        if (!stat.isDirectory() || (stat.mode & 0o022n) !== 0n && !(stat.uid === 0n && (stat.mode & 0o1000n) !== 0n))
+          hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+        projectedHookAcl(path, stat);
+        result2.push(`${path}:${stat.dev}:${stat.ino}:${stat.uid}:${stat.mode}`);
+        if (dirname12(path) === path)
+          break;
+      }
+      return result2;
+    };
+    const parentIdentity = parents2(), link2 = lstatSync17(command, { bigint: true });
+    if (link2.uid !== BigInt(process.getuid()) || !link2.isFile() && !link2.isSymbolicLink())
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    const linkIdentity = (stat) => `${stat.dev}:${stat.ino}:${stat.mode}:${stat.uid}:${stat.ctimeNs}`;
+    const resolved = realpathSync7(command);
+    if (expectedResolved !== undefined && resolved !== expectedResolved)
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    const resolvedParentIdentity = parents2(resolved);
+    const manifest = snapshot(join23(dirname12(dirname12(resolved)), "package.json"), false, { readOnlyPackage: true });
+    projectedHookAcl(manifest.file, manifest.stat);
+    const pkg = JSON.parse(manifest.text);
+    if (pkg.name !== "@hasna/skills" || !/^\d+\.\d+\.\d+$/.test(pkg.version) || pkg.bin?.skills !== "bin/index.js" || resolved !== join23(dirname12(manifest.file), "bin/index.js"))
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    const cli = snapshot(resolved, false, { readOnlyPackage: true });
+    projectedHookAcl(cli.file, cli.stat);
+    if ((cli.stat.mode & 0o100n) === 0n)
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    const recheck = () => {
+      try {
+        if (realpathSync7(command) !== resolved || linkIdentity(lstatSync17(command, { bigint: true })) !== linkIdentity(link2) || !isDeepStrictEqual5(parents2(), parentIdentity) || !isDeepStrictEqual5(parents2(resolved), resolvedParentIdentity))
+          hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+        projectedHookAcl(cli.file, cli.stat);
+        projectedHookAcl(manifest.file, manifest.stat);
+        unchanged2(cli);
+        unchanged2(manifest);
+      } catch {
+        hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+      }
+    };
+    recheck();
+    return { resolved, sha256: cli.sha256, manifestSha256: manifest.sha256, recheck };
+  } catch {
+    hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+  }
+}
+function planClaudeManagedHookProjection(options) {
+  if (typeof options.targetSettings !== "string" || Buffer.byteLength(options.targetSettings) > 1024 * 1024)
+    hookProjectionRefusal("TARGET_INVALID");
+  const targetSha256 = sha3(options.targetSettings);
+  if (!/^[a-f0-9]{64}$/.test(options.expectedTargetSha256) || options.expectedTargetSha256 !== targetSha256)
+    hookProjectionRefusal("TARGET_CHANGED");
+  let target;
+  try {
+    target = jsonObject(options.targetSettings, "target");
+  } catch {
+    hookProjectionRefusal("TARGET_INVALID");
+  }
+  const home = resolve12(options.home ?? homedir3()), dataDir3 = options.dataDir ?? getDataDirReadOnly();
+  const policyPath = join23(dataDir3, "agent-policy.json");
+  let policyBytes, settingsBytes, settingsPath, command, profile;
+  try {
+    policyBytes = readNativeBytes(policyPath, 1024 * 1024);
+    const snapshot2 = readManagedSkillPolicySnapshot(dataDir3);
+    if (!snapshot2 || snapshot2.text !== policyBytes.toString("utf8"))
+      hookProjectionRefusal("SOURCE_UNVERIFIED");
+    const binding = snapshot2.value.bridge;
+    settingsPath = canonicalAgentPath(join23(home, AGENT_ADAPTERS.claude.config), binding?.rootAliases ?? []);
+    settingsBytes = readNativeBytes(settingsPath, 1024 * 1024);
+    command = binding?.commands?.claude;
+    profile = binding?.profiles?.claude;
+    if (typeof command !== "string" || typeof profile !== "string")
+      hookProjectionRefusal("SOURCE_UNVERIFIED");
+    assertManagedAgentBridge("claude", { home, dataDir: dataDir3, projectDir: options.projectDir, profileId: profile });
+  } catch {
+    hookProjectionRefusal("SOURCE_UNVERIFIED");
+  }
+  const executable = projectedHookExecutable(command);
+  const sourceSha256 = sha3(JSON.stringify({
+    home,
+    policyPath,
+    policy: sha3(policyBytes),
+    settingsPath,
+    settings: sha3(settingsBytes),
+    executable: { path: executable.resolved, sha256: executable.sha256, manifestSha256: executable.manifestSha256 }
+  }));
+  if (options.expectedSourceSha256 !== undefined && options.expectedSourceSha256 !== sourceSha256)
+    hookProjectionRefusal("SOURCE_CHANGED");
+  const replacements2 = [];
+  const observed = [executable];
+  if (target.hooks !== undefined) {
+    if (!target.hooks || typeof target.hooks !== "object" || Array.isArray(target.hooks))
+      hookProjectionRefusal("TARGET_INVALID");
+    for (const event of [...AGENT_ADAPTERS.claude.events, "PreToolUse"]) {
+      const groups = target.hooks[event];
+      if (groups === undefined)
+        continue;
+      if (!Array.isArray(groups))
+        hookProjectionRefusal("TARGET_INVALID");
+      let recognized = 0;
+      for (const [groupIndex, group] of groups.entries()) {
+        if (!group || !Array.isArray(group.hooks))
+          hookProjectionRefusal("TARGET_INVALID");
+        for (const [hookIndex, hook] of group.hooks.entries()) {
+          if (hook?.type !== "command" || typeof hook.command !== "string")
+            continue;
+          if (!hook.command.includes("hook user-prompt --agent claude"))
+            continue;
+          const match = /^('(?:[^']|'\\'')*') hook user-prompt --agent claude --selection-profile ([A-Za-z0-9][A-Za-z0-9._-]{0,127}) --event ([A-Za-z]+)$/.exec(hook.command);
+          if (!match || match[3] !== event)
+            hookProjectionRefusal("UNRECOGNIZED");
+          const oldCommand = match[1].slice(1, -1).replaceAll("'\\''", "'");
+          let rendered;
+          try {
+            rendered = renderAgentHookCommand(oldCommand, "claude", match[2], event);
+          } catch {
+            hookProjectionRefusal("UNRECOGNIZED");
+          }
+          if (rendered !== hook.command)
+            hookProjectionRefusal("UNRECOGNIZED");
+          const legacy = projectedHookExecutable(oldCommand, executable.resolved);
+          if (legacy.resolved !== executable.resolved || legacy.sha256 !== executable.sha256 || legacy.manifestSha256 !== executable.manifestSha256)
+            hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+          observed.push(legacy);
+          if (++recognized > 1)
+            hookProjectionRefusal("AMBIGUOUS");
+          const replacement = renderAgentHookCommand(command, "claude", profile, event);
+          if (replacement !== hook.command)
+            replacements2.push({ event, groupIndex, hookIndex, beforeSha256: sha3(hook.command), command: replacement });
+        }
+      }
+    }
+  }
+  try {
+    if (!readNativeBytes(policyPath, 1024 * 1024).equals(policyBytes) || !readNativeBytes(settingsPath, 1024 * 1024).equals(settingsBytes))
+      hookProjectionRefusal("SOURCE_CHANGED");
+  } catch {
+    hookProjectionRefusal("SOURCE_CHANGED");
+  }
+  for (const item of observed)
+    item.recheck();
+  return { schema: "hasna.claude-managed-hook-projection.v1", targetSha256, sourceSha256, replacements: replacements2 };
+}
 function verifyCoordinatedDiscovery(binding, home, aliases) {
   try {
     if (binding.method !== "automatic" && binding.method !== "reviewed")
@@ -53357,10 +53599,10 @@ function verifyCoordinatedDiscovery(binding, home, aliases) {
 }
 function atomicWrite2(path, content) {
   assertSafePath(path);
-  mkdirSync5(dirname11(path), { recursive: true, mode: 448 });
+  mkdirSync5(dirname12(path), { recursive: true, mode: 448 });
   const temporary = `${path}.skills-${randomUUID5()}`;
   try {
-    writeFileSync4(temporary, content, { mode: 384, flag: "wx" });
+    writeFileSync5(temporary, content, { mode: 384, flag: "wx" });
     renameSync2(temporary, path);
   } finally {
     if (existsSync13(temporary))
@@ -53371,10 +53613,10 @@ function planAgentSettingsWitnessUpgrade(options) {
   if (options.targetCodexVersion !== undefined && (options.agent !== "codex" || ![2, 3].includes(options.targetCodexVersion)))
     throw new Error("Invalid Codex witness target version");
   const home = resolve12(options.home ?? homedir3()), dataDir3 = options.dataDir ?? getDataDirReadOnly();
-  const snapshot = readManagedSkillPolicySnapshot(dataDir3);
-  if (!snapshot || sha3(snapshot.text) !== options.expectedPolicySha256)
+  const snapshot2 = readManagedSkillPolicySnapshot(dataDir3);
+  if (!snapshot2 || sha3(snapshot2.text) !== options.expectedPolicySha256)
     throw new Error("Managed policy preimage changed");
-  const policy = snapshot.value, aliases = policy.bridge?.rootAliases ?? [];
+  const policy = snapshot2.value, aliases = policy.bridge?.rootAliases ?? [];
   recheckRootAliases(aliases);
   const binding = policy.bridge?.discovery?.[options.agent];
   if (!binding || binding.agent !== options.agent || binding.method !== "reviewed")
@@ -53418,7 +53660,7 @@ function planAgentSettingsWitnessUpgrade(options) {
   const replacement = { ...binding, sources: rebound };
   verifyAgentDiscovery(replacement);
   const after2 = serializeManagedSkillPolicy({ ...policy, bridge: { ...policy.bridge, discovery: { ...policy.bridge.discovery, [options.agent]: replacement } } });
-  return { dataDir: dataDir3, profileId: policy.profileId, changes: [{ path: join23(dataDir3, "agent-policy.json"), before: snapshot.text, after: after2 }], nativeSkills: [], observedPolicy: { path: join23(dataDir3, "agent-policy.json"), before: snapshot.text }, observedSettings: { path: configPath, before: settings }, discoveryBefore: [replacement], discoveryAfter: [replacement], rootAliases: aliases, managedAgentChecks: { home, agents: [options.agent] }, settingsWitnessUpgrade: { agent: options.agent, path: configPath, fromHashMode: previous.hashMode ?? "bytes", fromSha256: previous.sha256, toHashMode: next.hashMode, toSha256: next.sha256, reviewedPreimage: options.reviewedPreimage, currentSettingsSha256: options.expectedSettingsSha256, replacedWitnesses: replaced.map((source) => ({ hashMode: source.hashMode ?? "bytes", sha256: source.sha256 })) } };
+  return { dataDir: dataDir3, profileId: policy.profileId, changes: [{ path: join23(dataDir3, "agent-policy.json"), before: snapshot2.text, after: after2 }], nativeSkills: [], observedPolicy: { path: join23(dataDir3, "agent-policy.json"), before: snapshot2.text }, observedSettings: { path: configPath, before: settings }, discoveryBefore: [replacement], discoveryAfter: [replacement], rootAliases: aliases, managedAgentChecks: { home, agents: [options.agent] }, settingsWitnessUpgrade: { agent: options.agent, path: configPath, fromHashMode: previous.hashMode ?? "bytes", fromSha256: previous.sha256, toHashMode: next.hashMode, toSha256: next.sha256, reviewedPreimage: options.reviewedPreimage, currentSettingsSha256: options.expectedSettingsSha256, replacedWitnesses: replaced.map((source) => ({ hashMode: source.hashMode ?? "bytes", sha256: source.sha256 })) } };
 }
 function applyAgentIntegration(plan) {
   for (const source of plan.observedNativeSources ?? [])
@@ -53471,7 +53713,7 @@ function applyAgentIntegration(plan) {
   for (const [index, change] of plan.changes.entries())
     if (change.before !== null) {
       const backup = join23(backupRoot, `${index}-${sha3(change.path).slice(0, 12)}.backup`);
-      writeFileSync4(backup, change.before, { mode: 384, flag: "wx" });
+      writeFileSync5(backup, change.before, { mode: 384, flag: "wx" });
       if (readFileSync13(backup, "utf8") !== change.before)
         throw new Error("Native configuration preservation readback failed");
       backups.push(backup);
@@ -53481,7 +53723,7 @@ function applyAgentIntegration(plan) {
       recheckRootAliases(aliases);
       if (currentText(change.path) !== change.before)
         throw new Error(`Configuration changed after planning: ${change.path}`);
-      for (let directory = dirname11(change.path);!existsSync13(directory); directory = dirname11(directory))
+      for (let directory = dirname12(change.path);!existsSync13(directory); directory = dirname12(directory))
         createdDirectories.add(directory);
       const after2 = change.after;
       atomicWrite2(change.path, after2);
@@ -53532,11 +53774,11 @@ function applyAgentIntegration(plan) {
 }
 function syncArchiveDirectory(path) {
   assertSafePath(path);
-  const descriptor = openSync8(path, constants8.O_RDONLY | constants8.O_DIRECTORY | constants8.O_NOFOLLOW | constants8.O_NONBLOCK);
+  const descriptor = openSync9(path, constants9.O_RDONLY | constants9.O_DIRECTORY | constants9.O_NOFOLLOW | constants9.O_NONBLOCK);
   try {
-    fsyncSync2(descriptor);
+    fsyncSync3(descriptor);
   } finally {
-    closeSync8(descriptor);
+    closeSync9(descriptor);
   }
 }
 function writeArchiveJournal(path, value) {
@@ -53544,18 +53786,18 @@ function writeArchiveJournal(path, value) {
   const temporary = `${path}.skills-${randomUUID5()}`;
   let descriptor;
   try {
-    descriptor = openSync8(temporary, constants8.O_WRONLY | constants8.O_CREAT | constants8.O_EXCL | constants8.O_NOFOLLOW, 384);
-    writeFileSync4(descriptor, `${JSON.stringify(value)}
+    descriptor = openSync9(temporary, constants9.O_WRONLY | constants9.O_CREAT | constants9.O_EXCL | constants9.O_NOFOLLOW, 384);
+    writeFileSync5(descriptor, `${JSON.stringify(value)}
 `);
-    fsyncSync2(descriptor);
-    closeSync8(descriptor);
+    fsyncSync3(descriptor);
+    closeSync9(descriptor);
     descriptor = undefined;
     renameSync2(temporary, path);
-    syncArchiveDirectory(dirname11(path));
+    syncArchiveDirectory(dirname12(path));
   } finally {
     if (descriptor !== undefined)
-      closeSync8(descriptor);
-    if (lstatSync16(temporary, { throwIfNoEntry: false }))
+      closeSync9(descriptor);
+    if (lstatSync17(temporary, { throwIfNoEntry: false }))
       unlinkSync3(temporary);
   }
 }
@@ -53589,7 +53831,7 @@ function archiveNativeSkills(inventory, options) {
   const moved = [];
   const verifyArchive = (entry) => {
     assertSafePath(entry.archive);
-    const stat = lstatSync16(entry.archive);
+    const stat = lstatSync17(entry.archive);
     if (entry.discoveryOnly ? !stat.isFile() : !stat.isDirectory())
       throw new Error("Archive type changed");
     if ((entry.discoveryOnly ? sha3(readNativeBytes(entry.archive)) : treeHash(entry.archive)) !== entry.hash)
@@ -53597,14 +53839,14 @@ function archiveNativeSkills(inventory, options) {
   };
   assertSafePath(archiveRoot);
   const created = [];
-  for (let path = archiveRoot;!existsSync13(path); path = dirname11(path))
+  for (let path = archiveRoot;!existsSync13(path); path = dirname12(path))
     created.push(path);
   mkdirSync5(archiveRoot, { recursive: true, mode: 448 });
   try {
     for (const directory of created)
       syncArchiveDirectory(directory);
     if (created.length)
-      syncArchiveDirectory(dirname11(created.at(-1)));
+      syncArchiveDirectory(dirname12(created.at(-1)));
     writeArchiveJournal(receiptPath, journal);
     for (const [index, entry] of selected.entries()) {
       recheckRootAliases(aliases);
@@ -53616,7 +53858,7 @@ function archiveNativeSkills(inventory, options) {
       writeArchiveJournal(receiptPath, journal);
       renameSync2(move.source, move.archive);
       moved.push(move);
-      syncArchiveDirectory(dirname11(move.source));
+      syncArchiveDirectory(dirname12(move.source));
       syncArchiveDirectory(archiveRoot);
       verifyArchive(move);
       move.status = "archived";
@@ -53637,7 +53879,7 @@ function archiveNativeSkills(inventory, options) {
         recheckRootAliases(aliases);
         assertSafePath(entry.source);
         assertSafePath(entry.archive);
-        if (lstatSync16(entry.source, { throwIfNoEntry: false })) {
+        if (lstatSync17(entry.source, { throwIfNoEntry: false })) {
           entry.status = "recovery-required";
           entry.conflict = "source-occupied";
