@hasna/skills 0.10.52 → 0.10.54

package/README.md

@@ -643,9 +643,9 @@ skills hook native-catalog --cwd /absolute/project --output /private/catalog.jso
 skills hook install --agent codex --codex-native-catalog /private/catalog.json --json
 ```
 
-Codex 0.159.2, 0.160.0 and 0.160.1 have measured qualified-name catalog support.
+Codex 0.159.2, 0.160.0, 0.160.1 and 0.161.0 have measured qualified-name catalog support.
 Native transport, capture and review use one capability registry of exact
-releases. Unmeasured releases, including 0.160.2 and 0.161.0, refuse until the
+releases. Unmeasured releases, including 0.160.2 and 0.161.1, refuse until the
 native catalog/name-denial and hook-dispatch acceptance tests pass; an RPC
 handshake alone does not establish those semantics. Admitting a release does not
 admit its corpus: the transport still requires the existing native corpus
@@ -697,7 +697,7 @@ different extant, witnessed user version. Individual missing files, current
 registered roots, aliases and registration changes still refuse; historical
 source hashes and typed settings witnesses remain intact.
 
-For a Codex 0.160.0 or 0.160.1 remote refresh omitted by an existing qualified-name disable,
+For a Codex 0.160.0, 0.160.1 or 0.161.0 remote refresh omitted by an existing qualified-name disable,
 a fresh native catalog and discovery review can plan the new exact path disable
 in the same transaction. The remote installation receipt, namespace and capability
 controls must match; conflicting enable rules, unknown names and ambiguous

package/bin/index.js

@@ -36888,7 +36888,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.52",
+    version: "0.10.54",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -40291,7 +40291,8 @@ var init_codex_native_compatibility = __esm(() => {
     "codex-cli 0.159.0": ["hooks"],
     "codex-cli 0.159.2": ["hooks", "qualified-skill-catalog"],
     "codex-cli 0.160.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
-    "codex-cli 0.160.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
+    "codex-cli 0.160.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
+    "codex-cli 0.161.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
   };
   SUPPORTED_CODEX_HOOK_VERSIONS = Object.freeze(Object.keys(MEASURED_CODEX_CAPABILITIES).filter((version) => supportsCodexNativeCapability(version, "hooks")));
 });
@@ -59505,12 +59506,17 @@ function captureRetiredCodexDiscovery(binding, controls, rules) {
     return { ...current, codexRetiredMaterializations: previous };
   return { ...current, codexRetiredMaterializations: { roots, parents: parents3, directories: captureDiscoveryDirectoryProjection(directories.map((item) => item.path), roots) } };
 }
+function retainableAbsentSource(source) {
+  if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined)
+    return false;
+  return [undefined, "bytes"].includes(source.hashMode) || source.hashMode === "claude-plugin-manifest-v1" && source.sha256 !== null && source.path.endsWith(join37(sep8, ".claude-plugin", "plugin.json"));
+}
 function absentRetiredClaudeRoots(binding) {
   if (binding.agent !== "claude" || binding.method !== "reviewed")
     return [];
   const result2 = new Set;
   for (const source of binding.sources) {
-    if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || ![undefined, "bytes"].includes(source.hashMode) || source.sha256 === null)
+    if (!retainableAbsentSource(source) || source.sha256 === null)
       continue;
     const marker = sep8 + ".claude" + sep8 + "plugins" + sep8 + "cache" + sep8, at2 = source.path.indexOf(marker);
     if (at2 < 0 || source.path.indexOf(marker, at2 + 1) >= 0)
@@ -59535,17 +59541,41 @@ function absentRetiredClaudeRoots(binding) {
       continue;
     if (JSON.stringify(config.hooks ?? {}).includes(root2))
       continue;
+    const registrationScope = (row) => {
+      if (!row || typeof row !== "object" || Array.isArray(row))
+        return null;
+      const value = row;
