@hasna/skills 0.10.55 → 0.10.57

package/bin/index.js

@@ -36888,7 +36888,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.55",
+    version: "0.10.57",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -59361,6 +59361,97 @@ function read2(path, changes) {
     throw new Error(`Unsupported or oversized native discovery input: ${path}`);
   return readFileSync21(path, "utf8");
 }
+function assertReviewedClaudeCacheClosures(home, config, review) {
+  const enabledIds = Object.entries(config.enabledPlugins ?? {}).filter(([, enabled]) => enabled === true).map(([id]) => id);
+  if (enabledIds.length === 0)
+    return;
+  const registryPath = join37(home, ".claude/plugins/installed_plugins.json");
+  const cacheRoot = join37(home, ".claude/plugins/cache");
+  const registryText = read2(registryPath);
+  if (registryText === null)
+    return;
+  const registry = parseConfig(registryText, registryPath);
+  if (registry.version !== 2 || !registry.plugins || typeof registry.plugins !== "object" || Array.isArray(registry.plugins))
+    throw new Error("Reviewed Claude installed plugin registrations are invalid");
+  const cachePath = (path) => typeof path === "string" && isAbsolute22(path) && resolve21(path) === path && (path === cacheRoot || path.startsWith(cacheRoot + sep8));
+  const activeRoots = new Set;
+  for (const id of enabledIds) {
+    const rows = registry.plugins[id];
+    if (rows === undefined)
+      continue;
+    if (!Array.isArray(rows))
+      throw new Error("Reviewed Claude enabled plugin registrations must be an array");
+    for (const row of rows) {
+      if (!row || typeof row !== "object" || Array.isArray(row) || typeof row.installPath !== "string") {
+        throw new Error("Reviewed Claude enabled plugin registration requires an object with an installPath string");
+      }
+      if (typeof row.installPath === "string" && (row.installPath === cacheRoot || row.installPath.startsWith(cacheRoot + sep8))) {
+        if (!cachePath(row.installPath) || row.installPath.length > AGENT_POLICY_LIMITS.pathCharacters || row.version !== undefined && (typeof row.version !== "string" || basename11(row.installPath) !== row.version)) {
+          throw new Error("Reviewed Claude discovery has a malformed active cache registration");
+        }
+        if (row.scope === "user" && (row.projectPath === undefined || row.projectPath === null)) {} else if (row.scope === "project" && typeof row.projectPath === "string" && isAbsolute22(row.projectPath) && resolve21(row.projectPath) === row.projectPath && row.projectPath.length <= AGENT_POLICY_LIMITS.pathCharacters) {} else
+          throw new Error("Reviewed Claude discovery has an unsupported active cache registration scope");
+        activeRoots.add(row.installPath);
+      }
+    }
+  }
+  if (activeRoots.size === 0)
+    return;
+  const registrySource = review.sources.find((source) => source.path === registryPath && source.sha256 !== null && source.format === undefined && source.fields === undefined && source.managedPlugins === undefined && (source.hashMode === undefined || source.hashMode === "bytes"));
+  if (!registrySource)
+    throw new Error("Reviewed Claude discovery must bind installed registrations for active cache plugins");
+  const reviewedFile = (path, manifest = false) => review.sources.some((source) => source.path === path && source.sha256 !== null && source.format === undefined && source.fields === undefined && source.managedPlugins === undefined && (source.hashMode === undefined || source.hashMode === "bytes" || manifest && source.hashMode === "claude-plugin-manifest-v1"));
+  const requireSource = (path, description, manifest = false) => {
+    if (!reviewedFile(path, manifest))
+      throw new Error(`Reviewed active Claude cache plugin ${description} is not bound`);
+  };
+  for (const root2 of activeRoots) {
+    safe4(root2);
+    const rootStat = lstatSync25(root2, { throwIfNoEntry: false });
+    if (!rootStat?.isDirectory() || realpathSync11(root2) !== root2)
+      throw new Error("Reviewed Claude active cache plugin root is missing or unsafe");
+    const manifestPath = join37(root2, ".claude-plugin/plugin.json");
+    const manifestStat = lstatSync25(manifestPath, { throwIfNoEntry: false });
+    let manifest;
+    if (manifestStat) {
+      if (!manifestStat.isFile())
+        throw new Error("Reviewed active Claude cache plugin manifest is unsupported");
+      requireSource(manifestPath, "manifest", true);
+      const raw = read2(manifestPath);
+      if (raw === null)
+        throw new Error("Reviewed Claude active cache plugin manifest is missing");
+      manifest = JSON.parse(raw);
+      if (!manifest || typeof manifest !== "object" || Array.isArray(manifest))
+        throw new Error("Reviewed Claude active cache plugin manifest is invalid");
+    } else if (!review.sources.some((source) => source.path === manifestPath && source.hashMode === "path-bytes" && source.sha256 !== null && source.format === undefined && source.fields === undefined && source.managedPlugins === undefined)) {
+      throw new Error("Reviewed Claude active cache plugin manifest absence requires a path-bytes witness");
+    }
+    const roots = new Set([join37(root2, "skills")]);
+    if (lstatSync25(join37(root2, "SKILL.md"), { throwIfNoEntry: false })?.isFile())
+      roots.add(root2);
+    const declared = manifest?.skills === undefined ? ["./skills"] : typeof manifest.skills === "string" ? [manifest.skills] : manifest.skills;
+    if (!Array.isArray(declared) || declared.some((path) => typeof path !== "string"))
+      throw new Error("Reviewed Claude active cache plugin has unsupported skill paths");
+    for (const value of declared) {
+      const path = resolve21(root2, value);
+      if (path !== root2 && !path.startsWith(root2 + sep8))
+        throw new Error("Reviewed Claude active cache plugin skill path escapes its root");
+      roots.add(path.endsWith(`${sep8}SKILL.md`) ? dirname20(path) : path);
+    }
+    for (const skillRoot of roots)
+      if (!review.roots.includes(skillRoot))
+        throw new Error("Reviewed Claude active cache plugin skill root is not covered");
+    const hooksPath = join37(root2, "hooks/hooks.json");
+    const hooksStat = lstatSync25(hooksPath, { throwIfNoEntry: false });
+    if (hooksStat) {
+      if (!hooksStat.isFile())
+        throw new Error("Reviewed Claude plugin hook manifest is unsupported");
+      requireSource(hooksPath, "hook manifest");
+    }
+    if (typeof manifest?.hooks === "string")
+      requireSource(resolve21(root2, manifest.hooks), "manifest-declared hook source");
+  }
+}
 function projectNativeDiscoveryFields(text3, format, fields2, path) {
   const object6 = format === "yaml" ? parseHermesConfig(text3) : parseConfig(text3, path, format === "toml");
   if (!object6 || typeof object6 !== "object" || Array.isArray(object6))
@@ -59937,6 +60028,8 @@ function resolveAgentDiscovery(options) {
           throw new Error("Reviewed Claude plugin manifest requires separately reviewed exact hook file sources");
       return { path: source.path, sha256: manifestSha256, hashMode: "claude-plugin-manifest-v1" };
     });
+    if (agent === "claude")
+      assertReviewedClaudeCacheClosures(home, config, review);
     const combined = [...reviewedSources, ...reviewedSourcesWithManifestProjection];
     const unique = combined.filter((source, index) => combined.findIndex((candidate2) => isDeepStrictEqual11(candidate2, source)) === index);
     return { ...supplied, roots: [...new Set([...roots, ...supplied.roots])].sort(), sources: unique, ...agent === "gemini" ? { builtinNames } : {} };
@@ -116524,14 +116617,584 @@ var init_hook_diagnostics = __esm(() => {
   ]);
 });
 
+// src/lib/claude-prospective-review.ts
+import { createHash as createHash41 } from "crypto";
+import { lstatSync as lstatSync37, readFileSync as readFileSync45, readdirSync as readdirSync24, realpathSync as realpathSync21 } from "fs";
+import { basename as basename18, dirname as dirname38, isAbsolute as isAbsolute34, join as join68, relative as relative12, resolve as resolve33, sep as sep15 } from "path";
+import { isDeepStrictEqual as isDeepStrictEqual18 } from "util";
+function refuse6(reason2) {
+  throw new Error(`CLAUDE_CANDIDATE_REVIEW_REFUSED: ${reason2}`);
+}
+function preserveOrGenerateTimestamp(previous, field3) {
+  return { $allowed: [previous, { $generated: "claude-utc-timestamp", field: field3 }] };
+}
+function object11(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function hasOwn2(value, key) {
+  return object11(value) && Object.hasOwn(value, key);
+}
+function assertJsonValue(value, name, depth = 0) {
+  if (depth > 32)
+    refuse6(`${name} exceeds the JSON nesting bound`);
+  if (value === null || typeof value === "string" || typeof value === "boolean")
+    return;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value))
+      refuse6(`${name} contains a non-finite number`);
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value)
+      assertJsonValue(item, name, depth + 1);
+    return;
+  }
+  if (object11(value)) {
+    for (const item of Object.values(value))
+      assertJsonValue(item, name, depth + 1);
+    return;
+  }
+  refuse6(`${name} contains a non-JSON value`);
+}
+function canonicalJson3(value) {
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson3).join(",")}]`;
+  if (object11(value))
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson3(value[key])}`).join(",")}}`;
+  return JSON.stringify(value);
+}
+function keys3(value, expected, name) {
+  if (!object11(value) || Object.keys(value).sort().join("\x00") !== [...expected].sort().join("\x00"))
+    refuse6(`${name} has an unsupported shape`);
+}
+function abs(path, name) {
+  if (typeof path !== "string" || !path || path.length > 4096 || /[\x00-\x1f\x7f]/.test(path) || !isAbsolute34(path) || resolve33(path) !== path)
+    refuse6(`${name} must be a normalized absolute path`);
+}
+function validUtcTimestamp(value) {
+  return typeof value === "string" && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value) && Number.isFinite(Date.parse(value)) && new Date(Date.parse(value)).toISOString() === value;
+}
+function safeFile(path, name) {
+  abs(path, name);
+  for (let at2 = dirname38(path);; at2 = dirname38(at2)) {
+    const stat4 = lstatSync37(at2, { throwIfNoEntry: false });
+    if (!stat4?.isDirectory() || stat4.isSymbolicLink())
+      refuse6(`${name} traverses a symlink or non-directory`);
+    if (at2 === dirname38(at2))
+      break;
+  }
+  const stat3 = lstatSync37(path, { throwIfNoEntry: false });
+  if (!stat3?.isFile() || stat3.isSymbolicLink() || stat3.size > MAX_CANDIDATE_BYTES)
+    refuse6(`${name} is not a bounded regular file`);
+  return readFileSync45(path);
+}
+function canonicalDir(path, name) {
+  abs(path, name);
+  if (realpathSync21(path) !== path || !lstatSync37(path).isDirectory())
+    refuse6(`${name} is not a canonical directory`);
+  for (let at2 = path;; at2 = dirname38(at2)) {
+    const stat3 = lstatSync37(at2);
+    if (!stat3.isDirectory() || stat3.isSymbolicLink())
+      refuse6(`${name} traverses a symlink`);
+    if (at2 === dirname38(at2))
+      break;
+  }
+}
+function captureClaudeProspectiveCandidateClosure(root2) {
+  canonicalDir(root2, "candidate root");
+  const entries = [];
+  let bytes = 0;
+  const walk2 = (directory2) => {
