@hasna/skills 0.10.65 → 0.10.66

package/dist/sdk/index.js

@@ -32371,7 +32371,7 @@ var init_event_sink = __esm(() => {
   init_dist();
 });
 // package.json
-var version = "0.10.65";
+var version = "0.10.66";
 var package_default = {
   name: "@hasna/skills",
   version,
@@ -38326,7 +38326,7 @@ import {
   writeFileSync as writeFileSync8
 } from "fs";
 import { homedir as homedir5 } from "os";
-import { basename as basename13, dirname as dirname25, join as join35 } from "path";
+import { basename as basename15, dirname as dirname25, join as join35 } from "path";
 
 // src/lib/sumi-settings-witness.ts
 import { createHash as createHash8 } from "crypto";
@@ -40671,7 +40671,7 @@ function upgradeCodexSettingsWitnessV5(previous, reviewedSettingsPath) {
 // src/lib/codex-semantic-cache-witness.ts
 import { createHash as createHash13 } from "crypto";
 import { constants as constants9, closeSync as closeSync12, fstatSync as fstatSync12, lstatSync as lstatSync10, openSync as openSync12, readSync as readSync6, readdirSync as readdirSync4, realpathSync as realpathSync9 } from "fs";
-import { dirname as dirname9, isAbsolute as isAbsolute8, join as join15, relative as relative6, resolve as resolve8, sep as sep5 } from "path";
+import { basename as basename5, dirname as dirname9, isAbsolute as isAbsolute8, join as join15, relative as relative6, resolve as resolve8, sep as sep5 } from "path";
 var CODEX_SEMANTIC_CACHE_WITNESS_SCHEMA = "hasna.codex-semantic-cache-witness.v1";
 var identifier4 = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(value);
 var digest2 = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
@@ -40680,6 +40680,24 @@ var refuse5 = () => {
 };
 var MAX_DOCUMENT_BYTES = 1024 * 1024;
 var MAX_RECEIPT_BYTES = 16 * 1024;
+function codexLocalMarketplaceMapsPlugin(text, marketplace, plugin) {
+  try {
+    hashNativeJsonControls(text);
+    const value = JSON.parse(text);
+    if (!plainObject(value) || !exactKeys2(value, ["interface", "name", "plugins"]) || value.name !== marketplace || !(typeof value.interface === "string" || Number.isSafeInteger(value.interface)) || !Array.isArray(value.plugins) || value.plugins.length < 1 || value.plugins.length > 4096)
+      return false;
+    const rows = value.plugins.filter((row2) => plainObject(row2) && row2.name === plugin);
+    if (rows.length !== 1)
+      return false;
+    const row = rows[0];
+    if (!exactKeys2(row, ["name", "source"]) || !plainObject(row.source) || !exactKeys2(row.source, ["source", "path"]) || row.source.source !== "local" || typeof row.source.path !== "string" || !row.source.path.startsWith("./") || row.source.path.includes("\\"))
+      return false;
+    const parts = row.source.path.split("/");
+    return parts[0] === "." && parts.length > 1 && parts.slice(1).every((part) => /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(part)) && parts.at(-1) === plugin;
+  } catch {
+    return false;
+  }
+}
 function defaultRead(path) {
   const before = lstatSync10(path, { throwIfNoEntry: false, bigint: true });
   if (before === undefined)
@@ -40741,7 +40759,7 @@ function validPluginParent(cacheRoot, pluginParent, namespace, pluginId) {
   return parts.length === 2 && parts.every(identifier4) && parts[1] === namespace && pluginId === `${namespace}@${parts[0]}`;
 }
 function assertWitnessShape(value) {
-  if (!plainObject(value) || !exactKeys2(value, ["schema", "cacheRoot", "controls", "appOnlyParents", "skills", "sha256"]) || value.schema !== CODEX_SEMANTIC_CACHE_WITNESS_SCHEMA || typeof value.cacheRoot !== "string" || !isAbsolute8(value.cacheRoot) || resolve8(value.cacheRoot) !== value.cacheRoot || !digest2(value.sha256) || !Array.isArray(value.controls) || value.controls.length === 0 || value.controls.length > 4096 || !Array.isArray(value.appOnlyParents) || value.appOnlyParents.length > 4096 || !Array.isArray(value.skills) || value.skills.length === 0 || value.skills.length > 4096)
+  if (!plainObject(value) || !exactKeys2(value, ["schema", "cacheRoot", "controls", "appOnlyParents", "skills", "sha256"], ["hookParents"]) || value.schema !== CODEX_SEMANTIC_CACHE_WITNESS_SCHEMA || typeof value.cacheRoot !== "string" || !isAbsolute8(value.cacheRoot) || resolve8(value.cacheRoot) !== value.cacheRoot || !digest2(value.sha256) || !Array.isArray(value.controls) || value.controls.length === 0 || value.controls.length > 4096 || !Array.isArray(value.appOnlyParents) || value.appOnlyParents.length > 4096 || !Array.isArray(value.skills) || value.skills.length === 0 || value.skills.length > 4096)
     refuse5();
   const witness = value;
   const controlParents = new Set;
@@ -40762,6 +40780,20 @@ function assertWitnessShape(value) {
       refuse5();
     appOnlyParentPaths.add(row.pluginParent);
   }
+  const hookParentPaths = new Set;
+  const hookParents = witness.hookParents === undefined ? [] : witness.hookParents;
+  if (!Array.isArray(hookParents) || hookParents.length > 4096)
+    refuse5();
+  for (const candidate of hookParents) {
+    if (!plainObject(candidate))
+      refuse5();
+    const row = candidate;
+    const remote = row.installation === "remote-receipt";
+    const local = row.installation === "local-marketplace";
+    if (!exactKeys2(row, ["role", "pluginId", "namespace", "pluginParent", "installation", "manifestSha256", "hooksSha256"], remote ? ["remotePluginId", "receiptSha256"] : local ? ["marketplaceSourcePath", "marketplaceSha256"] : []) || row.role !== "reviewed-hook" || !identifier4(row.namespace) || typeof row.pluginId !== "string" || !/^[A-Za-z0-9_-]{1,64}@[A-Za-z0-9_-]{1,64}$/.test(row.pluginId) || typeof row.pluginParent !== "string" || !validPluginParent(String(witness.cacheRoot), row.pluginParent, row.namespace, row.pluginId) || remote && (typeof row.remotePluginId !== "string" || !/^[A-Za-z0-9_~-]{1,1024}$/.test(row.remotePluginId) || !digest2(row.receiptSha256)) || local && (typeof row.marketplaceSourcePath !== "string" || !isAbsolute8(row.marketplaceSourcePath) || resolve8(row.marketplaceSourcePath) !== row.marketplaceSourcePath || basename5(row.marketplaceSourcePath) !== "marketplace.json" || !digest2(row.marketplaceSha256)) || !remote && !local || !digest2(row.manifestSha256) || !digest2(row.hooksSha256) || hookParentPaths.has(row.pluginParent) || controlParents.has(row.pluginParent) || appOnlyParentPaths.has(row.pluginParent))
+      refuse5();
+    hookParentPaths.add(row.pluginParent);
+  }
   const skillNames = new Set;
   const qualifiedNames = new Set;
   for (const candidate of witness.skills) {
@@ -40781,6 +40813,7 @@ function assertWitnessShape(value) {
     cacheRoot: witness.cacheRoot,
     controls: witness.controls,
     appOnlyParents: witness.appOnlyParents,
+    ...witness.hookParents === undefined ? {} : { hookParents: witness.hookParents },
     skills: witness.skills
   };
   if (hash2(projection) !== witness.sha256)
@@ -40971,10 +41004,147 @@ function appOnlyParentProjection(cacheRoot, parents2, read) {
   }
   return rows.sort((a, b) => a.pluginId.localeCompare(b.pluginId) || a.pluginParent.localeCompare(b.pluginParent));
 }
-function assertParents(cacheRoot, controls, appOnlyParents, files, members) {
+var codexHookEvents = new Set([
+  "SessionStart",
+  "UserPromptSubmit",
+  "PreToolUse",
+  "PostToolUse",
+  "PostToolUseFailure",
+  "Stop",
+  "SubagentStart",
+  "SubagentStop",
+  "PreCompact",
+  "Notification",
+  "PermissionRequest",
+  "SessionEnd",
+  "ConfigChange",
+  "WorktreeCreate",
+  "WorktreeRemove",
+  "TeammateIdle",
+  "TaskComplete"
+]);
+function assertJsonValue(value, depth = 0, budget2 = { members: 0 }) {
+  if (depth > 32 || ++budget2.members > 4096)
+    refuse5();
+  if (value === null || typeof value === "string" || typeof value === "boolean")
+    return;
+  if (typeof value === "number" && Number.isFinite(value))
+    return;
+  if (Array.isArray(value)) {
+    for (const item of value)
+      assertJsonValue(item, depth + 1, budget2);
+    return;
+  }
+  if (!plainObject(value))
+    refuse5();
+  for (const [key, item] of Object.entries(value)) {
+    if (!key || /[\x00-\x1f\x7f]/.test(key))
+      refuse5();
+    assertJsonValue(item, depth + 1, budget2);
+  }
+}
+function reviewedHookControls(root, read) {
+  const manifestPath = join15(root, ".codex-plugin/plugin.json"), hooksPath = join15(root, "hooks/hooks.json");
+  let manifest, manifestSha256, hooks, hooksSha256;
