@hasna/skills 0.10.75 → 0.10.77

package/dist/index.js

@@ -6988,7 +6988,7 @@ var require_public_api = __commonJS((exports) => {
 });
 
 // src/lib/registry.ts
-import { existsSync as existsSync15, readFileSync as readFileSync27, readdirSync as readdirSync14 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync27, readdirSync as readdirSync15 } from "fs";
 import { join as join41 } from "path";
 
 // src/lib/config.ts
@@ -7257,12 +7257,12 @@ function unsetConfig(key, scope = "project") {
 // src/lib/portable-skills.ts
 import {
   existsSync as existsSync14,
-  mkdirSync as mkdirSync11,
-  mkdtempSync as mkdtempSync2,
-  readdirSync as readdirSync13,
+  mkdirSync as mkdirSync12,
+  mkdtempSync as mkdtempSync3,
+  readdirSync as readdirSync14,
   realpathSync as realpathSync15,
   renameSync as renameSync6,
-  rmSync as rmSync4,
+  rmSync as rmSync5,
   statSync as statSync13,
   writeFileSync as writeFileSync9
 } from "fs";
@@ -9973,7 +9973,7 @@ function assertAgentPolicyCollections(policy) {
 
 // src/lib/agent-discovery.ts
 import { createHash as createHash30 } from "crypto";
-import { lstatSync as lstatSync32, readFileSync as readFileSync26, readdirSync as readdirSync12, realpathSync as realpathSync13 } from "fs";
+import { lstatSync as lstatSync32, readFileSync as readFileSync26, readdirSync as readdirSync13, realpathSync as realpathSync13 } from "fs";
 import { basename as basename15, dirname as dirname26, isAbsolute as isAbsolute28, join as join38, relative as relative10, resolve as resolve27, sep as sep15 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual9 } from "util";
 
@@ -12462,6 +12462,39 @@ function captureCodexSettings(path, budget2 = { remaining: 256 * 1024 * 1024 })
 // src/lib/codex-hook-mcp-dependencies.ts
 import { createHash as createHash13 } from "crypto";
 import { basename as basename6, dirname as dirname11, isAbsolute as isAbsolute11, join as join13, resolve as resolve11, sep as sep4 } from "path";
+
+// src/lib/codex-plugin-capability-paths.ts
+var CODEX_PLUGIN_MANIFEST_LOCATIONS = Object.freeze([
+  "plugin.json",
+  ".codex-plugin/plugin.json",
+  ".claude-plugin/plugin.json",
+  ".cursor-plugin/plugin.json"
+]);
+var CODEX_PLUGIN_MANIFEST_DIRECTORIES = Object.freeze([".codex-plugin", ".claude-plugin", ".cursor-plugin"]);
+var CODEX_PLUGIN_ROOT_CAPABILITY_ENTRIES = Object.freeze([
+  "plugin.json",
+  ".codex-plugin",
+  ".claude-plugin",
+  ".cursor-plugin",
+  "hooks",
+  "hooks.json",
+  ".mcp.json",
+  ".app.json",
+  "commands",
+  "agents"
+]);
+function foldCodexPluginEntryName(name) {
+  return name.toUpperCase().toLowerCase();
+}
+function codexPluginRootCapabilityEntry(name) {
+  const folded = foldCodexPluginEntryName(name);
+  return CODEX_PLUGIN_ROOT_CAPABILITY_ENTRIES.includes(folded) ? folded : null;
+}
+function isCodexSkillDocumentName(name) {
+  return foldCodexPluginEntryName(name) === "skill.md";
+}
+
+// src/lib/codex-hook-mcp-dependencies.ts
 var need5 = (value) => {
   if (!value)
     throw new Error("Incomplete or unsupported reviewed Codex hook dependency");
@@ -12610,15 +12643,13 @@ function captureCodexHookMcpDependencies(configPath, reviewed, configText, chang
       }
     };
     const root = join13(cacheRoot, identity2, selectCodexPluginVersion(versions, selectionBudget));
-    const agent = read2(join13(root, "plugin.json"));
+    const [agentPluginManifest, ...legacyManifests] = CODEX_PLUGIN_MANIFEST_LOCATIONS;
+    const agent = read2(join13(root, agentPluginManifest));
     if (agent !== null) {
       const schema = JSON.parse(agent).$schema;
       need5(typeof schema !== "string" || !schema.startsWith("https://agent-plugins.org/schemas/"));
     }
-    const codex = read2(join13(root, ".codex-plugin/plugin.json"));
-    const claude = read2(join13(root, ".claude-plugin/plugin.json"));
-    const cursor = read2(join13(root, ".cursor-plugin/plugin.json"));
-    const text2 = codex ?? claude ?? cursor;
+    const text2 = legacyManifests.map((location) => read2(join13(root, location))).find((value) => value !== null) ?? null;
     if (text2 === null)
       continue;
     const manifest = JSON.parse(text2);
@@ -13491,14 +13522,14 @@ function hashDiscoveryPathFile(path, budget2, changes) {
 }
 
 // src/lib/codex-vendor-refresh.ts
-import { lstatSync as lstatSync15, readdirSync as readdirSync6, readFileSync as readFileSync12 } from "fs";
+import { lstatSync as lstatSync15, readdirSync as readdirSync7, readFileSync as readFileSync12 } from "fs";
 import { isAbsolute as isAbsolute16, join as join19, relative as relative6, resolve as resolve16, sep as sep9 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
 
 // src/lib/codex-plugin-skill-controls.ts
 import { createHash as createHash18 } from "crypto";
 import { basename as basename8, dirname as dirname15, join as join18, relative as relative5, resolve as resolve15, sep as sep8 } from "path";
-import { lstatSync as lstatSync14, readdirSync as readdirSync5, readFileSync as readFileSync11, readlinkSync as readlinkSync3, realpathSync as realpathSync6 } from "fs";
+import { lstatSync as lstatSync14, readdirSync as readdirSync6, readFileSync as readFileSync11, readlinkSync as readlinkSync3, realpathSync as realpathSync6 } from "fs";
 
 // src/lib/codex-native-skill-catalog.ts
 import { realpathSync as realpathSync5 } from "fs";
@@ -13836,14 +13867,35 @@ class KernelLock {
 }
 