+    const beforeDirectory = lstatSync37(directory2);
+    const names = readdirSync24(directory2).sort();
+    if (new Set(names).size !== names.length)
+      refuse6("candidate contains ambiguous directory entries");
+    for (const name of names) {
+      if (!name || name === "." || name === ".." || name.includes("/") || name.includes("\\") || /[\x00-\x1f\x7f]/.test(name))
+        refuse6("candidate contains an unsupported path member");
+      const path = join68(directory2, name), rel = relative12(root2, path).split(sep15).join("/");
+      if (entries.length >= MAX_CANDIDATE_FILES)
+        refuse6("candidate closure exceeds its member limit");
+      const stat3 = lstatSync37(path);
+      if (stat3.isSymbolicLink())
+        refuse6("candidate closure contains a symlink");
+      if (stat3.isDirectory()) {
+        entries.push([rel, "directory", null]);
+        walk2(path);
+      } else if (stat3.isFile()) {
+        bytes += stat3.size;
+        if (bytes > MAX_CANDIDATE_BYTES)
+          refuse6("candidate closure exceeds its byte limit");
+        const content = safeFile(path, "candidate member"), after2 = lstatSync37(path);
+        if (!after2.isFile() || after2.dev !== stat3.dev || after2.ino !== stat3.ino || after2.size !== stat3.size || after2.mtimeMs !== stat3.mtimeMs || after2.ctimeMs !== stat3.ctimeMs)
+          refuse6("candidate member changed while being read");
+        entries.push([rel, "file", sha7(content)]);
+      } else
+        refuse6("candidate closure contains a special file");
+    }
+    const afterDirectory = lstatSync37(directory2);
+    if (!afterDirectory.isDirectory() || afterDirectory.dev !== beforeDirectory.dev || afterDirectory.ino !== beforeDirectory.ino || afterDirectory.mtimeMs !== beforeDirectory.mtimeMs || afterDirectory.ctimeMs !== beforeDirectory.ctimeMs)
+      refuse6("candidate directory changed while being read");
+  };
+  walk2(root2);
+  entries.sort((a, b) => a[0].localeCompare(b[0]));
+  return sha7(JSON.stringify(entries));
+}
+function readWitness(path, expected, name) {
+  abs(path, `${name} path`);
+  const stat3 = lstatSync37(path, { throwIfNoEntry: false });
+  if (expected === null) {
+    if (stat3)
+      refuse6(`${name} was absent at review but is now present`);
+    return;
+  }
+  if (!SHA256.test(expected))
+    refuse6(`${name} has an invalid SHA-256`);
+  if (!stat3?.isFile() || stat3.isSymbolicLink() || sha7(safeFile(path, name)) !== expected)
+    refuse6(`${name} preimage changed`);
+}
+function jsonFile(path, name) {
+  const stat3 = lstatSync37(path, { throwIfNoEntry: false });
+  if (!stat3)
+    return null;
+  let value;
+  try {
+    value = JSON.parse(safeFile(path, name).toString("utf8"));
+  } catch {
+    refuse6(`${name} is not valid JSON`);
+  }
+  if (!object11(value))
+    refuse6(`${name} must be a JSON object`);
+  return value;
+}
+function assertNoUnprojectedSkillPayload(root2, catalogPath, marketplace, plugin, manifest) {
+  if (manifest.skills !== undefined || manifest.commands !== undefined)
+    refuse6("candidate plugin declares native skill or command payloads; project those through the Skills plugin admission flow first");
+  let catalog;
+  try {
+    catalog = JSON.parse(safeFile(catalogPath, "candidate catalog").toString("utf8"));
+  } catch {
+    refuse6("candidate catalog is not valid JSON");
+  }
+  if (!object11(catalog) || catalog.name !== marketplace || !Array.isArray(catalog.plugins))
+    refuse6("candidate catalog identity is invalid");
+  const entries = catalog.plugins.filter((entry) => object11(entry) && entry.name === plugin);
+  if (entries.length !== 1 || !object11(entries[0]))
+    refuse6("candidate catalog plugin entry is missing or ambiguous");
+  if (entries[0].skills !== undefined || entries[0].commands !== undefined)
+    refuse6("candidate marketplace entry declares native skill or command payloads");
+  const walk2 = (directory2) => {
+    for (const name of readdirSync24(directory2).sort()) {
+      const path = join68(directory2, name), rel = relative12(root2, path).split(sep15).join("/");
+      const stat3 = lstatSync37(path);
+      if (stat3.isDirectory())
+        walk2(path);
+      else if (stat3.isFile()) {
+        const parts = rel.toLowerCase().split("/");
+        if (parts.includes("skills") || parts.includes("commands") || name.toLowerCase() === "skill.md")
+          refuse6("candidate closure contains native skill or command payload paths");
+        if (parts.includes("agents") && /\.md$/i.test(name)) {
+          let text4;
+          try {
+            text4 = new TextDecoder("utf-8", { fatal: true }).decode(safeFile(path, "candidate agent file"));
+          } catch {
+            refuse6("candidate agent file is not strict UTF-8");
+          }
+          if (/^skills\s*:/m.test(text4))
+            refuse6("candidate agent preloads native skills; project it through the Skills plugin admission flow first");
+        }
+      }
+    }
+  };
+  walk2(root2);
+}
+function reviewClaudeProspectiveCandidate(request2, requestFileSha256) {
+  if (!SHA256.test(requestFileSha256))
+    refuse6("request file SHA-256 is invalid");
+  keys3(request2, ["schema", "scope", "native", "skills", "candidate", "preimages", "delta", "review"], "request");
+  if (request2.schema !== CLAUDE_PROSPECTIVE_REVIEW_SCHEMA)
+    refuse6("unsupported schema");
+  keys3(request2.scope, ["kind", "projectPath"], "scope");
+  if (request2.scope.kind !== "user" && request2.scope.kind !== "project")
+    refuse6("scope must be user or project");
+  abs(request2.scope.projectPath, "project path");
+  canonicalDir(request2.scope.projectPath, "project path");
+  keys3(request2.native, ["home", "executable", "configRoot", "pluginRoot"], "native identity");
+  canonicalDir(request2.native.home, "Claude home");
+  abs(request2.native.configRoot, "Claude config root");
+  keys3(request2.native.executable, ["path", "target", "version", "sha256"], "Claude executable identity");
+  abs(request2.native.executable.path, "Claude executable path");
+  abs(request2.native.executable.target, "Claude executable target");
+  if (typeof request2.native.executable.version !== "string" || !request2.native.executable.version || request2.native.executable.version.length > 256 || /[\x00-\x1f\x7f]/.test(request2.native.executable.version) || !SHA256.test(request2.native.executable.sha256) || realpathSync21(request2.native.executable.path) !== request2.native.executable.target || hashExecutableFile(request2.native.executable.target) !== request2.native.executable.sha256)
+    refuse6("Claude executable identity changed");
+  keys3(request2.skills, ["dataDir", "policySha256", "discoverySha256", "discoveryInputs"], "Skills preimage");
+  abs(request2.skills.dataDir, "Skills data directory");
+  if (!SHA256.test(request2.skills.policySha256) || !SHA256.test(request2.skills.discoverySha256))
+    refuse6("invalid Skills policy or discovery SHA-256");
+  const snapshot2 = readManagedSkillPolicySnapshot(request2.skills.dataDir);
+  if (!snapshot2 || sha7(snapshot2.text) !== request2.skills.policySha256)
+    refuse6("Skills policy preimage changed or is absent");
+  const aliases = snapshot2.value.bridge?.rootAliases ?? [];
+  if (!Array.isArray(aliases))
+    refuse6("Skills policy root aliases are invalid");
+  try {
+    recheckRootAliases(aliases);
+  } catch {
+    refuse6("Skills policy root alias changed or is invalid");
+  }
+  const canonical8 = (path) => canonicalAgentPath(path, aliases);
+  const configRoot = canonical8(join68(request2.native.home, ".claude"));
+  canonicalDir(configRoot, "Claude config root");
+  if (request2.native.configRoot !== configRoot)
+    refuse6("Claude config root differs from the current resolver and reviewed root alias");
+  const pluginRoot = join68(configRoot, "plugins");
+  if (process.env.CLAUDE_CODE_PLUGIN_CACHE_DIR)
+    refuse6("CLAUDE_CODE_PLUGIN_CACHE_DIR overrides are unsupported by this prospective schema; bind and review the actual cache root first");
+  if (request2.native.pluginRoot !== pluginRoot)
+    refuse6("Claude plugin root differs from the supported standard plugins directory; Cowork and custom cache roots require a separately bound schema");
+  const pluginRootStat = lstatSync37(pluginRoot, { throwIfNoEntry: false });
+  if (pluginRootStat && (!pluginRootStat.isDirectory() || pluginRootStat.isSymbolicLink()))
+    refuse6("Claude plugin root is not a regular directory");
+  keys3(request2.candidate, ["marketplace", "root", "catalogPath", "catalogSha256", "closureSha256", "plugins", ...hasOwn2(request2.candidate, "releaseManifest") ? ["releaseManifest"] : [], ...hasOwn2(request2.candidate, "functionHooksEnv") ? ["functionHooksEnv"] : []], "candidate");
+  const candidate2 = request2.candidate;
+  canonicalDir(candidate2.root, "candidate root");
+  if (typeof candidate2.marketplace !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(candidate2.marketplace))
+    refuse6("invalid candidate marketplace");
+  if (!Array.isArray(candidate2.plugins) || candidate2.plugins.length < 1 || candidate2.plugins.length > 32)
+    refuse6("candidate must select between one and 32 plugins from one marketplace");
+  if (candidate2.functionHooksEnv !== undefined && candidate2.functionHooksEnv !== "1")
+    refuse6("function-hook environment mutation only supports the explicit value 1");
+  abs(candidate2.catalogPath, "catalog path");
+  if (!candidate2.catalogPath.startsWith(candidate2.root + sep15))
+    refuse6("catalog must be inside the frozen candidate root");
+  if (candidate2.catalogPath !== join68(candidate2.root, ".claude-plugin", "marketplace.json"))
+    refuse6("marketplace catalog must be at the frozen root's .claude-plugin/marketplace.json path");
+  if (!SHA256.test(candidate2.catalogSha256) || !SHA256.test(candidate2.closureSha256))
+    refuse6("candidate digests must be lowercase SHA-256");
+  if (captureClaudeProspectiveCandidateClosure(candidate2.root) !== candidate2.closureSha256)
+    refuse6("complete candidate closure changed");
+  if (sha7(safeFile(candidate2.catalogPath, "candidate catalog")) !== candidate2.catalogSha256)
+    refuse6("candidate catalog changed");
+  let candidateCatalog;
+  try {
+    candidateCatalog = JSON.parse(safeFile(candidate2.catalogPath, "candidate catalog").toString("utf8"));
+  } catch {
+    refuse6("candidate catalog is not valid JSON");
+  }
+  if (!object11(candidateCatalog) || candidateCatalog.name !== candidate2.marketplace || !Array.isArray(candidateCatalog.plugins))
+    refuse6("candidate catalog identity is invalid");
+  const catalogMetadata = candidateCatalog.metadata;
+  if (catalogMetadata !== undefined && !object11(catalogMetadata))
+    refuse6("candidate catalog metadata has an unsupported shape");
+  if (catalogMetadata?.pluginRoot !== undefined && catalogMetadata.pluginRoot !== "." && catalogMetadata.pluginRoot !== "./")
+    refuse6("nontrivial marketplace metadata.pluginRoot is unsupported by this local-closure schema");
+  for (const [name, dependencies] of [["catalog", candidateCatalog.dependencies], ["catalog metadata", catalogMetadata?.dependencies]]) {
+    if (dependencies !== undefined && (!Array.isArray(dependencies) || dependencies.length !== 0))
+      refuse6(`${name} declares unsupported native dependencies`);
+  }
+  const selectedPlugins = [];