           continue;
@@ -53651,10 +53893,10 @@ function archiveNativeSkills(inventory, options) {
         }
         if (entry.discoveryOnly) {
           linkSync2(entry.archive, entry.source);
-          syncArchiveDirectory(dirname11(entry.source));
+          syncArchiveDirectory(dirname12(entry.source));
           unlinkSync3(entry.archive);
         } else {
-          if (lstatSync16(entry.source, { throwIfNoEntry: false })) {
+          if (lstatSync17(entry.source, { throwIfNoEntry: false })) {
             entry.status = "recovery-required";
             entry.conflict = "source-occupied";
             continue;
@@ -53662,7 +53904,7 @@ function archiveNativeSkills(inventory, options) {
           renameSync2(entry.archive, entry.source);
         }
         entry.status = "restored";
-        syncArchiveDirectory(dirname11(entry.source));
+        syncArchiveDirectory(dirname12(entry.source));
         syncArchiveDirectory(archiveRoot);
       } catch {
         entry.status = "recovery-required";
@@ -53687,10 +53929,10 @@ function assertManagedAgentBridge(agent, options = {}) {
 function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscovery) {
   const home = resolve12(options.home ?? homedir3()), dataDir3 = options.dataDir ?? getDataDirReadOnly();
   assertSafePath(join23(dataDir3, "agent-policy.json"));
-  const snapshot = readManagedSkillPolicySnapshot(dataDir3);
-  if (!snapshot)
+  const snapshot2 = readManagedSkillPolicySnapshot(dataDir3);
+  if (!snapshot2)
     throw new Error("NATIVE_SKILL_DRIFT: install the Skills bridge with skills hook install");
-  const binding = snapshot.value.bridge;
+  const binding = snapshot2.value.bridge;
   if (!binding || binding.version !== CLI_BRIDGE_VERSION || binding.digest !== CLI_BRIDGE_DIGEST || binding.home !== home || !Array.isArray(binding.agents) || !binding.agents.includes(agent))
     throw new Error("NATIVE_SKILL_DRIFT: the managed Skills bridge binding is missing or incompatible; run skills hook install");
   const aliases = binding.rootAliases ?? [];
@@ -53846,7 +54088,7 @@ function assertNativeExportAllowed(dataDir3 = getDataDirReadOnly()) {
   if (requiresCliSkillLoading(dataDir3))
     throw new Error("NATIVE_SKILL_EXPORT_DISABLED: this station loads skills through the Skills CLI; use skills sync --selection-profile <id>");
 }
-var sha3 = (data) => createHash12("sha256").update(data).digest("hex"), HOOK_EVENTS, ROOTS, SKILLS_LOADING_POLICY = "Skills loading policy: discover skills with `skills list` or `skills search`, and read selected instructions with `skills load <slug>`. Use `skills sync` to refresh the shared profile. The only native skill is the owned skills-cli bridge. Create and edit payload skills in the Skills authoring workspace; do not copy payload instructions into native discovery folders. Context loading does not authorize execution; use `skills run` only when the task calls for running a skill.";
+var sha3 = (data) => createHash13("sha256").update(data).digest("hex"), HOOK_EVENTS, ROOTS, SKILLS_LOADING_POLICY = "Skills loading policy: discover skills with `skills list` or `skills search`, and read selected instructions with `skills load <slug>`. Use `skills sync` to refresh the shared profile. The only native skill is the owned skills-cli bridge. Create and edit payload skills in the Skills authoring workspace; do not copy payload instructions into native discovery folders. Context loading does not authorize execution; use `skills run` only when the task calls for running a skill.";
 var init_agent_integration = __esm(() => {
   init_codex_plugin_skill_controls();
   init_codex_native_skill_catalog();
@@ -53862,12 +54104,13 @@ var init_agent_integration = __esm(() => {
   init_agent_sumi();
   init_agent_hermes();
   init_claude_settings_witness();
+  init_codex_hook_trust_files();
   HOOK_EVENTS = ["UserPromptSubmit", "SessionStart", "SubagentStart"];
   ROOTS = NATIVE_SKILL_ROOTS;
 });
 
 // src/lib/home-migration.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync6, readdirSync as readdirSync9, renameSync as renameSync3, rmSync, statSync as statSync9, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync6, readdirSync as readdirSync9, renameSync as renameSync3, rmSync, statSync as statSync9, writeFileSync as writeFileSync6 } from "fs";
 import { join as join25 } from "path";
 function layoutMigrationRecordPath(appDir) {
   return join25(appDir, SKILLS_CACHE_DIRNAME, LAYOUT_MIGRATION_RECORD);
@@ -53990,7 +54233,7 @@ function migrateOwnerLayout(options = {}) {
     moved,
     note: "installed/ and legacy flat skill dirs moved into skills/; custom/ retained"
   };
-  writeFileSync5(layoutMigrationRecordPath(appDir), `${JSON.stringify(record3, null, 2)}
+  writeFileSync6(layoutMigrationRecordPath(appDir), `${JSON.stringify(record3, null, 2)}
 `);
   return { status: "migrated", moved, created, record: record3 };
 }
@@ -54005,7 +54248,7 @@ var init_home_migration = __esm(() => {
 import {
   cpSync as cpSync2,
   existsSync as existsSync15,
-  lstatSync as lstatSync17,
+  lstatSync as lstatSync18,
   mkdirSync as mkdirSync7,
   mkdtempSync,
   readFileSync as readFileSync14,
@@ -54013,17 +54256,17 @@ import {
   renameSync as renameSync4,
   rmSync as rmSync2,
   statSync as statSync10,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync7
 } from "fs";
 import { homedir as homedir4 } from "os";
-import { basename as basename6, dirname as dirname12, join as join26 } from "path";
+import { basename as basename6, dirname as dirname13, join as join26 } from "path";
 function isSkillsOwnershipMarker(marker) {
   return typeof marker === "object" && marker !== null && Object.hasOwn(marker, "managedBy") && marker.managedBy === SYNC_MARKER_MANAGED_BY;
 }
 function hasSkillsOwnershipMarker(dir) {
   const path = join26(dir, SYNC_MARKER_FILE);
   try {
-    if (!lstatSync17(path).isFile())
+    if (!lstatSync18(path).isFile())
       return false;
     const marker = JSON.parse(readFileSync14(path, "utf8"));
     return isSkillsOwnershipMarker(marker);
@@ -54248,7 +54491,7 @@ function writeManagedSkillDir(dir, skillMd, options) {
   const action = dirExists ? "update" : "create";
   if (options.dryRun)
     return { action, path: skillMdPath };
-  const parentDir = dirname12(dir);
+  const parentDir = dirname13(dir);
   mkdirSync7(parentDir, { recursive: true });
   const transactionDir = mkdtempSync(join26(parentDir, `.hasna-skills-write-${basename6(dir)}-`));
   const candidateDir = join26(transactionDir, "candidate");
@@ -54270,10 +54513,10 @@ function writeManagedSkillDir(dir, skillMd, options) {
     } else {
       mkdirSync7(candidateDir, { recursive: true });
     }
-    writeFileSync6(candidateSkillMdPath, skillMd.endsWith(`
+    writeFileSync7(candidateSkillMdPath, skillMd.endsWith(`
 `) ? skillMd : `${skillMd}
 `);
-    writeFileSync6(candidateMarkerPath, `${JSON.stringify(marker, null, 2)}
+    writeFileSync7(candidateMarkerPath, `${JSON.stringify(marker, null, 2)}
 `);
     if (dirExists) {
       originalMoved = true;
@@ -54356,7 +54599,7 @@ var init_skill_aliases = __esm(() => {
 });
 
 // src/lib/project-state.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync15, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "fs";
 import { join as join27 } from "path";
 function getProjectStateDir(targetDir = process.cwd()) {
   return join27(targetDir, SKILLS_PROJECT_DIR);
@@ -54392,7 +54635,7 @@ function saveProjectConfig(config, targetDir = process.cwd()) {
   const dir = getProjectStateDir(targetDir);
   mkdirSync8(dir, { recursive: true });
   const normalized = normalizeProjectConfig({ ...config, updatedAt: new Date().toISOString() });
-  writeFileSync7(getProjectConfigPath(targetDir), JSON.stringify(normalized, null, 2) + `
+  writeFileSync8(getProjectConfigPath(targetDir), JSON.stringify(normalized, null, 2) + `
 `);
 }
 function pinProjectSkill(name, details = {}, targetDir = process.cwd()) {
@@ -55431,7 +55674,7 @@ var init_selection_resolver = __esm(() => {
 });
 
 // src/lib/plugin-projection.ts
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 import { posix } from "path";
 function pluginRefusal(message) {
   throw new SkillSelectionError("PLUGIN_ADMISSION_REFUSED", message);
@@ -55624,7 +55867,7 @@ function buildPluginProjection(entries) {
   files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   return { manifest, payloads: manifest.payloads, files, witnesses: pluginFileWitnesses(files), originalTreeDigest, projectionTreeDigest: pluginTreeDigest(files), removed: removed.length ? pluginFileWitnesses(removed) : [] };
 }
-var PLUGIN_PROJECTION_MANIFEST = "plugin-projection.json", PLUGIN_PROJECTION_LIMITS, pluginHash = (bytes) => createHash13("sha256").update(bytes).digest("hex"), MANIFEST_FIELDS;
+var PLUGIN_PROJECTION_MANIFEST = "plugin-projection.json", PLUGIN_PROJECTION_LIMITS, pluginHash = (bytes) => createHash14("sha256").update(bytes).digest("hex"), MANIFEST_FIELDS;
 var init_plugin_projection = __esm(() => {
   init_selection_cache();
   PLUGIN_PROJECTION_LIMITS = Object.freeze({ files: 1024, bytes: 64 * 1024 * 1024, fileBytes: 16 * 1024 * 1024, metadataBytes: 512 * 1024, registrations: 64, history: 128 });
@@ -55632,12 +55875,12 @@ var init_plugin_projection = __esm(() => {
 });
 
 // src/lib/plugin-projection-store.ts
-import { createHash as createHash14, randomUUID as randomUUID6 } from "crypto";
-import { constants as constants9, closeSync as closeSync9, fchmodSync, fstatSync as fstatSync9, fsyncSync as fsyncSync3, linkSync as linkSync3, lstatSync as lstatSync18, mkdirSync as mkdirSync9, openSync as openSync9, opendirSync as opendirSync4, readSync as readSync7, renameSync as renameSync5, rmdirSync as rmdirSync3, rmSync as rmSync4, unlinkSync as unlinkSync4, writeSync as writeSync2 } from "fs";
-import { dirname as dirname13, isAbsolute as isAbsolute12, join as join30, parse as parse5, resolve as resolve13 } from "path";
+import { createHash as createHash15, randomUUID as randomUUID6 } from "crypto";
+import { constants as constants10, closeSync as closeSync10, fchmodSync, fstatSync as fstatSync10, fsyncSync as fsyncSync4, linkSync as linkSync3, lstatSync as lstatSync19, mkdirSync as mkdirSync9, openSync as openSync10, opendirSync as opendirSync4, readSync as readSync8, renameSync as renameSync5, rmdirSync as rmdirSync3, rmSync as rmSync4, unlinkSync as unlinkSync4, writeSync as writeSync2 } from "fs";
+import { dirname as dirname14, isAbsolute as isAbsolute12, join as join30, parse as parse5, resolve as resolve13 } from "path";
 function stat(path) {
   try {
-    return lstatSync18(path, { bigint: true });
+    return lstatSync19(path, { bigint: true });
   } catch (error) {
     if (missing(error))
       return null;
@@ -55656,7 +55899,7 @@ function same3(left, right, identityOnly = false) {
 }
 function ancestors(path, create3 = false) {
   canonical5(path);
-  const result2 = [], parent = dirname13(path), filesystemRoot = parse5(parent).root;
+  const result2 = [], parent = dirname14(path), filesystemRoot = parse5(parent).root;
   let current = filesystemRoot;
   for (const segment of ["", ...parent.slice(filesystemRoot.length).split("/").filter(Boolean)]) {
     if (segment)
@@ -55684,7 +55927,7 @@ function verifyAncestors(chain, identityOnly = true) {
 }
 function privateParent(path) {
   const chain = ancestors(path, true), parent = chain.at(-1);
-  pluginNeed(parent && parent.path === dirname13(path), "Plugin storage parent is unavailable");
+  pluginNeed(parent && parent.path === dirname14(path), "Plugin storage parent is unavailable");
   owner(parent.stat);
   pluginNeed((parent.stat.mode & 0o7777n) === 0o700n, "Plugin storage parent must have mode 0700");
   return chain;
@@ -55713,19 +55956,19 @@ function readBytes(path, maximum, kind) {
   fileShape(before2, maximum, kind);
   let fd;
   try {
-    fd = openSync9(path, READ_FLAGS);
-    const opened = fstatSync9(fd, { bigint: true });
+    fd = openSync10(path, READ_FLAGS);
+    const opened = fstatSync10(fd, { bigint: true });
     same3(before2, opened);
     fileShape(opened, maximum, kind);
     const bytes = new Uint8Array(Number(opened.size));
     let offset = 0;
     while (offset < bytes.byteLength) {
-      const count = readSync7(fd, bytes, offset, bytes.byteLength - offset, null);
+      const count = readSync8(fd, bytes, offset, bytes.byteLength - offset, null);
       pluginNeed(count > 0, "Plugin file changed while being read");
       offset += count;
     }
-    pluginNeed(readSync7(fd, new Uint8Array(1), 0, 1, null) === 0, "Plugin file grew while being read");
-    same3(opened, fstatSync9(fd, { bigint: true }));
+    pluginNeed(readSync8(fd, new Uint8Array(1), 0, 1, null) === 0, "Plugin file grew while being read");
+    same3(opened, fstatSync10(fd, { bigint: true }));
     same3(opened, stat(path));
     verifyAncestors(chain);
     return bytes;
@@ -55735,7 +55978,7 @@ function readBytes(path, maximum, kind) {
     return pluginRefusal("Cannot safely read plugin file");
   } finally {
     if (fd !== undefined)
-      closeSync9(fd);
+      closeSync10(fd);
   }
 }
 function exactPaths(entries) {
@@ -55845,16 +56088,16 @@ function verifyPluginTree(root, witnesses) {
 function writeExclusive(path, bytes, mode) {
   let fd, created;
   try {
-    fd = openSync9(path, WRITE_FLAGS, mode);
+    fd = openSync10(path, WRITE_FLAGS, mode);
     fchmodSync(fd, mode);
-    created = fstatSync9(fd, { bigint: true });
+    created = fstatSync10(fd, { bigint: true });
     let offset = 0;
     while (offset < bytes.byteLength) {
       const count = writeSync2(fd, bytes, offset, bytes.byteLength - offset);
       pluginNeed(count > 0, "Plugin file write did not progress");
       offset += count;
     }
-    fsyncSync3(fd);
+    fsyncSync4(fd);
   } catch (error) {
     if (created) {
       same3(created, stat(path), true);
@@ -55863,7 +56106,7 @@ function writeExclusive(path, bytes, mode) {
     throw error;
   } finally {
     if (fd !== undefined)
-      closeSync9(fd);
+      closeSync10(fd);
   }
 }
 function materializePluginTree(root, entries) {
@@ -55966,20 +56209,20 @@ function pluginExecutableDigest(path) {
   fileShape(before2, maximum, "executable");
   let fd;
   try {
-    fd = openSync9(path, READ_FLAGS);
-    const opened = fstatSync9(fd, { bigint: true });
+    fd = openSync10(path, READ_FLAGS);
+    const opened = fstatSync10(fd, { bigint: true });
     same3(before2, opened);
     fileShape(opened, maximum, "executable");
-    const hash2 = createHash14("sha256"), buffer = new Uint8Array(64 * 1024);
+    const hash2 = createHash15("sha256"), buffer = new Uint8Array(64 * 1024);
     let remaining = Number(opened.size);
     while (remaining > 0) {
-      const count = readSync7(fd, buffer, 0, Math.min(buffer.byteLength, remaining), null);
+      const count = readSync8(fd, buffer, 0, Math.min(buffer.byteLength, remaining), null);
       pluginNeed(count > 0, "Plugin executable changed during hashing");
       hash2.update(buffer.subarray(0, count));
       remaining -= count;
     }
-    pluginNeed(readSync7(fd, buffer, 0, 1, null) === 0, "Plugin executable grew during hashing");
-    same3(opened, fstatSync9(fd, { bigint: true }));
+    pluginNeed(readSync8(fd, buffer, 0, 1, null) === 0, "Plugin executable grew during hashing");
+    same3(opened, fstatSync10(fd, { bigint: true }));
     same3(opened, stat(path));
     verifyAncestors(chain);
     return `sha256:${hash2.digest("hex")}`;
@@ -55989,14 +56232,14 @@ function pluginExecutableDigest(path) {
     return pluginRefusal("Cannot safely hash plugin executable");
   } finally {
     if (fd !== undefined)
-      closeSync9(fd);
+      closeSync10(fd);
   }
 }
 var READ_FLAGS, WRITE_FLAGS, uid = () => typeof process.getuid === "function" ? BigInt(process.getuid()) : undefined, missing = (error) => Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
 var init_plugin_projection_store = __esm(() => {
   init_plugin_projection();
-  READ_FLAGS = constants9.O_RDONLY | constants9.O_NOFOLLOW | constants9.O_NONBLOCK;