+  try {
+    const manifestText = read(manifestPath);
+    manifestSha256 = hashNativeJsonControls(manifestText, "version");
+    manifest = JSON.parse(manifestText);
+    const hooksText = read(hooksPath);
+    hashNativeJsonControls(hooksText);
+    hooksSha256 = createHash13("sha256").update(hooksText).digest("hex");
+    hooks = JSON.parse(hooksText);
+  } catch {
+    return refuse5();
+  }
+  if (!plainObject(manifest) || !exactKeys2(manifest, ["name", "version", "hooks"], ["description"]) || !identifier4(manifest.name) || typeof manifest.version !== "string" || manifest.version !== basename5(root) || manifest.hooks !== "./hooks/hooks.json" || manifest.description !== undefined && (typeof manifest.description !== "string" || !manifest.description.trim() || manifest.description.length > 1024))
+    refuse5();
+  const manifestRecord = manifest;
+  if (!plainObject(hooks) || !exactKeys2(hooks, ["hooks"]) || !plainObject(hooks.hooks))
+    refuse5();
+  const hookTable = hooks.hooks;
+  const events = Object.entries(hookTable);
+  if (!events.length || events.length > 32)
+    refuse5();
+  for (const [event, groups] of events) {
+    if (!codexHookEvents.has(event) || !Array.isArray(groups) || !groups.length || groups.length > 32)
+      refuse5();
+    for (const group of groups) {
+      if (!plainObject(group) || !exactKeys2(group, ["hooks"]) || !Array.isArray(group.hooks) || !group.hooks.length || group.hooks.length > 32)
+        refuse5();
+      const handlers = group.hooks;
+      for (const handler of handlers) {
+        if (!plainObject(handler) || !exactKeys2(handler, ["type", "server", "tool", "input"], ["timeout"]) || handler.type !== "mcp_tool" || !identifier4(handler.server) || !identifier4(handler.tool) || !plainObject(handler.input) || handler.timeout !== undefined && (!Number.isSafeInteger(handler.timeout) || Number(handler.timeout) < 1 || Number(handler.timeout) > 300))
+          refuse5();
+        assertJsonValue(handler.input);
+      }
+    }
+  }
+  return { namespace: manifestRecord.name, manifestSha256, hooksSha256 };
+}
+function reviewedHookParentProjection(cacheRoot, parents2, read) {
+  if (!Array.isArray(parents2) || parents2.length > 4096)
+    refuse5();
+  const seen = new Set, rows = [];
+  for (const parent of parents2) {
+    const remote = parent?.installation === "remote-receipt", local = parent?.installation === "local-marketplace";
+    if (!parent || !exactKeys2(parent, ["installation", "namespace", "pluginId", "pluginParent", "role"], remote ? ["remotePluginId"] : local ? ["marketplaceSourcePath", "marketplaceSha256"] : []) || parent.role !== "reviewed-hook" || !identifier4(parent.namespace) || !/^[A-Za-z0-9_-]{1,64}@[A-Za-z0-9_-]{1,64}$/.test(parent.pluginId) || typeof parent.pluginParent !== "string" || remote && (typeof parent.remotePluginId !== "string" || !/^[A-Za-z0-9_~-]{1,1024}$/.test(parent.remotePluginId)) || local && (typeof parent.marketplaceSourcePath !== "string" || !isAbsolute8(parent.marketplaceSourcePath) || resolve8(parent.marketplaceSourcePath) !== parent.marketplaceSourcePath || basename5(parent.marketplaceSourcePath) !== "marketplace.json" || !digest2(parent.marketplaceSha256)) || !remote && !local)
+      refuse5();
+    const parts = relative6(cacheRoot, parent.pluginParent).split(sep5);
+    if (!isAbsolute8(parent.pluginParent) || resolve8(parent.pluginParent) !== parent.pluginParent || parts.length !== 2 || parts.some((part) => !identifier4(part)) || parts[1] !== parent.namespace || parent.pluginId !== `${parent.namespace}@${parts[0]}` || seen.has(parent.pluginParent))
+      refuse5();
+    seen.add(parent.pluginParent);
+    const parentStat = lstatSync10(parent.pluginParent, { throwIfNoEntry: false });
+    if (!parentStat?.isDirectory() || parentStat.isSymbolicLink() || realpathSync9(parent.pluginParent) !== parent.pluginParent)
+      refuse5();
+    const receiptPath = join15(parent.pluginParent, ".codex-remote-plugin-install.json"), receiptStat = lstatSync10(receiptPath, { throwIfNoEntry: false });
+    let receiptText;
+    if (remote) {
+      if (!receiptStat?.isFile() || receiptStat.isSymbolicLink() || receiptStat.size > MAX_RECEIPT_BYTES)
+        refuse5();
+      try {
+        receiptText = read(receiptPath);
+        hashNativeJsonControls(receiptText);
+        const receipt = JSON.parse(receiptText);
+        if (!plainObject(receipt) || !exactKeys2(receipt, ["schema_version", "remote_plugin_id"]) || receipt.schema_version !== 1 || receipt.remote_plugin_id !== parent.remotePluginId)
+          refuse5();
+      } catch {
+        refuse5();
+      }
+    } else {
+      const marketplaceSourcePath = parent.marketplaceSourcePath ?? refuse5();
+      if (receiptStat !== undefined || !parent.marketplaceSha256)
+        refuse5();
+      let marketplaceText;
+      try {
+        marketplaceText = read(marketplaceSourcePath);
+      } catch {
+        return refuse5();
+      }
+      if (createHash13("sha256").update(marketplaceText).digest("hex") !== parent.marketplaceSha256 || !codexLocalMarketplaceMapsPlugin(marketplaceText, parts[0], parent.namespace))
+        refuse5();
+    }
+    const materializations = readdirSync4(parent.pluginParent).filter((name) => name !== ".codex-remote-plugin-install.json").map((version2) => {
+      if (!/^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/.test(version2))
+        refuse5();
+      const root = join15(parent.pluginParent, version2), stat = lstatSync10(root, { throwIfNoEntry: false });
+      if (!stat?.isDirectory() || stat.isSymbolicLink() || realpathSync9(root) !== root)
+        refuse5();
+      const controls = reviewedHookControls(root, read);
+      if (controls.namespace !== parent.namespace)
+        refuse5();
+      return { manifestSha256: controls.manifestSha256, hooksSha256: controls.hooksSha256 };
+    });
+    if (!materializations.length || materializations.some((item) => canonical4(item) !== canonical4(materializations[0])))
+      refuse5();
+    rows.push({ ...parent, ...receiptText === undefined ? {} : { receiptSha256: createHash13("sha256").update(receiptText).digest("hex") }, ...materializations[0] });
+  }
+  return rows.sort((a, b) => a.pluginId.localeCompare(b.pluginId) || a.pluginParent.localeCompare(b.pluginParent));
+}
+function assertParents(cacheRoot, controls, appOnlyParents, hookParents, files, members) {
   const expected = new Set;
   const expectedMarkets = new Set;
-  for (const control of [...controls, ...appOnlyParents]) {
+  for (const control of [...controls, ...appOnlyParents, ...hookParents]) {
     const rel = relative6(cacheRoot, control.pluginParent), parts = rel.split(sep5);
     if (resolve8(control.pluginParent) !== control.pluginParent || parts.length !== 2 || parts.some((part) => !identifier4(part)) || control.pluginId !== `${control.namespace}@${parts[0]}` || parts[1] !== control.namespace)
       refuse5();
@@ -41015,7 +41185,9 @@ function assertParents(cacheRoot, controls, appOnlyParents, files, members) {
       refuse5();
     if ([".app.json", ".mcp.json"].includes(base) && (parts.length !== 4 || dirname9(member) !== root))
       refuse5();
-    if (parts.includes("hooks"))
+    if ([".app.json", ".mcp.json"].includes(base) && hookParents.some((reviewed) => reviewed.pluginParent === parent))
+      refuse5();
+    if (parts.includes("hooks") && (![4, 5].includes(parts.length) || parts[3] !== "hooks" || (parts.length === 4 ? base !== "hooks" : base !== "hooks.json") || !hookParents.some((reviewed) => reviewed.pluginParent === join15(cacheRoot, parts[0], parts[1]))))
       refuse5();
   }
 }
@@ -41125,13 +41297,14 @@ function captureCodexSemanticCacheWitness(options) {
     const initialTree = treeSnapshot(options.cacheRoot);
     const controls = controlProjection(options.controls, read);
     const appOnlyParents = appOnlyParentProjection(options.cacheRoot, options.appOnlyParents ?? [], read);
+    const hookParents = reviewedHookParentProjection(options.cacheRoot, options.reviewedHookParents ?? [], read);
     const skillParents = new Set(controls.map((control) => control.pluginParent));
-    if (appOnlyParents.some((parent) => skillParents.has(parent.pluginParent)))
+    if (appOnlyParents.some((parent) => skillParents.has(parent.pluginParent)) || hookParents.some((parent) => skillParents.has(parent.pluginParent) || appOnlyParents.some((app) => app.pluginParent === parent.pluginParent)))