+  const pluginNames = new Set, sanitizedCachePaths = new Set;
+  for (const selected of candidate2.plugins) {
+    keys3(selected, ["plugin", "manifestPath", "manifestSha256", "optionsPatch"], "selected plugin");
+    if (typeof selected.plugin !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(selected.plugin))
+      refuse6("invalid selected plugin name");
+    if (pluginNames.has(selected.plugin))
+      refuse6("candidate repeats a selected plugin");
+    pluginNames.add(selected.plugin);
+    if (!object11(selected.optionsPatch))
+      refuse6("selected plugin optionsPatch must be a JSON object");
+    assertJsonValue(selected.optionsPatch, "selected plugin optionsPatch");
+    if (selected.optionsPatch.enabled !== true)
+      refuse6("selected plugin optionsPatch must explicitly declare enabled: true");
+    if (Buffer.byteLength(canonicalJson3(selected.optionsPatch), "utf8") > 16 * 1024)
+      refuse6("selected plugin optionsPatch exceeds its byte bound");
+    abs(selected.manifestPath, "manifest path");
+    if (!selected.manifestPath.startsWith(candidate2.root + sep15) || basename18(dirname38(selected.manifestPath)) !== ".claude-plugin" || selected.manifestPath !== join68(dirname38(dirname38(selected.manifestPath)), ".claude-plugin", "plugin.json"))
+      refuse6("plugin manifest must be under a plugin root inside the frozen marketplace closure");
+    const pluginRoot2 = dirname38(dirname38(selected.manifestPath));
+    const relativePluginRoot = relative12(candidate2.root, pluginRoot2);
+    if (!relativePluginRoot || relativePluginRoot === "." || relativePluginRoot === ".." || relativePluginRoot.startsWith(`..${sep15}`) || isAbsolute34(relativePluginRoot))
+      refuse6("plugin root must be a child of the frozen marketplace root");
+    canonicalDir(pluginRoot2, "candidate plugin root");
+    if (!SHA256.test(selected.manifestSha256))
+      refuse6("selected plugin manifest digest must be lowercase SHA-256");
+    if (hashClaudePluginManifest(safeFile(selected.manifestPath, "candidate plugin manifest").toString("utf8")) !== selected.manifestSha256)
+      refuse6("candidate plugin manifest changed or is invalid");
+    const manifest = JSON.parse(safeFile(selected.manifestPath, "candidate plugin manifest").toString("utf8"));
+    if (!object11(manifest) || manifest.name !== selected.plugin)
+      refuse6("candidate plugin manifest identity differs from the selected entry");
+    const entries = candidateCatalog.plugins.filter((entry2) => object11(entry2) && entry2.name === selected.plugin);
+    if (entries.length !== 1 || !object11(entries[0]))
+      refuse6("candidate marketplace plugin entry is missing or ambiguous");
+    const selectedEntry = entries[0];
+    if (selectedEntry.skills !== undefined || selectedEntry.commands !== undefined)
+      refuse6("candidate marketplace entry declares native skill or command payloads");
+    if (selectedEntry.dependencies !== undefined && (!Array.isArray(selectedEntry.dependencies) || selectedEntry.dependencies.length !== 0))
+      refuse6("selected marketplace plugin declares unsupported native dependencies");
+    if (manifest.skills !== undefined || manifest.commands !== undefined)
+      refuse6("candidate plugin declares native skill or command payloads; project those through the Skills plugin admission flow first");
+    const manifestVersion = manifest.version;
+    if (typeof manifestVersion !== "string" || !manifestVersion || typeof selectedEntry.version !== "string" || selectedEntry.version !== manifestVersion)
+      refuse6("candidate manifest version differs from the selected marketplace entry version");
+    const sanitizeComponent = (value) => value.replace(/[^A-Za-z0-9_-]/g, "-");
+    const sanitizedVersion = manifestVersion === "." || manifestVersion === ".." ? "-" : manifestVersion.replace(/[^A-Za-z0-9._-]/g, "-");
+    if (manifestVersion.length > 256 || /[\x00-\x1f\x7f/\\]/.test(manifestVersion) || !sanitizedVersion)
+      refuse6("candidate version is not a supported native cache component");
+    const sanitizedCachePath = [sanitizeComponent(candidate2.marketplace), sanitizeComponent(selected.plugin), sanitizedVersion].join("/");
+    if (sanitizedCachePaths.has(sanitizedCachePath))
+      refuse6("selected plugins collide after native cache path sanitization");
+    sanitizedCachePaths.add(sanitizedCachePath);
+    const sourcePath = selectedEntry.source;
+    const sourceRelativePath = relative12(candidate2.root, pluginRoot2).split(sep15).join("/");
+    const expectedSourcePath = sourceRelativePath === "." ? "./" : `./${sourceRelativePath}`;
+    if (typeof sourcePath !== "string" || isAbsolute34(sourcePath) || sourcePath !== expectedSourcePath || resolve33(dirname38(dirname38(candidate2.catalogPath)), sourcePath) !== pluginRoot2)
+      refuse6("marketplace source does not resolve to the frozen plugin closure; external source mapping is not supported by this schema");
+    const entry = captureClaudeMarketplaceEntry(candidate2.catalogPath, candidate2.marketplace, selected.plugin);
+    if (entry.sha256.length !== 64)
+      refuse6("candidate marketplace entry is invalid");
+    assertNoUnprojectedSkillPayload(candidate2.root, candidate2.catalogPath, candidate2.marketplace, selected.plugin, manifest);
+    selectedPlugins.push({ plugin: selected.plugin, pluginId: `${selected.plugin}@${candidate2.marketplace}`, manifestSha256: selected.manifestSha256, optionsPatch: selected.optionsPatch, pluginRoot: pluginRoot2, manifest, selectedEntry });
+  }
+  if (candidate2.releaseManifest !== undefined) {
+    keys3(candidate2.releaseManifest, ["path", "sha256"], "release manifest witness");
+    abs(candidate2.releaseManifest.path, "release manifest path");
+    if (!SHA256.test(candidate2.releaseManifest.sha256) || sha7(safeFile(candidate2.releaseManifest.path, "release manifest")) !== candidate2.releaseManifest.sha256)
+      refuse6("complete release manifest bytes changed or lack a valid digest");
+  }
+  if (!request2.preimages || !object11(request2.preimages))
+    refuse6("current Claude preimages are required");
+  keys3(request2.preimages, ["settings", "userSettings", "projectSettings", "projectSettingsLocal", "marketplaces", "installedPlugins"], "current Claude preimages");
+  for (const name of ["settings", "projectSettings", "projectSettingsLocal", "marketplaces", "installedPlugins"])
+    keys3(request2.preimages[name], ["path", "sha256"], `${name} preimage`);
+  const expectedPaths = {
+    settings: request2.scope.kind === "project" ? canonical8(join68(request2.scope.projectPath, ".claude/settings.json")) : canonical8(join68(request2.native.home, ".claude/settings.json")),
+    userSettings: canonical8(join68(request2.native.home, ".claude/settings.json")),
+    projectSettings: canonical8(join68(request2.scope.projectPath, ".claude/settings.json")),
+    projectSettingsLocal: canonical8(join68(request2.scope.projectPath, ".claude/settings.local.json")),
+    marketplaces: canonical8(join68(request2.native.home, ".claude/plugins/known_marketplaces.json")),
+    installedPlugins: canonical8(join68(request2.native.home, ".claude/plugins/installed_plugins.json"))
+  };
+  for (const name of Object.keys(expectedPaths)) {
+    const witness = request2.preimages[name];
+    if (witness.path !== expectedPaths[name])
+      refuse6(`${name} preimage path is not the selected Claude path`);
+    readWitness(witness.path, witness.sha256, name);
+  }
+  if (!request2.review || request2.review.pluginHooks !== "reviewed-no-skill-injection")
+    refuse6("an explicit no-skill-injection review is required");
+  if (request2.skills.discoveryInputs?.version !== 1 || !Array.isArray(request2.skills.discoveryInputs.agents) || request2.skills.discoveryInputs.agents.length !== 1 || request2.skills.discoveryInputs.agents[0]?.agent !== "claude" || request2.skills.discoveryInputs.agents[0]?.pluginHooks !== "reviewed-no-skill-injection")
+    refuse6("one explicit reviewed Claude discovery binding is required");
+  const reviewedPaths = new Set(request2.skills.discoveryInputs.agents[0].sources.map((source) => source.path));
+  for (const path of new Set(Object.values(expectedPaths)))
+    if (!reviewedPaths.has(path))
+      refuse6("Skills discovery review does not bind every current user/project Claude settings and registration source");
+  const binding = resolveAgentDiscovery({ home: request2.native.home, agent: "claude", canonical: canonical8, reviewed: request2.skills.discoveryInputs });
+  verifyAgentDiscovery(binding);
+  if (sha7(JSON.stringify(binding)) !== request2.skills.discoverySha256)
+    refuse6("Skills discovery preimage differs from its reviewed binding");
+  assertProjectDiscovery("claude", [request2.scope.projectPath], request2.native.home, canonical8, binding);
+  const stored = snapshot2.value.bridge?.discovery?.claude;
+  if (!stored || !isDeepStrictEqual18(stored, binding) || snapshot2.value.bridge?.home !== request2.native.home)
+    refuse6("Skills policy does not bind the reviewed current Claude discovery");
+  const delta = request2.delta;
+  keys3(delta, ["settingsAfter", "knownMarketplacesAfter", "installedPluginsAfter"], "complete semantic delta");
+  for (const [key, value] of Object.entries(delta))
+    if (!object11(value))
+      refuse6(`${key} must be a complete JSON object`);
+  const settings = jsonFile(expectedPaths.settings, "Claude settings");
+  if (settings && settings.enabledPlugins !== undefined && !object11(settings.enabledPlugins))
+    refuse6("current settings enabledPlugins is not an object");
+  if (settings?.pluginConfigs !== undefined && !object11(settings.pluginConfigs))
+    refuse6("current settings pluginConfigs is not an object");
+  const marketplaces = jsonFile(expectedPaths.marketplaces, "Claude known marketplaces");
+  const registrations = jsonFile(expectedPaths.installedPlugins, "Claude installed plugins");
+  if (registrations && (registrations.version !== 2 || !object11(registrations.plugins)))
+    refuse6("current installed plugin registry has an unsupported shape");
+  const settingsAfter = settings ? structuredClone(settings) : {};
+  if (settingsAfter.enabledPlugins === undefined)
+    settingsAfter.enabledPlugins = {};
+  if (!object11(settingsAfter.enabledPlugins))
+    refuse6("target settings enabledPlugins is not an object");
+  if (settingsAfter.pluginConfigs === undefined)
+    settingsAfter.pluginConfigs = {};
+  if (!object11(settingsAfter.pluginConfigs))
+    refuse6("target settings pluginConfigs is not an object");
+  const targetRegistrations = new Map;
+  const selectedPluginIds = [];
+  const selectedOptionPaths = [];
+  for (const selected of selectedPlugins) {
+    const { pluginId: pluginId2, plugin, manifest, optionsPatch } = selected;
+    if (Array.isArray(settings?.enabledPlugins?.[pluginId2]))
+      refuse6("selected enabledPlugins value is an array; this schema does not model that native shape");
+    selectedPluginIds.push(pluginId2);
+    settingsAfter.enabledPlugins[pluginId2] = true;
+    const currentConfig = settings?.pluginConfigs?.[pluginId2];
+    if (currentConfig !== undefined && !object11(currentConfig))
+      refuse6("selected pluginConfigs entry is malformed");
+    const currentOptions = currentConfig?.options;
+    if (currentOptions !== undefined && !object11(currentOptions))
+      refuse6("selected pluginConfigs options are malformed");
