@hasna/skills 0.10.34 → 0.10.36

package/dist/index.js

@@ -9655,8 +9655,8 @@ function hashDiscoveryPathFile(path, budget, changes) {
 }
 
 // src/lib/plugin-discovery.ts
-import { closeSync as closeSync10, constants as constants9, fstatSync as fstatSync10, lstatSync as lstatSync19, openSync as openSync10, opendirSync as opendirSync5, readSync as readSync8 } from "fs";
-import { basename as basename7, dirname as dirname14, isAbsolute as isAbsolute14, join as join27, resolve as resolve14 } from "path";
+import { closeSync as closeSync11, constants as constants10, fstatSync as fstatSync11, lstatSync as lstatSync20, openSync as openSync11, opendirSync as opendirSync5, readSync as readSync9 } from "fs";
+import { basename as basename7, dirname as dirname15, isAbsolute as isAbsolute14, join as join27, resolve as resolve14 } from "path";
 
 // src/lib/plugin-admission.ts
 import { homedir as homedir5 } from "os";
@@ -10975,7 +10975,7 @@ function replaceSkillSession(expected, replacement, plan, options = {}, beforeCo
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.34",
+  version: "0.10.36",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -12797,7 +12797,7 @@ import { homedir as homedir4 } from "os";
 import {
   cpSync as cpSync2,
   existsSync as existsSync10,
-  lstatSync as lstatSync17,
+  lstatSync as lstatSync18,
   mkdirSync as mkdirSync6,
   mkdtempSync,
   readFileSync as readFileSync13,
@@ -12805,10 +12805,10 @@ import {
   renameSync as renameSync3,
   rmSync,
   statSync as statSync9,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename as basename6, dirname as dirname12, join as join19 } from "path";
+import { basename as basename6, dirname as dirname13, join as join19 } from "path";
 
 // src/lib/codex-local-mcp-controls.ts
 function isCodexLocalStdioMcpServer(name, server) {
@@ -13717,7 +13717,7 @@ function reviewedCodexPluginCapabilitiesUnchanged(cache, controls, read2) {
     return false;
   }
 }
-function reviewCodexPluginControls(catalog, documents, cache, cwd, read2, rules, pluginSettings) {
+function reviewCodexPluginControls(catalog, documents, cache, cwd, read2, rules, pluginSettings, plannedRules) {
   if (!supportsCodexNativeCapability(catalog?.version, "qualified-skill-catalog") || catalog.cwd !== cwd)
     refuse2();
   const skills = projectCodexNativeSkillCatalog({ data: [{ cwd, errors: [], skills: catalog.skills }] }, cwd);
@@ -13788,7 +13788,9 @@ function reviewCodexPluginControls(catalog, documents, cache, cwd, read2, rules,
         remotePluginId = plugin.remotePluginId;
       }
       const exactPathDeny = Array.isArray(rules) && rules.some((rule) => rule?.path === document2 && rule?.enabled === false);
-      if (!exactPathDeny || !isCodexNativeSkillDisabled({ name: parsed.name, path: document2, pluginId: expectedPluginId, enabled: true }, rules))
+      const nativeSkill = { name: parsed.name, path: document2, pluginId: expectedPluginId, enabled: true };
+      const plannedPathDeny = catalog.version === "codex-cli 0.160.0" && remotePluginId !== undefined && Array.isArray(rules) && rules.some((rule) => typeof rule?.name === "string" && rule.name.trim() === parsed.name && rule.enabled === false) && !rules.some((rule) => (rule?.path === document2 || typeof rule?.name === "string" && rule.name.trim() === parsed.name) && rule.enabled !== false) && Array.isArray(plannedRules) && plannedRules.some((rule) => rule?.path === document2 && rule.enabled === false) && isCodexNativeSkillDisabled(nativeSkill, plannedRules);
+      if (!exactPathDeny && !plannedPathDeny || !isCodexNativeSkillDisabled(nativeSkill, rules))
         refuse2();
     }
     result.push({ ...parsed, pluginId: expectedPluginId, ...remotePluginId ? { remotePluginId } : {} });
@@ -14208,10 +14210,10 @@ function upgradeCodexSettingsWitnessV3(previous, reviewedSettingsPath) {
 }
 
 // src/lib/agent-integration.ts
-import { createHash as createHash12, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash13, randomUUID as randomUUID2 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
-import { existsSync as existsSync9, lstatSync as lstatSync16, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync12, readdirSync as readdirSync8, opendirSync as opendirSync3, readlinkSync as readlinkSync4, realpathSync as realpathSync7, renameSync as renameSync2, rmdirSync as rmdirSync2, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3, chmodSync, openSync as openSync8, closeSync as closeSync8, fsyncSync as fsyncSync2, fstatSync as fstatSync8, readSync as readSync6, constants as constants7, linkSync as linkSync2 } from "fs";
-import { dirname as dirname11, join as join18, resolve as resolve11, relative as relative5, isAbsolute as isAbsolute11, sep as sep5 } from "path";
+import { existsSync as existsSync9, lstatSync as lstatSync17, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync12, readdirSync as readdirSync8, opendirSync as opendirSync3, readlinkSync as readlinkSync4, realpathSync as realpathSync7, renameSync as renameSync2, rmdirSync as rmdirSync2, writeFileSync as writeFileSync5, unlinkSync as unlinkSync3, chmodSync, openSync as openSync9, closeSync as closeSync9, fsyncSync as fsyncSync3, fstatSync as fstatSync9, readSync as readSync7, constants as constants8, linkSync as linkSync2 } from "fs";
+import { dirname as dirname12, join as join18, resolve as resolve11, relative as relative5, isAbsolute as isAbsolute11, sep as sep5 } from "path";
 import { homedir as homedir2 } from "os";
 
 // src/lib/managed-policy.ts
@@ -14713,15 +14715,66 @@ var SUMI_SKILL_PERMISSIONS = [
   { action: "skill", resource: "skills-cli", effect: "allow" }
 ];
 