-  WRITE_FLAGS = constants9.O_WRONLY | constants9.O_CREAT | constants9.O_EXCL | constants9.O_NOFOLLOW | constants9.O_NONBLOCK;
+  READ_FLAGS = constants10.O_RDONLY | constants10.O_NOFOLLOW | constants10.O_NONBLOCK;
+  WRITE_FLAGS = constants10.O_WRONLY | constants10.O_CREAT | constants10.O_EXCL | constants10.O_NOFOLLOW | constants10.O_NONBLOCK;
 });
 
 // src/lib/selected-manifest.ts
@@ -56405,8 +56648,8 @@ var init_plugin_admission = __esm(() => {
 });
 
 // src/lib/plugin-discovery.ts
-import { closeSync as closeSync10, constants as constants10, fstatSync as fstatSync10, lstatSync as lstatSync19, openSync as openSync10, opendirSync as opendirSync5, readSync as readSync8 } from "fs";
-import { basename as basename7, dirname as dirname14, isAbsolute as isAbsolute14, join as join32, resolve as resolve15 } from "path";
+import { closeSync as closeSync11, constants as constants11, fstatSync as fstatSync11, lstatSync as lstatSync20, openSync as openSync11, opendirSync as opendirSync5, readSync as readSync9 } from "fs";
+import { basename as basename7, dirname as dirname15, isAbsolute as isAbsolute14, join as join32, resolve as resolve15 } from "path";
 function validateManagedPluginWitnesses(value) {
   pluginNeed(Array.isArray(value) && value.length > 0 && value.length <= PLUGIN_PROJECTION_LIMITS.registrations, "Invalid managed plugin witness collection");
   const seen = new Set;
@@ -56421,29 +56664,29 @@ function validateManagedPluginWitnesses(value) {
 function safe3(path) {
   pluginText(path);
   pluginNeed(isAbsolute14(path) && resolve15(path) === path, "Invalid plugin registry path");
-  for (let at2 = path;; at2 = dirname14(at2)) {
-    pluginNeed(!lstatSync19(at2, { throwIfNoEntry: false })?.isSymbolicLink(), "Plugin registry path traverses a symlink");
-    if (at2 === dirname14(at2))
+  for (let at2 = path;; at2 = dirname15(at2)) {
+    pluginNeed(!lstatSync20(at2, { throwIfNoEntry: false })?.isSymbolicLink(), "Plugin registry path traverses a symlink");
+    if (at2 === dirname15(at2))
       break;
   }
 }
 function readRegistry(path) {
   safe3(path);
-  const initial2 = lstatSync19(path);
+  const initial2 = lstatSync20(path);
   pluginNeed(initial2.isFile() && initial2.size <= 1024 * 1024, "Plugin registry is not a bounded regular file");
-  const fd = openSync10(path, constants10.O_RDONLY | constants10.O_NOFOLLOW | constants10.O_NONBLOCK);
+  const fd = openSync11(path, constants11.O_RDONLY | constants11.O_NOFOLLOW | constants11.O_NONBLOCK);
   try {
-    const opened = fstatSync10(fd);
+    const opened = fstatSync11(fd);
     pluginNeed(opened.isFile() && opened.ino === initial2.ino && opened.dev === initial2.dev, "Plugin registry changed during open");
     const bytes = Buffer.alloc(1024 * 1024 + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync8(fd, bytes, length, bytes.length - length, null);
+      const count = readSync9(fd, bytes, length, bytes.length - length, null);
       if (!count)
         break;
       length += count;
     }
-    const after2 = fstatSync10(fd), current = lstatSync19(path);
+    const after2 = fstatSync11(fd), current = lstatSync20(path);
     safe3(path);
     pluginNeed(length <= 1024 * 1024 && length === opened.size && after2.size === opened.size && after2.mtimeMs === opened.mtimeMs && after2.ctimeMs === opened.ctimeMs && current.dev === opened.dev && current.ino === opened.ino && current.mtimeMs === opened.mtimeMs && current.ctimeMs === opened.ctimeMs, "Plugin registry changed during read");
     let value;
@@ -56455,7 +56698,7 @@ function readRegistry(path) {
     pluginNeed(pluginObject(value) && value.version === 2 && pluginObject(value.plugins), "Unsupported native plugin registry schema");
     return { value, rawDigest: pluginHash(bytes.subarray(0, length)) };
   } finally {
-    closeSync10(fd);
+    closeSync11(fd);
   }
 }
 function nativeVersionMatches(version, receipt) {
@@ -56464,7 +56707,7 @@ function nativeVersionMatches(version, receipt) {
 }
 function hashManagedPluginRegistry(path, managed) {
   validateManagedPluginWitnesses(managed);
-  const snapshot = readRegistry(path), plugins = snapshot.value.plugins;
+  const snapshot2 = readRegistry(path), plugins = snapshot2.value.plugins;
   const seen = new Set, verified = new Set;
   let verifiedBytes = 0;
   for (const witness of managed) {
@@ -56473,7 +56716,7 @@ function hashManagedPluginRegistry(path, managed) {
     seen.add(target.pluginId);
     const rows = plugins[target.pluginId];
     pluginNeed(Array.isArray(rows) && rows.length === target.registrations.length, "Managed plugin registration membership changed");
-    const [name, market] = target.pluginId.split("@"), cacheRoot = join32(dirname14(path), "cache", market, name);
+    const [name, market] = target.pluginId.split("@"), cacheRoot = join32(dirname15(path), "cache", market, name);
     const scopes = new Set, approvals = new Map, currentFiles = new Map;
     plugins[target.pluginId] = rows.map((row) => {
       pluginNeed(pluginObject(row), "Invalid managed plugin registration");
@@ -56516,7 +56759,7 @@ function hashManagedPluginRegistry(path, managed) {
       return Object.fromEntries(Object.entries(row).filter(([key]) => !["version", "installPath", "sourceProducerPath", "previousProducerPaths", "lastUpdated"].includes(key)));
     });
     safe3(cacheRoot);
-    const before2 = lstatSync19(cacheRoot);
+    const before2 = lstatSync20(cacheRoot);
     pluginNeed(before2.isDirectory(), "Invalid managed plugin cache root");
     const directory = opendirSync5(cacheRoot), names = [];
     try {
@@ -56539,12 +56782,12 @@ function hashManagedPluginRegistry(path, managed) {
     }
     for (const row of rows)
       pluginNeed(names.includes(row.version), "Managed native plugin installation is missing");
-    const after2 = lstatSync19(cacheRoot);
+    const after2 = lstatSync20(cacheRoot);
     safe3(cacheRoot);
     pluginNeed(before2.dev === after2.dev && before2.ino === after2.ino && before2.mtimeMs === after2.mtimeMs && before2.ctimeMs === after2.ctimeMs, "Managed cache version membership changed during verification");
   }
-  pluginNeed(readRegistry(path).rawDigest === snapshot.rawDigest, "Native plugin registry changed during content verification");
-  return pluginHash(JSON.stringify(snapshot.value));
+  pluginNeed(readRegistry(path).rawDigest === snapshot2.rawDigest, "Native plugin registry changed during content verification");
+  return pluginHash(JSON.stringify(snapshot2.value));
 }
 var init_plugin_discovery = __esm(() => {
   init_plugin_admission();
@@ -56553,50 +56796,50 @@ var init_plugin_discovery = __esm(() => {
 });
 
 // src/lib/claude-marketplace-registry.ts
-import { createHash as createHash15 } from "crypto";
-import { closeSync as closeSync11, constants as constants11, fstatSync as fstatSync11, lstatSync as lstatSync20, openSync as openSync11, readSync as readSync9 } from "fs";
-import { basename as basename8, dirname as dirname15, isAbsolute as isAbsolute15, resolve as resolve16 } from "path";
-function need5(value, reason) {
+import { createHash as createHash16 } from "crypto";
+import { closeSync as closeSync12, constants as constants12, fstatSync as fstatSync12, lstatSync as lstatSync21, openSync as openSync12, readSync as readSync10 } from "fs";
+import { basename as basename8, dirname as dirname16, isAbsolute as isAbsolute15, resolve as resolve16 } from "path";
+function need6(value, reason) {
   if (!value)
     throw new Error(`Claude marketplace registry ${reason}`);
 }
 function absolutePath3(value) {
-  need5(typeof value === "string" && value.length > 0 && value.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.pathCharacters && !/[\x00-\x1f\x7f]/.test(value) && isAbsolute15(value) && resolve16(value) === value, "requires a normalized absolute path");
+  need6(typeof value === "string" && value.length > 0 && value.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.pathCharacters && !/[\x00-\x1f\x7f]/.test(value) && isAbsolute15(value) && resolve16(value) === value, "requires a normalized absolute path");
 }
 function parents2(path) {
   const result2 = [];
-  for (let at2 = dirname15(path);; at2 = dirname15(at2)) {
-    const stat2 = lstatSync20(at2, { bigint: true });
-    need5(stat2.isDirectory() && !stat2.isSymbolicLink(), "path traverses a symlink or non-directory");
+  for (let at2 = dirname16(path);; at2 = dirname16(at2)) {
+    const stat2 = lstatSync21(at2, { bigint: true });
+    need6(stat2.isDirectory() && !stat2.isSymbolicLink(), "path traverses a symlink or non-directory");
     result2.push([at2, stat2]);
-    if (at2 === dirname15(at2))
+    if (at2 === dirname16(at2))
       return result2;
   }
 }
 function readRegistry2(path, budget) {
   absolutePath3(path);
-  need5(basename8(path) === "known_marketplaces.json", "requires known_marketplaces.json");
-  need5(Number.isSafeInteger(budget.remaining) && budget.remaining >= 0, "has an invalid byte budget");
-  const ancestors2 = parents2(path), initial2 = lstatSync20(path, { bigint: true });
-  need5(initial2.isFile() && !initial2.isSymbolicLink() && initial2.size <= BigInt(CLAUDE_MARKETPLACE_REGISTRY_LIMITS.bytes), "is not a bounded regular file");
-  need5(initial2.size <= BigInt(budget.remaining), "exceeds its aggregate byte limit");
-  const fd = openSync11(path, constants11.O_RDONLY | constants11.O_NOFOLLOW | constants11.O_NONBLOCK);
+  need6(basename8(path) === "known_marketplaces.json", "requires known_marketplaces.json");
+  need6(Number.isSafeInteger(budget.remaining) && budget.remaining >= 0, "has an invalid byte budget");
+  const ancestors2 = parents2(path), initial2 = lstatSync21(path, { bigint: true });
+  need6(initial2.isFile() && !initial2.isSymbolicLink() && initial2.size <= BigInt(CLAUDE_MARKETPLACE_REGISTRY_LIMITS.bytes), "is not a bounded regular file");
+  need6(initial2.size <= BigInt(budget.remaining), "exceeds its aggregate byte limit");
+  const fd = openSync12(path, constants12.O_RDONLY | constants12.O_NOFOLLOW | constants12.O_NONBLOCK);
   try {
-    const opened = fstatSync11(fd, { bigint: true });
-    need5(opened.isFile() && sameFile2(initial2, opened), "changed during open");
+    const opened = fstatSync12(fd, { bigint: true });
+    need6(opened.isFile() && sameFile2(initial2, opened), "changed during open");
     const bytes = Buffer.alloc(Number(opened.size) + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync9(fd, bytes, length, bytes.length - length, null);
+      const count = readSync10(fd, bytes, length, bytes.length - length, null);
       if (!count)
         break;
       length += count;
     }
-    const after2 = fstatSync11(fd, { bigint: true }), current = lstatSync20(path, { bigint: true });
-    need5(current.isFile() && sameFile2(opened, after2) && sameFile2(after2, current) && BigInt(length) === opened.size, "changed during read");
+    const after2 = fstatSync12(fd, { bigint: true }), current = lstatSync21(path, { bigint: true });
+    need6(current.isFile() && sameFile2(opened, after2) && sameFile2(after2, current) && BigInt(length) === opened.size, "changed during read");
     for (const [ancestor, before2] of ancestors2) {
-      const now3 = lstatSync20(ancestor, { bigint: true });
-      need5(now3.isDirectory() && before2.dev === now3.dev && before2.ino === now3.ino && before2.mode === now3.mode, "parent changed during read");
+      const now3 = lstatSync21(ancestor, { bigint: true });
+      need6(now3.isDirectory() && before2.dev === now3.dev && before2.ino === now3.ino && before2.mode === now3.mode, "parent changed during read");
     }
     budget.remaining -= length;
     try {
@@ -56605,7 +56848,7 @@ function readRegistry2(path, budget) {
       throw new Error("Claude marketplace registry is not strict UTF-8");
     }
   } finally {
-    closeSync11(fd);
+    closeSync12(fd);
   }
 }
 function parse6(text2) {
@@ -56616,7 +56859,7 @@ function parse6(text2) {
       at2++;
   };
   function string() {
-    need5(text2[at2] === '"', "contains invalid JSON");
+    need6(text2[at2] === '"', "contains invalid JSON");
     const start = at2++;
     while (at2 < text2.length) {
       const character = text2[at2++];
@@ -56627,7 +56870,7 @@ function parse6(text2) {
         } catch {
           throw new Error("Claude marketplace registry contains invalid JSON string");
         }
-        need5(value2.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.stringCharacters, "exceeds its string limit");
+        need6(value2.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.stringCharacters, "exceeds its string limit");
         return value2;
       }
       if (character === "\\")
@@ -56636,7 +56879,7 @@ function parse6(text2) {
     throw new Error("Claude marketplace registry contains an unterminated JSON string");
   }
   function value(depth) {
-    need5(depth <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.depth && ++nodes <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.nodes, "exceeds its nesting or node limit");
+    need6(depth <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.depth && ++nodes <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.nodes, "exceeds its nesting or node limit");
     space();
     const character = text2[at2];
     if (character === '"')
@@ -56650,17 +56893,17 @@ function parse6(text2) {
           if (object5) {
             space();
             const key = string();
-            need5(!keys2.has(key), "contains a duplicate JSON key");
+            need6(!keys2.has(key), "contains a duplicate JSON key");
             keys2.add(key);
             space();
-            need5(text2[at2++] === ":", "contains invalid JSON");
+            need6(text2[at2++] === ":", "contains invalid JSON");
             entries.push([key, value(depth + 1)]);
           } else
             items.push(value(depth + 1));
           space();
           if (text2[at2] === end)
             break;
-          need5(text2[at2++] === ",", "contains invalid JSON");
+          need6(text2[at2++] === ",", "contains invalid JSON");
         }
       at2++;
       return object5 ? { kind: "object", entries } : { kind: "array", items };
@@ -56672,21 +56915,21 @@ function parse6(text2) {
       }
     numberPattern.lastIndex = at2;
     const number = numberPattern.exec(text2);
-    need5(number, "contains invalid JSON");
+    need6(number, "contains invalid JSON");
     at2 += number[0].length;
     return { kind: "number", value: number[0] };
   }
   const root2 = value(0);
   space();
-  need5(at2 === text2.length && root2.kind === "object", "requires a JSON object without trailing content");
-  need5(root2.entries.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.rows, "exceeds its marketplace row limit");
+  need6(at2 === text2.length && root2.kind === "object", "requires a JSON object without trailing content");
+  need6(root2.entries.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.rows, "exceeds its marketplace row limit");
   return root2;
 }
 function exactKeys(value, keys2) {
   return value?.kind === "object" && value.entries.length === keys2.length && value.entries.every(([key]) => keys2.includes(key));
 }
 function textField(value) {
-  need5(value?.kind === "string" && value.value.length > 0 && !/[\x00-\x1f\x7f]/.test(value.value), "contains an invalid recognized field");
+  need6(value?.kind === "string" && value.value.length > 0 && !/[\x00-\x1f\x7f]/.test(value.value), "contains an invalid recognized field");
   return value.value;
 }
 function normalizeRow(row, version = 1) {
@@ -56694,7 +56937,7 @@ function normalizeRow(row, version = 1) {
     if (version !== 2 || !exactKeys(row, ["source", "installLocation", "lastUpdated", "autoUpdate"]))
       return;
     const autoUpdate = field(row, "autoUpdate");
-    need5(autoUpdate?.kind === "literal" && (autoUpdate.value === "true" || autoUpdate.value === "false"), "contains an invalid automatic-update preference");
+    need6(autoUpdate?.kind === "literal" && (autoUpdate.value === "true" || autoUpdate.value === "false"), "contains an invalid automatic-update preference");
   }
   const source = field(row, "source");
