@hasna/skills 0.10.44 → 0.10.46

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.44",
+    version: "0.10.46",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -39885,8 +39885,348 @@ var init_agent_adapters = __esm(() => {
   };
 });
 
+// src/lib/claude-settings-witness.ts
+import { createHash as createHash2 } from "crypto";
+import { closeSync, constants as constants2, fstatSync, lstatSync as lstatSync3, openSync, readSync } from "fs";
+import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute2, resolve as resolve3 } from "path";
+function need(value, reason) {
+  if (!value)
+    throw new Error(`Claude settings witness ${reason}`);
+}
+function absolutePath(value) {
+  need(typeof value === "string" && value.length > 0 && value.length <= CLAUDE_SETTINGS_WITNESS_LIMITS.pathCharacters && !/[\x00-\x1f\x7f]/.test(value) && isAbsolute2(value) && resolve3(value) === value, "requires a normalized absolute path");
+}
+function parents(path) {
+  const result2 = [];
+  for (let at2 = dirname3(path);; at2 = dirname3(at2)) {
+    const stat = lstatSync3(at2, { bigint: true });
+    need(stat.isDirectory() && !stat.isSymbolicLink(), "path traverses a symlink or non-directory");
+    result2.push([at2, stat]);
+    if (at2 === dirname3(at2))
+      return result2;
+  }
+}
+function readNativeSettingsWitnessFile(path, budget, filename = "settings.json") {
+  absolutePath(path);
+  need(basename2(path) === filename, `requires ${filename}`);
+  need(Number.isSafeInteger(budget.remaining) && budget.remaining >= 0, "has an invalid byte budget");
+  const ancestors = parents(path), initial2 = lstatSync3(path, { bigint: true });
+  need(initial2.isFile() && !initial2.isSymbolicLink() && initial2.size <= BigInt(CLAUDE_SETTINGS_WITNESS_LIMITS.bytes), "is not a bounded regular file");
+  need(initial2.size <= BigInt(budget.remaining), "exceeds its aggregate byte limit");
+  const fd = openSync(path, constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK);
+  try {
+    const opened = fstatSync(fd, { bigint: true });
+    need(opened.isFile() && sameFile(initial2, opened), "changed during open");
+    const bytes = Buffer.alloc(Number(opened.size) + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const count = readSync(fd, bytes, length, bytes.length - length, null);
+      if (!count)
+        break;
+      length += count;
+    }
+    const after2 = fstatSync(fd, { bigint: true }), current = lstatSync3(path, { bigint: true });
+    need(current.isFile() && sameFile(opened, after2) && sameFile(after2, current) && BigInt(length) === opened.size, "changed during read");
+    for (const [ancestor, before2] of ancestors) {
+      const now3 = lstatSync3(ancestor, { bigint: true });
+      need(now3.isDirectory() && before2.dev === now3.dev && before2.ino === now3.ino && before2.mode === now3.mode, "parent changed during read");
+    }
+    budget.remaining -= length;
+    try {
+      return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes.subarray(0, length));
+    } catch {
+      throw new Error("Claude settings witness is not strict UTF-8");
+    }
+  } finally {
+    closeSync(fd);
+  }
+}
+function parse(text) {
+  let at2 = 0, nodes = 0;
+  const numberPattern = /-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/y;
+  const space = () => {
+    while (at2 < text.length && /[\x20\t\r\n]/.test(text[at2]))
+      at2++;
+  };
+  function string() {
+    need(text[at2] === '"', "contains invalid JSON");
+    const start = at2++;
+    while (at2 < text.length) {
+      const character = text[at2++];
+      if (character === '"') {
+        let value2;
+        try {
+          value2 = JSON.parse(text.slice(start, at2));
+        } catch {
+          throw new Error("Claude settings witness contains invalid JSON string");
+        }
+        need(value2.length <= CLAUDE_SETTINGS_WITNESS_LIMITS.stringCharacters, "exceeds its string limit");
+        return value2;
+      }
+      if (character === "\\")
+        at2++;
+    }
+    throw new Error("Claude settings witness contains an unterminated JSON string");
+  }
+  function value(depth) {
+    need(depth <= CLAUDE_SETTINGS_WITNESS_LIMITS.depth && ++nodes <= CLAUDE_SETTINGS_WITNESS_LIMITS.nodes, "exceeds its nesting or node limit");
+    space();
+    const character = text[at2];
+    if (character === '"')
+      return { kind: "string", value: string() };
+    if (character === "{" || character === "[") {
+      at2++;
+      space();
+      const object = character === "{", end = object ? "}" : "]", entries = [], items = [], keys2 = new Set;
+      if (text[at2] !== end)
+        while (true) {
+          if (object) {
+            space();
+            const key = string();
+            need(!keys2.has(key), "contains a duplicate JSON key");
+            keys2.add(key);
+            space();
+            need(text[at2++] === ":", "contains invalid JSON");
+            entries.push([key, value(depth + 1)]);
+          } else
+            items.push(value(depth + 1));
+          space();
+          if (text[at2] === end)
+            break;
+          need(text[at2++] === ",", "contains invalid JSON");
+        }
+      at2++;
+      return object ? { kind: "object", entries } : { kind: "array", items };
+    }
+    for (const literal of ["true", "false", "null"])
+      if (text.startsWith(literal, at2)) {
+        at2 += literal.length;
+        return { kind: "literal", value: literal };
+      }
+    numberPattern.lastIndex = at2;
+    const number = numberPattern.exec(text);
+    need(number, "contains invalid JSON");
+    at2 += number[0].length;
+    return { kind: "number", value: number[0] };
+  }
+  const root = value(0);
+  space();
+  need(at2 === text.length && root.kind === "object", "requires a JSON object without trailing content");
+  need(root.entries.length <= CLAUDE_SETTINGS_WITNESS_LIMITS.rows, "exceeds its settings field limit");
+  return root;
+}
+function canonical(value) {
+  if (value.kind === "object")
+    return { kind: "object", entries: value.entries.map(([key, child]) => [key, canonical(child)]).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0) };
+  if (value.kind === "array")
+    return { kind: "array", items: value.items.map(canonical) };
+  return value;
+}
+function inferencePreference(key, child, version) {
+  if (key === "skipDangerousModePermissionPrompt") {
+    need(child.kind === "literal" && (child.value === "true" || child.value === "false"), "contains an invalid dialog acknowledgment");
+    return false;
+  }
+  if (key === "effortLevel") {
+    need(child.kind === "string" && PERSISTED_EFFORT_LEVELS.has(child.value), "contains an invalid persisted effort level");
+    return true;
+  }
+  if (key !== "modelSettings")
+    return false;
+  need(child.kind === "object", "requires an object of model preferences");
+  child.entries = child.entries.filter(([model, preferences]) => {
+    if (version === 2 && !BUILTIN_MODEL_SELECTIONS.has(model) || preferences.kind !== "object" || preferences.entries.length !== 1 || preferences.entries[0][0] !== "effortLevel")
+      return true;
+    const effort = preferences.entries[0][1];
+    need(effort.kind === "string" && PERSISTED_EFFORT_LEVELS.has(effort.value), "contains an invalid persisted model effort level");
+    return false;
+  });
+  return child.entries.length === 0;
+}
+function settingsDigest(text, version = 1) {
+  const value = parse(text);
+  value.entries = value.entries.filter(([key, child]) => {
+    if (version !== 1 && inferencePreference(key, child, version))
+      return false;
+    if (key === "model") {
+      need(child.kind === "string", "contains an invalid model selection");
+      return !BUILTIN_MODEL_SELECTIONS.has(child.value);
+    }
+    if (BOOLEAN_PREFERENCES.has(key)) {
+      need(child.kind === "literal" && (child.value === "true" || child.value === "false"), "contains an invalid display preference");
+      return false;
+    }
+    if (Object.hasOwn(ENUM_PREFERENCES, key)) {
+      need(child.kind === "string" && ENUM_PREFERENCES[key].includes(child.value), "contains an invalid display preference");
+      return false;
+    }
+    return true;
+  });
+  return createHash2("sha256").update(`hasna.skills.claude-settings.v${version}\x00`).update(JSON.stringify(canonical(value))).digest("hex");
+}
+function hashClaudeSettingsReplacement(text, budget) {
+  need(typeof text === "string", "requires settings text");
+  const bytes = Buffer.byteLength(text);
+  need(bytes <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes && Number.isSafeInteger(budget.remaining) && budget.remaining >= bytes, "exceeds its byte limit");
+  budget.remaining -= bytes;
+  return settingsDigest(text);
+}
+function captureClaudeSettings(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "claude-settings-v1", sha256: settingsDigest(readNativeSettingsWitnessFile(path, budget)) };
+}
+function captureClaudeSettingsV2(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "claude-settings-v2", sha256: settingsDigest(readNativeSettingsWitnessFile(path, budget), 2) };
+}
+function hashClaudeSettingsReplacementV2(text, budget) {
+  need(typeof text === "string", "requires settings text");
+  const bytes = Buffer.byteLength(text);
+  need(bytes <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes && Number.isSafeInteger(budget.remaining) && budget.remaining >= bytes, "exceeds its byte limit");
+  budget.remaining -= bytes;
+  return settingsDigest(text, 2);
+}
+function captureClaudeSettingsV3(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "claude-settings-v3", sha256: settingsDigest(readNativeSettingsWitnessFile(path, budget), 3) };
+}
+function hashClaudeSettingsReplacementV3(text, budget) {
+  need(typeof text === "string", "requires settings text");
+  const bytes = Buffer.byteLength(text);
+  need(bytes <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes && Number.isSafeInteger(budget.remaining) && budget.remaining >= bytes, "exceeds its byte limit");
+  budget.remaining -= bytes;
+  return settingsDigest(text, 3);
+}
+function upgradeClaudeSettingsWitness(previous, reviewedSettingsPath) {
+  need(previous && Object.keys(previous).every((key) => ["path", "hashMode", "sha256"].includes(key)) && (previous.hashMode === undefined || previous.hashMode === "bytes" || previous.hashMode === "claude-settings-v1" || previous.hashMode === "claude-settings-v2") && typeof previous.sha256 === "string" && /^[a-f0-9]{64}$/.test(previous.sha256), "requires an exact legacy settings witness");
+  const budget = { remaining: 2 * CLAUDE_SETTINGS_WITNESS_LIMITS.bytes };
+  const before2 = readNativeSettingsWitnessFile(reviewedSettingsPath, budget), current = readNativeSettingsWitnessFile(previous.path, budget);
+  const beforeDigest = previous.hashMode === undefined || previous.hashMode === "bytes" ? createHash2("sha256").update(before2).digest("hex") : settingsDigest(before2, previous.hashMode === "claude-settings-v1" ? 1 : 2);
+  need(beforeDigest === previous.sha256, "reviewed preimage does not match the legacy witness");
+  const sha256 = settingsDigest(current, 3);
+  need(settingsDigest(before2, 3) === sha256, "non-preference settings changed; explicit discovery review required");
+  return { path: previous.path, hashMode: "claude-settings-v3", sha256 };
+}
+function hashNativeJsonControls(text, excludedMetadata) {
+  need(Buffer.byteLength(text) <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes, "exceeds its byte limit");
+  const value = parse(text);
+  value.entries = value.entries.filter(([key, child]) => {
+    if (key !== excludedMetadata)
+      return true;
+    need(child.kind === "string" && child.value.length <= 128, "has invalid version metadata");
+    return false;
+  });
+  return createHash2("sha256").update("hasna.skills.native-json-controls.v1\x00").update(JSON.stringify(canonical(value))).digest("hex");
+}
+function hashSumiNativeJsonControls(text) {
+  need(Buffer.byteLength(text) <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes, "exceeds its byte limit");
+  const value = parse(text);
+  value.entries = value.entries.filter(([key, child]) => {
+    if (key === "$schema" || key === "username") {
+      need(child.kind === "string", "has invalid Sumi display metadata");
+      return false;
+    }
+    if (key !== "experimental")
+      return true;
+    need(child.kind === "object", "requires Sumi experimental controls to be an object");
+    child.entries = child.entries.filter(([name, option]) => {
+      if (name !== "statusline" && name !== "compact_tools")
+        return true;
+      need(option.kind === "literal" && (option.value === "true" || option.value === "false"), "has invalid Sumi display preference");
+      return false;
+    });
+    return child.entries.length > 0;
+  });
+  return createHash2("sha256").update("hasna.skills.sumi-settings.v1\x00").update(JSON.stringify(value)).digest("hex");
+}
+var CLAUDE_SETTINGS_WITNESS_LIMITS, sameFile = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode && a.uid === b.uid && a.gid === b.gid && a.nlink === b.nlink && a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs, BOOLEAN_PREFERENCES, ENUM_PREFERENCES, BUILTIN_MODEL_SELECTIONS, PERSISTED_EFFORT_LEVELS;
+var init_claude_settings_witness = __esm(() => {
+  CLAUDE_SETTINGS_WITNESS_LIMITS = Object.freeze({ bytes: 1024 * 1024, rows: 1024, depth: 32, nodes: 65536, stringCharacters: 16384, pathCharacters: 4096 });
+  BOOLEAN_PREFERENCES = new Set([
+    "autoScrollEnabled",
+    "axScreenReader",
+    "emojiCompletionEnabled",
+    "prefersReducedMotion",
+    "showTurnDuration",
+    "spinnerTipsEnabled",
+    "syntaxHighlightingDisabled",
+    "terminalProgressBarEnabled",
+    "terminalTitleFromRename",
+    "verbose",
+    "wheelScrollAccelerationEnabled"
+  ]);
+  ENUM_PREFERENCES = Object.freeze({
+    editorMode: ["normal", "vim"],
+    tui: ["default", "fullscreen"],
+    viewMode: ["default", "verbose", "focus"]
+  });
+  BUILTIN_MODEL_SELECTIONS = new Set([
+    "default",
+    "best",
+    "fable",
+    "fable[1m]",
+    "sonnet",
+    "sonnet[1m]",
+    "opus",
+    "opus[1m]",
+    "haiku",
+    "opusplan",
+    "claude-fable-5-1",
+    "claude-fable-5",
+    "claude-fable-5[1m]",
+    "claude-opus-5",
+    "claude-sonnet-5",
+    "claude-haiku-4-5-20251001",
+    "claude-opus-4-6",
+    "claude-sonnet-4-5",
+    "claude-sonnet-4-5-20250929",
+    "claude-opus-4-8",
+    "claude-opus-4-8[1m]",
+    "claude-opus-4-7",
+    "claude-sonnet-4-6",
+    "claude-opus-4-5-20251101",
+    "claude-opus-4-5",
+    "claude-haiku-4-5",
+    "claude-fable-5-1[1m]",
+    "claude-opus-5[1m]",
+    "claude-opus-4-7[1m]",
+    "claude-opus-4-6[1m]",
+    "claude-sonnet-4-6[1m]"
+  ]);
+  PERSISTED_EFFORT_LEVELS = new Set(["low", "medium", "high", "xhigh"]);
+});
+
+// src/lib/sumi-settings-witness.ts
+import { createHash as createHash3 } from "crypto";
+function readSumiSettingsPreimage(path) {
+  return readNativeSettingsWitnessFile(path, budget(), "sumi.json");
+}
+function hashSumiSettingsReplacement(text, limits) {
+  const bytes = Buffer.byteLength(text);
+  if (bytes > CLAUDE_SETTINGS_WITNESS_LIMITS.bytes || !Number.isSafeInteger(limits.remaining) || limits.remaining < bytes)
+    throw new Error("Sumi settings witness exceeds its byte limit");
+  limits.remaining -= bytes;
+  return hashSumiNativeJsonControls(text);
+}
+function captureSumiSettings(path, limits = budget()) {
+  return { path, hashMode: "sumi-settings-v1", sha256: hashSumiNativeJsonControls(readNativeSettingsWitnessFile(path, limits, "sumi.json")) };
+}
+function upgradeSumiSettingsWitness(previous, reviewedSettingsPath) {
+  if (!previous || Object.keys(previous).some((key) => !["path", "hashMode", "sha256"].includes(key)) || ![undefined, "bytes"].includes(previous.hashMode) || !/^[a-f0-9]{64}$/.test(previous.sha256))
+    throw new Error("Sumi settings upgrade requires one exact preserved byte witness");
+  const before2 = readSumiSettingsPreimage(reviewedSettingsPath);
+  if (createHash3("sha256").update(before2).digest("hex") !== previous.sha256)
+    throw new Error("Reviewed Sumi preimage does not match its byte witness");
+  const next = captureSumiSettings(previous.path);
+  if (hashSumiNativeJsonControls(before2) !== next.sha256)
+    throw new Error("Sumi non-display settings changed; explicit discovery review required");
+  return next;
+}
+var SUMI_DISCOVERY_PROJECTION_FIELDS, budget = () => ({ remaining: 256 * 1024 * 1024 });
+var init_sumi_settings_witness = __esm(() => {
+  init_claude_settings_witness();
+  SUMI_DISCOVERY_PROJECTION_FIELDS = ["skills", "plugin", "plugins", "permissions"];
+});
+
 // src/lib/agent-policy-limits.ts
-import { basename as basename2, isAbsolute as isAbsolute2, resolve as resolve3 } from "path";
+import { basename as basename3, isAbsolute as isAbsolute3, resolve as resolve4 } from "path";
 function object(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -39939,7 +40279,7 @@ function assertAgentPolicyCollections(policy) {
       text(control.pluginId, 1024);
       text(control.namespace, 64);
       text(control.pluginParent);
-      requireBound(isAbsolute2(control.pluginParent) && resolve3(control.pluginParent) === control.pluginParent && /^[a-f0-9]{64}$/.test(control.manifestSha256));
+      requireBound(isAbsolute3(control.pluginParent) && resolve4(control.pluginParent) === control.pluginParent && /^[a-f0-9]{64}$/.test(control.manifestSha256));
       if (control.remotePluginId !== undefined)
         requireBound(typeof control.remotePluginId === "string" && /^[A-Za-z0-9_~-]{1,1024}$/.test(control.remotePluginId));
       if (control.skillsOnly !== undefined)
@@ -39957,7 +40297,7 @@ function assertAgentPolicyCollections(policy) {
       text(control.pluginId, 1024);
       text(control.namespace, 64);
       text(control.pluginParent);
-      requireBound(!ids.has(control.pluginId) && isAbsolute2(control.pluginParent) && resolve3(control.pluginParent) === control.pluginParent && ["local", "git", "npm"].includes(control.sourceType) && typeof control.sourceSha256 === "string" && /^[a-f0-9]{64}$/.test(control.sourceSha256));
+      requireBound(!ids.has(control.pluginId) && isAbsolute3(control.pluginParent) && resolve4(control.pluginParent) === control.pluginParent && ["local", "git", "npm"].includes(control.sourceType) && typeof control.sourceSha256 === "string" && /^[a-f0-9]{64}$/.test(control.sourceSha256));
       ids.add(control.pluginId);
     }
   }
@@ -39982,15 +40322,15 @@ function assertAgentPolicyCollections(policy) {
     requireBound(object(value));
     text(value.agent, 128);
     if (value.codexRetiredMaterializations !== undefined) {
-      const proof = record(value.codexRetiredMaterializations, 3), roots = array(proof.roots, AGENT_POLICY_LIMITS.discoveryRoots), parents = proof.parents === undefined ? [] : array(proof.parents, AGENT_POLICY_LIMITS.discoveryRoots);
-      requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && Object.keys(proof).every((key) => ["roots", "parents", "directories"].includes(key)) && roots.length + parents.length > 0 && new Set(roots).size === roots.length && new Set(parents).size === parents.length);
+      const proof = record(value.codexRetiredMaterializations, 3), roots = array(proof.roots, AGENT_POLICY_LIMITS.discoveryRoots), parents2 = proof.parents === undefined ? [] : array(proof.parents, AGENT_POLICY_LIMITS.discoveryRoots);
+      requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && Object.keys(proof).every((key) => ["roots", "parents", "directories"].includes(key)) && roots.length + parents2.length > 0 && new Set(roots).size === roots.length && new Set(parents2).size === parents2.length);
       for (const root of roots) {
         text(root);
-        requireBound(isAbsolute2(root) && resolve3(root) === root);
+        requireBound(isAbsolute3(root) && resolve4(root) === root);
       }
-      for (const parent of parents) {
+      for (const parent of parents2) {
         text(parent);
-        requireBound(isAbsolute2(parent) && resolve3(parent) === parent);
+        requireBound(isAbsolute3(parent) && resolve4(parent) === parent);
       }
       for (const directory of array(proof.directories, AGENT_POLICY_LIMITS.discoveryDirectories)) {
         requireBound(object(directory));
@@ -40010,7 +40350,7 @@ function assertAgentPolicyCollections(policy) {
         text(input.namespace, 64);
         text(input.pluginParent);
         text(input.sourceRoot);
-        requireBound(!ids.has(input.pluginId) && [input.pluginParent, input.sourceRoot].every((path) => isAbsolute2(path) && resolve3(path) === path) && typeof input.sourceSha256 === "string" && /^[a-f0-9]{64}$/.test(input.sourceSha256));
+        requireBound(!ids.has(input.pluginId) && [input.pluginParent, input.sourceRoot].every((path) => isAbsolute3(path) && resolve4(path) === path) && typeof input.sourceSha256 === "string" && /^[a-f0-9]{64}$/.test(input.sourceSha256));
         ids.add(input.pluginId);
       }
       if (proof.directories !== undefined)
@@ -40027,13 +40367,15 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3", "codex-settings-v4"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3", "codex-settings-v4", "sumi-settings-v1"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "sumi-settings-v1")
+        requireBound(agent === "sumi" && value.agent === "sumi" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve4(source.path) === source.path && basename3(source.path) === "sumi.json");
       if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4"))
-        requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute2(source.path) && resolve3(source.path) === source.path && basename2(source.path) === "config.toml");
+        requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve4(source.path) === source.path && basename3(source.path) === "config.toml");
       if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3")
-        requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute2(source.path) && resolve3(source.path) === source.path && basename2(source.path) === "settings.json");
+        requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve4(source.path) === source.path && basename3(source.path) === "settings.json");
       if (source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2")
-        requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute2(source.path) && resolve3(source.path) === source.path && basename2(source.path) === "known_marketplaces.json");
+        requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve4(source.path) === source.path && basename3(source.path) === "known_marketplaces.json");
       if (source.hashMode === "claude-plugin-registry") {
         requireBound(agent === "claude");
         const managed = array(source.managedPlugins, 64);
@@ -46961,7 +47303,7 @@ var require_public_api = __commonJS((exports) => {
     }
     return doc;
   }
-  function parse(src, reviver, options) {
+  function parse2(src, reviver, options) {
     let _reviver = undefined;
     if (typeof reviver === "function") {
       _reviver = reviver;
@@ -47002,7 +47344,7 @@ var require_public_api = __commonJS((exports) => {
       return value.toString(options);
     return new Document.Document(value, _replacer, options).toString(options);
   }
-  exports.parse = parse;
+  exports.parse = parse2;
   exports.parseAllDocuments = parseAllDocuments;
   exports.parseDocument = parseDocument;
   exports.stringify = stringify;
@@ -47058,8 +47400,8 @@ var init_dist = __esm(() => {
 });
 