+    const nextConfig = currentConfig === undefined ? {} : structuredClone(currentConfig);
+    nextConfig.options = { ...currentOptions ?? {}, ...optionsPatch, enabled: true };
+    settingsAfter.pluginConfigs[pluginId2] = nextConfig;
+    selectedOptionPaths.push(`pluginConfigs.${pluginId2}.options`);
+    const hasCurrentPluginKey = !!registrations && Object.prototype.hasOwnProperty.call(registrations.plugins, pluginId2);
+    const currentRows = hasCurrentPluginKey ? registrations.plugins[pluginId2] : [];
+    if (!Array.isArray(currentRows))
+      refuse6(`current selected plugin ${pluginId2} registrations are malformed`);
+    for (const row2 of currentRows) {
+      if (!object11(row2) || !["user", "project", "local"].includes(row2.scope) || typeof row2.installPath !== "string")
+        refuse6(`current selected plugin ${pluginId2} registration row is malformed`);
+      abs(row2.installPath, "registered plugin install path");
+      if (row2.version !== undefined && (typeof row2.version !== "string" || !row2.version))
+        refuse6("current selected plugin registration version is malformed");
+      if (row2.scope === "project" || row2.scope === "local")
+        abs(row2.projectPath, "registered plugin project path");
+      else if (row2.projectPath !== undefined)
+        refuse6("user plugin registration has a project path");
+    }
+    const isTargetScopeRow = (row2) => row2?.scope === request2.scope.kind && (request2.scope.kind === "user" ? row2.projectPath === undefined : row2.projectPath === request2.scope.projectPath);
+    const targetIndexes = currentRows.map((row2, index) => isTargetScopeRow(row2) ? index : -1).filter((index) => index >= 0);
+    if (targetIndexes.length > 1)
+      refuse6(`current selected-scope registrations for ${pluginId2} are ambiguous`);
+    const existingTarget = targetIndexes.length === 1 ? currentRows[targetIndexes[0]] : undefined;
+    if (existingTarget !== undefined && Object.keys(existingTarget).some((key) => !["scope", "projectPath", "installPath", "version", "installedAt", "lastUpdated"].includes(key)))
+      refuse6("current selected-scope plugin registration has unsupported fields");
+    for (const key of ["installedAt", "lastUpdated"])
+      if (existingTarget?.[key] !== undefined && !validUtcTimestamp(existingTarget[key]))
+        refuse6(`current selected-scope plugin ${key} field is invalid`);
+    const manifestVersion = manifest.version;
+    const sanitizeComponent = (value) => value.replace(/[^A-Za-z0-9_-]/g, "-");
+    const sanitizedVersion = manifestVersion === "." || manifestVersion === ".." ? "-" : manifestVersion.replace(/[^A-Za-z0-9._-]/g, "-");
+    const expectedInstallPath = join68(pluginRoot, "cache", sanitizeComponent(candidate2.marketplace), sanitizeComponent(plugin), sanitizedVersion);
+    if (expectedInstallPath.length > 4096)
+      refuse6("candidate native cache path exceeds its bound");
+    const targetRegistration = {
+      scope: request2.scope.kind,
+      ...request2.scope.kind === "project" ? { projectPath: request2.scope.projectPath } : {},
+      installPath: expectedInstallPath,
+      version: manifestVersion,
+      ...existingTarget ? {
+        ...existingTarget.installedAt === undefined ? {} : { installedAt: existingTarget.installedAt },
+        lastUpdated: existingTarget.lastUpdated === undefined ? GENERATED_PLUGIN_UPDATE_TIME : preserveOrGenerateTimestamp(existingTarget.lastUpdated, "installed_plugins.selected-row.lastUpdated")
+      } : { installedAt: GENERATED_FRESH_PLUGIN_INSTALLED_AT, lastUpdated: GENERATED_PLUGIN_UPDATE_TIME }
+    };
+    targetRegistrations.set(pluginId2, targetRegistration);
+  }
+  if (candidate2.functionHooksEnv === "1") {
+    const env3 = settingsAfter.env === undefined ? {} : settingsAfter.env;
+    if (!object11(env3))
+      refuse6("target settings env is not an object");
+    settingsAfter.env = { ...env3, CLAUDE_CODE_ENABLE_FUNCTION_HOOKS: "1" };
+  }
+  if (!isDeepStrictEqual18(delta.settingsAfter, settingsAfter))
+    refuse6("complete settings document differs from the exact selected plugin/options/environment operations");
+  const marketplaceRowBefore = marketplaces?.[candidate2.marketplace];
+  if (marketplaceRowBefore !== undefined && !object11(marketplaceRowBefore))
+    refuse6("current marketplace row has an unsupported shape");
+  if (marketplaceRowBefore !== undefined && Object.keys(marketplaceRowBefore).some((key) => !["source", "installLocation", "autoUpdate", "lastUpdated"].includes(key)))
+    refuse6("current marketplace row has unsupported fields");
+  if (marketplaceRowBefore?.autoUpdate !== undefined && typeof marketplaceRowBefore.autoUpdate !== "boolean")
+    refuse6("current marketplace autoUpdate field is invalid");
+  if (marketplaceRowBefore?.lastUpdated !== undefined && !validUtcTimestamp(marketplaceRowBefore.lastUpdated))
+    refuse6("current marketplace update timestamp is invalid");
+  const targetMarketplaceLocation = candidate2.root;
+  const sameMarketplaceSource = isDeepStrictEqual18(marketplaceRowBefore?.source, { source: "directory", path: candidate2.root }) && marketplaceRowBefore?.installLocation === targetMarketplaceLocation;
+  const afterMarketplace = {
+    source: { source: "directory", path: candidate2.root },
+    installLocation: targetMarketplaceLocation,
+    autoUpdate: false,
+    lastUpdated: sameMarketplaceSource && marketplaceRowBefore?.lastUpdated !== undefined ? preserveOrGenerateTimestamp(marketplaceRowBefore.lastUpdated, "known-marketplaces.lastUpdated") : GENERATED_MARKETPLACE_TIME
+  };
+  const marketplacesAfter = marketplaces ? structuredClone(marketplaces) : {};
+  marketplacesAfter[candidate2.marketplace] = afterMarketplace;
+  if (!isDeepStrictEqual18(delta.knownMarketplacesAfter, marketplacesAfter))
+    refuse6("complete marketplace document differs from the exact selected-directory marketplace operation");
+  const installedAfter = registrations ? structuredClone(registrations) : { version: 2, plugins: {} };
+  if (installedAfter.plugins === undefined)
+    installedAfter.plugins = {};
+  if (!object11(installedAfter.plugins))
+    refuse6("current installed plugin registry has an unsupported shape");
+  for (const [pluginId2, targetRegistration] of targetRegistrations) {
+    const rows = Object.prototype.hasOwnProperty.call(installedAfter.plugins, pluginId2) ? installedAfter.plugins[pluginId2] : [];
+    if (!Array.isArray(rows))
+      refuse6(`current selected plugin ${pluginId2} registrations are malformed`);
+    const isTargetScopeRow = (row2) => row2?.scope === request2.scope.kind && (request2.scope.kind === "user" ? row2.projectPath === undefined : row2.projectPath === request2.scope.projectPath);
+    const index = rows.findIndex(isTargetScopeRow);
+    const nextRows = [...rows];
+    if (index < 0)
+      nextRows.push(targetRegistration);
+    else
+      nextRows[index] = targetRegistration;
+    installedAfter.plugins[pluginId2] = nextRows;
+  }
+  if (!isDeepStrictEqual18(delta.installedPluginsAfter, installedAfter))
+    refuse6("complete installed plugin document changes an unrelated registration or has target rows not derived from every selected candidate");
+  const semanticDocumentsSha256 = sha7(canonicalJson3({ settings: settingsAfter, knownMarketplaces: marketplacesAfter, installedPlugins: installedAfter }));
+  const exactPreimages = Object.keys(expectedPaths).map((name) => ({ name, path: expectedPaths[name], sha256: request2.preimages[name].sha256 }));
+  const expectedPostStateSha256 = sha7(canonicalJson3({ paths: expectedPaths, targetSettingsPath: expectedPaths.settings, semanticDocumentsSha256, currentPreimages: exactPreimages }));
+  const operationSha256 = sha7(canonicalJson3({
+    scope: request2.scope,
+    native: request2.native,
+    candidate: request2.candidate,
+    paths: expectedPaths,
+    preimages: exactPreimages,
+    skills: { dataDir: request2.skills.dataDir, policySha256: request2.skills.policySha256, discoverySha256: request2.skills.discoverySha256 },
+    review: request2.review,
+    semanticDocumentsSha256
+  }));
+  return {
+    schema: CLAUDE_PROSPECTIVE_REVIEW_SCHEMA,
+    accepted: true,
+    applied: false,
+    scope: request2.scope,
+    pluginIds: selectedPluginIds,
+    native: { executablePath: request2.native.executable.path, executableTarget: request2.native.executable.target, executableVersion: request2.native.executable.version, executableSha256: request2.native.executable.sha256, configRoot: request2.native.configRoot, pluginRoot: request2.native.pluginRoot },
+    candidate: { marketplace: candidate2.marketplace, plugins: selectedPlugins.map((item) => ({ plugin: item.plugin, pluginId: item.pluginId, manifestSha256: item.manifestSha256, optionsPatchSha256: sha7(canonicalJson3(item.optionsPatch)) })), closureSha256: candidate2.closureSha256, catalogSha256: candidate2.catalogSha256, ...candidate2.releaseManifest ? { releaseManifest: candidate2.releaseManifest } : {} },
+    targetSettingsPath: expectedPaths.settings,
+    skillsDiscoverySha256: request2.skills.discoverySha256,
+    requestFileSha256,
+    semanticDocumentsSha256,
+    operationSha256,
+    expectedPostStateSha256,
+    preimages: [
+      { name: "settings", path: expectedPaths.settings, sha256: request2.preimages.settings.sha256 },
+      { name: "user-settings", path: expectedPaths.userSettings, sha256: request2.preimages.userSettings.sha256 },
+      { name: "project-settings", path: expectedPaths.projectSettings, sha256: request2.preimages.projectSettings.sha256 },
+      { name: "project-settings-local", path: expectedPaths.projectSettingsLocal, sha256: request2.preimages.projectSettingsLocal.sha256 },
+      { name: "known-marketplaces", path: expectedPaths.marketplaces, sha256: request2.preimages.marketplaces.sha256 },
+      { name: "installed-plugins", path: expectedPaths.installedPlugins, sha256: request2.preimages.installedPlugins.sha256 },
+      { name: "skills-policy", path: join68(request2.skills.dataDir, "agent-policy.json"), sha256: request2.skills.policySha256 }
+    ],
+    ownedDelta: { settingsEnabledPlugins: selectedPluginIds, selectedPluginOptions: selectedOptionPaths, functionHooksEnv: candidate2.functionHooksEnv ?? null, knownMarketplace: candidate2.marketplace, installedPlugins: selectedPluginIds, unrelatedGraph: "preserved-by-complete-semantic-documents" },
+    identityPrecondition: "Harnesses must resolve the installed Claude home/config/plugin roots and executable path/version/hash plus the installed Skills data directory through their package-owned consumers, then compare every value before trusting this receipt; this validator checks supplied paths and current bytes only and does not establish actual consumer identity",
+    reviewPrecondition: "The caller's no-skill-injection assessment is bound to the raw request hash; structural checks are not semantic hook review, and Harnesses must retain its existing review record and verify the exact candidate binding",
+    limitation: "validation-only; native installer atomicity and crash recovery are not established"
+  };
+}
+var CLAUDE_PROSPECTIVE_REVIEW_SCHEMA = "skills.claude-plugin-prospective-review/v1", SHA256, MAX_CANDIDATE_FILES = 16384, MAX_CANDIDATE_BYTES, sha7 = (data) => createHash41("sha256").update(data).digest("hex"), GENERATED_MARKETPLACE_TIME, GENERATED_FRESH_PLUGIN_INSTALLED_AT, GENERATED_PLUGIN_UPDATE_TIME;