   if (source?.kind !== "object")
@@ -56710,23 +56953,23 @@ function normalizeRow(row, version = 1) {
     absolutePath3(sourceLocation);
   absolutePath3(textField(field(row, "installLocation")));
   const updated = textField(field(row, "lastUpdated"));
-  need5(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(updated), "contains an invalid recognized update timestamp");
+  need6(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(updated), "contains an invalid recognized update timestamp");
   const millis = Date.parse(updated);
-  need5(Number.isFinite(millis) && new Date(millis).toISOString() === updated, "contains an invalid recognized update timestamp");
+  need6(Number.isFinite(millis) && new Date(millis).toISOString() === updated, "contains an invalid recognized update timestamp");
   row.entries = row.entries.map(([key, value]) => [key, key === "lastUpdated" ? { kind: "validated-update-time" } : value]);
 }
 function captureClaudeMarketplaceRegistry(path, budget = { remaining: 256 * 1024 * 1024 }) {
   const value = parse6(readRegistry2(path, budget));
   for (const [, row] of value.entries)
     normalizeRow(row);
-  const sha2562 = createHash15("sha256").update("hasna.skills.claude-marketplace-registry.v1\x00").update(JSON.stringify(value)).digest("hex");
+  const sha2562 = createHash16("sha256").update("hasna.skills.claude-marketplace-registry.v1\x00").update(JSON.stringify(value)).digest("hex");
   return { path, hashMode: "claude-marketplace-registry", sha256: sha2562 };
 }
 function captureClaudeMarketplaceRegistryV2(path, budget = { remaining: 256 * 1024 * 1024 }) {
   const value = parse6(readRegistry2(path, budget));
   for (const [, row] of value.entries)
     normalizeRow(row, 2);
-  const sha2562 = createHash15("sha256").update("hasna.skills.claude-marketplace-registry.v2\x00").update(JSON.stringify(value)).digest("hex");
+  const sha2562 = createHash16("sha256").update("hasna.skills.claude-marketplace-registry.v2\x00").update(JSON.stringify(value)).digest("hex");
   return { path, hashMode: "claude-marketplace-registry-v2", sha256: sha2562 };
 }
 var CLAUDE_MARKETPLACE_REGISTRY_LIMITS, sameFile2 = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode && a.uid === b.uid && a.gid === b.gid && a.nlink === b.nlink && a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs, field = (object5, key) => object5.entries.find(([name]) => name === key)?.[1];
@@ -56734,65 +56977,6 @@ var init_claude_marketplace_registry = __esm(() => {
   CLAUDE_MARKETPLACE_REGISTRY_LIMITS = Object.freeze({ bytes: 1024 * 1024, rows: 1024, depth: 32, nodes: 65536, stringCharacters: 16384, pathCharacters: 4096 });
 });
 
-// src/lib/codex-hook-trust-files.ts
-import { closeSync as closeSync12, constants as constants12, fstatSync as fstatSync12, fsyncSync as fsyncSync4, lstatSync as lstatSync21, openSync as openSync12, readSync as readSync10, writeFileSync as writeFileSync8 } from "fs";
-import { createHash as createHash16 } from "crypto";
-import { dirname as dirname16 } from "path";
-function need6(value, code) {
-  if (!value)
-    throw new Error(`CODEX_HOOK_TRUST_${code}`);
-}
-function safeParents(file) {
-  for (let p = dirname16(file);; p = dirname16(p)) {
-    const s = lstatSync21(p);
-    need6(s.isDirectory() && !s.isSymbolicLink(), "UNSAFE_PARENT");
-    need6((s.mode & 18) === 0 || s.uid === 0 && (s.mode & 512) !== 0, "UNSAFE_PARENT");
-    if (dirname16(p) === p)
-      break;
-  }
-}
-function snapshot(file, privateFile = false, options = {}) {
-  const readOnlyPackage = options.readOnlyPackage === true && !privateFile;
-  safeParents(file);
-  const initial2 = lstatSync21(file, { bigint: true });
-  need6(initial2.isFile() && initial2.uid === BigInt(process.getuid()) && (initial2.nlink === 1n || readOnlyPackage && initial2.nlink > 1n) && (initial2.mode & 0o022n) === 0n && (!privateFile || (initial2.mode & 0o777n) === 0o600n), "UNSAFE_FILE");
-  need6(initial2.size <= 8n * 1024n * 1024n, "FILE_BOUND");
-  const fd = openSync12(file, constants12.O_RDONLY | constants12.O_NOFOLLOW | constants12.O_NONBLOCK);
-  try {
-    const before2 = fstatSync12(fd, { bigint: true });
-    need6(sameStat(initial2, before2), "INPUT_CHANGED");
-    const bytes = Buffer.alloc(Number(before2.size) + 1);
-    let length = 0;
-    while (length < bytes.length) {
-      const n2 = readSync10(fd, bytes, length, bytes.length - length, null);
-      if (!n2)
-        break;
-      length += n2;
-    }
-    need6(length === Number(before2.size) && sameStat(before2, fstatSync12(fd, { bigint: true })) && sameStat(before2, lstatSync21(file, { bigint: true })), "INPUT_CHANGED");
-    const content = bytes.subarray(0, length), text2 = new TextDecoder("utf-8", { fatal: true }).decode(content);
-    return { file, privateFile, readOnlyPackage, text: text2, bytes: content, stat: before2, sha256: createHash16("sha256").update(content).digest("hex") };
-  } finally {
-    closeSync12(fd);
-  }
-}
-function unchanged2(before2) {
-  const after2 = snapshot(before2.file, before2.privateFile, before2.readOnlyPackage ? { readOnlyPackage: true } : {});
-  need6(sameStat(before2.stat, after2.stat) && after2.sha256 === before2.sha256, "INPUT_CHANGED");
-}
-function save(file, content) {
-  safeParents(file);
-  const fd = openSync12(file, constants12.O_WRONLY | constants12.O_CREAT | constants12.O_EXCL | constants12.O_NOFOLLOW, 384);
-  try {
-    writeFileSync8(fd, content);
-    fsyncSync4(fd);
-  } finally {
-    closeSync12(fd);
-  }
-}
-var sameStat = (a, b) => ["dev", "ino", "uid", "nlink", "mode", "size", "mtimeNs", "ctimeNs"].every((key) => a[key] === b[key]);
-var init_codex_hook_trust_files = () => {};
-
 // src/lib/codex-hook-trust-layout.ts
 import { isDeepStrictEqual as isDeepStrictEqual6 } from "util";
 function codexTrustTextWitness(text2, keys2, canonicalize = true) {
@@ -56931,53 +57115,53 @@ var init_codex_hook_trust_layout = () => {};
 import { isAbsolute as isAbsolute16 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual7 } from "util";
 function exactKeys2(value, keys2) {
-  need6(value && typeof value === "object" && !Array.isArray(value) && isDeepStrictEqual7(Object.keys(value).sort(), [...keys2].sort()), "RECONCILE_ADDITIONS_REVIEW_SCHEMA");
+  need5(value && typeof value === "object" && !Array.isArray(value) && isDeepStrictEqual7(Object.keys(value).sort(), [...keys2].sort()), "RECONCILE_ADDITIONS_REVIEW_SCHEMA");
 }
 function readReviewedAdditionTrustStates(proof, before2, current, journalHooks) {
   const captured = proofs.get(proof);
-  need6(!!captured && captured.before.file === before2.file && captured.before.sha256 === before2.sha256 && captured.current.file === current.file && captured.current.sha256 === current.sha256 && isDeepStrictEqual7(captured.journalHooks, journalHooks.map(({ key, currentHash }) => ({ key, currentHash }))), "RECONCILE_ADDITIONS_PROOF_CHANGED");
+  need5(!!captured && captured.before.file === before2.file && captured.before.sha256 === before2.sha256 && captured.current.file === current.file && captured.current.sha256 === current.sha256 && isDeepStrictEqual7(captured.journalHooks, journalHooks.map(({ key, currentHash }) => ({ key, currentHash }))), "RECONCILE_ADDITIONS_PROOF_CHANGED");
   captured.recheck();
   unchanged2(before2);
   unchanged2(current);
   return captured.states;
 }
 function reviewNativeHookAdditions(options) {
-  need6(isAbsolute16(options.path), "RECONCILE_ADDITIONS_REVIEW_PATH");
+  need5(isAbsolute16(options.path), "RECONCILE_ADDITIONS_REVIEW_PATH");
   const reviewFile = snapshot(options.path, true), review = JSON.parse(reviewFile.text);
   exactKeys2(review, ["version", "kind", "reason", "producerEvidence", "journalIntentSha256", "policySha256", "configCurrentSha256", "hooksCurrentSha256", "producerBefore", "additions"]);
-  need6((review.version === 1 || review.version === 2) && review.kind === "native-hook-additions" && text2(review.reason) && text2(review.producerEvidence), "RECONCILE_ADDITIONS_REVIEW_SCHEMA");
+  need5((review.version === 1 || review.version === 2) && review.kind === "native-hook-additions" && text2(review.reason) && text2(review.producerEvidence), "RECONCILE_ADDITIONS_REVIEW_SCHEMA");
   for (const [name, expected] of [["journalIntentSha256", options.intent.sha256], ["policySha256", options.policy.sha256], ["configCurrentSha256", options.configCurrent.sha256], ["hooksCurrentSha256", options.hooksCurrent.sha256]])
-    need6(hash2(review[name]) && review[name] === expected, "RECONCILE_ADDITIONS_REVIEW_CHANGED");
+    need5(hash2(review[name]) && review[name] === expected, "RECONCILE_ADDITIONS_REVIEW_CHANGED");
   exactKeys2(review.producerBefore, ["configPath", "configSha256", "hooksPath", "hooksSha256"]);
   const before2 = review.producerBefore;
-  need6(isAbsolute16(before2.configPath) && isAbsolute16(before2.hooksPath) && hash2(before2.configSha256) && hash2(before2.hooksSha256), "RECONCILE_ADDITIONS_PRODUCER_PREIMAGE");
+  need5(isAbsolute16(before2.configPath) && isAbsolute16(before2.hooksPath) && hash2(before2.configSha256) && hash2(before2.hooksSha256), "RECONCILE_ADDITIONS_PRODUCER_PREIMAGE");
   const producerConfig = snapshot(before2.configPath, true), producerHooks = snapshot(before2.hooksPath, true);
-  need6(producerConfig.sha256 === before2.configSha256 && producerHooks.sha256 === before2.hooksSha256 && producerHooks.sha256 === options.hooksBefore.sha256, "RECONCILE_ADDITIONS_PRODUCER_PREIMAGE");
+  need5(producerConfig.sha256 === before2.configSha256 && producerHooks.sha256 === before2.hooksSha256 && producerHooks.sha256 === options.hooksBefore.sha256, "RECONCILE_ADDITIONS_PRODUCER_PREIMAGE");
   const original = structure(options.configBefore.text), producer = structure(producerConfig.text), expectedProducer = structuredClone(original), originalKeys = options.journalHooks.map((hook) => hook.key);
   expectedProducer.hooks ??= {};
   expectedProducer.hooks.state ??= {};
   for (const hook of options.journalHooks)
     expectedProducer.hooks.state[hook.key] = { ...expectedProducer.hooks.state[hook.key], enabled: true, trusted_hash: hook.currentHash };
-  need6(isDeepStrictEqual7(expectedProducer, producer) && codexTrustReconcileWitness(options.configBefore.text, originalKeys) === codexTrustReconcileWitness(producerConfig.text, originalKeys) && codexTrustUnmanagedSemantic(options.configBefore.text, originalKeys) === codexTrustUnmanagedSemantic(producerConfig.text, originalKeys), "RECONCILE_ADDITIONS_PRODUCER_PREIMAGE");
-  need6(Array.isArray(review.additions) && review.additions.length > 0 && review.additions.length <= 20, "RECONCILE_ADDITIONS_REVIEW_SCHEMA");
+  need5(isDeepStrictEqual7(expectedProducer, producer) && codexTrustReconcileWitness(options.configBefore.text, originalKeys) === codexTrustReconcileWitness(producerConfig.text, originalKeys) && codexTrustUnmanagedSemantic(options.configBefore.text, originalKeys) === codexTrustUnmanagedSemantic(producerConfig.text, originalKeys), "RECONCILE_ADDITIONS_PRODUCER_PREIMAGE");
+  need5(Array.isArray(review.additions) && review.additions.length > 0 && review.additions.length <= 20, "RECONCILE_ADDITIONS_REVIEW_SCHEMA");
   const expectedHooks = JSON.parse(options.hooksBefore.text), currentHooks = JSON.parse(options.hooksCurrent.text), expectedConfig = structuredClone(producer);
-  need6(expectedHooks.hooks && typeof expectedHooks.hooks === "object" && !Array.isArray(expectedHooks.hooks), "RECONCILE_ADDITIONS_DECLARATIONS");
+  need5(expectedHooks.hooks && typeof expectedHooks.hooks === "object" && !Array.isArray(expectedHooks.hooks), "RECONCILE_ADDITIONS_DECLARATIONS");
   const added = [], states = [], seen = new Set, commands = new Set(options.recordedNativeHooks.map((hook) => hook.command));
   for (const addition of review.additions) {
     exactKeys2(addition, review.version === 1 ? ["event", "nativeHook"] : ["event", "nativeHook", "trustState"]);
-    need6(Object.hasOwn(review.version === 1 ? events : matchedEvents, addition.event), "RECONCILE_ADDITIONS_DECLARATIONS");
+    need5(Object.hasOwn(review.version === 1 ? events : matchedEvents, addition.event), "RECONCILE_ADDITIONS_DECLARATIONS");
     const { event, nativeHook: hook } = addition;
     exactKeys2(hook, nativeKeys);
     const groups = expectedHooks.hooks[event] ?? [];
-    need6(Array.isArray(groups), "RECONCILE_ADDITIONS_DECLARATIONS");
+    need5(Array.isArray(groups), "RECONCILE_ADDITIONS_DECLARATIONS");
     const key = `${options.nativeHooksPath}:${matchedEvents[event][1]}:${groups.length}:0`;
-    need6(hook.key === key && !seen.has(key) && !options.recordedNativeHooks.some((originalHook) => originalHook.key === key) && !Object.hasOwn(expectedConfig.hooks.state, key), "RECONCILE_ADDITIONS_IDENTITY");
-    need6(hook.eventName === matchedEvents[event][0] && hook.handlerType === "command" && (review.version === 2 ? v2Command(hook.command) : text2(hook.command, 16384)) && !commands.has(hook.command) && Number.isInteger(hook.timeoutSec) && hook.timeoutSec > 0 && hook.timeoutSec <= 60 && (event === "PreToolUse" ? text2(hook.matcher) : hook.matcher === null) && hook.async === false && hook.statusMessage === null && hook.additionalContextLimit === null && hook.sourcePath === options.nativeHooksPath && hook.source === "user" && hook.pluginId === null && hook.isManaged === false && /^sha256:[a-f0-9]{64}$/.test(hook.currentHash) && hook.enabled === true && hook.trustStatus === "trusted", "RECONCILE_ADDITIONS_IDENTITY");
+    need5(hook.key === key && !seen.has(key) && !options.recordedNativeHooks.some((originalHook) => originalHook.key === key) && !Object.hasOwn(expectedConfig.hooks.state, key), "RECONCILE_ADDITIONS_IDENTITY");
+    need5(hook.eventName === matchedEvents[event][0] && hook.handlerType === "command" && (review.version === 2 ? v2Command(hook.command) : text2(hook.command, 16384)) && !commands.has(hook.command) && Number.isInteger(hook.timeoutSec) && hook.timeoutSec > 0 && hook.timeoutSec <= 60 && (event === "PreToolUse" ? text2(hook.matcher) : hook.matcher === null) && hook.async === false && hook.statusMessage === null && hook.additionalContextLimit === null && hook.sourcePath === options.nativeHooksPath && hook.source === "user" && hook.pluginId === null && hook.isManaged === false && /^sha256:[a-f0-9]{64}$/.test(hook.currentHash) && hook.enabled === true && hook.trustStatus === "trusted", "RECONCILE_ADDITIONS_IDENTITY");
     let trustState = { enabled: true, trusted_hash: hook.currentHash };
     if (review.version === 2) {
       const state = addition.trustState;
       exactKeys2(state, state && Object.hasOwn(state, "enabled") ? ["enabled", "trusted_hash"] : ["trusted_hash"]);
-      need6(state.trusted_hash === hook.currentHash && (!Object.hasOwn(state, "enabled") || state.enabled === true), "RECONCILE_ADDITIONS_TRUST_STATE");
+      need5(state.trusted_hash === hook.currentHash && (!Object.hasOwn(state, "enabled") || state.enabled === true), "RECONCILE_ADDITIONS_TRUST_STATE");
       trustState = { ...state };
     }
     seen.add(key);
@@ -56987,9 +57171,9 @@ function reviewNativeHookAdditions(options) {
     expectedHooks.hooks[event] = [...groups, { ...event === "PreToolUse" ? { matcher: hook.matcher } : {}, hooks: [{ type: "command", command: hook.command, timeout: hook.timeoutSec }] }];
     expectedConfig.hooks.state[key] = trustState;
   }
-  need6(isDeepStrictEqual7(expectedHooks, currentHooks), "RECONCILE_ADDITIONS_DECLARATIONS");
+  need5(isDeepStrictEqual7(expectedHooks, currentHooks), "RECONCILE_ADDITIONS_DECLARATIONS");
   const keys2 = added.map((hook) => hook.key);
-  need6(isDeepStrictEqual7(expectedConfig, structure(options.configCurrent.text)) && codexTrustReconcileWitness(producerConfig.text, keys2) === codexTrustReconcileWitness(options.configCurrent.text, keys2) && codexTrustUnmanagedSemantic(producerConfig.text, keys2) === codexTrustUnmanagedSemantic(options.configCurrent.text, keys2), "RECONCILE_ADDITIONS_CONFIG");
+  need5(isDeepStrictEqual7(expectedConfig, structure(options.configCurrent.text)) && codexTrustReconcileWitness(producerConfig.text, keys2) === codexTrustReconcileWitness(options.configCurrent.text, keys2) && codexTrustUnmanagedSemantic(producerConfig.text, keys2) === codexTrustUnmanagedSemantic(options.configCurrent.text, keys2), "RECONCILE_ADDITIONS_CONFIG");