+// src/lib/codex-hook-trust-files.ts
+import { closeSync as closeSync8, constants as constants7, fstatSync as fstatSync8, fsyncSync as fsyncSync2, lstatSync as lstatSync16, openSync as openSync8, readSync as readSync6, writeFileSync as writeFileSync4 } from "fs";
+import { createHash as createHash12 } from "crypto";
+import { dirname as dirname11 } from "path";
+function need5(value, code) {
+  if (!value)
+    throw new Error(`CODEX_HOOK_TRUST_${code}`);
+}
+var sameStat = (a, b) => ["dev", "ino", "uid", "nlink", "mode", "size", "mtimeNs", "ctimeNs"].every((key) => a[key] === b[key]);
+function safeParents(file) {
+  for (let p = dirname11(file);; p = dirname11(p)) {
+    const s = lstatSync16(p);
+    need5(s.isDirectory() && !s.isSymbolicLink(), "UNSAFE_PARENT");
+    need5((s.mode & 18) === 0 || s.uid === 0 && (s.mode & 512) !== 0, "UNSAFE_PARENT");
+    if (dirname11(p) === p)
+      break;
+  }
+}
+function snapshot(file, privateFile = false, options = {}) {
+  const readOnlyPackage = options.readOnlyPackage === true && !privateFile;
+  safeParents(file);
+  const initial = lstatSync16(file, { bigint: true });
+  need5(initial.isFile() && initial.uid === BigInt(process.getuid()) && (initial.nlink === 1n || readOnlyPackage && initial.nlink > 1n) && (initial.mode & 0o022n) === 0n && (!privateFile || (initial.mode & 0o777n) === 0o600n), "UNSAFE_FILE");
+  need5(initial.size <= 8n * 1024n * 1024n, "FILE_BOUND");
+  const fd = openSync8(file, constants7.O_RDONLY | constants7.O_NOFOLLOW | constants7.O_NONBLOCK);
+  try {
+    const before = fstatSync8(fd, { bigint: true });
+    need5(sameStat(initial, before), "INPUT_CHANGED");
+    const bytes = Buffer.alloc(Number(before.size) + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const n2 = readSync6(fd, bytes, length, bytes.length - length, null);
+      if (!n2)
+        break;
+      length += n2;
+    }
+    need5(length === Number(before.size) && sameStat(before, fstatSync8(fd, { bigint: true })) && sameStat(before, lstatSync16(file, { bigint: true })), "INPUT_CHANGED");
+    const content = bytes.subarray(0, length), text2 = new TextDecoder("utf-8", { fatal: true }).decode(content);
+    return { file, privateFile, readOnlyPackage, text: text2, bytes: content, stat: before, sha256: createHash12("sha256").update(content).digest("hex") };
+  } finally {
+    closeSync8(fd);
+  }
+}
+function unchanged2(before) {
+  const after = snapshot(before.file, before.privateFile, before.readOnlyPackage ? { readOnlyPackage: true } : {});
+  need5(sameStat(before.stat, after.stat) && after.sha256 === before.sha256, "INPUT_CHANGED");
+}
+
 // src/lib/agent-integration.ts
-var sha3 = (data) => createHash12("sha256").update(data).digest("hex");
+var sha3 = (data) => createHash13("sha256").update(data).digest("hex");
 var ROOTS = NATIVE_SKILL_ROOTS;
-function hasNoDarwinAcl(fd) {
+function hasTrustedDarwinAcl(fd, allowDenyOnly = false) {
   try {
-    const { dlopen, read: read2 } = __require("bun:ffi");
+    const { dlopen, read: read2, ptr } = __require("bun:ffi");
     const library = dlopen("/usr/lib/libSystem.B.dylib", {
       acl_get_fd: { args: ["i32"], returns: "ptr" },
       acl_free: { args: ["ptr"], returns: "i32" },
+      acl_valid: { args: ["ptr"], returns: "i32" },
+      acl_get_entry: { args: ["ptr", "i32", "ptr"], returns: "i32" },
+      acl_get_tag_type: { args: ["ptr", "ptr"], returns: "i32" },
       __error: { args: [], returns: "ptr" }
     });
     try {
@@ -14730,8 +14783,23 @@ function hasNoDarwinAcl(fd) {
         return false;
       const acl = library.symbols.acl_get_fd(fd);
       if (acl) {
-        library.symbols.acl_free(acl);
-        return false;
+        try {
+          if (!allowDenyOnly || library.symbols.acl_valid(acl) !== 0)
+            return false;
+          const entry = new BigUint64Array(1), tag = new Int32Array(1);
+          for (let count = 0;count <= 128; count++) {
+            const status = library.symbols.acl_get_entry(acl, count === 0 ? 0 : -1, ptr(entry));
+            if (status !== 0) {
+              return status === -1 && read2.i32(errno) === 22 && library.symbols.acl_valid(acl) === 0;
+            }
+            const value = read2.ptr(ptr(entry));
+            if (count === 128 || !value || library.symbols.acl_get_tag_type(value, ptr(tag)) !== 0 || tag[0] !== 2)
+              return false;
+          }
+          return false;
+        } finally {
+          library.symbols.acl_free(acl);
+        }
       }
       return (acl === null || acl === 0) && read2.i32(errno) === 2;
     } finally {
@@ -14747,11 +14815,11 @@ function isSystemRootAlias(path) {
   const target = `/private${path}`, link = `private${path}`;
   const identity4 = (stat) => `${stat.dev}:${stat.ino}:${stat.ctimeNs}:${stat.uid}:${stat.mode}`;
   try {
-    const before = lstatSync16(path, { bigint: true });
+    const before = lstatSync17(path, { bigint: true });
     if (!before.isSymbolicLink() || before.uid !== 0n || readlinkSync4(path) !== link)
       return false;
     const directories = ["/", "/private", target].map((directory) => {
-      const stat = lstatSync16(directory, { bigint: true });
+      const stat = lstatSync17(directory, { bigint: true });
       if (!stat.isDirectory() || stat.uid !== 0n)
         throw new Error("Untrusted system alias directory");
       if (directory !== "/private/tmp") {
@@ -14759,23 +14827,23 @@ function isSystemRootAlias(path) {
           throw new Error("Writable system alias directory");
       } else if ((stat.mode & 0o1000n) === 0n)
         throw new Error("Unprotected system temporary directory");
-      const fd = openSync8(directory, constants7.O_RDONLY | constants7.O_DIRECTORY | constants7.O_NOFOLLOW);
+      const fd = openSync9(directory, constants8.O_RDONLY | constants8.O_DIRECTORY | constants8.O_NOFOLLOW);
       try {
-        if (identity4(fstatSync8(fd, { bigint: true })) !== identity4(stat) || !hasNoDarwinAcl(fd) || identity4(fstatSync8(fd, { bigint: true })) !== identity4(stat))
+        if (identity4(fstatSync9(fd, { bigint: true })) !== identity4(stat) || !hasTrustedDarwinAcl(fd) || identity4(fstatSync9(fd, { bigint: true })) !== identity4(stat))
           throw new Error("Unverified system alias directory ACL");
       } finally {
-        closeSync8(fd);
+        closeSync9(fd);
       }
       return { directory, identity: identity4(stat) };
     });
-    return realpathSync7(path) === target && readlinkSync4(path) === link && identity4(lstatSync16(path, { bigint: true })) === identity4(before) && directories.every((item) => identity4(lstatSync16(item.directory, { bigint: true })) === item.identity);
+    return realpathSync7(path) === target && readlinkSync4(path) === link && identity4(lstatSync17(path, { bigint: true })) === identity4(before) && directories.every((item) => identity4(lstatSync17(item.directory, { bigint: true })) === item.identity);
   } catch {
     return false;
   }
 }
 function canonicalSystemPath(path) {
   const absolute = resolve11(path), root = `/${absolute.split(sep5)[1]}`;
-  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(root) || !lstatSync16(root, { throwIfNoEntry: false })?.isSymbolicLink())
+  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(root) || !lstatSync17(root, { throwIfNoEntry: false })?.isSymbolicLink())
     return absolute;
   if (!isSystemRootAlias(root))
     throw new Error(`Refusing symlink path: ${root}`);
@@ -14784,9 +14852,9 @@ function canonicalSystemPath(path) {
 function assertSafePath(path) {
   let cursor = resolve11(path);
   while (true) {
-    if (lstatSync16(cursor, { throwIfNoEntry: false })?.isSymbolicLink() && !isSystemRootAlias(cursor))
+    if (lstatSync17(cursor, { throwIfNoEntry: false })?.isSymbolicLink() && !isSystemRootAlias(cursor))
       throw new Error(`Refusing symlink path: ${cursor}`);
-    const parent = dirname11(cursor);
+    const parent = dirname12(cursor);
     if (parent === cursor)
       return;
     cursor = parent;
@@ -14795,12 +14863,12 @@ function assertSafePath(path) {
 function readRootAlias(home, agent) {
   assertSafePath(home);
   const realHome = realpathSync7(home), alias = join18(realHome, `.${agent}`);
-  const stat = lstatSync16(alias, { throwIfNoEntry: false, bigint: true });
+  const stat = lstatSync17(alias, { throwIfNoEntry: false, bigint: true });
   if (!stat?.isSymbolicLink())
     throw new Error(`Agent root alias changed after planning: ${alias}`);
-  const link = readlinkSync4(alias), targetPath = resolve11(dirname11(alias), link);
+  const link = readlinkSync4(alias), targetPath = resolve11(dirname12(alias), link);
   assertSafePath(targetPath);
-  const targetStat = lstatSync16(targetPath, { throwIfNoEntry: false });
+  const targetStat = lstatSync17(targetPath, { throwIfNoEntry: false });
   if (!targetStat?.isDirectory())
     throw new Error(`Agent root alias must target an existing directory: ${alias}`);
   const target = realpathSync7(targetPath), inside = relative5(realHome, target);
@@ -14813,7 +14881,7 @@ function rootAliases(home, allowed = false) {
     return [];
   const result = [];
   for (const agent of ["claude", "codex"])
-    if (lstatSync16(join18(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync17(join18(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
       result.push(readRootAlias(home, agent));
   if (result.some((item, index) => result.slice(index + 1).some((other) => item.target === other.target || item.target.startsWith(other.target + sep5) || other.target.startsWith(item.target + sep5))))
     throw new Error("Agent root alias targets must not overlap");
@@ -14848,7 +14916,7 @@ function disabledCodexSkillPaths(config, aliases) {
       continue;
     settings.set(document2, [...settings.get(document2) ?? [], entry.enabled === false]);
   }
-  return [...settings].filter(([, values]) => values.length === 1 && values[0] === true).map(([document2]) => dirname11(document2));
+  return [...settings].filter(([, values]) => values.length === 1 && values[0] === true).map(([document2]) => dirname12(document2));
 }
 function recheckRootAliases(aliases) {
   for (const binding of aliases) {
@@ -14861,35 +14929,35 @@ function recheckRootAliases(aliases) {
 }
 function readNativeBytes(path, maximum = 64 * 1024 * 1024) {
   assertSafePath(path);
-  const before = lstatSync16(path);
+  const before = lstatSync17(path);
   if (!before.isFile() || before.size > maximum)
     throw new Error("Unsupported or oversized native skill file");
-  const descriptor = openSync8(path, constants7.O_RDONLY | constants7.O_NOFOLLOW | constants7.O_NONBLOCK);
+  const descriptor = openSync9(path, constants8.O_RDONLY | constants8.O_NOFOLLOW | constants8.O_NONBLOCK);
   try {
-    const opened = fstatSync8(descriptor);
+    const opened = fstatSync9(descriptor);
     if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino || opened.size !== before.size)
       throw new Error("Native skill file changed while reading");
     const bytes = Buffer.allocUnsafe(before.size + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync6(descriptor, bytes, length, bytes.length - length, null);
+      const count = readSync7(descriptor, bytes, length, bytes.length - length, null);
       if (!count)
         break;
       length += count;
     }
-    const after = fstatSync8(descriptor), current = lstatSync16(path);
+    const after = fstatSync9(descriptor), current = lstatSync17(path);
     if (current.dev !== opened.dev || current.ino !== opened.ino || current.size !== after.size || current.mtimeMs !== after.mtimeMs || current.ctimeMs !== after.ctimeMs || length !== before.size || after.size !== before.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs)
       throw new Error("Native skill file changed while reading");
     return bytes.subarray(0, length);
   } finally {
-    closeSync8(descriptor);
+    closeSync9(descriptor);
   }
 }
 function treeHash(root) {
-  const hash2 = createHash12("sha256");
+  const hash2 = createHash13("sha256");
   let bytes = 0, files = 0;
   function visit2(path) {
-    const stat = lstatSync16(path);
+    const stat = lstatSync17(path);
     if (stat.isSymbolicLink())
       throw new Error(`Refusing symlink in skill: ${path}`);
     const rel = relative5(root, path);
@@ -14921,7 +14989,7 @@ function selectNativeMigrationTargets(inventory, manifest) {
     if (!isAbsolute11(target.projectRoot) || resolve11(target.projectRoot) !== target.projectRoot)
       throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
     const projectRoot = canonicalSystemPath(target.projectRoot), normalized = relative5(projectRoot, resolve11(projectRoot, target.path));
-    if (!existsSync9(projectRoot) || !lstatSync16(projectRoot).isDirectory())
+    if (!existsSync9(projectRoot) || !lstatSync17(projectRoot).isDirectory())
       throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
     assertSafePath(projectRoot);
     if (isAbsolute11(target.path) || target.path.includes("\\") || target.path.includes("\x00") || !normalized || normalized === ".." || normalized.startsWith(`..${sep5}`) || normalized !== target.path || !/^[0-9a-f]{64}$/.test(target.treeSha256))
@@ -14950,7 +15018,7 @@ function projectAncestorDirectories(projects) {
       if (depth >= 100)
         throw new Error("NATIVE_SKILL_DRIFT: project ancestor discovery limit exceeded");
       directories.add(path);
-      const parent = dirname11(path);
+      const parent = dirname12(path);
       if (parent === path)
         break;
       path = parent;
@@ -14996,12 +15064,12 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
   let reviewedCacheAliasFound = false;
   function verifiedSiblingCacheAlias(agent, path, parent) {
     const link = readlinkSync4(path), lexicalTarget = resolve11(parent, link);
-    if (isAbsolute11(link) ? link !== lexicalTarget : dirname11(link) !== ".")
+    if (isAbsolute11(link) ? link !== lexicalTarget : dirname12(link) !== ".")
       return false;
     const target = canonicalSystemPath(lexicalTarget);
-    if (dirname11(target) !== parent)
+    if (dirname12(target) !== parent)
       return false;
-    if (!lstatSync16(target, { throwIfNoEntry: false })?.isDirectory())
+    if (!lstatSync17(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
     const scan = cacheScans.get(target);
     if (!scan?.complete || scan.entries > maxAliasProofEntries)
@@ -15026,7 +15094,7 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
       return scan;
     if (!existsSync9(path))
       return scan;
-    const stat = lstatSync16(path);
+    const stat = lstatSync17(path);
     if (stat.isFile()) {
       if (agent === "sumi" && depth === 1 && path.endsWith(".md"))
         throw new Error("NATIVE_SKILL_DRIFT: flat Sumi skill documents require a dedicated migration adapter");
@@ -15075,7 +15143,7 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
       if (isVendor && !options.includeVendor)
         continue;
       const child = join18(path, name);
-      if (isVendor && lstatSync16(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      if (isVendor && lstatSync17(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
         const target = statSync8(child, { throwIfNoEntry: false });
         if (target?.isFile() || pluginCache && target?.isDirectory() && verifiedSiblingCacheAlias(agent, child, path)) {
           scan.entries++;
@@ -15290,15 +15358,21 @@ function planAgentIntegration(options) {
     }
     return resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, retainedReview, canonical: (path) => canonicalAgentPath(path, aliases) });
   });
-  const codexConfig = options.agents.includes("codex") ? Bun.TOML.parse(readOptional(canonicalAgentPath(join18(home, ".codex", "config.toml"), aliases)) ?? "") : {};
+  const codexConfigBefore = options.agents.includes("codex") ? readOptional(canonicalAgentPath(join18(home, ".codex", "config.toml"), aliases)) : null;
+  const codexConfig = Bun.TOML.parse(codexConfigBefore ?? "");
   const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases, reviewedCacheAlias: options.reviewedCacheAlias, disabledVendorPaths: disabledCodexSkillPaths(codexConfig, aliases) });
+  const codexPathConfig = options.agents.includes("codex") ? disableCodexSkills(codexConfigBefore ?? "", nativeSkills, aliases, canonicalAgentPath(join18(home, ".codex/skills", CLI_BRIDGE_NAME), aliases)) : undefined;
+  const plannedCodexRules = codexPathConfig === undefined ? undefined : Bun.TOML.parse(codexPathConfig).skills?.config ?? [];
   const observedNativeSources = [];
   const codexPluginControls = options.codexNativeCatalog ? reviewCodexPluginControls(options.codexNativeCatalog, nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor).map((entry) => join18(entry.path, "SKILL.md")), canonicalAgentPath(join18(home, ".codex/plugins/cache"), aliases), resolve11(options.projectDir ?? home), (path) => {
     const bytes = readNativeBytes(path, 1024 * 1024);
     observedNativeSources.push({ path, sha256: sha3(bytes) });
     return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-  }, codexConfig.skills?.config ?? [], codexConfig.plugins) : { skills: policy.bridge?.codexPluginSkills ?? [], inactivePlugins: policy.bridge?.codexInactivePlugins ?? [], sourceInputs: policy.bridge?.discovery?.codex?.codexInstallationInputs?.plugins ?? [] };
+  }, codexConfig.skills?.config ?? [], codexConfig.plugins, plannedCodexRules) : { skills: policy.bridge?.codexPluginSkills ?? [], inactivePlugins: policy.bridge?.codexInactivePlugins ?? [], sourceInputs: policy.bridge?.discovery?.codex?.codexInstallationInputs?.plugins ?? [] };
   const codexPluginSkills = codexPluginControls.skills;
+  if (options.agents.includes("codex") && !options.codexNativeCatalog && codexPluginSkills.length && !reviewedCodexPluginCapabilitiesUnchanged(canonicalAgentPath(join18(home, ".codex/plugins/cache"), aliases), codexPluginSkills, (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024)))) {
+    throw new Error("NATIVE_SKILL_DRIFT: reviewed native plugin capability controls changed; provide a fresh native catalog and discovery review");
+  }
   const codexInactivePlugins = codexPluginControls.inactivePlugins;
   const codexDiscovery = discoveries.find((binding) => binding.agent === "codex");
   const codexPluginSourceInputs = codexPluginControls.sourceInputs.filter((input) => codexDiscovery?.method === "reviewed" && codexDiscovery.roots.some((root) => root === input.sourceRoot || root.startsWith(input.sourceRoot + sep5) || input.sourceRoot.startsWith(root + sep5)) && codexDiscovery.sources.some((source) => source.path === join18(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined));
@@ -15373,7 +15447,9 @@ function planAgentIntegration(options) {
       changes.push({ path, before, after });
     if (agent === "codex") {
       const configPath = canonicalAgentPath(join18(home, ".codex", "config.toml"), aliases), previous = readOptional(configPath);
-      const next = disableReviewedCodexPluginNames(disableCodexSkills(previous ?? "", nativeSkills, aliases, bridgePath), codexPluginSkills);
+      if (previous !== codexConfigBefore)
+        throw new Error(`Configuration changed during planning: ${configPath}`);
+      const next = disableReviewedCodexPluginNames(codexPathConfig, codexPluginSkills);
       if (next !== (previous ?? ""))
         changes.push({ path: configPath, before: previous, after: next });
     }
@@ -15409,6 +15485,171 @@ function planAgentIntegration(options) {
   recheckRootAliases(aliases);
   return { dataDir: dataDir2, profileId, changes, nativeSkills, ...observedNativeSources.length ? { observedNativeSources } : {}, ...nextPolicy.bridge.codexPluginSkillReview ? { codexPluginSkillReview: nextPolicy.bridge.codexPluginSkillReview } : {}, observedPolicy: { path: policyPath, before: previousPolicy }, discoveryBefore: discoveries, discoveryAfter, ...aliases.length ? { rootAliases: aliases } : {}, ...retainedAgents.length ? { retainedReviewChecks: { home, projectDir: options.projectDir ?? home, agents: retainedAgents } } : {} };
 }
+function hookProjectionRefusal(reason) {
+  throw new Error(`CLAUDE_MANAGED_HOOK_${reason}`);
+}
+function projectedHookAcl(path, observed) {
+  if (process.platform !== "darwin")
+    return;
+  const identity4 = (stat) => `${stat.dev}:${stat.ino}:${stat.ctimeNs}:${stat.uid}:${stat.mode}:${stat.nlink}:${stat.size}:${stat.mtimeNs}`;
+  const fd = openSync9(path, constants8.O_RDONLY | constants8.O_NOFOLLOW | constants8.O_NONBLOCK | (observed.isDirectory() ? constants8.O_DIRECTORY : 0));
+  try {
+    if (identity4(fstatSync9(fd, { bigint: true })) !== identity4(observed) || !hasTrustedDarwinAcl(fd, true) || identity4(fstatSync9(fd, { bigint: true })) !== identity4(observed) || identity4(lstatSync17(path, { bigint: true })) !== identity4(observed))
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+  } finally {
+    closeSync9(fd);
+  }
+}
+function projectedHookExecutable(command, expectedResolved) {
+  try {
+    if (!isAbsolute11(command) || /[\0\r\n]/.test(command) || resolve11(command) !== command)
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    command = canonicalSystemPath(command);
+    const parents2 = (file = command) => {
+      const result = [];
+      for (let path = dirname12(file);; path = dirname12(path)) {
+        const stat = lstatSync17(path, { bigint: true });
+        if (!stat.isDirectory() || (stat.mode & 0o022n) !== 0n && !(stat.uid === 0n && (stat.mode & 0o1000n) !== 0n))
+          hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+        projectedHookAcl(path, stat);
+        result.push(`${path}:${stat.dev}:${stat.ino}:${stat.uid}:${stat.mode}`);
+        if (dirname12(path) === path)
+          break;
+      }
+      return result;
+    };
+    const parentIdentity = parents2(), link = lstatSync17(command, { bigint: true });