 // src/lib/agent-hermes.ts
-import { dirname as dirname3, isAbsolute as isAbsolute3, join as join11, resolve as resolve4 } from "path";
-import { lstatSync as lstatSync3, readFileSync as readFileSync7, opendirSync } from "fs";
+import { dirname as dirname4, isAbsolute as isAbsolute4, join as join11, resolve as resolve5 } from "path";
+import { lstatSync as lstatSync4, readFileSync as readFileSync7, opendirSync } from "fs";
 function object2(value) {
   return Boolean(value && typeof value === "object" && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null));
 }
@@ -47094,7 +47436,7 @@ function quoted(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function hermesHookDefinitions(supervisor) {
-  if (!isAbsolute3(supervisor.runtime) || !isAbsolute3(supervisor.path))
+  if (!isAbsolute4(supervisor.runtime) || !isAbsolute4(supervisor.path))
     throw new Error("Expected absolute Hermes supervisor paths");
   const entry = (event) => ({ command: `${quoted(supervisor.runtime)} ${quoted(supervisor.path)} --event ${event}`, timeout: 15, ...event === "pre_tool_call" ? { fail_closed: true } : {} });
   return { pre_llm_call: entry("pre_llm_call"), pre_tool_call: entry("pre_tool_call") };
@@ -47130,19 +47472,19 @@ function assertHermesEnvironment(home) {
       throw new Error(`NATIVE_SKILL_DRIFT: Hermes ${variable} requires a dedicated discovery adapter; unset it before using this adapter`);
   }
   const selected = process.env.HERMES_HOME?.trim();
-  if (selected && (!isAbsolute3(selected) || resolve4(selected) !== join11(resolve4(home), ".hermes")))
+  if (selected && (!isAbsolute4(selected) || resolve5(selected) !== join11(resolve5(home), ".hermes")))
     throw new Error("NATIVE_SKILL_DRIFT: custom Hermes homes/profiles require their own reviewed bridge");
   if (process.env.HERMES_ENABLE_PROJECT_PLUGINS?.trim() && !["0", "false", "no", "off"].includes(process.env.HERMES_ENABLE_PROJECT_PLUGINS.trim().toLowerCase()))
     throw new Error("NATIVE_SKILL_DRIFT: Hermes project plugins require a dedicated discovery review");
 }
 function read(path) {
-  for (let current = path;; current = dirname3(current)) {
-    if (lstatSync3(current, { throwIfNoEntry: false })?.isSymbolicLink())
+  for (let current = path;; current = dirname4(current)) {
+    if (lstatSync4(current, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error("NATIVE_SKILL_DRIFT: symlink Hermes protection input");
-    if (dirname3(current) === current)
+    if (dirname4(current) === current)
       break;
   }
-  const stat = lstatSync3(path, { throwIfNoEntry: false });
+  const stat = lstatSync4(path, { throwIfNoEntry: false });
   if (!stat)
     return null;
   if (!stat.isFile() || stat.size > 1024 * 1024)
@@ -47153,7 +47495,7 @@ function assertHermesProtection(home, config, command, profile, supervisor) {
   assertHermesEnvironment(home);
   if (read(join11(home, ".hermes", HERMES_OPT_OUT)) === null)
     throw new Error("NATIVE_SKILL_DRIFT: Hermes bundled skill reseeding is not disabled; run skills hook install");
-  if (!supervisor || !isAbsolute3(supervisor.path) || supervisor.runtime !== process.execPath || read(supervisor.path) !== renderHermesSupervisor(command, profile))
+  if (!supervisor || !isAbsolute4(supervisor.path) || supervisor.runtime !== process.execPath || read(supervisor.path) !== renderHermesSupervisor(command, profile))
     throw new Error("NATIVE_SKILL_DRIFT: Hermes owned supervisor changed; run skills hook install");
   const raw = read(join11(home, ".hermes/shell-hooks-allowlist.json"));
   let trust;
@@ -47179,16 +47521,16 @@ function assertHermesProtection(home, config, command, profile, supervisor) {
 }
 function assertNoHermesLegacyShadow(root) {
   let entries = 0;
-  for (let cursor = resolve4(root);; cursor = dirname3(cursor)) {
-    if (lstatSync3(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+  for (let cursor = resolve5(root);; cursor = dirname4(cursor)) {
+    if (lstatSync4(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error("NATIVE_SKILL_DRIFT: symlink Hermes legacy discovery root");
-    if (dirname3(cursor) === cursor)
+    if (dirname4(cursor) === cursor)
       break;
   }
   function scan(path, depth) {
     if (++entries > 1e4 || depth > 64)
       throw new Error("NATIVE_SKILL_DRIFT: Hermes legacy discovery limit exceeded; review the root before continuing");
-    const stat = lstatSync3(path, { throwIfNoEntry: false });
+    const stat = lstatSync4(path, { throwIfNoEntry: false });
     if (!stat)
       return;
     if (stat.isSymbolicLink())
@@ -47198,9 +47540,9 @@ function assertNoHermesLegacyShadow(root) {
         throw new Error("NATIVE_SKILL_DRIFT: unsupported Hermes legacy discovery input");
       return;
     }
-    if (lstatSync3(join11(path, "skills-cli.md"), { throwIfNoEntry: false }))
+    if (lstatSync4(join11(path, "skills-cli.md"), { throwIfNoEntry: false }))
       throw new Error("NATIVE_SKILL_DRIFT: legacy Hermes skills-cli.md can shadow the owned bridge; preserve and retire it before continuing");
-    const hasDescriptor = Boolean(lstatSync3(join11(path, "SKILL.md"), { throwIfNoEntry: false }));
+    const hasDescriptor = Boolean(lstatSync4(join11(path, "SKILL.md"), { throwIfNoEntry: false }));
     const directory = opendirSync(path);
     try {
       for (let child = directory.readSync();child; child = directory.readSync()) {
@@ -47281,189 +47623,189 @@ var init_agent_hermes = __esm(() => {
 });
 
 // src/lib/agent-discovery-directories.ts
-import { createHash as createHash2 } from "crypto";
-import { lstatSync as lstatSync4, opendirSync as opendirSync2 } from "fs";
-import { dirname as dirname4, isAbsolute as isAbsolute4, join as join12, resolve as resolve5 } from "path";
-function need(value, message) {
+import { createHash as createHash4 } from "crypto";
+import { lstatSync as lstatSync5, opendirSync as opendirSync2 } from "fs";
+import { dirname as dirname5, isAbsolute as isAbsolute5, join as join12, resolve as resolve6 } from "path";
+function need2(value, message) {
   if (!value)
     throw new Error(message);
 }
 function safe(path) {
-  need(typeof path === "string" && path.length <= AGENT_POLICY_LIMITS.pathCharacters && isAbsolute4(path) && resolve5(path) === path && !path.includes("\x00"), "Expected a canonical absolute discovery directory path");
-  for (let cursor = path;; cursor = dirname4(cursor)) {
-    need(!lstatSync4(cursor, { throwIfNoEntry: false })?.isSymbolicLink(), "Refusing symlink native discovery directory");
-    if (dirname4(cursor) === cursor)
+  need2(typeof path === "string" && path.length <= AGENT_POLICY_LIMITS.pathCharacters && isAbsolute5(path) && resolve6(path) === path && !path.includes("\x00"), "Expected a canonical absolute discovery directory path");
+  for (let cursor = path;; cursor = dirname5(cursor)) {
+    need2(!lstatSync5(cursor, { throwIfNoEntry: false })?.isSymbolicLink(), "Refusing symlink native discovery directory");
+    if (dirname5(cursor) === cursor)
       break;
   }
 }
 function same(before2, after2) {
   return Boolean(after2 && after2.isDirectory() && before2.dev === after2.dev && before2.ino === after2.ino && before2.mtimeMs === after2.mtimeMs && before2.ctimeMs === after2.ctimeMs);
 }
-function capture(path, budget, excludedRoots, omittedRoots = [], rows) {
+function capture(path, budget2, excludedRoots, omittedRoots = [], rows) {
   safe(path);
   if (omittedRoots.some((root2) => path === root2 || path.startsWith(root2 + "/")))
     return { path, sha256: null };
-  const root = lstatSync4(path, { throwIfNoEntry: false });
+  const root = lstatSync5(path, { throwIfNoEntry: false });
   if (!root)
     return { path, sha256: null };
-  need(root.isDirectory(), "Unsupported native discovery directory input");
-  const hash = createHash2("sha256");
+  need2(root.isDirectory(), "Unsupported native discovery directory input");
+  const hash = createHash4("sha256");
   function walk(current, relative2, before2, depth) {
-    need(depth <= 64, "Native discovery directory depth limit exceeded");
+    need2(depth <= 64, "Native discovery directory depth limit exceeded");
     const names = [], directory = opendirSync2(current);
     try {
       for (let entry = directory.readSync();entry; entry = directory.readSync()) {
-        need(++budget.entries <= AGENT_POLICY_LIMITS.discoveryDirectoryEntries, "Native discovery directory entry limit exceeded");
+        need2(++budget2.entries <= AGENT_POLICY_LIMITS.discoveryDirectoryEntries, "Native discovery directory entry limit exceeded");
         names.push(entry.name);
       }
     } finally {
       directory.closeSync();
     }
-    need(new Set(names).size === names.length, "Ambiguous native discovery directory names");
+    need2(new Set(names).size === names.length, "Ambiguous native discovery directory names");
     for (const name of names.sort()) {
       const child = join12(current, name), childRelative = relative2 ? `${relative2}/${name}` : name;
       if (omittedRoots.includes(child))
         continue;
-      need(child.length <= AGENT_POLICY_LIMITS.pathCharacters, "Native discovery directory path limit exceeded");
-      const stat = lstatSync4(child);
-      need(stat.isFile() || stat.isDirectory(), "Refusing symlink or special native discovery directory member");
+      need2(child.length <= AGENT_POLICY_LIMITS.pathCharacters, "Native discovery directory path limit exceeded");
+      const stat = lstatSync5(child);
+      need2(stat.isFile() || stat.isDirectory(), "Refusing symlink or special native discovery directory member");
       const row = JSON.stringify([childRelative, stat.isDirectory() ? "directory" : "file"]) + `
 `;
-      budget.bytes += Buffer.byteLength(row);
-      need(budget.bytes <= AGENT_POLICY_LIMITS.discoveryDirectoryBytes, "Native discovery directory metadata limit exceeded");
+      budget2.bytes += Buffer.byteLength(row);
+      need2(budget2.bytes <= AGENT_POLICY_LIMITS.discoveryDirectoryBytes, "Native discovery directory metadata limit exceeded");
       hash.update(row);
       rows?.push(row);
       if (stat.isDirectory() && !excludedRoots.includes(child))
         walk(child, childRelative, stat, depth + 1);
     }
-    need(same(before2, lstatSync4(current, { throwIfNoEntry: false })), "Native discovery directory changed while reading");
+    need2(same(before2, lstatSync5(current, { throwIfNoEntry: false })), "Native discovery directory changed while reading");
   }
   walk(path, "", root, 0);
   safe(path);
   return { path, sha256: hash.digest("hex") };
 }
 function captureDiscoveryDirectoryProjection(paths, omittedRoots) {
-  need(Array.isArray(paths) && paths.length <= AGENT_POLICY_LIMITS.discoveryDirectories && new Set(paths).size === paths.length, "Invalid projected discovery directory collection");
-  need(omittedRoots.length <= AGENT_POLICY_LIMITS.discoveryRoots && new Set(omittedRoots).size === omittedRoots.length, "Invalid inactive discovery roots");
+  need2(Array.isArray(paths) && paths.length <= AGENT_POLICY_LIMITS.discoveryDirectories && new Set(paths).size === paths.length, "Invalid projected discovery directory collection");
+  need2(omittedRoots.length <= AGENT_POLICY_LIMITS.discoveryRoots && new Set(omittedRoots).size === omittedRoots.length, "Invalid inactive discovery roots");
   for (const root of omittedRoots)
     safe(root);
-  const budget = { entries: 0, bytes: 0 };
+  const budget2 = { entries: 0, bytes: 0 };
   return paths.map((path) => {
     const entries = [];
-    return { ...capture(path, budget, [], omittedRoots, entries), entries };
+    return { ...capture(path, budget2, [], omittedRoots, entries), entries };
   });
 }
 function verifyDiscoveryDirectoryProjection(directories, omittedRoots) {
-  need(directories.length <= AGENT_POLICY_LIMITS.discoveryDirectories, "Invalid projected discovery directory collection");
+  need2(directories.length <= AGENT_POLICY_LIMITS.discoveryDirectories, "Invalid projected discovery directory collection");
   let count = 0, bytes = 0;
   const expected = directories.map((directory) => {
     safe(directory.path);
-    need(Array.isArray(directory.entries), "Missing reviewed directory membership inventory");
-    const hash = createHash2("sha256");
+    need2(Array.isArray(directory.entries), "Missing reviewed directory membership inventory");
+    const hash = createHash4("sha256");
     const kept = [];
     for (const row of directory.entries) {
-      need(typeof row === "string" && ++count <= AGENT_POLICY_LIMITS.discoveryDirectoryEntries, "Invalid reviewed directory membership rows");
+      need2(typeof row === "string" && ++count <= AGENT_POLICY_LIMITS.discoveryDirectoryEntries, "Invalid reviewed directory membership rows");
       bytes += Buffer.byteLength(row);
-      need(bytes <= AGENT_POLICY_LIMITS.discoveryDirectoryBytes, "Reviewed directory membership byte limit exceeded");
+      need2(bytes <= AGENT_POLICY_LIMITS.discoveryDirectoryBytes, "Reviewed directory membership byte limit exceeded");
       const value = JSON.parse(row);
-      need(Array.isArray(value) && value.length === 2 && typeof value[0] === "string" && value[0] && !isAbsolute4(value[0]) && !value[0].split("/").some((part) => !part || part === "." || part === "..") && ["file", "directory"].includes(value[1]) && row === JSON.stringify(value) + `
+      need2(Array.isArray(value) && value.length === 2 && typeof value[0] === "string" && value[0] && !isAbsolute5(value[0]) && !value[0].split("/").some((part) => !part || part === "." || part === "..") && ["file", "directory"].includes(value[1]) && row === JSON.stringify(value) + `
 `, "Invalid reviewed directory member");
       hash.update(row);
       const path = join12(directory.path, value[0]);
       if (!omittedRoots.some((root) => path === root || path.startsWith(root + "/")))
         kept.push(row);
     }
-    need(directory.sha256 === null ? directory.entries.length === 0 : hash.digest("hex") === directory.sha256, "Reviewed directory inventory does not match its fingerprint");
+    need2(directory.sha256 === null ? directory.entries.length === 0 : hash.digest("hex") === directory.sha256, "Reviewed directory inventory does not match its fingerprint");
     const absent = omittedRoots.some((root) => directory.path === root || directory.path.startsWith(root + "/"));
-    return { path: directory.path, sha256: absent || directory.sha256 === null ? null : createHash2("sha256").update(kept.join("")).digest("hex") };
+    return { path: directory.path, sha256: absent || directory.sha256 === null ? null : createHash4("sha256").update(kept.join("")).digest("hex") };
   });
   const current = captureDiscoveryDirectoryProjection(directories.map((item) => item.path), omittedRoots);
-  need(current.every((item, index) => item.sha256 === expected[index].sha256), "Native discovery directory membership changed outside retired Codex roots");
+  need2(current.every((item, index) => item.sha256 === expected[index].sha256), "Native discovery directory membership changed outside retired Codex roots");
 }
 function captureDiscoveryDirectories(paths, excludedRoots = []) {
-  need(Array.isArray(paths) && paths.length <= AGENT_POLICY_LIMITS.discoveryDirectories && new Set(paths).size === paths.length, "Invalid native discovery directory collection");
-  const budget = { entries: 0, bytes: 0 };
+  need2(Array.isArray(paths) && paths.length <= AGENT_POLICY_LIMITS.discoveryDirectories && new Set(paths).size === paths.length, "Invalid native discovery directory collection");
+  const budget2 = { entries: 0, bytes: 0 };
   for (const root of excludedRoots)
     safe(root);
-  return paths.map((path) => capture(path, budget, excludedRoots));
+  return paths.map((path) => capture(path, budget2, excludedRoots));
 }
 function verifyDiscoveryDirectories(directories, excludedRoots = []) {
-  need(Array.isArray(directories) && directories.length <= AGENT_POLICY_LIMITS.discoveryDirectories, "Invalid native discovery directory collection");
+  need2(Array.isArray(directories) && directories.length <= AGENT_POLICY_LIMITS.discoveryDirectories, "Invalid native discovery directory collection");
   for (const directory of directories)
-    need(directory && typeof directory === "object" && (directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256)), "Invalid native discovery directory digest");
+    need2(directory && typeof directory === "object" && (directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256)), "Invalid native discovery directory digest");
   const current = captureDiscoveryDirectories(directories.map((directory) => directory.path), excludedRoots);
   for (let i = 0;i < directories.length; i++)
-    need(current[i].sha256 === directories[i].sha256, `Native discovery directory membership changed; run skills hook install with a fresh discovery review: ${directories[i].path}`);
+    need2(current[i].sha256 === directories[i].sha256, `Native discovery directory membership changed; run skills hook install with a fresh discovery review: ${directories[i].path}`);
 }
 var init_agent_discovery_directories = __esm(() => {
   init_agent_policy_limits();
 });
 
 // src/lib/agent-discovery-bytes.ts
-import { createHash as createHash3 } from "crypto";
-import { closeSync, constants as constants2, fstatSync, lstatSync as lstatSync5, openSync, readSync } from "fs";
-import { dirname as dirname5, isAbsolute as isAbsolute5, resolve as resolve6 } from "path";
+import { createHash as createHash5 } from "crypto";
+import { closeSync as closeSync2, constants as constants3, fstatSync as fstatSync2, lstatSync as lstatSync6, openSync as openSync2, readSync as readSync2 } from "fs";
+import { dirname as dirname6, isAbsolute as isAbsolute6, resolve as resolve7 } from "path";
 function discoveryByteBudget() {
   return { remaining: AGENT_POLICY_LIMITS.discoveryRawTotalBytes };
 }
 function safe2(path) {
-  if (typeof path !== "string" || !isAbsolute5(path) || path !== resolve6(path) || path.length > AGENT_POLICY_LIMITS.pathCharacters || path.includes("\x00"))
+  if (typeof path !== "string" || !isAbsolute6(path) || path !== resolve7(path) || path.length > AGENT_POLICY_LIMITS.pathCharacters || path.includes("\x00"))
     throw new Error("Expected a canonical absolute raw discovery path");
-  for (let cursor = path;; cursor = dirname5(cursor)) {
-    if (lstatSync5(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+  for (let cursor = path;; cursor = dirname6(cursor)) {
+    if (lstatSync6(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error("Refusing symlink raw discovery input");
-    if (dirname5(cursor) === cursor)
+    if (dirname6(cursor) === cursor)
       break;
   }
 }
 function same2(left, right) {
   return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs;
 }
-function consume(budget, bytes) {
-  if (bytes > budget.remaining)
+function consume(budget2, bytes) {
+  if (bytes > budget2.remaining)
     throw new Error("Raw discovery aggregate byte limit exceeded");
-  budget.remaining -= bytes;
+  budget2.remaining -= bytes;
 }
-function hashRawDiscoveryFile(path, budget, changes) {
+function hashRawDiscoveryFile(path, budget2, changes) {
   safe2(path);
   if (changes?.has(path)) {
     const text2 = changes.get(path), bytes = Buffer.byteLength(text2);
     if (bytes > AGENT_POLICY_LIMITS.discoveryRawSourceBytes)
       throw new Error("Raw discovery file byte limit exceeded");
-    consume(budget, bytes);
-    return createHash3("sha256").update(text2).digest("hex");
+    consume(budget2, bytes);
+    return createHash5("sha256").update(text2).digest("hex");
   }
-  const initial2 = lstatSync5(path, { throwIfNoEntry: false });
+  const initial2 = lstatSync6(path, { throwIfNoEntry: false });
   if (!initial2)
     return null;
   if (!initial2.isFile() || initial2.size > AGENT_POLICY_LIMITS.discoveryRawSourceBytes)
     throw new Error("Unsupported or oversized raw discovery input");
-  if (initial2.size > budget.remaining)
+  if (initial2.size > budget2.remaining)
     throw new Error("Raw discovery aggregate byte limit exceeded");
-  const fd = openSync(path, constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK);
+  const fd = openSync2(path, constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK);
   try {
-    const opened = fstatSync(fd);
+    const opened = fstatSync2(fd);
     if (!opened.isFile() || !same2(initial2, opened))
       throw new Error("Raw discovery input changed during open");
-    const hash = createHash3("sha256"), buffer = Buffer.alloc(64 * 1024);
+    const hash = createHash5("sha256"), buffer = Buffer.alloc(64 * 1024);
     let bytes = 0;
     while (true) {
-      const count = readSync(fd, buffer, 0, Math.min(buffer.length, AGENT_POLICY_LIMITS.discoveryRawSourceBytes - bytes + 1), null);
+      const count = readSync2(fd, buffer, 0, Math.min(buffer.length, AGENT_POLICY_LIMITS.discoveryRawSourceBytes - bytes + 1), null);
       if (!count)
         break;
       bytes += count;
       if (bytes > AGENT_POLICY_LIMITS.discoveryRawSourceBytes)
         throw new Error("Raw discovery file byte limit exceeded");
-      consume(budget, count);
+      consume(budget2, count);
       hash.update(buffer.subarray(0, count));
     }
-    const final = fstatSync(fd), current = lstatSync5(path, { throwIfNoEntry: false });
+    const final = fstatSync2(fd), current = lstatSync6(path, { throwIfNoEntry: false });
     safe2(path);
     if (!current?.isFile() || !same2(opened, final) || !same2(final, current) || bytes !== final.size)
       throw new Error("Raw discovery input changed during read");
     return hash.digest("hex");
   } finally {
-    closeSync(fd);
+    closeSync2(fd);
   }
 }
 var init_agent_discovery_bytes = __esm(() => {
@@ -47471,9 +47813,9 @@ var init_agent_discovery_bytes = __esm(() => {
 });
 