       refuse5();
     if (!reviewedCodexPluginCapabilitiesUnchanged(options.cacheRoot, options.controls, read, options.rules))
       refuse5();
     const files = initialTree.files;
-    assertParents(options.cacheRoot, controls, appOnlyParents, files, initialTree.state.members);
+    assertParents(options.cacheRoot, controls, appOnlyParents, hookParents, files, initialTree.state.members);
     const expectedNamesByRoot = assertSkillMaterializations(options.cacheRoot, options.controls, files, read);
     const docs = files.filter((path) => path.endsWith(`${sep5}SKILL.md`));
     const skillRows = [];
@@ -41140,6 +41313,8 @@ function captureCodexSemanticCacheWitness(options) {
       const rel = relative6(options.cacheRoot, document).split(sep5);
       if (appOnlyParents.some((parent) => parent.pluginParent === join15(options.cacheRoot, rel[0], rel[1])))
         refuse5();
+      if (hookParents.some((parent) => parent.pluginParent === join15(options.cacheRoot, rel[0], rel[1])))
+        refuse5();
       const documentStat = lstatSync10(document, { throwIfNoEntry: false });
       if (!documentStat?.isFile() || documentStat.isSymbolicLink() || documentStat.size > MAX_DOCUMENT_BYTES)
         refuse5();
@@ -41203,7 +41378,7 @@ function captureCodexSemanticCacheWitness(options) {
     tracked.verify();
     const finalTree = treeSnapshot(options.cacheRoot);
     assertSameTree(initialTree.state, finalTree.state, tracked.paths());
-    const completeProjection = { schema: CODEX_SEMANTIC_CACHE_WITNESS_SCHEMA, cacheRoot: options.cacheRoot, controls, appOnlyParents, skills: uniqueSkills };
+    const completeProjection = { schema: CODEX_SEMANTIC_CACHE_WITNESS_SCHEMA, cacheRoot: options.cacheRoot, controls, appOnlyParents, hookParents, skills: uniqueSkills };
     return { ...completeProjection, sha256: hash2(completeProjection) };
   } catch (error) {
     if (error instanceof Error && error.message.startsWith("CODEX_SEMANTIC_CACHE_WITNESS_UNSUPPORTED"))
@@ -41219,6 +41394,7 @@ function assertCodexSemanticCacheWitnessUnchanged(previous, current) {
     cacheRoot: previous.cacheRoot,
     controls: previous.controls,
     appOnlyParents: previous.appOnlyParents,
+    ...previous.hookParents === undefined ? {} : { hookParents: previous.hookParents },
     skills: previous.skills
   };
   const currentProjection = {
@@ -41226,9 +41402,11 @@ function assertCodexSemanticCacheWitnessUnchanged(previous, current) {
     cacheRoot: current.cacheRoot,
     controls: current.controls,
     appOnlyParents: current.appOnlyParents,
+    ...current.hookParents === undefined ? {} : { hookParents: current.hookParents },
     skills: current.skills
   };
-  if (hash2(priorProjection) !== previous.sha256 || hash2(currentProjection) !== current.sha256 || canonical4(priorProjection) !== canonical4(currentProjection))
+  const comparable = (projection) => ({ ...projection, hookParents: projection.hookParents ?? [] });
+  if (hash2(priorProjection) !== previous.sha256 || hash2(currentProjection) !== current.sha256 || canonical4(comparable(priorProjection)) !== canonical4(comparable(currentProjection)))
     refuse5();
 }
 
@@ -41257,7 +41435,7 @@ var NATIVE_SKILL_ROOTS = [
 import { createHash as createHash28, randomUUID as randomUUID4 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual8 } from "util";
 import { existsSync as existsSync7, lstatSync as lstatSync26, statSync as statSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync18, readdirSync as readdirSync9, opendirSync as opendirSync5, readlinkSync as readlinkSync7, realpathSync as realpathSync13, renameSync as renameSync4, rmdirSync as rmdirSync3, writeFileSync as writeFileSync5, unlinkSync as unlinkSync5, chmodSync, openSync as openSync21, closeSync as closeSync21, fsyncSync as fsyncSync7, fstatSync as fstatSync21, readSync as readSync14, constants as constants19, linkSync as linkSync3 } from "fs";
-import { dirname as dirname21, join as join30, resolve as resolve23, relative as relative8, isAbsolute as isAbsolute25, sep as sep10 } from "path";
+import { basename as basename11, dirname as dirname21, join as join30, resolve as resolve23, relative as relative8, isAbsolute as isAbsolute25, sep as sep10 } from "path";
 import { homedir as homedir3 } from "os";
 
 // src/lib/managed-policy.ts
@@ -41265,11 +41443,11 @@ import { closeSync as closeSync13, constants as constants10, fstatSync as fstatS
 import { join as join17 } from "path";
 
 // src/lib/agent-policy-limits.ts
-import { basename as basename6, isAbsolute as isAbsolute10, join as join16, resolve as resolve10, sep as sep6 } from "path";
+import { basename as basename7, isAbsolute as isAbsolute10, join as join16, resolve as resolve10, sep as sep6 } from "path";
 
 // src/lib/claude-marketplace-entry-witness.ts
 import { createHash as createHash14 } from "crypto";
-import { basename as basename5, dirname as dirname10, isAbsolute as isAbsolute9, resolve as resolve9 } from "path";
+import { basename as basename6, dirname as dirname10, isAbsolute as isAbsolute9, resolve as resolve9 } from "path";
 var CLAUDE_MARKETPLACE_ENTRY_HASH_MODE = "claude-marketplace-entry-v1";
 var DOMAIN = "hasna.skills.claude-marketplace-entry.v1\x00";
 var PATH_CHARACTERS = 4096;
@@ -41334,7 +41512,7 @@ var stringArray = (value) => value?.kind === "array" && value.items.every(isStri
 var stringObject = (value) => value?.kind === "object" && value.entries.every(([, item]) => isString(item));
 function claudeMarketplaceEntrySourceValid(source) {
   const path = source?.path;
-  return typeof path === "string" && path.length > 0 && path.length <= PATH_CHARACTERS && !/[\x00-\x1f\x7f]/.test(path) && isAbsolute9(path) && resolve9(path) === path && basename5(path) === "marketplace.json" && basename5(dirname10(path)) === ".claude-plugin" && typeof source.marketplace === "string" && NAME.test(source.marketplace) && !source.marketplace.includes("..") && typeof source.plugin === "string" && NAME.test(source.plugin);
+  return typeof path === "string" && path.length > 0 && path.length <= PATH_CHARACTERS && !/[\x00-\x1f\x7f]/.test(path) && isAbsolute9(path) && resolve9(path) === path && basename6(path) === "marketplace.json" && basename6(dirname10(path)) === ".claude-plugin" && typeof source.marketplace === "string" && NAME.test(source.marketplace) && !source.marketplace.includes("..") && typeof source.plugin === "string" && NAME.test(source.plugin);
 }
 function canonical5(value) {
   if (value.kind === "string")
@@ -41604,10 +41782,10 @@ function assertAgentPolicyCollections(policy) {
         }
     }
     if (value.codexSemanticCache !== undefined) {
-      const proof = record3(value.codexSemanticCache, 8), witness = record3(proof.witness, 6);
-      requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && Object.keys(proof).length === 8 && proof.schema === "hasna.codex-semantic-cache-discovery.v1" && typeof proof.previousPolicySha256 === "string" && /^[a-f0-9]{64}$/.test(proof.previousPolicySha256) && Object.keys(witness).length === 6 && witness.schema === "hasna.codex-semantic-cache-witness.v1" && typeof witness.sha256 === "string" && /^[a-f0-9]{64}$/.test(witness.sha256));
+      const proof = record3(value.codexSemanticCache, 9), witness = record3(proof.witness, 7);
+      requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && [8, 9].includes(Object.keys(proof).length) && Object.keys(proof).every((key) => ["schema", "configPath", "hookRootAlias", "witness", "appOnlyParents", "previousPolicySha256", "supersededSources", "supersededDirectories", "reviewedHookParents"].includes(key)) && proof.schema === "hasna.codex-semantic-cache-discovery.v1" && typeof proof.previousPolicySha256 === "string" && /^[a-f0-9]{64}$/.test(proof.previousPolicySha256) && [6, 7].includes(Object.keys(witness).length) && Object.keys(witness).every((key) => ["schema", "cacheRoot", "controls", "appOnlyParents", "skills", "sha256", "hookParents"].includes(key)) && witness.schema === "hasna.codex-semantic-cache-witness.v1" && typeof witness.sha256 === "string" && /^[a-f0-9]{64}$/.test(witness.sha256));
       text(proof.configPath);
-      requireBound(isAbsolute10(proof.configPath) && resolve10(proof.configPath) === proof.configPath && basename6(proof.configPath) === "config.toml");