+    if (link.uid !== BigInt(process.getuid()) || !link.isFile() && !link.isSymbolicLink())
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    const linkIdentity = (stat) => `${stat.dev}:${stat.ino}:${stat.mode}:${stat.uid}:${stat.ctimeNs}`;
+    const resolved = realpathSync7(command);
+    if (expectedResolved !== undefined && resolved !== expectedResolved)
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    const resolvedParentIdentity = parents2(resolved);
+    const manifest = snapshot(join18(dirname12(dirname12(resolved)), "package.json"), false, { readOnlyPackage: true });
+    projectedHookAcl(manifest.file, manifest.stat);
+    const pkg = JSON.parse(manifest.text);
+    if (pkg.name !== "@hasna/skills" || !/^\d+\.\d+\.\d+$/.test(pkg.version) || pkg.bin?.skills !== "bin/index.js" || resolved !== join18(dirname12(manifest.file), "bin/index.js"))
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    const cli = snapshot(resolved, false, { readOnlyPackage: true });
+    projectedHookAcl(cli.file, cli.stat);
+    if ((cli.stat.mode & 0o100n) === 0n)
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    const recheck = () => {
+      try {
+        if (realpathSync7(command) !== resolved || linkIdentity(lstatSync17(command, { bigint: true })) !== linkIdentity(link) || !isDeepStrictEqual4(parents2(), parentIdentity) || !isDeepStrictEqual4(parents2(resolved), resolvedParentIdentity))
+          hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+        projectedHookAcl(cli.file, cli.stat);
+        projectedHookAcl(manifest.file, manifest.stat);
+        unchanged2(cli);
+        unchanged2(manifest);
+      } catch {
+        hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+      }
+    };
+    recheck();
+    return { resolved, sha256: cli.sha256, manifestSha256: manifest.sha256, recheck };
+  } catch {
+    hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+  }
+}
+function planClaudeManagedHookProjection(options) {
+  if (typeof options.targetSettings !== "string" || Buffer.byteLength(options.targetSettings) > 1024 * 1024)
+    hookProjectionRefusal("TARGET_INVALID");
+  const targetSha256 = sha3(options.targetSettings);
+  if (!/^[a-f0-9]{64}$/.test(options.expectedTargetSha256) || options.expectedTargetSha256 !== targetSha256)
+    hookProjectionRefusal("TARGET_CHANGED");
+  let target;
+  try {
+    target = jsonObject(options.targetSettings, "target");
+  } catch {
+    hookProjectionRefusal("TARGET_INVALID");
+  }
+  const home = resolve11(options.home ?? homedir2()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
+  const policyPath = join18(dataDir2, "agent-policy.json");
+  let policyBytes, settingsBytes, settingsPath, command, profile;
+  try {
+    policyBytes = readNativeBytes(policyPath, 1024 * 1024);
+    const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
+    if (!snapshot2 || snapshot2.text !== policyBytes.toString("utf8"))
+      hookProjectionRefusal("SOURCE_UNVERIFIED");
+    const binding = snapshot2.value.bridge;
+    settingsPath = canonicalAgentPath(join18(home, AGENT_ADAPTERS.claude.config), binding?.rootAliases ?? []);
+    settingsBytes = readNativeBytes(settingsPath, 1024 * 1024);
+    command = binding?.commands?.claude;
+    profile = binding?.profiles?.claude;
+    if (typeof command !== "string" || typeof profile !== "string")
+      hookProjectionRefusal("SOURCE_UNVERIFIED");
+    assertManagedAgentBridge("claude", { home, dataDir: dataDir2, projectDir: options.projectDir, profileId: profile });
+  } catch {
+    hookProjectionRefusal("SOURCE_UNVERIFIED");
+  }
+  const executable = projectedHookExecutable(command);
+  const sourceSha256 = sha3(JSON.stringify({
+    home,
+    policyPath,
+    policy: sha3(policyBytes),
+    settingsPath,
+    settings: sha3(settingsBytes),
+    executable: { path: executable.resolved, sha256: executable.sha256, manifestSha256: executable.manifestSha256 }
+  }));
+  if (options.expectedSourceSha256 !== undefined && options.expectedSourceSha256 !== sourceSha256)
+    hookProjectionRefusal("SOURCE_CHANGED");
+  const replacements = [];
+  const observed = [executable];
+  if (target.hooks !== undefined) {
+    if (!target.hooks || typeof target.hooks !== "object" || Array.isArray(target.hooks))
+      hookProjectionRefusal("TARGET_INVALID");
+    for (const event of [...AGENT_ADAPTERS.claude.events, "PreToolUse"]) {
+      const groups = target.hooks[event];
+      if (groups === undefined)
+        continue;
+      if (!Array.isArray(groups))
+        hookProjectionRefusal("TARGET_INVALID");
+      let recognized = 0;
+      for (const [groupIndex, group] of groups.entries()) {
+        if (!group || !Array.isArray(group.hooks))
+          hookProjectionRefusal("TARGET_INVALID");
+        for (const [hookIndex, hook] of group.hooks.entries()) {
+          if (hook?.type !== "command" || typeof hook.command !== "string")
+            continue;
+          if (!hook.command.includes("hook user-prompt --agent claude"))
+            continue;
+          const match = /^('(?:[^']|'\\'')*') hook user-prompt --agent claude --selection-profile ([A-Za-z0-9][A-Za-z0-9._-]{0,127}) --event ([A-Za-z]+)$/.exec(hook.command);
+          if (!match || match[3] !== event)
+            hookProjectionRefusal("UNRECOGNIZED");
+          const oldCommand = match[1].slice(1, -1).replaceAll("'\\''", "'");
+          let rendered;
+          try {
+            rendered = renderAgentHookCommand(oldCommand, "claude", match[2], event);
+          } catch {
+            hookProjectionRefusal("UNRECOGNIZED");
+          }
+          if (rendered !== hook.command)
+            hookProjectionRefusal("UNRECOGNIZED");
+          const legacy = projectedHookExecutable(oldCommand, executable.resolved);
+          if (legacy.resolved !== executable.resolved || legacy.sha256 !== executable.sha256 || legacy.manifestSha256 !== executable.manifestSha256)
+            hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+          observed.push(legacy);
+          if (++recognized > 1)
+            hookProjectionRefusal("AMBIGUOUS");
+          const replacement = renderAgentHookCommand(command, "claude", profile, event);
+          if (replacement !== hook.command)
+            replacements.push({ event, groupIndex, hookIndex, beforeSha256: sha3(hook.command), command: replacement });
+        }
+      }
+    }
+  }
+  try {
+    if (!readNativeBytes(policyPath, 1024 * 1024).equals(policyBytes) || !readNativeBytes(settingsPath, 1024 * 1024).equals(settingsBytes))
+      hookProjectionRefusal("SOURCE_CHANGED");
+  } catch {
+    hookProjectionRefusal("SOURCE_CHANGED");
+  }
+  for (const item of observed)
+    item.recheck();
+  return { schema: "hasna.claude-managed-hook-projection.v1", targetSha256, sourceSha256, replacements };
+}
 function planClaudeStopHookUpdate(options) {
   return planClaudeHookEventsUpdate({ ...options, events: ["Stop"] });
 }
@@ -15441,10 +15682,10 @@ function planClaudeHookEventsUpdate(options) {
   const home = resolve11(options.home ?? homedir2()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
   const policyPath = join18(dataDir2, "agent-policy.json");
   assertSafePath(policyPath);
-  const snapshot = readManagedSkillPolicySnapshot(dataDir2);
-  if (!snapshot)
+  const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
+  if (!snapshot2)
     return null;
-  const policy = snapshot.value, bridge = policy.bridge;
+  const policy = snapshot2.value, bridge = policy.bridge;
   if (!bridge || bridge.home !== home || bridge.version !== CLI_BRIDGE_VERSION || bridge.digest !== CLI_BRIDGE_DIGEST || !Array.isArray(bridge.agents) || !bridge.agents.length || bridge.agents.some((agent) => !INTEGRATION_AGENTS.includes(agent)) || new Set(bridge.agents).size !== bridge.agents.length || !bridge.discovery || typeof bridge.discovery !== "object" || Array.isArray(bridge.discovery)) {
     throw new Error("Invalid managed bridge for Claude settings update");
   }
@@ -15452,7 +15693,7 @@ function planClaudeHookEventsUpdate(options) {
   recheckRootAliases(aliases);
   const path = canonicalAgentPath(join18(home, ".claude", "settings.json"), aliases);
   assertSafePath(path);
-  const before = lstatSync16(path, { throwIfNoEntry: false }) ? new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(readNativeBytes(path, 1024 * 1024)) : null;
+  const before = lstatSync17(path, { throwIfNoEntry: false }) ? new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(readNativeBytes(path, 1024 * 1024)) : null;
   if ((before === null ? "absent" : sha3(before)) !== options.expectedSettingsSha256)
     throw new Error("Claude settings preimage changed");
   assertClaudeHookEventsReplacement(before, options.replacement, options.events);
@@ -15482,7 +15723,7 @@ function planClaudeHookEventsUpdate(options) {
   const nextPolicy = { ...policy, bridge: { ...bridge, discovery: Object.fromEntries(discoveryAfter.map((binding) => [binding.agent, binding])) } };
   const changes = before === options.replacement ? [] : [{ path, before, after: options.replacement }];
   if (JSON.stringify(nextPolicy) !== JSON.stringify(policy))
-    changes.push({ path: policyPath, before: snapshot.text, after: serializeManagedSkillPolicy(nextPolicy) });
+    changes.push({ path: policyPath, before: snapshot2.text, after: serializeManagedSkillPolicy(nextPolicy) });
   recheckRootAliases(aliases);
   const nativeSkills = inventoryNativeSkills(home, {
     agents: consumers,
@@ -15497,7 +15738,7 @@ function planClaudeHookEventsUpdate(options) {
     profileId: policy.profileId ?? "default",
     changes,
     nativeSkills,
-    observedPolicy: { path: policyPath, before: snapshot.text },
+    observedPolicy: { path: policyPath, before: snapshot2.text },
     discoveryBefore: discoveries,
     discoveryAfter,
     rootAliases: aliases,
@@ -15506,10 +15747,10 @@ function planClaudeHookEventsUpdate(options) {
 }
 function atomicWrite2(path, content) {
   assertSafePath(path);
-  mkdirSync5(dirname11(path), { recursive: true, mode: 448 });
+  mkdirSync5(dirname12(path), { recursive: true, mode: 448 });
   const temporary = `${path}.skills-${randomUUID2()}`;
   try {
-    writeFileSync4(temporary, content, { mode: 384, flag: "wx" });
+    writeFileSync5(temporary, content, { mode: 384, flag: "wx" });
     renameSync2(temporary, path);
   } finally {
     if (existsSync9(temporary))
@@ -15520,10 +15761,10 @@ function planAgentSettingsWitnessUpgrade(options) {
   if (options.targetCodexVersion !== undefined && (options.agent !== "codex" || ![2, 3].includes(options.targetCodexVersion)))
     throw new Error("Invalid Codex witness target version");
   const home = resolve11(options.home ?? homedir2()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
-  const snapshot = readManagedSkillPolicySnapshot(dataDir2);
-  if (!snapshot || sha3(snapshot.text) !== options.expectedPolicySha256)
+  const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
+  if (!snapshot2 || sha3(snapshot2.text) !== options.expectedPolicySha256)
     throw new Error("Managed policy preimage changed");
-  const policy = snapshot.value, aliases = policy.bridge?.rootAliases ?? [];
+  const policy = snapshot2.value, aliases = policy.bridge?.rootAliases ?? [];
   recheckRootAliases(aliases);
   const binding = policy.bridge?.discovery?.[options.agent];
   if (!binding || binding.agent !== options.agent || binding.method !== "reviewed")
@@ -15567,7 +15808,7 @@ function planAgentSettingsWitnessUpgrade(options) {
   const replacement = { ...binding, sources: rebound };
   verifyAgentDiscovery(replacement);
   const after = serializeManagedSkillPolicy({ ...policy, bridge: { ...policy.bridge, discovery: { ...policy.bridge.discovery, [options.agent]: replacement } } });
-  return { dataDir: dataDir2, profileId: policy.profileId, changes: [{ path: join18(dataDir2, "agent-policy.json"), before: snapshot.text, after }], nativeSkills: [], observedPolicy: { path: join18(dataDir2, "agent-policy.json"), before: snapshot.text }, observedSettings: { path: configPath, before: settings }, discoveryBefore: [replacement], discoveryAfter: [replacement], rootAliases: aliases, managedAgentChecks: { home, agents: [options.agent] }, settingsWitnessUpgrade: { agent: options.agent, path: configPath, fromHashMode: previous.hashMode ?? "bytes", fromSha256: previous.sha256, toHashMode: next.hashMode, toSha256: next.sha256, reviewedPreimage: options.reviewedPreimage, currentSettingsSha256: options.expectedSettingsSha256, replacedWitnesses: replaced.map((source) => ({ hashMode: source.hashMode ?? "bytes", sha256: source.sha256 })) } };
+  return { dataDir: dataDir2, profileId: policy.profileId, changes: [{ path: join18(dataDir2, "agent-policy.json"), before: snapshot2.text, after }], nativeSkills: [], observedPolicy: { path: join18(dataDir2, "agent-policy.json"), before: snapshot2.text }, observedSettings: { path: configPath, before: settings }, discoveryBefore: [replacement], discoveryAfter: [replacement], rootAliases: aliases, managedAgentChecks: { home, agents: [options.agent] }, settingsWitnessUpgrade: { agent: options.agent, path: configPath, fromHashMode: previous.hashMode ?? "bytes", fromSha256: previous.sha256, toHashMode: next.hashMode, toSha256: next.sha256, reviewedPreimage: options.reviewedPreimage, currentSettingsSha256: options.expectedSettingsSha256, replacedWitnesses: replaced.map((source) => ({ hashMode: source.hashMode ?? "bytes", sha256: source.sha256 })) } };
 }
 function applyAgentIntegration(plan) {
   for (const source of plan.observedNativeSources ?? [])
@@ -15620,7 +15861,7 @@ function applyAgentIntegration(plan) {
   for (const [index, change] of plan.changes.entries())
     if (change.before !== null) {
       const backup = join18(backupRoot, `${index}-${sha3(change.path).slice(0, 12)}.backup`);
-      writeFileSync4(backup, change.before, { mode: 384, flag: "wx" });
+      writeFileSync5(backup, change.before, { mode: 384, flag: "wx" });
       if (readFileSync12(backup, "utf8") !== change.before)
         throw new Error("Native configuration preservation readback failed");
       backups.push(backup);
@@ -15630,7 +15871,7 @@ function applyAgentIntegration(plan) {
       recheckRootAliases(aliases);
       if (currentText(change.path) !== change.before)
         throw new Error(`Configuration changed after planning: ${change.path}`);
-      for (let directory = dirname11(change.path);!existsSync9(directory); directory = dirname11(directory))
+      for (let directory = dirname12(change.path);!existsSync9(directory); directory = dirname12(directory))
         createdDirectories.add(directory);
       const after = change.after;
       atomicWrite2(change.path, after);
@@ -15681,11 +15922,11 @@ function applyAgentIntegration(plan) {
 }
 function syncArchiveDirectory(path) {
   assertSafePath(path);
-  const descriptor = openSync8(path, constants7.O_RDONLY | constants7.O_DIRECTORY | constants7.O_NOFOLLOW | constants7.O_NONBLOCK);
+  const descriptor = openSync9(path, constants8.O_RDONLY | constants8.O_DIRECTORY | constants8.O_NOFOLLOW | constants8.O_NONBLOCK);
   try {
-    fsyncSync2(descriptor);
+    fsyncSync3(descriptor);
   } finally {
-    closeSync8(descriptor);
+    closeSync9(descriptor);
   }
 }
 function writeArchiveJournal(path, value) {
@@ -15693,18 +15934,18 @@ function writeArchiveJournal(path, value) {
   const temporary = `${path}.skills-${randomUUID2()}`;
   let descriptor;
   try {
-    descriptor = openSync8(temporary, constants7.O_WRONLY | constants7.O_CREAT | constants7.O_EXCL | constants7.O_NOFOLLOW, 384);
-    writeFileSync4(descriptor, `${JSON.stringify(value)}
+    descriptor = openSync9(temporary, constants8.O_WRONLY | constants8.O_CREAT | constants8.O_EXCL | constants8.O_NOFOLLOW, 384);
+    writeFileSync5(descriptor, `${JSON.stringify(value)}
 `);
-    fsyncSync2(descriptor);
-    closeSync8(descriptor);
+    fsyncSync3(descriptor);
+    closeSync9(descriptor);
     descriptor = undefined;
     renameSync2(temporary, path);
-    syncArchiveDirectory(dirname11(path));
+    syncArchiveDirectory(dirname12(path));
   } finally {
     if (descriptor !== undefined)
-      closeSync8(descriptor);
-    if (lstatSync16(temporary, { throwIfNoEntry: false }))
+      closeSync9(descriptor);
+    if (lstatSync17(temporary, { throwIfNoEntry: false }))
       unlinkSync3(temporary);
   }
 }
@@ -15738,7 +15979,7 @@ function archiveNativeSkills(inventory, options) {
   const moved = [];
   const verifyArchive = (entry) => {
     assertSafePath(entry.archive);
-    const stat = lstatSync16(entry.archive);
+    const stat = lstatSync17(entry.archive);
     if (entry.discoveryOnly ? !stat.isFile() : !stat.isDirectory())
       throw new Error("Archive type changed");
     if ((entry.discoveryOnly ? sha3(readNativeBytes(entry.archive)) : treeHash(entry.archive)) !== entry.hash)
@@ -15746,14 +15987,14 @@ function archiveNativeSkills(inventory, options) {
   };
   assertSafePath(archiveRoot);
   const created = [];
-  for (let path = archiveRoot;!existsSync9(path); path = dirname11(path))
+  for (let path = archiveRoot;!existsSync9(path); path = dirname12(path))
     created.push(path);
   mkdirSync5(archiveRoot, { recursive: true, mode: 448 });
   try {
     for (const directory of created)
       syncArchiveDirectory(directory);
     if (created.length)
-      syncArchiveDirectory(dirname11(created.at(-1)));
+      syncArchiveDirectory(dirname12(created.at(-1)));
     writeArchiveJournal(receiptPath, journal);
     for (const [index, entry] of selected.entries()) {
       recheckRootAliases(aliases);
@@ -15765,7 +16006,7 @@ function archiveNativeSkills(inventory, options) {
       writeArchiveJournal(receiptPath, journal);
       renameSync2(move.source, move.archive);
       moved.push(move);
-      syncArchiveDirectory(dirname11(move.source));
+      syncArchiveDirectory(dirname12(move.source));
       syncArchiveDirectory(archiveRoot);
       verifyArchive(move);
       move.status = "archived";
@@ -15786,7 +16027,7 @@ function archiveNativeSkills(inventory, options) {
         recheckRootAliases(aliases);
         assertSafePath(entry.source);
         assertSafePath(entry.archive);
-        if (lstatSync16(entry.source, { throwIfNoEntry: false })) {
+        if (lstatSync17(entry.source, { throwIfNoEntry: false })) {
           entry.status = "recovery-required";
           entry.conflict = "source-occupied";
           continue;
@@ -15800,10 +16041,10 @@ function archiveNativeSkills(inventory, options) {
         }
         if (entry.discoveryOnly) {
           linkSync2(entry.archive, entry.source);
-          syncArchiveDirectory(dirname11(entry.source));
+          syncArchiveDirectory(dirname12(entry.source));
           unlinkSync3(entry.archive);
         } else {
-          if (lstatSync16(entry.source, { throwIfNoEntry: false })) {
+          if (lstatSync17(entry.source, { throwIfNoEntry: false })) {
             entry.status = "recovery-required";
             entry.conflict = "source-occupied";
             continue;
@@ -15811,7 +16052,7 @@ function archiveNativeSkills(inventory, options) {
           renameSync2(entry.archive, entry.source);
         }
         entry.status = "restored";
-        syncArchiveDirectory(dirname11(entry.source));
+        syncArchiveDirectory(dirname12(entry.source));
         syncArchiveDirectory(archiveRoot);
       } catch {
         entry.status = "recovery-required";
@@ -15836,10 +16077,10 @@ function assertManagedAgentBridge(agent, options = {}) {
 function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscovery) {
   const home = resolve11(options.home ?? homedir2()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
   assertSafePath(join18(dataDir2, "agent-policy.json"));
-  const snapshot = readManagedSkillPolicySnapshot(dataDir2);
-  if (!snapshot)
+  const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
+  if (!snapshot2)
     throw new Error("NATIVE_SKILL_DRIFT: install the Skills bridge with skills hook install");
-  const binding = snapshot.value.bridge;
+  const binding = snapshot2.value.bridge;
   if (!binding || binding.version !== CLI_BRIDGE_VERSION || binding.digest !== CLI_BRIDGE_DIGEST || binding.home !== home || !Array.isArray(binding.agents) || !binding.agents.includes(agent))
     throw new Error("NATIVE_SKILL_DRIFT: the managed Skills bridge binding is missing or incompatible; run skills hook install");
   const aliases = binding.rootAliases ?? [];
@@ -15980,7 +16221,7 @@ function isSkillsOwnershipMarker(marker) {
 function hasSkillsOwnershipMarker(dir) {
   const path = join19(dir, SYNC_MARKER_FILE);
   try {
-    if (!lstatSync17(path).isFile())
+    if (!lstatSync18(path).isFile())
       return false;
     const marker = JSON.parse(readFileSync13(path, "utf8"));
     return isSkillsOwnershipMarker(marker);
@@ -16206,7 +16447,7 @@ function writeManagedSkillDir(dir, skillMd, options) {
   const action = dirExists ? "update" : "create";
   if (options.dryRun)
     return { action, path: skillMdPath };
-  const parentDir = dirname12(dir);
+  const parentDir = dirname13(dir);
   mkdirSync6(parentDir, { recursive: true });
   const transactionDir = mkdtempSync(join19(parentDir, `.hasna-skills-write-${basename6(dir)}-`));
   const candidateDir = join19(transactionDir, "candidate");
@@ -16228,10 +16469,10 @@ function writeManagedSkillDir(dir, skillMd, options) {
     } else {
       mkdirSync6(candidateDir, { recursive: true });
     }
-    writeFileSync5(candidateSkillMdPath, skillMd.endsWith(`
+    writeFileSync6(candidateSkillMdPath, skillMd.endsWith(`
 `) ? skillMd : `${skillMd}
 `);
-    writeFileSync5(candidateMarkerPath, `${JSON.stringify(marker, null, 2)}
+    writeFileSync6(candidateMarkerPath, `${JSON.stringify(marker, null, 2)}
 `);
     if (dirExists) {
       originalMoved = true;
@@ -16311,7 +16552,7 @@ function resolveSkillAlias(name) {
 }
 