 // src/lib/codex-corpus-write.ts
-import { execFileSync } from "child_process";
+import { AsyncLocalStorage } from "async_hooks";
+import { execFileSync, spawnSync as spawnSync3 } from "child_process";
 import { createHash as createHash17 } from "crypto";
-import { accessSync, constants as constants8, lstatSync as lstatSync13, readFileSync as readFileSync10, realpathSync as realpathSync3, statSync as statSync7 } from "fs";
+import { accessSync, constants as constants8, lstatSync as lstatSync13, mkdirSync as mkdirSync5, mkdtempSync, readdirSync as readdirSync5, readFileSync as readFileSync10, realpathSync as realpathSync3, rmSync as rmSync2, statSync as statSync7 } from "fs";
 import { basename as basename7, delimiter, dirname as dirname14, isAbsolute as isAbsolute13, join as join16, relative as relative4, resolve as resolve14, sep as sep7 } from "path";
 var KEY = ".native-corpus-admission";
-var fail = () => {
-  throw new Error("CODEX_CORPUS_ADMISSION_REQUIRED: verified native admission and its existing shared lock are required");
+var fail = (reason2) => {
+  throw new Error(`CODEX_CORPUS_ADMISSION_REQUIRED: verified native admission and its existing shared lock are required${reason2 ? ` (${reason2})` : ""}`);
 };
+function codexAdmissionRecord(options) {
+  const record4 = options.onCodexAdmission;
+  const invalid = () => {
+    throw new Error("CODEX_CORPUS_ADMISSION_RECORD_INVALID: onCodexAdmission must be a synchronous function");
+  };
+  if (record4 !== undefined && typeof record4 !== "function")
+    invalid();
+  return { policy: { fallback: typeof record4 === "function" }, deliver(admission) {
+    if (!admission || typeof record4 !== "function")
+      return;
+    const result = record4(admission);
+    if (result !== null && (typeof result === "object" || typeof result === "function") && typeof result.then === "function") {
+      Promise.resolve(result).catch(() => {});
+      invalid();
+    }
+  } };
+}
+function codexAdmissionReceipt(admission) {
+  return admission?.nativeAdmission === "unavailable" && admission.probe ? { nativeAdmission: "unavailable", nativeAdmissionProbe: { ...admission.probe } } : {};
+}
 function physicalTarget(path) {
   const suffix = [];
   for (let cursor = path;; cursor = dirname14(cursor)) {
@@ -13925,13 +13977,246 @@ function executable(options) {
   const digest = hash2();
   if (options.codexSha256 && digest !== options.codexSha256)
     return fail();
-  return { path, assertCurrent() {
+  return { path, sha256: digest, size: Number(initial.size), assertCurrent() {
     const current = statSync7(path, { bigint: true });
     if (realpathSync3(found) !== path || ["dev", "ino", "size", "mtimeNs", "ctimeNs", "mode"].some((key2) => initial[key2] !== current[key2]) || hash2() !== digest)
       fail();
   } };
 }
-function acquireCodexCorpusWrite(roots, options) {
+var PROBE = { timeout: 5000, maxBuffer: 4096, killSignal: "SIGKILL", encoding: "utf8" };
+var UNRECOGNIZED = /^error: unrecognized subcommand 'corpus-admission-inspect'(?:\r?\n|$)/;
+var VERSION = /^codex-cli (?:0|[1-9][0-9]{0,5})\.(?:0|[1-9][0-9]{0,5})\.(?:0|[1-9][0-9]{0,5})(?:-[0-9A-Za-z-]{1,32}(?:\.[0-9A-Za-z-]{1,32}){0,7})?$/;
+var LOCK_DIRECTORY = "codex-corpus-locks";
+var PROBE_PARENT = "codex-probe-homes";
+var retain = (hold) => {
+  hold.refs++;
+  return { hold, released: false };
+};
+var release = (ref) => {
+  if (ref.released)
+    return;
+  ref.released = true;
+  if (--ref.hold.refs === 0)
+    ref.hold.lock.close();
+};
+var enclosing = new AsyncLocalStorage;
+var leaseHolds = new WeakMap;
+var contains = (base, path) => {
+  const distance = relative4(base, path);
+  return distance === "" || !distance.startsWith(`..${sep7}`) && distance !== ".." && !isAbsolute13(distance);
+};
+function nativeLockAbsent(root) {
+  for (const name of [`${KEY}.flock-v1`, `${KEY}.lock`]) {
+    try {
+      lstatSync13(join16(root, name));
+      return false;
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+    }
+  }
+  return true;
+}
+function skillsState(root, leaf, roots) {
+  const chain = [realpathSync3(dirname14(root))];
+  for (const part of [".hasna", "skills", leaf])
+    chain.push(join16(chain.at(-1), part));
+  const path = chain.at(-1);
+  const uid2 = process.getuid();
+  const verify = () => {
+    if (roots.some((item) => contains(item, path)) || codexCorpusRootForPath(path) !== undefined)
+      fail();
+    for (let ancestor = dirname14(chain[0]);; ancestor = dirname14(ancestor)) {
+      const stat2 = lstatSync13(ancestor), sticky = stat2.uid === 0 && (stat2.mode & 512) !== 0;
+      if (!stat2.isDirectory() || stat2.uid !== uid2 && stat2.uid !== 0 || (stat2.mode & 18) !== 0 && !sticky)
+        fail();
+      if (dirname14(ancestor) === ancestor)
+        break;
+    }
+    for (const component of chain) {
+      const stat2 = lstatSync13(component, { throwIfNoEntry: false });
+      if (!stat2)
+        return;
+      if (!stat2.isDirectory() || stat2.uid !== uid2 && stat2.uid !== 0 || (stat2.mode & 18) !== 0 || component === path && stat2.uid !== uid2)
+        fail();
+    }
+  };
+  verify();
+  return { path, ensure() {
+    verify();
+    for (const component of chain.slice(1)) {
+      try {
+        mkdirSync5(component, { mode: 448 });
+      } catch (error) {
+        if (error.code !== "EEXIST")
+          throw error;
+      }
+    }
+    verify();
+    if (realpathSync3(path) !== path)
+      fail();
+    return path;
+  } };
+}
+function probeParent(roots) {
+  const dataRoot = resolve14(getDataDirReadOnly()), path = join16(dataRoot, PROBE_PARENT), uid2 = process.getuid();
+  const chain = [];
+  for (let component = path;; component = dirname14(component)) {
+    chain.unshift(component);
+    if (dirname14(component) === component)
+      break;
+  }
+  const verify = () => {
+    if (roots.some((item) => contains(item, path)) || codexCorpusRootForPath(path) !== undefined)
+      fail();
+    for (const component of chain) {
+      const stat2 = lstatSync13(component, { throwIfNoEntry: false });
+      if (!stat2)
+        return;
+      const skills = contains(dataRoot, component), sticky = !skills && stat2.uid === 0 && (stat2.mode & 512) !== 0;
+      if (!stat2.isDirectory() || stat2.uid !== uid2 && (skills || stat2.uid !== 0) || (stat2.mode & 18) !== 0 && !sticky)
+        fail();
+    }
+  };
+  verify();
+  for (const component of chain) {
+    if (lstatSync13(component, { throwIfNoEntry: false }))
+      continue;
+    try {
+      mkdirSync5(component, { mode: 448 });
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+    }
+  }
+  verify();
+  if (realpathSync3(path) !== path)
+    fail();
+  return path;
+}
+function probeHomeIntact(home, empty) {
+  const stat2 = lstatSync13(home.path, { bigint: true, throwIfNoEntry: false });
+  return !!stat2 && stat2.isDirectory() && stat2.dev === home.dev && stat2.ino === home.ino && stat2.uid === BigInt(process.getuid()) && (stat2.mode & 0o777n) === 0o700n && realpathSync3(home.path) === home.path && (!empty || readdirSync5(home.path).length === 0);
+}
+function removeProbeHome(home) {
+  try {
+    const stat2 = lstatSync13(home.path, { bigint: true });
+    if (stat2.isDirectory() && stat2.dev === home.dev && stat2.ino === home.ino)
+      rmSync2(home.path, { recursive: true, force: true });
+  } catch {}
+}
+function probe(path, args, parent, stdio) {
+  const created = mkdtempSync(join16(parent, "probe-")), stat2 = lstatSync13(created, { bigint: true });
+  const home = { path: created, dev: stat2.dev, ino: stat2.ino };
+  try {
+    if (!probeHomeIntact(home, true))
+      return;
+    const env = { CODEX_HOME: home.path };
+    for (const key2 of ["PATH", "HOME"])
+      if (process.env[key2] !== undefined)
+        env[key2] = process.env[key2];
+    const result = spawnSync3(path, args, { ...PROBE, cwd: home.path, env, stdio: ["ignore", stdio, stdio] });
+    return probeHomeIntact(home, false) ? result : undefined;
+  } finally {
+    removeProbeHome(home);
+  }
+}
+function probeAdmissionCommand(path, parent) {
+  const help = probe(path, ["help", "corpus-admission-inspect"], parent, "pipe");
+  if (!help || help.error || help.signal !== null)
+    return "inconclusive";
+  if (help.status === 0)
+    return "present";
+  if (help.status !== 2 || help.stdout !== "" || typeof help.stderr !== "string" || !UNRECOGNIZED.test(help.stderr))
+    return "inconclusive";
+  const control = probe(path, ["help", "exec"], parent, "ignore");
+  return control && !control.error && control.signal === null && control.status === 0 ? "absent" : "inconclusive";
+}
+function strictVersion(path, parent) {
+  const result = probe(path, ["--version"], parent, "pipe");
+  if (!result || result.error || result.signal !== null || result.status !== 0 || typeof result.stdout !== "string")
+    return;
+  const line = result.stdout.replace(/\r?\n$/, "");
+  return VERSION.test(line) ? line : undefined;
+}
+function rootLockKey(root, id) {
+  return `codex-corpus-${createHash17("sha256").update(`${root}\x00${id.device}\x00${id.inode}`).digest("hex")}`;
+}
+function acquireFallback(inputs, options) {
+  let reason2 = "executable-unverified";
+  const refs = new Map, held = [];
+  const close = () => {
+    for (const ref of [...refs.values()].reverse())
+      release(ref);
+  };
+  try {
+    const native = executable(options);
+    reason2 = "skills-lock-unavailable";
+    const roots = inputs.map((item) => item.root);
+    const locks = new Map(roots.map((root) => [root, skillsState(root, LOCK_DIRECTORY, roots)]));
+    const parent = probeParent(roots);
+    reason2 = "probe-inconclusive";
+    const state = probeAdmissionCommand(native.path, parent);
+    if (state === "present")
+      reason2 = "command-present";
+    if (state !== "absent")
+      fail();
+    const version = strictVersion(native.path, parent);
+    if (version === undefined)
+      fail();
+    reason2 = "executable-unverified";
+    native.assertCurrent();
+    reason2 = "skills-lock-unavailable";
+    for (const { input, root } of inputs) {
+      const id = identity3(root), key2 = rootLockKey(root, id);
+      if (!refs.has(key2)) {
+        const owner2 = enclosing.getStore()?.get(key2);
+        if (owner2 && !owner2.released)
+          refs.set(key2, retain(owner2.hold));
+        else {
+          const lock = new KernelLock(locks.get(root).ensure(), key2, { mode: "exclusive" });
+          refs.set(key2, retain({ lock, refs: 0 }));
+          if (!lock.trySync(1000)) {
+            reason2 = "writer-busy";
+            fail();
+          }
+        }
+      }
+      held.push({ input, root, id, ref: refs.get(key2) });
+    }
+    const assertCurrent = () => {
+      try {
+        for (const item of held) {
+          if (item.ref.released)
+            fail();
+          item.ref.hold.lock.assertUnchanged();
+          if (realpathSync3(item.input) !== item.root || !sameIdentity(identity3(item.root), item.id) || !nativeLockAbsent(item.root))
+            fail();
+        }
+        native.assertCurrent();
+      } catch {
+        fail("lease-changed");
+      }
+    };
+    reason2 = "lease-changed";
+    assertCurrent();
+    const lease = { assertCurrent, close, admission: { nativeAdmission: "unavailable", probe: {
+      kind: "help-unrecognized-subcommand",
+      executable: native.path,
+      sha256: native.sha256,
+      size: native.size,
+      version,
+      probeExitCode: 2,
+      controlExitCode: 0
+    } } };
+    leaseHolds.set(lease, refs);
+    return lease;
+  } catch {
+    close();
+    return fail(reason2);
+  }
+}
+function acquireCodexCorpusWrite(roots, options, policy = {}) {
   const held = [];
   const close = () => {
     for (const item of held.reverse())
@@ -13944,10 +14229,20 @@ function acquireCodexCorpusWrite(roots, options) {
         fail();
     }
   };
+  let fallback = false, refusal;
   try {
     if (roots.some((root) => typeof root !== "string" || !isAbsolute13(root) || root.includes("\x00")))
       fail();
     const inputs = [...new Set(roots)].map((input) => ({ input, root: realpathSync3(input) })).sort((a, b) => a.root.localeCompare(b.root));
+    const absent = inputs.filter(({ root }) => nativeLockAbsent(root));
+    if (absent.length && absent.length !== inputs.length) {
+      refusal = "native-lock-present";
+      fail();
+    }
+    if (absent.length && policy.fallback !== false) {
+      fallback = true;
+      return acquireFallback(inputs, options);
+    }
     for (const { input, root } of inputs) {
       const lock = new KernelLock(root, KEY, { mode: "shared", existingOnly: true });
       held.push({ input, root, lock });
@@ -13975,19 +14270,25 @@ function acquireCodexCorpusWrite(roots, options) {
       if (Object.keys(row).sort().join(",") !== "lock,root,schema,state" || row.schema !== "codex-corpus-admission-status/v1" || row.state !== "committed-v1" && row.state !== "committed-v2" || !sameIdentity(row.root, rootIdentity) || !sameIdentity(row.lock, lockIdentity))
         fail();
     }
-    return { assertCurrent, close };
-  } catch {
+    return { assertCurrent, close, admission: { nativeAdmission: "verified" } };
+  } catch (error) {
+    if (fallback)
+      throw error;
     close();
-    return fail();
+    return fail(refusal);
   }
 }
-function withCodexCorpusWrite(roots, run, options = {}) {
+function scoped(lease, run) {
+  const holds = leaseHolds.get(lease);
+  return holds?.size ? enclosing.run(new Map([...enclosing.getStore() ?? [], ...holds]), run) : run();
+}
+function withCodexCorpusWrite(roots, run, options = {}, policy = {}) {
   if (!roots.length)
     return run(() => {});
-  const lease = acquireCodexCorpusWrite(roots, options);
+  const lease = acquireCodexCorpusWrite(roots, options, policy);
   try {
     lease.assertCurrent();
-    const result = run(lease.assertCurrent);
+    const result = scoped(lease, () => run(lease.assertCurrent, lease.admission));
     lease.assertCurrent();
     return result;
   } finally {
@@ -14108,6 +14409,7 @@ async function connectCodexHookRpc(options) {
   const rpc = {
     version,
     processId: child2.pid,
+    admission: corpusLease.admission,
     request(method, params) {
       if (stopped)
         return Promise.reject(new Error(configInvalid ? CODEX_CONFIG_INVALID : "CODEX_HOOK_TRUST_NATIVE_RPC_CLOSED"));
@@ -14561,7 +14863,7 @@ function reviewedRetiredCodexRoot(cache, root, controls, rules, read2, allowAbse
     if (!enrolled.some((control) => control.namespace === parsed.namespace && control.manifestSha256 === parsed.manifestSha256 && !parsed.appSha256 && !parsed.mcpSha256))
       return false;
     let entries = 0;
-    const emptySkills = (directory, depth) => depth <= 64 && readdirSync5(directory).every((name) => {
+    const emptySkills = (directory, depth) => depth <= 64 && readdirSync6(directory).every((name) => {
       if (++entries > 4096 || name === "SKILL.md")
         return false;
       const path = join18(directory, name), stat2 = lstatSync14(path);
@@ -14586,7 +14888,7 @@ function reviewedCodexPluginCapabilitiesUnchanged(cache, controls, read2, rules)
         if (control.remotePluginId !== undefined && !remoteInstallationMatches(parent, control.remotePluginId, read2))
           return false;
       }
-      const names = readdirSync5(parent);
+      const names = readdirSync6(parent);
       entries += names.length;
       if (entries > 4096)
         return false;
@@ -14794,20 +15096,20 @@ function codexVendorMarketplace(cache, path) {
     return null;
   return CODEX_VENDOR_MARKETPLACES.includes(parts[0]) ? parts[0] : null;
 }
-var OTHER_PLUGIN_CONTROLS = Object.freeze(["plugin.json", ".claude-plugin", ".cursor-plugin", "hooks", "hooks.json", ".mcp.json", "commands", "agents"]);
+var OTHER_PLUGIN_CONTROLS = Object.freeze(CODEX_PLUGIN_ROOT_CAPABILITY_ENTRIES.filter((entry) => entry !== ".codex-plugin" && entry !== ".app.json"));
 var VENDOR_MANIFEST_KEYS = Object.freeze(["name", "version", "description", "author", "homepage", "repository", "license", "keywords", "interface", "skills", "apps"]);
 var DEFAULT_SKILLS_PATHS = Object.freeze(["./skills", "./skills/"]);
 var VENDOR_APP_DECLARATION = "./.app.json";
 var MAX_SUBTREE_ENTRIES = 20000;
 var MAX_SUBTREE_DEPTH = 32;
 var hiddenName = (name) => name.startsWith(".") || name === "node_modules";
-var isSkillDocument = (name) => name.toLowerCase() === "skill.md";
+var isSkillDocument = isCodexSkillDocumentName;
 var present = (path) => lstatSync15(path, { throwIfNoEntry: false }) !== undefined;
-var holdsOtherControl = (path) => readdirSync6(path).some((name) => OTHER_PLUGIN_CONTROLS.includes(name.toLowerCase()));
+var holdsOtherControl = (path) => readdirSync7(path).some((name) => OTHER_PLUGIN_CONTROLS.includes(codexPluginRootCapabilityEntry(name) ?? ""));
 function pluginTreeVisible(path, hidden, insideSkill, depth, budget2) {
   if (depth > MAX_SUBTREE_DEPTH)
     return false;
-  const names = readdirSync6(path);
+  const names = readdirSync7(path);
   const skill = names.some(isSkillDocument);
   if (skill && (hidden || insideSkill))
     return false;
@@ -14831,7 +15133,7 @@ function codexVendorPluginRootRefreshSafe(root, budget2 = { remaining: MAX_SUBTR
       return false;
     if (!directory(join19(root, ".codex-plugin")))
       return false;
-    const controls = readdirSync6(join19(root, ".codex-plugin"));
+    const controls = readdirSync7(join19(root, ".codex-plugin"));
     if (controls.length !== 1 || controls[0] !== "plugin.json")
       return false;
     const manifest = join19(root, ".codex-plugin", "plugin.json"), stat2 = lstatSync15(manifest, { throwIfNoEntry: false });
@@ -14854,7 +15156,7 @@ function codexVendorPluginRootRefreshSafe(root, budget2 = { remaining: MAX_SUBTR
 }
 function vendorMembers(path, budget2) {
   const directories = [];
-  for (const name of readdirSync6(path)) {
+  for (const name of readdirSync7(path)) {
     if (--budget2.remaining < 0)
       return null;
     const stat2 = lstatSync15(join19(path, name));
@@ -15144,7 +15446,7 @@ import { basename as basename13, dirname as dirname24, isAbsolute as isAbsolute2
 import { homedir as homedir5 } from "os";
 import { isAbsolute as isAbsolute25, join as join36, resolve as resolve24 } from "path";
 // package.json
-var version = "0.10.75";
+var version = "0.10.77";
 var package_default = {
   name: "@hasna/skills",
   version,
@@ -15287,7 +15589,7 @@ var package_default = {
 