   const inputs = [reviewFile, producerConfig, producerHooks, options.intent, options.policy, options.configBefore, options.configCurrent, options.hooksBefore, options.hooksCurrent];
   const recheck = () => {
     for (const input of inputs)
@@ -57023,16 +57207,16 @@ function createCodexHookDiscoveryRecovery(binding, before2, current, hooks, addi
   const raw = binding.sources.filter((source) => source.path === current.file && source.hashMode === "bytes");
   if (!raw.some((source) => source.sha256 !== current.sha256))
     return;
-  need6(binding.agent === "codex" && binding.method === "reviewed" && raw.length === 1 && raw[0].sha256 === before2.sha256 && before2.sha256 !== current.sha256, "RECONCILE_DISCOVERY_CONFIG_WITNESS");
-  need6(raw[0].format === undefined && raw[0].fields === undefined && raw[0].managedPlugins === undefined, "RECONCILE_DISCOVERY_CONFIG_WITNESS");
+  need5(binding.agent === "codex" && binding.method === "reviewed" && raw.length === 1 && raw[0].sha256 === before2.sha256 && before2.sha256 !== current.sha256, "RECONCILE_DISCOVERY_CONFIG_WITNESS");
+  need5(raw[0].format === undefined && raw[0].fields === undefined && raw[0].managedPlugins === undefined, "RECONCILE_DISCOVERY_CONFIG_WITNESS");
   const typed = binding.sources.filter((source) => source.path === current.file && source.format === "toml");
-  need6(typed.length === 1 && typed[0].hashMode === undefined && isDeepStrictEqual8(typed[0].fields, fields), "RECONCILE_DISCOVERY_TYPED_WITNESS");
+  need5(typed.length === 1 && typed[0].hashMode === undefined && isDeepStrictEqual8(typed[0].fields, fields), "RECONCILE_DISCOVERY_TYPED_WITNESS");
   const original = structure2(before2.text), actual = structure2(current.text);
   const project = (value) => Object.fromEntries(fields.map((field2) => [field2, value[field2] ?? null]));
   const projection = sha4(JSON.stringify(project(original)));
-  need6(typed[0].sha256 === projection && sha4(JSON.stringify(project(actual))) === projection && isDeepStrictEqual8(project(original), project(actual)), "RECONCILE_DISCOVERY_TYPED_WITNESS");
+  need5(typed[0].sha256 === projection && sha4(JSON.stringify(project(actual))) === projection && isDeepStrictEqual8(project(original), project(actual)), "RECONCILE_DISCOVERY_TYPED_WITNESS");
   const keys2 = [...journalHooks.map((hook) => hook.key), ...additionStates.map((hook) => hook.key)];
-  need6(journalHooks.length > 0 && keys2.length <= 100 && new Set(keys2).size === keys2.length && journalHooks.every((hook) => typeof hook.key === "string" && /^sha256:[a-f0-9]{64}$/.test(hook.currentHash)), "RECONCILE_DISCOVERY_TRUST_WITNESS");
+  need5(journalHooks.length > 0 && keys2.length <= 100 && new Set(keys2).size === keys2.length && journalHooks.every((hook) => typeof hook.key === "string" && /^sha256:[a-f0-9]{64}$/.test(hook.currentHash)), "RECONCILE_DISCOVERY_TRUST_WITNESS");
   const expected = structuredClone(original);
   expected.hooks ??= {};
   expected.hooks.state ??= {};
@@ -57040,7 +57224,7 @@ function createCodexHookDiscoveryRecovery(binding, before2, current, hooks, addi
     expected.hooks.state[hook.key] = { ...expected.hooks.state[hook.key], enabled: true, trusted_hash: hook.currentHash };
   for (const { key, state } of additionStates)
     expected.hooks.state[key] = { ...state };
-  need6(isDeepStrictEqual8(expected, actual) && codexTrustReconcileWitness(before2.text, keys2) === codexTrustReconcileWitness(current.text, keys2) && codexTrustUnmanagedSemantic(before2.text, keys2) === codexTrustUnmanagedSemantic(current.text, keys2), "RECONCILE_DISCOVERY_TRUST_WITNESS");
+  need5(isDeepStrictEqual8(expected, actual) && codexTrustReconcileWitness(before2.text, keys2) === codexTrustReconcileWitness(current.text, keys2) && codexTrustUnmanagedSemantic(before2.text, keys2) === codexTrustUnmanagedSemantic(current.text, keys2), "RECONCILE_DISCOVERY_TRUST_WITNESS");
   unchanged2(before2);
   unchanged2(current);
   const witness = Object.freeze({ configPath: current.file, beforeSha256: before2.sha256, currentSha256: current.sha256, discoverySha256: sha4(JSON.stringify(binding)), typedProjectionSha256: projection });
@@ -57049,7 +57233,7 @@ function createCodexHookDiscoveryRecovery(binding, before2, current, hooks, addi
 }
 function assertCodexHookDiscoveryRecovery(binding, witness) {
   const proof = proofs2.get(witness);
-  need6(!!proof && binding.agent === "codex" && witness.discoverySha256 === sha4(JSON.stringify(binding)), "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
+  need5(!!proof && binding.agent === "codex" && witness.discoverySha256 === sha4(JSON.stringify(binding)), "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
   unchanged2(proof.before);
   unchanged2(proof.current);
   proof.recheckAdditions();
@@ -57058,7 +57242,7 @@ function verifiesCodexHookDiscoverySource(binding, source, currentDigest, witnes
   if (!witness || source.path !== witness.configPath || source.hashMode !== "bytes")
     return false;
   assertCodexHookDiscoveryRecovery(binding, witness);
-  need6(source.sha256 === witness.beforeSha256 && currentDigest === witness.currentSha256, "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
+  need5(source.sha256 === witness.beforeSha256 && currentDigest === witness.currentSha256, "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
   return true;
 }
 var sha4 = (text3) => createHash17("sha256").update(text3).digest("hex"), fields, structure2 = (text3) => JSON.parse(JSON.stringify(Bun.TOML.parse(text3))), proofs2;
@@ -109753,16 +109937,47 @@ function assertConfigUnchanged(configs) {
     }
   }
 }
-async function runNpm(args2, cwd2, home, staging) {
+function releaseAgePolicy(options) {
+  if (options.minReleaseAgeExclude !== undefined && !Array.isArray(options.minReleaseAgeExclude))
+    throw new Error("MIN_RELEASE_AGE_EXCLUDE_INVALID");
+  if (options.minReleaseAge === undefined) {
+    if (options.minReleaseAgeExclude?.length)
+      throw new Error("MIN_RELEASE_AGE_REQUIRED_FOR_EXCLUSIONS");
+    return;
+  }
+  if (!Number.isSafeInteger(options.minReleaseAge) || options.minReleaseAge < 1)
+    throw new Error("MIN_RELEASE_AGE_INVALID");
+  const exclusions = options.minReleaseAgeExclude ?? [];
+  if (!Array.isArray(exclusions) || exclusions.some((pattern) => typeof pattern !== "string" || pattern.length > 214 || !/^(?:@[a-z0-9*?][a-z0-9._*?-]*\/)?[a-z0-9*?][a-z0-9._*?-]*$/.test(pattern))) {
+    throw new Error("MIN_RELEASE_AGE_EXCLUDE_INVALID");
+  }
+  return { minReleaseAge: options.minReleaseAge, minReleaseAgeExclude: [...new Set(exclusions)] };
+}
+async function npmReleaseAgeCapability(cwd2, env3) {
+  try {
+    const versionProbe = Bun.spawn(["npm", "--version"], { cwd: cwd2, env: env3, stdin: "ignore", stdout: "pipe", stderr: "ignore" });
+    const [versionText, versionStatus] = await Promise.all([new Response(versionProbe.stdout).text(), versionProbe.exited]);
+    const version2 = versionText.trim();
+    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version2);
+    if (versionStatus !== 0 || !match || Number(match[1]) < 11 || Number(match[1]) === 11 && Number(match[2]) < 19)
+      throw new Error("NPM_RELEASE_AGE_UNSUPPORTED");
+    const configProbe = Bun.spawn(["npm", "config", "list", "--json"], { cwd: cwd2, env: env3, stdin: "ignore", stdout: "pipe", stderr: "ignore" });
+    const [configText, configStatus] = await Promise.all([new Response(configProbe.stdout).text(), configProbe.exited]);
+    const config2 = object9(JSON.parse(configText), "NPM_RELEASE_AGE_UNSUPPORTED");
+    if (configStatus !== 0 || !Object.hasOwn(config2, "min-release-age") || !Object.hasOwn(config2, "min-release-age-exclude") || !Array.isArray(config2["min-release-age-exclude"]))
+      throw new Error("NPM_RELEASE_AGE_UNSUPPORTED");
+    return version2;
+  } catch {
+    throw new Error("NPM_RELEASE_AGE_UNSUPPORTED");
+  }
+}
+async function runNpm(args2, cwd2, home, staging, policy) {
   const userNpmrc = join56(staging, "npm-user.npmrc"), globalNpmrc = join56(staging, "npm-global.npmrc");
-  if (!existsSync34(userNpmrc))
-    writeFileSync23(userNpmrc, `registry=${REGISTRY_ORIGIN}/
+  const baseConfig = `registry=${REGISTRY_ORIGIN}/
 ignore-scripts=true
-`, { mode: 384, flag: "wx" });
+`;
   if (!existsSync34(globalNpmrc))
-    writeFileSync23(globalNpmrc, `registry=${REGISTRY_ORIGIN}/
-ignore-scripts=true
-`, { mode: 384, flag: "wx" });
+    writeFileSync23(globalNpmrc, baseConfig, { mode: 384, flag: "wx" });
   const env3 = {
     PATH: process.env.PATH ?? "",
     HOME: home,
@@ -109776,6 +109991,19 @@ ignore-scripts=true
     NPM_CONFIG_REGISTRY: `${REGISTRY_ORIGIN}/`,
     NPM_CONFIG_IGNORE_SCRIPTS: "true"
   };
+  const capabilityNpmrc = join56(staging, "npm-capability.npmrc");
+  if (policy && !existsSync34(capabilityNpmrc))
+    writeFileSync23(capabilityNpmrc, baseConfig, { mode: 384, flag: "wx" });
+  if (policy && readFileSync37(capabilityNpmrc, "utf8") !== baseConfig)
+    throw new Error("NPM_ISOLATED_CONFIG_DRIFT");
+  const npmVersion = policy ? await npmReleaseAgeCapability(cwd2, { ...env3, NPM_CONFIG_USERCONFIG: capabilityNpmrc }) : undefined;
+  const config2 = baseConfig + (policy ? `min-release-age=${policy.minReleaseAge}
+${policy.minReleaseAgeExclude.map((pattern) => `min-release-age-exclude[]=${pattern}
+`).join("")}` : "");
+  if (!existsSync34(userNpmrc))
+    writeFileSync23(userNpmrc, config2, { mode: 384, flag: "wx" });
+  if (readFileSync37(userNpmrc, "utf8") !== config2 || readFileSync37(globalNpmrc, "utf8") !== baseConfig)
+    throw new Error("NPM_ISOLATED_CONFIG_DRIFT");
   const proc = Bun.spawn(["npm", ...args2, "--registry", `${REGISTRY_ORIGIN}/`, "--ignore-scripts", "--no-audit", "--no-fund"], {
     cwd: cwd2,
     env: env3,
@@ -109786,6 +110014,7 @@ ignore-scripts=true
   const exitCode = await proc.exited;
   if (exitCode !== 0)
     throw new Error("DEPENDENCY_GRAPH_INSTALL_FAILED");
+  return npmVersion;
 }
 function comparePackageTrees(expectedRoot, installedRoot) {
   const expected = readTree(expectedRoot, false);
@@ -110164,6 +110393,7 @@ async function updateCopyfileRuntime(version2, options = {}) {
     throw new Error("EXACT_VERSION_REQUIRED");
   if (!STABLE_SEMVER_PATTERN.test(version2))
     throw new Error("EXACT_STABLE_VERSION_REQUIRED");
+  const policy = releaseAgePolicy(options);
   const home = resolve24(options.homeDir ?? process.env.HOME ?? "");
   if (!home || !existsSync34(home))
     throw new Error("HOME_NOT_FOUND");
@@ -110201,8 +110431,10 @@ async function updateCopyfileRuntime(version2, options = {}) {
     mkdirSync24(stagePackage, { mode: 448 });
     copyFileSync(artifact.tarballPath, join56(stagePackage, "verified.tgz"));
     writeFileSync23(join56(stagePackage, "package.json"), JSON.stringify({ private: true, dependencies: { [PACKAGE_NAME]: "file:./verified.tgz" } }, null, 2), { mode: 384, flag: "wx" });
-    await runNpm(["install", "--package-lock-only", "--prefix", stagePackage], stagePackage, home, stagePath);
-    await runNpm(["ci", "--prefix", stagePackage], stagePackage, home, stagePath);
+    const npmVersion = await runNpm(["install", "--package-lock-only", "--prefix", stagePackage], stagePackage, home, stagePath, policy);
+    const ciNpmVersion = await runNpm(["ci", "--prefix", stagePackage], stagePackage, home, stagePath, policy);
+    if (npmVersion !== ciNpmVersion)
+      throw new Error("NPM_VERSION_DRIFT_DURING_UPDATE");
     const lockBytes = readFileSync37(join56(stagePackage, "package-lock.json"));
     const installedPackage = join56(stagePackage, "node_modules", "@hasna", "skills");
     const installed = readPackage(join56(installedPackage, "package.json"));
@@ -110243,6 +110475,7 @@ async function updateCopyfileRuntime(version2, options = {}) {
       targetPackageRoot,
       configs: configPreimages,
       preimageSha256,
+      ...policy ? { dependencyPolicy: { ...policy, npmVersion } } : {},
       launchers,
       switchedLaunchers: [],
       rollbackCompletedLaunchers: []
@@ -110281,7 +110514,7 @@ async function updateCopyfileRuntime(version2, options = {}) {
     }
     receipt.state = "switched";
     persistReceipt(join56(finalPath, "rollout-receipt.json"), receipt);
-    return { updated: true, version: version2, currentVersion: layout.currentVersion, receiptId: id2, runtimeRoot: finalPath, tarballSha256: artifact.sha256, tarballIntegrity: artifact.integrity, runtimeTreeSha256: stagedTree.digest, launcherCount: launchers.length, configCount: configPreimages.length };
+    return { updated: true, version: version2, currentVersion: layout.currentVersion, receiptId: id2, runtimeRoot: finalPath, tarballSha256: artifact.sha256, tarballIntegrity: artifact.integrity, runtimeTreeSha256: stagedTree.digest, launcherCount: launchers.length, configCount: configPreimages.length, ...policy ? { dependencyPolicy: { ...policy, npmVersion } } : {} };
   } catch (error61) {
     if (switched.length > 0 || moved) {
       let rollbackFailed = false;
@@ -110505,7 +110738,12 @@ function registerRuntime(parent) {
   });
   const setup = parent.command("setup").description("Point this CLI at a Skills API server, or register agent integrations").option("--api-url <url>", "Skills API origin to send remote work to").option("--global", "Accepted for compatibility; the API origin is always per-user", false).option("--json", "Output setup result as JSON", false).action(async (options) => handleSetup(options));
   setup.command("agents").option("--json", "Output registration result as JSON", false).description("Register the Skills MCP server with all supported agents").action(async (options) => handleMcp({ register: "all", json: options.json }));
-  parent.command("self-update").description("Update @hasna/skills to the latest version").option("--json", "Output result as JSON", false).option("--version <version>", "Install this exact @hasna/skills version as a staged copyfile runtime").option("--rollback <receipt-id>", "Restore launcher links from an exact copyfile rollout receipt").option("--adopt-aliases", "Switch verified legacy @hasna/skills aliases to the active copyfile runtime").option("--rollback-aliases <receipt-id>", "Restore aliases from an exact adoption receipt").action(async (options) => {
+  parent.command("self-update").description("Update @hasna/skills to the latest version").option("--json", "Output result as JSON", false).option("--version <version>", "Install this exact @hasna/skills version as a staged copyfile runtime").option("--min-release-age <days>", "Require a positive integer dependency release age in days for an exact-version update").option("--min-release-age-exclude <pattern>", "Exclude matching package identities from the release-age policy (repeatable)", (pattern, prior) => [...prior, pattern], []).option("--rollback <receipt-id>", "Restore launcher links from an exact copyfile rollout receipt").option("--adopt-aliases", "Switch verified legacy @hasna/skills aliases to the active copyfile runtime").option("--rollback-aliases <receipt-id>", "Restore aliases from an exact adoption receipt").action(async (options) => {
+    if ((options.minReleaseAge !== undefined || options.minReleaseAgeExclude.length > 0) && (!options.version || options.rollback || options.adoptAliases || options.rollbackAliases)) {
+      console.error(JSON.stringify({ error: "RELEASE_AGE_POLICY_REQUIRES_EXACT_VERSION" }));
+      process.exitCode = 1;
+      return;
+    }
     if ([options.version, options.rollback, options.adoptAliases, options.rollbackAliases].filter(Boolean).length > 1) {
       console.error(JSON.stringify({ error: "SELF_UPDATE_OPERATIONS_ARE_MUTUALLY_EXCLUSIVE" }));
       process.exitCode = 1;
@@ -110541,7 +110779,8 @@ function registerRuntime(parent) {
     }
     if (options.version) {
       try {
-        const result2 = await updateCopyfileRuntime(options.version);
+        const minReleaseAge = options.minReleaseAge === undefined ? undefined : /^\d+$/.test(options.minReleaseAge) ? Number(options.minReleaseAge) : NaN;