 // src/lib/project-state.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync7, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync7, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "fs";
 import { join as join20 } from "path";
 var VALID_PIN_SOURCES = [
   "official",
@@ -16360,7 +16601,7 @@ function saveProjectConfig(config, targetDir = process.cwd()) {
   const dir = getProjectStateDir(targetDir);
   mkdirSync7(dir, { recursive: true });
   const normalized = normalizeProjectConfig({ ...config, updatedAt: new Date().toISOString() });
-  writeFileSync6(getProjectConfigPath(targetDir), JSON.stringify(normalized, null, 2) + `
+  writeFileSync7(getProjectConfigPath(targetDir), JSON.stringify(normalized, null, 2) + `
 `);
 }
 function pinProjectSkill(name, details = {}, targetDir = process.cwd()) {
@@ -17179,7 +17420,7 @@ function exactProfileSelection(spec, profile) {
 }
 
 // src/lib/plugin-projection.ts
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 import { posix } from "path";
 var PLUGIN_PROJECTION_MANIFEST = "plugin-projection.json";
 var PLUGIN_PROJECTION_LIMITS = Object.freeze({ files: 1024, bytes: 64 * 1024 * 1024, fileBytes: 16 * 1024 * 1024, metadataBytes: 512 * 1024, registrations: 64, history: 128 });
@@ -17190,7 +17431,7 @@ function pluginNeed(value, message) {
   if (!value)
     pluginRefusal(message);
 }
-var pluginHash = (bytes) => createHash13("sha256").update(bytes).digest("hex");
+var pluginHash = (bytes) => createHash14("sha256").update(bytes).digest("hex");
 function pluginObject(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -17378,16 +17619,16 @@ function buildPluginProjection(entries) {
 }
 