+var init_claude_prospective_review = __esm(() => {
+  init_agent_discovery();
+  init_agent_integration();
+  init_claude_marketplace_entry_witness();
+  init_claude_plugin_manifest_witness();
+  init_managed_policy();
+  init_codex_native_skill_policy();
+  SHA256 = /^[a-f0-9]{64}$/;
+  MAX_CANDIDATE_BYTES = 256 * 1024 * 1024;
+  GENERATED_MARKETPLACE_TIME = Object.freeze({ $generated: "claude-utc-timestamp", field: "known-marketplaces.lastUpdated" });
+  GENERATED_FRESH_PLUGIN_INSTALLED_AT = Object.freeze({ $generated: "claude-utc-timestamp", field: "installed_plugins.fresh-row.installedAt" });
+  GENERATED_PLUGIN_UPDATE_TIME = Object.freeze({ $generated: "claude-utc-timestamp", field: "installed_plugins.selected-row.lastUpdated" });
+});
+
 // src/lib/self-spawn.ts
-import { realpathSync as realpathSync21 } from "fs";
-import { dirname as dirname38, isAbsolute as isAbsolute34, sep as sep15 } from "path";
+import { realpathSync as realpathSync22 } from "fs";
+import { dirname as dirname39, isAbsolute as isAbsolute35, sep as sep16 } from "path";
 function selfSpawnRoot(entry) {
   const index = entry.indexOf(INSTALLED_PACKAGE);
-  const root2 = index > 0 ? entry.slice(0, index) : dirname38(entry);
+  const root2 = index > 0 ? entry.slice(0, index) : dirname39(entry);
   try {
-    return realpathSync21(root2);
+    return realpathSync22(root2);
   } catch {
     return root2;
   }
@@ -116539,7 +117202,7 @@ function selfSpawnRoot(entry) {
 function selfSpawnCommand(args2, options = {}) {
   const runtime = options.runtime ?? process.execPath;
   const entry = options.entry ?? process.argv[1];
-  if (!runtime || !isAbsolute34(runtime) || !entry || !isAbsolute34(entry))
+  if (!runtime || !isAbsolute35(runtime) || !entry || !isAbsolute35(entry))
     throw new Error("SKILLS_SELF_SPAWN_ENTRY_UNRESOLVED");
   const root2 = selfSpawnRoot(entry);
   const env3 = pinnedLauncherEnvironment(options.env ?? process.env);
@@ -116549,7 +117212,7 @@ function selfSpawnCommand(args2, options = {}) {
 var INSTALLED_PACKAGE;
 var init_self_spawn = __esm(() => {
   init_runtime_launcher();
-  INSTALLED_PACKAGE = `${sep15}node_modules${sep15}@hasna${sep15}skills${sep15}`;
+  INSTALLED_PACKAGE = `${sep16}node_modules${sep16}@hasna${sep16}skills${sep16}`;
 });
 
 // src/cli/commands/agent-integration.ts
@@ -116557,10 +117220,10 @@ var exports_agent_integration = {};
 __export(exports_agent_integration, {
   registerAgentIntegration: () => registerAgentIntegration
 });
-import { existsSync as existsSync36, lstatSync as lstatSync37, readFileSync as readFileSync45, readSync as readSync18, writeFileSync as writeFileSync27 } from "fs";
-import { createHash as createHash41 } from "crypto";
+import { existsSync as existsSync36, lstatSync as lstatSync38, readFileSync as readFileSync46, readSync as readSync18, writeFileSync as writeFileSync27 } from "fs";
+import { createHash as createHash42 } from "crypto";
 import { homedir as homedir13 } from "os";
-import { isAbsolute as isAbsolute35 } from "path";
+import { isAbsolute as isAbsolute36 } from "path";
 function pinnedHookProfile(input3, configuredProfile) {
   try {
     const parsed = parseSkillContextInput(JSON.stringify(input3));
@@ -116656,7 +117319,7 @@ function registerAgentIntegration(parent) {
   });
   hook.command("native-catalog").requiredOption("--cwd <path>", "Absolute project directory observed by native Codex skills/list").requiredOption("--output <file>", "New private file for the projected native catalog").option("--codex-command <path>", "Installed Codex executable used by the native client", "codex").option("--json", "Output bounded capture metadata as JSON", false).description("Capture a reviewed Codex native skill catalog for exact hook enrollment").action(async (options) => {
     try {
-      if (!isAbsolute35(options.cwd) || !isAbsolute35(options.output))
+      if (!isAbsolute36(options.cwd) || !isAbsolute36(options.output))
         throw new Error("CODEX_NATIVE_SKILL_CATALOG_ABSOLUTE_PATH_REQUIRED");
       if (existsSync36(options.output))
         throw new Error("CODEX_NATIVE_SKILL_CATALOG_OUTPUT_EXISTS");
@@ -116675,8 +117338,8 @@ function registerAgentIntegration(parent) {
           throw new Error("CODEX_NATIVE_SKILL_CATALOG_OUTPUT_EXISTS");
         throw error61;
       }
-      const written = lstatSync37(options.output);
-      if (!written.isFile() || written.isSymbolicLink() || (written.mode & 63) !== 0 || readFileSync45(options.output, "utf8") !== bytes)
+      const written = lstatSync38(options.output);
+      if (!written.isFile() || written.isSymbolicLink() || (written.mode & 63) !== 0 || readFileSync46(options.output, "utf8") !== bytes)
         throw new Error("CODEX_NATIVE_SKILL_CATALOG_READBACK_FAILED");
       const receipt = {
         version: catalog.version,
@@ -116684,7 +117347,7 @@ function registerAgentIntegration(parent) {
         skillCount: catalog.skills.length,
         output: options.output,
         bytes: Buffer.byteLength(bytes),
-        sha256: createHash41("sha256").update(bytes).digest("hex")
+        sha256: createHash42("sha256").update(bytes).digest("hex")
       };
       await writeCliOutput(options.json ? JSON.stringify(receipt) : `Captured ${receipt.skillCount} native Codex skill(s) in ${receipt.output}.`);
     } catch (error61) {
@@ -116707,6 +117370,22 @@ function registerAgentIntegration(parent) {
       throw new Error("Unsupported witness kind; select sumi-settings-v1, claude-settings-v4, claude-settings-v3, claude-settings-v2, codex-settings-v4, codex-settings-v3, codex-settings-v2, codex-settings-v1, claude-marketplace-registry-v2 or claude-marketplace-entry-v1");
     await writeCliOutput(JSON.stringify(capture2(options.path), null, 2));
   });
+  hook.command("review-claude-candidate").requiredOption("--request <file>", "Frozen skills.claude-plugin-prospective-review/v1 JSON request").option("--json", "Return the validation-only receipt as JSON", false).description("Validate a prospective Claude plugin candidate and current preimages without changing native state; Harnesses must compare native and Skills paths against installed package-owned resolvers before trusting the receipt").action(async (options) => {
+    try {
+      if (!isAbsolute36(options.request))
+        throw new Error("CLAUDE_CANDIDATE_REVIEW_REFUSED: --request must be an absolute path");
+      const stat3 = lstatSync38(options.request);
+      if (!stat3.isFile() || stat3.isSymbolicLink() || stat3.size > 1024 * 1024)
+        throw new Error("CLAUDE_CANDIDATE_REVIEW_REFUSED: request must be a regular file no larger than 1 MiB");
+      const requestBytes = readFileSync46(options.request);
+      const request2 = JSON.parse(requestBytes.toString("utf8"));
+      const receipt = reviewClaudeProspectiveCandidate(request2, createHash42("sha256").update(requestBytes).digest("hex"));
+      await writeCliOutput(options.json ? JSON.stringify(receipt) : `Claude plugin candidate review accepted for ${receipt.pluginIds.length} selected plugin(s); native state was not changed.`);
+    } catch (error61) {
+      console.error(error61 instanceof Error && error61.message.startsWith("CLAUDE_CANDIDATE_REVIEW_REFUSED:") ? error61.message : "CLAUDE_CANDIDATE_REVIEW_REFUSED: request or current preimage validation failed");
+      process.exitCode = 1;
+    }
+  });
   hook.command("rebind-settings").requiredOption("--agent <agent>", "claude, codex or sumi").requiredOption("--reviewed-preimage <path>", "Exact preserved legacy settings.json, config.toml or sumi.json").requiredOption("--expected-policy-sha256 <sha256>", "Exact current managed policy bytes").requiredOption("--expected-settings-sha256 <sha256>", "Exact current native settings bytes").option("--codex-witness-version <version>", "Explicit target: 2 (legacy default) 3 (service tier and model-advertised effort), or 4 (native availability UI counts)").option("--claude-witness-version <version>", "Explicit target: 3 (default) or 4 (also permits a built-in top-level theme)").option("--apply", "Apply the explicit semantic witness upgrade with preservation and readback", false).option("--json", "Return the metadata-only plan or receipt", false).description("Explicitly migrate a legacy native settings witness after proving only known preferences changed").action(async (options) => {
     try {
       if (!["claude", "codex", "sumi"].includes(options.agent))
@@ -116742,8 +117421,8 @@ function registerAgentIntegration(parent) {
   });
   hook.command("install").option("--agent <agent>", `Agent to configure: ${INTEGRATION_AGENTS.join(", ")}, all`, "all").option("--command <path>", "Skills executable used by the hook (preserves existing binding; new agents use skills)").option("--selection-profile <id>", "Selection profile (preserves existing binding; new agents use default)").option("--include-vendor", "Retained for compatibility; vendor system skills are always inventoried and disabled", false).option("--discovery-inputs <file>", "Advanced reviewed active plugin roots and source hashes for unsupported registrations").option("--codex-skill-denials <file>", "Explicit reviewed remote skill denials: array of exact name, path and document sha256; requires fresh catalog and discovery inputs").option("--codex-native-catalog <file>", "Reviewed supported Codex skill and installed-plugin receipt for exact qualified-name disables").option("--reviewed-cache-alias <path>", "Exact skill-containing vendor cache alias reviewed for this hook plan").option("--allow-root-aliases", "Allow home .claude/.codex aliases to existing directories within this home", false).option("--apply", "Apply the plan, preserving prior configuration in private backups", false).option("--json", "Output a receipt as JSON", false).description("Plan or install one Skills CLI bridge plus native prompt hooks").action(async (options) => {
     try {
-      const discoveryInputs = options.discoveryInputs ? JSON.parse(readFileSync45(options.discoveryInputs, "utf8")) : undefined;
-      const plan = planAgentIntegration({ projectDir: process.cwd(), agents: agents(options.agent), command: options.command, profileId: options.selectionProfile, includeVendor: options.includeVendor, discoveryInputs, allowRootAliases: options.allowRootAliases, reviewedCacheAlias: options.reviewedCacheAlias, codexSkillDenials: options.codexSkillDenials ? JSON.parse(readFileSync45(options.codexSkillDenials, "utf8")) : undefined, codexNativeCatalog: options.codexNativeCatalog ? JSON.parse(readFileSync45(options.codexNativeCatalog, "utf8")) : undefined });
+      const discoveryInputs = options.discoveryInputs ? JSON.parse(readFileSync46(options.discoveryInputs, "utf8")) : undefined;
+      const plan = planAgentIntegration({ projectDir: process.cwd(), agents: agents(options.agent), command: options.command, profileId: options.selectionProfile, includeVendor: options.includeVendor, discoveryInputs, allowRootAliases: options.allowRootAliases, reviewedCacheAlias: options.reviewedCacheAlias, codexSkillDenials: options.codexSkillDenials ? JSON.parse(readFileSync46(options.codexSkillDenials, "utf8")) : undefined, codexNativeCatalog: options.codexNativeCatalog ? JSON.parse(readFileSync46(options.codexNativeCatalog, "utf8")) : undefined });
       const result2 = options.apply ? applyAgentIntegration(plan) : { changed: [], backups: [] };