+      requireBound(isAbsolute10(proof.configPath) && resolve10(proof.configPath) === proof.configPath && basename7(proof.configPath) === "config.toml");
       text(witness.cacheRoot);
       requireBound(isAbsolute10(witness.cacheRoot) && resolve10(witness.cacheRoot) === witness.cacheRoot);
       if (proof.hookRootAlias !== null) {
@@ -41624,6 +41802,20 @@ function assertAgentPolicyCollections(policy) {
           text(parent[key]);
         requireBound(isAbsolute10(parent.pluginParent) && resolve10(parent.pluginParent) === parent.pluginParent);
       }
+      if (proof.reviewedHookParents !== undefined)
+        for (const parent of array(proof.reviewedHookParents, 4096)) {
+          requireBound(object4(parent) && parent.role === "reviewed-hook" && (parent.installation === "remote-receipt" && Object.keys(parent).length === 6 || parent.installation === "local-marketplace" && Object.keys(parent).length === 7));
+          requireBound(parent.installation === "remote-receipt" ? Object.keys(parent).sort().join(",") === "installation,namespace,pluginId,pluginParent,remotePluginId,role" : Object.keys(parent).sort().join(",") === "installation,marketplaceSha256,marketplaceSourcePath,namespace,pluginId,pluginParent,role");
+          for (const key of ["pluginId", "namespace", "pluginParent", "installation"])
+            text(parent[key]);
+          if (parent.installation === "remote-receipt")
+            text(parent.remotePluginId);
+          else {
+            text(parent.marketplaceSourcePath);
+            requireBound(typeof parent.marketplaceSha256 === "string" && /^[a-f0-9]{64}$/.test(parent.marketplaceSha256) && isAbsolute10(parent.marketplaceSourcePath) && resolve10(parent.marketplaceSourcePath) === parent.marketplaceSourcePath && basename7(parent.marketplaceSourcePath) === "marketplace.json");
+          }
+          requireBound(isAbsolute10(parent.pluginParent) && resolve10(parent.pluginParent) === parent.pluginParent);
+        }
       for (const row of [...array(witness.controls, 4096), ...array(witness.appOnlyParents, 4096)]) {
         requireBound(object4(row));
         for (const key of ["pluginId", "namespace", "pluginParent"])
@@ -41632,6 +41824,26 @@ function assertAgentPolicyCollections(policy) {
           if (row[key] !== undefined)
             requireBound(typeof row[key] === "string" && /^[a-f0-9]{64}$/.test(row[key]));
       }
+      if (witness.hookParents !== undefined)
+        for (const row of array(witness.hookParents, 4096)) {
+          requireBound(object4(row) && row.role === "reviewed-hook" && (row.installation === "remote-receipt" && Object.keys(row).length === 9 || row.installation === "local-marketplace" && Object.keys(row).length === 9));
+          requireBound(row.installation === "remote-receipt" ? Object.keys(row).sort().join(",") === "hooksSha256,installation,manifestSha256,namespace,pluginId,pluginParent,receiptSha256,remotePluginId,role" : Object.keys(row).sort().join(",") === "hooksSha256,installation,manifestSha256,marketplaceSha256,marketplaceSourcePath,namespace,pluginId,pluginParent,role");
+          for (const key of ["pluginId", "namespace", "pluginParent", "installation"])
+            text(row[key]);
+          if (row.installation === "remote-receipt")
+            text(row.remotePluginId);
+          else {
+            text(row.marketplaceSourcePath);
+            requireBound(typeof row.marketplaceSha256 === "string" && /^[a-f0-9]{64}$/.test(row.marketplaceSha256) && isAbsolute10(row.marketplaceSourcePath) && resolve10(row.marketplaceSourcePath) === row.marketplaceSourcePath && basename7(row.marketplaceSourcePath) === "marketplace.json");
+          }
+          requireBound(isAbsolute10(row.pluginParent) && resolve10(row.pluginParent) === row.pluginParent);
+          for (const key of ["manifestSha256", "hooksSha256"])
+            requireBound(typeof row[key] === "string" && /^[a-f0-9]{64}$/.test(row[key]));
+          if (row.installation === "remote-receipt")
+            requireBound(typeof row.receiptSha256 === "string" && /^[a-f0-9]{64}$/.test(row.receiptSha256));
+          else
+            requireBound(row.receiptSha256 === undefined);
+        }
       for (const skill of array(witness.skills, 4096)) {
         requireBound(object4(skill));
         for (const key of ["name", "pluginId", "namespace", "pluginParent"])
@@ -41661,13 +41873,13 @@ function assertAgentPolicyCollections(policy) {
       if (source.hashMode === "claude-plugin-manifest-v1")
         requireBound(agent === "claude" && value.agent === "claude" && ["automatic", "reviewed"].includes(value.method) && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute10(source.path) && resolve10(source.path) === source.path && source.path.endsWith(join16(sep6, ".claude-plugin", "plugin.json")) && source.managedPlugins === undefined);
       if (source.hashMode === "sumi-settings-v1")
-        requireBound(agent === "sumi" && value.agent === "sumi" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute10(source.path) && resolve10(source.path) === source.path && basename6(source.path) === "sumi.json");
+        requireBound(agent === "sumi" && value.agent === "sumi" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute10(source.path) && resolve10(source.path) === source.path && basename7(source.path) === "sumi.json");
       if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4" || source.hashMode === "codex-settings-v5"))
-        requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute10(source.path) && resolve10(source.path) === source.path && basename6(source.path) === "config.toml");
+        requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute10(source.path) && resolve10(source.path) === source.path && basename7(source.path) === "config.toml");
       if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || source.hashMode === "claude-settings-v4"))
-        requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute10(source.path) && resolve10(source.path) === source.path && basename6(source.path) === "settings.json");
+        requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute10(source.path) && resolve10(source.path) === source.path && basename7(source.path) === "settings.json");
       if (source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2")
-        requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute10(source.path) && resolve10(source.path) === source.path && basename6(source.path) === "known_marketplaces.json");
+        requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute10(source.path) && resolve10(source.path) === source.path && basename7(source.path) === "known_marketplaces.json");
       if (source.hashMode === "claude-marketplace-entry-v1")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && claudeMarketplaceEntrySourceValid(source));
       if (source.hashMode === "claude-plugin-registry") {
@@ -41832,7 +42044,7 @@ function isOwnedCliBridge(path, expectedPaths) {
 // src/lib/agent-discovery.ts
 import { createHash as createHash26 } from "crypto";
 import { lstatSync as lstatSync24, readFileSync as readFileSync16, readdirSync as readdirSync8, realpathSync as realpathSync11 } from "fs";
-import { basename as basename9, dirname as dirname20, isAbsolute as isAbsolute23, join as join29, relative as relative7, resolve as resolve22, sep as sep9 } from "path";
+import { basename as basename10, dirname as dirname20, isAbsolute as isAbsolute23, join as join29, relative as relative7, resolve as resolve22, sep as sep9 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual6 } from "util";
 
 // node_modules/yaml/dist/index.js
@@ -42523,7 +42735,7 @@ function projectReviewedClaudePluginManifest(text2, reviewedSha256) {
 
 // src/lib/plugin-discovery.ts
 import { closeSync as closeSync16, constants as constants13, fstatSync as fstatSync16, lstatSync as lstatSync19, openSync as openSync16, opendirSync as opendirSync4, readSync as readSync10 } from "fs";
-import { basename as basename7, dirname as dirname16, isAbsolute as isAbsolute18, join as join26, resolve as resolve17 } from "path";
+import { basename as basename8, dirname as dirname16, isAbsolute as isAbsolute18, join as join26, resolve as resolve17 } from "path";
 
 // src/lib/plugin-admission.ts
 import { homedir as homedir2 } from "os";
@@ -44004,7 +44216,7 @@ function hashManagedPluginRegistry(path, managed) {