+        const result2 = await updateCopyfileRuntime(options.version, { minReleaseAge, minReleaseAgeExclude: options.minReleaseAgeExclude });
         if (options.json)
           console.log(JSON.stringify(result2));
         else
@@ -112755,40 +112994,40 @@ import { realpathSync as realpathSync17 } from "fs";
 import { dirname as dirname33, isAbsolute as isAbsolute27, join as join60 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual13 } from "util";
 function inspectRecordedSkillsCli(command, expected) {
-  need6(isAbsolute27(command) && !command.includes("\x00"), "RECONCILE_RECORDED_COMMAND_REQUIRED");
+  need5(isAbsolute27(command) && !command.includes("\x00"), "RECONCILE_RECORDED_COMMAND_REQUIRED");
   const resolved = realpathSync17(command);
   const cli = snapshot(resolved, false, { readOnlyPackage: true });
   const manifest = snapshot(join60(dirname33(dirname33(resolved)), "package.json"), false, { readOnlyPackage: true });
   const pkg = JSON.parse(manifest.text);
-  need6(pkg.name === "@hasna/skills" && /^\d+\.\d+\.\d+$/.test(pkg.version) && pkg.bin?.skills === "bin/index.js" && resolved === join60(dirname33(manifest.file), "bin/index.js"), "SKILLS_PACKAGE_MISMATCH");
-  need6((cli.stat.mode & 0o100n) !== 0n, "SKILLS_COMMAND_NOT_EXECUTABLE");
+  need5(pkg.name === "@hasna/skills" && /^\d+\.\d+\.\d+$/.test(pkg.version) && pkg.bin?.skills === "bin/index.js" && resolved === join60(dirname33(manifest.file), "bin/index.js"), "SKILLS_PACKAGE_MISMATCH");
+  need5((cli.stat.mode & 0o100n) !== 0n, "SKILLS_COMMAND_NOT_EXECUTABLE");
   const receipt = { path: resolved, version: pkg.version, sha256: cli.sha256, manifestSha256: manifest.sha256 };
-  need6(isDeepStrictEqual13(receipt, expected), "RECONCILE_SKILLS_BINDING_CHANGED");
+  need5(isDeepStrictEqual13(receipt, expected), "RECONCILE_SKILLS_BINDING_CHANGED");
   return { receipt, recheck() {
-    need6(realpathSync17(command) === resolved, "SKILLS_COMMAND_CHANGED");
+    need5(realpathSync17(command) === resolved, "SKILLS_COMMAND_CHANGED");
     unchanged2(cli);
     unchanged2(manifest);
   } };
 }
 function bindSkillsCli(command, reviewed) {
   const normal = Bun.which("skills", { PATH: process.env.PATH });
-  need6(normal, "SKILLS_COMMAND_UNAVAILABLE");
+  need5(normal, "SKILLS_COMMAND_UNAVAILABLE");
   const resolved = realpathSync17(normal);
   const bound = isAbsolute27(command) ? command : command === "skills" ? normal : undefined;
-  need6(bound && realpathSync17(bound) === resolved, "SKILLS_COMMAND_MISMATCH");
+  need5(bound && realpathSync17(bound) === resolved, "SKILLS_COMMAND_MISMATCH");
   const entrypoint = reviewed?.path ?? process.argv[1];
-  need6(entrypoint && realpathSync17(entrypoint) === resolved, "SKILLS_ENTRYPOINT_MISMATCH");
+  need5(entrypoint && realpathSync17(entrypoint) === resolved, "SKILLS_ENTRYPOINT_MISMATCH");
   const cli = snapshot(resolved, false, { readOnlyPackage: true });
   const manifest = snapshot(join60(dirname33(dirname33(resolved)), "package.json"), false, { readOnlyPackage: true });
   const pkg = JSON.parse(manifest.text);
-  need6(pkg.name === "@hasna/skills" && /^\d+\.\d+\.\d+$/.test(pkg.version) && pkg.bin?.skills === "bin/index.js" && resolved === join60(dirname33(manifest.file), "bin/index.js"), "SKILLS_PACKAGE_MISMATCH");
+  need5(pkg.name === "@hasna/skills" && /^\d+\.\d+\.\d+$/.test(pkg.version) && pkg.bin?.skills === "bin/index.js" && resolved === join60(dirname33(manifest.file), "bin/index.js"), "SKILLS_PACKAGE_MISMATCH");
   if (reviewed)
-    need6(/^[a-f0-9]{64}$/.test(reviewed.sha256) && reviewed.sha256 === cli.sha256 && reviewed.version === pkg.version, "SKILLS_RELEASE_MISMATCH");
-  need6((cli.stat.mode & 0o100n) !== 0n, "SKILLS_COMMAND_NOT_EXECUTABLE");
+    need5(/^[a-f0-9]{64}$/.test(reviewed.sha256) && reviewed.sha256 === cli.sha256 && reviewed.version === pkg.version, "SKILLS_RELEASE_MISMATCH");
+  need5((cli.stat.mode & 0o100n) !== 0n, "SKILLS_COMMAND_NOT_EXECUTABLE");
   return {
     receipt: { path: resolved, version: pkg.version, sha256: cli.sha256, manifestSha256: manifest.sha256 },
     recheck() {
-      need6(Bun.which("skills", { PATH: process.env.PATH }) === normal && realpathSync17(normal) === resolved && realpathSync17(bound) === resolved && realpathSync17(entrypoint) === resolved, "SKILLS_COMMAND_CHANGED");
+      need5(Bun.which("skills", { PATH: process.env.PATH }) === normal && realpathSync17(normal) === resolved && realpathSync17(bound) === resolved && realpathSync17(entrypoint) === resolved, "SKILLS_COMMAND_CHANGED");
       unchanged2(cli);
       unchanged2(manifest);
     }
@@ -112801,17 +113040,17 @@ var init_codex_hook_trust_identity = __esm(() => {
 // src/lib/codex-hook-policy-recovery.ts
 import { isDeepStrictEqual as isDeepStrictEqual14 } from "util";
 function reviewedClaudeDiscoveryChange(beforeText, currentText, options) {
-  need6(typeof options.reason === "string" && options.reason.trim().length > 0 && options.reason.length <= 512 && !/[\x00-\x1f\x7f]/.test(options.reason), "RECONCILE_RECOVERY_REASON_REQUIRED");
-  need6(options.reviewedPlanDigest === undefined || /^[a-f0-9]{64}$/.test(options.reviewedPlanDigest), "RECONCILE_RECOVERY_PLAN_CHANGED");
+  need5(typeof options.reason === "string" && options.reason.trim().length > 0 && options.reason.length <= 512 && !/[\x00-\x1f\x7f]/.test(options.reason), "RECONCILE_RECOVERY_REASON_REQUIRED");
+  need5(options.reviewedPlanDigest === undefined || /^[a-f0-9]{64}$/.test(options.reviewedPlanDigest), "RECONCILE_RECOVERY_PLAN_CHANGED");
   const before2 = parseManagedSkillPolicy(beforeText), current = parseManagedSkillPolicy(currentText);
   const oldDiscovery = before2.bridge?.discovery?.claude, newDiscovery = current.bridge?.discovery?.claude;
-  need6(oldDiscovery?.agent === "claude" && newDiscovery?.agent === "claude" && oldDiscovery.method === "reviewed" && newDiscovery.method === "reviewed", "RECONCILE_POLICY_CHANGED");
+  need5(oldDiscovery?.agent === "claude" && newDiscovery?.agent === "claude" && oldDiscovery.method === "reviewed" && newDiscovery.method === "reviewed", "RECONCILE_POLICY_CHANGED");
   const changes = ["roots", "sources"].filter((key) => !isDeepStrictEqual14(oldDiscovery[key], newDiscovery[key])).map((key) => ({ path: `bridge.discovery.claude.${key}`, before: oldDiscovery[key], after: newDiscovery[key] }));
-  need6(changes.length > 0, "RECONCILE_POLICY_CHANGED");
+  need5(changes.length > 0, "RECONCILE_POLICY_CHANGED");
   const compared = structuredClone(current);
   compared.bridge.discovery.claude.roots = oldDiscovery.roots;
   compared.bridge.discovery.claude.sources = oldDiscovery.sources;
-  need6(isDeepStrictEqual14(before2, compared), "RECONCILE_POLICY_CHANGED");
+  need5(isDeepStrictEqual14(before2, compared), "RECONCILE_POLICY_CHANGED");
   verifyAgentDiscovery(newDiscovery);
   return { reason: options.reason, changes };
 }
@@ -112829,15 +113068,15 @@ import { dirname as dirname34, isAbsolute as isAbsolute28, join as join61, resol
 import { homedir as homedir12 } from "os";
 import { isDeepStrictEqual as isDeepStrictEqual15 } from "util";
 function verifyReleaseArtifact(proof, skillsCli) {
-  need6(isAbsolute28(proof.packageTarPath) && !proof.packageTarPath.includes("\x00"), "RECONCILE_RELEASE_PROVENANCE_PATH");
+  need5(isAbsolute28(proof.packageTarPath) && !proof.packageTarPath.includes("\x00"), "RECONCILE_RELEASE_PROVENANCE_PATH");
   const tarPath = realpathSync18(proof.packageTarPath);
-  need6(statSync21(tarPath).isFile(), "RECONCILE_RELEASE_PROVENANCE_PATH");
+  need5(statSync21(tarPath).isFile(), "RECONCILE_RELEASE_PROVENANCE_PATH");
   const tarBytes = readFileSync40(tarPath);
-  need6(tarBytes.byteLength === proof.packageTarBytes && createHash31("sha256").update(tarBytes).digest("hex") === proof.packageTarSha256, "RECONCILE_RELEASE_ARTIFACT_CHANGED");
+  need5(tarBytes.byteLength === proof.packageTarBytes && createHash31("sha256").update(tarBytes).digest("hex") === proof.packageTarSha256, "RECONCILE_RELEASE_ARTIFACT_CHANGED");
   const packageRoot = dirname34(dirname34(realpathSync18(skillsCli.receipt.path)));
   const manifest = readFileSync40(join61(packageRoot, "package.json"));
-  need6(createHash31("sha256").update(manifest).digest("hex") === skillsCli.receipt.manifestSha256 && skillsCli.receipt.manifestSha256 === proof.manifestSha256, "RECONCILE_RELEASE_MANIFEST_CHANGED");
-  need6(createHash31("sha256").update(readFileSync40(skillsCli.receipt.path)).digest("hex") === proof.executableSha256 && skillsCli.receipt.sha256 === proof.executableSha256, "RECONCILE_RELEASE_EXECUTABLE_CHANGED");
+  need5(createHash31("sha256").update(manifest).digest("hex") === skillsCli.receipt.manifestSha256 && skillsCli.receipt.manifestSha256 === proof.manifestSha256, "RECONCILE_RELEASE_MANIFEST_CHANGED");
+  need5(createHash31("sha256").update(readFileSync40(skillsCli.receipt.path)).digest("hex") === proof.executableSha256 && skillsCli.receipt.sha256 === proof.executableSha256, "RECONCILE_RELEASE_EXECUTABLE_CHANGED");
   const members2 = [["package/package.json", manifest], ["package/bin/index.js", readFileSync40(skillsCli.receipt.path)]];
   for (const [member, expected] of members2) {
     let actual;
@@ -112846,7 +113085,7 @@ function verifyReleaseArtifact(proof, skillsCli) {
     } catch {
       throw new Error("RECONCILE_RELEASE_ARTIFACT_MEMBER_MISSING");
     }
-    need6(Buffer.compare(actual, expected) === 0, "RECONCILE_RELEASE_ARTIFACT_MEMBER_CHANGED");
+    need5(Buffer.compare(actual, expected) === 0, "RECONCILE_RELEASE_ARTIFACT_MEMBER_CHANGED");
   }
 }
 async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc) {
@@ -112854,48 +113093,48 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
   try {
     const home = resolve26(options.home ?? homedir12()), dataDir3 = resolve26(options.dataDir ?? getDataDirReadOnly());
     const parent = resolve26(join61(dataDir3, "native-hook-trust")), journal = resolve26(options.journal);
-    need6(journal.startsWith(parent + "/") && /^[a-f0-9-]{36}$/.test(journal.slice(parent.length + 1)), "RECONCILE_JOURNAL_PATH");
+    need5(journal.startsWith(parent + "/") && /^[a-f0-9-]{36}$/.test(journal.slice(parent.length + 1)), "RECONCILE_JOURNAL_PATH");
     const dir = lstatSync32(journal, { throwIfNoEntry: false });
-    need6(!!dir && dir.isDirectory() && !dir.isSymbolicLink() && dir.uid === process.getuid() && (dir.mode & 511) === 448, "UNSAFE_JOURNAL");
-    need6(!lstatSync32(join61(journal, "receipt.json"), { throwIfNoEntry: false }), "RECONCILE_ALREADY_COMPLETE");
-    need6(lstatSync32(join61(journal, "stopped.json"), { throwIfNoEntry: false })?.isFile(), "RECONCILE_JOURNAL_INCOMPLETE");
+    need5(!!dir && dir.isDirectory() && !dir.isSymbolicLink() && dir.uid === process.getuid() && (dir.mode & 511) === 448, "UNSAFE_JOURNAL");
+    need5(!lstatSync32(join61(journal, "receipt.json"), { throwIfNoEntry: false }), "RECONCILE_ALREADY_COMPLETE");
+    need5(lstatSync32(join61(journal, "stopped.json"), { throwIfNoEntry: false })?.isFile(), "RECONCILE_JOURNAL_INCOMPLETE");
     const stoppedFile = snapshot(join61(journal, "stopped.json"), true);
     const intentFile = snapshot(join61(journal, "intent.json"), true), intent = JSON.parse(intentFile.text);
     const configBefore = snapshot(join61(journal, "config.before.toml"), true), hooksBefore = snapshot(join61(journal, "hooks.before.json"), true), policyBefore = snapshot(join61(journal, "policy.before.json"), true);
     const legacyIntent = intent.home === undefined && intent.configSha256 === undefined && intent.configVersion === undefined && intent.declarations === undefined && intent.admitted === undefined && intent.nativeHooks === undefined;
-    need6(intent.version === 1 && /^[a-f0-9]{64}$/.test(intent.planDigest) && typeof intent.configPath === "string" && /^[a-f0-9]{64}$/.test(intent.policySha256) && /^[a-f0-9]{64}$/.test(intent.hooksSha256) && Array.isArray(intent.hooks) && intent.hooks.length > 0 && intent.hooks.length <= 100 && (legacyIntent || typeof intent.home === "string" && intent.home === home && /^[a-f0-9]{64}$/.test(intent.configSha256) && typeof intent.configVersion === "string" && Array.isArray(intent.declarations) && Array.isArray(intent.admitted) && Array.isArray(intent.nativeHooks)), "RECONCILE_INTENT_INVALID");
+    need5(intent.version === 1 && /^[a-f0-9]{64}$/.test(intent.planDigest) && typeof intent.configPath === "string" && /^[a-f0-9]{64}$/.test(intent.policySha256) && /^[a-f0-9]{64}$/.test(intent.hooksSha256) && Array.isArray(intent.hooks) && intent.hooks.length > 0 && intent.hooks.length <= 100 && (legacyIntent || typeof intent.home === "string" && intent.home === home && /^[a-f0-9]{64}$/.test(intent.configSha256) && typeof intent.configVersion === "string" && Array.isArray(intent.declarations) && Array.isArray(intent.admitted) && Array.isArray(intent.nativeHooks)), "RECONCILE_INTENT_INVALID");
     const declarations = intent.declarations ?? intent.hooks.map((hook) => ({ event: hook.event, key: `${join61(home, ".codex/hooks.json")}${hook.key.slice(hook.key.indexOf(".codex/hooks.json") + ".codex/hooks.json".length)}`, command: hook.command }));
     const admitted = intent.admitted ?? intent.hooks;
     const configSha256 = intent.configSha256 ?? configBefore.sha256, configVersion = intent.configVersion ?? intent.expectedVersion;
     const digestInput = { version: 1, home: intent.home ?? home, configPath: intent.configPath, ...intent.nativeConfigPath !== undefined ? { nativeConfigPath: intent.nativeConfigPath } : {}, configSha256, configVersion, policySha256: intent.policySha256, hooksSha256: intent.hooksSha256, skillsCli: intent.skillsCli, nativeVersion: intent.nativeVersion, declarations, admitted };
-    need6(makePlanDigest(digestInput) === intent.planDigest, "RECONCILE_PLAN_CHANGED");
-    need6(isDeepStrictEqual15(intent.hooks, admitted.filter((hook) => !hook.enabled || hook.trustStatus !== "trusted")), "RECONCILE_INTENT_HOOKS_CHANGED");
-    need6(configBefore.sha256 === (intent.beforeSha256 ?? intent.configSha256) && hooksBefore.sha256 === intent.hooksSha256 && policyBefore.sha256 === intent.policySha256, "RECONCILE_JOURNAL_CHANGED");
+    need5(makePlanDigest(digestInput) === intent.planDigest, "RECONCILE_PLAN_CHANGED");
+    need5(isDeepStrictEqual15(intent.hooks, admitted.filter((hook) => !hook.enabled || hook.trustStatus !== "trusted")), "RECONCILE_INTENT_HOOKS_CHANGED");
+    need5(configBefore.sha256 === (intent.beforeSha256 ?? intent.configSha256) && hooksBefore.sha256 === intent.hooksSha256 && policyBefore.sha256 === intent.policySha256, "RECONCILE_JOURNAL_CHANGED");
     const policyCurrent = snapshot(join61(dataDir3, "agent-policy.json"), true);
     const { claudeDiscoveryRecovery: claudeRecovery, nativeHookAdditionsRecovery: additionsRecovery } = options;
     const recovery = claudeRecovery ?? additionsRecovery;
-    need6(!recovery || !options.supersedeBinding, "RECONCILE_RECOVERY_MODE_CONFLICT");
-    need6(!claudeRecovery || !additionsRecovery || claudeRecovery.reviewedPlanDigest === additionsRecovery.reviewedPlanDigest, "RECONCILE_RECOVERY_MODE_CONFLICT");
-    need6(recovery?.reviewedPlanDigest === undefined || /^[a-f0-9]{64}$/.test(recovery.reviewedPlanDigest), "RECONCILE_RECOVERY_PLAN_CHANGED");
+    need5(!recovery || !options.supersedeBinding, "RECONCILE_RECOVERY_MODE_CONFLICT");
+    need5(!claudeRecovery || !additionsRecovery || claudeRecovery.reviewedPlanDigest === additionsRecovery.reviewedPlanDigest, "RECONCILE_RECOVERY_MODE_CONFLICT");
+    need5(recovery?.reviewedPlanDigest === undefined || /^[a-f0-9]{64}$/.test(recovery.reviewedPlanDigest), "RECONCILE_RECOVERY_PLAN_CHANGED");
     const policyChange = claudeRecovery ? reviewedClaudeDiscoveryChange(policyBefore.text, policyCurrent.text, claudeRecovery) : undefined;
     let supersededBinding = false;
     if (policyCurrent.sha256 !== policyBefore.sha256 && !claudeRecovery) {
-      need6(options.supersedeBinding === true, "RECONCILE_POLICY_CHANGED");
+      need5(options.supersedeBinding === true, "RECONCILE_POLICY_CHANGED");