       const receipt = { codexPluginSkillReview: plan.codexPluginSkillReview, codexPluginSkills: plan.changes.filter((change) => change.path.endsWith("agent-policy.json")).map((change) => JSON.parse(change.after).bridge?.codexPluginSkills ?? []).flat(), applied: options.apply, planned: plan.changes.map((change) => change.path), ...result2, rootAliases: plan.rootAliases ?? [], discovery: plan.discoveryAfter, nativeSkills: plan.nativeSkills.map((entry) => ({ agent: entry.agent, path: entry.path, managed: entry.managed, vendor: entry.vendor, system: entry.system === true, bridge: entry.bridge === true })), requiresNativeRetirement: plan.nativeSkills.some((entry) => !entry.bridge && !entry.system) };
       if (options.json)
@@ -116802,7 +117481,7 @@ function registerAgentIntegration(parent) {
     try {
       if (agents(options.agent).length !== 1)
         throw new Error("A hook invocation requires one agent");
-      const inputBytes = readFileSync45(0), inputText = inputBytes.toString("utf8");
+      const inputBytes = readFileSync46(0), inputText = inputBytes.toString("utf8");
       if (inputText.length > 1024 * 1024)
         throw new Error("Hook input is too large");
       let input3 = JSON.parse(inputText);
@@ -116815,12 +117494,12 @@ function registerAgentIntegration(parent) {
       input3.hook_event_name = event;
       const projects = [process.cwd()];
       if (input3.cwd !== undefined) {
-        if (typeof input3.cwd !== "string" || !isAbsolute35(input3.cwd) || input3.cwd.includes("\x00"))
+        if (typeof input3.cwd !== "string" || !isAbsolute36(input3.cwd) || input3.cwd.includes("\x00"))
           throw new Error("Invalid native hook working directory");
         projects.push(input3.cwd);
       }
       if (options.agent === "cursor") {
-        if (!Array.isArray(input3.workspace_roots) || input3.workspace_roots.length > 32 || input3.workspace_roots.some((path) => typeof path !== "string" || !isAbsolute35(path) || path.includes("\x00")))
+        if (!Array.isArray(input3.workspace_roots) || input3.workspace_roots.length > 32 || input3.workspace_roots.some((path) => typeof path !== "string" || !isAbsolute36(path) || path.includes("\x00")))
           throw new Error("Invalid Cursor workspace roots");
         projects.push(...input3.workspace_roots);
         input3.cwd ??= input3.workspace_roots[0] ?? process.cwd();
@@ -116918,7 +117597,7 @@ function registerAgentIntegration(parent) {
     try {
       if (options.agent && !INTEGRATION_AGENTS.includes(options.agent))
         throw new Error(`Unsupported migration agent: ${options.agent}`);
-      const discoveryInputs = options.discoveryInputs ? JSON.parse(readFileSync45(options.discoveryInputs, "utf8")) : undefined;
+      const discoveryInputs = options.discoveryInputs ? JSON.parse(readFileSync46(options.discoveryInputs, "utf8")) : undefined;
       if (options.targetManifest && (options.includeUnmanaged || options.includeVendor))
         throw new Error("--target-manifest cannot be combined with broad native migration selectors");
       const targetManifest = options.targetManifest ? readNativeMigrationTargetManifest(options.targetManifest) : undefined;
@@ -116956,6 +117635,7 @@ var init_agent_integration2 = __esm(() => {
   init_codex_settings_witness();
   init_claude_marketplace_registry();
   init_claude_marketplace_entry_witness();
+  init_claude_prospective_review();
   init_codex_native_skill_catalog();
   init_self_spawn();
   RECOVERABLE_CONTEXT_CACHE_ERRORS = new Set(["CACHED_PROFILE_EXPIRED", "CACHED_PROFILE_MISSING", "CACHED_BUNDLE_MISSING"]);
@@ -117231,28 +117911,28 @@ var init_grants = __esm(() => {
 });
 
 // src/lib/station-hydrate.ts
-import { createHash as createHash42 } from "crypto";
+import { createHash as createHash43 } from "crypto";
 import {
   copyFileSync as copyFileSync3,
   mkdirSync as mkdirSync29,
-  readdirSync as readdirSync24,
-  readFileSync as readFileSync46,
+  readdirSync as readdirSync25,
+  readFileSync as readFileSync47,
   statSync as statSync23,
   writeFileSync as writeFileSync30
 } from "fs";
-import { dirname as dirname39, join as join68, resolve as resolve33, sep as sep16 } from "path";
+import { dirname as dirname40, join as join69, resolve as resolve34, sep as sep17 } from "path";
 function fail6(code2, message, detail = []) {
   throw new StationSnapshotError(code2, message, detail);
 }
 function snapshotRootFor(repoRoot, stationId) {
-  return join68(repoRoot, "resources", stationId, "skills");
+  return join69(repoRoot, "resources", stationId, "skills");
 }
 function readSnapshotManifest(repoRoot, stationId) {
   const snapshotRoot = snapshotRootFor(repoRoot, stationId);
-  const manifestPath = join68(snapshotRoot, "sync-manifest.json");
+  const manifestPath = join69(snapshotRoot, "sync-manifest.json");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync46(manifestPath, "utf8"));
+    manifest = JSON.parse(readFileSync47(manifestPath, "utf8"));
   } catch (error61) {
     fail6("MANIFEST_UNREADABLE", `cannot read snapshot manifest: ${manifestPath}: ${error61.message}`);
   }
@@ -117276,10 +117956,10 @@ function planStationHydration(stationId, repoRoot) {
   const hashMismatches = [];
   const skippedByRule = [];
   for (const agent of SYNC_AGENTS) {
-    const agentRoot = join68(snapshotRoot, "agent-homes", agent);
+    const agentRoot = join69(snapshotRoot, "agent-homes", agent);
     let identEntries;
     try {
-      identEntries = readdirSync24(agentRoot, { withFileTypes: true });
+      identEntries = readdirSync25(agentRoot, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -117287,10 +117967,10 @@ function planStationHydration(stationId, repoRoot) {
       if (!identEntry.isDirectory() || identEntry.name.startsWith(".")) {
         continue;
       }
-      const identRoot = join68(agentRoot, identEntry.name);
+      const identRoot = join69(agentRoot, identEntry.name);
       const entries = walkEntries(identRoot);
       for (const entry of entries) {
-        const relativeParts = [identEntry.name, ...entry.relativePath.split(sep16)];
+        const relativeParts = [identEntry.name, ...entry.relativePath.split(sep17)];
         if (entry.kind === "symlink") {
           symlinks.push({ ident: identEntry.name, agent, relativePath: entry.relativePath });
           continue;
@@ -117314,8 +117994,8 @@ function planStationHydration(stationId, repoRoot) {
           });
           continue;
         }
-        const withinIdent = relativeParts.slice(1).join(sep16);
-        const homeRelative = relativeParts.join(sep16);
+        const withinIdent = relativeParts.slice(1).join(sep17);
+        const homeRelative = relativeParts.join(sep17);
         if (REFUSED_SCANNER_FLAGGED.has(homeRelative)) {
           skippedByRule.push({
             ident: identEntry.name,
@@ -117388,7 +118068,7 @@ function planStationHydration(stationId, repoRoot) {
         for (const copy of copies) {
           let isStub = false;
           try {
-            isStub = isPointerSkillMd(readFileSync46(copy.fullPath, "utf8"));
+            isStub = isPointerSkillMd(readFileSync47(copy.fullPath, "utf8"));
           } catch {
             isStub = false;
           }
@@ -117434,12 +118114,12 @@ function skillSha256(skill) {
     return sha256File(skill.files[0].winner.fullPath);
   }
   const joined = skill.files.map((file2) => sha256File(file2.winner.fullPath));
-  return createHash42("sha256").update(joined.sort().join(`
+  return createHash43("sha256").update(joined.sort().join(`
 `)).digest("hex");
 }
 function writeStationHydration(options) {
-  const repoRoot = resolve33(options.repoRoot ?? process.cwd());
-  const cacheRoot = resolve33(options.cacheRoot ?? resolveCorpusRoot());
+  const repoRoot = resolve34(options.repoRoot ?? process.cwd());
+  const cacheRoot = resolve34(options.cacheRoot ?? resolveCorpusRoot());
   const plan = planStationHydration(options.stationId, repoRoot);
   const resultSkills = plan.winners.map((skill) => ({
     ident: skill.ident,
@@ -117472,7 +118152,7 @@ function writeStationHydration(options) {
   const toWrite = [];
   for (const skill of plan.winners) {
     for (const file2 of skill.files) {
-      const destination = join68(cacheRoot, skill.ident, file2.withinIdent);
+      const destination = join69(cacheRoot, skill.ident, file2.withinIdent);
       const digest4 = sha256File(file2.winner.fullPath);
       let existingDigest = null;
       try {
@@ -117493,7 +118173,7 @@ function writeStationHydration(options) {
   }
   let written = 0;
   for (const entry of toWrite) {
-    mkdirSync29(dirname39(entry.destination), { recursive: true });
+    mkdirSync29(dirname40(entry.destination), { recursive: true });
     copyFileSync3(entry.fullPath, entry.destination);
     written += 1;
   }
@@ -117514,8 +118194,8 @@ function writeStationHydration(options) {
     },
     skills: resultSkills
   };
-  const hydrationManifestPath = join68(dirname39(cacheRoot), `hydration-${options.stationId}.json`);
-  mkdirSync29(dirname39(hydrationManifestPath), { recursive: true });
+  const hydrationManifestPath = join69(dirname40(cacheRoot), `hydration-${options.stationId}.json`);
+  mkdirSync29(dirname40(hydrationManifestPath), { recursive: true });
   writeFileSync30(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
 `);
   return {
@@ -117591,15 +118271,15 @@ var init_hydrate = __esm(() => {
 });
 
 // src/lib/prepare-skill.ts
-import { createHash as createHash43, randomUUID as randomUUID13 } from "crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync37, lstatSync as lstatSync38, mkdirSync as mkdirSync30, mkdtempSync as mkdtempSync6, readFileSync as readFileSync47, readdirSync as readdirSync25, renameSync as renameSync15, rmSync as rmSync9, writeFileSync as writeFileSync31 } from "fs";
+import { createHash as createHash44, randomUUID as randomUUID13 } from "crypto";
+import { chmodSync as chmodSync5, existsSync as existsSync37, lstatSync as lstatSync39, mkdirSync as mkdirSync30, mkdtempSync as mkdtempSync6, readFileSync as readFileSync48, readdirSync as readdirSync26, renameSync as renameSync15, rmSync as rmSync9, writeFileSync as writeFileSync31 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname40, isAbsolute as isAbsolute36, join as join69, relative as relative12, resolve as resolve34, sep as sep17 } from "path";
+import { dirname as dirname41, isAbsolute as isAbsolute37, join as join70, relative as relative13, resolve as resolve35, sep as sep18 } from "path";
 function prepareSkill(name, options) {
   const normalized = normalizePortableSkillName(name);
   if (!new RegExp(SEMVER_PATTERN).test(options.version))
     throw new Error("--version must be a semantic version, for example 0.2.0.");
-  const path = join69(getPortableSkillsRootReadOnly(options), normalized);
+  const path = join70(getPortableSkillsRootReadOnly(options), normalized);
   assertPortableAuthoringPath(path, options);
   const before2 = snapshot2(path);
   const manifestFile = before2.files.find((file2) => file2.path === "skill.json");
@@ -117634,16 +118314,16 @@ function prepareSkill(name, options) {
     throw new Error("skill.json provenance must be an object.");
   const provenance = manifest.provenance;
   const candidate2 = { ...manifest, version: options.version, kind, provenance: { ...provenance } };