 // src/lib/agent-discovery-path-bytes.ts
-import { createHash as createHash4 } from "crypto";
-import { lstatSync as lstatSync6, readlinkSync } from "fs";
-import { dirname as dirname6, isAbsolute as isAbsolute6, join as join13, parse, resolve as resolve7, sep as sep2 } from "path";
+import { createHash as createHash6 } from "crypto";
+import { lstatSync as lstatSync7, readlinkSync } from "fs";
+import { dirname as dirname7, isAbsolute as isAbsolute7, join as join13, parse as parse2, resolve as resolve8, sep as sep2 } from "path";
 function identity3(stat, mutable = false) {
   return {
     dev: String(stat.dev),
@@ -47484,14 +47826,14 @@ function identity3(stat, mutable = false) {
     ...mutable ? { size: String(stat.size), mtimeNs: String(stat.mtimeNs), ctimeNs: String(stat.ctimeNs) } : {}
   };
 }
-function canonical(path) {
-  if (typeof path !== "string" || !isAbsolute6(path) || path !== resolve7(path) || path.length > AGENT_POLICY_LIMITS.pathCharacters || path.includes("\x00") || Buffer.from(path).toString("utf8") !== path)
+function canonical2(path) {
+  if (typeof path !== "string" || !isAbsolute7(path) || path !== resolve8(path) || path.length > AGENT_POLICY_LIMITS.pathCharacters || path.includes("\x00") || Buffer.from(path).toString("utf8") !== path)
     throw new Error("Expected a canonical absolute discovery path");
 }
 function trace(path) {
-  canonical(path);
+  canonical2(path);
   const rows = [], paths = [];
-  let metadataBytes = 0, steps = 0, links = 0, cursor = parse(path).root, pending = path.slice(cursor.length).split(sep2);
+  let metadataBytes = 0, steps = 0, links = 0, cursor = parse2(path).root, pending = path.slice(cursor.length).split(sep2);
   function record2(path2, row) {
     const value = { path: path2, ...row };
     metadataBytes += Buffer.byteLength(JSON.stringify(value));
@@ -47501,7 +47843,7 @@ function trace(path) {
     paths.push(path2);
   }
   function root() {
-    const stat = lstatSync6(cursor, { bigint: true });
+    const stat = lstatSync7(cursor, { bigint: true });
     if (!stat.isDirectory())
       throw new Error("Unsupported discovery path root");
     record2(cursor, { type: "directory", ...identity3(stat) });
@@ -47514,13 +47856,13 @@ function trace(path) {
     if (!component || component === ".")
       continue;
     if (component === "..") {
-      cursor = dirname6(cursor);
+      cursor = dirname7(cursor);
       continue;
     }
     const candidate = join13(cursor, component);
     if (candidate.length > AGENT_POLICY_LIMITS.pathCharacters)
       throw new Error("Discovery resolved path length limit exceeded");
-    const stat = lstatSync6(candidate, { bigint: true, throwIfNoEntry: false });
+    const stat = lstatSync7(candidate, { bigint: true, throwIfNoEntry: false });
     if (!stat) {
       record2(candidate, { type: "missing", remaining: pending });
       return { rows, paths, file: null, missing: candidate, metadataBytes };
@@ -47528,17 +47870,17 @@ function trace(path) {
     if (stat.isSymbolicLink()) {
       if (++links > AGENT_POLICY_LIMITS.discoveryPathLinks || stat.size > BigInt(AGENT_POLICY_LIMITS.pathCharacters))
         throw new Error("Discovery path link limit exceeded");
-      const rawTarget = readlinkSync(candidate, { encoding: "buffer" }), target = rawTarget.toString("utf8"), after2 = lstatSync6(candidate, { bigint: true });
+      const rawTarget = readlinkSync(candidate, { encoding: "buffer" }), target = rawTarget.toString("utf8"), after2 = lstatSync7(candidate, { bigint: true });
       if (!rawTarget.equals(Buffer.from(target, "utf8")))
         throw new Error("Unsupported non-UTF8 discovery link target");
       if (!target || target.includes("\x00") || Buffer.byteLength(target) > AGENT_POLICY_LIMITS.pathCharacters || !after2.isSymbolicLink() || JSON.stringify(identity3(stat, true)) !== JSON.stringify(identity3(after2, true)))
         throw new Error("Discovery link changed during read");
       record2(candidate, { type: "link", target, ...identity3(stat, true) });
-      if (isAbsolute6(target)) {
-        cursor = parse(target).root;
+      if (isAbsolute7(target)) {
+        cursor = parse2(target).root;
         root();
       }
-      const remainder = isAbsolute6(target) ? target.slice(parse(target).root.length) : target;
+      const remainder = isAbsolute7(target) ? target.slice(parse2(target).root.length) : target;
       pending = [...remainder.split(sep2), ...pending];
       if (pending.length + steps > AGENT_POLICY_LIMITS.discoveryPathSteps)
         throw new Error("Discovery path step limit exceeded");
@@ -47558,7 +47900,7 @@ function trace(path) {
   }
   throw new Error("Unsupported directory discovery path input");
 }
-function hashDiscoveryPathFile(path, budget, changes) {
+function hashDiscoveryPathFile(path, budget2, changes) {
   const before2 = trace(path);
   let createsMissingPath = false;
   if (before2.missing !== null && changes) {
@@ -47571,17 +47913,17 @@ function hashDiscoveryPathFile(path, budget, changes) {
   }
   if (createsMissingPath || changes?.has(path) || before2.paths.some((path2) => changes?.has(path2)))
     throw new Error("Discovery path witness intersects a planned write; use bytes mode for owned configuration");
-  const remaining = budget.pathMetadataRemaining ?? AGENT_POLICY_LIMITS.discoveryPathTotalMetadataBytes;
+  const remaining = budget2.pathMetadataRemaining ?? AGENT_POLICY_LIMITS.discoveryPathTotalMetadataBytes;
   if (before2.metadataBytes > remaining)
     throw new Error("Discovery path aggregate metadata limit exceeded");
-  budget.pathMetadataRemaining = remaining - before2.metadataBytes;
-  const content = before2.file === null ? null : hashRawDiscoveryFile(before2.file, budget);
+  budget2.pathMetadataRemaining = remaining - before2.metadataBytes;
+  const content = before2.file === null ? null : hashRawDiscoveryFile(before2.file, budget2);
   if (before2.file !== null && content === null)
     throw new Error("Discovery path input changed during read");
   const after2 = trace(path);
   if (JSON.stringify(before2.rows) !== JSON.stringify(after2.rows) || before2.file !== after2.file)
     throw new Error("Discovery path input changed during read");
-  return createHash4("sha256").update(JSON.stringify({ version: 1, path, rows: before2.rows, content })).digest("hex");
+  return createHash6("sha256").update(JSON.stringify({ version: 1, path, rows: before2.rows, content })).digest("hex");
 }
 var init_agent_discovery_path_bytes = __esm(() => {
   init_agent_policy_limits();
@@ -47589,7 +47931,7 @@ var init_agent_discovery_path_bytes = __esm(() => {
 });
 
 // src/lib/skill-bundle.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { readFileSync as readFileSync8, readdirSync as readdirSync4, statSync as statSync5 } from "fs";
 import { join as join14, relative as relative2 } from "path";
 import { createGunzip } from "zlib";
@@ -47621,7 +47963,7 @@ function ownBytes(view) {
   return out;
 }
 function sha256Hex(bytes) {
-  return createHash5("sha256").update(bytes).digest("hex");
+  return createHash7("sha256").update(bytes).digest("hex");
 }
 function collectSkillBundleEntries(dir) {
   const entries = [];
@@ -47850,7 +48192,7 @@ async function inspectSkillBundle(bundle, options = {}) {
       parser2.push(chunk2);
       bytesSinceYield += chunk2.byteLength;
       if (bytesSinceYield >= 256 * 1024) {
-        await new Promise((resolve8) => setTimeout(resolve8, 0));
+        await new Promise((resolve9) => setTimeout(resolve9, 0));
         bytesSinceYield = 0;
         check();
       }
@@ -48210,21 +48552,21 @@ var init_profile_limits = __esm(() => {
 });
 
 // src/lib/selection-cache.ts
-import { createHash as createHash6, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash8, randomUUID as randomUUID3 } from "crypto";
 import { spawnSync } from "child_process";
-import { closeSync as closeSync2, constants as constants3, fstatSync as fstatSync2, fsyncSync, linkSync, lstatSync as lstatSync7, mkdirSync as mkdirSync3, openSync as openSync2, readFileSync as readFileSync9, readlinkSync as readlinkSync2, readSync as readSync2, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { closeSync as closeSync3, constants as constants4, fstatSync as fstatSync3, fsyncSync, linkSync, lstatSync as lstatSync8, mkdirSync as mkdirSync3, openSync as openSync3, readFileSync as readFileSync9, readlinkSync as readlinkSync2, readSync as readSync3, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
 import { hostname } from "os";
-import { dirname as dirname7, join as join15, parse as parse2, resolve as resolve8 } from "path";
+import { dirname as dirname8, join as join15, parse as parse3, resolve as resolve9 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 function selectionCacheRoot(options = {}) {
-  return resolve8(options.cacheDir ?? join15(getDataDirReadOnly(), "selection-cache"));
+  return resolve9(options.cacheDir ?? join15(getDataDirReadOnly(), "selection-cache"));
 }
 function selectionKey(selection) {
   validateSelection(selection);
   return hash([selection.authority, selection.workspaceId, selection.slug, selection.version, selection.bundleDigest]);
 }
 function hash(value) {
-  return createHash6("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash8("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function validateSelection(selection) {
   if (!selection || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(selection.slug) || !isValidSkillVersion(selection.version) || !/^sha256:[a-f0-9]{64}$/.test(selection.bundleDigest) || typeof selection.workspaceId !== "string" || !selection.workspaceId.trim() || typeof selection.profileRevision !== "string" || !selection.profileRevision.trim()) {
@@ -48264,14 +48606,14 @@ function selectionBundlePath(selection, options = {}) {
   return join15(selectionCacheRoot(options), "objects", hash(selection.authority), hash(selection.workspaceId), `${selection.bundleDigest.slice(7)}.tar.gz`);
 }
 function assertRegularPath(path, createParents = false) {
-  const absolute = resolve8(path);
-  const root = parse2(absolute).root;
+  const absolute = resolve9(path);
+  const root = parse3(absolute).root;
   let cursor = root;
   const segments = absolute.slice(root.length).split("/");
   for (let index = 0;index < segments.length; index++) {
     cursor = join15(cursor, segments[index]);
     try {
-      const stat = lstatSync7(cursor);
+      const stat = lstatSync8(cursor);
       if (stat.isSymbolicLink() || index < segments.length - 1 && !stat.isDirectory()) {
         throw new SkillSelectionError("UNSAFE_CACHE_PATH", "Skills cache paths must not traverse symlinks or non-directories.");
       }
@@ -48287,20 +48629,20 @@ function readRegularFile(path, limit) {
   assertRegularPath(path);
   let fd;
   try {
-    fd = openSync2(path, constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK);
+    fd = openSync3(path, constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
   } catch (error) {
     if (error.code === "ENOENT")
       return null;
     throw error;
   }
   try {
-    const stat = fstatSync2(fd);
+    const stat = fstatSync3(fd);
     if (!stat.isFile() || stat.size > limit)
       throw new SkillSelectionError("INVALID_CACHE_FILE", "The Skills cache contains an invalid or oversized file.");
     const bytes = Buffer.alloc(stat.size + 1);
     let size2 = 0;
     while (size2 < bytes.length) {
-      const read2 = readSync2(fd, bytes, size2, bytes.length - size2, null);
+      const read2 = readSync3(fd, bytes, size2, bytes.length - size2, null);
       if (!read2)
         break;
       size2 += read2;
@@ -48309,7 +48651,7 @@ function readRegularFile(path, limit) {
       throw new SkillSelectionError("INVALID_CACHE_FILE", "The Skills cache file grew during its bounded read.");
     return bytes.subarray(0, size2);
   } finally {
-    closeSync2(fd);
+    closeSync3(fd);
   }
 }
 function writeSelectionJson(path, value) {
@@ -48321,19 +48663,19 @@ function writeSelectionJson(path, value) {
 }
 function atomicWrite(path, bytes, mode, durable = false) {
   assertRegularPath(path, true);
-  const temporary = join15(dirname7(path), `.selection-${randomUUID3()}.tmp`);
+  const temporary = join15(dirname8(path), `.selection-${randomUUID3()}.tmp`);
   try {
-    const fd = openSync2(temporary, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, mode);
+    const fd = openSync3(temporary, constants4.O_WRONLY | constants4.O_CREAT | constants4.O_EXCL | constants4.O_NOFOLLOW, mode);
     try {
       writeFileSync3(fd, bytes);
       if (durable)
         fsyncSync(fd);
     } finally {
-      closeSync2(fd);
+      closeSync3(fd);
     }
     renameSync(temporary, path);
     if (durable)
-      syncDirectory(dirname7(path));
+      syncDirectory(dirname8(path));
   } finally {
     try {
       unlinkSync(temporary);
@@ -48443,7 +48785,7 @@ function assertFreshCachedProfile(receipt, options = {}) {
   }
 }
 function projectSelectionLockPath(projectDir) {
-  return join15(resolve8(projectDir), ".skills", SELECTION_LOCK_FILE);
+  return join15(resolve9(projectDir), ".skills", SELECTION_LOCK_FILE);
 }
 function readProjectSelection(projectDir) {
   const receipt = readSelectionJson(projectSelectionLockPath(projectDir));
@@ -48557,14 +48899,14 @@ function localLockIdentity() {
 }
 function readSessionLock(sessionId, options) {
   const path = `${sessionReceiptPath(sessionId, options)}.write-lock`;
-  const before2 = lstatSync7(path, { throwIfNoEntry: false });
+  const before2 = lstatSync8(path, { throwIfNoEntry: false });
   if (!before2)
     return null;
   if (!before2.isFile() || ![1, 2].includes(before2.nlink) || (before2.mode & 63) !== 0 || process.getuid && before2.uid !== process.getuid()) {
     throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock is not a private regular file; recovery requires review.");
   }
   const bytes = readRegularFile(path, SESSION_LOCK_MAX_BYTES);
-  const after2 = lstatSync7(path, { throwIfNoEntry: false });
+  const after2 = lstatSync8(path, { throwIfNoEntry: false });
   if (!bytes || !after2?.isFile() || before2.dev !== after2.dev || before2.ino !== after2.ino || before2.mtimeMs !== after2.mtimeMs || before2.mode !== after2.mode || before2.uid !== after2.uid || before2.gid !== after2.gid || before2.nlink !== after2.nlink) {
     throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock changed during inspection; recovery requires review.");
   }
@@ -48581,7 +48923,7 @@ function readSessionLock(sessionId, options) {
   if (after2.nlink === 2) {
     stagingPath = `${path}.${marker.operationId}.prepared`;
     assertRegularPath(stagingPath);
-    const staged = lstatSync7(stagingPath, { throwIfNoEntry: false });
+    const staged = lstatSync8(stagingPath, { throwIfNoEntry: false });
     if (marker.publication !== "hard-link-v1" || !staged?.isFile() || staged.dev !== after2.dev || staged.ino !== after2.ino || staged.nlink !== 2 || staged.mode !== after2.mode || staged.uid !== after2.uid || staged.gid !== after2.gid) {
       throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock has an unbound publication link; recovery requires review.");
     }
@@ -48592,33 +48934,33 @@ function publishSessionLock(path, marker) {
   const stagingPath = `${path}.${marker.operationId}.prepared`;
   const bytes = Buffer.from(`${JSON.stringify({ ...marker, publication: "hard-link-v1" })}
 `);
-  const fd = openSync2(stagingPath, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
-  const stat = fstatSync2(fd);
+  const fd = openSync3(stagingPath, constants4.O_WRONLY | constants4.O_CREAT | constants4.O_EXCL | constants4.O_NOFOLLOW, 384);
+  const stat = fstatSync3(fd);
   let published = false, handedOff = false;
   try {
     writeFileSync3(fd, bytes);
     fsyncSync(fd);
     linkSync(stagingPath, path);
     published = true;
-    syncDirectory(dirname7(path));
-    const staged = lstatSync7(stagingPath);
+    syncDirectory(dirname8(path));
+    const staged = lstatSync8(stagingPath);
     if (!staged.isFile() || staged.dev !== stat.dev || staged.ino !== stat.ino) {
       throw new SkillSelectionError("SESSION_WRITE_LOCK_CHANGED", "The initialized lock staging inode changed before publication completed.");
     }
     unlinkSync(stagingPath);
-    syncDirectory(dirname7(path));
+    syncDirectory(dirname8(path));
     handedOff = true;
     return { path, stagingPath, fd, dev: stat.dev, ino: stat.ino };
   } finally {
     if (!handedOff) {
       try {
         for (const target of [...published ? [path] : [], stagingPath]) {
-          const current = lstatSync7(target, { throwIfNoEntry: false });
+          const current = lstatSync8(target, { throwIfNoEntry: false });
           if (current?.isFile() && current.dev === stat.dev && current.ino === stat.ino)
             unlinkSync(target);
         }
       } finally {
-        closeSync2(fd);
+        closeSync3(fd);
       }
     }
   }
@@ -48667,25 +49009,25 @@ function archiveSessionLock(lock, receipt, explicitLocalHost) {
   const guardPath = `${lock.path}.recovery-guard`;
   let guardFd;
   try {
-    guardFd = openSync2(guardPath, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
+    guardFd = openSync3(guardPath, constants4.O_WRONLY | constants4.O_CREAT | constants4.O_EXCL | constants4.O_NOFOLLOW, 384);
   } catch (error) {
     if (error.code === "EEXIST")
       return null;
     throw error;
   }
-  const guardStat = fstatSync2(guardFd);
+  const guardStat = fstatSync3(guardFd);
   try {
     writeFileSync3(guardFd, `${JSON.stringify({ schemaVersion: 1, pid: process.pid, operationId: randomUUID3() })}
 `);
     fsyncSync(guardFd);
-    const cacheOptions = { cacheDir: dirname7(dirname7(lock.path)) };
+    const cacheOptions = { cacheDir: dirname8(dirname8(lock.path)) };
     const current = readSessionLock(lock.marker.sessionId, cacheOptions);
     if (!current || current.dev !== lock.dev || current.ino !== lock.ino || current.sha256 !== lock.sha256 || current.mtimeMs !== lock.mtimeMs || !writerIsGone(current, explicitLocalHost))
       return null;
     const currentReceipt = readSkillSessionSnapshotIfExists(lock.marker.sessionId, cacheOptions);
     if (currentReceipt?.sha256 !== receipt?.sha256 || currentReceipt?.generation !== receipt?.generation)
       return null;
-    const directory = join15(dirname7(dirname7(lock.path)), "session-lock-recoveries", randomUUID3());
+    const directory = join15(dirname8(dirname8(lock.path)), "session-lock-recoveries", randomUUID3());
     const archivePath = join15(directory, "original.write-lock");
     const recordPath = join15(directory, "recovery.json");
     assertRegularPath(archivePath, true);
@@ -48702,7 +49044,7 @@ function archiveSessionLock(lock, receipt, explicitLocalHost) {
     })}
 `));
     syncDirectory(directory);
-    syncDirectory(dirname7(directory));
+    syncDirectory(dirname8(directory));
     const finalLock = readSessionLock(lock.marker.sessionId, cacheOptions);
     if (!finalLock || finalLock.dev !== lock.dev || finalLock.ino !== lock.ino || finalLock.sha256 !== lock.sha256 || readSkillSessionSnapshotIfExists(lock.marker.sessionId, cacheOptions)?.sha256 !== receipt?.sha256)
       return null;
@@ -48717,11 +49059,11 @@ function archiveSessionLock(lock, receipt, explicitLocalHost) {
         archivedPaths.push(publicationPath);
       }
       syncDirectory(directory);
-      syncDirectory(dirname7(lock.path));
+      syncDirectory(dirname8(lock.path));
       for (const path of archivedPaths) {
-        const before2 = lstatSync7(path, { throwIfNoEntry: false });
+        const before2 = lstatSync8(path, { throwIfNoEntry: false });
         const bytes = readRegularFile(path, SESSION_LOCK_MAX_BYTES);
-        const after2 = lstatSync7(path, { throwIfNoEntry: false });
+        const after2 = lstatSync8(path, { throwIfNoEntry: false });
         if (!before2?.isFile() || before2.dev !== lock.dev || before2.ino !== lock.ino || before2.nlink !== archivedPaths.length || before2.mtimeMs !== lock.mtimeMs || (before2.mode & 63) !== 0 || process.getuid && before2.uid !== process.getuid() || !bytes || sha256Hex(bytes) !== lock.sha256 || !after2?.isFile() || before2.dev !== after2.dev || before2.ino !== after2.ino || before2.mtimeMs !== after2.mtimeMs || before2.mode !== after2.mode || before2.uid !== after2.uid || before2.gid !== after2.gid || before2.nlink !== after2.nlink) {
           throw new Error("Archived lock ownership or bytes changed");
         }
@@ -48733,8 +49075,8 @@ function archiveSessionLock(lock, receipt, explicitLocalHost) {
     }
     return archivePath;
   } finally {
-    closeSync2(guardFd);
-    const current = lstatSync7(guardPath, { throwIfNoEntry: false });
+    closeSync3(guardFd);
+    const current = lstatSync8(guardPath, { throwIfNoEntry: false });
     if (current?.isFile() && current.dev === guardStat.dev && current.ino === guardStat.ino)
       unlinkSync(guardPath);
   }
@@ -48756,7 +49098,7 @@ function withSessionWriteLocks(sessionIds, options, action) {
   const owned = [];
   const assertOwned = () => {
     for (const lock of owned) {
-      const current = lstatSync7(lock.path, { throwIfNoEntry: false });
+      const current = lstatSync8(lock.path, { throwIfNoEntry: false });
       if (!current?.isFile() || current.dev !== lock.dev || current.ino !== lock.ino) {
         throw new SkillSelectionError("SESSION_WRITE_LOCK_CHANGED", "A session write lock changed during the operation; no replacement is permitted.");
       }
@@ -48800,12 +49142,12 @@ function withSessionWriteLocks(sessionIds, options, action) {
     for (const lock of owned.reverse()) {
       try {
         for (const path of [lock.path, lock.stagingPath]) {
-          const current = lstatSync7(path, { throwIfNoEntry: false });
+          const current = lstatSync8(path, { throwIfNoEntry: false });
           if (current?.isFile() && current.dev === lock.dev && current.ino === lock.ino)
             unlinkSync(path);
         }
       } finally {
-        closeSync2(lock.fd);
+        closeSync3(lock.fd);
       }
     }
   }
@@ -48856,21 +49198,21 @@ function writeSkillSession(receipt, expected, options = {}) {
 }
 function syncDirectory(path) {
   assertRegularPath(path);
-  const fd = openSync2(path, constants3.O_RDONLY | constants3.O_DIRECTORY | constants3.O_NOFOLLOW);
+  const fd = openSync3(path, constants4.O_RDONLY | constants4.O_DIRECTORY | constants4.O_NOFOLLOW);
   try {
     fsyncSync(fd);
   } finally {
-    closeSync2(fd);
+    closeSync3(fd);
   }
 }
 function archiveBytes(path, bytes) {
   assertRegularPath(path, true);
-  const fd = openSync2(path, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
+  const fd = openSync3(path, constants4.O_WRONLY | constants4.O_CREAT | constants4.O_EXCL | constants4.O_NOFOLLOW, 384);
   try {
     writeFileSync3(fd, bytes);
     fsyncSync(fd);
   } finally {
-    closeSync2(fd);
+    closeSync3(fd);
   }
 }
 function replaceSkillSession(expected, replacement, plan, options = {}, beforeCommit = () => {}) {
@@ -48897,7 +49239,7 @@ function replaceSkillSession(expected, replacement, plan, options = {}, beforeCo
     archiveBytes(receiptPath, Buffer.from(`${JSON.stringify(receipt)}
 `));
     syncDirectory(directory);
-    syncDirectory(dirname7(directory));
+    syncDirectory(dirname8(directory));
     syncDirectory(selectionCacheRoot(options));
     if (sha256Hex(readRegularFile(archivePath, MAX_PROFILE_DOCUMENT_BYTES)) !== before2.sha256 || !sameSnapshot(readSkillSessionSnapshot(replacement.sessionId, options), expected)) {
       throw new SkillSelectionError("SESSION_RECEIPT_CHANGED", "The session or its preservation archive changed before replacement; retained evidence must be reviewed.");
@@ -48937,12 +49279,12 @@ import { spawnSync as spawnSync2 } from "child_process";
 import { closeSync as closeSync22, fstatSync as fstatSync22, openSync as openSync22, readFileSync as readFileSync22 } from "fs";
 import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";
 import { hostname as osHostname } from "os";
-import { isAbsolute as isAbsolute7, join as join22 } from "path";
+import { isAbsolute as isAbsolute8, join as join22 } from "path";
 import { createRequire } from "module";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { closeSync as closeSync3, fstatSync as fstatSync3, lstatSync as lstatSync8, openSync as openSync3, readFileSync as readFileSync10, realpathSync as realpathSync2, statSync as statSync6 } from "fs";
+import { closeSync as closeSync4, fstatSync as fstatSync4, lstatSync as lstatSync9, openSync as openSync4, readFileSync as readFileSync10, realpathSync as realpathSync2, statSync as statSync6 } from "fs";
 import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
-import { basename as basename3, dirname as dirname8, join as join16, relative as relative3, sep as sep3 } from "path";
+import { basename as basename4, dirname as dirname9, join as join16, relative as relative3, sep as sep3 } from "path";
 import { fileURLToPath, pathToFileURL } from "url";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
@@ -49017,15 +49359,15 @@ function o(e2, r2, t2) {
 }
 function entryPoint(directory) {
   const root = realpathSync2(directory);
-  const fd = openSync3(join16(root, "package.json"), O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+  const fd = openSync4(join16(root, "package.json"), O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
   let pkg;
   try {
-    const stat = fstatSync3(fd);
+    const stat = fstatSync4(fd);
     if (!stat.isFile() || stat.size > MAX_PACKAGE_BYTES)
       throw new Error("Invalid Secrets package metadata");
     pkg = JSON.parse(readFileSync10(fd, "utf8"));
   } finally {
-    closeSync3(fd);
+    closeSync4(fd);
   }
   if (!pkg || typeof pkg !== "object" || !("name" in pkg) || pkg.name !== PACKAGE) {
     throw new Error("Invalid Secrets package identity");
@@ -49045,13 +49387,13 @@ function entryPoint(directory) {
   return pathToFileURL(file).href;
 }
 function resolveInstalledSecrets(parentUrl) {
-  let directory = dirname8(fileURLToPath(parentUrl));
+  let directory = dirname9(fileURLToPath(parentUrl));
   for (;; ) {
-    if (basename3(directory) !== "node_modules") {
+    if (basename4(directory) !== "node_modules") {
       const candidate = join16(directory, "node_modules", PACKAGE);
       let absent = false;
       try {
-        lstatSync8(candidate);
+        lstatSync9(candidate);
       } catch (error) {
         if (error.code !== "ENOENT")
           throw error;
@@ -49060,7 +49402,7 @@ function resolveInstalledSecrets(parentUrl) {
       if (!absent)
         return entryPoint(candidate);
     }
-    const parent = dirname8(directory);
+    const parent = dirname9(directory);
     if (parent === directory)
       throw new Error("Secrets SDK is not installed for this consumer");
     directory = parent;
@@ -49072,7 +49414,7 @@ function homeDir(env3) {
 }
 function absoluteOverride(env3, key) {
   const value = env3[key]?.trim();
-  return value && isAbsolute7(value) ? value : null;
+  return value && isAbsolute8(value) ? value : null;
 }
 function hasnaHomeDir(env3) {
   const override = absoluteOverride(env3, HASNA_HOME_ENV_KEY);
@@ -49768,7 +50110,7 @@ function selectedCliSkillsCredentialProfile() {
 var cliCredentialProfile;
 