       const oldPolicy = JSON.parse(policyBefore.text), currentPolicy = JSON.parse(policyCurrent.text);
-      need6(isDeepStrictEqual15(withoutCodexCommand(oldPolicy), withoutCodexCommand(currentPolicy)), "RECONCILE_POLICY_CHANGED");
+      need5(isDeepStrictEqual15(withoutCodexCommand(oldPolicy), withoutCodexCommand(currentPolicy)), "RECONCILE_POLICY_CHANGED");
       supersededBinding = true;
     }
     if (supersededBinding || recovery) {
-      need6(Array.isArray(intent.nativeHooks) && intent.nativeHooks.length > 0, "RECONCILE_NATIVE_INVENTORY_REQUIRED");
+      need5(Array.isArray(intent.nativeHooks) && intent.nativeHooks.length > 0, "RECONCILE_NATIVE_INVENTORY_REQUIRED");
       const proof = options.releaseProof;
-      need6(!!proof && isAbsolute28(proof.packageTarPath) && /^[a-f0-9]{64}$/.test(proof.packageTarSha256) && Number.isInteger(proof.packageTarBytes) && proof.packageTarBytes > 0 && /^[a-f0-9]{64}$/.test(proof.manifestSha256) && /^[a-f0-9]{64}$/.test(proof.executableSha256), "RECONCILE_RELEASE_PROVENANCE_REQUIRED");
+      need5(!!proof && isAbsolute28(proof.packageTarPath) && /^[a-f0-9]{64}$/.test(proof.packageTarSha256) && Number.isInteger(proof.packageTarBytes) && proof.packageTarBytes > 0 && /^[a-f0-9]{64}$/.test(proof.manifestSha256) && /^[a-f0-9]{64}$/.test(proof.executableSha256), "RECONCILE_RELEASE_PROVENANCE_REQUIRED");
     }
     const currentConfig = snapshot(intent.configPath, true);
     const policy = parseManagedSkillPolicy(policyCurrent.text), binding = policy.bridge;
     const alias = binding.rootAliases?.find((item) => item.agent === "codex"), physicalRoot = alias?.target ?? join61(home, ".codex"), hooksPath = join61(physicalRoot, "hooks.json");
-    need6(resolve26(intent.configPath) === resolve26(join61(physicalRoot, "config.toml")), "RECONCILE_CONFIG_PATH_CHANGED");
+    need5(resolve26(intent.configPath) === resolve26(join61(physicalRoot, "config.toml")), "RECONCILE_CONFIG_PATH_CHANGED");
     const nativeConfigPath = intent.nativeConfigPath ?? intent.configPath;
-    need6([join61(home, ".codex/config.toml"), join61(physicalRoot, "config.toml")].includes(nativeConfigPath), "RECONCILE_NATIVE_CONFIG_PATH_CHANGED");
+    need5([join61(home, ".codex/config.toml"), join61(physicalRoot, "config.toml")].includes(nativeConfigPath), "RECONCILE_NATIVE_CONFIG_PATH_CHANGED");
     const codexHome = nativeConfigPath !== intent.configPath ? undefined : dirname34(nativeConfigPath);
     const hooksCurrent = snapshot(hooksPath);
     const additions = additionsRecovery ? reviewNativeHookAdditions({ path: additionsRecovery.path, intent: intentFile, policy: policyCurrent, configBefore, configCurrent: currentConfig, hooksBefore, hooksCurrent, nativeHooksPath: join61(dirname34(nativeConfigPath), "hooks.json"), journalHooks: intent.hooks, recordedNativeHooks: intent.nativeHooks }) : undefined;
@@ -112903,7 +113142,7 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     const managedKeys = managedHooks.map((h) => h.key);
     const witnessSame = codexTrustReconcileWitness(configBefore.text, managedKeys) === codexTrustReconcileWitness(currentConfig.text, managedKeys);
     const unmanagedSame = codexTrustUnmanagedSemantic(configBefore.text, managedKeys) === codexTrustUnmanagedSemantic(currentConfig.text, managedKeys);
-    need6(unmanagedSame && (witnessSame || supersededBinding), "RECONCILE_UNRELATED_CONFIG_CHANGED");
+    need5(unmanagedSame && (witnessSame || supersededBinding), "RECONCILE_UNRELATED_CONFIG_CHANGED");
     const before2 = structure3(configBefore.text), current = structure3(currentConfig.text), expectedConfig = structuredClone(before2);
     expectedConfig.hooks ??= {};
     expectedConfig.hooks.state ??= {};
@@ -112915,10 +113154,10 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     if (supersededBinding) {
       for (const hook of intent.hooks) {
         const state = current.hooks?.state?.[hook.key];
-        need6(state?.enabled === true && typeof state.trusted_hash === "string" && /^sha256:[a-f0-9]{64}$/.test(state.trusted_hash), "RECONCILE_CONFIG_DRIFT");
+        need5(state?.enabled === true && typeof state.trusted_hash === "string" && /^sha256:[a-f0-9]{64}$/.test(state.trusted_hash), "RECONCILE_CONFIG_DRIFT");
       }
     } else
-      need6(isDeepStrictEqual15(expectedConfig, current), "RECONCILE_CONFIG_DRIFT");
+      need5(isDeepStrictEqual15(expectedConfig, current), "RECONCILE_CONFIG_DRIFT");
     const configDiscoveryRecovery = recovery && binding.discovery?.codex ? createCodexHookDiscoveryRecovery(binding.discovery.codex, configBefore, currentConfig, intent.hooks, additions?.trustProof) : undefined;
     assertManagedAgentBridge("codex", { home, dataDir: dataDir3, projectDir: home, codexDiscoveryRecovery: configDiscoveryRecovery });
     const recoveryCli = recovery ? bindSkillsCli("skills", options.reviewedSkillsCli) : undefined;
@@ -112928,28 +113167,28 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     if (supersededBinding)
       verifyReleaseArtifact(options.releaseProof, skillsCli);
     const skillsBindingChanged = !isDeepStrictEqual15(skillsCli.receipt, intent.skillsCli);
-    need6(!skillsBindingChanged || supersededBinding, "RECONCILE_SKILLS_BINDING_CHANGED");
+    need5(!skillsBindingChanged || supersededBinding, "RECONCILE_SKILLS_BINDING_CHANGED");
     if (!additions && hooksCurrent.sha256 !== intent.hooksSha256 && hooksCurrent.sha256 !== hooksBefore.sha256) {
-      need6(supersededBinding, "RECONCILE_HOOKS_CHANGED");
+      need5(supersededBinding, "RECONCILE_HOOKS_CHANGED");
       const currentDeclarations = JSON.parse(hooksCurrent.text).hooks;
       for (const [event, [nativeEvent]] of Object.entries(eventNames)) {
         const command = renderAgentHookCommand(binding.commands.codex, "codex", binding.profiles.codex, event);
-        need6(isDeepStrictEqual15(currentDeclarations?.[event], [{ hooks: [{ type: "command", command, timeout: 15 }] }]), "RECONCILE_BINDING_HOOK_CHANGED");
+        need5(isDeepStrictEqual15(currentDeclarations?.[event], [{ hooks: [{ type: "command", command, timeout: 15 }] }]), "RECONCILE_BINDING_HOOK_CHANGED");
       }
     }
     rpc = await connect({ command: options.codexCommand ?? "codex", home, codexHome });
-    need6(rpc.version === intent.nativeVersion, "RECONCILE_NATIVE_VERSION_CHANGED");
+    need5(rpc.version === intent.nativeVersion, "RECONCILE_NATIVE_VERSION_CHANGED");
     const discovered = await rpc.request("hooks/list", { cwds: [home] });
-    need6(Array.isArray(discovered?.data) && discovered.data.length === 1 && discovered.data[0].cwd === home && !discovered.data[0].errors?.length && !discovered.data[0].warnings?.length, "RECONCILE_NATIVE_DISCOVERY_REFUSED");
+    need5(Array.isArray(discovered?.data) && discovered.data.length === 1 && discovered.data[0].cwd === home && !discovered.data[0].errors?.length && !discovered.data[0].warnings?.length, "RECONCILE_NATIVE_DISCOVERY_REFUSED");
     const nativeHooks = discovered.data[0].hooks;
     const recordedNativeHooks = intent.nativeHooks;
     if (recordedNativeHooks)
-      need6(nativeHooks.length === recordedNativeHooks.length + (additions?.hooks.length ?? 0), "RECONCILE_NATIVE_HOOK_LIST_CHANGED");
+      need5(nativeHooks.length === recordedNativeHooks.length + (additions?.hooks.length ?? 0), "RECONCILE_NATIVE_HOOK_LIST_CHANGED");
     const plannedKeys = new Set(intent.hooks.map((hook) => hook.key));
     let nativeTrustPending = false;
     for (const expected of [...recordedNativeHooks ?? [], ...additions?.hooks ?? []]) {
       const matches2 = nativeHooks.filter((hook) => hook.key === expected.key);
-      need6(matches2.length === 1, "RECONCILE_NATIVE_HOOK_LIST_CHANGED");
+      need5(matches2.length === 1, "RECONCILE_NATIVE_HOOK_LIST_CHANGED");
       const actual = safeNativeHook(matches2[0]);
       const stable = (hook) => {
         const { enabled, trustStatus, ...identity5 } = hook;
@@ -112957,35 +113196,35 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
           delete identity5.command;
         return identity5;
       };
-      need6(isDeepStrictEqual15(stable(actual), stable(expected)), "RECONCILE_NATIVE_IDENTITY_CHANGED");
+      need5(isDeepStrictEqual15(stable(actual), stable(expected)), "RECONCILE_NATIVE_IDENTITY_CHANGED");
       if (!plannedKeys.has(expected.key))
-        need6(isDeepStrictEqual15(actual, expected), "RECONCILE_UNRELATED_HOOK_CHANGED");
+        need5(isDeepStrictEqual15(actual, expected), "RECONCILE_UNRELATED_HOOK_CHANGED");
     }
     for (const wanted of intent.hooks) {
       const matches2 = nativeHooks.filter((h2) => h2.key === wanted.key || h2.key === wanted.key.replace(join61(home, ".codex/hooks.json"), hooksPath));
-      need6(matches2.length === 1, "RECONCILE_NATIVE_IDENTITY_CHANGED");
+      need5(matches2.length === 1, "RECONCILE_NATIVE_IDENTITY_CHANGED");
       const h = matches2[0];
       const trusted = h.trustStatus === "trusted";
-      need6(h.enabled === true && (trusted || supersededBinding && h.trustStatus === "modified") && (h.currentHash === wanted.currentHash || supersededBinding && /^sha256:[a-f0-9]{64}$/.test(h.currentHash)), "RECONCILE_NATIVE_STATE_INCOMPLETE");
+      need5(h.enabled === true && (trusted || supersededBinding && h.trustStatus === "modified") && (h.currentHash === wanted.currentHash || supersededBinding && /^sha256:[a-f0-9]{64}$/.test(h.currentHash)), "RECONCILE_NATIVE_STATE_INCOMPLETE");
       if (!trusted)
         nativeTrustPending = true;
       if (supersededBinding) {
         const nativeToCliEvent = { userPromptSubmit: "UserPromptSubmit", sessionStart: "SessionStart", subagentStart: "SubagentStart" };
-        need6(h.command === renderAgentHookCommand(binding.commands.codex, "codex", binding.profiles.codex, nativeToCliEvent[wanted.event] ?? ""), "RECONCILE_BINDING_HOOK_CHANGED");
+        need5(h.command === renderAgentHookCommand(binding.commands.codex, "codex", binding.profiles.codex, nativeToCliEvent[wanted.event] ?? ""), "RECONCILE_BINDING_HOOK_CHANGED");
       }
     }
     const config2 = await rpc.request("config/read", { includeLayers: true, cwd: home });
     const layers = config2?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
-    need6(layers?.length === 1 && !layers[0].disabledReason && codexNativeConfigEqual(layers[0].config, current), "RECONCILE_NATIVE_CONFIG_MISMATCH");
+    need5(layers?.length === 1 && !layers[0].disabledReason && codexNativeConfigEqual(layers[0].config, current), "RECONCILE_NATIVE_CONFIG_MISMATCH");
     const finalDiscovery = await rpc.request("hooks/list", { cwds: [home] });
-    need6(Array.isArray(finalDiscovery?.data) && finalDiscovery.data.length === 1 && finalDiscovery.data[0].cwd === home && !finalDiscovery.data[0].errors?.length && !finalDiscovery.data[0].warnings?.length && (!recordedNativeHooks || isDeepStrictEqual15(finalDiscovery.data[0].hooks.map(safeNativeHook), nativeHooks.map(safeNativeHook))), "RECONCILE_NATIVE_STATE_CHANGED");
+    need5(Array.isArray(finalDiscovery?.data) && finalDiscovery.data.length === 1 && finalDiscovery.data[0].cwd === home && !finalDiscovery.data[0].errors?.length && !finalDiscovery.data[0].warnings?.length && (!recordedNativeHooks || isDeepStrictEqual15(finalDiscovery.data[0].hooks.map(safeNativeHook), nativeHooks.map(safeNativeHook))), "RECONCILE_NATIVE_STATE_CHANGED");
     const finalConfig = await rpc.request("config/read", { includeLayers: true, cwd: home });
     const finalLayers = finalConfig?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
-    need6(finalLayers?.length === 1 && !finalLayers[0].disabledReason && codexNativeConfigEqual(finalLayers[0].config, current), "RECONCILE_NATIVE_CONFIG_CHANGED");
+    need5(finalLayers?.length === 1 && !finalLayers[0].disabledReason && codexNativeConfigEqual(finalLayers[0].config, current), "RECONCILE_NATIVE_CONFIG_CHANGED");
     if (recovery) {
       for (const response of [config2, finalConfig]) {
         const layerIndex = response.layers.findIndex((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
-        need6(response.config && response.config.features?.hooks !== false && response.layers.slice(0, layerIndex).every((layer) => layer.config?.hooks === undefined && layer.config?.features?.hooks === undefined), "RECONCILE_NATIVE_CONFIG_OVERRIDDEN");
+        need5(response.config && response.config.features?.hooks !== false && response.layers.slice(0, layerIndex).every((layer) => layer.config?.hooks === undefined && layer.config?.features?.hooks === undefined), "RECONCILE_NATIVE_CONFIG_OVERRIDDEN");
       }
       recoveryCli.recheck();
       verifyReleaseArtifact(options.releaseProof, recoveryCli);
@@ -113006,7 +113245,7 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     const recoveryPlan = recovery ? { version: 1, kind: additions ? claudeRecovery ? "claude-discovery-and-native-hook-additions" : "native-hook-additions" : "claude-discovery-only", journal, journalIntentSha256: intentFile.sha256, stoppedSha256: stoppedFile.sha256, originalPlanDigest: intent.planDigest, policyBeforeSha256: policyBefore.sha256, policyCurrentSha256: policyCurrent.sha256, configBeforeSha256: configBefore.sha256, configCurrentSha256: currentConfig.sha256, ...configDiscoveryRecovery ? { configDiscoveryRecovery } : {}, ...additions ? { nativeHookAdditions: additions.receipt } : {}, hooksSha256: hooksCurrent.sha256, nativeConfigPath, nativeVersion: rpc.version, nativeInventorySha256: makePlanDigest(nativeHooks.map(safeNativeHook)), recordedNativeInventorySha256: makePlanDigest(recordedNativeHooks), boundSkillsCli: skillsCli.receipt, recoveryCli: recoveryCli.receipt, releaseProof: options.releaseProof, ...policyChange } : undefined;
     const recoveryPlanDigest = recoveryPlan ? makePlanDigest(recoveryPlan) : undefined;
     if (recovery?.reviewedPlanDigest !== undefined)
-      need6(recovery.reviewedPlanDigest === recoveryPlanDigest, "RECONCILE_RECOVERY_PLAN_CHANGED");
+      need5(recovery.reviewedPlanDigest === recoveryPlanDigest, "RECONCILE_RECOVERY_PLAN_CHANGED");
     const preview2 = !!recovery && recovery.reviewedPlanDigest === undefined;
     const receipt = { version: 1, status: preview2 ? "recovery-review-required" : supersededBinding ? "superseded" : "reconciled", reconciled: !preview2, supersededBinding, automaticRollback: false, journal, planDigest: intent.planDigest, nativeVersion: rpc.version, nativeStateVerified: !nativeTrustPending, nativeTrustPending, bindingRefreshRequired: !!configDiscoveryRecovery, nativeExecutionVerified: false, configSha256: currentConfig.sha256, hooksSha256: hooksCurrent.sha256, policySha256: policyBefore.sha256, policyBeforeSha256: policyBefore.sha256, policyCurrentSha256: policyCurrent.sha256, previousSkillsCli: intent.skillsCli, skillsCli: skillsCli.receipt, releaseProof: options.releaseProof, nativeInventoryScope: recordedNativeHooks ? "complete" : "declared-managed-hooks-only", unrelatedNativeHooksPreserved: !!recordedNativeHooks, unrelatedSettingsAndCommentsPreserved: true, ...recoveryPlan ? { recoveryPlan, recoveryPlanDigest } : {} };
     if (preview2)
@@ -113029,7 +113268,7 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
     const binding = policy.bridge, alias = binding.rootAliases?.find((item) => item.agent === "codex");
     const skillsCli = bindSkillsCli(binding.commands.codex, options.reviewedSkillsCli);
     const physicalRoot = alias?.target ?? join61(home, ".codex"), hooksPath = join61(physicalRoot, "hooks.json"), configPath = join61(physicalRoot, "config.toml");
-    need6(options.codexHome === undefined || isAbsolute28(options.codexHome) && [join61(home, ".codex"), physicalRoot].includes(options.codexHome), "NATIVE_HOME_NOT_ADMITTED");
+    need5(options.codexHome === undefined || isAbsolute28(options.codexHome) && [join61(home, ".codex"), physicalRoot].includes(options.codexHome), "NATIVE_HOME_NOT_ADMITTED");
     const codexHome = options.codexHome === undefined ? undefined : physicalRoot;
     const nativeConfigPath = join61(codexHome ?? join61(home, ".codex"), "config.toml");