-  const staging = mkdtempSync6(join69(tmpdir2(), "skills-prepare-"));
+  const staging = mkdtempSync6(join70(tmpdir2(), "skills-prepare-"));
   try {
     for (const directory2 of before2.directories)
-      mkdirSync30(join69(staging, directory2), { recursive: true });
+      mkdirSync30(join70(staging, directory2), { recursive: true });
     for (const file2 of before2.files) {
-      const destination = join69(staging, file2.path);
-      mkdirSync30(dirname40(destination), { recursive: true });
+      const destination = join70(staging, file2.path);
+      mkdirSync30(dirname41(destination), { recursive: true });
       writeFileSync31(destination, file2.bytes, { mode: file2.mode });
     }
-    const stagedManifest = join69(staging, "skill.json");
+    const stagedManifest = join70(staging, "skill.json");
     writeFileSync31(stagedManifest, `${JSON.stringify(candidate2, null, 2)}
 `);
     const contentHash = computeContentHash(staging);
@@ -117666,11 +118346,11 @@ ${validation.issues.map((issue2) => `${issue2.code}: ${issue2.message}`).join(`
     if (snapshot2(path).identity !== before2.identity)
       throw new Error("Skill changed during preparation; review the draft and run prepare again.");
     if (changed3 && !options.dryRun) {
-      const temporary = join69(path, `.skill-prepare-${randomUUID13()}.tmp`);
+      const temporary = join70(path, `.skill-prepare-${randomUUID13()}.tmp`);
       try {
         writeFileSync31(temporary, candidateBytes, { flag: "wx", mode: manifestFile.mode });
         chmodSync5(temporary, manifestFile.mode);
-        renameSync15(temporary, join69(path, "skill.json"));
+        renameSync15(temporary, join70(path, "skill.json"));
       } finally {
         rmSync9(temporary, { force: true });
       }
@@ -117700,8 +118380,8 @@ function validateRuntimeEntrypoint(candidate2, root2) {
   const entry = candidate2.runtime.entrypoint;
   if (typeof entry !== "string")
     return;
-  const target = resolve34(root2, entry), rel = relative12(root2, target);
-  if (isAbsolute36(entry) || /^[a-zA-Z]:/.test(entry) || entry.includes("\\") || !rel || rel === ".." || rel.startsWith(`..${sep17}`) || isAbsolute36(rel) || !existsSync37(target) || !lstatSync38(target).isFile()) {
+  const target = resolve35(root2, entry), rel = relative13(root2, target);
+  if (isAbsolute37(entry) || /^[a-zA-Z]:/.test(entry) || entry.includes("\\") || !rel || rel === ".." || rel.startsWith(`..${sep18}`) || isAbsolute37(rel) || !existsSync37(target) || !lstatSync39(target).isFile()) {
     throw new Error("Executable runtime.entrypoint must name an existing regular file inside the skill directory.");
   }
 }
@@ -117786,20 +118466,20 @@ function compareVersions(left, right) {
   return 0;
 }
 function snapshot2(root2) {
-  const rootStat = lstatSync38(root2);
+  const rootStat = lstatSync39(root2);
   if (rootStat.isSymbolicLink() || !rootStat.isDirectory())
     throw new Error("Skill root must be a real directory, not a symlink.");
   const files = [], directories = [];
-  const hash6 = createHash43("sha256").update(`${rootStat.dev}:${rootStat.ino}\x00`);
+  const hash6 = createHash44("sha256").update(`${rootStat.dev}:${rootStat.ino}\x00`);
   let count = 0, bytes = 0;
-  const walk2 = (relative13) => {
-    for (const name of readdirSync25(join69(root2, relative13)).sort()) {
-      if (IGNORED.has(name.toLowerCase()) || !relative13 && ROOT_IGNORED.has(name.toLowerCase()))
+  const walk2 = (relative14) => {
+    for (const name of readdirSync26(join70(root2, relative14)).sort()) {
+      if (IGNORED.has(name.toLowerCase()) || !relative14 && ROOT_IGNORED.has(name.toLowerCase()))
         continue;
-      const path = relative13 ? `${relative13}/${name}` : name;
+      const path = relative14 ? `${relative14}/${name}` : name;
       if (++count > 20000)
         throw new Error("Skill exceeds the preparation entry limit (20000).");
-      const absolute = join69(root2, path), stat3 = lstatSync38(absolute);
+      const absolute = join70(root2, path), stat3 = lstatSync39(absolute);
       if (stat3.isSymbolicLink())
         throw new Error(`Skill contains a symlink: ${path}. No files were changed.`);
       if (stat3.isDirectory() && name === "node_modules")
@@ -117812,7 +118492,7 @@ function snapshot2(root2) {
         bytes += stat3.size;
         if (bytes > 50000000)
           throw new Error("Skill exceeds the preparation size limit (50000000 bytes).");
-        const content = readFileSync47(absolute);
+        const content = readFileSync48(absolute);
         if (content.length !== stat3.size)
           throw new Error("Skill changed during preparation.");
         files.push({ path, bytes: content, mode: stat3.mode & 511 });
@@ -118215,7 +118895,7 @@ var init_schedule = __esm(() => {
 
 // src/lib/registry-sync.ts
 import { mkdirSync as mkdirSync31, writeFileSync as writeFileSync32 } from "fs";
-import { dirname as dirname41, relative as relative13 } from "path";
+import { dirname as dirname42, relative as relative14 } from "path";
 function createRegistrySyncArtifact(options = {}) {
   const profile = options.profile ?? "all";
   const includeDocs = options.includeDocs ?? true;
@@ -118227,7 +118907,7 @@ function createRegistrySyncArtifact(options = {}) {
   const registry2 = [...loadRegistryProfile(profile)].sort((a, b) => a.name.localeCompare(b.name));
   const skills = registry2.map((skill) => {
     const skillPath = getSkillPath(skill.name);
-    const directory2 = relative13(process.cwd(), skillPath) || skillPath;
+    const directory2 = relative14(process.cwd(), skillPath) || skillPath;
     const validation = includeValidation ? validateSkillDirectory(skill.name, skillPath, skill) : undefined;
     const docs = includeDocs ? buildDocs(skill.name) : undefined;
     return {
@@ -118272,7 +118952,7 @@ function createRegistrySyncArtifact(options = {}) {
   };
 }
 function writeRegistrySyncArtifact(path, artifact) {
-  mkdirSync31(dirname41(path), { recursive: true });
+  mkdirSync31(dirname42(path), { recursive: true });
   writeFileSync32(path, `${JSON.stringify(artifact, null, 2)}
 `);
 }
@@ -118292,8 +118972,8 @@ var init_registry_sync = __esm(() => {
 });
 
 // src/lib/review-export.ts
-import { constants as constants25, closeSync as closeSync27, existsSync as existsSync38, fstatSync as fstatSync27, fsyncSync as fsyncSync9, lstatSync as lstatSync39, openSync as openSync27, realpathSync as realpathSync22, statSync as statSync24, writeFileSync as writeFileSync33 } from "fs";
-import { basename as basename18, dirname as dirname42, isAbsolute as isAbsolute37, join as join70, parse as parse13, resolve as resolve35, sep as sep18 } from "path";
+import { constants as constants25, closeSync as closeSync27, existsSync as existsSync38, fstatSync as fstatSync27, fsyncSync as fsyncSync9, lstatSync as lstatSync40, openSync as openSync27, realpathSync as realpathSync23, statSync as statSync24, writeFileSync as writeFileSync33 } from "fs";
+import { basename as basename19, dirname as dirname43, isAbsolute as isAbsolute38, join as join71, parse as parse13, resolve as resolve36, sep as sep19 } from "path";
 function exactVersion(spec) {
   const at2 = spec.indexOf("@");
   const slug2 = spec.slice(0, at2);
@@ -118304,23 +118984,23 @@ function exactVersion(spec) {
   return { slug: slug2, version: version2 };
 }
 function assertPrivateDestination(output2) {
-  if (!isAbsolute37(output2) || resolve35(output2) !== output2 || !basename18(output2).endsWith(".tar.gz")) {
+  if (!isAbsolute38(output2) || resolve36(output2) !== output2 || !basename19(output2).endsWith(".tar.gz")) {
     throw new Error("Review output must be an absolute, normalized .tar.gz path.");
   }
-  const parent = dirname42(output2);
-  if (realpathSync22(parent) !== parent || lstatSync39(parent).isSymbolicLink()) {
+  const parent = dirname43(output2);
+  if (realpathSync23(parent) !== parent || lstatSync40(parent).isSymbolicLink()) {
     throw new Error("Review output parent must be a real directory, not a symlink.");
   }
   const parentStat = statSync24(parent);
   if (!parentStat.isDirectory() || (parentStat.mode & 63) !== 0 || process.getuid && parentStat.uid !== process.getuid()) {
     throw new Error("Review output parent must be an owner-only directory (mode 0700).");
   }
-  const segments = parent.toLowerCase().split(sep18);
+  const segments = parent.toLowerCase().split(sep19);
   if (segments.some((segment) => NATIVE_CONTAINERS.has(segment)) || segments.some((segment, index) => segment === ".config" && segments[index + 1] === "opencode") || segments.some((segment, index) => segment === ".hasna" && segments[index + 1] === "skills")) {
     throw new Error("Review output cannot be placed in agent-native discovery or Skills installation paths.");
   }
-  for (let current = parent;; current = dirname42(current)) {
-    if (existsSync38(join70(current, ".git"))) {
+  for (let current = parent;; current = dirname43(current)) {
+    if (existsSync38(join71(current, ".git"))) {
       throw new Error("Review output cannot be placed inside a Git worktree.");
     }
     if (current === parse13(current).root)
@@ -118396,12 +119076,12 @@ function registerRegistry(parent) {
 async function writeJson2(value, space) {
   const text4 = `${JSON.stringify(value, null, space)}
 `;
-  await new Promise((resolve36, reject2) => {
+  await new Promise((resolve37, reject2) => {
     process.stdout.write(text4, (error61) => {
       if (error61)
         reject2(error61);
       else
-        resolve36();
+        resolve37();
     });
   });
 }
@@ -118605,9 +119285,9 @@ __export(exports_publish, {
   PushSkillError: () => PushSkillError
 });
 import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync39, readFileSync as readFileSync48 } from "fs";
+import { existsSync as existsSync39, readFileSync as readFileSync49 } from "fs";
 import { hostname as hostname5 } from "os";
-import { join as join71 } from "path";
+import { join as join72 } from "path";
 function registerPublish(parent) {
   parent.command("push").argument("<name>", "Name of a skill in the local corpus (~/.hasna/skills/installed or the migrated ~/.hasna/skills/skills)").option("--version <version>", "Override the version recorded on the instance").option("--force-new-version", "If name@version already exists with different content, publish as the next patch version", false).option("--dry-run", "Pack and validate without uploading", false).option("--json", "Output result as JSON", false).description("Publish a local skill to the configured skills instance").action(async (name, options) => {
     try {
@@ -118659,8 +119339,8 @@ async function pushSkill(name, options = {}) {
   const packed = packSkillBundle(skill.path, { maxUnpackedBytes: MAX_UNPACKED_BYTES });
   await verifyPackedCanonicalHash(skill.name, packed);
   const versionManifest = buildVersionManifest(skill.path, packed);
-  const skillMdPath = join71(skill.path, "SKILL.md");
-  const skillMd = existsSync39(skillMdPath) ? readFileSync48(skillMdPath, "utf-8") : undefined;
+  const skillMdPath = join72(skill.path, "SKILL.md");
+  const skillMd = existsSync39(skillMdPath) ? readFileSync49(skillMdPath, "utf-8") : undefined;
   const base3 = {
     slug: skill.name,
     path: skill.path,
@@ -118898,7 +119578,7 @@ var exports_private_publications = {};
 __export(exports_private_publications, {
   registerPrivatePublications: () => registerPrivatePublications