 // src/lib/instance-credentials.ts
-import { closeSync as closeSync4, constants as constants4, fstatSync as fstatSync4, lstatSync as lstatSync9, openSync as openSync4, readSync as readSync3 } from "fs";
+import { closeSync as closeSync5, constants as constants5, fstatSync as fstatSync5, lstatSync as lstatSync10, openSync as openSync5, readSync as readSync4 } from "fs";
 function selectedSkillsProfile(env3, explicit) {
   const selected = explicit ?? selectedCliSkillsCredentialProfile() ?? env3.HASNA_PROFILE;
   if (selected === undefined)
@@ -49783,7 +50125,7 @@ function skillsProfileCredentialFiles(env3, explicit) {
 }
 function fileIdentity(file) {
   try {
-    return lstatSync9(file);
+    return lstatSync10(file);
   } catch (error) {
     if (["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
       return null;
@@ -49804,14 +50146,14 @@ function captureSkillsCredentialFiles(files) {
 function readMetadataText(file) {
   let fd;
   try {
-    fd = openSync4(file, constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
+    fd = openSync5(file, constants5.O_RDONLY | constants5.O_NOFOLLOW | constants5.O_NONBLOCK);
   } catch (error) {
     if (["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
       return null;
     throw new Error("Cannot safely read Skills instance configuration");
   }
   try {
-    const before2 = fstatSync4(fd);
+    const before2 = fstatSync5(fd);
     const uid = process.getuid?.() ?? process.geteuid?.();
     if (!before2.isFile() || ![256, 384].includes(before2.mode & 4095) || uid !== undefined && before2.uid !== uid || before2.size > 64 * 1024) {
       throw new Error("Unsafe Skills instance configuration; expected a bounded owner-only regular file");
@@ -49819,17 +50161,17 @@ function readMetadataText(file) {
     const bytes = Buffer.alloc(64 * 1024 + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync3(fd, bytes, length, bytes.length - length, null);
+      const count = readSync4(fd, bytes, length, bytes.length - length, null);
       if (!count)
         break;
       length += count;
     }
-    if (length > 64 * 1024 || !unchanged(before2, fstatSync4(fd)) || !unchanged(before2, fileIdentity(file))) {
+    if (length > 64 * 1024 || !unchanged(before2, fstatSync5(fd)) || !unchanged(before2, fileIdentity(file))) {
       throw new Error("Skills instance configuration changed while reading");
     }
     return bytes.subarray(0, length).toString("utf8");
   } finally {
-    closeSync4(fd);
+    closeSync5(fd);
   }
 }
 function readSkillsInstanceMetadata(file) {
@@ -50336,7 +50678,7 @@ __export(exports_remote_files, {
   decodeRemoteFiles: () => decodeRemoteFiles,
   MAX_REMOTE_FILE_BYTES: () => MAX_REMOTE_FILE_BYTES
 });
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 function describeRemoteFiles(files) {
   if (files.length > 10)
     throw new Error("At most 10 input files are supported");
@@ -50353,7 +50695,7 @@ function describeRemoteFiles(files) {
   });
 }
 function sha256(bytes) {
-  return createHash7("sha256").update(bytes).digest("hex");
+  return createHash9("sha256").update(bytes).digest("hex");
 }
 async function readBoundedResponse(response, maximum) {
   if (!Number.isSafeInteger(maximum) || maximum < 0 || maximum > MAX_REMOTE_FILE_BYTES)
@@ -50608,11 +50950,11 @@ function capturePreparationProcess(child, platform2 = process.platform, signalGr
 }
 
 // src/lib/dependency-preparation.ts
-import { constants as constants5, closeSync as closeSync5, fstatSync as fstatSync5, lstatSync as lstatSync10, mkdirSync as mkdirSync4, openSync as openSync5, readFileSync as readFileSync11, readdirSync as readdirSync5, rmdirSync, unlinkSync as unlinkSync2, ftruncateSync, writeSync } from "fs";
+import { constants as constants6, closeSync as closeSync6, fstatSync as fstatSync6, lstatSync as lstatSync11, mkdirSync as mkdirSync4, openSync as openSync6, readFileSync as readFileSync11, readdirSync as readdirSync5, rmdirSync, unlinkSync as unlinkSync2, ftruncateSync, writeSync } from "fs";
 import { join as join17 } from "path";
 function hasDependencyPreparationMarker(skillPath) {
   try {
-    lstatSync10(join17(skillPath, DEPENDENCY_PREPARATION_MARKER));
+    lstatSync11(join17(skillPath, DEPENDENCY_PREPARATION_MARKER));
     return true;
   } catch (error) {
     return error.code !== "ENOENT";
@@ -50631,21 +50973,21 @@ function claimPreparation(skillPath) {
   }
   let fd;
   try {
-    if (!lstatSync10(marker).isDirectory() || lstatSync10(marker).isSymbolicLink())
+    if (!lstatSync11(marker).isDirectory() || lstatSync11(marker).isSymbolicLink())
       return;
     if (!created) {
       if (readdirSync5(marker).some((name) => name !== "state.json"))
         return;
-      if (!lstatSync10(state).isFile() || lstatSync10(state).isSymbolicLink() || lstatSync10(state).size > 1024)
+      if (!lstatSync11(state).isFile() || lstatSync11(state).isSymbolicLink() || lstatSync11(state).size > 1024)
         return;
       const previous = JSON.parse(readFileSync11(state, "utf8"));
       if (previous.version !== 1 || previous.status !== "failed" || Object.keys(previous).length !== 2)
         return;
     }
     mkdirSync4(active, { mode: 448 });
-    fd = openSync5(state, constants5.O_RDWR | constants5.O_NOFOLLOW | (created ? constants5.O_CREAT | constants5.O_EXCL : 0), 384);
-    if (!fstatSync5(fd).isFile()) {
-      closeSync5(fd);
+    fd = openSync6(state, constants6.O_RDWR | constants6.O_NOFOLLOW | (created ? constants6.O_CREAT | constants6.O_EXCL : 0), 384);
+    if (!fstatSync6(fd).isFile()) {
+      closeSync6(fd);
       return;
     }
     const descriptor = fd;
@@ -50657,7 +50999,7 @@ function claimPreparation(skillPath) {
     record2("pending");
     return { abandon() {
       try {
-        closeSync5(descriptor);
+        closeSync6(descriptor);
       } catch {}
     }, finish(success) {
       try {
@@ -50665,7 +51007,7 @@ function claimPreparation(skillPath) {
           unlinkSync2(state);
         else
           record2("failed");
-        closeSync5(descriptor);
+        closeSync6(descriptor);
         fd = undefined;
         rmdirSync(active);
         if (success)
@@ -50673,7 +51015,7 @@ function claimPreparation(skillPath) {
         return true;
       } catch {
         try {
-          closeSync5(descriptor);
+          closeSync6(descriptor);
         } catch {}
         return false;
       }
@@ -50681,7 +51023,7 @@ function claimPreparation(skillPath) {
   } catch {
     if (fd !== undefined)
       try {
-        closeSync5(fd);
+        closeSync6(fd);
       } catch {}
     return;
   }
@@ -50774,32 +51116,32 @@ var init_dependency_preparation = () => {};
 // src/lib/codex-corpus-write.ts
 import { KernelLock } from "@hasna/contracts/kernel-lock";
 import { execFileSync } from "child_process";
-import { createHash as createHash8 } from "crypto";
-import { accessSync, constants as constants6, lstatSync as lstatSync11, readFileSync as readFileSync12, realpathSync as realpathSync3, statSync as statSync7 } from "fs";
-import { basename as basename4, delimiter, dirname as dirname9, isAbsolute as isAbsolute8, join as join18, relative as relative4, resolve as resolve9, sep as sep4 } from "path";
+import { createHash as createHash10 } from "crypto";
+import { accessSync, constants as constants7, lstatSync as lstatSync12, readFileSync as readFileSync12, realpathSync as realpathSync3, statSync as statSync7 } from "fs";
+import { basename as basename5, delimiter, dirname as dirname10, isAbsolute as isAbsolute9, join as join18, relative as relative4, resolve as resolve10, sep as sep4 } from "path";
 function physicalTarget(path) {
   const suffix = [];
-  for (let cursor = path;; cursor = dirname9(cursor)) {
+  for (let cursor = path;; cursor = dirname10(cursor)) {
     try {
       return join18(realpathSync3(cursor), ...suffix);
     } catch (error) {
-      if (error.code !== "ENOENT" || cursor === dirname9(cursor))
+      if (error.code !== "ENOENT" || cursor === dirname10(cursor))
         throw error;
       try {
-        if (lstatSync11(cursor).isSymbolicLink())
+        if (lstatSync12(cursor).isSymbolicLink())
           fail2();
       } catch (statError) {
         if (statError.code !== "ENOENT")
           throw statError;
       }
-      suffix.unshift(basename4(cursor));
+      suffix.unshift(basename5(cursor));
     }
   }
 }
 function codexCorpusRootForPath(path) {
-  const target = resolve9(path), physical = physicalTarget(target);
+  const target = resolve10(path), physical = physicalTarget(target);
   const selected = process.env.CODEX_HOME;
-  const selectedRoots = selected && isAbsolute8(selected) ? [resolve9(selected), physicalTarget(resolve9(selected))] : [];
+  const selectedRoots = selected && isAbsolute9(selected) ? [resolve10(selected), physicalTarget(resolve10(selected))] : [];
   const classify = (candidate) => {
     const checked = (root2) => {
       if (candidate === root2 || candidate === join18(root2, `${KEY}.flock-v1`))
@@ -50808,10 +51150,10 @@ function codexCorpusRootForPath(path) {
     };
     for (const root2 of selectedRoots) {
       const distance = relative4(root2, candidate);
-      if (distance === "" || !distance.startsWith(`..${sep4}`) && distance !== ".." && !isAbsolute8(distance))
+      if (distance === "" || !distance.startsWith(`..${sep4}`) && distance !== ".." && !isAbsolute9(distance))
         return checked(root2);
     }
-    for (let cursor = candidate;cursor !== dirname9(cursor); cursor = dirname9(cursor)) {
+    for (let cursor = candidate;cursor !== dirname10(cursor); cursor = dirname10(cursor)) {
       if (cursor.endsWith(`${sep4}.codex`))
         return checked(cursor);
     }
@@ -50823,7 +51165,7 @@ function codexCorpusRootForPath(path) {
   return root;
 }
 function identity4(path) {
-  const stat = lstatSync11(path, { bigint: true });
+  const stat = lstatSync12(path, { bigint: true });
   return { device: String(stat.dev), inode: String(stat.ino) };
 }
 function sameIdentity(value, expected) {
@@ -50837,12 +51179,12 @@ function executable(options) {
   if (typeof command !== "string" || !command || command.includes("\x00") || options.codexSha256 !== undefined && !/^[a-f0-9]{64}$/.test(options.codexSha256))
     return fail2();
   let found;
-  if (isAbsolute8(command))
+  if (isAbsolute9(command))
     found = command;
   else if (!command.includes(sep4)) {
-    found = (process.env.PATH ?? "").split(delimiter).filter(isAbsolute8).map((dir) => join18(dir, command)).find((candidate) => {
+    found = (process.env.PATH ?? "").split(delimiter).filter(isAbsolute9).map((dir) => join18(dir, command)).find((candidate) => {
       try {
-        accessSync(candidate, constants6.X_OK);
+        accessSync(candidate, constants7.X_OK);
         return true;
       } catch {
         return false;
@@ -50854,7 +51196,7 @@ function executable(options) {
   const path = realpathSync3(found), initial2 = statSync7(path, { bigint: true });
   if (!initial2.isFile() || (initial2.mode & 0o022n) !== 0n || (initial2.mode & 0o111n) === 0n || initial2.uid !== BigInt(process.getuid()) && initial2.uid !== 0n)
     return fail2();
-  const hash2 = () => createHash8("sha256").update(readFileSync12(path)).digest("hex");
+  const hash2 = () => createHash10("sha256").update(readFileSync12(path)).digest("hex");
   const digest = hash2();
   if (options.codexSha256 && digest !== options.codexSha256)
     return fail2();
@@ -50878,7 +51220,7 @@ function acquireCodexCorpusWrite(roots, options) {
     }
   };
   try {
-    if (roots.some((root) => typeof root !== "string" || !isAbsolute8(root) || root.includes("\x00")))
+    if (roots.some((root) => typeof root !== "string" || !isAbsolute9(root) || root.includes("\x00")))
       fail2();
     const inputs = [...new Set(roots)].map((input) => ({ input, root: realpathSync3(input) })).sort((a, b) => a.root.localeCompare(b.root));
     for (const { input, root } of inputs) {
@@ -51011,293 +51353,6 @@ function isCodexLocalStdioMcpServer(name, server) {
   }
 }
 
-// src/lib/claude-settings-witness.ts
-import { createHash as createHash9 } from "crypto";
-import { closeSync as closeSync6, constants as constants7, fstatSync as fstatSync6, lstatSync as lstatSync12, openSync as openSync6, readSync as readSync4 } from "fs";
-import { basename as basename5, dirname as dirname10, isAbsolute as isAbsolute9, resolve as resolve10 } from "path";
-function need2(value, reason) {
-  if (!value)
-    throw new Error(`Claude settings witness ${reason}`);
-}
-function absolutePath(value) {
-  need2(typeof value === "string" && value.length > 0 && value.length <= CLAUDE_SETTINGS_WITNESS_LIMITS.pathCharacters && !/[\x00-\x1f\x7f]/.test(value) && isAbsolute9(value) && resolve10(value) === value, "requires a normalized absolute path");
-}
-function parents(path) {
-  const result2 = [];
-  for (let at2 = dirname10(path);; at2 = dirname10(at2)) {
-    const stat = lstatSync12(at2, { bigint: true });
-    need2(stat.isDirectory() && !stat.isSymbolicLink(), "path traverses a symlink or non-directory");
-    result2.push([at2, stat]);
-    if (at2 === dirname10(at2))
-      return result2;
-  }
-}
-function readNativeSettingsWitnessFile(path, budget, filename = "settings.json") {
-  absolutePath(path);
-  need2(basename5(path) === filename, `requires ${filename}`);
-  need2(Number.isSafeInteger(budget.remaining) && budget.remaining >= 0, "has an invalid byte budget");
-  const ancestors = parents(path), initial2 = lstatSync12(path, { bigint: true });
-  need2(initial2.isFile() && !initial2.isSymbolicLink() && initial2.size <= BigInt(CLAUDE_SETTINGS_WITNESS_LIMITS.bytes), "is not a bounded regular file");
-  need2(initial2.size <= BigInt(budget.remaining), "exceeds its aggregate byte limit");
-  const fd = openSync6(path, constants7.O_RDONLY | constants7.O_NOFOLLOW | constants7.O_NONBLOCK);
-  try {
-    const opened = fstatSync6(fd, { bigint: true });
-    need2(opened.isFile() && sameFile(initial2, opened), "changed during open");
-    const bytes = Buffer.alloc(Number(opened.size) + 1);
-    let length = 0;
-    while (length < bytes.length) {
-      const count = readSync4(fd, bytes, length, bytes.length - length, null);
-      if (!count)
-        break;
-      length += count;
-    }
-    const after2 = fstatSync6(fd, { bigint: true }), current = lstatSync12(path, { bigint: true });
-    need2(current.isFile() && sameFile(opened, after2) && sameFile(after2, current) && BigInt(length) === opened.size, "changed during read");
-    for (const [ancestor, before2] of ancestors) {
-      const now3 = lstatSync12(ancestor, { bigint: true });
-      need2(now3.isDirectory() && before2.dev === now3.dev && before2.ino === now3.ino && before2.mode === now3.mode, "parent changed during read");
-    }
-    budget.remaining -= length;
-    try {
-      return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes.subarray(0, length));
-    } catch {
-      throw new Error("Claude settings witness is not strict UTF-8");
-    }
-  } finally {
-    closeSync6(fd);
-  }
-}
-function parse3(text2) {
-  let at2 = 0, nodes = 0;
-  const numberPattern = /-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/y;
-  const space = () => {
-    while (at2 < text2.length && /[\x20\t\r\n]/.test(text2[at2]))
-      at2++;
-  };
-  function string() {
-    need2(text2[at2] === '"', "contains invalid JSON");
-    const start = at2++;
-    while (at2 < text2.length) {
-      const character = text2[at2++];
-      if (character === '"') {
-        let value2;
-        try {
-          value2 = JSON.parse(text2.slice(start, at2));
-        } catch {
-          throw new Error("Claude settings witness contains invalid JSON string");
-        }
-        need2(value2.length <= CLAUDE_SETTINGS_WITNESS_LIMITS.stringCharacters, "exceeds its string limit");
-        return value2;
-      }
-      if (character === "\\")
-        at2++;
-    }
-    throw new Error("Claude settings witness contains an unterminated JSON string");
-  }
-  function value(depth) {
-    need2(depth <= CLAUDE_SETTINGS_WITNESS_LIMITS.depth && ++nodes <= CLAUDE_SETTINGS_WITNESS_LIMITS.nodes, "exceeds its nesting or node limit");
-    space();
-    const character = text2[at2];
-    if (character === '"')
-      return { kind: "string", value: string() };
-    if (character === "{" || character === "[") {
-      at2++;
-      space();
-      const object4 = character === "{", end = object4 ? "}" : "]", entries = [], items = [], keys2 = new Set;
-      if (text2[at2] !== end)
-        while (true) {
-          if (object4) {
-            space();
-            const key = string();
-            need2(!keys2.has(key), "contains a duplicate JSON key");
-            keys2.add(key);
-            space();
-            need2(text2[at2++] === ":", "contains invalid JSON");
-            entries.push([key, value(depth + 1)]);
-          } else
-            items.push(value(depth + 1));
-          space();
-          if (text2[at2] === end)
-            break;
-          need2(text2[at2++] === ",", "contains invalid JSON");
-        }
-      at2++;
-      return object4 ? { kind: "object", entries } : { kind: "array", items };
-    }
-    for (const literal of ["true", "false", "null"])
-      if (text2.startsWith(literal, at2)) {
-        at2 += literal.length;
-        return { kind: "literal", value: literal };
-      }
-    numberPattern.lastIndex = at2;
-    const number = numberPattern.exec(text2);
-    need2(number, "contains invalid JSON");
-    at2 += number[0].length;
-    return { kind: "number", value: number[0] };
-  }
-  const root = value(0);
-  space();
-  need2(at2 === text2.length && root.kind === "object", "requires a JSON object without trailing content");
-  need2(root.entries.length <= CLAUDE_SETTINGS_WITNESS_LIMITS.rows, "exceeds its settings field limit");
-  return root;
-}
-function canonical2(value) {
-  if (value.kind === "object")
-    return { kind: "object", entries: value.entries.map(([key, child]) => [key, canonical2(child)]).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0) };
-  if (value.kind === "array")
-    return { kind: "array", items: value.items.map(canonical2) };
-  return value;
-}
-function inferencePreference(key, child, version) {
-  if (key === "skipDangerousModePermissionPrompt") {
-    need2(child.kind === "literal" && (child.value === "true" || child.value === "false"), "contains an invalid dialog acknowledgment");
-    return false;
-  }
-  if (key === "effortLevel") {
-    need2(child.kind === "string" && PERSISTED_EFFORT_LEVELS.has(child.value), "contains an invalid persisted effort level");
-    return true;
-  }
-  if (key !== "modelSettings")
-    return false;
-  need2(child.kind === "object", "requires an object of model preferences");
-  child.entries = child.entries.filter(([model, preferences]) => {
-    if (version === 2 && !BUILTIN_MODEL_SELECTIONS.has(model) || preferences.kind !== "object" || preferences.entries.length !== 1 || preferences.entries[0][0] !== "effortLevel")
-      return true;
-    const effort = preferences.entries[0][1];
-    need2(effort.kind === "string" && PERSISTED_EFFORT_LEVELS.has(effort.value), "contains an invalid persisted model effort level");
-    return false;
-  });
-  return child.entries.length === 0;
-}
-function settingsDigest(text2, version = 1) {
-  const value = parse3(text2);
-  value.entries = value.entries.filter(([key, child]) => {
-    if (version !== 1 && inferencePreference(key, child, version))
-      return false;
-    if (key === "model") {
-      need2(child.kind === "string", "contains an invalid model selection");
-      return !BUILTIN_MODEL_SELECTIONS.has(child.value);
-    }
-    if (BOOLEAN_PREFERENCES.has(key)) {
-      need2(child.kind === "literal" && (child.value === "true" || child.value === "false"), "contains an invalid display preference");
-      return false;
-    }
-    if (Object.hasOwn(ENUM_PREFERENCES, key)) {
-      need2(child.kind === "string" && ENUM_PREFERENCES[key].includes(child.value), "contains an invalid display preference");
-      return false;
-    }
-    return true;
-  });
-  return createHash9("sha256").update(`hasna.skills.claude-settings.v${version}\x00`).update(JSON.stringify(canonical2(value))).digest("hex");
-}
-function hashClaudeSettingsReplacement(text2, budget) {
-  need2(typeof text2 === "string", "requires settings text");
-  const bytes = Buffer.byteLength(text2);
-  need2(bytes <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes && Number.isSafeInteger(budget.remaining) && budget.remaining >= bytes, "exceeds its byte limit");
-  budget.remaining -= bytes;
-  return settingsDigest(text2);
-}
-function captureClaudeSettings(path, budget = { remaining: 256 * 1024 * 1024 }) {
-  return { path, hashMode: "claude-settings-v1", sha256: settingsDigest(readNativeSettingsWitnessFile(path, budget)) };
-}
-function captureClaudeSettingsV2(path, budget = { remaining: 256 * 1024 * 1024 }) {
-  return { path, hashMode: "claude-settings-v2", sha256: settingsDigest(readNativeSettingsWitnessFile(path, budget), 2) };
-}
-function hashClaudeSettingsReplacementV2(text2, budget) {
-  need2(typeof text2 === "string", "requires settings text");
-  const bytes = Buffer.byteLength(text2);
-  need2(bytes <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes && Number.isSafeInteger(budget.remaining) && budget.remaining >= bytes, "exceeds its byte limit");
-  budget.remaining -= bytes;
-  return settingsDigest(text2, 2);
-}
-function captureClaudeSettingsV3(path, budget = { remaining: 256 * 1024 * 1024 }) {
-  return { path, hashMode: "claude-settings-v3", sha256: settingsDigest(readNativeSettingsWitnessFile(path, budget), 3) };
-}
-function hashClaudeSettingsReplacementV3(text2, budget) {
-  need2(typeof text2 === "string", "requires settings text");
-  const bytes = Buffer.byteLength(text2);
-  need2(bytes <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes && Number.isSafeInteger(budget.remaining) && budget.remaining >= bytes, "exceeds its byte limit");
-  budget.remaining -= bytes;
-  return settingsDigest(text2, 3);
-}
-function upgradeClaudeSettingsWitness(previous, reviewedSettingsPath) {
-  need2(previous && Object.keys(previous).every((key) => ["path", "hashMode", "sha256"].includes(key)) && (previous.hashMode === undefined || previous.hashMode === "bytes" || previous.hashMode === "claude-settings-v1" || previous.hashMode === "claude-settings-v2") && typeof previous.sha256 === "string" && /^[a-f0-9]{64}$/.test(previous.sha256), "requires an exact legacy settings witness");
-  const budget = { remaining: 2 * CLAUDE_SETTINGS_WITNESS_LIMITS.bytes };
-  const before2 = readNativeSettingsWitnessFile(reviewedSettingsPath, budget), current = readNativeSettingsWitnessFile(previous.path, budget);
-  const beforeDigest = previous.hashMode === undefined || previous.hashMode === "bytes" ? createHash9("sha256").update(before2).digest("hex") : settingsDigest(before2, previous.hashMode === "claude-settings-v1" ? 1 : 2);
-  need2(beforeDigest === previous.sha256, "reviewed preimage does not match the legacy witness");
-  const sha2562 = settingsDigest(current, 3);
-  need2(settingsDigest(before2, 3) === sha2562, "non-preference settings changed; explicit discovery review required");
-  return { path: previous.path, hashMode: "claude-settings-v3", sha256: sha2562 };
-}
-function hashNativeJsonControls(text2, excludedMetadata) {
-  need2(Buffer.byteLength(text2) <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes, "exceeds its byte limit");
-  const value = parse3(text2);
-  value.entries = value.entries.filter(([key, child]) => {
-    if (key !== excludedMetadata)
-      return true;
-    need2(child.kind === "string" && child.value.length <= 128, "has invalid version metadata");
-    return false;
-  });
-  return createHash9("sha256").update("hasna.skills.native-json-controls.v1\x00").update(JSON.stringify(canonical2(value))).digest("hex");
-}
-var CLAUDE_SETTINGS_WITNESS_LIMITS, sameFile = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode && a.uid === b.uid && a.gid === b.gid && a.nlink === b.nlink && a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs, BOOLEAN_PREFERENCES, ENUM_PREFERENCES, BUILTIN_MODEL_SELECTIONS, PERSISTED_EFFORT_LEVELS;
-var init_claude_settings_witness = __esm(() => {
-  CLAUDE_SETTINGS_WITNESS_LIMITS = Object.freeze({ bytes: 1024 * 1024, rows: 1024, depth: 32, nodes: 65536, stringCharacters: 16384, pathCharacters: 4096 });
-  BOOLEAN_PREFERENCES = new Set([
-    "autoScrollEnabled",
-    "axScreenReader",
-    "emojiCompletionEnabled",
-    "prefersReducedMotion",
-    "showTurnDuration",
-    "spinnerTipsEnabled",
-    "syntaxHighlightingDisabled",
-    "terminalProgressBarEnabled",
-    "terminalTitleFromRename",
-    "verbose",
-    "wheelScrollAccelerationEnabled"
-  ]);
-  ENUM_PREFERENCES = Object.freeze({
-    editorMode: ["normal", "vim"],
-    tui: ["default", "fullscreen"],
-    viewMode: ["default", "verbose", "focus"]
-  });
-  BUILTIN_MODEL_SELECTIONS = new Set([
-    "default",
-    "best",
-    "fable",
-    "fable[1m]",
-    "sonnet",
-    "sonnet[1m]",
-    "opus",
-    "opus[1m]",
-    "haiku",
-    "opusplan",
-    "claude-fable-5-1",
-    "claude-fable-5",
-    "claude-fable-5[1m]",
-    "claude-opus-5",
-    "claude-sonnet-5",
-    "claude-haiku-4-5-20251001",
-    "claude-opus-4-6",
-    "claude-sonnet-4-5",
-    "claude-sonnet-4-5-20250929",
-    "claude-opus-4-8",
-    "claude-opus-4-8[1m]",
-    "claude-opus-4-7",
-    "claude-sonnet-4-6",
-    "claude-opus-4-5-20251101",
-    "claude-opus-4-5",
-    "claude-haiku-4-5",
-    "claude-fable-5-1[1m]",
-    "claude-opus-5[1m]",
-    "claude-opus-4-7[1m]",
-    "claude-opus-4-6[1m]",
-    "claude-sonnet-4-6[1m]"
-  ]);
-  PERSISTED_EFFORT_LEVELS = new Set(["low", "medium", "high", "xhigh"]);
-});
-
 // src/lib/codex-native-compatibility.ts
 function supportsCodexNativeCapability(version, capability) {
   return typeof version === "string" && Object.hasOwn(MEASURED_CODEX_CAPABILITIES, version) && MEASURED_CODEX_CAPABILITIES[version].includes(capability);
@@ -51629,7 +51684,7 @@ var init_codex_native_skill_catalog = __esm(() => {
 });
 