 // node_modules/@hasna/contracts/dist/client/transport.js
 import { isIP } from "net";
-import { spawnSync as spawnSync3 } from "child_process";
+import { spawnSync as spawnSync4 } from "child_process";
 import { closeSync as closeSync22, fstatSync as fstatSync22, openSync as openSync22, readFileSync as readFileSync22 } from "fs";
 import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";
 import { hostname as osHostname } from "os";
@@ -15687,7 +15989,7 @@ function isAmbientEnvironment(env) {
   return env === process.env || env[AMBIENT_ENVIRONMENT] === true;
 }
 function defaultKeychainRunner(argv) {
-  const result = spawnSync3(KEYCHAIN_SECURITY_BIN, [...argv], {
+  const result = spawnSync4(KEYCHAIN_SECURITY_BIN, [...argv], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],
     timeout: KEYCHAIN_SPAWN_TIMEOUT_MS
@@ -16232,6 +16534,9 @@ function selectsSkillsLocalMode(env = process.env) {
   return !hasSkillsEnvAuthorityIntent(env) && isSkillsLocalOptIn(env);
 }
 
+// src/lib/credential-profile-command.ts
+var urlKeys = clientTransportEnvKeys("skills").apiUrlKeys;
+
 // src/lib/fleet-credentials.ts
 var SKILLS_APP = "skills";
 var ENV_KEYS = clientTransportEnvKeys(SKILLS_APP);
@@ -16782,7 +17087,7 @@ async function createProfileClient(signal) {
 }
 
 // src/lib/dependency-preparation.ts
-import { constants as constants10, closeSync as closeSync10, fstatSync as fstatSync10, lstatSync as lstatSync18, mkdirSync as mkdirSync5, openSync as openSync10, readFileSync as readFileSync14, readdirSync as readdirSync7, rmdirSync as rmdirSync2, unlinkSync as unlinkSync3, ftruncateSync, writeSync as writeSync2 } from "fs";
+import { constants as constants10, closeSync as closeSync10, fstatSync as fstatSync10, lstatSync as lstatSync18, mkdirSync as mkdirSync6, openSync as openSync10, readFileSync as readFileSync14, readdirSync as readdirSync8, rmdirSync as rmdirSync2, unlinkSync as unlinkSync3, ftruncateSync, writeSync as writeSync2 } from "fs";
 import { join as join21 } from "path";
 
 // src/lib/preparation-process.ts
@@ -16841,7 +17146,7 @@ function claimPreparation(skillPath) {
   const state = join21(marker, "state.json"), active = join21(marker, "active");
   let created = false;
   try {
-    mkdirSync5(marker, { mode: 448 });
+    mkdirSync6(marker, { mode: 448 });
     created = true;
   } catch (error) {
     if (error.code !== "EEXIST")
@@ -16852,7 +17157,7 @@ function claimPreparation(skillPath) {
     if (!lstatSync18(marker).isDirectory() || lstatSync18(marker).isSymbolicLink())
       return;
     if (!created) {
-      if (readdirSync7(marker).some((name) => name !== "state.json"))
+      if (readdirSync8(marker).some((name) => name !== "state.json"))
         return;
       if (!lstatSync18(state).isFile() || lstatSync18(state).isSymbolicLink() || lstatSync18(state).size > 1024)
         return;
@@ -16860,7 +17165,7 @@ function claimPreparation(skillPath) {
       if (previous.version !== 1 || previous.status !== "failed" || Object.keys(previous).length !== 2)
         return;
     }
-    mkdirSync5(active, { mode: 448 });
+    mkdirSync6(active, { mode: 448 });
     fd = openSync10(state, constants10.O_RDWR | constants10.O_NOFOLLOW | (created ? constants10.O_CREAT | constants10.O_EXCL : 0), 384);
     if (!fstatSync10(fd).isFile()) {
       closeSync10(fd);
@@ -16993,7 +17298,7 @@ import { existsSync as existsSync13, readFileSync as readFileSync25 } from "fs";
 import { join as join35 } from "path";
 
 // src/lib/installer.ts
-import { existsSync as existsSync12, readFileSync as readFileSync23, rmSync as rmSync3 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync23, rmSync as rmSync4 } from "fs";
 import { join as join34 } from "path";
 import { homedir as homedir4 } from "os";
 
@@ -17002,12 +17307,12 @@ import {
   cpSync as cpSync2,
   existsSync as existsSync10,
   lstatSync as lstatSync29,
-  mkdirSync as mkdirSync9,
-  mkdtempSync,
+  mkdirSync as mkdirSync10,
+  mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync20,
-  readdirSync as readdirSync11,
+  readdirSync as readdirSync12,
   renameSync as renameSync5,
-  rmSync as rmSync2,
+  rmSync as rmSync3,
   statSync as statSync12,
   writeFileSync as writeFileSync7
 } from "fs";
@@ -17016,7 +17321,7 @@ import { basename as basename12, dirname as dirname23, join as join32 } from "pa
 
 // src/lib/codex-native-skill-policy.ts
 import { createHash as createHash21, randomUUID as randomUUID3 } from "crypto";
-import { closeSync as closeSync11, constants as constants11, fstatSync as fstatSync11, fsyncSync as fsyncSync3, lstatSync as lstatSync19, mkdirSync as mkdirSync6, openSync as openSync11, readFileSync as readFileSync15, readSync as readSync7, readlinkSync as readlinkSync4, realpathSync as realpathSync8, renameSync as renameSync3, unlinkSync as unlinkSync4, writeFileSync as writeFileSync4 } from "fs";
+import { closeSync as closeSync11, constants as constants11, fstatSync as fstatSync11, fsyncSync as fsyncSync3, lstatSync as lstatSync19, mkdirSync as mkdirSync7, openSync as openSync11, readFileSync as readFileSync15, readSync as readSync7, readlinkSync as readlinkSync4, realpathSync as realpathSync8, renameSync as renameSync3, unlinkSync as unlinkSync4, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname17, isAbsolute as isAbsolute18, join as join23, resolve as resolve17 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual6 } from "util";
 var CODEX_NATIVE_POLICY_CAPABILITY = "host-path-allowlist-v1";
@@ -17285,7 +17590,7 @@ function writeExecutableCache(dataDir2, entries) {
       return;
     const existing = lstatSync19(directory2, { throwIfNoEntry: false });
     if (!existing)
-      mkdirSync6(directory2, { mode: 448 });
+      mkdirSync7(directory2, { mode: 448 });
     else if (existing.isSymbolicLink() || !existing.isDirectory())
       return;
     const holder = lstatSync19(directory2, { throwIfNoEntry: false, bigint: true });
@@ -17580,7 +17885,7 @@ function recordCodexNativePolicyAcceptance(dataDir2, verification, accepted) {
     ...verification.attestation ? { attestation: { schema: verification.attestation.schema, peerProcessId: verification.attestation.peerProcessId } } : {}
   };
   try {
-    mkdirSync6(directory2, { recursive: true, mode: 448 });
+    mkdirSync7(directory2, { recursive: true, mode: 448 });
     const stat2 = lstatSync19(directory2);
     if (stat2.isSymbolicLink() || !stat2.isDirectory())
       throw new Error(`the receipt directory is not a real directory: ${directory2}`);
@@ -17612,9 +17917,10 @@ function recordCodexNativePolicyAcceptance(dataDir2, verification, accepted) {
 