       pluginNeed(/^(?:[A-Za-z0-9][A-Za-z0-9._+-]*-)?[a-f0-9]{12}$/.test(row.version) && row.installPath === join26(cacheRoot, row.version), "Managed plugin cache path or version is outside its registration");
       const approval = (producer) => {
         pluginText(producer);
-        const digest3 = `sha256:${basename7(producer)}`;
+        const digest3 = `sha256:${basename8(producer)}`;
         const receipt2 = readPluginAdmissionReceipt(witness.storeRoot, witness.bindingId, digest3);
         pluginNeed(receipt2.materializedPath === producer, "Managed producer path is not an approved immutable projection");
         if (!verified.has(producer)) {
@@ -44068,7 +44280,7 @@ function captureManagedPluginRegistry(path, managedPlugins) {
 // src/lib/claude-marketplace-registry.ts
 import { createHash as createHash22 } from "crypto";
 import { closeSync as closeSync17, constants as constants14, fstatSync as fstatSync17, lstatSync as lstatSync20, openSync as openSync17, readSync as readSync11 } from "fs";
-import { basename as basename8, dirname as dirname17, isAbsolute as isAbsolute19, resolve as resolve18 } from "path";
+import { basename as basename9, dirname as dirname17, isAbsolute as isAbsolute19, resolve as resolve18 } from "path";
 var CLAUDE_MARKETPLACE_REGISTRY_LIMITS = Object.freeze({ bytes: 1024 * 1024, rows: 1024, depth: 32, nodes: 65536, stringCharacters: 16384, pathCharacters: 4096 });
 function need6(value, reason2) {
   if (!value)
@@ -44090,7 +44302,7 @@ function parents2(path) {
 }
 function readRegistry2(path, budget2) {
   absolutePath3(path);
-  need6(basename8(path) === "known_marketplaces.json", "requires known_marketplaces.json");
+  need6(basename9(path) === "known_marketplaces.json", "requires known_marketplaces.json");
   need6(Number.isSafeInteger(budget2.remaining) && budget2.remaining >= 0, "has an invalid byte budget");
   const ancestors2 = parents2(path), initial = lstatSync20(path, { bigint: true });
   need6(initial.isFile() && !initial.isSymbolicLink() && initial.size <= BigInt(CLAUDE_MARKETPLACE_REGISTRY_LIMITS.bytes), "is not a bounded regular file");
@@ -44914,7 +45126,7 @@ function assertReviewedClaudeCacheClosures(home, config, review, canonical9) {
         throw new Error("Reviewed Claude enabled plugin registration requires an object with an installPath string");
       }
       if ([cacheAliasRoot, cacheRoot].some((root2) => row.installPath === root2 || row.installPath.startsWith(root2 + sep9))) {
-        if (!cachePath(row.installPath) || row.installPath.length > AGENT_POLICY_LIMITS.pathCharacters || row.version !== undefined && (typeof row.version !== "string" || basename9(row.installPath) !== row.version)) {
+        if (!cachePath(row.installPath) || row.installPath.length > AGENT_POLICY_LIMITS.pathCharacters || row.version !== undefined && (typeof row.version !== "string" || basename10(row.installPath) !== row.version)) {
           throw new Error("Reviewed Claude discovery has a malformed active cache registration");
         }
         if (row.scope === "user" && (row.projectPath === undefined || row.projectPath === null)) {} else if (row.scope === "project" && typeof row.projectPath === "string" && isAbsolute23(row.projectPath) && resolve22(row.projectPath) === row.projectPath && row.projectPath.length <= AGENT_POLICY_LIMITS.pathCharacters) {} else
@@ -45192,7 +45404,7 @@ function absentRetiredClaudeRoots(binding) {
     if (!targetValid || !targetScopes.has("user\x00"))
       continue;
     const active = rows[0]?.installPath;
-    if (typeof active !== "string" || rows[0]?.version !== basename9(active) || dirname20(active) !== dirname20(root2) || active === root2 || !lstatSync24(active, { throwIfNoEntry: false })?.isDirectory() || realpathSync11(active) !== active)
+    if (typeof active !== "string" || rows[0]?.version !== basename10(active) || dirname20(active) !== dirname20(root2) || active === root2 || !lstatSync24(active, { throwIfNoEntry: false })?.isDirectory() || realpathSync11(active) !== active)
       continue;
     const activeManifest = full(join29(active, ".claude-plugin/plugin.json"));
     if (!activeManifest || projected(activeManifest) !== activeManifest.sha256)
@@ -45201,14 +45413,15 @@ function absentRetiredClaudeRoots(binding) {
   }
   return [...result];
 }
-function codexSemanticCacheSourceRole(source, cacheRoot, parents3) {
+function codexSemanticCacheSourceRole(source, cacheRoot, parents3, hookParents = []) {
   if (!isAbsolute23(source.path) || resolve22(source.path) !== source.path || /[\x00-\x1f\x7f]/.test(source.path) || source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || source.reviewArtifact !== undefined || source.hashMode !== undefined && source.hashMode !== "bytes")
     return false;
   const parts = relative7(cacheRoot, source.path).split(sep9);
   if (parts.length < 3 || !parents3.includes(join29(cacheRoot, parts[0], parts[1])))
     return false;
   const tail = parts.slice(3).join("/");
-  return parts.length === 5 && tail === ".codex-plugin/plugin.json" && source.sha256 !== null || parts.length === 4 && [".app.json", ".mcp.json"].includes(tail) && source.sha256 !== null || source.sha256 === null && (parts.length === 4 && tail === "SKILL.md" || parts.length === 5 && tail === "hooks/hooks.json");
+  const parent = join29(cacheRoot, parts[0], parts[1]);
+  return parts.length === 5 && tail === ".codex-plugin/plugin.json" && source.sha256 !== null || parts.length === 4 && [".app.json", ".mcp.json"].includes(tail) && source.sha256 !== null || parts.length === 5 && tail === "hooks/hooks.json" && hookParents.includes(parent) && source.sha256 !== null || source.sha256 === null && (parts.length === 4 && tail === "SKILL.md" || parts.length === 5 && tail === "hooks/hooks.json");
 }
 function codexSemanticCacheDirectoryRole(path, cacheRoot) {
   return isAbsolute23(path) && resolve22(path) === path && !/[\x00-\x1f\x7f]/.test(path) && (path === cacheRoot || path.startsWith(cacheRoot + sep9));
@@ -45240,20 +45453,28 @@ function verifyCodexSemanticCacheDiscovery(binding, reviewedRootAliases) {
   const cacheRoot = proof.witness.cacheRoot;
   if (controls.some((control) => dirname20(dirname20(control.pluginParent)) !== cacheRoot))
     throw new Error("Codex semantic cache names another enrolled cache");
-  const parents3 = [...new Set([...controls.map((control) => control.pluginParent), ...proof.appOnlyParents.map((parent) => parent.pluginParent)])];
-  const sources = binding.sources.filter((source) => codexSemanticCacheSourceRole(source, cacheRoot, parents3));
+  const reviewedHookParents = proof.reviewedHookParents ?? [];
+  if (!Array.isArray(reviewedHookParents) || reviewedHookParents.length > 4096 || reviewedHookParents.some((parent) => !parent || !(parent.installation === "remote-receipt" && Object.keys(parent).sort().join(",") === "installation,namespace,pluginId,pluginParent,remotePluginId,role" && typeof parent.remotePluginId === "string" || parent.installation === "local-marketplace" && Object.keys(parent).sort().join(",") === "installation,marketplaceSha256,marketplaceSourcePath,namespace,pluginId,pluginParent,role" && typeof parent.marketplaceSourcePath === "string" && /^[a-f0-9]{64}$/.test(parent.marketplaceSha256 ?? "")) || parent.role !== "reviewed-hook" || typeof parent.pluginId !== "string" || typeof parent.namespace !== "string" || typeof parent.pluginParent !== "string") || new Set(reviewedHookParents.map((parent) => parent.pluginParent)).size !== reviewedHookParents.length || !isDeepStrictEqual6((proof.witness.hookParents ?? []).map(({ manifestSha256: _manifest, hooksSha256: _hooks, receiptSha256: _receipt, ...parent }) => parent), reviewedHookParents)) {
+    throw new Error("Invalid reviewed native-hook cache role");
+  }
+  for (const parent of reviewedHookParents)
+    if (parent.installation === "local-marketplace" && !binding.sources.some((source) => source.path === parent.marketplaceSourcePath && source.sha256 === parent.marketplaceSha256 && source.sha256 !== null && source.format === undefined && source.fields === undefined && source.reviewArtifact === undefined && (source.hashMode === undefined || source.hashMode === "bytes")))
+      throw new Error("Local marketplace hook parent lost its enrolled source witness");