 });
-import { resolve as resolve36 } from "path";
+import { resolve as resolve37 } from "path";
 function verifyOptions(options, action) {
   if (options.userId === undefined !== (options.membershipId === undefined) || options.userId !== undefined && (!publicationUuid(options.userId) || !publicationUuid(options.membershipId)))
     throw new PrivatePublicationError("PUBLICATION_CONTEXT_REQUIRED", "Provide both observed --user-id and --membership-id UUIDs.");
@@ -118943,9 +119623,9 @@ function registerPrivatePublications(parent) {
         if (code2 === null)
           return;
         const context2 = options.userId ? { userId: options.userId, membershipId: options.membershipId } : undefined;
-        const client2 = await privatePublicationSession(options.email, code2, context2), directory2 = resolve36(options.recoveryDir);
+        const client2 = await privatePublicationSession(options.email, code2, context2), directory2 = resolve37(options.recoveryDir);
         if (action === "publish")
-          await preparePrivatePublication(client2, resolve36(args2[0]), directory2, { skillId: options.skillId, expectedCurrentVersionId: options.expectedCurrentVersion ?? null, idempotencyKey: options.idempotencyKey });
+          await preparePrivatePublication(client2, resolve37(args2[0]), directory2, { skillId: options.skillId, expectedCurrentVersionId: options.expectedCurrentVersion ?? null, idempotencyKey: options.idempotencyKey });
         const result2 = action === "publish" || action === "resume" ? await continuePrivatePublication(client2, directory2, { confirm: true, waitMs: Number(options.waitSeconds) * 1000 }) : await inspectPrivatePublication(client2, directory2, action === "cancel");
         print2(result2, options.json);
       } catch (error61) {
@@ -119047,7 +119727,7 @@ __export(exports_auth, {
 import { createInterface as createInterface3 } from "readline";
 function prompt(question) {
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     let settled = false;
     const finish = (answer) => {
       if (settled)
@@ -119056,7 +119736,7 @@ function prompt(question) {
       rl.close();
       if (answer === null)
         process.exitCode = 130;
-      resolve37(answer);
+      resolve38(answer);
     };
     rl.once("SIGINT", () => finish(null));
     rl.once("close", () => finish(null));
@@ -119234,7 +119914,7 @@ Skipped. Run it any time: skills setup agents`));
 function promptHidden(question) {
   const stdin = process.stdin;
   process.stdout.write(question);
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     let value = "";
     const done = (answer) => {
       stdin.off("data", onData);
@@ -119244,7 +119924,7 @@ function promptHidden(question) {
 `);
       if (answer === null)
         process.exitCode = 130;
-      resolve37(answer);
+      resolve38(answer);
     };
     const onData = (chunk2) => {
       for (const character of chunk2.toString()) {
@@ -119636,8 +120316,8 @@ function registerAccountCommands(parent) {
 }
 function registerAuth(parent) {
   const auth = parent.command("auth").description("Manage account authentication");
-  const keys3 = auth.command("keys").description("Manage API keys on the configured instance");
-  keys3.command("list").option("--json", "Output as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").action(async (options) => {
+  const keys4 = auth.command("keys").description("Manage API keys on the configured instance");
+  keys4.command("list").option("--json", "Output as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").action(async (options) => {
     try {
       const target = await captureProfileWorkspace("List API keys");
       target.unchanged();
@@ -119646,7 +120326,7 @@ function registerAuth(parent) {
       writeCommandError(error61, "Failed to list API keys", options.json);
     }
   });
-  keys3.command("create").argument("<name>").option("--scope <scope>", "Limit key scope (repeatable)", (value, all) => [...all, value], []).option("--json", "Output the newly created key as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").description("Create a key; the returned secret is shown once and must be stored securely").action(async (name, options) => {
+  keys4.command("create").argument("<name>").option("--scope <scope>", "Limit key scope (repeatable)", (value, all) => [...all, value], []).option("--json", "Output the newly created key as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").description("Create a key; the returned secret is shown once and must be stored securely").action(async (name, options) => {
     try {
       const target = await captureProfileWorkspace("Create API key");
       const client2 = new RemoteSkillsAuthClient(target.origin);
@@ -119657,7 +120337,7 @@ function registerAuth(parent) {
       writeCommandError(error61, "Failed to create API key", options.json);
     }
   });
-  keys3.command("revoke").argument("<key-id>").option("--json", "Output as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").action(async (id3, options) => {
+  keys4.command("revoke").argument("<key-id>").option("--json", "Output as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").action(async (id3, options) => {
     try {
       const target = await captureProfileWorkspace("Revoke API key");
       target.unchanged();
@@ -119666,7 +120346,7 @@ function registerAuth(parent) {
       writeCommandError(error61, "Failed to revoke API key", options.json);
     }
   });
-  keys3.command("add-publish-scope").argument("<key-id>").requiredOption("--expected-scopes <csv>", "Current comma-separated scopes; stale values are refused").option("--json", "Output as JSON", false).description("Add skills:publish to one existing key without minting or rotating it").action(async (id3, options) => {
+  keys4.command("add-publish-scope").argument("<key-id>").requiredOption("--expected-scopes <csv>", "Current comma-separated scopes; stale values are refused").option("--json", "Output as JSON", false).description("Add skills:publish to one existing key without minting or rotating it").action(async (id3, options) => {
     try {
       const connection = await resolveSkillsConnection();
       if (!connection)
@@ -119800,7 +120480,7 @@ function promptInvitationProof(kind) {
   const label = kind === "token" ? "invitation token" : "recovery code";
   const character = kind === "token" ? /^[A-Za-z0-9_-]$/ : /^\d$/;
   const { stdin, stderr: output2 } = process, wasRaw = stdin.isRaw, wasFlowing = stdin.readableFlowing;
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     let value = "", settled = false, overflow = false;
     const finish = (answer) => {
       if (settled)
@@ -119817,7 +120497,7 @@ function promptInvitationProof(kind) {
 `);
       if (answer === null)
         process.exitCode = 130;
-      resolve37(answer);
+      resolve38(answer);
     };
     const cancel = () => finish(null);
     const keypress = (text4, key) => {
@@ -120389,8 +121069,8 @@ var init_storage2 = __esm(() => {
 });
 
 // src/lib/registry-reconcile.ts
-import { existsSync as existsSync40, readFileSync as readFileSync49, statSync as statSync25, writeFileSync as writeFileSync34 } from "fs";
-import { join as join72 } from "path";
+import { existsSync as existsSync40, readFileSync as readFileSync50, statSync as statSync25, writeFileSync as writeFileSync34 } from "fs";
+import { join as join73 } from "path";
 function isDirectory2(path) {
   try {
     return statSync25(path).isDirectory();
@@ -120401,15 +121081,15 @@ function isDirectory2(path) {
 function migrationNeeded(options) {
   if (options.rootDir)
     return false;
-  const appDir = options.homeDir ? join72(options.homeDir, ".hasna", "skills") : getDataDir();
-  return !(isOwnerLayoutMigrated(appDir) && isDirectory2(join72(appDir, SKILLS_CACHE_DIRNAME)));
+  const appDir = options.homeDir ? join73(options.homeDir, ".hasna", "skills") : getDataDir();
+  return !(isOwnerLayoutMigrated(appDir) && isDirectory2(join73(appDir, SKILLS_CACHE_DIRNAME)));
 }
 function readBaseline(skillDir) {
-  const markerPath = join72(skillDir, PULL_MARKER_FILE);
+  const markerPath = join73(skillDir, PULL_MARKER_FILE);
   if (!existsSync40(markerPath))
     return;
   try {
-    const marker = JSON.parse(readFileSync49(markerPath, "utf-8"));
+    const marker = JSON.parse(readFileSync50(markerPath, "utf-8"));
     if (!isSkillsOwnershipMarker(marker))
       return;
     return {
@@ -120421,11 +121101,11 @@ function readBaseline(skillDir) {
   }
 }
 function readCursor(root2) {
-  const path = join72(root2, SYNC_CURSOR_FILE);
+  const path = join73(root2, SYNC_CURSOR_FILE);
   if (!existsSync40(path))
     return { runCount: 0 };
   try {
-    const cursor2 = JSON.parse(readFileSync49(path, "utf-8"));
+    const cursor2 = JSON.parse(readFileSync50(path, "utf-8"));
     return { runCount: typeof cursor2.runCount === "number" ? cursor2.runCount : 0 };
   } catch {
     return { runCount: 0 };
@@ -120434,12 +121114,12 @@ function readCursor(root2) {
 function resolveCorpusRootReadOnly(options) {
   if (options.rootDir)
     return { root: options.rootDir, migrationPending: false };
-  const appDir = options.homeDir ? join72(options.homeDir, ".hasna", "skills") : getDataDirReadOnly();
-  const cache3 = join72(appDir, SKILLS_CACHE_DIRNAME);
+  const appDir = options.homeDir ? join73(options.homeDir, ".hasna", "skills") : getDataDirReadOnly();
+  const cache3 = join73(appDir, SKILLS_CACHE_DIRNAME);
   if (isOwnerLayoutMigrated(appDir) && isDirectory2(cache3)) {
     return { root: cache3, migrationPending: false };
   }
-  return { root: join72(appDir, INSTALLED_SKILLS_DIRNAME), migrationPending: true };
+  return { root: join73(appDir, INSTALLED_SKILLS_DIRNAME), migrationPending: true };
 }
 function remoteRowToSkill(record12) {
   const slug2 = typeof record12.slug === "string" ? record12.slug : typeof record12.name === "string" ? record12.name : undefined;
@@ -120573,7 +121253,7 @@ async function reconcileRegistry(options = {}) {
   for (const slug2 of allSlugs) {
     const local = locals.get(slug2);
     const remote = remotes.get(slug2);
-    const baseline = local ? readBaseline(join72(root2, slug2)) : undefined;
+    const baseline = local ? readBaseline(join73(root2, slug2)) : undefined;
     const { state, reason: reason2 } = classifySkill(local, remote, baseline);
     let { action, reason: actionReason } = resolveAction(state, direction, conflict);
     if (state === "remote-only" && isDigestless(remote)) {
@@ -120632,7 +121312,7 @@ async function reconcileRegistry(options = {}) {
       try {
         await pushSkill(slug2, { rootDir: root2, client: client2 });
         const pushed = locals.get(slug2);
-        writePullMarker(join72(root2, slug2), {
+        writePullMarker(join73(root2, slug2), {
           skill: slug2,
           ...pushed?.version ? { version: pushed.version } : {},
           ...pushed?.sha256 ? { contentHash: pushed.sha256 } : {},
@@ -120704,7 +121384,7 @@ async function reconcileRegistry(options = {}) {
         runCount: readCursor(root2).runCount + 1,
         summary
       };
-      writeFileSync34(join72(root2, SYNC_CURSOR_FILE), `${JSON.stringify(cursor2, null, 2)}
+      writeFileSync34(join73(root2, SYNC_CURSOR_FILE), `${JSON.stringify(cursor2, null, 2)}
 `);
       return {
         corpusRoot: root2,