+      if (typeof value.installPath !== "string" || /[\x00-\x1f\x7f]/.test(value.installPath) || !isAbsolute22(value.installPath) || resolve21(value.installPath) !== value.installPath || value.installPath.length > AGENT_POLICY_LIMITS.pathCharacters)
+        return null;
+      if (value.scope === "user")
+        return value.projectPath === undefined || value.projectPath === null ? "user\x00" : null;
+      if (value.scope === "project")
+        return typeof value.projectPath === "string" && !/[\x00-\x1f\x7f]/.test(value.projectPath) && value.projectPath.length <= AGENT_POLICY_LIMITS.pathCharacters && isAbsolute22(value.projectPath) && resolve21(value.projectPath) === value.projectPath ? `project\x00${value.projectPath}` : null;
+      return null;
+    };
+    if (Object.values(installed.plugins).some((value) => !Array.isArray(value) || value.some((row) => !row || typeof row.installPath !== "string" || row.installPath === root2 || row.installPath.startsWith(root2 + sep8) || root2.startsWith(row.installPath + sep8))))
+      continue;
     const rows = installed.plugins[id];
-    if (!Array.isArray(rows) || rows.length !== 1 || rows[0]?.scope !== "user" || typeof rows[0]?.installPath !== "string")
+    if (!Array.isArray(rows) || rows.length < 1)
       continue;
-    const active = rows[0].installPath;
-    if (rows[0].version !== basename11(active) || resolve21(active) !== active || dirname20(active) !== dirname20(root2) || active === root2 || !lstatSync25(active, { throwIfNoEntry: false })?.isDirectory() || realpathSync11(active) !== active)
+    const targetScopes = new Set;
+    let targetValid = true;
+    for (const row of rows) {
+      const scope = registrationScope(row), value = row;
+      if (scope === null || targetScopes.has(scope) || value?.installPath !== rows[0]?.installPath || value?.version !== rows[0]?.version) {
+        targetValid = false;
+        break;
+      }
+      targetScopes.add(scope);
+    }
+    if (!targetValid || !targetScopes.has("user\x00"))
+      continue;
+    const active = rows[0]?.installPath;
+    if (typeof active !== "string" || rows[0]?.version !== basename11(active) || dirname20(active) !== dirname20(root2) || active === root2 || !lstatSync25(active, { throwIfNoEntry: false })?.isDirectory() || realpathSync11(active) !== active)
       continue;
     const activeManifest = full(join37(active, ".claude-plugin/plugin.json"));
     if (!activeManifest || projected(activeManifest) !== activeManifest.sha256)
       continue;
-    if (Object.values(installed.plugins).some((value) => !Array.isArray(value) || value.some((row) => !row || typeof row.installPath !== "string" || row.installPath === root2 || row.installPath.startsWith(root2 + sep8) || root2.startsWith(row.installPath + sep8))))
-      continue;
     result2.add(root2);
   }
   return [...result2];
@@ -59598,7 +59628,7 @@ function verifyAgentDiscovery(binding, codexRecovery) {
       safe4(source.path);
       continue;
     }
-    if (absentRoots.some((root2) => source.path.startsWith(root2 + sep8)) && source.format === undefined && source.fields === undefined && source.managedPlugins === undefined && [undefined, "bytes"].includes(source.hashMode)) {
+    if (absentRoots.some((root2) => source.path.startsWith(root2 + sep8)) && retainableAbsentSource(source)) {
       safe4(source.path);
       continue;
     }
@@ -59654,7 +59684,7 @@ function rebindAgentDiscovery(binding, changes) {
   const installationRoots = codexInstallationRoots(binding), absentRoots = [...absentCodexSkillRoots(binding), ...absentRetiredClaudeRoots(binding), ...retiredCodexRoots(binding).filter((root2) => !lstatSync25(root2, { throwIfNoEntry: false }))];
   const rebound = { ...binding, sources: binding.sources.map((source) => {
     assertMarketplaceBinding(binding, source);
-    if (!changes.has(source.path) && (installationRoots.some((root2) => source.path.startsWith(root2 + sep8)) || absentRoots.some((root2) => source.path.startsWith(root2 + sep8)) && source.format === undefined && source.fields === undefined && source.managedPlugins === undefined && [undefined, "bytes"].includes(source.hashMode)))