+  const parents3 = [...new Set([...controls.map((control) => control.pluginParent), ...proof.appOnlyParents.map((parent) => parent.pluginParent), ...reviewedHookParents.map((parent) => parent.pluginParent)])];
+  const hookParentPaths = reviewedHookParents.map((parent) => parent.pluginParent);
+  const sources = binding.sources.filter((source) => codexSemanticCacheSourceRole(source, cacheRoot, parents3, hookParentPaths));
   const directories = (binding.directories ?? []).filter((directory) => codexSemanticCacheDirectoryRole(directory.path, cacheRoot));
   if (!directories.length || !isDeepStrictEqual6(sources, proof.supersededSources) || !isDeepStrictEqual6(directories, proof.supersededDirectories))
     throw new Error("Codex semantic cache provenance changed");
   const configPath = proof.configPath;
-  if (!isAbsolute23(configPath) || resolve22(configPath) !== configPath || basename9(configPath) !== "config.toml" || /[\x00-\x1f\x7f]/.test(configPath))
+  if (!isAbsolute23(configPath) || resolve22(configPath) !== configPath || basename10(configPath) !== "config.toml" || /[\x00-\x1f\x7f]/.test(configPath))
     throw new Error("Invalid semantic cache configuration source");
   const configSource = binding.sources.find((source) => source.path === configPath && source.sha256 !== null && source.format === undefined && source.fields === undefined);
   if (!configSource || projected(configSource) !== configSource.sha256)
     throw new Error("Codex semantic cache requires unchanged reviewed configuration");
   assertCodexSemanticCacheHookSafety(cacheRoot, parents3, configPath, proof.hookRootAlias);
   const rules = parseConfig(read2(configPath), configPath, true).skills?.config ?? [];
-  const current = captureCodexSemanticCacheWitness({ cacheRoot, controls, appOnlyParents: proof.appOnlyParents, rules });
+  const current = captureCodexSemanticCacheWitness({ cacheRoot, controls, appOnlyParents: proof.appOnlyParents, reviewedHookParents, rules });
   assertCodexSemanticCacheWitnessUnchanged(proof.witness, current);
   return proof;
 }
@@ -45337,7 +45558,7 @@ function codexInstallationRoots(binding) {
   const config = join29(dirname20(dirname20(cache)), "config.toml"), home = dirname20(dirname20(dirname20(cache)));
   const configSource = binding.sources.find((source) => source.path === config && source.sha256 !== null && (!source.format || source.format === "toml" && source.fields?.includes("plugins")));
   const nativeRoots = NATIVE_SKILL_ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => join29(home, path));
-  if (!configSource || proof.plugins.some((input) => nativeRoots.some((root2) => root2 === input.sourceRoot || root2.startsWith(input.sourceRoot + sep9) || input.sourceRoot.startsWith(root2 + sep9)) || binding.sources.some((source) => basename9(source.path) === "config.toml" && (source.path === input.sourceRoot || source.path.startsWith(input.sourceRoot + sep9)))))
+  if (!configSource || proof.plugins.some((input) => nativeRoots.some((root2) => root2 === input.sourceRoot || root2.startsWith(input.sourceRoot + sep9) || input.sourceRoot.startsWith(root2 + sep9)) || binding.sources.some((source) => basename10(source.path) === "config.toml" && (source.path === input.sourceRoot || source.path.startsWith(input.sourceRoot + sep9)))))
     throw new Error("Native installation input overlaps configuration or loading roots");
   if (proof.plugins.some((input) => dirname20(dirname20(input.pluginParent)) !== cache || !binding.sources.some((source) => source.path === join29(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined)))
     throw new Error("Missing native installation input source witness");
@@ -45349,13 +45570,13 @@ function codexInstallationRoots(binding) {
   });
 }
 function assertMarketplaceBinding(binding, source) {
-  if (source.hashMode === "claude-plugin-manifest-v1" && (binding.agent !== "claude" || basename9(source.path) !== "plugin.json" || !source.path.endsWith(join29(sep9, ".claude-plugin", "plugin.json"))))
+  if (source.hashMode === "claude-plugin-manifest-v1" && (binding.agent !== "claude" || basename10(source.path) !== "plugin.json" || !source.path.endsWith(join29(sep9, ".claude-plugin", "plugin.json"))))
     throw new Error("Claude plugin manifest witnesses require Claude plugin discovery");
-  if (source.hashMode === "sumi-settings-v1" && (binding.agent !== "sumi" || binding.method !== "reviewed" || basename9(source.path) !== "sumi.json"))
+  if (source.hashMode === "sumi-settings-v1" && (binding.agent !== "sumi" || binding.method !== "reviewed" || basename10(source.path) !== "sumi.json"))
     throw new Error("Sumi settings witnesses require explicit reviewed Sumi configuration");
-  if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4" || source.hashMode === "codex-settings-v5")) && (binding.agent !== "codex" || binding.method !== "reviewed" || basename9(source.path) !== "config.toml"))
+  if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4" || source.hashMode === "codex-settings-v5")) && (binding.agent !== "codex" || binding.method !== "reviewed" || basename10(source.path) !== "config.toml"))
     throw new Error("Codex settings witnesses require explicit reviewed Codex configuration");
-  if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || source.hashMode === "claude-settings-v4")) && (binding.agent !== "claude" || binding.method !== "reviewed" || basename9(source.path) !== "settings.json"))
+  if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || source.hashMode === "claude-settings-v4")) && (binding.agent !== "claude" || binding.method !== "reviewed" || basename10(source.path) !== "settings.json"))
     throw new Error("Claude settings witnesses require explicit reviewed Claude configuration");
   if ((source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2") && (binding.agent !== "claude" || binding.method !== "reviewed"))
     throw new Error("Claude marketplace witnesses require explicit reviewed Claude discovery");
@@ -45473,7 +45694,7 @@ function verifyAutomaticDiscoveryClosure(binding, options) {
   const current = resolveAgentDiscovery({ home: options.home, agent: binding.agent, canonical: options.canonical, executable: runtime });
   if (JSON.stringify(current) === JSON.stringify(binding))
     return;
-  const reviewedWithRuntime = (binding.builtinNames?.length ?? 0) > 0 || binding.sources.some((source) => basename9(source.path) === "package.json");
+  const reviewedWithRuntime = (binding.builtinNames?.length ?? 0) > 0 || binding.sources.some((source) => basename10(source.path) === "package.json");
   const otherwiseCurrent = current.method === binding.method && JSON.stringify(current.roots) === JSON.stringify(binding.roots) && JSON.stringify(current.directories) === JSON.stringify(binding.directories) && current.sources.every((source) => binding.sources.some((saved) => isDeepStrictEqual6(saved, source)));
   if (command && gap && runtime === null && reviewedWithRuntime && otherwiseCurrent)
     throw discoveryRootUnresolved(binding.agent, command, gap);
@@ -45616,7 +45837,7 @@ function resolveAgentDiscovery(options) {
       throw new Error("Discovery review must include the agent configuration source");
     const reviewedSources = supersedesSettingsProjection(agent, review.sources, canonical9(configPath)) ? sources.filter((source) => !isSupersededSettingsProjection(agent, canonical9(configPath), source)) : sources;
     const reviewedSourcesWithManifestProjection = review.sources.map((source) => {
-      if (agent !== "claude" || source.sha256 === null || source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || source.hashMode !== undefined && source.hashMode !== "bytes" || basename9(source.path) !== "plugin.json" || !source.path.endsWith(join29(sep9, ".claude-plugin", "plugin.json")))
+      if (agent !== "claude" || source.sha256 === null || source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || source.hashMode !== undefined && source.hashMode !== "bytes" || basename10(source.path) !== "plugin.json" || !source.path.endsWith(join29(sep9, ".claude-plugin", "plugin.json")))
         return source;
       const pluginRoot = dirname20(dirname20(source.path)), hooksPath = join29(pluginRoot, "hooks/hooks.json");
       const hookStat = lstatSync24(hooksPath, { throwIfNoEntry: false });
@@ -47524,7 +47745,7 @@ function planAgentSettingsWitnessUpgrade(options) {