 // src/lib/codex-plugin-skill-controls.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { basename as basename6, dirname as dirname11, join as join20, relative as relative5, resolve as resolve11, sep as sep5 } from "path";
 import { lstatSync as lstatSync13, readdirSync as readdirSync6, readlinkSync as readlinkSync3, realpathSync as realpathSync6 } from "fs";
 function refuse2() {
@@ -51989,7 +52044,7 @@ function reviewCodexPluginControls(catalog, documents, cache3, cwd2, read2, rule
       const exactPathDeny = Array.isArray(rules) && rules.some((rule) => rule?.path === document3 && rule?.enabled === false);
       const nativeSkill = { name: parsed.name, path: document3, pluginId: expectedPluginId, enabled: true };
       const denial = denials.find((item) => item.path === document3);
-      const explicitDeny = denial !== undefined && remotePluginId !== undefined && catalog.version === "codex-cli 0.160.0" && denial.name === parsed.name && denial.sha256 === createHash10("sha256").update(read2(document3)).digest("hex") && Array.isArray(rules) && !rules.some((rule) => (rule?.path === document3 || typeof rule?.name === "string" && rule.name.trim() === parsed.name) && rule.enabled !== false) && Array.isArray(plannedRules) && plannedRules.some((rule) => rule?.path === document3 && rule.enabled === false);
+      const explicitDeny = denial !== undefined && remotePluginId !== undefined && catalog.version === "codex-cli 0.160.0" && denial.name === parsed.name && denial.sha256 === createHash11("sha256").update(read2(document3)).digest("hex") && Array.isArray(rules) && !rules.some((rule) => (rule?.path === document3 || typeof rule?.name === "string" && rule.name.trim() === parsed.name) && rule.enabled !== false) && Array.isArray(plannedRules) && plannedRules.some((rule) => rule?.path === document3 && rule.enabled === false);
       if (denial && !explicitDeny)
         refuse2();
       if (explicitDeny)
@@ -52082,7 +52137,7 @@ var init_codex_plugin_skill_controls = __esm(() => {
 });
 
 // src/lib/codex-native-skill-policy.ts
-import { createHash as createHash11, randomUUID as randomUUID5 } from "crypto";
+import { createHash as createHash12, randomUUID as randomUUID5 } from "crypto";
 import { closeSync as closeSync7, constants as constants8, fstatSync as fstatSync7, fsyncSync as fsyncSync2, lstatSync as lstatSync14, mkdirSync as mkdirSync5, openSync as openSync7, readFileSync as readFileSync13, readSync as readSync5, readlinkSync as readlinkSync4, realpathSync as realpathSync7, renameSync as renameSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname12, isAbsolute as isAbsolute12, join as join21, resolve as resolve12 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
@@ -52094,7 +52149,7 @@ function codexNativeHookEnvelopeFromInput(input, event, inputBytes, inheritedFd)
     policy: input.native_skill_policy,
     sessionId: input.session_id,
     ...Object.hasOwn(input, "turn_id") ? { turnId: input.turn_id } : {},
-    hookInputSha256: createHash11("sha256").update(inputBytes).digest("hex"),
+    hookInputSha256: createHash12("sha256").update(inputBytes).digest("hex"),
     ...inheritedFd !== undefined ? { inheritedFd: /^(0|[1-9]\d{0,9})$/.test(inheritedFd) ? Number(inheritedFd) : inheritedFd } : {}
   };
 }
@@ -52204,7 +52259,7 @@ function verifyCodexNativeBridgeDocument(path, expectedContent, expectedSha256)
   if (realpathSync7.native(path) !== path)
     refuse3("NATIVE_SKILL_POLICY_BRIDGE_UNVERIFIED", "the bridge document real path differs from its lexical path");
   const bytes = readBounded(path, MAX_BRIDGE_DOCUMENT_BYTES, "the bridge document");
-  const sha2562 = createHash11("sha256").update(bytes).digest("hex");
+  const sha2562 = createHash12("sha256").update(bytes).digest("hex");
   if (!bytes.equals(Buffer.from(expectedContent, "utf8")) || sha2562 !== expectedSha256)
     refuse3("NATIVE_SKILL_POLICY_BRIDGE_UNVERIFIED", "the bridge document bytes differ from the managed bridge");
   return { path, sha256: sha2562 };
@@ -52679,7 +52734,7 @@ var init_codex_native_skill_policy = __esm(() => {
 });
 
 // src/lib/codex-settings-witness-v1.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 function need3(value) {
   if (!value)
     throw new Error("Invalid Codex settings witness");
@@ -52723,8 +52778,8 @@ function numericTokens(text2) {
   }
   return result2;
 }
-function canonical3(value, depth = 0, budget = { remaining: 65536 }) {
-  need3(depth <= 32 && --budget.remaining >= 0);
+function canonical3(value, depth = 0, budget2 = { remaining: 65536 }) {
+  need3(depth <= 32 && --budget2.remaining >= 0);
   if (value === null)
     return ["null"];
   if (typeof value === "string")
@@ -52740,13 +52795,13 @@ function canonical3(value, depth = 0, budget = { remaining: 65536 }) {
     return ["date", value.toISOString()];
   }
   if (Array.isArray(value))
-    return ["array", value.map((child) => canonical3(child, depth + 1, budget))];
+    return ["array", value.map((child) => canonical3(child, depth + 1, budget2))];
   need3(value && typeof value === "object");
-  return ["object", Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, child]) => [key, canonical3(child, depth + 1, budget)])];
+  return ["object", Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, child]) => [key, canonical3(child, depth + 1, budget2)])];
 }
-function hashCodexSettingsReplacement(text2, budget = { remaining: 256 * 1024 * 1024 }) {
-  need3(Buffer.byteLength(text2) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text2));
-  budget.remaining -= Buffer.byteLength(text2);
+function hashCodexSettingsReplacement(text2, budget2 = { remaining: 256 * 1024 * 1024 }) {
+  need3(Buffer.byteLength(text2) <= 1024 * 1024 && budget2.remaining >= Buffer.byteLength(text2));
+  budget2.remaining -= Buffer.byteLength(text2);
   let config;
   try {
     config = Bun.TOML.parse(text2);
@@ -52765,11 +52820,11 @@ function hashCodexSettingsReplacement(text2, budget = { remaining: 256 * 1024 *
     }
   return sha(`hasna.skills.codex-settings.v1\x00${JSON.stringify([canonical3(config), numericTokens(text2)])}`);
 }
-function captureCodexSettings(path, budget = { remaining: 256 * 1024 * 1024 }) {
-  const text2 = readNativeSettingsWitnessFile(path, budget, "config.toml");
+function captureCodexSettings(path, budget2 = { remaining: 256 * 1024 * 1024 }) {
+  const text2 = readNativeSettingsWitnessFile(path, budget2, "config.toml");
   return { path, hashMode: "codex-settings-v1", sha256: hashCodexSettingsReplacement(text2) };
 }
-var sha = (text2) => createHash12("sha256").update(text2).digest("hex"), EFFORT, VERBOSITY;
+var sha = (text2) => createHash13("sha256").update(text2).digest("hex"), EFFORT, VERBOSITY;
 var init_codex_settings_witness_v1 = __esm(() => {
   init_claude_settings_witness();
   EFFORT = new Set(["none", "minimal", "low", "medium", "high", "xhigh"]);
@@ -52842,7 +52897,7 @@ function projectRegularCodexMcp(config, source) {
 var init_codex_mcp_discovery_projection = () => {};
 
 // src/lib/codex-settings-witness.ts
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
 function need4(value) {
   if (!value)
@@ -52893,8 +52948,8 @@ function numericTokens2(text2) {
   }
   return result2.sort();
 }
-function canonical4(value, depth = 0, budget = { remaining: 65536 }) {
-  need4(depth <= 32 && --budget.remaining >= 0);
+function canonical4(value, depth = 0, budget2 = { remaining: 65536 }) {
+  need4(depth <= 32 && --budget2.remaining >= 0);
   if (value === null)
     return ["null"];
   if (typeof value === "string")
@@ -52910,9 +52965,9 @@ function canonical4(value, depth = 0, budget = { remaining: 65536 }) {
     return ["date", value.toISOString()];
   }
   if (Array.isArray(value))
-    return ["array", value.map((child) => canonical4(child, depth + 1, budget))];
+    return ["array", value.map((child) => canonical4(child, depth + 1, budget2))];
   need4(isRecord3(value));
-  return ["object", Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, child]) => [key, canonical4(child, depth + 1, budget)])];
+  return ["object", Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, child]) => [key, canonical4(child, depth + 1, budget2)])];
 }
 function normalize3(config, version = 2) {
   if (isRecord3(config.hooks)) {
@@ -53088,40 +53143,40 @@ function settingsDigest2(text2, version = 2) {
   normalize3(projected.config, version);
   return sha2(`hasna.skills.codex-settings.v${version}\x00${JSON.stringify([canonical4(projected.config), numericTokens2(projected.numericSource)])}`);
 }
-function hashCodexSettingsReplacementV2(text2, budget = { remaining: 256 * 1024 * 1024 }) {
-  need4(Buffer.byteLength(text2) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text2));
-  budget.remaining -= Buffer.byteLength(text2);
+function hashCodexSettingsReplacementV2(text2, budget2 = { remaining: 256 * 1024 * 1024 }) {
+  need4(Buffer.byteLength(text2) <= 1024 * 1024 && budget2.remaining >= Buffer.byteLength(text2));
+  budget2.remaining -= Buffer.byteLength(text2);
   return settingsDigest2(text2);
 }
-function captureCodexSettingsV2(path, budget = { remaining: 256 * 1024 * 1024 }) {
-  const text2 = readNativeSettingsWitnessFile(path, budget, "config.toml");
+function captureCodexSettingsV2(path, budget2 = { remaining: 256 * 1024 * 1024 }) {
+  const text2 = readNativeSettingsWitnessFile(path, budget2, "config.toml");
   return { path, hashMode: "codex-settings-v2", sha256: settingsDigest2(text2) };
 }
-function readCodexSettingsPreimage(path, budget = { remaining: 2 * 1024 * 1024 }) {
-  return readNativeSettingsWitnessFile(path, budget, "config.toml");
+function readCodexSettingsPreimage(path, budget2 = { remaining: 2 * 1024 * 1024 }) {
+  return readNativeSettingsWitnessFile(path, budget2, "config.toml");
 }
 function upgradeCodexSettingsWitness(previous, reviewedSettingsPath) {
   need4(previous && Object.keys(previous).every((key) => ["path", "hashMode", "sha256"].includes(key)) && (previous.hashMode === undefined || previous.hashMode === "bytes" || previous.hashMode === "codex-settings-v1") && /^[a-f0-9]{64}$/.test(previous.sha256));
-  const budget = { remaining: 2 * 1024 * 1024 };
-  const before2 = readNativeSettingsWitnessFile(reviewedSettingsPath, budget, "config.toml"), current = readNativeSettingsWitnessFile(previous.path, budget, "config.toml");
+  const budget2 = { remaining: 2 * 1024 * 1024 };
+  const before2 = readNativeSettingsWitnessFile(reviewedSettingsPath, budget2, "config.toml"), current = readNativeSettingsWitnessFile(previous.path, budget2, "config.toml");
   need4((previous.hashMode === "codex-settings-v1" ? hashCodexSettingsReplacement(before2) : sha2(before2)) === previous.sha256);
   const sha2562 = settingsDigest2(current);
   if (settingsDigest2(before2) !== sha2562)
     throw new Error("Codex non-preference settings changed; explicit discovery review required");
   return { path: previous.path, hashMode: "codex-settings-v2", sha256: sha2562 };
 }
-function hashCodexSettingsReplacementV3(text2, budget = { remaining: 256 * 1024 * 1024 }) {
-  need4(Buffer.byteLength(text2) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text2));
-  budget.remaining -= Buffer.byteLength(text2);
+function hashCodexSettingsReplacementV3(text2, budget2 = { remaining: 256 * 1024 * 1024 }) {
+  need4(Buffer.byteLength(text2) <= 1024 * 1024 && budget2.remaining >= Buffer.byteLength(text2));
+  budget2.remaining -= Buffer.byteLength(text2);
   return settingsDigest2(text2, 3);
 }
-function captureCodexSettingsV3(path, budget = { remaining: 256 * 1024 * 1024 }) {
-  return { path, hashMode: "codex-settings-v3", sha256: settingsDigest2(readNativeSettingsWitnessFile(path, budget, "config.toml"), 3) };
+function captureCodexSettingsV3(path, budget2 = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "codex-settings-v3", sha256: settingsDigest2(readNativeSettingsWitnessFile(path, budget2, "config.toml"), 3) };
 }
 function upgradeCodexSettingsWitnessV3(previous, reviewedSettingsPath) {
   need4(previous && Object.keys(previous).every((key) => ["path", "hashMode", "sha256"].includes(key)) && (previous.hashMode === undefined || ["bytes", "codex-settings-v1", "codex-settings-v2"].includes(previous.hashMode)) && /^[a-f0-9]{64}$/.test(previous.sha256));
-  const budget = { remaining: 2 * 1024 * 1024 };
-  const before2 = readNativeSettingsWitnessFile(reviewedSettingsPath, budget, "config.toml"), current = readNativeSettingsWitnessFile(previous.path, budget, "config.toml");
+  const budget2 = { remaining: 2 * 1024 * 1024 };
+  const before2 = readNativeSettingsWitnessFile(reviewedSettingsPath, budget2, "config.toml"), current = readNativeSettingsWitnessFile(previous.path, budget2, "config.toml");
   const original = previous.hashMode === "codex-settings-v2" ? settingsDigest2(before2) : previous.hashMode === "codex-settings-v1" ? hashCodexSettingsReplacement(before2) : sha2(before2);
   need4(original === previous.sha256);
   const sha2562 = settingsDigest2(current, 3);
@@ -53129,18 +53184,18 @@ function upgradeCodexSettingsWitnessV3(previous, reviewedSettingsPath) {
     throw new Error("Codex settings outside the reviewed V3 contract changed; explicit discovery review required");
   return { path: previous.path, hashMode: "codex-settings-v3", sha256: sha2562 };
 }
-function hashCodexSettingsReplacementV4(text2, budget = { remaining: 256 * 1024 * 1024 }) {
-  need4(Buffer.byteLength(text2) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text2));
-  budget.remaining -= Buffer.byteLength(text2);
+function hashCodexSettingsReplacementV4(text2, budget2 = { remaining: 256 * 1024 * 1024 }) {
+  need4(Buffer.byteLength(text2) <= 1024 * 1024 && budget2.remaining >= Buffer.byteLength(text2));
+  budget2.remaining -= Buffer.byteLength(text2);
   return settingsDigest2(text2, 4);
 }
-function captureCodexSettingsV4(path, budget = { remaining: 256 * 1024 * 1024 }) {
-  return { path, hashMode: "codex-settings-v4", sha256: settingsDigest2(readNativeSettingsWitnessFile(path, budget, "config.toml"), 4) };
+function captureCodexSettingsV4(path, budget2 = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "codex-settings-v4", sha256: settingsDigest2(readNativeSettingsWitnessFile(path, budget2, "config.toml"), 4) };
 }
 function upgradeCodexSettingsWitnessV4(previous, reviewedSettingsPath) {
   need4(previous && Object.keys(previous).every((key) => ["path", "hashMode", "sha256"].includes(key)) && (previous.hashMode === undefined || ["bytes", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3"].includes(previous.hashMode)) && /^[a-f0-9]{64}$/.test(previous.sha256));
-  const budget = { remaining: 2 * 1024 * 1024 };
-  const before2 = readNativeSettingsWitnessFile(reviewedSettingsPath, budget, "config.toml"), current = readNativeSettingsWitnessFile(previous.path, budget, "config.toml");
+  const budget2 = { remaining: 2 * 1024 * 1024 };
+  const before2 = readNativeSettingsWitnessFile(reviewedSettingsPath, budget2, "config.toml"), current = readNativeSettingsWitnessFile(previous.path, budget2, "config.toml");
   const original = previous.hashMode === "codex-settings-v3" ? settingsDigest2(before2, 3) : previous.hashMode === "codex-settings-v2" ? settingsDigest2(before2, 2) : previous.hashMode === "codex-settings-v1" ? hashCodexSettingsReplacement(before2) : sha2(before2);
   need4(original === previous.sha256);
   const sha2562 = settingsDigest2(current, 4);
@@ -53148,7 +53203,7 @@ function upgradeCodexSettingsWitnessV4(previous, reviewedSettingsPath) {
     throw new Error("Codex settings outside the reviewed V4 contract changed; explicit discovery review required");
   return { path: previous.path, hashMode: "codex-settings-v4", sha256: sha2562 };
 }
-var sha2 = (text2) => createHash13("sha256").update(text2).digest("hex"), EFFORT2, VERBOSITY2, MODEL, CODEX_DISCOVERY_PROJECTION_FIELDS, INFERENCE;
+var sha2 = (text2) => createHash14("sha256").update(text2).digest("hex"), EFFORT2, VERBOSITY2, MODEL, CODEX_DISCOVERY_PROJECTION_FIELDS, INFERENCE;
 var init_codex_settings_witness = __esm(() => {
   init_codex_settings_witness_v1();
   init_codex_settings_witness_v1();
@@ -53247,7 +53302,7 @@ var init_managed_policy = __esm(() => {
 });
 
 // src/lib/agent-bridge.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 import { lstatSync as lstatSync16, readFileSync as readFileSync14, readdirSync as readdirSync7 } from "fs";
 import { join as join25 } from "path";
 function isOwnedCliBridge(path, expectedPaths) {
@@ -53281,7 +53336,7 @@ Use the Skills CLI as the skill authority for this station.
 This bridge contains no skill payloads. Do not copy skill content into agent-native skill directories or load other native skill copies. If a Skills command refuses authority, selection, integrity, or native drift, report that refusal and use its repair guidance; do not substitute bundled or stale local content. Explicit local draft authoring remains available.
 `, CLI_BRIDGE_DIGEST, CLI_BRIDGE_FILES;
 var init_agent_bridge = __esm(() => {
-  CLI_BRIDGE_DIGEST = createHash14("sha256").update(markdown).digest("hex");
+  CLI_BRIDGE_DIGEST = createHash15("sha256").update(markdown).digest("hex");
   CLI_BRIDGE_FILES = Object.freeze({
     "SKILL.md": markdown,
     ".hasna-skills.json": `${JSON.stringify({ managedBy: "@hasna/skills", kind: "cli-bridge", version: CLI_BRIDGE_VERSION, protocol: "selection-v1", contentSha256: CLI_BRIDGE_DIGEST }, null, 2)}
@@ -53593,31 +53648,44 @@ function sumiConfigPath(home) {
   return join26(sumiConfigDirectory(home), "sumi.json");
 }
 function renderSumiPlugin(command, profile) {
+  return renderSumiPluginVersion(command, profile, false);
+}
+function isManagedSumiPlugin(text2, command, profile) {
+  return text2 === renderSumiPlugin(command, profile) || text2 === renderSumiPluginVersion(command, profile, true);
+}
+function renderSumiPluginVersion(command, profile, legacy) {
+  const failure = (message) => legacy ? `new Error(${JSON.stringify(message)})` : "refusal()";
   return `// Managed by @hasna/skills. Regenerate with skills hook install --agent sumi.
 import { spawn } from "node:child_process";
 const command = ${JSON.stringify(command)};
 const profile = ${JSON.stringify(profile)};
-function context(input) {
+${legacy ? "" : `function refusal() {
+  const error = new Error("Skills verification blocked this request. Review the Sumi Skills hook configuration, then retry.");
+  error.name = "SkillsHookRefusal";
+  error.skillsHookRefusal = { version: 1, code: "SKILLS_HOOK_REFUSED" };
+  return error;
+}
+`}function context(input) {
   return new Promise((resolve, reject) => {
     const child = spawn(command, ["hook", "user-prompt", "--agent", "sumi", "--selection-profile", profile], { cwd: input.cwd, stdio: ["pipe", "pipe", "pipe"] });
     const chunks = []; let bytes = 0, failure;
-    const timer = setTimeout(() => { failure = new Error("Skills prompt hook timed out"); child.kill("SIGKILL"); }, 15000);
-    child.stdout.on("data", chunk => { bytes += chunk.length; if (bytes > 1048576) { failure = new Error("Skills prompt hook output exceeded its limit"); child.kill("SIGKILL"); } else chunks.push(chunk); });
+    const timer = setTimeout(() => { failure = ${failure("Skills prompt hook timed out")}; child.kill("SIGKILL"); }, 15000);
+    child.stdout.on("data", chunk => { bytes += chunk.length; if (bytes > 1048576) { failure = ${failure("Skills prompt hook output exceeded its limit")}; child.kill("SIGKILL"); } else chunks.push(chunk); });
     child.stderr.on("data", () => {});
     child.stdin.on("error", () => {});
-    child.on("error", error => { clearTimeout(timer); reject(error); });
+    child.on("error", error => { clearTimeout(timer); reject(${legacy ? "error" : "refusal()"}); });
     child.on("close", code => {
       clearTimeout(timer);
-      if (failure || code !== 0) return reject(failure ?? new Error("Skills prompt hook failed"));
+      if (failure || code !== 0) return reject(failure ?? ${failure("Skills prompt hook failed")});
       try {
         const result = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-        if (!result || typeof result !== "object" || Array.isArray(result)) throw new Error("Invalid Skills hook response");
-        if (result.decision === "block" || result.continue === false) throw new Error("Skills prompt hook refused");
-        if (Object.keys(result).length && (!result.hookSpecificOutput || result.hookSpecificOutput.hookEventName !== input.hook_event_name)) throw new Error("Invalid Skills hook response");
+        if (!result || typeof result !== "object" || Array.isArray(result)) throw ${failure("Invalid Skills hook response")};
+        if (result.decision === "block" || result.continue === false) throw ${failure("Skills prompt hook refused")};
+        if (Object.keys(result).length && (!result.hookSpecificOutput || result.hookSpecificOutput.hookEventName !== input.hook_event_name)) throw ${failure("Invalid Skills hook response")};
         const text = result.hookSpecificOutput?.additionalContext ?? "";
-        if (typeof text !== "string") throw new Error("Invalid Skills prompt context");
+        if (typeof text !== "string") throw ${failure("Invalid Skills prompt context")};
         resolve(text);
-      } catch (error) { reject(error); }
+      } catch (error) { reject(${legacy ? "error" : "refusal()"}); }
     });
     child.stdin.end(JSON.stringify(input));
   });
@@ -53625,13 +53693,14 @@ function context(input) {
 export default {
   id: "local.hasna-skills-cli",
   async setup(ctx) {
-    if (!ctx?.session?.hook || !ctx?.session?.get || !ctx?.skill?.transform || !ctx?.tool?.hook) throw new Error("Unsupported Sumi native Skills contract");
+    if (!ctx?.session?.hook || !ctx?.session?.get || !ctx?.skill?.transform || !ctx?.tool?.hook) throw ${failure("Unsupported Sumi native Skills contract")};
     const registrations = [];
     const sessions = new Set();
     async function input(sessionID, prompt, first) {
       // The Promise adapter unwraps single-data endpoint responses.
-      const session = await ctx.session.get({ sessionID });
-      if (!session || session.id !== sessionID || typeof session.location?.directory !== "string" || (session.parentID !== undefined && typeof session.parentID !== "string") || session.parentID === sessionID) throw new Error("Invalid Sumi session custody");
+      ${legacy ? "const session = await ctx.session.get({ sessionID });" : `let session;
+      try { session = await ctx.session.get({ sessionID }); } catch { throw refusal(); }`}
+      if (!session || session.id !== sessionID || typeof session.location?.directory !== "string" || (session.parentID !== undefined && typeof session.parentID !== "string") || session.parentID === sessionID) throw ${failure("Invalid Sumi session custody")};
       return { hook_event_name: first ? session.parentID ? "SubagentStart" : "SessionStart" : "UserPromptSubmit", cwd: session.location.directory, session_id: sessionID, parent_session_id: session.parentID ?? null, prompt, restore: true };
     }
     registrations.push(await ctx.skill.transform(editor => {
@@ -53640,11 +53709,11 @@ export default {
     // Native config transforms may add skills after this transform. Guard
     // both direct tool calls and prompt attachments at the consumption edge.
     registrations.push(await ctx.tool.hook("execute.before", event => {
-      if (event.tool === "skill" && event.input?.id !== "skills-cli") throw new Error("Native Sumi skill payload refused; use Skills CLI");
+      if (event.tool === "skill" && event.input?.id !== "skills-cli") throw ${failure("Native Sumi skill payload refused; use Skills CLI")};
     }));
     registrations.push(await ctx.session.hook("prompt", async event => {
-      if (typeof event.prompt?.text !== "string") throw new Error("Invalid Sumi prompt");
-      if (event.prompt.skills !== undefined && (!Array.isArray(event.prompt.skills) || event.prompt.skills.some(skill => skill?.id !== "skills-cli"))) throw new Error("Native Sumi skill attachment refused; use Skills CLI");
+      if (typeof event.prompt?.text !== "string") throw ${failure("Invalid Sumi prompt")};
+      if (event.prompt.skills !== undefined && (!Array.isArray(event.prompt.skills) || event.prompt.skills.some(skill => skill?.id !== "skills-cli"))) throw ${failure("Native Sumi skill attachment refused; use Skills CLI")};
       await context(await input(event.sessionID, event.prompt.text, !sessions.has(event.sessionID)));
       sessions.add(event.sessionID);
     }));
@@ -53672,7 +53741,7 @@ var init_agent_sumi = __esm(() => {
 
 // src/lib/codex-hook-trust-files.ts
 import { closeSync as closeSync9, constants as constants10, fstatSync as fstatSync9, fsyncSync as fsyncSync3, lstatSync as lstatSync18, openSync as openSync9, readSync as readSync7, writeFileSync as writeFileSync5 } from "fs";
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash16 } from "crypto";
 import { dirname as dirname13 } from "path";
 function need5(value, code) {
   if (!value)
@@ -53707,7 +53776,7 @@ function snapshot(file, privateFile = false, options = {}) {
     }
     need5(length === Number(before2.size) && sameStat(before2, fstatSync9(fd, { bigint: true })) && sameStat(before2, lstatSync18(file, { bigint: true })), "INPUT_CHANGED");
     const content = bytes.subarray(0, length), text2 = new TextDecoder("utf-8", { fatal: true }).decode(content);
-    return { file, privateFile, readOnlyPackage, text: text2, bytes: content, stat: before2, sha256: createHash15("sha256").update(content).digest("hex") };
+    return { file, privateFile, readOnlyPackage, text: text2, bytes: content, stat: before2, sha256: createHash16("sha256").update(content).digest("hex") };
   } finally {
     closeSync9(fd);
   }
@@ -53730,7 +53799,7 @@ var sameStat = (a, b) => ["dev", "ino", "uid", "nlink", "mode", "size", "mtimeNs
 var init_codex_hook_trust_files = () => {};
 
 // src/lib/agent-integration.ts
-import { createHash as createHash16, randomUUID as randomUUID6 } from "crypto";
+import { createHash as createHash17, randomUUID as randomUUID6 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual7 } from "util";
 import { existsSync as existsSync13, lstatSync as lstatSync19, statSync as statSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync15, readdirSync as readdirSync8, opendirSync as opendirSync3, readlinkSync as readlinkSync5, realpathSync as realpathSync9, renameSync as renameSync3, rmdirSync as rmdirSync2, writeFileSync as writeFileSync6, unlinkSync as unlinkSync4, chmodSync, openSync as openSync10, closeSync as closeSync10, fsyncSync as fsyncSync4, fstatSync as fstatSync10, readSync as readSync8, constants as constants11, linkSync as linkSync2 } from "fs";
 import { dirname as dirname14, join as join27, resolve as resolve14, relative as relative6, isAbsolute as isAbsolute13, sep as sep6 } from "path";
@@ -53927,7 +53996,7 @@ function readNativeBytes(path, maximum = 64 * 1024 * 1024) {
   }
 }
 function treeHash(root) {
-  const hash2 = createHash16("sha256");
+  const hash2 = createHash17("sha256");
   let bytes = 0, files = 0;
   function visit2(path) {
     const stat = lstatSync19(path);
@@ -54427,6 +54496,7 @@ function planAgentIntegration(options) {
   const codexPluginSourceInputs = codexPluginControls.sourceInputs.filter((input) => codexDiscovery?.method === "reviewed" && codexDiscovery.roots.some((root) => root === input.sourceRoot || root.startsWith(input.sourceRoot + sep6) || input.sourceRoot.startsWith(root + sep6)) && codexDiscovery.sources.some((source) => source.path === join27(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined));
   assertCodexInstallationInputs(home, [options.projectDir ?? home], codexPluginSourceInputs.map((input) => input.sourceRoot));
   const changes = [];
+  let observedSettings;
   for (const agent of [...new Set(options.agents)]) {
     if (!INTEGRATION_AGENTS.includes(agent))
       throw new Error(`Unsupported agent: ${agent}`);
@@ -54469,7 +54539,7 @@ function planAgentIntegration(options) {
       const pluginPath = join27(sumiConfigDirectory(home), "plugins", "skills-cli.js"), pluginBefore = readOptional(pluginPath);
       const pluginAfter = renderSumiPlugin(command, profileId2);
       const priorCommand = policy.bridge?.commands?.sumi, priorProfile = policy.bridge?.profiles?.sumi ?? policy.profileId;
-      if (pluginBefore !== null && pluginBefore !== pluginAfter && !(typeof priorCommand === "string" && typeof priorProfile === "string" && pluginBefore === renderSumiPlugin(priorCommand, priorProfile)))
+      if (pluginBefore !== null && pluginBefore !== pluginAfter && !(typeof priorCommand === "string" && typeof priorProfile === "string" && isManagedSumiPlugin(pluginBefore, priorCommand, priorProfile)))
         throw new Error("Refusing to overwrite a modified Sumi Skills plugin; preserve and review it first");
       if (pluginBefore !== pluginAfter)
         changes.push({ path: pluginPath, before: pluginBefore, after: pluginAfter });
@@ -54499,8 +54569,12 @@ function planAgentIntegration(options) {
       if (previous !== codexConfigBefore)
         throw new Error(`Configuration changed during planning: ${configPath}`);
       const next = disableReviewedCodexPluginNames(codexPathConfig, codexPluginSkills);
-      if (next !== (previous ?? ""))
-        changes.push({ path: configPath, before: previous, after: next });
+      if (next !== (previous ?? "")) {
+        if (previous !== null && isDeepStrictEqual7(Bun.TOML.parse(previous), Bun.TOML.parse(next))) {
+          observedSettings = { path: configPath, before: previous };
+        } else
+          changes.push({ path: configPath, before: previous, after: next });
+      }
     }
   }
   const codexPluginSkillReview = options.codexNativeCatalog ? { version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, catalogSha256: sha3(JSON.stringify({ version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, skills: projectCodexNativeSkillCatalog({ data: [{ cwd: options.codexNativeCatalog.cwd, errors: [], skills: options.codexNativeCatalog.skills }] }, options.codexNativeCatalog.cwd), ...options.codexNativeCatalog.plugins === undefined ? {} : { plugins: projectCodexInstalledPluginEntries(options.codexNativeCatalog.plugins) } })), configSha256: changes.find((change) => change.path === canonicalAgentPath(join27(home, ".codex/config.toml"), aliases))?.before === null ? null : sha3(readOptional(canonicalAgentPath(join27(home, ".codex/config.toml"), aliases)) ?? "") } : policy.bridge?.codexPluginSkillReview;
@@ -54533,7 +54607,7 @@ function planAgentIntegration(options) {
   if (JSON.stringify(policy) !== JSON.stringify(nextPolicy))
     changes.push({ path: policyPath, before: previousPolicy, after: serializedPolicy });
   recheckRootAliases(aliases);
-  return { dataDir: dataDir3, profileId, changes, nativeSkills, ...observedNativeSources.length ? { observedNativeSources } : {}, ...nextPolicy.bridge.codexPluginSkillReview ? { codexPluginSkillReview: nextPolicy.bridge.codexPluginSkillReview } : {}, observedPolicy: { path: policyPath, before: previousPolicy }, discoveryBefore: discoveries, discoveryAfter, ...aliases.length ? { rootAliases: aliases } : {}, ...retainedAgents.length ? { retainedReviewChecks: { home, projectDir: options.projectDir ?? home, agents: retainedAgents } } : {} };
+  return { dataDir: dataDir3, profileId, changes, nativeSkills, ...observedSettings ? { observedSettings } : {}, ...observedNativeSources.length ? { observedNativeSources } : {}, ...nextPolicy.bridge.codexPluginSkillReview ? { codexPluginSkillReview: nextPolicy.bridge.codexPluginSkillReview } : {}, observedPolicy: { path: policyPath, before: previousPolicy }, discoveryBefore: discoveries, discoveryAfter, ...aliases.length ? { rootAliases: aliases } : {}, ...retainedAgents.length ? { retainedReviewChecks: { home, projectDir: options.projectDir ?? home, agents: retainedAgents } } : {} };
 }
 function hookProjectionRefusal(reason) {
   throw new Error(`CLAUDE_MANAGED_HOOK_${reason}`);
@@ -54738,7 +54812,7 @@ function planAgentSettingsWitnessUpgrade(options) {
   const binding = policy.bridge?.discovery?.[options.agent];
   if (!binding || binding.agent !== options.agent || binding.method !== "reviewed")
     throw new Error("Settings witness upgrade requires an existing reviewed native binding");
-  const configPath = canonicalAgentPath(join27(home, options.agent === "claude" ? ".claude/settings.json" : ".codex/config.toml"), aliases);
+  const configPath = canonicalAgentPath(options.agent === "sumi" ? sumiConfigPath(home) : join27(home, options.agent === "claude" ? ".claude/settings.json" : ".codex/config.toml"), aliases);
   const settings = readOptional(configPath);
   if (settings === null || sha3(settings) !== options.expectedSettingsSha256)
     throw new Error("Native settings preimage changed");
@@ -54764,7 +54838,19 @@ function planAgentSettingsWitnessUpgrade(options) {
       replaced.push(source);
     }
   }
-  const next = options.agent === "claude" ? upgradeClaudeSettingsWitness(previous, options.reviewedPreimage) : options.targetCodexVersion === 4 ? upgradeCodexSettingsWitnessV4(previous, options.reviewedPreimage) : options.targetCodexVersion === 3 ? upgradeCodexSettingsWitnessV3(previous, options.reviewedPreimage) : upgradeCodexSettingsWitness(previous, options.reviewedPreimage);
+  if (options.agent === "sumi") {
+    const preimage = readSumiSettingsPreimage(options.reviewedPreimage);
+    for (const source of binding.sources) {
+      if (source === previous || source.path !== configPath)
+        continue;
+      if (source.hashMode !== undefined || source.format !== "json" || !isDeepStrictEqual7(source.fields, [...SUMI_DISCOVERY_PROJECTION_FIELDS]) || typeof source.sha256 !== "string")
+        throw new Error("Sumi settings witness upgrade found an unrecognized configuration witness");
+      if (projectNativeDiscoveryFields(preimage, "json", source.fields, configPath) !== source.sha256)
+        throw new Error("Reviewed preimage does not explain the Sumi discovery projection witness");
+      replaced.push(source);
+    }
+  }
+  const next = options.agent === "sumi" ? upgradeSumiSettingsWitness(previous, options.reviewedPreimage) : options.agent === "claude" ? upgradeClaudeSettingsWitness(previous, options.reviewedPreimage) : options.targetCodexVersion === 4 ? upgradeCodexSettingsWitnessV4(previous, options.reviewedPreimage) : options.targetCodexVersion === 3 ? upgradeCodexSettingsWitnessV3(previous, options.reviewedPreimage) : upgradeCodexSettingsWitness(previous, options.reviewedPreimage);
   const rebound = [];
   for (const source of binding.sources) {
     if (!replaced.includes(source)) {
@@ -55125,7 +55211,7 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
       throw new Error("NATIVE_SKILL_DRIFT: Hermes supervisor binding changed; run skills hook install");
     assertHermesProtection(home, config, command, profile, supervisor);
   } else if (agent === "sumi") {
-    if (JSON.stringify(config.permissions?.filter((rule) => rule.action === "skill")) !== JSON.stringify(SUMI_SKILL_PERMISSIONS) || readOptional(join27(sumiConfigDirectory(home), "plugins", "skills-cli.js")) !== renderSumiPlugin(command, profile))
+    if (JSON.stringify(config.permissions?.filter((rule) => rule.action === "skill")) !== JSON.stringify(SUMI_SKILL_PERMISSIONS) || !isManagedSumiPlugin(readOptional(join27(sumiConfigDirectory(home), "plugins", "skills-cli.js")), command, profile))
       throw new Error("NATIVE_SKILL_DRIFT: Sumi bridge protection changed; run skills hook install");
   } else if (agent === "opencode") {
     if (JSON.stringify(config.permission?.skill) !== JSON.stringify({ "*": "deny", [CLI_BRIDGE_NAME]: "allow" }) || readOptional(join27(home, ".config", "opencode", "plugins", "skills-cli.js")) !== renderOpenCodePlugin(command, profile))
@@ -55271,8 +55357,9 @@ function assertNativeExportAllowed(dataDir3 = getDataDirReadOnly()) {
   if (requiresCliSkillLoading(dataDir3))
     throw new Error("NATIVE_SKILL_EXPORT_DISABLED: this station loads skills through the Skills CLI; use skills sync --selection-profile <id>");
 }
-var sha3 = (data) => createHash16("sha256").update(data).digest("hex"), HOOK_EVENTS, ROOTS, SKILLS_LOADING_POLICY = "Skills loading policy: discover skills with `skills list` or `skills search`, and read selected instructions with `skills load <slug>`. Use `skills sync` to refresh the shared profile. The only native skill is the owned skills-cli bridge. Create and edit payload skills in the Skills authoring workspace; do not copy payload instructions into native discovery folders. Context loading does not authorize execution; use `skills run` only when the task calls for running a skill.";
+var sha3 = (data) => createHash17("sha256").update(data).digest("hex"), HOOK_EVENTS, ROOTS, SKILLS_LOADING_POLICY = "Skills loading policy: discover skills with `skills list` or `skills search`, and read selected instructions with `skills load <slug>`. Use `skills sync` to refresh the shared profile. The only native skill is the owned skills-cli bridge. Create and edit payload skills in the Skills authoring workspace; do not copy payload instructions into native discovery folders. Context loading does not authorize execution; use `skills run` only when the task calls for running a skill.";
 var init_agent_integration = __esm(() => {
+  init_sumi_settings_witness();
   init_codex_corpus_write();
   init_codex_plugin_skill_controls();
   init_codex_native_skill_policy();
@@ -56885,7 +56972,7 @@ var init_selection_resolver = __esm(() => {
 });
 
 // src/lib/plugin-projection.ts
-import { createHash as createHash17 } from "crypto";
+import { createHash as createHash18 } from "crypto";
 import { posix } from "path";
 function pluginRefusal(message) {
   throw new SkillSelectionError("PLUGIN_ADMISSION_REFUSED", message);
@@ -57078,7 +57165,7 @@ function buildPluginProjection(entries) {
   files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   return { manifest, payloads: manifest.payloads, files, witnesses: pluginFileWitnesses(files), originalTreeDigest, projectionTreeDigest: pluginTreeDigest(files), removed: removed.length ? pluginFileWitnesses(removed) : [] };
 }
-var PLUGIN_PROJECTION_MANIFEST = "plugin-projection.json", PLUGIN_PROJECTION_LIMITS, pluginHash = (bytes) => createHash17("sha256").update(bytes).digest("hex"), MANIFEST_FIELDS;
+var PLUGIN_PROJECTION_MANIFEST = "plugin-projection.json", PLUGIN_PROJECTION_LIMITS, pluginHash = (bytes) => createHash18("sha256").update(bytes).digest("hex"), MANIFEST_FIELDS;
 var init_plugin_projection = __esm(() => {
   init_selection_cache();
   PLUGIN_PROJECTION_LIMITS = Object.freeze({ files: 1024, bytes: 64 * 1024 * 1024, fileBytes: 16 * 1024 * 1024, metadataBytes: 512 * 1024, registrations: 64, history: 128 });
@@ -57086,7 +57173,7 @@ var init_plugin_projection = __esm(() => {
 });
 
 // src/lib/plugin-projection-store.ts
-import { createHash as createHash18, randomUUID as randomUUID7 } from "crypto";
+import { createHash as createHash19, randomUUID as randomUUID7 } from "crypto";
 import { constants as constants12, closeSync as closeSync11, fchmodSync, fstatSync as fstatSync11, fsyncSync as fsyncSync5, linkSync as linkSync3, lstatSync as lstatSync21, mkdirSync as mkdirSync10, openSync as openSync11, opendirSync as opendirSync4, readSync as readSync9, renameSync as renameSync6, rmdirSync as rmdirSync3, rmSync as rmSync4, unlinkSync as unlinkSync5, writeSync as writeSync2 } from "fs";
 import { dirname as dirname16, isAbsolute as isAbsolute14, join as join33, parse as parse5, resolve as resolve15 } from "path";
 function stat(path) {
@@ -57424,7 +57511,7 @@ function pluginExecutableDigest(path) {
     const opened = fstatSync11(fd, { bigint: true });
     same3(before2, opened);
     fileShape(opened, maximum, "executable");
-    const hash2 = createHash18("sha256"), buffer = new Uint8Array(64 * 1024);
+    const hash2 = createHash19("sha256"), buffer = new Uint8Array(64 * 1024);
     let remaining = Number(opened.size);
     while (remaining > 0) {
       const count = readSync9(fd, buffer, 0, Math.min(buffer.byteLength, remaining), null);
@@ -58007,7 +58094,7 @@ var init_plugin_discovery = __esm(() => {
 });
 
 // src/lib/claude-marketplace-registry.ts
-import { createHash as createHash19 } from "crypto";
+import { createHash as createHash20 } from "crypto";
 import { closeSync as closeSync13, constants as constants14, fstatSync as fstatSync13, lstatSync as lstatSync23, openSync as openSync13, readSync as readSync11 } from "fs";
 import { basename as basename9, dirname as dirname18, isAbsolute as isAbsolute17, resolve as resolve18 } from "path";
 function need6(value, reason) {
@@ -58027,13 +58114,13 @@ function parents2(path) {
       return result2;
   }
 }
-function readRegistry2(path, budget) {
+function readRegistry2(path, budget2) {
   absolutePath3(path);
   need6(basename9(path) === "known_marketplaces.json", "requires known_marketplaces.json");
-  need6(Number.isSafeInteger(budget.remaining) && budget.remaining >= 0, "has an invalid byte budget");
+  need6(Number.isSafeInteger(budget2.remaining) && budget2.remaining >= 0, "has an invalid byte budget");
   const ancestors2 = parents2(path), initial2 = lstatSync23(path, { bigint: true });
   need6(initial2.isFile() && !initial2.isSymbolicLink() && initial2.size <= BigInt(CLAUDE_MARKETPLACE_REGISTRY_LIMITS.bytes), "is not a bounded regular file");
-  need6(initial2.size <= BigInt(budget.remaining), "exceeds its aggregate byte limit");
+  need6(initial2.size <= BigInt(budget2.remaining), "exceeds its aggregate byte limit");
   const fd = openSync13(path, constants14.O_RDONLY | constants14.O_NOFOLLOW | constants14.O_NONBLOCK);
   try {
     const opened = fstatSync13(fd, { bigint: true });
@@ -58052,7 +58139,7 @@ function readRegistry2(path, budget) {
       const now3 = lstatSync23(ancestor, { bigint: true });
       need6(now3.isDirectory() && before2.dev === now3.dev && before2.ino === now3.ino && before2.mode === now3.mode, "parent changed during read");
     }
-    budget.remaining -= length;
+    budget2.remaining -= length;
     try {
       return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes.subarray(0, length));
     } catch {
@@ -58169,18 +58256,18 @@ function normalizeRow(row, version = 1) {
   need6(Number.isFinite(millis) && new Date(millis).toISOString() === updated, "contains an invalid recognized update timestamp");
   row.entries = row.entries.map(([key, value]) => [key, key === "lastUpdated" ? { kind: "validated-update-time" } : value]);
 }
-function captureClaudeMarketplaceRegistry(path, budget = { remaining: 256 * 1024 * 1024 }) {
-  const value = parse6(readRegistry2(path, budget));
+function captureClaudeMarketplaceRegistry(path, budget2 = { remaining: 256 * 1024 * 1024 }) {
+  const value = parse6(readRegistry2(path, budget2));
   for (const [, row] of value.entries)
     normalizeRow(row);
-  const sha2562 = createHash19("sha256").update("hasna.skills.claude-marketplace-registry.v1\x00").update(JSON.stringify(value)).digest("hex");
+  const sha2562 = createHash20("sha256").update("hasna.skills.claude-marketplace-registry.v1\x00").update(JSON.stringify(value)).digest("hex");
   return { path, hashMode: "claude-marketplace-registry", sha256: sha2562 };
 }
-function captureClaudeMarketplaceRegistryV2(path, budget = { remaining: 256 * 1024 * 1024 }) {
-  const value = parse6(readRegistry2(path, budget));
+function captureClaudeMarketplaceRegistryV2(path, budget2 = { remaining: 256 * 1024 * 1024 }) {
+  const value = parse6(readRegistry2(path, budget2));
   for (const [, row] of value.entries)
     normalizeRow(row, 2);
-  const sha2562 = createHash19("sha256").update("hasna.skills.claude-marketplace-registry.v2\x00").update(JSON.stringify(value)).digest("hex");
+  const sha2562 = createHash20("sha256").update("hasna.skills.claude-marketplace-registry.v2\x00").update(JSON.stringify(value)).digest("hex");
   return { path, hashMode: "claude-marketplace-registry-v2", sha256: sha2562 };
 }
 var CLAUDE_MARKETPLACE_REGISTRY_LIMITS, sameFile2 = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode && a.uid === b.uid && a.gid === b.gid && a.nlink === b.nlink && a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs, field = (object6, key) => object6.entries.find(([name]) => name === key)?.[1];
@@ -58406,7 +58493,7 @@ var init_codex_hook_additions_review = __esm(() => {
 });
 
 // src/lib/codex-hook-discovery-recovery.ts
-import { createHash as createHash20 } from "crypto";
+import { createHash as createHash21 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual10 } from "util";
 function createCodexHookDiscoveryRecovery(binding, before2, current, hooks, additions) {
   const journalHooks = hooks.map(({ key, currentHash }) => ({ key, currentHash }));
@@ -58456,7 +58543,7 @@ function verifiesCodexHookDiscoverySource(binding, source, currentDigest, witnes
   need5(source.sha256 === witness.beforeSha256 && currentDigest === witness.currentSha256, "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
   return true;
 }
-var sha4 = (text3) => createHash20("sha256").update(text3).digest("hex"), fields, structure2 = (text3) => JSON.parse(JSON.stringify(Bun.TOML.parse(text3))), proofs2;
+var sha4 = (text3) => createHash21("sha256").update(text3).digest("hex"), fields, structure2 = (text3) => JSON.parse(JSON.stringify(Bun.TOML.parse(text3))), proofs2;
 var init_codex_hook_discovery_recovery = __esm(() => {
   init_codex_hook_trust_files();
   init_codex_hook_trust_layout();
@@ -58467,7 +58554,7 @@ var init_codex_hook_discovery_recovery = __esm(() => {
 });
 
 // src/lib/agent-discovery.ts
-import { createHash as createHash21 } from "crypto";
+import { createHash as createHash22 } from "crypto";
 import { lstatSync as lstatSync24, readFileSync as readFileSync20, readdirSync as readdirSync11, realpathSync as realpathSync10 } from "fs";
 import { basename as basename10, dirname as dirname19, isAbsolute as isAbsolute19, join as join36, resolve as resolve19, sep as sep7 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual11 } from "util";
@@ -58508,33 +58595,45 @@ function projectNativeDiscoveryFields(text3, format, fields2, path) {
     throw new Error("Expected native discovery configuration object");
   return digest(JSON.stringify(Object.fromEntries(fields2.map((field2) => [field2, object6[field2] ?? null]))));
 }
-function isSupersededCodexProjection(agent, configPath, source) {
+function isSupersededSettingsProjection(agent, configPath, source) {
+  if (agent === "sumi")
+    return source.path === configPath && source.format === "json" && isDeepStrictEqual11(source.fields, [...SUMI_DISCOVERY_PROJECTION_FIELDS]);
   return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual11(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
 }
-function supersedesCodexProjection(sources, configPath) {
-  return sources.some((source) => source.path === configPath && (source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")));
+function supersedesSettingsProjection(agent, sources, configPath) {
+  if (agent === "sumi")
+    return sources.some((source) => source.path === configPath && source.hashMode === "sumi-settings-v1");
+  return agent === "codex" && sources.some((source) => source.path === configPath && (source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")));
 }
-function projected(source, changes, budget = discoveryByteBudget()) {
+function projected(source, changes, budget2 = discoveryByteBudget()) {
+  if (source.hashMode === "sumi-settings-v1") {
+    if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
+      throw new Error("Sumi settings witnesses require exact typed metadata");
+    const current = captureSumiSettings(source.path, budget2).sha256;
+    if (current !== source.sha256)
+      throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
+    return changes?.has(source.path) ? hashSumiSettingsReplacement(changes.get(source.path), budget2) : current;
+  }
   if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")) {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Codex settings witnesses require exact typed metadata");
-    const current = (source.hashMode === "codex-settings-v4" ? captureCodexSettingsV4 : source.hashMode === "codex-settings-v3" ? captureCodexSettingsV3 : source.hashMode === "codex-settings-v2" ? captureCodexSettingsV2 : captureCodexSettings)(source.path, budget).sha256;
+    const current = (source.hashMode === "codex-settings-v4" ? captureCodexSettingsV4 : source.hashMode === "codex-settings-v3" ? captureCodexSettingsV3 : source.hashMode === "codex-settings-v2" ? captureCodexSettingsV2 : captureCodexSettings)(source.path, budget2).sha256;
     if (current !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
-    return changes?.has(source.path) ? (source.hashMode === "codex-settings-v4" ? hashCodexSettingsReplacementV4 : source.hashMode === "codex-settings-v3" ? hashCodexSettingsReplacementV3 : source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget) : current;
+    return changes?.has(source.path) ? (source.hashMode === "codex-settings-v4" ? hashCodexSettingsReplacementV4 : source.hashMode === "codex-settings-v3" ? hashCodexSettingsReplacementV3 : source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget2) : current;
   }
   if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Claude settings witnesses require exact typed metadata");
-    const current = (source.hashMode === "claude-settings-v3" ? captureClaudeSettingsV3 : source.hashMode === "claude-settings-v2" ? captureClaudeSettingsV2 : captureClaudeSettings)(source.path, budget).sha256;
+    const current = (source.hashMode === "claude-settings-v3" ? captureClaudeSettingsV3 : source.hashMode === "claude-settings-v2" ? captureClaudeSettingsV2 : captureClaudeSettings)(source.path, budget2).sha256;
     if (current !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
-    return changes?.has(source.path) ? (source.hashMode === "claude-settings-v3" ? hashClaudeSettingsReplacementV3 : source.hashMode === "claude-settings-v2" ? hashClaudeSettingsReplacementV2 : hashClaudeSettingsReplacement)(changes.get(source.path), budget) : current;
+    return changes?.has(source.path) ? (source.hashMode === "claude-settings-v3" ? hashClaudeSettingsReplacementV3 : source.hashMode === "claude-settings-v2" ? hashClaudeSettingsReplacementV2 : hashClaudeSettingsReplacement)(changes.get(source.path), budget2) : current;
   }
   if (source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256) || changes?.has(source.path))
       throw new Error("Claude marketplace witnesses require an exact reviewed registry without synthetic changes");
-    const sha2562 = (source.hashMode === "claude-marketplace-registry-v2" ? captureClaudeMarketplaceRegistryV2 : captureClaudeMarketplaceRegistry)(source.path, budget).sha256;
+    const sha2562 = (source.hashMode === "claude-marketplace-registry-v2" ? captureClaudeMarketplaceRegistryV2 : captureClaudeMarketplaceRegistry)(source.path, budget2).sha256;
     if (sha2562 !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
     return sha2562;
@@ -58552,8 +58651,8 @@ function projected(source, changes, budget = discoveryByteBudget()) {
     if (source.format !== undefined || source.fields !== undefined)
       throw new Error("Raw discovery witnesses cannot project configuration fields");
     if (source.hashMode === "path-bytes")
-      return hashDiscoveryPathFile(source.path, budget, changes);
-    return hashRawDiscoveryFile(source.path, budget, changes);
+      return hashDiscoveryPathFile(source.path, budget2, changes);
+    return hashRawDiscoveryFile(source.path, budget2, changes);
   }
   const text3 = read2(source.path, changes);
   if (text3 === null)
@@ -58701,7 +58800,7 @@ function verifyAgentDiscovery(binding, codexRecovery) {
     verifyDiscoveryDirectories(projected2, installationRoots);
   }
   const absentRoots = [...absentCodexSkillRoots(binding), ...absentRetiredClaudeRoots(binding), ...retiredRoots.filter((root2) => !lstatSync24(root2, { throwIfNoEntry: false }))];
-  const budget = discoveryByteBudget();
+  const budget2 = discoveryByteBudget();
   for (const source of binding.sources) {
     assertMarketplaceBinding(binding, source);
     if (source.hashMode === "claude-plugin-registry" && binding.agent !== "claude")
@@ -58718,7 +58817,7 @@ function verifyAgentDiscovery(binding, codexRecovery) {
       safe4(source.path);
       continue;
     }
-    const current = projected(source, undefined, budget);
+    const current = projected(source, undefined, budget2);
     if (current !== source.sha256 && !verifiesCodexHookDiscoverySource(binding, source, current, codexRecovery))
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
   }
@@ -58752,6 +58851,8 @@ function codexInstallationRoots(binding) {
   });
 }
 function assertMarketplaceBinding(binding, source) {
+  if (source.hashMode === "sumi-settings-v1" && (binding.agent !== "sumi" || binding.method !== "reviewed" || basename10(source.path) !== "sumi.json"))
+    throw new Error("Sumi settings witnesses require explicit reviewed Sumi configuration");
   if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")) && (binding.agent !== "codex" || binding.method !== "reviewed" || basename10(source.path) !== "config.toml"))
     throw new Error("Codex settings witnesses require explicit reviewed Codex configuration");
   if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename10(source.path) !== "settings.json"))
@@ -58760,13 +58861,13 @@ function assertMarketplaceBinding(binding, source) {
     throw new Error("Claude marketplace witnesses require explicit reviewed Claude discovery");
 }
 function rebindAgentDiscovery(binding, changes) {
-  const budget = discoveryByteBudget();
+  const budget2 = discoveryByteBudget();
   const installationRoots = codexInstallationRoots(binding), absentRoots = [...absentCodexSkillRoots(binding), ...absentRetiredClaudeRoots(binding), ...retiredCodexRoots(binding).filter((root2) => !lstatSync24(root2, { throwIfNoEntry: false }))];
   const rebound = { ...binding, sources: binding.sources.map((source) => {
     assertMarketplaceBinding(binding, source);
     if (!changes.has(source.path) && (installationRoots.some((root2) => source.path.startsWith(root2 + sep7)) || absentRoots.some((root2) => source.path.startsWith(root2 + sep7)) && source.format === undefined && source.fields === undefined && source.managedPlugins === undefined && [undefined, "bytes"].includes(source.hashMode)))
       return source;
-    const sha2562 = projected(source, changes, budget);
+    const sha2562 = projected(source, changes, budget2);
     if (!changes.has(source.path) && sha2562 !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
     return { ...source, sha256: sha2562 };
@@ -58844,7 +58945,7 @@ function resolveAgentDiscovery(options) {
   if (agent === "hermes")
     assertHermesEnvironment(home);
   const configPath = agentDiscoveryConfigPath(home, agent);
-  const configText = witness(configPath, agent === "hermes" ? "yaml" : agent === "codex" ? "toml" : "json", agent === "hermes" ? ["skills", "plugins", "hooks"] : agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces"] : agent === "codex" ? [...CODEX_DISCOVERY_PROJECTION_FIELDS] : agent === "gemini" ? ["skills", "extensions", "security"] : agent === "opencode" ? ["plugin", "skills"] : agent === "sumi" ? ["skills", "plugin", "plugins", "permissions"] : ["version"]);
+  const configText = witness(configPath, agent === "hermes" ? "yaml" : agent === "codex" ? "toml" : "json", agent === "hermes" ? ["skills", "plugins", "hooks"] : agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces"] : agent === "codex" ? [...CODEX_DISCOVERY_PROJECTION_FIELDS] : agent === "gemini" ? ["skills", "extensions", "security"] : agent === "opencode" ? ["plugin", "skills"] : agent === "sumi" ? [...SUMI_DISCOVERY_PROJECTION_FIELDS] : ["version"]);
   const config = configText === null ? {} : agent === "hermes" ? parseHermesConfig(configText) : parseConfig(configText, configPath, agent === "codex");
   const unresolved = (detail) => {
     throw new Error(`Native discovery is unresolved (${agent}: ${detail}); provide a reviewed --discovery-inputs file`);
@@ -58941,9 +59042,9 @@ function resolveAgentDiscovery(options) {
     verifyAgentDiscovery(retained);
     if (!retained.sources.some((source) => source.path === canonical6(configPath) && source.format === undefined && source.fields === undefined))
       unresolved("retained review is missing the full agent configuration source");
-    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")))) && source.path !== canonical6(configPath)))
+    if (retained.sources.some((source) => (source.hashMode === "sumi-settings-v1" || source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")))) && source.path !== canonical6(configPath)))
       unresolved("retained settings witness names another configuration source");
-    const covered = supersedesCodexProjection(retained.sources, canonical6(configPath)) ? sources.filter((source) => !isSupersededCodexProjection(agent, canonical6(configPath), source)) : sources;
+    const covered = supersedesSettingsProjection(agent, retained.sources, canonical6(configPath)) ? sources.filter((source) => !isSupersededSettingsProjection(agent, canonical6(configPath), source)) : sources;
     if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual11(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
       unresolved("retained review is missing current runtime discovery coverage");
     return retained;
@@ -58958,11 +59059,11 @@ function resolveAgentDiscovery(options) {
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
-    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")))) && source.path !== canonical6(configPath)))
-      throw new Error("Semantic settings witnesses must name the configured Claude configuration source");
+    if (review.sources.some((source) => (source.hashMode === "sumi-settings-v1" || source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")))) && source.path !== canonical6(configPath)))
+      throw new Error("Semantic settings witnesses must name the configured agent configuration source");
     if (!review.sources.some((source) => source.path === canonical6(configPath)))
       throw new Error("Discovery review must include the agent configuration source");
-    const reviewedSources = supersedesCodexProjection(review.sources, canonical6(configPath)) ? sources.filter((source) => !isSupersededCodexProjection(agent, canonical6(configPath), source)) : sources;
+    const reviewedSources = supersedesSettingsProjection(agent, review.sources, canonical6(configPath)) ? sources.filter((source) => !isSupersededSettingsProjection(agent, canonical6(configPath), source)) : sources;
     return { ...supplied, roots: [...new Set([...roots, ...supplied.roots])].sort(), sources: [...reviewedSources, ...review.sources], ...agent === "gemini" ? { builtinNames } : {} };
   }
   function plugin(root2) {
@@ -59077,8 +59178,9 @@ function resolveAgentDiscovery(options) {
   }
   return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {}, ...agent === "hermes" ? { directories: captureDiscoveryDirectories([join36(home, ".hermes/plugins"), join36(home, ".hermes/hermes-agent")].map((path) => canonical6(path))) } : {} };
 }
-var digest = (text3) => createHash21("sha256").update(text3).digest("hex");
+var digest = (text3) => createHash22("sha256").update(text3).digest("hex");
 var init_agent_discovery = __esm(() => {
+  init_sumi_settings_witness();
   init_agent_policy_limits();
   init_agent_hermes();
   init_agent_discovery_directories();
@@ -62016,7 +62118,7 @@ var init_remote_workspace_selection = __esm(() => {
 });
 
 // src/lib/remote-private-publications.ts
-import { createHash as createHash22 } from "crypto";
+import { createHash as createHash23 } from "crypto";
 function checkedPublicationDeclaration(value) {
   if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash3(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
     return bad();
@@ -62036,7 +62138,7 @@ function checkedPublicationView(value, skillId, intentId, declaration) {
     return invalid3();
   return Object.freeze({ ...value });
 }
-async function boundedJson(url, init, token, mutation, budget = 15000, signal) {
+async function boundedJson(url, init, token, mutation, budget2 = 15000, signal) {
   const controller = new AbortController;
   let reader;
   let response;
@@ -62091,7 +62193,7 @@ async function boundedJson(url, init, token, mutation, budget = 15000, signal) {
         controller.abort();
         reject2(timeout);
       };
-      timer = setTimeout(abort, Math.max(1, Math.min(15000, budget)));
+      timer = setTimeout(abort, Math.max(1, Math.min(15000, budget2)));
       signal?.addEventListener("abort", abort, { once: true });
     })]);
   } catch (error) {
@@ -62277,7 +62379,7 @@ var PRIVATE_PUBLICATION_MAX_BYTES, failures, PrivatePublicationError, bad = () =
   throw new PrivatePublicationError("INVALID_PUBLICATION_INPUT", "Invalid publication input or recovery data.");
 }, invalid3 = () => {
   throw new PrivatePublicationError("INVALID_PUBLICATION_RESPONSE", "The server returned an invalid publication result.");
-}, publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), hash3 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v), record5 = (v) => !!v && typeof v === "object" && !Array.isArray(v), exact = (v, keys2) => record5(v) && Object.keys(v).sort().join(",") === keys2.sort().join(","), date = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v)), publicationSha256 = (bytes) => createHash22("sha256").update(bytes).digest("hex");
+}, publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), hash3 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v), record5 = (v) => !!v && typeof v === "object" && !Array.isArray(v), exact = (v, keys2) => record5(v) && Object.keys(v).sort().join(",") === keys2.sort().join(","), date = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v)), publicationSha256 = (bytes) => createHash23("sha256").update(bytes).digest("hex");
 var init_remote_private_publications = __esm(() => {
   init_fleet_credentials();
   init_remote_workspace_selection();
@@ -81666,7 +81768,7 @@ var init_v4 = __esm(() => {
 });
 
 // src/lib/canonical-json.ts
-import { createHash as createHash23 } from "crypto";
+import { createHash as createHash24 } from "crypto";
 function canonicalJson2(value, maximumBytes = 2 * 1024 * 1024) {
   return canonicalJsonAtDepth(value, maximumBytes, 64);
 }
@@ -81710,7 +81812,7 @@ function canonicalJsonAtDepth(value, maximumBytes, maximumDepth) {
   return visit3(value, 0);
 }
 function canonicalJsonSha256(value, maximumBytes) {
-  return createHash23("sha256").update(canonicalJson2(value, maximumBytes)).digest("hex");
+  return createHash24("sha256").update(canonicalJson2(value, maximumBytes)).digest("hex");
 }
 var init_canonical_json = () => {};
 
@@ -81889,7 +81991,7 @@ function parseRecurringResult(action, value, input2, identity6) {
   }
   return result2;
 }
-var RecurringInputError, RemoteRecurringUnavailableError, RemoteRecurringReadError, RemoteRecurringUnconfirmedError, failures2, RemoteRecurringError, uuid10, instant2, integer2, digest2, list, inputs, capabilityNames, budget, period, preview, consent, refusal2, occurrence, revocation, page = (item) => exports_external.object({ contractVersion: exports_external.literal(1), items: exports_external.array(item).max(100), nextCursor: exports_external.string().min(1).max(2048).nullable() }), results;
+var RecurringInputError, RemoteRecurringUnavailableError, RemoteRecurringReadError, RemoteRecurringUnconfirmedError, failures2, RemoteRecurringError, uuid10, instant2, integer2, digest2, list, inputs, capabilityNames, budget2, period, preview, consent, refusal2, occurrence, revocation, page = (item) => exports_external.object({ contractVersion: exports_external.literal(1), items: exports_external.array(item).max(100), nextCursor: exports_external.string().min(1).max(2048).nullable() }), results;
 var init_remote_recurring = __esm(() => {
   init_v4();
   init_canonical_json();
@@ -81975,7 +82077,7 @@ var init_remote_recurring = __esm(() => {
     occurrences: "recurring.occurrences",
     revoke: "recurring.revoke"
   };
-  budget = exports_external.object({ reservedCredits: integer2, settledCredits: integer2, admittedOccurrences: integer2 });
+  budget2 = exports_external.object({ reservedCredits: integer2, settledCredits: integer2, admittedOccurrences: integer2 });
   period = exports_external.object({ startsAt: instant2, endsAt: instant2 });
   preview = exports_external.object({
     contractVersion: exports_external.literal(1),
@@ -81997,8 +82099,8 @@ var init_remote_recurring = __esm(() => {
     state: exports_external.enum(["active", "revoked", "expired"]),
     activatedAt: instant2,
     revokedAt: instant2.nullable(),
-    total: budget,
-    currentPeriod: budget.extend(period.shape).nullable(),
+    total: budget2,
+    currentPeriod: budget2.extend(period.shape).nullable(),
     nextDueAt: instant2.nullable()
   });
   refusal2 = exports_external.enum([
@@ -83624,7 +83726,7 @@ var init_remote_auth = __esm(() => {
 });
 
 // src/lib/sign-in.ts
-import { createHash as createHash24 } from "crypto";
+import { createHash as createHash25 } from "crypto";
 import { chmodSync as chmodSync3, mkdirSync as mkdirSync13, readFileSync as readFileSync25, readdirSync as readdirSync14, renameSync as renameSync9, unlinkSync as unlinkSync7, writeFileSync as writeFileSync12 } from "fs";
 import { basename as basename14, dirname as dirname23, join as join41 } from "path";
 function isRecord7(value) {
@@ -83775,7 +83877,7 @@ function pendingDeviceSignInStem(env3) {
 }
 function pendingDeviceSignInPath(origin, env3 = process.env) {
   const { dir, stem } = pendingDeviceSignInStem(env3);
-  return join41(dir, `${stem}-${createHash24("sha256").update(origin).digest("hex").slice(0, 16)}.json`);
+  return join41(dir, `${stem}-${createHash25("sha256").update(origin).digest("hex").slice(0, 16)}.json`);
 }
 function savePendingDeviceSignIn(origin, start, env3 = process.env, now3 = Date.now()) {
   const path = pendingDeviceSignInPath(origin, env3);
@@ -84479,7 +84581,7 @@ function optionPrefix(program2, args) {
 }
 
 // src/lib/revision.ts
-import { createHash as createHash25 } from "crypto";
+import { createHash as createHash26 } from "crypto";
 function revisionIdOf(content) {
   const canonicalContent = {
     slug: content.slug,
@@ -84500,7 +84602,7 @@ function revisionIdOf(content) {
     canonicalContent.replacementSlug = content.replacementSlug ?? null;
   }
   const canonical6 = JSON.stringify(canonicalContent);
-  return createHash25("sha256").update(canonical6).digest("hex");
+  return createHash26("sha256").update(canonical6).digest("hex");
 }
 var REVISION_ID_PATTERN;
 var init_revision = __esm(() => {
@@ -84949,7 +85051,7 @@ var init_pull = __esm(() => {
 });
 
 // src/lib/skill-context.ts
-import { createHash as createHash26 } from "crypto";
+import { createHash as createHash27 } from "crypto";
 import { resolve as resolve22 } from "path";
 function words2(value) {
   return new Set(value.toLowerCase().match(/[a-z0-9]+/g) ?? []);
@@ -85042,7 +85144,7 @@ ${content}`;
 `);
   const receipt = {
     schemaVersion: 1,
-    id: createHash26("sha256").update(JSON.stringify({ profile: profile.profileRevision, sessionId, selections, omitted })).digest("hex"),
+    id: createHash27("sha256").update(JSON.stringify({ profile: profile.profileRevision, sessionId, selections, omitted })).digest("hex"),
     profileId: profile.profileId,
     profileRevision: profile.profileRevision,
     authority: profile.authority,
@@ -85064,7 +85166,7 @@ var init_skill_context = __esm(() => {
 });
 
 // src/lib/session-reconciliation.ts
-import { createHash as createHash27 } from "crypto";
+import { createHash as createHash28 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual12 } from "util";
 function exactTimestamp(value) {
   const parsed = value === undefined ? Number.NaN : Date.parse(value);
@@ -85204,7 +85306,7 @@ async function reconcileSkillSession(input2, options = {}) {
   const result2 = replaceSkillSession(skillSessionSnapshotBinding(snapshot2), replacement, { ...plan, planDigest }, options, () => assertPlanWindow(issuedAt, expiresAt, (options.now ?? Date.now)()));
   return { applied: true, plan, planDigest, ...result2 };
 }
-var SESSION_RECONCILIATION_PLAN_TTL_MS, digest3 = (value) => createHash27("sha256").update(JSON.stringify(value)).digest("hex");
+var SESSION_RECONCILIATION_PLAN_TTL_MS, digest3 = (value) => createHash28("sha256").update(JSON.stringify(value)).digest("hex");
 var init_session_reconciliation = __esm(() => {
   init_profile_client();
   init_selection_cache();
@@ -89846,7 +89948,7 @@ __export(exports_selected_run, {
   prepareSelectedSecretBindings: () => prepareSelectedSecretBindings,
   executeSelectedLocal: () => executeSelectedLocal
 });
-import { createHash as createHash28 } from "crypto";
+import { createHash as createHash29 } from "crypto";
 import { spawn as spawn3 } from "child_process";
 import { mkdirSync as mkdirSync16, mkdtempSync as mkdtempSync4, writeFileSync as writeFileSync16, realpathSync as realpathSync14 } from "fs";
 import { dirname as dirname25, join as join49, resolve as resolve23 } from "path";
@@ -89972,7 +90074,7 @@ async function executeSelectedLocal(selected, options = {}) {
     selection: selection2,
     target: "local",
     runtime: runtimeName,
-    inputDigest: `sha256:${createHash28("sha256").update(input2).digest("hex")}`,
+    inputDigest: `sha256:${createHash29("sha256").update(input2).digest("hex")}`,
     runDirectory,
     ...executionGrant ? { executionGrant } : {},
     ...bindings ? { secretBinding: { schema: bindings.schema, selection: bindings.selection, consumer: bindings.consumer, secretsAuthority: bindings.secretsAuthority, bindings: bindings.bindings } } : {},
@@ -94189,7 +94291,7 @@ var init_runs = __esm(() => {
 });
 
 // src/lib/run-state.ts
-import { createHash as createHash29, randomBytes } from "crypto";
+import { createHash as createHash30, randomBytes } from "crypto";
 import { existsSync as existsSync28, mkdirSync as mkdirSync17, readFileSync as readFileSync34, readdirSync as readdirSync18, statSync as statSync17, writeFileSync as writeFileSync17 } from "fs";
 import { extname, join as join50, relative as relative8 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
@@ -94326,7 +94428,7 @@ function collectRunArtifacts(context) {
     artifacts.push({
       path: toProjectRelative(context.targetDir, path),
       mime: mimeForPath(path),
-      sha256: createHash29("sha256").update(bytes).digest("hex"),
+      sha256: createHash30("sha256").update(bytes).digest("hex"),
       sizeBytes: stat2.size
     });
   }
@@ -109574,7 +109676,7 @@ var init_schedule_tools = __esm(() => {
 });
 
 // src/lib/native-storage.ts
-import { createHash as createHash30, createHmac as createHmac3 } from "crypto";
+import { createHash as createHash31, createHmac as createHmac3 } from "crypto";
 import {
   existsSync as existsSync32,
   mkdirSync as mkdirSync22,
@@ -109651,7 +109753,7 @@ function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
       files.push({
         path: relativePath,
         sizeBytes: bytes.byteLength,
-        sha256: createHash30("sha256").update(bytes).digest("hex"),
+        sha256: createHash31("sha256").update(bytes).digest("hex"),
         ...options.includeFileContents ? { contentBase64: Buffer.from(bytes).toString("base64") } : {}
       });
     }
@@ -110833,7 +110935,7 @@ var init_remote_account2 = __esm(() => {
 });
 
 // src/cli/commands/reviewed-runtime-lock.ts
-import { createHash as createHash31 } from "crypto";
+import { createHash as createHash32 } from "crypto";
 function row(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("REVIEWED_LOCK_SHAPE_INVALID");
@@ -110887,7 +110989,7 @@ async function metadata(name, context2) {
 async function validateReviewedRuntimeLock(bytes, sha2562, context2) {
   if (!/^[a-f0-9]{64}$/.test(sha2562))
     throw new Error("REVIEWED_LOCK_SHA256_INVALID");
-  if (bytes.byteLength > MAX_LOCK_BYTES || createHash31("sha256").update(bytes).digest("hex") !== sha2562)
+  if (bytes.byteLength > MAX_LOCK_BYTES || createHash32("sha256").update(bytes).digest("hex") !== sha2562)
     throw new Error("REVIEWED_LOCK_HASH_MISMATCH");
   if (!Number.isSafeInteger(context2.minReleaseAge) || context2.minReleaseAge < 1)
     throw new Error("REVIEWED_LOCK_RELEASE_AGE_REQUIRED");
@@ -110964,7 +111066,7 @@ var init_reviewed_runtime_lock = __esm(() => {
 });
 
 // src/cli/commands/runtime-copyfile.ts
-import { createHash as createHash32, randomUUID as randomUUID10 } from "crypto";
+import { createHash as createHash33, randomUUID as randomUUID10 } from "crypto";
 import { Readable } from "stream";
 import { createGunzip as createGunzip2 } from "zlib";
 import {
@@ -110988,7 +111090,7 @@ function object10(value, code2) {
   return value;
 }
 function hash5(bytes) {
-  return createHash32("sha256").update(bytes).digest("hex");
+  return createHash33("sha256").update(bytes).digest("hex");
 }
 function isWithin(parent, child) {
   const rel = relative10(parent, child);
@@ -111139,7 +111241,7 @@ function verifyIntegrity(bytes, integrity) {
   const match = /^sha512-([A-Za-z0-9+/]+={0,2})$/.exec(integrity);
   if (!match)
     throw new Error("REGISTRY_INTEGRITY_UNSUPPORTED");
-  const actual = createHash32("sha512").update(bytes).digest("base64");
+  const actual = createHash33("sha512").update(bytes).digest("base64");
   if (actual !== match[1])
     throw new Error("TARBALL_INTEGRITY_MISMATCH");
 }
@@ -112243,7 +112345,7 @@ var exports_runtime = {};
 __export(exports_runtime, {
   registerRuntime: () => registerRuntime
 });
-import { createHash as createHash33, randomUUID as randomUUID11 } from "crypto";
+import { createHash as createHash34, randomUUID as randomUUID11 } from "crypto";
 import { lstatSync as lstatSync32, mkdirSync as mkdirSync26, readFileSync as readFileSync40, realpathSync as realpathSync18, writeFileSync as writeFileSync25 } from "fs";
 import { basename as basename16, isAbsolute as isAbsolute27, join as join60 } from "path";
 import { createInterface } from "readline";
@@ -112284,7 +112386,7 @@ function registerRuntime(parent) {
       if (!expected)
         throw new Error("Cloud artifact not found");
       const bytes = await client2.download(id2, name);
-      if (bytes.length !== expected.byteSize || createHash33("sha256").update(bytes).digest("hex") !== expected.sha256)
+      if (bytes.length !== expected.byteSize || createHash34("sha256").update(bytes).digest("hex") !== expected.sha256)
         throw new Error("Cloud artifact integrity verification failed");
       writeFileSync25(options.output, bytes, { flag: "wx", mode: 384 });
       console.log(JSON.stringify({ path: options.output, sha256: expected.sha256, byteSize: bytes.length }));
@@ -113938,7 +114040,7 @@ var init_portable_snapshot_filter = __esm(() => {
 });
 
 // src/lib/station-snapshot.ts
-import { createHash as createHash34 } from "crypto";
+import { createHash as createHash35 } from "crypto";
 import {
   copyFileSync as copyFileSync2,
   mkdirSync as mkdirSync27,
@@ -113953,7 +114055,7 @@ function validateStationId(stationId) {
   }
 }
 function sha256File(filePath) {
-  return createHash34("sha256").update(readFileSync41(filePath)).digest("hex");
+  return createHash35("sha256").update(readFileSync41(filePath)).digest("hex");
 }
 function scanHome(definition, homesRoot) {
   const homePath = homePathFor(definition, homesRoot);
@@ -114643,7 +114745,7 @@ var init_codex_hook_policy_recovery = __esm(() => {
 
 // src/lib/agent-codex-trust.ts
 import { lstatSync as lstatSync34, mkdirSync as mkdirSync28, readdirSync as readdirSync23, readFileSync as readFileSync42, realpathSync as realpathSync20, statSync as statSync22 } from "fs";
-import { createHash as createHash35, randomUUID as randomUUID12 } from "crypto";
+import { createHash as createHash36, randomUUID as randomUUID12 } from "crypto";
 import { execFileSync as execFileSync2 } from "child_process";
 import { dirname as dirname36, isAbsolute as isAbsolute30, join as join64, resolve as resolve28 } from "path";
 import { homedir as homedir12 } from "os";
@@ -114653,11 +114755,11 @@ function verifyReleaseArtifact(proof, skillsCli) {
   const tarPath = realpathSync20(proof.packageTarPath);
   need5(statSync22(tarPath).isFile(), "RECONCILE_RELEASE_PROVENANCE_PATH");
   const tarBytes = readFileSync42(tarPath);
-  need5(tarBytes.byteLength === proof.packageTarBytes && createHash35("sha256").update(tarBytes).digest("hex") === proof.packageTarSha256, "RECONCILE_RELEASE_ARTIFACT_CHANGED");
+  need5(tarBytes.byteLength === proof.packageTarBytes && createHash36("sha256").update(tarBytes).digest("hex") === proof.packageTarSha256, "RECONCILE_RELEASE_ARTIFACT_CHANGED");
   const packageRoot = dirname36(dirname36(realpathSync20(skillsCli.receipt.path)));
   const manifest = readFileSync42(join64(packageRoot, "package.json"));
-  need5(createHash35("sha256").update(manifest).digest("hex") === skillsCli.receipt.manifestSha256 && skillsCli.receipt.manifestSha256 === proof.manifestSha256, "RECONCILE_RELEASE_MANIFEST_CHANGED");
-  need5(createHash35("sha256").update(readFileSync42(skillsCli.receipt.path)).digest("hex") === proof.executableSha256 && skillsCli.receipt.sha256 === proof.executableSha256, "RECONCILE_RELEASE_EXECUTABLE_CHANGED");
+  need5(createHash36("sha256").update(manifest).digest("hex") === skillsCli.receipt.manifestSha256 && skillsCli.receipt.manifestSha256 === proof.manifestSha256, "RECONCILE_RELEASE_MANIFEST_CHANGED");
+  need5(createHash36("sha256").update(readFileSync42(skillsCli.receipt.path)).digest("hex") === proof.executableSha256 && skillsCli.receipt.sha256 === proof.executableSha256, "RECONCILE_RELEASE_EXECUTABLE_CHANGED");
   const members2 = [["package/package.json", manifest], ["package/bin/index.js", readFileSync42(skillsCli.receipt.path)]];
   for (const [member, expected] of members2) {
     let actual;
@@ -114975,7 +115077,7 @@ async function enrollCodexNativeHooksUnlocked(options, connect) {
   }
 }
 var json2 = (value) => JSON.stringify(value, null, 2) + `
-`, structure3 = (text4) => JSON.parse(JSON.stringify(Bun.TOML.parse(text4))), eventNames, makePlanDigest = (value) => createHash35("sha256").update(json2(value)).digest("hex"), safeNativeHook = (hook) => ({ key: hook.key, eventName: hook.eventName, handlerType: hook.handlerType, command: hook.command, matcher: hook.matcher, timeoutSec: hook.timeoutSec, async: hook.async, statusMessage: hook.statusMessage, additionalContextLimit: hook.additionalContextLimit, sourcePath: hook.sourcePath, source: hook.source, pluginId: hook.pluginId, isManaged: hook.isManaged, currentHash: hook.currentHash, enabled: hook.enabled, trustStatus: hook.trustStatus }), withoutCodexCommand = (value) => {
+`, structure3 = (text4) => JSON.parse(JSON.stringify(Bun.TOML.parse(text4))), eventNames, makePlanDigest = (value) => createHash36("sha256").update(json2(value)).digest("hex"), safeNativeHook = (hook) => ({ key: hook.key, eventName: hook.eventName, handlerType: hook.handlerType, command: hook.command, matcher: hook.matcher, timeoutSec: hook.timeoutSec, async: hook.async, statusMessage: hook.statusMessage, additionalContextLimit: hook.additionalContextLimit, sourcePath: hook.sourcePath, source: hook.source, pluginId: hook.pluginId, isManaged: hook.isManaged, currentHash: hook.currentHash, enabled: hook.enabled, trustStatus: hook.trustStatus }), withoutCodexCommand = (value) => {
   const copy = structuredClone(value);
   if (copy?.bridge?.commands && Object.hasOwn(copy.bridge.commands, "codex"))
     copy.bridge.commands.codex = "<reviewed-codex-binding>";
@@ -114999,7 +115101,7 @@ var init_agent_codex_trust = __esm(() => {
 });
 
 // src/lib/codex-native-trust.ts
-import { createHash as createHash36 } from "crypto";
+import { createHash as createHash37 } from "crypto";
 import { readFileSync as readFileSync43 } from "fs";
 import { join as join65, resolve as resolve29 } from "path";
 function refuse5(detail) {
@@ -115072,7 +115174,7 @@ function applyCodexNativeTrust(plan, expectedPolicySha256) {
   receipt.readback = { policySha256: sha6(readback.text), digests, verified: true };
   return receipt;
 }
-var CODEX_NATIVE_TRUST_PLAN_SCHEMA = "skills.codex-native-trust-plan/v1", CODEX_NATIVE_TRUST_RECEIPT_SCHEMA = "skills.codex-native-trust-receipt/v1", PLATFORM_KEY2, HEX_DIGEST2, MAX_DIGESTS = 16, sha6 = (data) => createHash36("sha256").update(data).digest("hex");
+var CODEX_NATIVE_TRUST_PLAN_SCHEMA = "skills.codex-native-trust-plan/v1", CODEX_NATIVE_TRUST_RECEIPT_SCHEMA = "skills.codex-native-trust-receipt/v1", PLATFORM_KEY2, HEX_DIGEST2, MAX_DIGESTS = 16, sha6 = (data) => createHash37("sha256").update(data).digest("hex");
 var init_codex_native_trust = __esm(() => {
   init_config();
   init_managed_policy();
@@ -115202,7 +115304,7 @@ __export(exports_agent_integration, {
   registerAgentIntegration: () => registerAgentIntegration
 });
 import { existsSync as existsSync36, lstatSync as lstatSync35, readFileSync as readFileSync44, readSync as readSync18, writeFileSync as writeFileSync27 } from "fs";
-import { createHash as createHash37 } from "crypto";
+import { createHash as createHash38 } from "crypto";
 import { homedir as homedir13 } from "os";
 import { isAbsolute as isAbsolute31 } from "path";
 function pinnedHookProfile(input3, configuredProfile) {
@@ -115327,7 +115429,7 @@ function registerAgentIntegration(parent) {
         skillCount: catalog.skills.length,
         output: options.output,
         bytes: Buffer.byteLength(bytes),
-        sha256: createHash37("sha256").update(bytes).digest("hex")
+        sha256: createHash38("sha256").update(bytes).digest("hex")
       };
       await writeCliOutput(options.json ? JSON.stringify(receipt) : `Captured ${receipt.skillCount} native Codex skill(s) in ${receipt.output}.`);
     } catch (error61) {
@@ -115336,16 +115438,16 @@ function registerAgentIntegration(parent) {
       process.exitCode = 1;
     }
   });
-  hook.command("witness").requiredOption("--kind <kind>", "claude-settings-v3, claude-settings-v2, codex-settings-v4, codex-settings-v3, codex-settings-v2, codex-settings-v1 or claude-marketplace-registry-v2").requiredOption("--path <path>", "Canonical absolute path to the reviewed settings or registry file").option("--json", "Output the discovery witness as JSON", false).description("Capture an explicit versioned review witness without installing it").action(async (options) => {
-    const capture2 = options.kind === "codex-settings-v4" ? captureCodexSettingsV4 : options.kind === "codex-settings-v3" ? captureCodexSettingsV3 : options.kind === "codex-settings-v2" ? captureCodexSettingsV2 : options.kind === "codex-settings-v1" ? captureCodexSettings : options.kind === "claude-settings-v3" ? captureClaudeSettingsV3 : options.kind === "claude-settings-v2" ? captureClaudeSettingsV2 : options.kind === "claude-marketplace-registry-v2" ? captureClaudeMarketplaceRegistryV2 : null;
+  hook.command("witness").requiredOption("--kind <kind>", "sumi-settings-v1, claude-settings-v3, claude-settings-v2, codex-settings-v4, codex-settings-v3, codex-settings-v2, codex-settings-v1 or claude-marketplace-registry-v2").requiredOption("--path <path>", "Canonical absolute path to the reviewed settings or registry file").option("--json", "Output the discovery witness as JSON", false).description("Capture an explicit versioned review witness without installing it").action(async (options) => {
+    const capture2 = options.kind === "sumi-settings-v1" ? captureSumiSettings : options.kind === "codex-settings-v4" ? captureCodexSettingsV4 : options.kind === "codex-settings-v3" ? captureCodexSettingsV3 : options.kind === "codex-settings-v2" ? captureCodexSettingsV2 : options.kind === "codex-settings-v1" ? captureCodexSettings : options.kind === "claude-settings-v3" ? captureClaudeSettingsV3 : options.kind === "claude-settings-v2" ? captureClaudeSettingsV2 : options.kind === "claude-marketplace-registry-v2" ? captureClaudeMarketplaceRegistryV2 : null;
     if (!capture2)
-      throw new Error("Unsupported witness kind; select claude-settings-v3, claude-settings-v2, codex-settings-v4, codex-settings-v3, codex-settings-v2, codex-settings-v1 or claude-marketplace-registry-v2");
+      throw new Error("Unsupported witness kind; select sumi-settings-v1, claude-settings-v3, claude-settings-v2, codex-settings-v4, codex-settings-v3, codex-settings-v2, codex-settings-v1 or claude-marketplace-registry-v2");
     await writeCliOutput(JSON.stringify(capture2(options.path), null, 2));
   });
-  hook.command("rebind-settings").requiredOption("--agent <agent>", "claude or codex").requiredOption("--reviewed-preimage <path>", "Exact preserved legacy settings.json or config.toml").requiredOption("--expected-policy-sha256 <sha256>", "Exact current managed policy bytes").requiredOption("--expected-settings-sha256 <sha256>", "Exact current native settings bytes").option("--codex-witness-version <version>", "Explicit target: 2 (legacy default) 3 (service tier and model-advertised effort), or 4 (native availability UI counts)").option("--apply", "Apply the explicit semantic witness upgrade with preservation and readback", false).option("--json", "Return the metadata-only plan or receipt", false).description("Explicitly migrate a legacy native settings witness after proving only known preferences changed").action(async (options) => {
+  hook.command("rebind-settings").requiredOption("--agent <agent>", "claude, codex or sumi").requiredOption("--reviewed-preimage <path>", "Exact preserved legacy settings.json, config.toml or sumi.json").requiredOption("--expected-policy-sha256 <sha256>", "Exact current managed policy bytes").requiredOption("--expected-settings-sha256 <sha256>", "Exact current native settings bytes").option("--codex-witness-version <version>", "Explicit target: 2 (legacy default) 3 (service tier and model-advertised effort), or 4 (native availability UI counts)").option("--apply", "Apply the explicit semantic witness upgrade with preservation and readback", false).option("--json", "Return the metadata-only plan or receipt", false).description("Explicitly migrate a legacy native settings witness after proving only known preferences changed").action(async (options) => {
     try {
-      if (!["claude", "codex"].includes(options.agent))
-        throw new Error("Settings witness rebind accepts claude or codex");
+      if (!["claude", "codex", "sumi"].includes(options.agent))
+        throw new Error("Settings witness rebind accepts claude, codex or sumi");
       if (options.codexWitnessVersion !== undefined && !["2", "3", "4"].includes(options.codexWitnessVersion))
         throw new Error("Codex witness version accepts 2, 3 or 4");
       const plan = planAgentSettingsWitnessUpgrade({ ...options.codexWitnessVersion !== undefined ? { targetCodexVersion: Number(options.codexWitnessVersion) } : {}, agent: options.agent, reviewedPreimage: options.reviewedPreimage, expectedPolicySha256: options.expectedPolicySha256, expectedSettingsSha256: options.expectedSettingsSha256 });
@@ -115573,6 +115675,7 @@ function registerAgentIntegration(parent) {
 }
 var RECOVERABLE_CONTEXT_CACHE_ERRORS;
 var init_agent_integration2 = __esm(() => {
+  init_sumi_settings_witness();
   init_agent_hermes();
   init_context();
   init_agent_adapters();
@@ -115859,7 +115962,7 @@ var init_grants = __esm(() => {
 });
 
 // src/lib/station-hydrate.ts
-import { createHash as createHash38 } from "crypto";
+import { createHash as createHash39 } from "crypto";
 import {
   copyFileSync as copyFileSync3,
   mkdirSync as mkdirSync29,
@@ -116062,7 +116165,7 @@ function skillSha256(skill) {
     return sha256File(skill.files[0].winner.fullPath);
   }
   const joined = skill.files.map((file2) => sha256File(file2.winner.fullPath));
-  return createHash38("sha256").update(joined.sort().join(`
+  return createHash39("sha256").update(joined.sort().join(`
 `)).digest("hex");
 }
 function writeStationHydration(options) {
@@ -116219,7 +116322,7 @@ var init_hydrate = __esm(() => {
 });
 
 // src/lib/prepare-skill.ts
-import { createHash as createHash39, randomUUID as randomUUID13 } from "crypto";
+import { createHash as createHash40, randomUUID as randomUUID13 } from "crypto";
 import { chmodSync as chmodSync5, existsSync as existsSync37, lstatSync as lstatSync36, mkdirSync as mkdirSync30, mkdtempSync as mkdtempSync6, readFileSync as readFileSync46, readdirSync as readdirSync25, renameSync as renameSync15, rmSync as rmSync9, writeFileSync as writeFileSync31 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { dirname as dirname38, isAbsolute as isAbsolute32, join as join67, relative as relative12, resolve as resolve31, sep as sep15 } from "path";
@@ -116418,7 +116521,7 @@ function snapshot2(root2) {
   if (rootStat.isSymbolicLink() || !rootStat.isDirectory())
     throw new Error("Skill root must be a real directory, not a symlink.");
   const files = [], directories = [];
-  const hash6 = createHash39("sha256").update(`${rootStat.dev}:${rootStat.ino}\x00`);
+  const hash6 = createHash40("sha256").update(`${rootStat.dev}:${rootStat.ino}\x00`);
   let count = 0, bytes = 0;
   const walk2 = (relative13) => {
     for (const name of readdirSync25(join67(root2, relative13)).sort()) {