 // src/lib/codex-semantic-cache-witness.ts
 import { createHash as createHash22 } from "crypto";
-import { constants as constants12, closeSync as closeSync12, fstatSync as fstatSync12, lstatSync as lstatSync20, openSync as openSync12, readSync as readSync8, readdirSync as readdirSync8, realpathSync as realpathSync9 } from "fs";
+import { constants as constants12, closeSync as closeSync12, fstatSync as fstatSync12, lstatSync as lstatSync20, openSync as openSync12, readSync as readSync8, readdirSync as readdirSync9, realpathSync as realpathSync9 } from "fs";
 import { basename as basename10, dirname as dirname18, isAbsolute as isAbsolute19, join as join25, relative as relative8, resolve as resolve18, sep as sep11 } from "path";
 var CODEX_SEMANTIC_CACHE_WITNESS_SCHEMA = "hasna.codex-semantic-cache-witness.v1";
+var SEMANTIC_BOUND_ROOT_ENTRIES = Object.freeze([".codex-plugin", ".app.json", ".mcp.json", "hooks"]);
 var identifier5 = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(value);
 var digest = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
 var refuse4 = () => {
@@ -17777,7 +18083,7 @@ function assertCanonicalDirectory(path) {
 function walkSafeTree(path, state, depth = 0, root = path) {
   if (depth > 64 || ++state.entries > 16384)
     refuse4();
-  const names = readdirSync8(path).sort();
+  const names = readdirSync9(path).sort();
   const files = [];
   for (const name of names) {
     if (!name || name === "." || name === ".." || name.includes(sep11) || ++state.entries > 16384)
@@ -17923,7 +18229,7 @@ function appOnlyParentProjection(cacheRoot, parents2, read2) {
     } catch {
       refuse4();
     }
-    const versions = readdirSync8(parent.pluginParent).filter((name) => name !== ".codex-remote-plugin-install.json");
+    const versions = readdirSync9(parent.pluginParent).filter((name) => name !== ".codex-remote-plugin-install.json");
     if (!versions.length || versions.length > 4096)
       refuse4();
     const materializations = versions.map((version2) => {
@@ -18068,7 +18374,7 @@ function reviewedHookParentProjection(cacheRoot, parents2, read2) {
       if (createHash22("sha256").update(marketplaceText).digest("hex") !== parent.marketplaceSha256 || !codexLocalMarketplaceMapsPlugin(marketplaceText, parts[0], parent.namespace))
         refuse4();
     }
-    const materializations = readdirSync8(parent.pluginParent).filter((name) => name !== ".codex-remote-plugin-install.json").map((version2) => {
+    const materializations = readdirSync9(parent.pluginParent).filter((name) => name !== ".codex-remote-plugin-install.json").map((version2) => {
       if (!/^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/.test(version2))
         refuse4();
       const root = join25(parent.pluginParent, version2), stat2 = lstatSync20(root, { throwIfNoEntry: false });
@@ -18102,14 +18408,14 @@ function assertParents(cacheRoot, controls, appOnlyParents, hookParents, files,
       refuse4();
     actual.add(join25(cacheRoot, parts[0], parts[1]));
   }
-  const actualMarkets = readdirSync8(cacheRoot);
+  const actualMarkets = readdirSync9(cacheRoot);
   if (actualMarkets.length !== expectedMarkets.size || actualMarkets.some((market) => !expectedMarkets.has(market)))
     refuse4();
   for (const market of actualMarkets) {
     const marketPath = join25(cacheRoot, market), marketStat = lstatSync20(marketPath);
     if (!identifier5(market) || !marketStat.isDirectory() || marketStat.isSymbolicLink())
       refuse4();
-    for (const plugin of readdirSync8(marketPath)) {
+    for (const plugin of readdirSync9(marketPath)) {
       const parent = join25(marketPath, plugin), stat2 = lstatSync20(parent);
       if (!identifier5(plugin) || !stat2.isDirectory() || stat2.isSymbolicLink())
         refuse4();
@@ -18124,14 +18430,23 @@ function assertParents(cacheRoot, controls, appOnlyParents, hookParents, files,
       continue;
     const parent = join25(cacheRoot, parts[0], parts[1]);
     const root = join25(parent, parts[2]);
-    const base = parts[parts.length - 1];
-    if (parts.includes(".codex-plugin") && (parts.length < 4 || parts[3] !== ".codex-plugin" || (parts.length === 4 ? base !== ".codex-plugin" : parts.length !== 5 || base !== "plugin.json")))
+    const base = parts[parts.length - 1], folded = foldCodexPluginEntryName(base);
+    if (parts.length === 3 && (codexPluginRootCapabilityEntry(base) !== null || isCodexSkillDocumentName(base)))
+      refuse4();
+    const rootEntry = parts.length >= 4 ? codexPluginRootCapabilityEntry(parts[3]) : null;
+    if (rootEntry !== null && rootEntry !== parts[3])
+      refuse4();
+    if (rootEntry !== null && !SEMANTIC_BOUND_ROOT_ENTRIES.includes(rootEntry))
       refuse4();
-    if ([".app.json", ".mcp.json"].includes(base) && (parts.length !== 4 || dirname18(member) !== root))
+    if (isCodexSkillDocumentName(base) && base !== "SKILL.md")
       refuse4();
-    if ([".app.json", ".mcp.json"].includes(base) && hookParents.some((reviewed) => reviewed.pluginParent === parent))
+    if (parts.some((part) => CODEX_PLUGIN_MANIFEST_DIRECTORIES.includes(foldCodexPluginEntryName(part))) && (parts.length < 4 || parts[3] !== ".codex-plugin" || (parts.length === 4 ? base !== ".codex-plugin" : parts.length !== 5 || base !== "plugin.json")))
       refuse4();
-    if ((parts[3] === "hooks" || base === "hooks.json") && (![4, 5].includes(parts.length) || parts[3] !== "hooks" || (parts.length === 4 ? base !== "hooks" : base !== "hooks.json") || !hookParents.some((reviewed) => reviewed.pluginParent === join25(cacheRoot, parts[0], parts[1]))))
+    if ([".app.json", ".mcp.json"].includes(folded) && (parts.length !== 4 || dirname18(member) !== root))
+      refuse4();
+    if ([".app.json", ".mcp.json"].includes(folded) && hookParents.some((reviewed) => reviewed.pluginParent === parent))
+      refuse4();
+    if ((rootEntry === "hooks" || folded === "hooks.json") && (![4, 5].includes(parts.length) || parts[3] !== "hooks" || (parts.length === 4 ? base !== "hooks" : base !== "hooks.json") || !hookParents.some((reviewed) => reviewed.pluginParent === join25(cacheRoot, parts[0], parts[1]))))
       refuse4();
   }
 }
@@ -18161,7 +18476,7 @@ function assertSkillMaterializations(cacheRoot, controls, files, read2) {
     const expectedNames = new Set(rows.map((row) => row.name));
     if (expectedNames.size !== rows.length)
       refuse4();
-    const entries = readdirSync8(parent);
+    const entries = readdirSync9(parent);
     let roots = 0;
     for (const entry of entries) {
       if (entry === ".codex-remote-plugin-install.json")
@@ -18400,7 +18715,7 @@ function codexPluginCacheSkillTree(path, depth) {
 // src/lib/agent-integration.ts
 import { createHash as createHash27, randomUUID as randomUUID4 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual8 } from "util";
-import { existsSync as existsSync9, lstatSync as lstatSync28, statSync as statSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync19, readdirSync as readdirSync10, opendirSync as opendirSync4, readlinkSync as readlinkSync7, realpathSync as realpathSync12, renameSync as renameSync4, rmdirSync as rmdirSync3, writeFileSync as writeFileSync6, unlinkSync as unlinkSync5, chmodSync, openSync as openSync17, closeSync as closeSync17, fsyncSync as fsyncSync7, fstatSync as fstatSync17, readSync as readSync12, constants as constants18, linkSync as linkSync3 } from "fs";
+import { existsSync as existsSync9, lstatSync as lstatSync28, statSync as statSync11, mkdirSync as mkdirSync9, readFileSync as readFileSync19, readdirSync as readdirSync11, opendirSync as opendirSync4, readlinkSync as readlinkSync7, realpathSync as realpathSync12, renameSync as renameSync4, rmdirSync as rmdirSync3, writeFileSync as writeFileSync6, unlinkSync as unlinkSync5, chmodSync, openSync as openSync17, closeSync as closeSync17, fsyncSync as fsyncSync7, fstatSync as fstatSync17, readSync as readSync12, constants as constants18, linkSync as linkSync3 } from "fs";
 import { basename as basename11, dirname as dirname22, join as join31, resolve as resolve23, relative as relative9, isAbsolute as isAbsolute24, sep as sep14 } from "path";
 import { homedir as homedir2 } from "os";
 
@@ -18486,7 +18801,7 @@ function requiresCliSkillLoading(dataDir2 = getDataDirReadOnly()) {
 
 // src/lib/agent-bridge.ts
 import { createHash as createHash23 } from "crypto";
-import { lstatSync as lstatSync23, readFileSync as readFileSync17, readdirSync as readdirSync9 } from "fs";
+import { lstatSync as lstatSync23, readFileSync as readFileSync17, readdirSync as readdirSync10 } from "fs";
 import { join as join28 } from "path";
 var CLI_BRIDGE_NAME = "skills-cli";
 var CLI_BRIDGE_VERSION = 1;
@@ -18516,7 +18831,7 @@ function isOwnedCliBridge(path, expectedPaths) {
   try {
     if (!lstatSync23(path).isDirectory())
       return false;
-    if (JSON.stringify(readdirSync9(path).sort()) !== JSON.stringify(Object.keys(CLI_BRIDGE_FILES).sort()))
+    if (JSON.stringify(readdirSync10(path).sort()) !== JSON.stringify(Object.keys(CLI_BRIDGE_FILES).sort()))
       return false;
     return Object.entries(CLI_BRIDGE_FILES).every(([name, content]) => {
       const file = join28(path, name), stat2 = lstatSync23(file);
@@ -18796,7 +19111,7 @@ function disableCodexBundledSkills(text2) {
 }
 
 // src/lib/agent-sumi.ts
-import { spawnSync as spawnSync4 } from "child_process";
+import { spawnSync as spawnSync5 } from "child_process";
 import { accessSync as accessSync2, constants as constants14, existsSync as existsSync8, lstatSync as lstatSync24, realpathSync as realpathSync10, statSync as statSync10 } from "fs";
 import { delimiter as delimiter2, isAbsolute as isAbsolute20, join as join29, resolve as resolve20 } from "path";
 
@@ -18954,7 +19269,7 @@ function sumiPathPlan(home, cwd = process.cwd(), env = process.env) {
       childEnv[key2] = env[key2];
   let child2;
   try {
-    child2 = spawnSync4(executable2, ["--json", "--home", resolve20(home), "--cwd", resolve20(cwd)], {
+    child2 = spawnSync5(executable2, ["--json", "--home", resolve20(home), "--cwd", resolve20(cwd)], {
       cwd: resolve20(cwd),
       env: childEnv,
       encoding: "buffer",
@@ -19420,7 +19735,7 @@ function assertPinnedLauncherRuntimeSafe(runtime) {
 