   return { dataDir: dataDir2, profileId: policy.profileId, changes: [{ path: join30(dataDir2, "agent-policy.json"), before: snapshot2.text, after }], nativeSkills: [], observedPolicy: { path: join30(dataDir2, "agent-policy.json"), before: snapshot2.text }, observedSettings: { path: configPath, before: settings }, discoveryBefore: [replacement], discoveryAfter: [replacement], ...policy.bridge.discoveryExecutables ? { discoveryExecutables: policy.bridge.discoveryExecutables } : {}, rootAliases: aliases, managedAgentChecks: { home, agents: [options.agent] }, settingsWitnessUpgrade: { agent: options.agent, path: configPath, fromHashMode: previous.hashMode ?? "bytes", fromSha256: previous.sha256, toHashMode: next.hashMode, toSha256: next.sha256, reviewedPreimage: options.reviewedPreimage, currentSettingsSha256: options.expectedSettingsSha256, replacedWitnesses: replaced.map((source) => ({ hashMode: source.hashMode ?? "bytes", sha256: source.sha256 })) } };
 }
 function planCodexSemanticCacheWitnessUpgrade(options) {
-  if (options.agent !== "codex" || !/^[a-f0-9]{64}$/.test(options.expectedPolicySha256) || !/^[a-f0-9]{64}$/.test(options.expectedSettingsSha256) || options.expectedCacheWitnessSha256 !== undefined && !/^[a-f0-9]{64}$/.test(options.expectedCacheWitnessSha256) || !Array.isArray(options.appOnlyParents) || options.appOnlyParents.length > 4096 || new Set(options.appOnlyParents).size !== options.appOnlyParents.length)
+  if (options.agent !== "codex" || !/^[a-f0-9]{64}$/.test(options.expectedPolicySha256) || !/^[a-f0-9]{64}$/.test(options.expectedSettingsSha256) || options.expectedCacheWitnessSha256 !== undefined && !/^[a-f0-9]{64}$/.test(options.expectedCacheWitnessSha256) || !Array.isArray(options.appOnlyParents) || options.appOnlyParents.length > 4096 || new Set(options.appOnlyParents).size !== options.appOnlyParents.length || options.reviewedHookParents !== undefined && (!Array.isArray(options.reviewedHookParents) || options.reviewedHookParents.length > 4096 || new Set(options.reviewedHookParents).size !== options.reviewedHookParents.length))
     throw new Error("Invalid Codex semantic cache upgrade request");
   const home = resolve23(options.home ?? homedir3()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
   const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
@@ -47548,14 +47769,23 @@ function planCodexSemanticCacheWitnessUpgrade(options) {
     throw new Error("Native settings preimage changed");
   const boundedRead = (path) => new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(readNativeBytes(path, 1024 * 1024));
   const unchangedFullSource = (path) => {
-    const source = binding.sources.find((source2) => source2.path === path && source2.sha256 !== null && source2.format === undefined && source2.fields === undefined && source2.reviewArtifact === undefined && (source2.hashMode === undefined || source2.hashMode === "bytes"));
-    if (!source)
-      throw new Error("Cache upgrade lacks prior full identity source");
+    const sources = binding.sources.filter((source2) => source2.path === path && source2.sha256 !== null && source2.format === undefined && source2.fields === undefined && source2.reviewArtifact === undefined && (source2.hashMode === undefined || source2.hashMode === "bytes"));
+    if (sources.length !== 1)
+      throw new Error("Cache upgrade requires one unambiguous prior full identity source");
+    const source = sources[0];
     const text2 = boundedRead(path);
     if (sha5(text2) !== source.sha256)
       throw new Error("Reviewed cache identity source changed");
     return text2;
   };
+  const unchangedReviewedHookSource = (path) => {
+    const sources = binding.sources.filter((source) => source.path === path);
+    if (!sources.length)
+      throw new Error("Cache upgrade lacks prior full identity source");
+    if (sources.length !== 1)
+      throw new Error("Reviewed hook identity source is ambiguous");
+    return unchangedFullSource(path);
+  };
   const appOnlyParents = options.appOnlyParents.map((parent) => {
     const parts = relative8(cacheRoot, parent).split(sep10);
     if (!isAbsolute25(parent) || resolve23(parent) !== parent || parts.length !== 2 || parts.some((part) => !/^[A-Za-z0-9_-]{1,64}$/.test(part)) || controls.some((control) => control.pluginParent === parent))
@@ -47570,11 +47800,60 @@ function planCodexSemanticCacheWitnessUpgrade(options) {
       unchangedFullSource(source.path);
     return { role: "app-only", pluginId: `${parts[1]}@${parts[0]}`, namespace: parts[1], pluginParent: parent, remotePluginId: receipt.remote_plugin_id };
   }).sort((a, b) => a.pluginParent.localeCompare(b.pluginParent));
-  const parents3 = [...new Set([...controls.map((control) => control.pluginParent), ...appOnlyParents.map((parent) => parent.pluginParent)])];
+  const reviewedHookParents = (options.reviewedHookParents ?? []).map((parent) => {
+    const parts = relative8(cacheRoot, parent).split(sep10);
+    if (!isAbsolute25(parent) || resolve23(parent) !== parent || parts.length !== 2 || parts.some((part) => !/^[A-Za-z0-9_-]{1,64}$/.test(part)) || controls.some((control) => control.pluginParent === parent) || appOnlyParents.some((role) => role.pluginParent === parent))
+      throw new Error("Unsupported reviewed native-hook parent role");
+    const receiptPath = join30(parent, ".codex-remote-plugin-install.json"), receiptStat = lstatSync26(receiptPath, { throwIfNoEntry: false });
+    let identity5;
+    if (receiptStat) {
+      if (!receiptStat.isFile() || receiptStat.isSymbolicLink() || receiptStat.size > 16 * 1024)
+        throw new Error("Invalid reviewed native-hook install receipt");
+      const receiptText = unchangedReviewedHookSource(receiptPath);
+      let receipt;
+      try {
+        hashNativeJsonControls(receiptText);
+        receipt = JSON.parse(receiptText);
+      } catch {
+        throw new Error("Invalid reviewed native-hook install receipt");
+      }
+      if (!receipt || Array.isArray(receipt) || Object.keys(receipt).length !== 2 || receipt.schema_version !== 1 || typeof receipt.remote_plugin_id !== "string" || !/^[A-Za-z0-9_~-]{1,1024}$/.test(receipt.remote_plugin_id))
+        throw new Error("Invalid reviewed native-hook install receipt");
+      identity5 = { role: "reviewed-hook", pluginId: `${parts[1]}@${parts[0]}`, namespace: parts[1], pluginParent: parent, installation: "remote-receipt", remotePluginId: receipt.remote_plugin_id };
+    } else {
+      const pluginId2 = `${parts[1]}@${parts[0]}`;
+      const marketplaceSources = binding.sources.filter((source2) => basename11(source2.path) === "marketplace.json" && source2.sha256 !== null && source2.format === undefined && source2.fields === undefined && source2.reviewArtifact === undefined && (source2.hashMode === undefined || source2.hashMode === "bytes"));
+      const matches = marketplaceSources.flatMap((source2) => {
+        const text2 = unchangedFullSource(source2.path);
+        return codexLocalMarketplaceMapsPlugin(text2, parts[0], parts[1]) ? [{ source: source2, text: text2 }] : [];
+      });
+      if (matches.length !== 1)
+        throw new Error("Local marketplace hook parent lacks one exact enrolled marketplace source");
+      const { source } = matches[0];
+      const config = Bun.TOML.parse(settings);
+      if (config.plugins?.[pluginId2]?.enabled !== true)
+        throw new Error("Local marketplace hook parent is not enabled in the unchanged Codex settings");
+      identity5 = { role: "reviewed-hook", pluginId: pluginId2, namespace: parts[1], pluginParent: parent, installation: "local-marketplace", marketplaceSourcePath: source.path, marketplaceSha256: source.sha256 };
+    }
+    const versions = readdirSync9(parent).filter((name) => name !== ".codex-remote-plugin-install.json");
+    if (!versions.length || versions.length > 4096)
+      throw new Error("Reviewed native-hook parent has no bounded materializations");
+    for (const version2 of versions) {
+      if (!/^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/.test(version2))
+        throw new Error("Invalid reviewed native-hook version identity");
+      const root2 = join30(parent, version2), stat2 = lstatSync26(root2, { throwIfNoEntry: false });
+      if (!stat2?.isDirectory() || stat2.isSymbolicLink() || realpathSync13(root2) !== root2)
+        throw new Error("Invalid reviewed native-hook materialization");