+    if (!changes.has(source.path) && (installationRoots.some((root2) => source.path.startsWith(root2 + sep8)) || absentRoots.some((root2) => source.path.startsWith(root2 + sep8)) && retainableAbsentSource(source)))
       return source;
     const sha2563 = projected(source, changes, budget2);
     if (!changes.has(source.path) && sha2563 !== source.sha256)

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.52",
+    version: "0.10.54",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -38560,7 +38560,8 @@ var init_codex_native_compatibility = __esm(() => {
     "codex-cli 0.159.0": ["hooks"],
     "codex-cli 0.159.2": ["hooks", "qualified-skill-catalog"],
     "codex-cli 0.160.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
-    "codex-cli 0.160.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
+    "codex-cli 0.160.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
+    "codex-cli 0.161.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
   };
   SUPPORTED_CODEX_HOOK_VERSIONS = Object.freeze(Object.keys(MEASURED_CODEX_CAPABILITIES).filter((version2) => supportsCodexNativeCapability(version2, "hooks")));
 });
@@ -50916,12 +50917,17 @@ function retiredCodexRoots(binding) {
   }
   return proof.roots;
 }
+function retainableAbsentSource(source) {
+  if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined)
+    return false;
+  return [undefined, "bytes"].includes(source.hashMode) || source.hashMode === "claude-plugin-manifest-v1" && source.sha256 !== null && source.path.endsWith(join26(sep6, ".claude-plugin", "plugin.json"));
+}
 function absentRetiredClaudeRoots(binding) {
   if (binding.agent !== "claude" || binding.method !== "reviewed")
     return [];
   const result = new Set;
   for (const source of binding.sources) {
-    if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || ![undefined, "bytes"].includes(source.hashMode) || source.sha256 === null)
+    if (!retainableAbsentSource(source) || source.sha256 === null)
       continue;
     const marker = sep6 + ".claude" + sep6 + "plugins" + sep6 + "cache" + sep6, at = source.path.indexOf(marker);
     if (at < 0 || source.path.indexOf(marker, at + 1) >= 0)
@@ -50946,17 +50952,41 @@ function absentRetiredClaudeRoots(binding) {
       continue;
     if (JSON.stringify(config2.hooks ?? {}).includes(root))
       continue;
+    const registrationScope = (row) => {
+      if (!row || typeof row !== "object" || Array.isArray(row))
+        return null;
+      const value = row;
+      if (typeof value.installPath !== "string" || /[\x00-\x1f\x7f]/.test(value.installPath) || !isAbsolute15(value.installPath) || resolve17(value.installPath) !== value.installPath || value.installPath.length > AGENT_POLICY_LIMITS.pathCharacters)
+        return null;
+      if (value.scope === "user")
+        return value.projectPath === undefined || value.projectPath === null ? "user\x00" : null;
+      if (value.scope === "project")
+        return typeof value.projectPath === "string" && !/[\x00-\x1f\x7f]/.test(value.projectPath) && value.projectPath.length <= AGENT_POLICY_LIMITS.pathCharacters && isAbsolute15(value.projectPath) && resolve17(value.projectPath) === value.projectPath ? `project\x00${value.projectPath}` : null;
+      return null;
+    };
+    if (Object.values(installed.plugins).some((value) => !Array.isArray(value) || value.some((row) => !row || typeof row.installPath !== "string" || row.installPath === root || row.installPath.startsWith(root + sep6) || root.startsWith(row.installPath + sep6))))
+      continue;
     const rows = installed.plugins[id];
-    if (!Array.isArray(rows) || rows.length !== 1 || rows[0]?.scope !== "user" || typeof rows[0]?.installPath !== "string")
+    if (!Array.isArray(rows) || rows.length < 1)
       continue;
-    const active = rows[0].installPath;
-    if (rows[0].version !== basename9(active) || resolve17(active) !== active || dirname16(active) !== dirname16(root) || active === root || !lstatSync18(active, { throwIfNoEntry: false })?.isDirectory() || realpathSync5(active) !== active)
+    const targetScopes = new Set;