     const hooksFile = snapshot(hooksPath), configFile = snapshot(configPath, true), original = structure3(configFile.text);
@@ -113037,38 +113276,38 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
     for (const [event, [nativeEvent, label]] of Object.entries(eventNames)) {
       const command = renderAgentHookCommand(binding.commands.codex, "codex", binding.profiles.codex, event);
       const groups = declarations[event];
-      need6(Array.isArray(groups), "DECLARATION_CHANGED");
+      need5(Array.isArray(groups), "DECLARATION_CHANGED");
       const matches2 = groups.flatMap((group, gi) => (group.hooks ?? []).flatMap((entry, hi) => entry.command === command ? [{ group, entry, gi, hi }] : []));
-      need6(matches2.length === 1 && isDeepStrictEqual15(matches2[0].group, { hooks: [{ type: "command", command, timeout: 15 }] }), "DECLARATION_CHANGED");
+      need5(matches2.length === 1 && isDeepStrictEqual15(matches2[0].group, { hooks: [{ type: "command", command, timeout: 15 }] }), "DECLARATION_CHANGED");
       expected.push({ event: nativeEvent, key: `${join61(home, ".codex/hooks.json")}:${label}:${matches2[0].gi}:${matches2[0].hi}`, command });
     }
     codexTrustTextWitness(configFile.text, expected.map((h) => h.key));
     rpc = await connect({ command: options.codexCommand ?? "codex", home, codexHome });
-    need6(SUPPORTED_CODEX_HOOK_VERSIONS.includes(rpc.version), "NATIVE_UNSUPPORTED_VERSION");
+    need5(SUPPORTED_CODEX_HOOK_VERSIONS.includes(rpc.version), "NATIVE_UNSUPPORTED_VERSION");
     const list2 = async () => {
       const response = await rpc.request("hooks/list", { cwds: [home] });
       const nativeRoots = [...new Set([physicalRoot, join61(home, ".codex")])];
       const coexistenceWarnings = nativeRoots.flatMap((hooksRoot) => nativeRoots.map((configRoot) => `loading hooks from both ${join61(hooksRoot, "hooks.json")} and ${join61(configRoot, "config.toml")}; prefer a single representation for this layer`));
       const entry = response?.data?.[0];
-      need6(Array.isArray(response?.data) && response.data.length === 1 && entry.cwd === home && Array.isArray(entry.hooks) && entry.hooks.length <= 1e4 && Array.isArray(entry.errors) && entry.errors.length === 0 && Array.isArray(entry.warnings) && entry.warnings.length <= 1 && entry.warnings.every((warning) => typeof warning === "string" && coexistenceWarnings.includes(warning)), "NATIVE_DISCOVERY_REFUSED");
+      need5(Array.isArray(response?.data) && response.data.length === 1 && entry.cwd === home && Array.isArray(entry.hooks) && entry.hooks.length <= 1e4 && Array.isArray(entry.errors) && entry.errors.length === 0 && Array.isArray(entry.warnings) && entry.warnings.length <= 1 && entry.warnings.every((warning) => typeof warning === "string" && coexistenceWarnings.includes(warning)), "NATIVE_DISCOVERY_REFUSED");
       return response.data[0].hooks;
     };
     const admit = (hooks) => expected.map((wanted) => {
       const canonicalKey = wanted.key.replace(join61(home, ".codex/hooks.json"), hooksPath);
       const matches2 = hooks.filter((h2) => h2.key === wanted.key || h2.key === canonicalKey);
-      need6(matches2.length === 1, "AMBIGUOUS_IDENTITY");
+      need5(matches2.length === 1, "AMBIGUOUS_IDENTITY");
       const h = matches2[0];
-      need6(h.eventName === wanted.event && h.handlerType === "command" && h.command === wanted.command && h.matcher === null && h.timeoutSec === 15 && h.async === false && h.statusMessage === null && h.additionalContextLimit === null && [hooksPath, join61(home, ".codex/hooks.json")].includes(h.sourcePath) && h.source === "user" && h.pluginId === null && h.isManaged === false && /^sha256:[a-f0-9]{64}$/.test(h.currentHash) && typeof h.enabled === "boolean", "NATIVE_IDENTITY_CHANGED");
-      need6(hooks.filter((other) => other.command === wanted.command).length === 1, "AMBIGUOUS_IDENTITY");
-      need6(["trusted", "untrusted", "modified"].includes(h.trustStatus), "UNKNOWN_TRUST_STATUS");
+      need5(h.eventName === wanted.event && h.handlerType === "command" && h.command === wanted.command && h.matcher === null && h.timeoutSec === 15 && h.async === false && h.statusMessage === null && h.additionalContextLimit === null && [hooksPath, join61(home, ".codex/hooks.json")].includes(h.sourcePath) && h.source === "user" && h.pluginId === null && h.isManaged === false && /^sha256:[a-f0-9]{64}$/.test(h.currentHash) && typeof h.enabled === "boolean", "NATIVE_IDENTITY_CHANGED");
+      need5(hooks.filter((other) => other.command === wanted.command).length === 1, "AMBIGUOUS_IDENTITY");
+      need5(["trusted", "untrusted", "modified"].includes(h.trustStatus), "UNKNOWN_TRUST_STATUS");
       return { key: h.key, event: wanted.event, command: wanted.command, handlerType: h.handlerType, timeoutSec: h.timeoutSec, sourcePath: h.sourcePath, currentHash: h.currentHash, enabled: h.enabled, trustStatus: h.trustStatus };
     });
     const discovered = await list2(), admitted = admit(discovered);
     const config2 = await rpc.request("config/read", { includeLayers: true, cwd: home });
     const layers = config2?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
-    need6(layers?.length === 1 && /^sha256:[a-f0-9]{64}$/.test(layers[0].version) && !layers[0].disabledReason && codexNativeConfigEqual(layers[0].config, original), "NATIVE_CONFIG_MISMATCH");
-    need6(config2.config && config2.config.features?.hooks !== false, "NATIVE_HOOKS_DISABLED");
-    need6(config2.layers.slice(0, config2.layers.indexOf(layers[0])).every((layer) => layer.config?.hooks === undefined && layer.config?.features?.hooks === undefined), "NATIVE_CONFIG_OVERRIDDEN");
+    need5(layers?.length === 1 && /^sha256:[a-f0-9]{64}$/.test(layers[0].version) && !layers[0].disabledReason && codexNativeConfigEqual(layers[0].config, original), "NATIVE_CONFIG_MISMATCH");
+    need5(config2.config && config2.config.features?.hooks !== false, "NATIVE_HOOKS_DISABLED");
+    need5(config2.layers.slice(0, config2.layers.indexOf(layers[0])).every((layer) => layer.config?.hooks === undefined && layer.config?.features?.hooks === undefined), "NATIVE_CONFIG_OVERRIDDEN");
     const keys3 = admitted.map((h) => h.key), planned = admitted.filter((h) => !h.enabled || h.trustStatus !== "trusted");
     const preservationText = codexTrustTextWitness(configFile.text, keys3);
     const checkInputs = () => {
@@ -113083,16 +113322,16 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
     const planDigest = makePlanDigest(digestInput);
     const baseReceipt = { planDigest, skillsCli: skillsCli.receipt, nativeVersion: rpc.version, nativeConfigPath, ownedNativeProcessId: rpc.processId, agent: "codex", applied: false, planned, nativeEligible: planned.length === 0, bindingRefreshRequired: false, transport: "owned-stdio-process", existingSessionsReloaded: false, nativeExecutionVerified: false };
     if (options.apply)
-      need6(options.reviewedPlanDigest === planDigest, "PLAN_CHANGED: run the dry-run again and pass its reviewed --plan-digest with --apply");
+      need5(options.reviewedPlanDigest === planDigest, "PLAN_CHANGED: run the dry-run again and pass its reviewed --plan-digest with --apply");
     const parent = join61(dataDir3, "native-hook-trust");
     const st = lstatSync32(parent, { throwIfNoEntry: false });
     if (st) {
-      need6(st.isDirectory() && !st.isSymbolicLink() && st.uid === process.getuid() && (st.mode & 511) === 448, "UNSAFE_JOURNAL");
+      need5(st.isDirectory() && !st.isSymbolicLink() && st.uid === process.getuid() && (st.mode & 511) === 448, "UNSAFE_JOURNAL");
       const priorJournals = readdirSync23(parent);
-      need6(priorJournals.length < 1000, "JOURNAL_BOUND");
+      need5(priorJournals.length < 1000, "JOURNAL_BOUND");
       for (const name of priorJournals) {
-        need6(/^[a-f0-9-]{36}$/.test(name), "UNSAFE_JOURNAL");
-        need6(lstatSync32(join61(parent, name, "receipt.json"), { throwIfNoEntry: false })?.isFile(), "RECONCILE_REQUIRED: inspect the incomplete private journal before applying again");
+        need5(/^[a-f0-9-]{36}$/.test(name), "UNSAFE_JOURNAL");
+        need5(lstatSync32(join61(parent, name, "receipt.json"), { throwIfNoEntry: false })?.isFile(), "RECONCILE_REQUIRED: inspect the incomplete private journal before applying again");
       }
     }
     if (!options.apply || !planned.length)
@@ -113105,7 +113344,7 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
     save(join61(journal, "hooks.before.json"), hooksFile.bytes);
     save(join61(journal, "policy.before.json"), policyFile.bytes);
     save(join61(journal, "intent.json"), json2({ ...digestInput, planDigest, hooks: planned, nativeHooks: discovered.map(safeNativeHook) }));
-    need6(isDeepStrictEqual15(admit(await list2()), admitted), "NATIVE_DISCOVERY_CHANGED");
+    need5(isDeepStrictEqual15(admit(await list2()), admitted), "NATIVE_DISCOVERY_CHANGED");
     checkInputs();
     let result2;
     try {
@@ -113113,22 +113352,22 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
     } catch {
       throw new Error("CODEX_HOOK_TRUST_NATIVE_WRITE_FAILED: reconcile the private journal before retrying");
     }
-    need6(result2?.status === "ok" && result2.filePath === configPath && /^sha256:[a-f0-9]{64}$/.test(result2.version), "NATIVE_WRITE_OVERRIDDEN");
+    need5(result2?.status === "ok" && result2.filePath === configPath && /^sha256:[a-f0-9]{64}$/.test(result2.version), "NATIVE_WRITE_OVERRIDDEN");
     const after2 = snapshot(configPath, true), expectedConfig = structuredClone(original);
     expectedConfig.hooks ??= {};
     expectedConfig.hooks.state ??= {};
     for (const h of planned)
       expectedConfig.hooks.state[h.key] = { ...expectedConfig.hooks.state[h.key], enabled: true, trusted_hash: h.currentHash };
-    need6(isDeepStrictEqual15(structure3(after2.text), expectedConfig) && codexTrustTextWitness(after2.text, keys3) === preservationText, "PRESERVATION_FAILED");
+    need5(isDeepStrictEqual15(structure3(after2.text), expectedConfig) && codexTrustTextWitness(after2.text, keys3) === preservationText, "PRESERVATION_FAILED");
     const savedConfig = snapshot(join61(journal, "config.before.toml"), true);
-    need6(savedConfig.sha256 === configFile.sha256, "JOURNAL_CHANGED");
+    need5(savedConfig.sha256 === configFile.sha256, "JOURNAL_CHANGED");
     const discoveryTransition = binding.discovery?.codex ? createCodexHookDiscoveryRecovery(binding.discovery.codex, savedConfig, after2, planned) : undefined;
     unchanged2(policyFile);
     unchanged2(hooksFile);
     assertManagedAgentBridge("codex", { home, dataDir: dataDir3, projectDir: home, codexDiscoveryRecovery: discoveryTransition });
     const current = await list2(), confirmed = admit(current);
-    need6(confirmed.every((h) => h.enabled && h.trustStatus === "trusted") && isDeepStrictEqual15(confirmed.map((h) => [h.key, h.currentHash]), admitted.map((h) => [h.key, h.currentHash])), "NATIVE_NOT_ELIGIBLE");
-    need6(isDeepStrictEqual15(current.filter((h) => !keys3.includes(h.key)), discovered.filter((h) => !keys3.includes(h.key))), "UNRELATED_HOOK_CHANGED");
+    need5(confirmed.every((h) => h.enabled && h.trustStatus === "trusted") && isDeepStrictEqual15(confirmed.map((h) => [h.key, h.currentHash]), admitted.map((h) => [h.key, h.currentHash])), "NATIVE_NOT_ELIGIBLE");
+    need5(isDeepStrictEqual15(current.filter((h) => !keys3.includes(h.key)), discovered.filter((h) => !keys3.includes(h.key))), "UNRELATED_HOOK_CHANGED");
     unchanged2(after2);
     unchanged2(savedConfig);
     unchanged2(hooksFile);
@@ -113291,7 +113530,7 @@ var exports_agent_integration = {};
 __export(exports_agent_integration, {
   registerAgentIntegration: () => registerAgentIntegration
 });
-import { existsSync as existsSync36, lstatSync as lstatSync33, readFileSync as readFileSync41, writeFileSync as writeFileSync26 } from "fs";
+import { existsSync as existsSync36, lstatSync as lstatSync33, readFileSync as readFileSync41, readSync as readSync17, writeFileSync as writeFileSync26 } from "fs";
 import { createHash as createHash32 } from "crypto";
 import { homedir as homedir13 } from "os";
 import { isAbsolute as isAbsolute29 } from "path";
@@ -113361,6 +113600,32 @@ function agents(value) {
 }
 function registerAgentIntegration(parent) {
   const hook = parent.command("hook").description("Load selected Skills context through agent lifecycle hooks");
+  hook.command("project-claude-settings").requiredOption("--expected-target-sha256 <sha256>", "SHA-256 of the exact target settings bytes supplied on stdin").option("--expected-source-sha256 <sha256>", "Source witness from the preceding projection, for revalidation").option("--json", "Return only command-leaf replacements and content witnesses", false).description("Read-only projection of verified Skills hooks into copied Claude settings supplied on stdin").action(async (options) => {
+    try {
+      const bytes = Buffer.alloc(1024 * 1024 + 1);
+      let length = 0;
+      while (length < bytes.length) {
+        const count = readSync17(0, bytes, length, bytes.length - length, null);
+        if (!count)
+          break;
+        length += count;
+      }
+      if (length > 1024 * 1024)
+        throw new Error("CLAUDE_MANAGED_HOOK_TARGET_INVALID");
+      const targetSettings = new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, length));
+      const plan = planClaudeManagedHookProjection({
+        targetSettings,
+        expectedTargetSha256: options.expectedTargetSha256,
+        expectedSourceSha256: options.expectedSourceSha256,
+        projectDir: process.cwd()
+      });
+      await writeCliOutput(JSON.stringify(plan));
+    } catch (error61) {
+      const code2 = error61 instanceof Error && /^CLAUDE_MANAGED_HOOK_[A-Z_]+$/.test(error61.message) ? error61.message : "CLAUDE_MANAGED_HOOK_PROJECTION_FAILED";
+      console.error(code2);
+      process.exitCode = 1;
+    }
+  });
   hook.command("native-catalog").requiredOption("--cwd <path>", "Absolute project directory observed by native Codex skills/list").requiredOption("--output <file>", "New private file for the projected native catalog").option("--codex-command <path>", "Installed Codex executable used by the native client", "codex").option("--json", "Output bounded capture metadata as JSON", false).description("Capture a reviewed Codex native skill catalog for exact hook enrollment").action(async (options) => {
     try {
       if (!isAbsolute29(options.cwd) || !isAbsolute29(options.output))
@@ -113772,7 +114037,7 @@ var exports_profiles = {};
 __export(exports_profiles, {
   registerProfiles: () => registerProfiles
 });
-import { closeSync as closeSync21, constants as constants20, fstatSync as fstatSync21, openSync as openSync21, readSync as readSync17, writeFileSync as writeFileSync27 } from "fs";
+import { closeSync as closeSync21, constants as constants20, fstatSync as fstatSync21, openSync as openSync21, readSync as readSync18, writeFileSync as writeFileSync27 } from "fs";
 function readProfileInput(path) {
   const fd = openSync21(path, constants20.O_RDONLY | constants20.O_NONBLOCK);
   try {
@@ -113782,7 +114047,7 @@ function readProfileInput(path) {
     const bytes = Buffer.alloc(MAX_PROFILE_DOCUMENT_BYTES + 1);
     let size2 = 0;
     while (size2 < bytes.length) {
-      const read3 = readSync17(fd, bytes, size2, bytes.length - size2, null);
+      const read3 = readSync18(fd, bytes, size2, bytes.length - size2, null);
       if (!read3)
         break;
       size2 += read3;
@@ -113846,7 +114111,7 @@ import {
   closeSync as closeSync23,
   fstatSync as fstatSync23,
   openSync as openSync23,
-  readSync as readSync18,
+  readSync as readSync19,
   writeFileSync as writeFileSync28
 } from "fs";
 function readInput(path) {
@@ -113858,7 +114123,7 @@ function readInput(path) {
     const bytes = Buffer.alloc(MAX_EXECUTION_GRANT_BYTES + 1);
     let size2 = 0;
     while (size2 < bytes.length) {
-      const count = readSync18(fd, bytes, size2, bytes.length - size2, null);
+      const count = readSync19(fd, bytes, size2, bytes.length - size2, null);
       if (!count)
         break;
       size2 += count;