 // src/lib/retained-review-artifacts.ts
 import { createHash as createHash26 } from "crypto";
-import { constants as constants17, closeSync as closeSync16, fstatSync as fstatSync16, fsyncSync as fsyncSync6, lstatSync as lstatSync27, mkdirSync as mkdirSync7, openSync as openSync16, readSync as readSync11, writeSync as writeSync4 } from "fs";
+import { constants as constants17, closeSync as closeSync16, fstatSync as fstatSync16, fsyncSync as fsyncSync6, lstatSync as lstatSync27, mkdirSync as mkdirSync8, openSync as openSync16, readSync as readSync11, writeSync as writeSync4 } from "fs";
 import { dirname as dirname21, isAbsolute as isAbsolute23, join as join30, resolve as resolve22, sep as sep13 } from "path";
 var sha3 = (bytes) => createHash26("sha256").update(bytes).digest("hex");
 var hex = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
@@ -19550,7 +19865,7 @@ function writeReviewArtifactExclusive(change) {
   for (let parent = dirname21(change.path);!lstatSync27(parent, { throwIfNoEntry: false }); parent = dirname21(parent))
     missing2.push(parent);
   for (const parent of missing2.reverse())
-    mkdirSync7(parent, { mode: 448 });
+    mkdirSync8(parent, { mode: 448 });
   safe4(change.path);
   privateStore(change.artifact.storeRoot);
   for (let parent = dirname21(change.path);parent !== change.artifact.storeRoot; parent = dirname21(parent)) {
@@ -19800,7 +20115,7 @@ function treeHash(root) {
     const rel = relative9(root, path);
     if (stat2.isDirectory()) {
       hash3.update(`d\x00${rel}\x00`);
-      for (const name of readdirSync10(path).sort())
+      for (const name of readdirSync11(path).sort())
         visit2(join31(path, name));
       return;
     }
@@ -20695,7 +21010,7 @@ function planClaudeHookEventsUpdate(options) {
 }
 function atomicWrite2(path, content) {
   assertSafePath(path);
-  mkdirSync8(dirname22(path), { recursive: true, mode: 448 });
+  mkdirSync9(dirname22(path), { recursive: true, mode: 448 });
   const temporary = `${path}.skills-${randomUUID4()}`;
   try {
     writeFileSync6(temporary, content, { mode: 384, flag: "wx" });
@@ -20863,7 +21178,7 @@ function planCodexSemanticCacheWitnessUpgrade(options) {
         throw new Error("Local marketplace hook parent is not enabled in the unchanged Codex settings");
       identity5 = { role: "reviewed-hook", pluginId: pluginId2, namespace: parts[1], pluginParent: parent, installation: "local-marketplace", marketplaceSourcePath: source.path, marketplaceSha256: source.sha256 };
     }
-    const versions = readdirSync10(parent).filter((name) => name !== ".codex-remote-plugin-install.json");
+    const versions = readdirSync11(parent).filter((name) => name !== ".codex-remote-plugin-install.json");
     if (!versions.length || versions.length > 4096)
       throw new Error("Reviewed native-hook parent has no bounded materializations");
     for (const version2 of versions) {
@@ -20957,9 +21272,10 @@ function applyAgentIntegration(plan, options = {}) {
     const alias = plan.rootAliases?.find((item) => item.agent === "codex" && (change.path === item.target || change.path.startsWith(item.target + "/")));
     return lexical ? [lexical] : alias ? [alias.alias] : [];
   });
-  return withCodexCorpusWrite(roots, (assertCurrent) => applyAgentIntegrationUnlocked(plan, options, assertCurrent), options);
+  return withCodexCorpusWrite(roots, (assertCurrent, admission) => applyAgentIntegrationUnlocked(plan, options, assertCurrent, admission), options);
 }
-function applyAgentIntegrationUnlocked(plan, options = {}, assertCurrent) {
+function applyAgentIntegrationUnlocked(plan, options = {}, assertCurrent, admission) {
+  const fallback = codexAdmissionReceipt(admission);
   for (const source of plan.reviewArtifactSources ?? [])
     verifyReviewArtifactOriginal(source.path, source.sha256);
   for (const source of plan.observedNativeSources ?? [])
@@ -21023,10 +21339,10 @@ function applyAgentIntegrationUnlocked(plan, options = {}, assertCurrent) {
     recheckRootAliases(aliases);
     for (const agent of plan.retainedReviewChecks?.agents ?? [])
       assertManagedAgentBridge(agent, { ...plan.retainedReviewChecks, dataDir: plan.dataDir });
-    return { changed: [], backups, ...aliases.length ? { rootAliases: aliases } : {} };
+    return { changed: [], backups, ...aliases.length ? { rootAliases: aliases } : {}, ...fallback };
   }
   assertSafePath(backupRoot);
-  mkdirSync8(backupRoot, { recursive: true, mode: 448 });
+  mkdirSync9(backupRoot, { recursive: true, mode: 448 });
   chmodSync(backupRoot, 448);
   for (const [index, change] of plan.changes.entries())
     if (change.before !== null) {
@@ -21074,7 +21390,7 @@ function applyAgentIntegrationUnlocked(plan, options = {}, assertCurrent) {
       assertManagedAgentBridge(agent, { home: plan.managedAgentChecks.home, dataDir: plan.dataDir, projectDir: plan.managedAgentChecks.projectDir ?? plan.managedAgentChecks.home });
     for (const agent of plan.retainedReviewChecks?.agents ?? [])
       assertManagedAgentBridge(agent, { ...plan.retainedReviewChecks, dataDir: plan.dataDir });
-    atomicWrite2(join31(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha4(change.before), afterHash: sha4(change.after) })), backups, ...plan.cacheWitnessUpgrade ? { cacheWitnessUpgrade: plan.cacheWitnessUpgrade } : {}, ...plan.retainedReviewArtifacts?.length ? { retainedReviewArtifacts: plan.retainedReviewArtifacts.map((item) => ({ path: item.path, ...item.artifact })) } : {}, ...aliases.length ? { rootAliases: aliases } : {} }) + `
+    atomicWrite2(join31(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha4(change.before), afterHash: sha4(change.after) })), backups, ...plan.cacheWitnessUpgrade ? { cacheWitnessUpgrade: plan.cacheWitnessUpgrade } : {}, ...plan.retainedReviewArtifacts?.length ? { retainedReviewArtifacts: plan.retainedReviewArtifacts.map((item) => ({ path: item.path, ...item.artifact })) } : {}, ...aliases.length ? { rootAliases: aliases } : {}, ...fallback }) + `
 `);
   } catch (error) {
     assertCurrent();
@@ -21102,7 +21418,7 @@ function applyAgentIntegrationUnlocked(plan, options = {}, assertCurrent) {
     }
     throw error;
   }
-  return { changed: plan.changes.map((change) => change.path), backups, ...aliases.length ? { rootAliases: aliases } : {} };
+  return { changed: plan.changes.map((change) => change.path), backups, ...aliases.length ? { rootAliases: aliases } : {}, ...fallback };
 }
 function syncArchiveDirectory(path) {
   assertSafePath(path);
@@ -21142,9 +21458,10 @@ function archiveNativeSkills(inventory, options) {
       throw new Error("CODEX_CORPUS_ROOT_UNVERIFIED");
     return [...new Set([root, owner2].filter((value) => value !== undefined))];
   });
-  return withCodexCorpusWrite(roots, (assertCurrent) => archiveNativeSkillsUnlocked(inventory, options, assertCurrent), options);
+  return withCodexCorpusWrite(roots, (assertCurrent, admission) => archiveNativeSkillsUnlocked(inventory, options, assertCurrent, admission), options);
 }
-function archiveNativeSkillsUnlocked(inventory, options, assertCurrent) {
+function archiveNativeSkillsUnlocked(inventory, options, assertCurrent, admission) {
+  const fallback = codexAdmissionReceipt(admission);
   const aliases = [...new Map(inventory.filter((entry) => entry.rootAlias).map((entry) => [entry.rootAlias.alias, entry.rootAlias])).values()];
   if (aliases.length && !options.allowRootAliases)
     throw new Error("Native migration requires explicit allowRootAliases for agent root aliases");
@@ -21162,7 +21479,7 @@ function archiveNativeSkillsUnlocked(inventory, options, assertCurrent) {
       throw new Error(`Native skill changed after planning: ${entry.path}`);
   const targetManifest = options.targetManifest ? { schema: options.targetManifest.schema, digest: options.targetManifest.digest, targetCount: options.targetManifest.targets.length } : undefined;
   if (!selected.length)
-    return { entries: [], ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
+    return { entries: [], ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {}, ...fallback };
   const operationId = randomUUID4(), archiveRoot = join31(options.dataDir ?? getDataDir(), "migration", operationId, "native"), receiptPath = join31(archiveRoot, "receipt.json");
   const entries = selected.map((entry, index) => ({
     source: entry.vendor ? join31(entry.path, "SKILL.md") : entry.path,
@@ -21171,7 +21488,7 @@ function archiveNativeSkillsUnlocked(inventory, options, assertCurrent) {
     ...entry.vendor ? { discoveryOnly: true } : {},
     status: "planned"
   }));
-  const journal = { version: 2, operationId, status: "planned", entries, ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
+  const journal = { version: 2, operationId, status: "planned", entries, ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {}, ...fallback };
   const moved = [];
   const verifyArchive = (entry) => {
     assertSafePath(entry.archive);
@@ -21185,7 +21502,7 @@ function archiveNativeSkillsUnlocked(inventory, options, assertCurrent) {
   const created = [];
   for (let path = archiveRoot;!existsSync9(path); path = dirname22(path))
     created.push(path);
-  mkdirSync8(archiveRoot, { recursive: true, mode: 448 });
+  mkdirSync9(archiveRoot, { recursive: true, mode: 448 });
   try {
     for (const directory2 of created)
       syncArchiveDirectory(directory2);
@@ -21268,7 +21585,7 @@ function archiveNativeSkillsUnlocked(inventory, options, assertCurrent) {
     } catch {}
     throw new Error(`Native archive failed; inspect the recovery journal at ${receiptPath} before retrying.`, { cause: error });
   }
-  return { entries: entries.map(({ status, conflict, ...entry }) => entry), receiptPath, ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
+  return { entries: entries.map(({ status, conflict, ...entry }) => entry), receiptPath, ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {}, ...fallback };
 }
 function classifiedCodexPluginCacheCopy(entry, cache, read2, admit) {
   try {
@@ -21716,7 +22033,7 @@ function packageSourceRoots(source) {
 function containsSkillDirectories(path) {
   let entries;
   try {
-    entries = readdirSync11(path);
+    entries = readdirSync12(path);
   } catch {
     return false;
   }
@@ -21811,12 +22128,16 @@ function writeManagedAgentSkill(params) {
     agent: params.agent,
     path: result.path,
     action: result.action,
-    ...result.reason ? { reason: result.reason } : {}
+    ...result.reason ? { reason: result.reason } : {},
+    ...result.nativeAdmission ? { nativeAdmission: result.nativeAdmission, nativeAdmissionProbe: result.nativeAdmissionProbe } : {}
   };
 }
 function writeManagedSkillDir(dir, skillMd, options) {
   const root = options.dryRun ? undefined : codexCorpusRootForPath(dir);
-  return withCodexCorpusWrite(root ? [root] : [], (assertCurrent) => writeManagedSkillDirUnlocked(dir, skillMd, options, assertCurrent), options);
+  return withCodexCorpusWrite(root ? [root] : [], (assertCurrent, admission) => {
+    const result = writeManagedSkillDirUnlocked(dir, skillMd, options, assertCurrent);
+    return { ...result, ...codexAdmissionReceipt(admission) };
+  }, options);
 }
 function writeManagedSkillDirUnlocked(dir, skillMd, options, assertCurrent) {
   const skillMdPath = join32(dir, "SKILL.md");
@@ -21857,8 +22178,8 @@ function writeManagedSkillDirUnlocked(dir, skillMd, options, assertCurrent) {
   if (options.dryRun)
     return { action, path: skillMdPath };
   const parentDir = dirname23(dir);
-  mkdirSync9(parentDir, { recursive: true });
-  const transactionDir = mkdtempSync(join32(parentDir, `.hasna-skills-write-${basename12(dir)}-`));
+  mkdirSync10(parentDir, { recursive: true });
+  const transactionDir = mkdtempSync2(join32(parentDir, `.hasna-skills-write-${basename12(dir)}-`));
   const candidateDir = join32(transactionDir, "candidate");
   const backupDir = join32(transactionDir, "backup");
   const candidateSkillMdPath = join32(candidateDir, "SKILL.md");
@@ -21876,7 +22197,7 @@ function writeManagedSkillDirUnlocked(dir, skillMd, options, assertCurrent) {
     if (options.resourceDir) {
       cpSync2(options.resourceDir, candidateDir, { recursive: true, force: true });
     } else {
-      mkdirSync9(candidateDir, { recursive: true });
+      mkdirSync10(candidateDir, { recursive: true });
     }
     writeFileSync7(candidateSkillMdPath, skillMd.endsWith(`
 `) ? skillMd : `${skillMd}
@@ -21900,7 +22221,7 @@ function writeManagedSkillDirUnlocked(dir, skillMd, options, assertCurrent) {
       try {
         assertCurrent();
         if (existsSync10(dir))
-          rmSync2(dir, { recursive: true, force: true });
+          rmSync3(dir, { recursive: true, force: true });
         renameDirectory(backupDir, dir);
         originalMoved = false;
       } catch (rollbackError) {
@@ -21913,22 +22234,26 @@ function writeManagedSkillDirUnlocked(dir, skillMd, options, assertCurrent) {
     if (!preserveTransaction) {
       try {
         assertCurrent();
-        rmSync2(transactionDir, { recursive: true, force: true });
+        rmSync3(transactionDir, { recursive: true, force: true });
       } catch {}
     }
   }
   return { action, path: skillMdPath };
 }
 function removeManagedAgentSkill(skill, agent, homeDir2 = homedir3(), options = {}) {
+  const record5 = codexAdmissionRecord(options);
   const dir = join32(agentGlobalSkillsDir(agent, homeDir2), skill);
   const root = codexCorpusRootForPath(dir);
-  return withCodexCorpusWrite(root ? [root] : [], () => removeManagedAgentSkillUnlocked(skill, agent, homeDir2, options), options);
+  return withCodexCorpusWrite(root ? [root] : [], (_assertCurrent, admission) => {
+    record5.deliver(admission);
+    return removeManagedAgentSkillUnlocked(skill, agent, homeDir2, options);
+  }, options, record5.policy);
 }
 function removeManagedAgentSkillUnlocked(skill, agent, homeDir2 = homedir3(), options = {}) {
   const dir = join32(agentGlobalSkillsDir(agent, homeDir2), skill);
   if (!hasSkillsOwnershipMarker(dir))
     return false;
-  rmSync2(dir, { recursive: true, force: true });
+  rmSync3(dir, { recursive: true, force: true });
   return true;
 }
 function sourceSkillMd(skillPath, name, description, kind, preferBundledDocs = false) {
@@ -21975,7 +22300,7 @@ function resolveSkillAlias(name) {
 }
 