 // src/lib/plugin-projection-store.ts
-import { createHash as createHash14, randomUUID as randomUUID3 } from "crypto";
-import { constants as constants8, closeSync as closeSync9, fchmodSync, fstatSync as fstatSync9, fsyncSync as fsyncSync3, linkSync as linkSync3, lstatSync as lstatSync18, mkdirSync as mkdirSync8, openSync as openSync9, opendirSync as opendirSync4, readSync as readSync7, renameSync as renameSync4, rmdirSync as rmdirSync3, rmSync as rmSync3, unlinkSync as unlinkSync4, writeSync as writeSync2 } from "fs";
-import { dirname as dirname13, isAbsolute as isAbsolute12, join as join25, parse as parse5, resolve as resolve12 } from "path";
-var READ_FLAGS = constants8.O_RDONLY | constants8.O_NOFOLLOW | constants8.O_NONBLOCK;
-var WRITE_FLAGS = constants8.O_WRONLY | constants8.O_CREAT | constants8.O_EXCL | constants8.O_NOFOLLOW | constants8.O_NONBLOCK;
+import { createHash as createHash15, randomUUID as randomUUID3 } from "crypto";
+import { constants as constants9, closeSync as closeSync10, fchmodSync, fstatSync as fstatSync10, fsyncSync as fsyncSync4, linkSync as linkSync3, lstatSync as lstatSync19, mkdirSync as mkdirSync8, openSync as openSync10, opendirSync as opendirSync4, readSync as readSync8, renameSync as renameSync4, rmdirSync as rmdirSync3, rmSync as rmSync3, unlinkSync as unlinkSync4, writeSync as writeSync2 } from "fs";
+import { dirname as dirname14, isAbsolute as isAbsolute12, join as join25, parse as parse5, resolve as resolve12 } from "path";
+var READ_FLAGS = constants9.O_RDONLY | constants9.O_NOFOLLOW | constants9.O_NONBLOCK;
+var WRITE_FLAGS = constants9.O_WRONLY | constants9.O_CREAT | constants9.O_EXCL | constants9.O_NOFOLLOW | constants9.O_NONBLOCK;
 var uid = () => typeof process.getuid === "function" ? BigInt(process.getuid()) : undefined;
 var missing = (error) => Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
 function stat(path) {
   try {
-    return lstatSync18(path, { bigint: true });
+    return lstatSync19(path, { bigint: true });
   } catch (error) {
     if (missing(error))
       return null;
@@ -17406,7 +17647,7 @@ function same3(left, right, identityOnly = false) {
 }
 function ancestors(path, create = false) {
   canonical5(path);
-  const result = [], parent = dirname13(path), filesystemRoot = parse5(parent).root;
+  const result = [], parent = dirname14(path), filesystemRoot = parse5(parent).root;
   let current = filesystemRoot;
   for (const segment of ["", ...parent.slice(filesystemRoot.length).split("/").filter(Boolean)]) {
     if (segment)
@@ -17434,7 +17675,7 @@ function verifyAncestors(chain, identityOnly = true) {
 }
 function privateParent(path) {
   const chain = ancestors(path, true), parent = chain.at(-1);
-  pluginNeed(parent && parent.path === dirname13(path), "Plugin storage parent is unavailable");
+  pluginNeed(parent && parent.path === dirname14(path), "Plugin storage parent is unavailable");
   owner(parent.stat);
   pluginNeed((parent.stat.mode & 0o7777n) === 0o700n, "Plugin storage parent must have mode 0700");
   return chain;
@@ -17463,19 +17704,19 @@ function readBytes(path, maximum, kind) {
   fileShape(before, maximum, kind);
   let fd;
   try {
-    fd = openSync9(path, READ_FLAGS);
-    const opened = fstatSync9(fd, { bigint: true });
+    fd = openSync10(path, READ_FLAGS);
+    const opened = fstatSync10(fd, { bigint: true });
     same3(before, opened);
     fileShape(opened, maximum, kind);
     const bytes = new Uint8Array(Number(opened.size));
     let offset = 0;
     while (offset < bytes.byteLength) {
-      const count = readSync7(fd, bytes, offset, bytes.byteLength - offset, null);
+      const count = readSync8(fd, bytes, offset, bytes.byteLength - offset, null);
       pluginNeed(count > 0, "Plugin file changed while being read");
       offset += count;
     }
-    pluginNeed(readSync7(fd, new Uint8Array(1), 0, 1, null) === 0, "Plugin file grew while being read");
-    same3(opened, fstatSync9(fd, { bigint: true }));
+    pluginNeed(readSync8(fd, new Uint8Array(1), 0, 1, null) === 0, "Plugin file grew while being read");
+    same3(opened, fstatSync10(fd, { bigint: true }));
     same3(opened, stat(path));
     verifyAncestors(chain);
     return bytes;
@@ -17485,7 +17726,7 @@ function readBytes(path, maximum, kind) {
     return pluginRefusal("Cannot safely read plugin file");
   } finally {
     if (fd !== undefined)
-      closeSync9(fd);
+      closeSync10(fd);
   }
 }
 function exactPaths(entries) {
@@ -17595,16 +17836,16 @@ function verifyPluginTree(root, witnesses) {
 function writeExclusive(path, bytes, mode) {
   let fd, created;
   try {
-    fd = openSync9(path, WRITE_FLAGS, mode);
+    fd = openSync10(path, WRITE_FLAGS, mode);
     fchmodSync(fd, mode);
-    created = fstatSync9(fd, { bigint: true });
+    created = fstatSync10(fd, { bigint: true });
     let offset = 0;
     while (offset < bytes.byteLength) {
       const count = writeSync2(fd, bytes, offset, bytes.byteLength - offset);
       pluginNeed(count > 0, "Plugin file write did not progress");
       offset += count;
     }
-    fsyncSync3(fd);
+    fsyncSync4(fd);
   } catch (error) {
     if (created) {
       same3(created, stat(path), true);
@@ -17613,7 +17854,7 @@ function writeExclusive(path, bytes, mode) {
     throw error;
   } finally {
     if (fd !== undefined)
-      closeSync9(fd);
+      closeSync10(fd);
   }
 }
 function materializePluginTree(root, entries) {
@@ -17716,20 +17957,20 @@ function pluginExecutableDigest(path) {
   fileShape(before, maximum, "executable");
   let fd;
   try {
-    fd = openSync9(path, READ_FLAGS);
-    const opened = fstatSync9(fd, { bigint: true });
+    fd = openSync10(path, READ_FLAGS);
+    const opened = fstatSync10(fd, { bigint: true });
     same3(before, opened);
     fileShape(opened, maximum, "executable");
-    const hash2 = createHash14("sha256"), buffer = new Uint8Array(64 * 1024);
+    const hash2 = createHash15("sha256"), buffer = new Uint8Array(64 * 1024);
     let remaining = Number(opened.size);
     while (remaining > 0) {
-      const count = readSync7(fd, buffer, 0, Math.min(buffer.byteLength, remaining), null);
+      const count = readSync8(fd, buffer, 0, Math.min(buffer.byteLength, remaining), null);
       pluginNeed(count > 0, "Plugin executable changed during hashing");
       hash2.update(buffer.subarray(0, count));
       remaining -= count;
     }
-    pluginNeed(readSync7(fd, buffer, 0, 1, null) === 0, "Plugin executable grew during hashing");
-    same3(opened, fstatSync9(fd, { bigint: true }));
+    pluginNeed(readSync8(fd, buffer, 0, 1, null) === 0, "Plugin executable grew during hashing");
+    same3(opened, fstatSync10(fd, { bigint: true }));
     same3(opened, stat(path));
     verifyAncestors(chain);
     return `sha256:${hash2.digest("hex")}`;
@@ -17739,7 +17980,7 @@ function pluginExecutableDigest(path) {
     return pluginRefusal("Cannot safely hash plugin executable");
   } finally {
     if (fd !== undefined)
-      closeSync9(fd);
+      closeSync10(fd);
   }
 }
 