+    let targetValid = true;
+    for (const row of rows) {
+      const scope = registrationScope(row), value = row;
+      if (scope === null || targetScopes.has(scope) || value?.installPath !== rows[0]?.installPath || value?.version !== rows[0]?.version) {
+        targetValid = false;
+        break;
+      }
+      targetScopes.add(scope);
+    }
+    if (!targetValid || !targetScopes.has("user\x00"))
+      continue;
+    const active = rows[0]?.installPath;
+    if (typeof active !== "string" || rows[0]?.version !== basename9(active) || dirname16(active) !== dirname16(root) || active === root || !lstatSync18(active, { throwIfNoEntry: false })?.isDirectory() || realpathSync5(active) !== active)
       continue;
     const activeManifest = full(join26(active, ".claude-plugin/plugin.json"));
     if (!activeManifest || projected(activeManifest) !== activeManifest.sha256)
       continue;
-    if (Object.values(installed.plugins).some((value) => !Array.isArray(value) || value.some((row) => !row || typeof row.installPath !== "string" || row.installPath === root || row.installPath.startsWith(root + sep6) || root.startsWith(row.installPath + sep6))))
-      continue;
     result.add(root);
   }
   return [...result];
@@ -51009,7 +51039,7 @@ function verifyAgentDiscovery(binding, codexRecovery) {
       safe4(source.path);
       continue;
     }
-    if (absentRoots.some((root) => source.path.startsWith(root + sep6)) && source.format === undefined && source.fields === undefined && source.managedPlugins === undefined && [undefined, "bytes"].includes(source.hashMode)) {
+    if (absentRoots.some((root) => source.path.startsWith(root + sep6)) && retainableAbsentSource(source)) {
       safe4(source.path);
       continue;
     }

package/bin/migrate.js

@@ -25,7 +25,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.52",
+  version: "0.10.54",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24140,7 +24140,7 @@ restoreLaunchCwd();
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.52",
+  version: "0.10.54",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -24143,7 +24143,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.52",
+  version: "0.10.54",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/index.js

@@ -9398,7 +9398,8 @@ var MEASURED_CODEX_CAPABILITIES = {
   "codex-cli 0.159.0": ["hooks"],
   "codex-cli 0.159.2": ["hooks", "qualified-skill-catalog"],
   "codex-cli 0.160.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
-  "codex-cli 0.160.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
+  "codex-cli 0.160.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
+  "codex-cli 0.161.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
 };
 function supportsCodexNativeCapability(version, capability) {
   return typeof version === "string" && Object.hasOwn(MEASURED_CODEX_CAPABILITIES, version) && MEASURED_CODEX_CAPABILITIES[version].includes(capability);
@@ -11832,7 +11833,7 @@ function replaceSkillSession(expected, replacement, plan, options = {}, beforeCo
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.52",
+  version: "0.10.54",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -20837,12 +20838,17 @@ function captureRetiredCodexDiscovery(binding, controls, rules) {
     return { ...current, codexRetiredMaterializations: previous };
   return { ...current, codexRetiredMaterializations: { roots, parents: parents3, directories: captureDiscoveryDirectoryProjection(directories.map((item) => item.path), roots) } };
 }
+function retainableAbsentSource(source) {
+  if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined)
+    return false;
+  return [undefined, "bytes"].includes(source.hashMode) || source.hashMode === "claude-plugin-manifest-v1" && source.sha256 !== null && source.path.endsWith(join32(sep8, ".claude-plugin", "plugin.json"));
+}
 function absentRetiredClaudeRoots(binding) {
   if (binding.agent !== "claude" || binding.method !== "reviewed")
     return [];
   const result = new Set;
   for (const source of binding.sources) {