 // src/lib/project-state.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync10, readFileSync as readFileSync21, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync11, readFileSync as readFileSync21, writeFileSync as writeFileSync8 } from "fs";
 import { join as join33 } from "path";
 var VALID_PIN_SOURCES = [
   "official",
@@ -22022,7 +22347,7 @@ function ensureProjectConfig(targetDir = process.cwd()) {
 }
 function saveProjectConfig(config, targetDir = process.cwd()) {
   const dir = getProjectStateDir(targetDir);
-  mkdirSync10(dir, { recursive: true });
+  mkdirSync11(dir, { recursive: true });
   const normalized2 = normalizeProjectConfig({ ...config, updatedAt: new Date().toISOString() });
   writeFileSync8(getProjectConfigPath(targetDir), JSON.stringify(normalized2, null, 2) + `
 `);
@@ -22291,15 +22616,20 @@ function installSkillForAgent(name, options, generateSkillMd) {
     codexCommand: options.codexCommand,
     codexSha256: options.codexSha256
   });
+  const fallback = result.nativeAdmission ? { nativeAdmission: result.nativeAdmission, nativeAdmissionProbe: result.nativeAdmissionProbe } : {};
   if (result.action === "skip") {
-    return { skill: canonicalName, success: false, error: result.reason ?? "skipped", path: result.path };
+    return { skill: canonicalName, success: false, error: result.reason ?? "skipped", path: result.path, ...fallback };
   }
-  return { skill: canonicalName, success: true, path: result.path };
+  return { skill: canonicalName, success: true, path: result.path, ...fallback };
 }
 function removeSkillForAgent(name, options) {
+  const record5 = codexAdmissionRecord(options);
   const dir = getAgentSkillPath(name, options.agent, options.scope ?? "global", options.projectDir);
   const root = codexCorpusRootForPath(dir);
-  return withCodexCorpusWrite(root ? [root] : [], () => removeSkillForAgentUnlocked(name, options), options);
+  return withCodexCorpusWrite(root ? [root] : [], (_assertCurrent, admission) => {
+    record5.deliver(admission);
+    return removeSkillForAgentUnlocked(name, options);
+  }, options, record5.policy);
 }
 function removeSkillForAgentUnlocked(name, options) {
   const canonicalName = getCanonicalSkillName(name);
@@ -22307,7 +22637,7 @@ function removeSkillForAgentUnlocked(name, options) {
   const dir = getAgentSkillPath(canonicalName, options.agent, scope, options.projectDir);
   if (!hasSkillsOwnershipMarker(dir))
     return false;
-  rmSync3(dir, { recursive: true, force: true });
+  rmSync4(dir, { recursive: true, force: true });
   return true;
 }
 function resolveAgentSkillMd(name, generateSkillMd) {
@@ -24465,13 +24795,13 @@ function assertProjectDiscovery(agent, directories, home, canonical9 = resolve27
       for (const name of ["plugin", "plugins"]) {
         const path = canonical9(join38(directory2, ".sumi", name));
         safe6(path);
-        if (lstatSync32(path, { throwIfNoEntry: false })?.isDirectory() && readdirSync12(path).length)
+        if (lstatSync32(path, { throwIfNoEntry: false })?.isDirectory() && readdirSync13(path).length)
           throw new Error(`NATIVE_SKILL_DRIFT: project Sumi plugins require a dedicated discovery review: ${path}`);
       }
     if (agent === "claude") {
       const commands = canonical9(join38(directory2, ".claude/commands"));
       safe6(commands);
-      if (lstatSync32(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync12(commands).length)
+      if (lstatSync32(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync13(commands).length)
         throw new Error("NATIVE_SKILL_DRIFT: legacy project command discovery requires a dedicated format adapter");
     }
   }
@@ -24620,7 +24950,7 @@ function resolveAgentDiscovery(options) {
     for (const path of plugins) {
       safe6(path);
       if (lstatSync32(path, { throwIfNoEntry: false })?.isDirectory())
-        for (const name of readdirSync12(path).sort()) {
+        for (const name of readdirSync13(path).sort()) {
           if (name === "skills-cli.js" && path === plugins[1])
             continue;
           const target = join38(path, name);
@@ -24631,7 +24961,7 @@ function resolveAgentDiscovery(options) {
     }
     for (const root2 of roots) {
       safe6(root2);
-      if (lstatSync32(root2, { throwIfNoEntry: false })?.isDirectory() && readdirSync12(root2).some((name) => name.endsWith(".md")))
+      if (lstatSync32(root2, { throwIfNoEntry: false })?.isDirectory() && readdirSync13(root2).some((name) => name.endsWith(".md")))
         unresolved("flat markdown skills require a dedicated native migration adapter");
     }
   }
@@ -24675,7 +25005,7 @@ function resolveAgentDiscovery(options) {
       safe6(builtinRoot);
       if (!lstatSync32(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
         unresolved("installed Gemini builtin root is missing");
-      for (const name of readdirSync12(builtinRoot).sort()) {
+      for (const name of readdirSync13(builtinRoot).sort()) {
         const text2 = witness(join38(builtinRoot, name, "SKILL.md"));
         const match = text2?.match(/^---\r?\n[\s\S]*?^name:\s*([a-z0-9][a-z0-9-]*)\s*$/m);
         if (!match?.[1] || builtinNames.includes(match[1]))
@@ -24773,7 +25103,7 @@ function resolveAgentDiscovery(options) {
       unresolved("plugin hooks require a separate no-skill-injection review");
     const commands = join38(root2, "commands");
     safe6(commands);
-    if (agent === "claude" && (manifest.commands !== undefined || lstatSync32(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync12(commands).length))
+    if (agent === "claude" && (manifest.commands !== undefined || lstatSync32(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync13(commands).length))
       unresolved("legacy command discovery requires retirement or a dedicated format adapter");
     const rootSkill = witness(join38(root2, "SKILL.md"));
     if (rootSkill !== null)
@@ -24795,7 +25125,7 @@ function resolveAgentDiscovery(options) {
     const installed = registrations === null ? {} : parseConfig(registrations, join38(home, ".claude/plugins/installed_plugins.json")).plugins;
     const commands = canonical9(join38(home, ".claude/commands"));
     safe6(commands);
-    if (lstatSync32(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync12(commands).length)
+    if (lstatSync32(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync13(commands).length)
       unresolved("legacy home command discovery requires a dedicated format adapter");
     for (const [id, enabled] of Object.entries(config.enabledPlugins ?? {})) {
       if (enabled === false)
@@ -24837,7 +25167,7 @@ function resolveAgentDiscovery(options) {
     }
     const localPlugins = join38(home, ".config/opencode/plugins");
     safe6(localPlugins);
-    if (lstatSync32(localPlugins, { throwIfNoEntry: false }) && readdirSync12(localPlugins).some((name) => name !== "skills-cli.js"))
+    if (lstatSync32(localPlugins, { throwIfNoEntry: false }) && readdirSync13(localPlugins).some((name) => name !== "skills-cli.js"))
       unresolved("additional local plugin hooks require review");
   } else if (agent === "sumi") {
     if ((config.plugin?.length ?? 0) > 0 || (config.plugins?.length ?? 0) > 0 || sources.some((source) => source.path !== canonical9(configPath) && source.path !== canonical9(join38(sumiConfigDirectory(home), "sumi.jsonc")) && source.sha256 !== null))
@@ -24856,7 +25186,7 @@ function resolveAgentDiscovery(options) {
     const directory2 = join38(home, ".gemini/extensions");
     safe6(directory2);
     if (lstatSync32(directory2, { throwIfNoEntry: false }))
-      for (const name of readdirSync12(directory2)) {
+      for (const name of readdirSync13(directory2)) {
         const root2 = join38(directory2, name);
         safe6(root2);
         if (!lstatSync32(root2)?.isDirectory())
@@ -24901,7 +25231,7 @@ function physicalPath(path) {
   }
   return resolve28(realpathSync14(cursor), ...suffix);
 }
-function contains(root2, path) {
+function contains2(root2, path) {
   return path === root2 || path.startsWith(root2 + sep16);
 }
 function configuredRoots(home, explicitHome) {
@@ -24954,14 +25284,14 @@ function assertPortableAuthoringPath(path, options = {}) {
   const defaults = NATIVE_DISCOVERY_ROOTS.map((parts) => join39(home, ...parts));
   defaults.push(join39(home, ".codex/plugins/cache"), join39(home, ".claude/plugins/cache"), join39(home, ".claude/plugins/synced"), join39(home, ".gemini/extensions"));
   for (const root2 of defaults) {
-    if (candidates.some((candidate2) => contains(resolve28(root2), candidate2) || contains(physicalPath(root2), candidate2)))
+    if (candidates.some((candidate2) => contains2(resolve28(root2), candidate2) || contains2(physicalPath(root2), candidate2)))
       native ??= root2;
   }
   if (native) {
     throw new Error(`Refusing portable Skills authoring below native discovery root '${native}': ${lexical}. Set HASNA_SKILLS_DIR to a private authoring corpus outside native roots.`);
   }
   for (const root2 of configuredRoots(home, options.homeDir !== undefined)) {
-    if (candidates.some((candidate2) => contains(resolve28(root2), candidate2) || contains(physicalPath(root2), candidate2))) {
+    if (candidates.some((candidate2) => contains2(resolve28(root2), candidate2) || contains2(physicalPath(root2), candidate2))) {
       throw new Error(`Refusing portable Skills authoring below configured native discovery root: ${lexical}`);
     }
   }
@@ -25004,7 +25334,7 @@ function listPortableSkills(options = {}) {
   if (!safeIsDirectory(root2))
     return [];
   const skills = [];
-  for (const entry of readdirSync13(root2).sort()) {
+  for (const entry of readdirSync14(root2).sort()) {
     if (entry.startsWith("."))
       continue;
     const path = join40(root2, entry);
@@ -25048,7 +25378,7 @@ function scaffoldPortableSkill(name, options = {}) {
   if (existsSync14(skillPath)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${skillPath}`);
-    rmSync4(skillPath, { recursive: true, force: true });
+    rmSync5(skillPath, { recursive: true, force: true });
   }
   const kind = options.kind ?? "executable";
   const description = options.description ?? `${displayName(skillName)} skill`;
@@ -25075,7 +25405,7 @@ function portPortableSkillDirectory(sourceDir, options = {}) {
   };
   const imported = [];
   const skipped = [];
-  const entries = readdirSync13(absoluteSource, { withFileTypes: true }).map((entry) => entry.name).filter((entryName) => !entryName.startsWith(".")).sort();
+  const entries = readdirSync14(absoluteSource, { withFileTypes: true }).map((entry) => entry.name).filter((entryName) => !entryName.startsWith(".")).sort();
   for (const entryName of entries) {
     const childPath = join40(absoluteSource, entryName);
     if (!safeIsDirectory(childPath))
@@ -25120,11 +25450,11 @@ function physicalImportPath(path) {
 function assertDisjointImportPaths(source, destination) {
   const sourcePath = realpathSync15(source);
   const destinationPath = physicalImportPath(destination);
-  const contains2 = (parent, child2) => {
+  const contains3 = (parent, child2) => {
     const path = relative11(parent, child2);
     return path === "" || !isAbsolute29(path) && path !== ".." && !path.startsWith(`..${sep17}`);
   };
-  if (contains2(sourcePath, destinationPath) || contains2(destinationPath, sourcePath)) {
+  if (contains3(sourcePath, destinationPath) || contains3(destinationPath, sourcePath)) {
     throw new Error("Source and destination skill directories must not overlap");
   }
 }
@@ -25151,9 +25481,9 @@ function portPortableSkill(sourcePath, options = {}) {
   if (existsSync14(destination)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${destination}`);
-    rmSync4(destination, { recursive: true, force: true });
+    rmSync5(destination, { recursive: true, force: true });
   }
-  mkdirSync11(dirname28(destination), { recursive: true });
+  mkdirSync12(dirname28(destination), { recursive: true });
   copySkillDirectory(absoluteSource, destination);
   const base = {
     ...inferred,
@@ -25195,7 +25525,7 @@ function writeCorpusSkill(input, options = {}) {
   const skillPath = join40(root2, name);
   assertPortableAuthoringPath(skillPath, options);
   const created = !existsSync14(skillPath);
-  mkdirSync11(skillPath, { recursive: true });
+  mkdirSync12(skillPath, { recursive: true });
   writeFileSync9(join40(skillPath, "SKILL.md"), input.skillMd);
   const manifest = buildCorpusManifest(input, name);
   writeSkillJsonWithHash(skillPath, manifest);
@@ -25209,8 +25539,8 @@ function installCorpusSkillAtomically(input, options = {}) {
   const target = join40(root2, name);
   assertPortableAuthoringPath(target, options);
   const created = !existsSync14(target);
-  mkdirSync11(root2, { recursive: true });
-  const staging = mkdtempSync2(join40(root2, `.pull-${name}-`));
+  mkdirSync12(root2, { recursive: true });
+  const staging = mkdtempSync3(join40(root2, `.pull-${name}-`));
   let moved = false;
   let backup = null;
   try {
@@ -25218,16 +25548,16 @@ function installCorpusSkillAtomically(input, options = {}) {
     const manifest = buildCorpusManifest(input, name);
     writeSkillJsonWithHash(staging, manifest);
     if (existsSync14(target)) {
-      backup = mkdtempSync2(join40(root2, `.pull-backup-${name}-`));
+      backup = mkdtempSync3(join40(root2, `.pull-backup-${name}-`));
       renameSync6(target, join40(backup, name));
       moved = true;
     }
     renameSync6(staging, target);
     if (moved && backup)
-      rmSync4(backup, { recursive: true, force: true });
+      rmSync5(backup, { recursive: true, force: true });
     return { name, path: target, manifest, created };
   } catch (error) {
-    rmSync4(staging, { recursive: true, force: true });
+    rmSync5(staging, { recursive: true, force: true });
     if (moved && backup && existsSync14(join40(backup, name))) {
       try {
         renameSync6(join40(backup, name), target);
@@ -25523,7 +25853,7 @@ function discoverSkillsInDir(dir, source = "custom") {
     return [];
   const result = [];
   try {
-    const entries = readdirSync14(dir, { withFileTypes: true });
+    const entries = readdirSync15(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
@@ -25559,7 +25889,7 @@ function findExtensionSkillPath(name) {
   if (!config.extensionsDir || !existsSync15(config.extensionsDir))
     return null;
   try {
-    const entries = readdirSync14(config.extensionsDir, { withFileTypes: true });
+    const entries = readdirSync15(config.extensionsDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
@@ -25634,7 +25964,7 @@ function getAllTags(catalog) {
 }
 // src/lib/run-state.ts
 import { createHash as createHash31, randomBytes } from "crypto";
-import { existsSync as existsSync16, mkdirSync as mkdirSync12, readFileSync as readFileSync28, readdirSync as readdirSync15, statSync as statSync14, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync13, readFileSync as readFileSync28, readdirSync as readdirSync16, statSync as statSync14, writeFileSync as writeFileSync10 } from "fs";
 import { extname, join as join42, relative as relative12 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now = new Date;
@@ -25645,9 +25975,9 @@ function createSkillRun(params, targetDir = process.cwd()) {
   const runDir = join42(root2, "runs", day, id);
   const logsDir = join42(runDir, "logs");
   const exportDir = join42(root2, "exports", skillName, id);
-  mkdirSync12(logsDir, { recursive: true });
-  mkdirSync12(exportDir, { recursive: true });
-  mkdirSync12(join42(root2, "tmp"), { recursive: true });
+  mkdirSync13(logsDir, { recursive: true });
+  mkdirSync13(exportDir, { recursive: true });
+  mkdirSync13(join42(root2, "tmp"), { recursive: true });
   const record5 = {
     id,
     skill: skillName,
@@ -25714,11 +26044,11 @@ function listSkillRuns(targetDir = process.cwd(), limit = 50) {
   if (!existsSync16(runsRoot))
     return [];
   const records = [];
-  for (const day of readdirSync15(runsRoot).sort().reverse()) {
+  for (const day of readdirSync16(runsRoot).sort().reverse()) {
     const dayDir = join42(runsRoot, day);
     if (!statSync14(dayDir).isDirectory())
       continue;
-    for (const runId of readdirSync15(dayDir).sort().reverse()) {
+    for (const runId of readdirSync16(dayDir).sort().reverse()) {
       const record5 = readRunRecord(join42(dayDir, runId));
       if (record5)
         records.push(record5);
@@ -25732,7 +26062,7 @@ function findSkillRun(runId, targetDir = process.cwd()) {
   const runsRoot = join42(getProjectStateDir(targetDir), "runs");
   if (!existsSync16(runsRoot))
     return null;
-  for (const day of readdirSync15(runsRoot)) {
+  for (const day of readdirSync16(runsRoot)) {
     const record5 = readRunRecord(join42(runsRoot, day, runId));
     if (record5)
       return record5;
@@ -25778,7 +26108,7 @@ function readRunRecord(runDir) {
 }
 function walkFiles(dir) {
   const files = [];
-  for (const entry of readdirSync15(dir)) {
+  for (const entry of readdirSync16(dir)) {
     const full = join42(dir, entry);
     if (statSync14(full).isDirectory())
       files.push(...walkFiles(full));
@@ -47286,7 +47616,7 @@ async function createRemoteSkillsClient(env = process.env) {
   return connection ? new RemoteSkillsClient(connection.apiKey, connection.apiOrigin) : null;
 }
 // src/lib/scheduler.ts
-import { existsSync as existsSync17, readFileSync as readFileSync29, writeFileSync as writeFileSync11, mkdirSync as mkdirSync13 } from "fs";
+import { existsSync as existsSync17, readFileSync as readFileSync29, writeFileSync as writeFileSync11, mkdirSync as mkdirSync14 } from "fs";
 import { join as join43 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
   return join43(targetDir, ".skills", "schedules.json");
@@ -47304,7 +47634,7 @@ function saveSchedules(data, targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
   const dir = join43(targetDir, ".skills");
   if (!existsSync17(dir))
-    mkdirSync13(dir, { recursive: true });
+    mkdirSync14(dir, { recursive: true });
   writeFileSync11(path, JSON.stringify(data, null, 2));
 }
 function validateCronField(expr, min, max, label) {
@@ -47518,7 +47848,7 @@ function revisionIdOfRecord(record10) {
   return revisionIdOf(record10);
 }
 // src/lib/pull.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync14, mkdtempSync as mkdtempSync3, readFileSync as readFileSync30, renameSync as renameSync7, rmSync as rmSync5, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync15, mkdtempSync as mkdtempSync4, readFileSync as readFileSync30, renameSync as renameSync7, rmSync as rmSync6, writeFileSync as writeFileSync12 } from "fs";
 import { dirname as dirname29, join as join44 } from "path";
 