@@ -18149,29 +18390,29 @@ function validateManagedPluginWitnesses(value) {
 function safe3(path) {
   pluginText(path);
   pluginNeed(isAbsolute14(path) && resolve14(path) === path, "Invalid plugin registry path");
-  for (let at = path;; at = dirname14(at)) {
-    pluginNeed(!lstatSync19(at, { throwIfNoEntry: false })?.isSymbolicLink(), "Plugin registry path traverses a symlink");
-    if (at === dirname14(at))
+  for (let at = path;; at = dirname15(at)) {
+    pluginNeed(!lstatSync20(at, { throwIfNoEntry: false })?.isSymbolicLink(), "Plugin registry path traverses a symlink");
+    if (at === dirname15(at))
       break;
   }
 }
 function readRegistry(path) {
   safe3(path);
-  const initial = lstatSync19(path);
+  const initial = lstatSync20(path);
   pluginNeed(initial.isFile() && initial.size <= 1024 * 1024, "Plugin registry is not a bounded regular file");
-  const fd = openSync10(path, constants9.O_RDONLY | constants9.O_NOFOLLOW | constants9.O_NONBLOCK);
+  const fd = openSync11(path, constants10.O_RDONLY | constants10.O_NOFOLLOW | constants10.O_NONBLOCK);
   try {
-    const opened = fstatSync10(fd);
+    const opened = fstatSync11(fd);
     pluginNeed(opened.isFile() && opened.ino === initial.ino && opened.dev === initial.dev, "Plugin registry changed during open");
     const bytes = Buffer.alloc(1024 * 1024 + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync8(fd, bytes, length, bytes.length - length, null);
+      const count = readSync9(fd, bytes, length, bytes.length - length, null);
       if (!count)
         break;
       length += count;
     }
-    const after = fstatSync10(fd), current = lstatSync19(path);
+    const after = fstatSync11(fd), current = lstatSync20(path);
     safe3(path);
     pluginNeed(length <= 1024 * 1024 && length === opened.size && after.size === opened.size && after.mtimeMs === opened.mtimeMs && after.ctimeMs === opened.ctimeMs && current.dev === opened.dev && current.ino === opened.ino && current.mtimeMs === opened.mtimeMs && current.ctimeMs === opened.ctimeMs, "Plugin registry changed during read");
     let value;
@@ -18183,7 +18424,7 @@ function readRegistry(path) {
     pluginNeed(pluginObject(value) && value.version === 2 && pluginObject(value.plugins), "Unsupported native plugin registry schema");
     return { value, rawDigest: pluginHash(bytes.subarray(0, length)) };
   } finally {
-    closeSync10(fd);
+    closeSync11(fd);
   }
 }
 function nativeVersionMatches(version, receipt) {
@@ -18192,7 +18433,7 @@ function nativeVersionMatches(version, receipt) {
 }
 function hashManagedPluginRegistry(path, managed) {
   validateManagedPluginWitnesses(managed);
-  const snapshot = readRegistry(path), plugins = snapshot.value.plugins;
+  const snapshot2 = readRegistry(path), plugins = snapshot2.value.plugins;
   const seen = new Set, verified = new Set;
   let verifiedBytes = 0;
   for (const witness of managed) {
@@ -18201,7 +18442,7 @@ function hashManagedPluginRegistry(path, managed) {
     seen.add(target.pluginId);
     const rows = plugins[target.pluginId];
     pluginNeed(Array.isArray(rows) && rows.length === target.registrations.length, "Managed plugin registration membership changed");
-    const [name, market] = target.pluginId.split("@"), cacheRoot = join27(dirname14(path), "cache", market, name);
+    const [name, market] = target.pluginId.split("@"), cacheRoot = join27(dirname15(path), "cache", market, name);
     const scopes = new Set, approvals = new Map, currentFiles = new Map;
     plugins[target.pluginId] = rows.map((row) => {
       pluginNeed(pluginObject(row), "Invalid managed plugin registration");
@@ -18244,7 +18485,7 @@ function hashManagedPluginRegistry(path, managed) {
       return Object.fromEntries(Object.entries(row).filter(([key]) => !["version", "installPath", "sourceProducerPath", "previousProducerPaths", "lastUpdated"].includes(key)));
     });
     safe3(cacheRoot);
-    const before = lstatSync19(cacheRoot);
+    const before = lstatSync20(cacheRoot);
     pluginNeed(before.isDirectory(), "Invalid managed plugin cache root");
     const directory = opendirSync5(cacheRoot), names = [];
     try {
@@ -18267,64 +18508,64 @@ function hashManagedPluginRegistry(path, managed) {
     }
     for (const row of rows)
       pluginNeed(names.includes(row.version), "Managed native plugin installation is missing");
-    const after = lstatSync19(cacheRoot);
+    const after = lstatSync20(cacheRoot);
     safe3(cacheRoot);
     pluginNeed(before.dev === after.dev && before.ino === after.ino && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs, "Managed cache version membership changed during verification");
   }
-  pluginNeed(readRegistry(path).rawDigest === snapshot.rawDigest, "Native plugin registry changed during content verification");
-  return pluginHash(JSON.stringify(snapshot.value));
+  pluginNeed(readRegistry(path).rawDigest === snapshot2.rawDigest, "Native plugin registry changed during content verification");
+  return pluginHash(JSON.stringify(snapshot2.value));
 }
 function captureManagedPluginRegistry(path, managedPlugins) {
   return { path, hashMode: "claude-plugin-registry", managedPlugins, sha256: hashManagedPluginRegistry(path, managedPlugins) };
 }
 