-    if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || ![undefined, "bytes"].includes(source.hashMode) || source.sha256 === null)
+    if (!retainableAbsentSource(source) || source.sha256 === null)
       continue;
     const marker = sep8 + ".claude" + sep8 + "plugins" + sep8 + "cache" + sep8, at = source.path.indexOf(marker);
     if (at < 0 || source.path.indexOf(marker, at + 1) >= 0)
@@ -20867,17 +20873,41 @@ function absentRetiredClaudeRoots(binding) {
       continue;
     if (JSON.stringify(config.hooks ?? {}).includes(root2))
       continue;
+    const registrationScope = (row) => {
+      if (!row || typeof row !== "object" || Array.isArray(row))
+        return null;
+      const value = row;
+      if (typeof value.installPath !== "string" || /[\x00-\x1f\x7f]/.test(value.installPath) || !isAbsolute21(value.installPath) || resolve20(value.installPath) !== value.installPath || value.installPath.length > AGENT_POLICY_LIMITS.pathCharacters)
+        return null;
+      if (value.scope === "user")
+        return value.projectPath === undefined || value.projectPath === null ? "user\x00" : null;
+      if (value.scope === "project")
+        return typeof value.projectPath === "string" && !/[\x00-\x1f\x7f]/.test(value.projectPath) && value.projectPath.length <= AGENT_POLICY_LIMITS.pathCharacters && isAbsolute21(value.projectPath) && resolve20(value.projectPath) === value.projectPath ? `project\x00${value.projectPath}` : null;
+      return null;
+    };
+    if (Object.values(installed.plugins).some((value) => !Array.isArray(value) || value.some((row) => !row || typeof row.installPath !== "string" || row.installPath === root2 || row.installPath.startsWith(root2 + sep8) || root2.startsWith(row.installPath + sep8))))
+      continue;
     const rows = installed.plugins[id];
-    if (!Array.isArray(rows) || rows.length !== 1 || rows[0]?.scope !== "user" || typeof rows[0]?.installPath !== "string")
+    if (!Array.isArray(rows) || rows.length < 1)
       continue;
-    const active = rows[0].installPath;
-    if (rows[0].version !== basename11(active) || resolve20(active) !== active || dirname20(active) !== dirname20(root2) || active === root2 || !lstatSync25(active, { throwIfNoEntry: false })?.isDirectory() || realpathSync11(active) !== active)
+    const targetScopes = new Set;
+    let targetValid = true;
+    for (const row of rows) {
+      const scope = registrationScope(row), value = row;
+      if (scope === null || targetScopes.has(scope) || value?.installPath !== rows[0]?.installPath || value?.version !== rows[0]?.version) {
+        targetValid = false;
+        break;
+      }
+      targetScopes.add(scope);
+    }
+    if (!targetValid || !targetScopes.has("user\x00"))
+      continue;
+    const active = rows[0]?.installPath;
+    if (typeof active !== "string" || rows[0]?.version !== basename11(active) || dirname20(active) !== dirname20(root2) || active === root2 || !lstatSync25(active, { throwIfNoEntry: false })?.isDirectory() || realpathSync11(active) !== active)
       continue;
     const activeManifest = full(join32(active, ".claude-plugin/plugin.json"));
     if (!activeManifest || projected(activeManifest) !== activeManifest.sha256)
       continue;
-    if (Object.values(installed.plugins).some((value) => !Array.isArray(value) || value.some((row) => !row || typeof row.installPath !== "string" || row.installPath === root2 || row.installPath.startsWith(root2 + sep8) || root2.startsWith(row.installPath + sep8))))
-      continue;
     result.add(root2);
   }
   return [...result];
@@ -20930,7 +20960,7 @@ function verifyAgentDiscovery(binding, codexRecovery) {
       safe4(source.path);
       continue;
     }
-    if (absentRoots.some((root2) => source.path.startsWith(root2 + sep8)) && source.format === undefined && source.fields === undefined && source.managedPlugins === undefined && [undefined, "bytes"].includes(source.hashMode)) {
+    if (absentRoots.some((root2) => source.path.startsWith(root2 + sep8)) && retainableAbsentSource(source)) {
       safe4(source.path);
       continue;
     }