 // src/lib/skill-bundles.ts
@@ -47713,7 +48043,7 @@ function reconcileTombstone(slug2, corpusOptions) {
   if (!hasSkillsOwnershipMarker(target)) {
     return { name: slug2, success: true, tombstoned: true, removed: false, leftInPlace: true };
   }
-  rmSync5(target, { recursive: true, force: true });
+  rmSync6(target, { recursive: true, force: true });
   return { name: slug2, success: true, tombstoned: true, removed: true };
 }
 function readPullMarker(dir) {
@@ -47852,16 +48182,16 @@ function verifyBundleResponseBytes(buffer, response, verify = {}) {
 }
 function installBundleAtomically(name, entries, options = {}, marker = {}) {
   const root2 = getPortableSkillsRoot(options);
-  mkdirSync14(root2, { recursive: true });
+  mkdirSync15(root2, { recursive: true });
   const target = join44(root2, name);
   const created = !existsSync18(target);
-  const staging = mkdtempSync3(join44(root2, `.pull-${name}-`));
+  const staging = mkdtempSync4(join44(root2, `.pull-${name}-`));
   let moved = false;
   let backup = null;
   try {
     for (const entry of entries) {
       const destination = join44(staging, entry.path);
-      mkdirSync14(dirname29(destination), { recursive: true });
+      mkdirSync15(dirname29(destination), { recursive: true });
       writeFileSync12(destination, entry.bytes, { mode: entry.mode });
     }
     writePullMarker(staging, {
@@ -47873,15 +48203,15 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
       ...marker.revisionId ? { revisionId: marker.revisionId } : {}
     });
     if (existsSync18(target)) {
-      backup = mkdtempSync3(join44(root2, `.pull-backup-${name}-`));
+      backup = mkdtempSync4(join44(root2, `.pull-backup-${name}-`));
       renameSync7(target, join44(backup, name));
       moved = true;
     }
     renameSync7(staging, target);
     if (moved && backup)
-      rmSync5(backup, { recursive: true, force: true });
+      rmSync6(backup, { recursive: true, force: true });
   } catch (error61) {
-    rmSync5(staging, { recursive: true, force: true });
+    rmSync6(staging, { recursive: true, force: true });
     if (moved && backup && existsSync18(join44(backup, name))) {
       try {
         renameSync7(join44(backup, name), target);
@@ -48764,7 +49094,7 @@ function findSkillsParityForMcpTool(tool) {
   return SKILLS_CLI_MCP_PARITY.find((entry) => entry.mcpTools.includes(tool));
 }
 // src/lib/registry-sync.ts
-import { mkdirSync as mkdirSync15, writeFileSync as writeFileSync13 } from "fs";
+import { mkdirSync as mkdirSync16, writeFileSync as writeFileSync13 } from "fs";
 import { dirname as dirname30, relative as relative13 } from "path";
 function createRegistrySyncArtifact(options = {}) {
   const profile = options.profile ?? "all";
@@ -48822,7 +49152,7 @@ function createRegistrySyncArtifact(options = {}) {
   };
 }
 function writeRegistrySyncArtifact(path, artifact) {
-  mkdirSync15(dirname30(path), { recursive: true });
+  mkdirSync16(dirname30(path), { recursive: true });
   writeFileSync13(path, `${JSON.stringify(artifact, null, 2)}
 `);
 }
@@ -49906,7 +50236,7 @@ function clone3(value) {
   return JSON.parse(JSON.stringify(value));
 }
 // src/lib/feedback.ts
-import { appendFileSync, existsSync as existsSync19, mkdirSync as mkdirSync16 } from "fs";
+import { appendFileSync, existsSync as existsSync19, mkdirSync as mkdirSync17 } from "fs";
 import { dirname as dirname31, join as join45 } from "path";
 import { Database } from "bun:sqlite";
 function getFeedbackDbPath() {
@@ -49916,7 +50246,7 @@ function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
   const dir = dirname31(dbPath);
   if (!existsSync19(dir))
-    mkdirSync16(dir, { recursive: true });
+    mkdirSync17(dir, { recursive: true });
   const db = new Database(dbPath);
   db.exec("PRAGMA journal_mode = WAL");
   db.exec([
@@ -49945,7 +50275,7 @@ function saveFeedback(input2) {
     const path = join45(getDataDir(), "feedback.jsonl");
     const dir = dirname31(path);
     if (!existsSync19(dir))
-      mkdirSync16(dir, { recursive: true });
+      mkdirSync17(dir, { recursive: true });
     appendFileSync(path, JSON.stringify({ message, category, email: input2.email ?? null, agent: input2.agent ?? null, version: input2.version ?? null, createdAt: new Date().toISOString() }) + `
 `);
     return { saved: true, category, path };
@@ -49969,9 +50299,9 @@ function isApiMode(env = process.env) {
 import { createHash as createHash35, createHmac as createHmac2 } from "crypto";
 import {
   existsSync as existsSync20,
-  mkdirSync as mkdirSync17,
+  mkdirSync as mkdirSync18,
   readFileSync as readFileSync31,
-  readdirSync as readdirSync16,
+  readdirSync as readdirSync17,
   statSync as statSync15,
   writeFileSync as writeFileSync14
 } from "fs";
@@ -50171,7 +50501,7 @@ function importSkillsLocalSnapshot(snapshot2, targetDir = process.cwd(), options
     if (hash5 !== file2.sha256) {
       throw new Error(`Snapshot file checksum mismatch: ${file2.path}`);
     }
-    mkdirSync17(dirname32(absolutePath5), { recursive: true });
+    mkdirSync18(dirname32(absolutePath5), { recursive: true });
     writeFileSync14(absolutePath5, bytes);
     written += 1;
   }
@@ -50468,7 +50798,7 @@ function parsePositiveInteger(value) {
 }
 function walkFiles2(dir) {
   const files = [];
-  for (const entry of readdirSync16(dir)) {
+  for (const entry of readdirSync17(dir)) {
     const full = join46(dir, entry);
     const stats = statSync15(full);
     if (stats.isDirectory())
@@ -50554,7 +50884,7 @@ function toArrayBuffer(bytes) {
 import { createHash as createHash36 } from "crypto";
 import {
   copyFileSync,
-  mkdirSync as mkdirSync18,
+  mkdirSync as mkdirSync19,
   readFileSync as readFileSync32,
   statSync as statSync17,
   writeFileSync as writeFileSync15
@@ -50562,7 +50892,7 @@ import {
 import { dirname as dirname33, isAbsolute as isAbsolute31, relative as relative15, resolve as resolve30, sep as sep20 } from "path";
 
 // src/lib/portable-snapshot-filter.ts
-import { readdirSync as readdirSync17, statSync as statSync16 } from "fs";
+import { readdirSync as readdirSync18, statSync as statSync16 } from "fs";
 import { homedir as homedir7 } from "os";
 import { join as join47, sep as sep19 } from "path";
 var SYNC_HOMES = [
@@ -50671,7 +51001,7 @@ function destinationFor(definition, stationId, relativePath) {
 function walkEntries(absoluteRoot) {
   let entries;
   try {
-    entries = readdirSync17(absoluteRoot, { withFileTypes: true });
+    entries = readdirSync18(absoluteRoot, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -50847,7 +51177,7 @@ function writeStationSnapshot(options) {
   let written = 0;
   for (const plan of untouched) {
     const destination = resolve30(repoRoot, plan.destination);
-    mkdirSync18(dirname33(destination), { recursive: true });
+    mkdirSync19(dirname33(destination), { recursive: true });
     copyFileSync(plan.source.fullPath, destination);
     written += 1;
   }
@@ -50866,7 +51196,7 @@ function writeStationSnapshot(options) {
     files: manifestFiles
   };
   const manifestPath = resolve30(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
-  mkdirSync18(dirname33(manifestPath), { recursive: true });
+  mkdirSync19(dirname33(manifestPath), { recursive: true });
   writeFileSync15(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `);
   return {
@@ -50880,8 +51210,8 @@ function writeStationSnapshot(options) {
 import { createHash as createHash37 } from "crypto";
 import {
   copyFileSync as copyFileSync2,
-  mkdirSync as mkdirSync19,
-  readdirSync as readdirSync18,
+  mkdirSync as mkdirSync20,
+  readdirSync as readdirSync19,
   readFileSync as readFileSync33,
   statSync as statSync18,
   writeFileSync as writeFileSync16
@@ -50928,7 +51258,7 @@ function planStationHydration(stationId, repoRoot) {
     const agentRoot = join48(snapshotRoot, "agent-homes", agent);
     let identEntries;
     try {
-      identEntries = readdirSync18(agentRoot, { withFileTypes: true });
+      identEntries = readdirSync19(agentRoot, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -51142,7 +51472,7 @@ function writeStationHydration(options) {
   }
   let written = 0;
   for (const entry of toWrite) {
-    mkdirSync19(dirname34(entry.destination), { recursive: true });
+    mkdirSync20(dirname34(entry.destination), { recursive: true });
     copyFileSync2(entry.fullPath, entry.destination);
     written += 1;
   }
@@ -51164,7 +51494,7 @@ function writeStationHydration(options) {
     skills: resultSkills
   };
   const hydrationManifestPath = join48(dirname34(cacheRoot), `hydration-${options.stationId}.json`);
-  mkdirSync19(dirname34(hydrationManifestPath), { recursive: true });
+  mkdirSync20(dirname34(hydrationManifestPath), { recursive: true });
   writeFileSync16(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
 `);
   return {
@@ -51175,7 +51505,7 @@ function writeStationHydration(options) {
   };
 }
 // src/lib/private-publication-recovery.ts
-import { constants as constants21, closeSync as closeSync20, fsyncSync as fsyncSync8, fstatSync as fstatSync20, lstatSync as lstatSync34, mkdirSync as mkdirSync20, openSync as openSync20, readSync as readSync15, realpathSync as realpathSync16, renameSync as renameSync8, unlinkSync as unlinkSync6, writeFileSync as writeFileSync17 } from "fs";
+import { constants as constants21, closeSync as closeSync20, fsyncSync as fsyncSync8, fstatSync as fstatSync20, lstatSync as lstatSync34, mkdirSync as mkdirSync21, openSync as openSync20, readSync as readSync15, realpathSync as realpathSync16, renameSync as renameSync8, unlinkSync as unlinkSync6, writeFileSync as writeFileSync17 } from "fs";
 import { dirname as dirname35, isAbsolute as isAbsolute32, join as join49, resolve as resolve32 } from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 var fail3 = () => {
@@ -51322,7 +51652,7 @@ async function preparePrivatePublication(client2, sourceDirectory, recoveryDirec
   };
   if (!isAbsolute32(recoveryDirectory) || resolve32(recoveryDirectory) !== recoveryDirectory || realpathSync16(dirname35(recoveryDirectory)) !== dirname35(recoveryDirectory))
     return fail3();
-  mkdirSync20(recoveryDirectory, { mode: 448 });
+  mkdirSync21(recoveryDirectory, { mode: 448 });
   safeDirectory(recoveryDirectory);
   const parent = openSync20(dirname35(recoveryDirectory), constants21.O_RDONLY | constants21.O_NOFOLLOW);
   try {
@@ -51646,7 +51976,7 @@ function applySessionReconciliation(snapshot2, target, planned, record12, verifi
 }
 // src/lib/claude-prospective-review.ts
 import { createHash as createHash40 } from "crypto";
-import { lstatSync as lstatSync35, readFileSync as readFileSync34, readdirSync as readdirSync19, realpathSync as realpathSync17 } from "fs";
+import { lstatSync as lstatSync35, readFileSync as readFileSync34, readdirSync as readdirSync20, realpathSync as realpathSync17 } from "fs";
 import { basename as basename18, dirname as dirname36, isAbsolute as isAbsolute33, join as join50, relative as relative16, resolve as resolve34, sep as sep22 } from "path";
 var MAX_CANDIDATE_FILES = 16384;
 var MAX_CANDIDATE_BYTES = 256 * 1024 * 1024;
@@ -51693,7 +52023,7 @@ function captureClaudeProspectiveCandidateClosure(root2) {
   let bytes = 0;
   const walk2 = (directory3) => {
     const beforeDirectory = lstatSync35(directory3);
-    const names = readdirSync19(directory3).sort();
+    const names = readdirSync20(directory3).sort();
     if (new Set(names).size !== names.length)
       refuse6("candidate contains ambiguous directory entries");
     for (const name of names) {