 // src/lib/claude-marketplace-registry.ts
-import { createHash as createHash15 } from "crypto";
-import { closeSync as closeSync11, constants as constants10, fstatSync as fstatSync11, lstatSync as lstatSync20, openSync as openSync11, readSync as readSync9 } from "fs";
-import { basename as basename8, dirname as dirname15, isAbsolute as isAbsolute15, resolve as resolve15 } from "path";
+import { createHash as createHash16 } from "crypto";
+import { closeSync as closeSync12, constants as constants11, fstatSync as fstatSync12, lstatSync as lstatSync21, openSync as openSync12, readSync as readSync10 } from "fs";
+import { basename as basename8, dirname as dirname16, isAbsolute as isAbsolute15, resolve as resolve15 } from "path";
 var CLAUDE_MARKETPLACE_REGISTRY_LIMITS = Object.freeze({ bytes: 1024 * 1024, rows: 1024, depth: 32, nodes: 65536, stringCharacters: 16384, pathCharacters: 4096 });
-function need5(value, reason) {
+function need6(value, reason) {
   if (!value)
     throw new Error(`Claude marketplace registry ${reason}`);
 }
 function absolutePath3(value) {
-  need5(typeof value === "string" && value.length > 0 && value.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.pathCharacters && !/[\x00-\x1f\x7f]/.test(value) && isAbsolute15(value) && resolve15(value) === value, "requires a normalized absolute path");
+  need6(typeof value === "string" && value.length > 0 && value.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.pathCharacters && !/[\x00-\x1f\x7f]/.test(value) && isAbsolute15(value) && resolve15(value) === value, "requires a normalized absolute path");
 }
 var sameFile2 = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode && a.uid === b.uid && a.gid === b.gid && a.nlink === b.nlink && a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs;
 function parents2(path) {
   const result = [];
-  for (let at = dirname15(path);; at = dirname15(at)) {
-    const stat2 = lstatSync20(at, { bigint: true });
-    need5(stat2.isDirectory() && !stat2.isSymbolicLink(), "path traverses a symlink or non-directory");
+  for (let at = dirname16(path);; at = dirname16(at)) {
+    const stat2 = lstatSync21(at, { bigint: true });
+    need6(stat2.isDirectory() && !stat2.isSymbolicLink(), "path traverses a symlink or non-directory");
     result.push([at, stat2]);
-    if (at === dirname15(at))
+    if (at === dirname16(at))
       return result;
   }
 }
 function readRegistry2(path, budget) {
   absolutePath3(path);
-  need5(basename8(path) === "known_marketplaces.json", "requires known_marketplaces.json");
-  need5(Number.isSafeInteger(budget.remaining) && budget.remaining >= 0, "has an invalid byte budget");
-  const ancestors2 = parents2(path), initial = lstatSync20(path, { bigint: true });
-  need5(initial.isFile() && !initial.isSymbolicLink() && initial.size <= BigInt(CLAUDE_MARKETPLACE_REGISTRY_LIMITS.bytes), "is not a bounded regular file");
-  need5(initial.size <= BigInt(budget.remaining), "exceeds its aggregate byte limit");
-  const fd = openSync11(path, constants10.O_RDONLY | constants10.O_NOFOLLOW | constants10.O_NONBLOCK);
+  need6(basename8(path) === "known_marketplaces.json", "requires known_marketplaces.json");
+  need6(Number.isSafeInteger(budget.remaining) && budget.remaining >= 0, "has an invalid byte budget");
+  const ancestors2 = parents2(path), initial = lstatSync21(path, { bigint: true });
+  need6(initial.isFile() && !initial.isSymbolicLink() && initial.size <= BigInt(CLAUDE_MARKETPLACE_REGISTRY_LIMITS.bytes), "is not a bounded regular file");
+  need6(initial.size <= BigInt(budget.remaining), "exceeds its aggregate byte limit");
+  const fd = openSync12(path, constants11.O_RDONLY | constants11.O_NOFOLLOW | constants11.O_NONBLOCK);
   try {
-    const opened = fstatSync11(fd, { bigint: true });
-    need5(opened.isFile() && sameFile2(initial, opened), "changed during open");
+    const opened = fstatSync12(fd, { bigint: true });
+    need6(opened.isFile() && sameFile2(initial, opened), "changed during open");
     const bytes = Buffer.alloc(Number(opened.size) + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync9(fd, bytes, length, bytes.length - length, null);
+      const count = readSync10(fd, bytes, length, bytes.length - length, null);
       if (!count)
         break;
       length += count;
     }
-    const after = fstatSync11(fd, { bigint: true }), current = lstatSync20(path, { bigint: true });
-    need5(current.isFile() && sameFile2(opened, after) && sameFile2(after, current) && BigInt(length) === opened.size, "changed during read");
+    const after = fstatSync12(fd, { bigint: true }), current = lstatSync21(path, { bigint: true });
+    need6(current.isFile() && sameFile2(opened, after) && sameFile2(after, current) && BigInt(length) === opened.size, "changed during read");
     for (const [ancestor, before] of ancestors2) {
-      const now = lstatSync20(ancestor, { bigint: true });
-      need5(now.isDirectory() && before.dev === now.dev && before.ino === now.ino && before.mode === now.mode, "parent changed during read");
+      const now = lstatSync21(ancestor, { bigint: true });
+      need6(now.isDirectory() && before.dev === now.dev && before.ino === now.ino && before.mode === now.mode, "parent changed during read");
     }
     budget.remaining -= length;
     try {
@@ -18333,7 +18574,7 @@ function readRegistry2(path, budget) {
       throw new Error("Claude marketplace registry is not strict UTF-8");
     }
   } finally {
-    closeSync11(fd);
+    closeSync12(fd);
   }
 }
 function parse6(text2) {
@@ -18344,7 +18585,7 @@ function parse6(text2) {
       at++;
   };
   function string() {
-    need5(text2[at] === '"', "contains invalid JSON");
+    need6(text2[at] === '"', "contains invalid JSON");
     const start = at++;
     while (at < text2.length) {
       const character = text2[at++];
@@ -18355,7 +18596,7 @@ function parse6(text2) {
         } catch {
           throw new Error("Claude marketplace registry contains invalid JSON string");
         }
-        need5(value2.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.stringCharacters, "exceeds its string limit");
+        need6(value2.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.stringCharacters, "exceeds its string limit");
         return value2;
       }
       if (character === "\\")
@@ -18364,7 +18605,7 @@ function parse6(text2) {
     throw new Error("Claude marketplace registry contains an unterminated JSON string");
   }
   function value(depth) {
-    need5(depth <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.depth && ++nodes <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.nodes, "exceeds its nesting or node limit");
+    need6(depth <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.depth && ++nodes <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.nodes, "exceeds its nesting or node limit");
     space();
     const character = text2[at];
     if (character === '"')
@@ -18378,17 +18619,17 @@ function parse6(text2) {
           if (object5) {
             space();
             const key = string();
-            need5(!keys.has(key), "contains a duplicate JSON key");
+            need6(!keys.has(key), "contains a duplicate JSON key");
             keys.add(key);
             space();
-            need5(text2[at++] === ":", "contains invalid JSON");
+            need6(text2[at++] === ":", "contains invalid JSON");
             entries.push([key, value(depth + 1)]);
           } else
             items.push(value(depth + 1));
           space();
           if (text2[at] === end)
             break;
-          need5(text2[at++] === ",", "contains invalid JSON");
+          need6(text2[at++] === ",", "contains invalid JSON");
         }
       at++;
       return object5 ? { kind: "object", entries } : { kind: "array", items };
@@ -18400,14 +18641,14 @@ function parse6(text2) {
       }
     numberPattern.lastIndex = at;
     const number = numberPattern.exec(text2);
-    need5(number, "contains invalid JSON");
+    need6(number, "contains invalid JSON");
     at += number[0].length;
     return { kind: "number", value: number[0] };
   }
   const root2 = value(0);
   space();
-  need5(at === text2.length && root2.kind === "object", "requires a JSON object without trailing content");
-  need5(root2.entries.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.rows, "exceeds its marketplace row limit");
+  need6(at === text2.length && root2.kind === "object", "requires a JSON object without trailing content");
+  need6(root2.entries.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.rows, "exceeds its marketplace row limit");
   return root2;
 }
 function exactKeys(value, keys) {
@@ -18415,7 +18656,7 @@ function exactKeys(value, keys) {
 }
 var field = (object5, key) => object5.entries.find(([name]) => name === key)?.[1];
 function textField(value) {
-  need5(value?.kind === "string" && value.value.length > 0 && !/[\x00-\x1f\x7f]/.test(value.value), "contains an invalid recognized field");
+  need6(value?.kind === "string" && value.value.length > 0 && !/[\x00-\x1f\x7f]/.test(value.value), "contains an invalid recognized field");
   return value.value;
 }
 function normalizeRow(row, version = 1) {
@@ -18423,7 +18664,7 @@ function normalizeRow(row, version = 1) {
     if (version !== 2 || !exactKeys(row, ["source", "installLocation", "lastUpdated", "autoUpdate"]))
       return;
     const autoUpdate = field(row, "autoUpdate");
-    need5(autoUpdate?.kind === "literal" && (autoUpdate.value === "true" || autoUpdate.value === "false"), "contains an invalid automatic-update preference");
+    need6(autoUpdate?.kind === "literal" && (autoUpdate.value === "true" || autoUpdate.value === "false"), "contains an invalid automatic-update preference");
   }
   const source = field(row, "source");
   if (source?.kind !== "object")
@@ -18439,77 +18680,29 @@ function normalizeRow(row, version = 1) {
     absolutePath3(sourceLocation);
   absolutePath3(textField(field(row, "installLocation")));
   const updated = textField(field(row, "lastUpdated"));
-  need5(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(updated), "contains an invalid recognized update timestamp");
+  need6(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(updated), "contains an invalid recognized update timestamp");
   const millis = Date.parse(updated);
-  need5(Number.isFinite(millis) && new Date(millis).toISOString() === updated, "contains an invalid recognized update timestamp");
+  need6(Number.isFinite(millis) && new Date(millis).toISOString() === updated, "contains an invalid recognized update timestamp");
   row.entries = row.entries.map(([key, value]) => [key, key === "lastUpdated" ? { kind: "validated-update-time" } : value]);
 }
 function captureClaudeMarketplaceRegistry(path, budget = { remaining: 256 * 1024 * 1024 }) {
   const value = parse6(readRegistry2(path, budget));
   for (const [, row] of value.entries)
     normalizeRow(row);
-  const sha2562 = createHash15("sha256").update("hasna.skills.claude-marketplace-registry.v1\x00").update(JSON.stringify(value)).digest("hex");
+  const sha2562 = createHash16("sha256").update("hasna.skills.claude-marketplace-registry.v1\x00").update(JSON.stringify(value)).digest("hex");
   return { path, hashMode: "claude-marketplace-registry", sha256: sha2562 };
 }
 function captureClaudeMarketplaceRegistryV2(path, budget = { remaining: 256 * 1024 * 1024 }) {
   const value = parse6(readRegistry2(path, budget));
   for (const [, row] of value.entries)
     normalizeRow(row, 2);
-  const sha2562 = createHash15("sha256").update("hasna.skills.claude-marketplace-registry.v2\x00").update(JSON.stringify(value)).digest("hex");
+  const sha2562 = createHash16("sha256").update("hasna.skills.claude-marketplace-registry.v2\x00").update(JSON.stringify(value)).digest("hex");
   return { path, hashMode: "claude-marketplace-registry-v2", sha256: sha2562 };
 }
 
 // src/lib/codex-hook-discovery-recovery.ts
 import { createHash as createHash17 } from "crypto";
 
-// src/lib/codex-hook-trust-files.ts
-import { closeSync as closeSync12, constants as constants11, fstatSync as fstatSync12, fsyncSync as fsyncSync4, lstatSync as lstatSync21, openSync as openSync12, readSync as readSync10, writeFileSync as writeFileSync7 } from "fs";
-import { createHash as createHash16 } from "crypto";
-import { dirname as dirname16 } from "path";
-function need6(value, code) {
-  if (!value)
-    throw new Error(`CODEX_HOOK_TRUST_${code}`);
-}
-var sameStat = (a, b) => ["dev", "ino", "uid", "nlink", "mode", "size", "mtimeNs", "ctimeNs"].every((key) => a[key] === b[key]);
-function safeParents(file) {
-  for (let p = dirname16(file);; p = dirname16(p)) {
-    const s = lstatSync21(p);
-    need6(s.isDirectory() && !s.isSymbolicLink(), "UNSAFE_PARENT");
-    need6((s.mode & 18) === 0 || s.uid === 0 && (s.mode & 512) !== 0, "UNSAFE_PARENT");
-    if (dirname16(p) === p)
-      break;
-  }
-}
-function snapshot(file, privateFile = false, options = {}) {
-  const readOnlyPackage = options.readOnlyPackage === true && !privateFile;
-  safeParents(file);
-  const initial = lstatSync21(file, { bigint: true });
-  need6(initial.isFile() && initial.uid === BigInt(process.getuid()) && (initial.nlink === 1n || readOnlyPackage && initial.nlink > 1n) && (initial.mode & 0o022n) === 0n && (!privateFile || (initial.mode & 0o777n) === 0o600n), "UNSAFE_FILE");
-  need6(initial.size <= 8n * 1024n * 1024n, "FILE_BOUND");
-  const fd = openSync12(file, constants11.O_RDONLY | constants11.O_NOFOLLOW | constants11.O_NONBLOCK);
-  try {
-    const before = fstatSync12(fd, { bigint: true });
-    need6(sameStat(initial, before), "INPUT_CHANGED");
-    const bytes = Buffer.alloc(Number(before.size) + 1);
-    let length = 0;
-    while (length < bytes.length) {
-      const n2 = readSync10(fd, bytes, length, bytes.length - length, null);
-      if (!n2)
-        break;
-      length += n2;
-    }
-    need6(length === Number(before.size) && sameStat(before, fstatSync12(fd, { bigint: true })) && sameStat(before, lstatSync21(file, { bigint: true })), "INPUT_CHANGED");
-    const content = bytes.subarray(0, length), text2 = new TextDecoder("utf-8", { fatal: true }).decode(content);
-    return { file, privateFile, readOnlyPackage, text: text2, bytes: content, stat: before, sha256: createHash16("sha256").update(content).digest("hex") };
-  } finally {
-    closeSync12(fd);
-  }
-}
-function unchanged2(before) {
-  const after = snapshot(before.file, before.privateFile, before.readOnlyPackage ? { readOnlyPackage: true } : {});
-  need6(sameStat(before.stat, after.stat) && after.sha256 === before.sha256, "INPUT_CHANGED");
-}
-
 // src/lib/codex-hook-additions-review.ts
 var events = { UserPromptSubmit: ["userPromptSubmit", "user_prompt_submit"], SessionStart: ["sessionStart", "session_start"], SubagentStart: ["subagentStart", "subagent_start"] };
 var matchedEvents = { ...events, PreToolUse: ["preToolUse", "pre_tool_use"] };
@@ -18521,7 +18714,7 @@ var fields = [...CODEX_DISCOVERY_PROJECTION_FIELDS];
 var proofs2 = new WeakMap;
 function assertCodexHookDiscoveryRecovery(binding, witness) {
   const proof = proofs2.get(witness);
-  need6(!!proof && binding.agent === "codex" && witness.discoverySha256 === sha4(JSON.stringify(binding)), "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
+  need5(!!proof && binding.agent === "codex" && witness.discoverySha256 === sha4(JSON.stringify(binding)), "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
   unchanged2(proof.before);
   unchanged2(proof.current);
   proof.recheckAdditions();
@@ -18530,7 +18723,7 @@ function verifiesCodexHookDiscoverySource(binding, source, currentDigest, witnes
   if (!witness || source.path !== witness.configPath || source.hashMode !== "bytes")
     return false;
   assertCodexHookDiscoveryRecovery(binding, witness);
-  need6(source.sha256 === witness.beforeSha256 && currentDigest === witness.currentSha256, "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
+  need5(source.sha256 === witness.beforeSha256 && currentDigest === witness.currentSha256, "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
   return true;
 }
 
@@ -45935,6 +46128,7 @@ export {
   planPluginAdmission,
   planClaudeStopHookUpdate,
   planClaudePreToolUseHookUpdate,
+  planClaudeManagedHookProjection,
   planClaudeHookEventsUpdate,
   planAgentSettingsWitnessUpgrade,
   planAgentIntegration,