@@ -20986,7 +21016,7 @@ function rebindAgentDiscovery(binding, changes) {
   const installationRoots = codexInstallationRoots(binding), absentRoots = [...absentCodexSkillRoots(binding), ...absentRetiredClaudeRoots(binding), ...retiredCodexRoots(binding).filter((root2) => !lstatSync25(root2, { throwIfNoEntry: false }))];
   const rebound = { ...binding, sources: binding.sources.map((source) => {
     assertMarketplaceBinding(binding, source);
-    if (!changes.has(source.path) && (installationRoots.some((root2) => source.path.startsWith(root2 + sep8)) || absentRoots.some((root2) => source.path.startsWith(root2 + sep8)) && source.format === undefined && source.fields === undefined && source.managedPlugins === undefined && [undefined, "bytes"].includes(source.hashMode)))
+    if (!changes.has(source.path) && (installationRoots.some((root2) => source.path.startsWith(root2 + sep8)) || absentRoots.some((root2) => source.path.startsWith(root2 + sep8)) && retainableAbsentSource(source)))
       return source;
     const sha2563 = projected(source, changes, budget2);
     if (!changes.has(source.path) && sha2563 !== source.sha256)

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.52",
+  version: "0.10.54",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -38446,7 +38446,8 @@ var MEASURED_CODEX_CAPABILITIES = {
   "codex-cli 0.159.0": ["hooks"],
   "codex-cli 0.159.2": ["hooks", "qualified-skill-catalog"],
   "codex-cli 0.160.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
-  "codex-cli 0.160.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
+  "codex-cli 0.160.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
+  "codex-cli 0.161.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
 };
 function supportsCodexNativeCapability(version, capability) {
   return typeof version === "string" && Object.hasOwn(MEASURED_CODEX_CAPABILITIES, version) && MEASURED_CODEX_CAPABILITIES[version].includes(capability);
@@ -43655,12 +43656,17 @@ function captureRetiredCodexDiscovery(binding, controls, rules) {
     return { ...current, codexRetiredMaterializations: previous };
   return { ...current, codexRetiredMaterializations: { roots, parents: parents3, directories: captureDiscoveryDirectoryProjection(directories.map((item) => item.path), roots) } };
 }
+function retainableAbsentSource(source) {
+  if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined)
+    return false;
+  return [undefined, "bytes"].includes(source.hashMode) || source.hashMode === "claude-plugin-manifest-v1" && source.sha256 !== null && source.path.endsWith(join26(sep6, ".claude-plugin", "plugin.json"));
+}
 function absentRetiredClaudeRoots(binding) {
   if (binding.agent !== "claude" || binding.method !== "reviewed")
     return [];
   const result = new Set;
   for (const source of binding.sources) {
-    if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || ![undefined, "bytes"].includes(source.hashMode) || source.sha256 === null)
+    if (!retainableAbsentSource(source) || source.sha256 === null)
       continue;
     const marker = sep6 + ".claude" + sep6 + "plugins" + sep6 + "cache" + sep6, at = source.path.indexOf(marker);
     if (at < 0 || source.path.indexOf(marker, at + 1) >= 0)
@@ -43685,17 +43691,41 @@ function absentRetiredClaudeRoots(binding) {
       continue;
     if (JSON.stringify(config.hooks ?? {}).includes(root2))
       continue;
+    const registrationScope = (row) => {
+      if (!row || typeof row !== "object" || Array.isArray(row))
+        return null;
+      const value = row;
+      if (typeof value.installPath !== "string" || /[\x00-\x1f\x7f]/.test(value.installPath) || !isAbsolute20(value.installPath) || resolve19(value.installPath) !== value.installPath || value.installPath.length > AGENT_POLICY_LIMITS.pathCharacters)
+        return null;
+      if (value.scope === "user")
+        return value.projectPath === undefined || value.projectPath === null ? "user\x00" : null;
+      if (value.scope === "project")