+      unchangedReviewedHookSource(join30(root2, ".codex-plugin/plugin.json"));
+      unchangedReviewedHookSource(join30(root2, "hooks/hooks.json"));
+    }
+    return identity5;
+  }).sort((a, b) => a.pluginParent.localeCompare(b.pluginParent));
+  const parents3 = [...new Set([...controls.map((control) => control.pluginParent), ...appOnlyParents.map((parent) => parent.pluginParent), ...reviewedHookParents.map((parent) => parent.pluginParent)])];
   const reviewedAlias = aliases.find((alias) => alias.agent === "codex");
   const hookRootAlias = reviewedAlias ? { alias: reviewedAlias.alias, target: reviewedAlias.target } : null;
   assertCodexSemanticCacheHookSafety(cacheRoot, parents3, configPath, hookRootAlias);
-  const supersededSources = binding.sources.filter((source) => codexSemanticCacheSourceRole(source, cacheRoot, parents3));
+  const supersededSources = binding.sources.filter((source) => codexSemanticCacheSourceRole(source, cacheRoot, parents3, reviewedHookParents.map((parent) => parent.pluginParent)));
   for (const source of supersededSources)
     if ([".app.json", ".mcp.json"].includes(source.path.split(sep10).at(-1)))
       unchangedFullSource(source.path);
@@ -47582,7 +47861,7 @@ function planCodexSemanticCacheWitnessUpgrade(options) {
   if (!supersededDirectories.some((directory) => directory.path === cacheRoot) || (binding.directories ?? []).some((directory) => cacheRoot.startsWith(directory.path + sep10)))
     throw new Error("Cache upgrade requires exact cache directory coverage without an unproved ancestor projection");
   const rules = Bun.TOML.parse(settings).skills?.config ?? [];
-  const witness = captureCodexSemanticCacheWitness({ cacheRoot, controls, appOnlyParents, rules, read: boundedRead });
+  const witness = captureCodexSemanticCacheWitness({ cacheRoot, controls, appOnlyParents, reviewedHookParents, rules, read: boundedRead });
   if (options.expectedCacheWitnessSha256 !== undefined && witness.sha256 !== options.expectedCacheWitnessSha256)
     throw new Error("Reviewed semantic cache preimage changed");
   const replacement = { ...binding, codexDisabledPluginSkills: controls, codexSemanticCache: {
@@ -47591,6 +47870,7 @@ function planCodexSemanticCacheWitnessUpgrade(options) {
     hookRootAlias,
     witness,
     appOnlyParents,
+    reviewedHookParents,
     previousPolicySha256: options.expectedPolicySha256,
     supersededSources,
     supersededDirectories
@@ -47609,7 +47889,7 @@ function planCodexSemanticCacheWitnessUpgrade(options) {
     rootAliases: aliases,
     managedAgentChecks: { home, agents: ["codex"] },
     ...policy.bridge.discoveryExecutables ? { discoveryExecutables: policy.bridge.discoveryExecutables } : {},
-    cacheWitnessUpgrade: { ...options, home, dataDir: dataDir2, appOnlyParents: appOnlyParents.map((parent) => parent.pluginParent) }
+    cacheWitnessUpgrade: { ...options, home, dataDir: dataDir2, appOnlyParents: appOnlyParents.map((parent) => parent.pluginParent), reviewedHookParents: reviewedHookParents.map((parent) => parent.pluginParent) }
   };
 }
 function planReviewedArtifactMigration(options) {
@@ -48148,7 +48428,7 @@ import {
   statSync as statSync11,
   writeFileSync as writeFileSync7
 } from "fs";
-import { basename as basename12, dirname as dirname24, isAbsolute as isAbsolute26, join as join34, normalize as normalize4, relative as relative10, resolve as resolve25, sep as sep13 } from "path";
+import { basename as basename14, dirname as dirname24, isAbsolute as isAbsolute26, join as join34, normalize as normalize4, relative as relative10, resolve as resolve25, sep as sep13 } from "path";
 
 // src/lib/registry-data/index.ts
 var SKILLS = [];
@@ -48673,7 +48953,7 @@ import {
   realpathSync as realpathSync14,
   writeFileSync as writeFileSync6
 } from "fs";
-import { basename as basename10, dirname as dirname22, join as join32, relative as relative9 } from "path";
+import { basename as basename12, dirname as dirname22, join as join32, relative as relative9 } from "path";
 var ANY_SEGMENT_COPY_EXCLUDES = new Set([
   ".git",
   ".DS_Store",
@@ -48723,11 +49003,11 @@ function normalizeNewPortableSkillName(name) {
     throw new Error(`Invalid skill name '${name}'. Include letters or numbers.`);
   return normalized;
 }
-function readPortableSkillManifest(skillPath, fallbackName = basename10(skillPath)) {
+function readPortableSkillManifest(skillPath, fallbackName = basename12(skillPath)) {
   return readManifest(skillPath, fallbackName, normalizePortableSkillName);
 }
 function readPortableSkillManifestForImport(skillPath) {
-  return readManifest(skillPath, basename10(skillPath), normalizeNewPortableSkillName);
+  return readManifest(skillPath, basename12(skillPath), normalizeNewPortableSkillName);
 }
 function readManifest(skillPath, fallbackName, normalizeName) {
   const skillJsonPath = join32(skillPath, "skill.json");
@@ -49281,7 +49561,7 @@ function inferRuntimeFromCommands(commands) {
 function readJsonObject(path) {
   const parsed = JSON.parse(readFileSync20(path, "utf-8"));
   if (!isRecord3(parsed))
-    throw new Error(`${basename10(path)} must contain a JSON object`);
+    throw new Error(`${basename12(path)} must contain a JSON object`);
   return parsed;
 }
 function hasPackageDependencies(pkgPath) {
@@ -49319,7 +49599,7 @@ function escapeJsString(value) {
 // src/lib/authoring-path.ts
 import { lstatSync as lstatSync28, realpathSync as realpathSync15 } from "fs";
 import { homedir as homedir4 } from "os";
-import { basename as basename11, dirname as dirname23, join as join33, resolve as resolve24, sep as sep12 } from "path";
+import { basename as basename13, dirname as dirname23, join as join33, resolve as resolve24, sep as sep12 } from "path";
 var NATIVE_DISCOVERY_ROOTS = NATIVE_SKILL_ROOTS.map(([, path]) => path.split("/"));
 function pathParts(path) {
   return resolve24(path).split(sep12).filter(Boolean);
@@ -49339,7 +49619,7 @@ function physicalPath(path) {
   let cursor = resolve24(path);
   const suffix = [];
   while (!lstatSync28(cursor, { throwIfNoEntry: false })) {
-    suffix.unshift(basename11(cursor));
+    suffix.unshift(basename13(cursor));
     const parent = dirname23(cursor);
     if (parent === cursor)
       return resolve24(path);
@@ -49558,7 +49838,7 @@ function physicalImportPath(path) {
   let ancestor = resolve25(path);
   const suffix = [];
   while (!existsSync10(ancestor)) {
-    suffix.unshift(basename12(ancestor));
+    suffix.unshift(basename14(ancestor));
     ancestor = dirname24(ancestor);
   }
   return join34(realpathSync16(ancestor), ...suffix);
@@ -49583,8 +49863,8 @@ function portPortableSkill(sourcePath, options = {}) {
   const explicitName = options.name != null;
   const skillName = normalizeNewPortableSkillName(options.name ?? inferred.name);
   if (isOfficialSkillName(skillName) && !options.allowShadow) {
-    const sourceSlug = safeNormalizeName(basename12(absoluteSource));
-    const via = explicitName ? `Name '${skillName}' matches a bundled official skill.` : `Inferred name '${skillName}'${sourceSlug && sourceSlug !== skillName ? ` (from source folder '${basename12(absoluteSource)}')` : ""} matches a bundled official skill.`;
+    const sourceSlug = safeNormalizeName(basename14(absoluteSource));
+    const via = explicitName ? `Name '${skillName}' matches a bundled official skill.` : `Inferred name '${skillName}'${sourceSlug && sourceSlug !== skillName ? ` (from source folder '${basename14(absoluteSource)}')` : ""} matches a bundled official skill.`;
     throw new Error(`${via} Importing it would shadow the official '${skillName}'. ` + `Pass --name to choose a different name, or --allow-shadow to override deliberately.`);
   }
   const readOnlyDestination = join34(resolvePortableSkillsRoot(options, false), skillName);
@@ -50112,7 +50392,7 @@ function writeManagedSkillDirUnlocked(dir, skillMd, options, assertCurrent) {
     return { action, path: skillMdPath };
   const parentDir = dirname25(dir);
   mkdirSync10(parentDir, { recursive: true });
-  const transactionDir = mkdtempSync2(join35(parentDir, `.hasna-skills-write-${basename13(dir)}-`));
+  const transactionDir = mkdtempSync2(join35(parentDir, `.hasna-skills-write-${basename15(dir)}-`));
   const candidateDir = join35(transactionDir, "candidate");
   const backupDir = join35(transactionDir, "backup");
   const candidateSkillMdPath = join35(candidateDir, "SKILL.md");