+        return typeof value.projectPath === "string" && !/[\x00-\x1f\x7f]/.test(value.projectPath) && value.projectPath.length <= AGENT_POLICY_LIMITS.pathCharacters && isAbsolute20(value.projectPath) && resolve19(value.projectPath) === value.projectPath ? `project\x00${value.projectPath}` : null;
+      return null;
+    };
+    if (Object.values(installed.plugins).some((value) => !Array.isArray(value) || value.some((row) => !row || typeof row.installPath !== "string" || row.installPath === root2 || row.installPath.startsWith(root2 + sep6) || root2.startsWith(row.installPath + sep6))))
+      continue;
     const rows = installed.plugins[id2];
-    if (!Array.isArray(rows) || rows.length !== 1 || rows[0]?.scope !== "user" || typeof rows[0]?.installPath !== "string")
+    if (!Array.isArray(rows) || rows.length < 1)
       continue;
-    const active = rows[0].installPath;
-    if (rows[0].version !== basename9(active) || resolve19(active) !== active || dirname17(active) !== dirname17(root2) || active === root2 || !lstatSync21(active, { throwIfNoEntry: false })?.isDirectory() || realpathSync9(active) !== active)
+    const targetScopes = new Set;
+    let targetValid = true;
+    for (const row of rows) {
+      const scope = registrationScope(row), value = row;
+      if (scope === null || targetScopes.has(scope) || value?.installPath !== rows[0]?.installPath || value?.version !== rows[0]?.version) {
+        targetValid = false;
+        break;
+      }
+      targetScopes.add(scope);
+    }
+    if (!targetValid || !targetScopes.has("user\x00"))
+      continue;
+    const active = rows[0]?.installPath;
+    if (typeof active !== "string" || rows[0]?.version !== basename9(active) || dirname17(active) !== dirname17(root2) || active === root2 || !lstatSync21(active, { throwIfNoEntry: false })?.isDirectory() || realpathSync9(active) !== active)
       continue;
     const activeManifest = full(join26(active, ".claude-plugin/plugin.json"));
     if (!activeManifest || projected(activeManifest) !== activeManifest.sha256)
       continue;
-    if (Object.values(installed.plugins).some((value) => !Array.isArray(value) || value.some((row) => !row || typeof row.installPath !== "string" || row.installPath === root2 || row.installPath.startsWith(root2 + sep6) || root2.startsWith(row.installPath + sep6))))
-      continue;
     result.add(root2);
   }
   return [...result];
@@ -43748,7 +43778,7 @@ function verifyAgentDiscovery(binding, codexRecovery) {
       safe4(source.path);
       continue;
     }
-    if (absentRoots.some((root2) => source.path.startsWith(root2 + sep6)) && source.format === undefined && source.fields === undefined && source.managedPlugins === undefined && [undefined, "bytes"].includes(source.hashMode)) {
+    if (absentRoots.some((root2) => source.path.startsWith(root2 + sep6)) && retainableAbsentSource(source)) {
       safe4(source.path);
       continue;
     }
@@ -43804,7 +43834,7 @@ function rebindAgentDiscovery(binding, changes) {
   const installationRoots = codexInstallationRoots(binding), absentRoots = [...absentCodexSkillRoots(binding), ...absentRetiredClaudeRoots(binding), ...retiredCodexRoots(binding).filter((root2) => !lstatSync21(root2, { throwIfNoEntry: false }))];
   const rebound = { ...binding, sources: binding.sources.map((source) => {
     assertMarketplaceBinding(binding, source);
-    if (!changes.has(source.path) && (installationRoots.some((root2) => source.path.startsWith(root2 + sep6)) || absentRoots.some((root2) => source.path.startsWith(root2 + sep6)) && source.format === undefined && source.fields === undefined && source.managedPlugins === undefined && [undefined, "bytes"].includes(source.hashMode)))
+    if (!changes.has(source.path) && (installationRoots.some((root2) => source.path.startsWith(root2 + sep6)) || absentRoots.some((root2) => source.path.startsWith(root2 + sep6)) && retainableAbsentSource(source)))
       return source;
     const sha2562 = projected(source, changes, budget2);
     if (!changes.has(source.path) && sha2562 !== source.sha256)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.52",
+  "version": "0.10.54",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {