@hasna/skills 0.10.88 → 0.10.90

package/bin/index.js

@@ -36888,7 +36888,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.88",
+    version: "0.10.90",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -40737,7 +40737,8 @@ var init_codex_native_compatibility = __esm(() => {
     "codex-cli 0.162.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
     "codex-cli 0.163.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
     "codex-cli 0.164.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
-    "codex-cli 0.165.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
+    "codex-cli 0.165.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
+    "codex-cli 0.166.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
   };
   SUPPORTED_CODEX_HOOK_VERSIONS = Object.freeze(Object.keys(MEASURED_CODEX_CAPABILITIES).filter((version) => supportsCodexNativeCapability(version, "hooks")));
 });
@@ -63619,6 +63620,7 @@ var init_selected_document = __esm(() => {
 });
 
 // src/lib/selection-resolver.ts
+import { isDeepStrictEqual as isDeepStrictEqual11 } from "util";
 async function syncSelectionProfile(profileId, options = {}) {
   const client = options.client ?? await createProfileClient();
   const profile = await client.resolveProfile(profileId);
@@ -63743,21 +63745,70 @@ function unknownNameRefusal(slug, profile) {
   return `Skill '${slug}' is not selected by this Skills profile or project lock.${hint} ` + `Read the accepted names with 'skills search <term>' or 'skills list --all --json'; accept one with 'skills pin <name>'. ${ACCEPTED_FORM}`;
 }
 async function loadSelectedSkill(spec, profileId, options = {}) {
-  const context = await resolveSelectionContext(profileId, options);
+  if (!options.cacheFirst)
+    return readSelectedSkill(spec, profileId, options);
+  const { cacheFirst: _cacheFirst, cached: _cached, authority, ...service } = options;
+  try {
+    return await readSelectedSkill(spec, profileId, { ...service, authority, cached: true });
+  } catch (cacheError) {
+    if (!(cacheError instanceof SkillSelectionError) || !RECOVERABLE_CACHE_ERRORS.has(cacheError.code))
+      throw cacheError;
+    try {
+      return await readSelectedSkill(spec, profileId, service);
+    } catch (serviceError) {
+      if (!(serviceError instanceof SkillSelectionError) || serviceError.code !== "SKILLS_API_UNAVAILABLE")
+        throw serviceError;
+      throw new SkillSelectionError(cacheError.code, "The verified cache can't serve this load and the Skills service can't be reached from here, so it has to run where the network is available. `skills sync` doesn't renew a session's pin.");
+    }
+  }
+}
+async function readSelectedSkill(spec, profileId, options) {
+  const context = await resolveSelectionContext(profileId, options).catch((error) => {
+    if (options.cached && options.sessionId && error instanceof SkillSelectionError && error.code === "CACHED_PROFILE_EXPIRED" && readSkillSessionSnapshotIfExists(options.sessionId, options)) {
+      throw new SkillSelectionError("CACHED_PROFILE_EXPIRED", "This session's Skills pin was verified too long ago to read from the cache. Run the same command without --cached: that keeps the pin but needs the network and sign-in. `skills sync` doesn't renew a session's pin.");
+    }
+    throw error;
+  });
   const selection = exactProfileSelection(spec, context.receipt.profile);
   const entries = await readSelectedEntries(selection, context, options);
   const { file, content } = readSelectedDocument(entries, options.file);
   const receipt = { ...selection, file, source: options.cached ? "verified-cache" : "api", verifiedAt: context.receipt.verifiedAt };
-  if (options.sessionId) {
-    const session = {
-      ...context.receipt,
-      sessionId: options.sessionId,
-      loaded: [...new Set([...context.session?.loaded ?? [], selectionKey(selection)])],
-      ...context.projectLock ? { projectLock: context.projectLock } : {}
-    };
-    writeSkillSession(session, { current: context.sessionSnapshot, parent: context.parentSnapshot }, options);
+  const sessionRecorded = options.sessionId ? recordSessionLoad(options.sessionId, selection, context, options) : undefined;
+  return { content, selection, receipt, ...sessionRecorded === undefined ? {} : { sessionRecorded } };
+}
+function isUnwritableStore(error) {
+  for (let cause = error, depth = 0;cause && depth < 4; cause = cause.cause, depth++)
+    if (UNWRITABLE_CODES.has(cause.code))
+      return true;
+  return false;
+}
+function recordSessionLoad(sessionId, selection, context, options) {
+  const key2 = selectionKey(selection);
+  let snapshot2 = context.sessionSnapshot;
+  for (let attempt2 = 0;attempt2 < SESSION_LOAD_RECORD_ATTEMPTS; attempt2++) {
+    try {
+      const session = {
+        ...context.receipt,
+        sessionId,
+        loaded: [...new Set([...context.session?.loaded ?? [], key2])],
+        ...context.projectLock ? { projectLock: context.projectLock } : {}
+      };
+      writeSkillSession(session, { current: snapshot2, parent: context.parentSnapshot }, options);
+      return true;
+    } catch (error) {
+      const blocked = isUnwritableStore(error) || error instanceof SkillSelectionError && error.code === "SESSION_WRITE_BUSY";
+      if (!blocked && !(error instanceof SkillSelectionError && error.code === "SESSION_CONTEXT_CONFLICT"))
+        throw error;
+      const current = readSkillSessionSnapshotIfExists(sessionId, options);
+      if (current ? !isDeepStrictEqual11(current.receipt.profile, context.receipt.profile) : !blocked) {
+        throw new SkillSelectionError("SESSION_CONTEXT_CONFLICT", "The Skills session's pin changed while this skill was loading, so its content no longer belongs to that pin. Load it again.");
+      }
+      if (blocked)
+        return false;
+      snapshot2 = skillSessionSnapshotBinding(current);
+    }
   }
-  return { content, selection, receipt };
+  return false;
 }
 async function pinSelectedSkillVersion(spec, profileId, options) {
   const context = await resolveSelectionContext(profileId, options);
@@ -63786,13 +63837,15 @@ async function selectedSkillRequirements(spec, profileId, options = {}) {
   }
   return { ...getSkillRequirementsFromContent(selection.slug, texts, dependencies), selection };
 }
-var ACCEPTED_FORM = "Accepted form: '<slug>' or '<slug>@<version>'.";
+var ACCEPTED_FORM = "Accepted form: '<slug>' or '<slug>@<version>'.", RECOVERABLE_CACHE_ERRORS, SESSION_LOAD_RECORD_ATTEMPTS = 8, UNWRITABLE_CODES;
 var init_selection_resolver = __esm(() => {
   init_profile_client();
   init_skillinfo();
   init_search();
   init_selected_document();
   init_selection_cache();
+  RECOVERABLE_CACHE_ERRORS = new Set(["CACHED_PROFILE_EXPIRED", "CACHED_PROFILE_MISSING", "CACHED_BUNDLE_MISSING"]);
+  UNWRITABLE_CODES = new Set(["EACCES", "EPERM", "EROFS", "ENOSPC", "EDQUOT"]);
 });
 
 // src/lib/selected-manifest.ts
@@ -64534,7 +64587,7 @@ var init_claude_marketplace_registry = __esm(() => {
 });
 
 // src/lib/codex-hook-trust-layout.ts
-import { isDeepStrictEqual as isDeepStrictEqual11 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual12 } from "util";
 function codexTrustTextWitness(text2, keys3, canonicalize = true) {
   const parsed = Bun.TOML.parse(text2), wanted = new Set(keys3);
   const headers = [...text2.matchAll(/^[ \t]*(\[[^\r\n]+\])[ \t]*(#[^\r\n]*)?(?:\r?\n|$)/gm)];
@@ -64599,7 +64652,7 @@ function codexTrustTextWitness(text2, keys3, canonicalize = true) {
   if (expected.hooks)
     delete expected.hooks.state;
   try {
-    if (!isDeepStrictEqual11(prune(Bun.TOML.parse(noState)), prune(expected)))
+    if (!isDeepStrictEqual12(prune(Bun.TOML.parse(noState)), prune(expected)))
       throw fail3();
   } catch {
     throw fail3();
@@ -64669,13 +64722,13 @@ var init_codex_hook_trust_layout = () => {};
 
 // src/lib/codex-hook-additions-review.ts
 import { isAbsolute as isAbsolute29 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual12 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual13 } from "util";
 function exactKeys3(value, keys3) {
-  need8(value && typeof value === "object" && !Array.isArray(value) && isDeepStrictEqual12(Object.keys(value).sort(), [...keys3].sort()), "RECONCILE_ADDITIONS_REVIEW_SCHEMA");
+  need8(value && typeof value === "object" && !Array.isArray(value) && isDeepStrictEqual13(Object.keys(value).sort(), [...keys3].sort()), "RECONCILE_ADDITIONS_REVIEW_SCHEMA");
 }
 function readReviewedAdditionTrustStates(proof, before2, current, journalHooks) {
   const captured = proofs.get(proof);
-  need8(!!captured && captured.before.file === before2.file && captured.before.sha256 === before2.sha256 && captured.current.file === current.file && captured.current.sha256 === current.sha256 && isDeepStrictEqual12(captured.journalHooks, journalHooks.map(({ key: key2, currentHash }) => ({ key: key2, currentHash }))), "RECONCILE_ADDITIONS_PROOF_CHANGED");
+  need8(!!captured && captured.before.file === before2.file && captured.before.sha256 === before2.sha256 && captured.current.file === current.file && captured.current.sha256 === current.sha256 && isDeepStrictEqual13(captured.journalHooks, journalHooks.map(({ key: key2, currentHash }) => ({ key: key2, currentHash }))), "RECONCILE_ADDITIONS_PROOF_CHANGED");
   captured.recheck();
   unchanged2(before2);
   unchanged2(current);
@@ -64698,7 +64751,7 @@ function reviewNativeHookAdditions(options) {
   expectedProducer.hooks.state ??= {};
   for (const hook of options.journalHooks)
     expectedProducer.hooks.state[hook.key] = { ...expectedProducer.hooks.state[hook.key], enabled: true, trusted_hash: hook.currentHash };
-  need8(isDeepStrictEqual12(expectedProducer, producer) && codexTrustReconcileWitness(options.configBefore.text, originalKeys) === codexTrustReconcileWitness(producerConfig.text, originalKeys) && codexTrustUnmanagedSemantic(options.configBefore.text, originalKeys) === codexTrustUnmanagedSemantic(producerConfig.text, originalKeys), "RECONCILE_ADDITIONS_PRODUCER_PREIMAGE");
+  need8(isDeepStrictEqual13(expectedProducer, producer) && codexTrustReconcileWitness(options.configBefore.text, originalKeys) === codexTrustReconcileWitness(producerConfig.text, originalKeys) && codexTrustUnmanagedSemantic(options.configBefore.text, originalKeys) === codexTrustUnmanagedSemantic(producerConfig.text, originalKeys), "RECONCILE_ADDITIONS_PRODUCER_PREIMAGE");
   need8(Array.isArray(review.additions) && review.additions.length > 0 && review.additions.length <= 20, "RECONCILE_ADDITIONS_REVIEW_SCHEMA");
   const expectedHooks = JSON.parse(options.hooksBefore.text), currentHooks = JSON.parse(options.hooksCurrent.text), expectedConfig = structuredClone(producer);
   need8(expectedHooks.hooks && typeof expectedHooks.hooks === "object" && !Array.isArray(expectedHooks.hooks), "RECONCILE_ADDITIONS_DECLARATIONS");
@@ -64727,9 +64780,9 @@ function reviewNativeHookAdditions(options) {
     expectedHooks.hooks[event] = [...groups, { ...event === "PreToolUse" ? { matcher: hook.matcher } : {}, hooks: [{ type: "command", command: hook.command, timeout: hook.timeoutSec }] }];
     expectedConfig.hooks.state[key2] = trustState;
   }
-  need8(isDeepStrictEqual12(expectedHooks, currentHooks), "RECONCILE_ADDITIONS_DECLARATIONS");
+  need8(isDeepStrictEqual13(expectedHooks, currentHooks), "RECONCILE_ADDITIONS_DECLARATIONS");
   const keys3 = added.map((hook) => hook.key);
-  need8(isDeepStrictEqual12(expectedConfig, structure(options.configCurrent.text)) && codexTrustReconcileWitness(producerConfig.text, keys3) === codexTrustReconcileWitness(options.configCurrent.text, keys3) && codexTrustUnmanagedSemantic(producerConfig.text, keys3) === codexTrustUnmanagedSemantic(options.configCurrent.text, keys3), "RECONCILE_ADDITIONS_CONFIG");
+  need8(isDeepStrictEqual13(expectedConfig, structure(options.configCurrent.text)) && codexTrustReconcileWitness(producerConfig.text, keys3) === codexTrustReconcileWitness(options.configCurrent.text, keys3) && codexTrustUnmanagedSemantic(producerConfig.text, keys3) === codexTrustUnmanagedSemantic(options.configCurrent.text, keys3), "RECONCILE_ADDITIONS_CONFIG");
   const inputs = [reviewFile, producerConfig, producerHooks, options.intent, options.policy, options.configBefore, options.configCurrent, options.hooksBefore, options.hooksCurrent];
   const recheck = () => {
     for (const input of inputs)
@@ -64752,7 +64805,7 @@ var init_codex_hook_additions_review = __esm(() => {
 
 // src/lib/codex-hook-discovery-recovery.ts
 import { createHash as createHash32 } from "crypto";
-import { isDeepStrictEqual as isDeepStrictEqual13 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual14 } from "util";
 function createCodexHookDiscoveryRecovery(binding, before2, current, hooks, additions) {
   const journalHooks = hooks.map(({ key: key2, currentHash }) => ({ key: key2, currentHash }));
   const additionStates = additions ? readReviewedAdditionTrustStates(additions, before2, current, journalHooks) : [];
@@ -64766,11 +64819,11 @@ function createCodexHookDiscoveryRecovery(binding, before2, current, hooks, addi
   need8(binding.agent === "codex" && binding.method === "reviewed" && raw.length === 1 && raw[0].sha256 === before2.sha256 && before2.sha256 !== current.sha256, "RECONCILE_DISCOVERY_CONFIG_WITNESS");
   need8(raw[0].format === undefined && raw[0].fields === undefined && raw[0].managedPlugins === undefined, "RECONCILE_DISCOVERY_CONFIG_WITNESS");
   const typed = binding.sources.filter((source) => source.path === current.file && source.format === "toml");
-  need8(typed.length === 1 && typed[0].hashMode === undefined && isDeepStrictEqual13(typed[0].fields, fields), "RECONCILE_DISCOVERY_TYPED_WITNESS");
+  need8(typed.length === 1 && typed[0].hashMode === undefined && isDeepStrictEqual14(typed[0].fields, fields), "RECONCILE_DISCOVERY_TYPED_WITNESS");
   const original = structure2(before2.text), actual = structure2(current.text);
   const project = (value) => Object.fromEntries(fields.map((field3) => [field3, value[field3] ?? null]));
   const projection = sha5(JSON.stringify(project(original)));
-  need8(typed[0].sha256 === projection && sha5(JSON.stringify(project(actual))) === projection && isDeepStrictEqual13(project(original), project(actual)), "RECONCILE_DISCOVERY_TYPED_WITNESS");
+  need8(typed[0].sha256 === projection && sha5(JSON.stringify(project(actual))) === projection && isDeepStrictEqual14(project(original), project(actual)), "RECONCILE_DISCOVERY_TYPED_WITNESS");
   const keys3 = [...journalHooks.map((hook) => hook.key), ...additionStates.map((hook) => hook.key)];
   need8(journalHooks.length > 0 && keys3.length <= 100 && new Set(keys3).size === keys3.length && journalHooks.every((hook) => typeof hook.key === "string" && /^sha256:[a-f0-9]{64}$/.test(hook.currentHash)), "RECONCILE_DISCOVERY_TRUST_WITNESS");
   const expected = structuredClone(original);
@@ -64780,7 +64833,7 @@ function createCodexHookDiscoveryRecovery(binding, before2, current, hooks, addi
     expected.hooks.state[hook.key] = { ...expected.hooks.state[hook.key], enabled: true, trusted_hash: hook.currentHash };
   for (const { key: key2, state } of additionStates)
     expected.hooks.state[key2] = { ...state };
-  need8(isDeepStrictEqual13(expected, actual) && codexTrustReconcileWitness(before2.text, keys3) === codexTrustReconcileWitness(current.text, keys3) && codexTrustUnmanagedSemantic(before2.text, keys3) === codexTrustUnmanagedSemantic(current.text, keys3), "RECONCILE_DISCOVERY_TRUST_WITNESS");
+  need8(isDeepStrictEqual14(expected, actual) && codexTrustReconcileWitness(before2.text, keys3) === codexTrustReconcileWitness(current.text, keys3) && codexTrustUnmanagedSemantic(before2.text, keys3) === codexTrustUnmanagedSemantic(current.text, keys3), "RECONCILE_DISCOVERY_TRUST_WITNESS");
   unchanged2(before2);
   unchanged2(current);
   const witness = Object.freeze({ configPath: current.file, beforeSha256: before2.sha256, currentSha256: current.sha256, discoverySha256: discoveryDigest(binding), typedProjectionSha256: projection });
@@ -64822,7 +64875,7 @@ var init_codex_hook_discovery_recovery = __esm(() => {
 import { createHash as createHash33 } from "crypto";
 import { lstatSync as lstatSync35, opendirSync as opendirSync6, readFileSync as readFileSync27, readdirSync as readdirSync16, realpathSync as realpathSync12 } from "fs";
 import { basename as basename18, dirname as dirname29, isAbsolute as isAbsolute30, join as join46, relative as relative9, resolve as resolve29, sep as sep14 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual14 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual15 } from "util";
 function discoveryRootUnresolved(agent, command, detail) {
   return new Error(`${DISCOVERY_ROOT_UNRESOLVED}: ${agent} discovery cannot resolve its "${command}" executable: ${detail}. The reviewed discovery is unchanged; this is an environment gap, not drift.`);
 }
@@ -64975,8 +65028,8 @@ function projectNativeDiscoveryFields(text3, format, fields2, path) {
 }
 function isSupersededSettingsProjection(agent, configPath, source) {
   if (agent === "sumi")
-    return source.path === configPath && source.format === "json" && isDeepStrictEqual14(source.fields, [...SUMI_DISCOVERY_PROJECTION_FIELDS]);
-  return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual14(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
+    return source.path === configPath && source.format === "json" && isDeepStrictEqual15(source.fields, [...SUMI_DISCOVERY_PROJECTION_FIELDS]);
+  return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual15(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
 }
 function supersedesSettingsProjection(agent, sources, configPath) {
   if (agent === "sumi")
@@ -64997,7 +65050,7 @@ function projected(source, changes, budget3 = discoveryByteBudget()) {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || !Array.isArray(source.hookSources))
       throw new Error("Codex V6 requires exact reviewed hook sources");
     const current = captureCodexSettingsV6(source.path, source.hookSources, budget3);
-    if (current.sha256 !== source.sha256 || !isDeepStrictEqual14(current.hookSources, source.hookSources))
+    if (current.sha256 !== source.sha256 || !isDeepStrictEqual15(current.hookSources, source.hookSources))
       throw new Error("Codex hook provider or dependency changed; explicit discovery review required");
     return changes ? captureCodexSettingsV6(source.path, source.hookSources, budget3, changes).sha256 : current.sha256;
   }
@@ -65201,7 +65254,7 @@ function captureRetiredCodexDiscovery(binding, controls, rules) {
     return current;
   const installation = codexInstallationRoots(binding);
   const directories = (binding.directories ?? []).filter((directory2) => !installation.some((root2) => directory2.path === root2 || directory2.path.startsWith(root2 + sep14) || root2.startsWith(directory2.path + sep14)));
-  if (previous && isDeepStrictEqual14(previous.roots, roots) && isDeepStrictEqual14(previous.parents, parents3) && isDeepStrictEqual14(previous.directories.map((item) => item.path), directories.map((item) => item.path)))
+  if (previous && isDeepStrictEqual15(previous.roots, roots) && isDeepStrictEqual15(previous.parents, parents3) && isDeepStrictEqual15(previous.directories.map((item) => item.path), directories.map((item) => item.path)))
     return { ...current, codexRetiredMaterializations: previous };
   return { ...current, codexRetiredMaterializations: { roots, parents: parents3, directories: captureDiscoveryDirectoryProjection(directories.map((item) => item.path), roots) } };
 }
@@ -65322,7 +65375,7 @@ function verifyCodexSemanticCacheDiscovery(binding, reviewedRootAliases, narrowe
   if (reviewedRootAliases !== undefined) {
     const alias = reviewedRootAliases.find((alias2) => alias2.agent === "codex");
     const expected = alias ? { alias: alias.alias, target: alias.target } : null;
-    if (!isDeepStrictEqual14(proof.hookRootAlias, expected))
+    if (!isDeepStrictEqual15(proof.hookRootAlias, expected))
       throw new Error("Semantic cache hook alias differs from reviewed root binding");
   }
   const controls = binding.codexDisabledPluginSkills;
@@ -65332,7 +65385,7 @@ function verifyCodexSemanticCacheDiscovery(binding, reviewedRootAliases, narrowe
   if (controls.some((control) => dirname29(dirname29(control.pluginParent)) !== cacheRoot))
     throw new Error("Codex semantic cache names another enrolled cache");
   const reviewedHookParents = proof.reviewedHookParents ?? [];
-  if (!Array.isArray(reviewedHookParents) || reviewedHookParents.length > 4096 || reviewedHookParents.some((parent) => !parent || !(parent.installation === "remote-receipt" && Object.keys(parent).sort().join(",") === "installation,namespace,pluginId,pluginParent,remotePluginId,role" && typeof parent.remotePluginId === "string" || parent.installation === "local-marketplace" && Object.keys(parent).sort().join(",") === "installation,marketplaceSha256,marketplaceSourcePath,namespace,pluginId,pluginParent,role" && typeof parent.marketplaceSourcePath === "string" && /^[a-f0-9]{64}$/.test(parent.marketplaceSha256 ?? "")) || parent.role !== "reviewed-hook" || typeof parent.pluginId !== "string" || typeof parent.namespace !== "string" || typeof parent.pluginParent !== "string") || new Set(reviewedHookParents.map((parent) => parent.pluginParent)).size !== reviewedHookParents.length || !isDeepStrictEqual14((proof.witness.hookParents ?? []).map(({ manifestSha256: _manifest, hooksSha256: _hooks, receiptSha256: _receipt, ...parent }) => parent), reviewedHookParents)) {
+  if (!Array.isArray(reviewedHookParents) || reviewedHookParents.length > 4096 || reviewedHookParents.some((parent) => !parent || !(parent.installation === "remote-receipt" && Object.keys(parent).sort().join(",") === "installation,namespace,pluginId,pluginParent,remotePluginId,role" && typeof parent.remotePluginId === "string" || parent.installation === "local-marketplace" && Object.keys(parent).sort().join(",") === "installation,marketplaceSha256,marketplaceSourcePath,namespace,pluginId,pluginParent,role" && typeof parent.marketplaceSourcePath === "string" && /^[a-f0-9]{64}$/.test(parent.marketplaceSha256 ?? "")) || parent.role !== "reviewed-hook" || typeof parent.pluginId !== "string" || typeof parent.namespace !== "string" || typeof parent.pluginParent !== "string") || new Set(reviewedHookParents.map((parent) => parent.pluginParent)).size !== reviewedHookParents.length || !isDeepStrictEqual15((proof.witness.hookParents ?? []).map(({ manifestSha256: _manifest, hooksSha256: _hooks, receiptSha256: _receipt, ...parent }) => parent), reviewedHookParents)) {
     throw new Error("Invalid reviewed native-hook cache role");
   }
   for (const parent of reviewedHookParents)
@@ -65342,7 +65395,7 @@ function verifyCodexSemanticCacheDiscovery(binding, reviewedRootAliases, narrowe
   const hookParentPaths = reviewedHookParents.map((parent) => parent.pluginParent);
   const sources = binding.sources.filter((source) => codexSemanticCacheSourceRole(source, cacheRoot, parents3, hookParentPaths));
   const directories = (binding.directories ?? []).filter((directory2) => codexSemanticCacheDirectoryRole(directory2.path, cacheRoot));
-  if (!directories.length || !isDeepStrictEqual14(sources, proof.supersededSources) || !isDeepStrictEqual14(directories, proof.supersededDirectories))
+  if (!directories.length || !isDeepStrictEqual15(sources, proof.supersededSources) || !isDeepStrictEqual15(directories, proof.supersededDirectories))
     throw new Error("Codex semantic cache provenance changed");
   const configPath = proof.configPath;
   if (!isAbsolute30(configPath) || resolve29(configPath) !== configPath || basename18(configPath) !== "config.toml" || /[\x00-\x1f\x7f]/.test(configPath))
@@ -65388,8 +65441,8 @@ function verifyDiscovery(binding, codexRecovery, reviewedRootAliases, witnessTol
         if (omitted.some((root2) => !retiredRoots.includes(root2)))
           throw new Error("Missing reviewed directory membership inventory; provide a fresh discovery review");
         const current = captureDiscoveryDirectoryProjection(ordinary.map((item) => item.path), retiredRoots).map(({ entries, ...item }) => item);
-        if (!isDeepStrictEqual14(current, projection)) {
-          const changed = projection.filter((item, index) => !isDeepStrictEqual14(current[index], item));
+        if (!isDeepStrictEqual15(current, projection)) {
+          const changed = projection.filter((item, index) => !isDeepStrictEqual15(current[index], item));
           for (const item of changed.length && current.length === projection.length ? changed : [null])
             witnessChanged(new NativeDiscoveryWitnessChange("membership", item?.path ?? null, "Native discovery directory membership changed outside retired Codex roots"), witnessTolerance, item !== null && witnessTolerance?.acceptsMembership(item.path) === true);
         }
@@ -65412,7 +65465,7 @@ function verifyDiscovery(binding, codexRecovery, reviewedRootAliases, witnessTol
       safe6(source.path);
       continue;
     }
-    if (semanticCache?.supersededSources.some((previous) => isDeepStrictEqual14(previous, source))) {
+    if (semanticCache?.supersededSources.some((previous) => isDeepStrictEqual15(previous, source))) {
       safe6(source.path);
       continue;
     }
@@ -65537,7 +65590,7 @@ function rebindAgentDiscovery(binding, changes) {
   const installationRoots = codexInstallationRoots(binding), absentRoots = [...absentCodexSkillRoots(binding), ...absentRetiredClaudeRoots(binding), ...retiredCodexRoots(binding).filter((root2) => !lstatSync35(root2, { throwIfNoEntry: false }))];
   const rebound = { ...binding, sources: binding.sources.map((source) => {
     assertMarketplaceBinding(binding, source);
-    if (semanticCache?.supersededSources.some((previous) => isDeepStrictEqual14(previous, source))) {
+    if (semanticCache?.supersededSources.some((previous) => isDeepStrictEqual15(previous, source))) {
       if (changes.has(source.path))
         throw new Error("Codex semantic cache sources cannot be written by hook rendering");
       return source;
@@ -65678,7 +65731,7 @@ function verifyAutomaticDiscoveryClosure(binding, options) {
   if (JSON.stringify(current) === JSON.stringify(binding))
     return;
   const reviewedWithRuntime = (binding.builtinNames?.length ?? 0) > 0 || binding.sources.some((source) => basename18(source.path) === "package.json");
-  const otherwiseCurrent = current.method === binding.method && JSON.stringify(current.roots) === JSON.stringify(binding.roots) && JSON.stringify(current.directories) === JSON.stringify(binding.directories) && current.sources.every((source) => binding.sources.some((saved) => isDeepStrictEqual14(saved, source)));
+  const otherwiseCurrent = current.method === binding.method && JSON.stringify(current.roots) === JSON.stringify(binding.roots) && JSON.stringify(current.directories) === JSON.stringify(binding.directories) && current.sources.every((source) => binding.sources.some((saved) => isDeepStrictEqual15(saved, source)));
   if (command && gap && runtime === null && reviewedWithRuntime && otherwiseCurrent)
     throw discoveryRootUnresolved(binding.agent, command, gap);
   if (options.witnessTolerance && collectAutomaticWitnessChanges(binding, current, options.witnessTolerance))
@@ -66156,7 +66209,7 @@ function resolveDiscovery(options, exclusion) {
       const parents3 = [...new Set([...(retained.codexDisabledPluginSkills ?? []).map((control) => control.pluginParent), ...proof.appOnlyParents.map((parent) => parent.pluginParent)])];
       covered = covered.filter((source) => !codexSemanticCacheSourceRole(source, proof.witness.cacheRoot, parents3));
     }
-    if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual14(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
+    if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual15(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
       unresolved("retained review is missing current runtime discovery coverage");
     return retained;
   }
@@ -66214,7 +66267,7 @@ function resolveDiscovery(options, exclusion) {
         throw new Error("Retired native materialization changed during discovery review");
     }
     const combined = [...reviewedSources, ...reviewedSourcesWithManifestProjection];
-    const unique = combined.filter((source, index) => combined.findIndex((candidate2) => isDeepStrictEqual14(candidate2, source)) === index);
+    const unique = combined.filter((source, index) => combined.findIndex((candidate2) => isDeepStrictEqual15(candidate2, source)) === index);
     return { ...supplied, roots: [...new Set([...roots, ...supplied.roots])].sort(), sources: unique, ...agent === "gemini" ? { builtinNames } : {} };
   }
   function plugin(root2) {
@@ -92729,7 +92782,7 @@ var init_skill_relevance = __esm(() => {
 // src/lib/skill-context.ts
 import { createHash as createHash38 } from "crypto";
 import { resolve as resolve32 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual15 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual16 } from "util";
 function pathMatch(pattern, path) {
   if (!pattern || pattern.length > 512)
     return false;
@@ -92755,6 +92808,12 @@ async function buildSkillContextOnce(input2, options, mayResolveAgain) {
   if (maxChars !== undefined && (!Number.isInteger(maxChars) || maxChars < 512 || maxChars > 64000) || !Number.isInteger(maxSkills) || maxSkills < 1 || maxSkills > 20) {
     throw new SkillSelectionError("INVALID_CONTEXT_BUDGET", "Context limits must be 512\u201364000 characters and 1\u201320 skills.");
   }
+  const minPromptPhraseWords = options.minPromptPhraseWords ?? 0;
+  const inheritedBodies = options.inheritedBodies ?? HISTORY_BODY_LIMITS["subagent-inherit"];
+  if (!Number.isInteger(minPromptPhraseWords) || minPromptPhraseWords < 0 || !Number.isInteger(inheritedBodies) || inheritedBodies < 0) {
+    throw new SkillSelectionError("INVALID_CONTEXT_BUDGET", "The prompt phrase and inherited body limits must be whole numbers of 0 or more.");
+  }
+  const historyBodyLimits = { ...HISTORY_BODY_LIMITS, "subagent-inherit": inheritedBodies };
   const profileId = input2.profileId ?? "default";
   const sessionId = input2.sessionId ? input2.agentId ? `${input2.sessionId}:${input2.agentId}` : input2.sessionId : undefined;
   if (input2.parentSessionId !== undefined) {
@@ -92784,8 +92843,9 @@ async function buildSkillContextOnce(input2, options, mayResolveAgain) {
     const key2 = selectionKey(selection);
     if (restoredOrder.has(key2))
       return [{ selection, reason: "session-restore", priority: 6, score: 2000, recency: restoredOrder.get(key2) }];
-    if (inheritedOrder.has(key2))
-      return [{ selection, reason: "subagent-inherit", priority: 6, score: 2000, recency: inheritedOrder.get(key2) }];
+    const inherited = inheritedOrder.has(key2) ? { selection, reason: "subagent-inherit", priority: 6, score: 2000, recency: inheritedOrder.get(key2) } : undefined;
+    if (inherited && inheritedBodies > 0)
+      return [inherited];
     if (explicit.has(key2))
       return [{ selection, reason: "explicit", priority: 5, score: 1000 }];
     if (selection.triggers?.always)
@@ -92794,7 +92854,10 @@ async function buildSkillContextOnce(input2, options, mayResolveAgain) {
     if (matchedPath)
       return [{ selection, reason: "path", priority: 3, score: 500 }];
     const match = relevance.get(key2);
-    return match ? [{ selection, reason: "prompt", priority: match.priority, score: match.score, weak: match.weak }] : [];
+    const weak = match !== undefined && (match.weak || match.priority === 1 && !match.phrases.some((phrase) => phrase.split(" ").length >= minPromptPhraseWords));
+    if (match && !(inherited && weak))
+      return [{ selection, reason: "prompt", priority: match.priority, score: match.score, weak }];
+    return inherited ? [inherited] : [];
   }).sort((a, b) => b.priority - a.priority || (b.recency ?? -1) - (a.recency ?? -1) || b.score - a.score || a.selection.slug.localeCompare(b.selection.slug));
   const historyOffered = new Map;
   const candidates = ranked.filter((candidate2) => {
@@ -92804,6 +92867,9 @@ async function buildSkillContextOnce(input2, options, mayResolveAgain) {
     historyOffered.set(candidate2.reason, count + 1);
     return count < HISTORY_CANDIDATE_LIMIT;
   });
+  const pointerSession = sessionId && /^[A-Za-z0-9._:@][A-Za-z0-9._:@-]{0,255}$/.test(sessionId) ? ` --session ${sessionId}` : "";
+  const pointerCache = options.cached || options.pointerCacheFirst ? " --cache-first" : "";
+  const loadCommandFor = (selection) => `skills load ${selection.slug}@${selection.version} --selection-profile ${profile.profileId}${pointerCache}${pointerSession}`;
   const delivered = [];
   let selections = [];
   const omitted = [];
@@ -92813,7 +92879,7 @@ async function buildSkillContextOnce(input2, options, mayResolveAgain) {
     const { selection, reason: reason2 } = candidates[index];
     if (!input2.restore && !explicit.has(selectionKey(selection)) && loaded.has(selectionKey(selection)))
       continue;
-    const loadCommand = `skills load ${selection.slug}@${selection.version} --selection-profile ${profile.profileId}`;
+    const loadCommand = loadCommandFor(selection);
     if (selections.length >= maxSkills || ambiguous && reason2 === "prompt") {
       omitted.push({ slug: selection.slug, version: selection.version, reason: "skill-limit", loadCommand });
       continue;
@@ -92822,7 +92888,7 @@ async function buildSkillContextOnce(input2, options, mayResolveAgain) {
       omitted.push({ slug: selection.slug, version: selection.version, reason: "weak-match", loadCommand });
       continue;
     }
-    const historyLimit = HISTORY_BODY_LIMITS[reason2];
+    const historyLimit = historyBodyLimits[reason2];
     if (historyLimit !== undefined) {
       const delivered2 = historyBodies.get(reason2) ?? 0;
       if (delivered2 >= historyLimit) {
@@ -92833,12 +92899,13 @@ async function buildSkillContextOnce(input2, options, mayResolveAgain) {
     if (reason2 === "prompt") {
       const candidate2 = candidates[index];
       let end = index;
-      while (end + 1 < candidates.length && candidates[end + 1].reason === "prompt" && candidates[end + 1].priority === candidate2.priority && candidates[end + 1].score === candidate2.score && !candidates[end + 1].weak)
+      while (end + 1 < candidates.length && candidates[end + 1].reason === "prompt" && candidates[end + 1].priority === candidate2.priority && candidates[end + 1].score === candidate2.score)
         end++;
-      const tied = candidates.slice(index, end + 1).filter((entry) => explicit.has(selectionKey(entry.selection)) || !loaded.has(selectionKey(entry.selection)));
+      const block = candidates.slice(index, end + 1).filter((entry) => explicit.has(selectionKey(entry.selection)) || !loaded.has(selectionKey(entry.selection)));
+      const tied = block.filter((entry) => !entry.weak);
       if (tied.length > maxSkills - selections.length) {
-        for (const entry of tied)
-          omitted.push({ slug: entry.selection.slug, version: entry.selection.version, reason: "ambiguous-match", loadCommand: `skills load ${entry.selection.slug}@${entry.selection.version} --selection-profile ${profile.profileId}` });
+        for (const entry of block)
+          omitted.push({ slug: entry.selection.slug, version: entry.selection.version, reason: entry.weak ? "weak-match" : "ambiguous-match", loadCommand: loadCommandFor(entry.selection) });
         ambiguous = true;
         index = end;
         continue;
@@ -92865,7 +92932,7 @@ ${content}`;
     return considered.has(key2) || !explicit.has(key2) && loaded.has(key2);
   });
   for (const offer of offers)
-    omitted.push({ slug: offer.selection.slug, version: offer.selection.version, reason: offer.reason, loadCommand: `skills load ${offer.selection.slug}@${offer.selection.version} --selection-profile ${profile.profileId}` });
+    omitted.push({ slug: offer.selection.slug, version: offer.selection.version, reason: offer.reason, loadCommand: loadCommandFor(offer.selection) });
   let notice;
   if (sessionId) {
     if (!resolved.session || [...loaded].some((key2) => !previouslyLoaded.has(key2))) {
@@ -92881,7 +92948,7 @@ ${content}`;
           slug: selection.slug,
           version: selection.version,
           reason: "write-busy",
-          loadCommand: `skills load ${selection.slug}@${selection.version} --selection-profile ${profile.profileId}`
+          loadCommand: loadCommandFor(selection)
         })));
         selections = selections.filter((selection) => !unrecorded.has(selectionKey(selection)));
         delivered.splice(0, delivered.length, ...delivered.filter((entry) => !unrecorded.has(entry.key)));
@@ -92916,7 +92983,7 @@ function parentPinUnchanged(resolved, options) {
     return false;
   try {
     const current = readSkillSessionSnapshotIfExists(resolved.parentSnapshot.sessionId, options);
-    return current !== null && isDeepStrictEqual15(current.receipt.profile, resolved.receipt.profile);
+    return current !== null && isDeepStrictEqual16(current.receipt.profile, resolved.receipt.profile);
   } catch {
     return false;
   }
@@ -92928,7 +92995,7 @@ function pinUnchanged(sessionId, resolved, options) {
     if (readSelectionFileSnapshot(sessionReceiptPath(sessionId, options), MAX_PROFILE_DOCUMENT_BYTES)?.sha256 === resolved.sessionSnapshot.receiptSha256)
       return true;
     const current = readSkillSessionSnapshotIfExists(sessionId, options);
-    return current !== null && isDeepStrictEqual15(current.receipt.profile, resolved.session.profile);
+    return current !== null && isDeepStrictEqual16(current.receipt.profile, resolved.session.profile);
   } catch {
     return false;
   }
@@ -92947,7 +93014,7 @@ var init_skill_context = __esm(() => {
 // src/lib/session-reconciliation.ts
 import { createHash as createHash39 } from "crypto";
 import { dirname as dirname35, join as join53, resolve as resolve33 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual16 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual17 } from "util";
 function exactTimestamp(value) {
   const parsed = value === undefined ? Number.NaN : Date.parse(value);
   if (!Number.isFinite(parsed) || new Date(parsed).toISOString() !== value) {
@@ -93238,7 +93305,7 @@ async function renewSkillSessionPin(sessionId, profileId, options = {}) {
         profileRevision: target.profileRevision,
         ...!previous.authorizationEpoch && current.authorizationEpoch ? { authorizationEpoch: current.authorizationEpoch } : {}
       };
-      if (!isDeepStrictEqual16(expected, current)) {
+      if (!isDeepStrictEqual17(expected, current)) {
         throw new SkillSelectionError("SESSION_RECONCILIATION_REQUIRED", "A pinned skill's selection policy changed; review skills sessions reconcile before changing this session's pin.");
       }
       if (changedVersion)
@@ -93258,7 +93325,7 @@ async function renewSkillSessionPin(sessionId, profileId, options = {}) {
     const confirmed = await client2.resolveProfile(profileId);
     assertActive();
     validateResolvedProfile(confirmed, client2.authority);
-    if (!isDeepStrictEqual16(target, confirmed))
+    if (!isDeepStrictEqual17(target, confirmed))
       throw new SkillSelectionError("SESSION_TARGET_CHANGED", "The authenticated Skills profile changed during session authorization; the existing pin is unchanged.");
     const replacement = {
       ...old,
@@ -93330,7 +93397,7 @@ async function renewSkillSessionPin(sessionId, profileId, options = {}) {
   function holdsReplacement(generation, target) {
     try {
       const current = readSkillSessionSnapshotIfExists(sessionId, options);
-      return current !== null && current.generation === generation && current.receipt.verifiedAt === new Date(now3).toISOString() && isDeepStrictEqual16(current.receipt.profile, target);
+      return current !== null && current.generation === generation && current.receipt.verifiedAt === new Date(now3).toISOString() && isDeepStrictEqual17(current.receipt.profile, target);
     } catch {
       return false;
     }
@@ -93855,20 +93922,24 @@ Preserved original receipt: ${result2.archivePath}` : [
       reportContextError(error61, options.json);
     }
   });
-  parent.command("load <skill>").description("Load an exact API-selected skill and return its version/digest receipt").option("--selection-profile <id>", "Selection profile (separate from the credential --profile)").option("--cached", "Use only an explicitly selected verified cache, at most 24 hours old", false).option("--session <id>", "Pin this load to a session").option("--file <path>", "Read an exact bundle file (default: SKILL.md, README.md, then CLAUDE.md)").option("--json", "Return content and provenance as JSON", false).action(async (skill, options) => {
+  parent.command("load <skill>").description("Load an exact API-selected skill and return its version/digest receipt").option("--selection-profile <id>", "Selection profile (separate from the credential --profile)").option("--cached", "Use only an explicitly selected verified cache, at most 24 hours old", false).option("--cache-first", "Read the verified cache while it can serve this load, and the Skills service after that", false).option("--session <id>", "Pin this load to a session").option("--file <path>", "Read an exact bundle file (default: SKILL.md, README.md, then CLAUDE.md)").option("--json", "Return content and provenance as JSON", false).action(async (skill, options) => {
     try {
       const result2 = await loadSelectedSkill(skill, selectedProfileId(options.selectionProfile), {
-        ...contextResolverOptions(options),
+        ...contextResolverOptions({ ...options, cached: options.cached || options.cacheFirst }),
+        cacheFirst: options.cacheFirst && !options.cached,
         projectDir: process.cwd(),
         sessionId: options.session,
         file: options.file
       });
+      if (result2.sessionRecorded === false)
+        process.stderr.write(`Skills: this load was not recorded on its session, because the session store could not be updated here. The content is complete, but compaction won't restore it and this session won't be told if the skill is retired.
+`);
       await writeCliOutput(options.json ? JSON.stringify(result2) : result2.content);
     } catch (error61) {
       reportContextError(error61, options.json);
     }
   });
-  parent.command("context [prompt]").description("Select bounded, versioned skill context for this prompt without running skills").option("--stdin", "Read native hook JSON or a prompt from stdin", false).option("--selection-profile <id>", "Selection profile (separate from the credential --profile)").option("--cached", "Use only an explicitly selected verified cache, at most 24 hours old", false).option("--auto-reconcile-safe", "For managed hooks, renew authorized immutable session pins without adopting newer selected versions", false).option("--auto-migrate-session-pin", "With --auto-reconcile-safe: when renewal is refused because the same profile moved on, migrate the pin to the current revision and retire changed or removed loaded skills; managed hooks name them once. A project lock at the input cwd keeps the refusal", false).option("--renewal-budget-ms <ms>", "With --auto-reconcile-safe: milliseconds this command may spend before its session pin renewal must finish, counted from when the command starts; the renewal never exceeds its own budget either").option("--background-renewal", "With --auto-reconcile-safe (managed hooks): renew session pins in a detached background worker, ahead of expiry for root sessions; an expired pin waits a few seconds for it and otherwise delivers no payload", false).option("--session <id>", "Keep the same skill versions across this session").option("--restore", "Re-emit loaded session context after compaction or resume", false).option("--max-chars <count>", "Optional maximum injected characters").option("--max-skills <count>", "Maximum loaded skills", "3").option("--json", "Return context and selection receipts as JSON", false).action(async (prompt, options) => {
+  parent.command("context [prompt]").description("Select bounded, versioned skill context for this prompt without running skills").option("--stdin", "Read native hook JSON or a prompt from stdin", false).option("--selection-profile <id>", "Selection profile (separate from the credential --profile)").option("--cached", "Use only an explicitly selected verified cache, at most 24 hours old", false).option("--auto-reconcile-safe", "For managed hooks, renew authorized immutable session pins without adopting newer selected versions", false).option("--auto-migrate-session-pin", "With --auto-reconcile-safe: when renewal is refused because the same profile moved on, migrate the pin to the current revision and retire changed or removed loaded skills; managed hooks name them once. A project lock at the input cwd keeps the refusal", false).option("--renewal-budget-ms <ms>", "With --auto-reconcile-safe: milliseconds this command may spend before its session pin renewal must finish, counted from when the command starts; the renewal never exceeds its own budget either").option("--background-renewal", "With --auto-reconcile-safe (managed hooks): renew session pins in a detached background worker, ahead of expiry for root sessions; an expired pin waits a few seconds for it and otherwise delivers no payload", false).option("--session <id>", "Keep the same skill versions across this session").option("--restore", "Re-emit loaded session context after compaction or resume", false).option("--max-chars <count>", "Optional maximum injected characters").option("--max-skills <count>", "Maximum loaded skills", "3").option("--min-prompt-phrase-words <count>", "Offer an unnamed prompt match as a load command instead of injecting it unless a matched phrase has at least this many words").option("--inherited-bodies <count>", "Skill bodies a subagent receives from its parent's loaded skills; the rest are offered as load commands").option("--pointer-cache-first", "Print load commands with --cache-first even when this context isn't read from the cache", false).option("--json", "Return context and selection receipts as JSON", false).action(async (prompt, options) => {
     const started = performance.now();
     try {
       if (options.autoReconcileSafe && !options.cached)
@@ -93882,6 +93953,10 @@ Preserved original receipt: ${result2.archivePath}` : [
         throw new SkillSelectionError("INVALID_CONTEXT_INPUT", "--auto-migrate-session-pin requires --auto-reconcile-safe.");
       if (options.backgroundRenewal && !options.autoReconcileSafe)
         throw new SkillSelectionError("INVALID_CONTEXT_INPUT", "--background-renewal requires --auto-reconcile-safe.");
+      for (const [flag, value] of [["--min-prompt-phrase-words", options.minPromptPhraseWords], ["--inherited-bodies", options.inheritedBodies]]) {
+        if (value !== undefined && !/^\d{1,6}$/.test(value))
+          throw new SkillSelectionError("INVALID_CONTEXT_INPUT", `${flag} must be a whole number of at most six digits.`);
+      }
       const input2 = options.stdin ? parseSkillContextInput(await readContextStdin()) : { prompt: prompt ?? "" };
       input2.profileId = selectedProfileId(options.selectionProfile ?? input2.profileId);
       input2.cwd ??= process.cwd();
@@ -93892,6 +93967,9 @@ Preserved original receipt: ${result2.archivePath}` : [
         ...contextResolverOptions(options),
         ...options.maxChars === undefined ? {} : { maxChars: Number(options.maxChars) },
         maxSkills: Number(options.maxSkills),
+        ...options.minPromptPhraseWords === undefined ? {} : { minPromptPhraseWords: Number(options.minPromptPhraseWords) },
+        ...options.inheritedBodies === undefined ? {} : { inheritedBodies: Number(options.inheritedBodies) },
+        ...options.pointerCacheFirst ? { pointerCacheFirst: true } : {},
         ...renewalDeadline === undefined ? {} : { resolveAgainBefore: renewalDeadline },
         ...options.backgroundRenewal ? { onResolved: (resolved) => {
           pinned = resolved.session && resolved.sessionSnapshot ? { receipt: resolved.session, receiptSha256: resolved.sessionSnapshot.receiptSha256 } : null;
@@ -98440,7 +98518,7 @@ var init_execution_grants = __esm(() => {
 });
 
 // src/lib/execution-grant-client.ts
-import { isDeepStrictEqual as isDeepStrictEqual17 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual18 } from "util";
 function id(value) {
   if (!grantIdentifier(value))
     throw new Error("Invalid execution grant profile or revision identifier.");
@@ -98492,7 +98570,7 @@ async function saveExecutionGrantPolicy(profileId, grants, revision) {
     headers: revision === undefined ? { "If-None-Match": "*" } : { "If-Match": `"${revision}"` },
     body: JSON.stringify({ grants: snapshot2 })
   }));
-  if (policy.profileId !== profileId || policy.previousRevision !== (revision ?? null) || !isDeepStrictEqual17(policy.grants, snapshot2)) {
+  if (policy.profileId !== profileId || policy.previousRevision !== (revision ?? null) || !isDeepStrictEqual18(policy.grants, snapshot2)) {
     throw new Error("The API did not preserve the reviewed execution grant policy; read it before retrying.");
   }
   return policy;
@@ -98503,7 +98581,7 @@ async function resolveExecutionGrant(input2) {
   if (!grantRecord(value) || Object.keys(value).length !== 3 || !grantIdentifier(value.policyRevision) || !grantIdentifier(value.grantId) || !grantRecord(value.bindings)) {
     throw new SkillSelectionError("INVALID_EXECUTION_GRANT", "The Skills API returned an invalid execution grant.");
   }
-  if (!isDeepStrictEqual17(value.bindings.selection, snapshot2.selection) || !isDeepStrictEqual17(value.bindings.consumer, snapshot2.consumer)) {
+  if (!isDeepStrictEqual18(value.bindings.selection, snapshot2.selection) || !isDeepStrictEqual18(value.bindings.consumer, snapshot2.consumer)) {
     throw new SkillSelectionError("EXECUTION_GRANT_SCOPE_MISMATCH", "The Skills API returned a grant for a different selection or consumer.");
   }
   return value;
@@ -119642,7 +119720,7 @@ import { closeSync as closeSync31, constants as constants30, existsSync as exist
 import { randomUUID as randomUUID12 } from "crypto";
 import { homedir as homedir11 } from "os";
 import { dirname as dirname44, isAbsolute as isAbsolute41, join as join71 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual18, stripVTControlCharacters } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual19, stripVTControlCharacters } from "util";
 async function handleMcp(options) {
   if (options.register) {
     let agents;
@@ -119764,7 +119842,7 @@ async function registerClaudeMcp(command, server2, environment) {
       }
       if (exitCode === 0) {
         const actual = isPlainObject4(data.mcpServers) ? data.mcpServers[MCP_SERVER_NAME] : undefined;
-        if (!claudeNativeConfigPreserved(previous, data, firstRun !== undefined && before2 === null) || !isPlainObject4(actual) || !isDeepStrictEqual18({ ...actual, env: actual.env ?? {} }, desired)) {
+        if (!claudeNativeConfigPreserved(previous, data, firstRun !== undefined && before2 === null) || !isPlainObject4(actual) || !isDeepStrictEqual19({ ...actual, env: actual.env ?? {} }, desired)) {
           if (!preimage || current !== null && current.equals(preimage.bytes))
             throw new Error;
           if (current === null || actual === undefined || !claudeRewriteExplainedByNativeAdd(previous, data))
@@ -119860,12 +119938,12 @@ function restoreClaudePreimage(path, preimage, observed, command) {
 }
 function claudeRewriteExplainedByNativeAdd(before2, after2) {
   const skills = (data) => isPlainObject4(data.mcpServers) ? data.mcpServers[MCP_SERVER_NAME] : undefined;
-  if (skills(after2) === undefined || isDeepStrictEqual18(skills(before2), skills(after2)))
+  if (skills(after2) === undefined || isDeepStrictEqual19(skills(before2), skills(after2)))
     return false;
   const previous = withoutClaudeSkills(before2), current = withoutClaudeSkills(after2);
   for (const [key2, value] of Object.entries(current)) {
     if (Object.hasOwn(previous, key2)) {
-      if (!isDeepStrictEqual18(previous[key2], value))
+      if (!isDeepStrictEqual19(previous[key2], value))
         return false;
     } else if (!CLAUDE_NATIVE_FIRST_START_KEYS.has(key2))
       return false;
@@ -119989,7 +120067,7 @@ function claudeNativeConfigPreserved(before2, after2, firstRun = false) {
       return false;
     delete current[key2];
   }
-  return isDeepStrictEqual18(previous, current);
+  return isDeepStrictEqual19(previous, current);
 }
 function isClaudeBootstrapAddition(key2, value) {
   switch (key2) {
@@ -120047,7 +120125,7 @@ ${body}`;
       const before2 = Bun.TOML.parse(current);
       const next = upsertTomlSection(current, `[mcp_servers.${MCP_SERVER_NAME}]`, body);
       const after2 = Bun.TOML.parse(next);
-      if (!isDeepStrictEqual18(withoutSkillsMcp(before2), withoutSkillsMcp(after2)))
+      if (!isDeepStrictEqual19(withoutSkillsMcp(before2), withoutSkillsMcp(after2)))
         throw new Error;
       return next;
     });
@@ -124456,7 +124534,7 @@ var init_agent_install_selection = __esm(() => {
 // src/lib/codex-hook-trust-identity.ts
 import { lstatSync as lstatSync49, realpathSync as realpathSync22 } from "fs";
 import { dirname as dirname50, isAbsolute as isAbsolute46, join as join78, resolve as resolve42 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual19 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual20 } from "util";
 function commandPhysical(command) {
   need8(typeof command === "string" && isAbsolute46(command) && !command.includes("\x00") && resolve42(command) === command, COMMAND_NOT_CANONICAL);
   const physical = realpathSync22(command);
@@ -124521,7 +124599,7 @@ function inspectRecordedSkillsCli(command, expected) {
   need8(pkg.name === "@hasna/skills" && /^\d+\.\d+\.\d+$/.test(pkg.version) && pkg.bin?.skills === "bin/index.js" && resolved === join78(dirname50(manifest.file), "bin/index.js"), "SKILLS_PACKAGE_MISMATCH");
   need8((cli.stat.mode & 0o100n) !== 0n, "SKILLS_COMMAND_NOT_EXECUTABLE");
   const receipt = { path: resolved, version: pkg.version, sha256: cli.sha256, manifestSha256: manifest.sha256 };
-  need8(isDeepStrictEqual19(receipt, expected), "RECONCILE_SKILLS_BINDING_CHANGED");
+  need8(isDeepStrictEqual20(receipt, expected), "RECONCILE_SKILLS_BINDING_CHANGED");
   return { receipt, recheck() {
     targetUnchanged(command, target);
     unchanged2(cli);
@@ -124591,19 +124669,19 @@ var init_codex_hook_trust_identity = __esm(() => {
 });
 
 // src/lib/codex-hook-policy-recovery.ts
-import { isDeepStrictEqual as isDeepStrictEqual20 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual21 } from "util";
 function reviewedClaudeDiscoveryChange(beforeText, currentText, options) {
   need8(typeof options.reason === "string" && options.reason.trim().length > 0 && options.reason.length <= 512 && !/[\x00-\x1f\x7f]/.test(options.reason), "RECONCILE_RECOVERY_REASON_REQUIRED");
   need8(options.reviewedPlanDigest === undefined || /^[a-f0-9]{64}$/.test(options.reviewedPlanDigest), "RECONCILE_RECOVERY_PLAN_CHANGED");
   const before2 = parseManagedSkillPolicy(beforeText), current = parseManagedSkillPolicy(currentText);
   const oldDiscovery = before2.bridge?.discovery?.claude, newDiscovery = current.bridge?.discovery?.claude;
   need8(oldDiscovery?.agent === "claude" && newDiscovery?.agent === "claude" && oldDiscovery.method === "reviewed" && newDiscovery.method === "reviewed", "RECONCILE_POLICY_CHANGED");
-  const changes = ["roots", "sources"].filter((key2) => !isDeepStrictEqual20(oldDiscovery[key2], newDiscovery[key2])).map((key2) => ({ path: `bridge.discovery.claude.${key2}`, before: oldDiscovery[key2], after: newDiscovery[key2] }));
+  const changes = ["roots", "sources"].filter((key2) => !isDeepStrictEqual21(oldDiscovery[key2], newDiscovery[key2])).map((key2) => ({ path: `bridge.discovery.claude.${key2}`, before: oldDiscovery[key2], after: newDiscovery[key2] }));
   need8(changes.length > 0, "RECONCILE_POLICY_CHANGED");
   const compared = structuredClone(current);
   compared.bridge.discovery.claude.roots = oldDiscovery.roots;
   compared.bridge.discovery.claude.sources = oldDiscovery.sources;
-  need8(isDeepStrictEqual20(before2, compared), "RECONCILE_POLICY_CHANGED");
+  need8(isDeepStrictEqual21(before2, compared), "RECONCILE_POLICY_CHANGED");
   verifyAgentDiscovery(newDiscovery);
   return { reason: options.reason, changes };
 }
@@ -124619,7 +124697,7 @@ import { createHash as createHash49, randomUUID as randomUUID16 } from "crypto";
 import { execFileSync as execFileSync2 } from "child_process";
 import { dirname as dirname51, isAbsolute as isAbsolute47, join as join79, resolve as resolve43 } from "path";
 import { homedir as homedir14 } from "os";
-import { isDeepStrictEqual as isDeepStrictEqual21 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual22 } from "util";
 function verifyReleaseArtifact(proof, skillsCli) {
   need8(isAbsolute47(proof.packageTarPath) && !proof.packageTarPath.includes("\x00"), "RECONCILE_RELEASE_PROVENANCE_PATH");
   const tarPath = realpathSync23(proof.packageTarPath);
@@ -124661,7 +124739,7 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     const configSha256 = intent.configSha256 ?? configBefore.sha256, configVersion = intent.configVersion ?? intent.expectedVersion;
     const digestInput = { version: 1, home: intent.home ?? home, configPath: intent.configPath, ...intent.nativeConfigPath !== undefined ? { nativeConfigPath: intent.nativeConfigPath } : {}, configSha256, configVersion, policySha256: intent.policySha256, hooksSha256: intent.hooksSha256, skillsCli: intent.skillsCli, nativeVersion: intent.nativeVersion, declarations, admitted };
     need8(makePlanDigest(digestInput) === intent.planDigest, "RECONCILE_PLAN_CHANGED");
-    need8(isDeepStrictEqual21(intent.hooks, admitted.filter((hook) => !hook.enabled || hook.trustStatus !== "trusted")), "RECONCILE_INTENT_HOOKS_CHANGED");
+    need8(isDeepStrictEqual22(intent.hooks, admitted.filter((hook) => !hook.enabled || hook.trustStatus !== "trusted")), "RECONCILE_INTENT_HOOKS_CHANGED");
     need8(configBefore.sha256 === (intent.beforeSha256 ?? intent.configSha256) && hooksBefore.sha256 === intent.hooksSha256 && policyBefore.sha256 === intent.policySha256, "RECONCILE_JOURNAL_CHANGED");
     const policyCurrent = snapshot(join79(dataDir3, "agent-policy.json"), true);
     const { claudeDiscoveryRecovery: claudeRecovery, nativeHookAdditionsRecovery: additionsRecovery } = options;
@@ -124674,7 +124752,7 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     if (policyCurrent.sha256 !== policyBefore.sha256 && !claudeRecovery) {
       need8(options.supersedeBinding === true, "RECONCILE_POLICY_CHANGED");
       const oldPolicy = JSON.parse(policyBefore.text), currentPolicy = JSON.parse(policyCurrent.text);
-      need8(isDeepStrictEqual21(withoutCodexCommand(oldPolicy), withoutCodexCommand(currentPolicy)), "RECONCILE_POLICY_CHANGED");
+      need8(isDeepStrictEqual22(withoutCodexCommand(oldPolicy), withoutCodexCommand(currentPolicy)), "RECONCILE_POLICY_CHANGED");
       supersededBinding = true;
     }
     if (supersededBinding || recovery) {
@@ -124710,7 +124788,7 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
         need8(state?.enabled === true && typeof state.trusted_hash === "string" && /^sha256:[a-f0-9]{64}$/.test(state.trusted_hash), "RECONCILE_CONFIG_DRIFT");
       }
     } else
-      need8(isDeepStrictEqual21(expectedConfig, current), "RECONCILE_CONFIG_DRIFT");
+      need8(isDeepStrictEqual22(expectedConfig, current), "RECONCILE_CONFIG_DRIFT");
     const configDiscoveryRecovery = recovery && binding.discovery?.codex ? createCodexHookDiscoveryRecovery(binding.discovery.codex, configBefore, currentConfig, intent.hooks, additions?.trustProof) : undefined;
     assertManagedAgentBridge("codex", { home, dataDir: dataDir3, projectDir: home, codexDiscoveryRecovery: configDiscoveryRecovery });
     const recoveryCli = recovery ? bindSkillsCli("skills", options.reviewedSkillsCli) : undefined;
@@ -124719,14 +124797,14 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     const skillsCli = recovery ? inspectRecordedSkillsCli(binding.commands.codex, intent.skillsCli) : bindSkillsCli(binding.commands.codex, options.reviewedSkillsCli);
     if (supersededBinding)
       verifyReleaseArtifact(options.releaseProof, skillsCli);
-    const skillsBindingChanged = !isDeepStrictEqual21(skillsCli.receipt, intent.skillsCli);
+    const skillsBindingChanged = !isDeepStrictEqual22(skillsCli.receipt, intent.skillsCli);
     need8(!skillsBindingChanged || supersededBinding, "RECONCILE_SKILLS_BINDING_CHANGED");
     if (!additions && hooksCurrent.sha256 !== intent.hooksSha256 && hooksCurrent.sha256 !== hooksBefore.sha256) {
       need8(supersededBinding, "RECONCILE_HOOKS_CHANGED");
       const currentDeclarations = JSON.parse(hooksCurrent.text).hooks;
       for (const [event, [nativeEvent]] of Object.entries(eventNames)) {
         const command = renderAgentHookCommand(binding.commands.codex, "codex", binding.profiles.codex, event);
-        need8(isDeepStrictEqual21(currentDeclarations?.[event], [{ hooks: [{ type: "command", command, timeout: 15 }] }]), "RECONCILE_BINDING_HOOK_CHANGED");
+        need8(isDeepStrictEqual22(currentDeclarations?.[event], [{ hooks: [{ type: "command", command, timeout: 15 }] }]), "RECONCILE_BINDING_HOOK_CHANGED");
       }
     }
     rpc = await connect({ command: options.codexCommand ?? "codex", home, codexHome });
@@ -124749,9 +124827,9 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
           delete identity7.command;
         return identity7;
       };
-      need8(isDeepStrictEqual21(stable(actual), stable(expected)), "RECONCILE_NATIVE_IDENTITY_CHANGED");
+      need8(isDeepStrictEqual22(stable(actual), stable(expected)), "RECONCILE_NATIVE_IDENTITY_CHANGED");
       if (!plannedKeys.has(expected.key))
-        need8(isDeepStrictEqual21(actual, expected), "RECONCILE_UNRELATED_HOOK_CHANGED");
+        need8(isDeepStrictEqual22(actual, expected), "RECONCILE_UNRELATED_HOOK_CHANGED");
     }
     for (const wanted of intent.hooks) {
       const matches2 = nativeHooks.filter((h2) => h2.key === wanted.key || h2.key === wanted.key.replace(join79(home, ".codex/hooks.json"), hooksPath));
@@ -124770,7 +124848,7 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     const layers = config2?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
     need8(layers?.length === 1 && !layers[0].disabledReason && codexNativeConfigEqual(layers[0].config, current), "RECONCILE_NATIVE_CONFIG_MISMATCH");
     const finalDiscovery = await rpc.request("hooks/list", { cwds: [home] });
-    need8(Array.isArray(finalDiscovery?.data) && finalDiscovery.data.length === 1 && finalDiscovery.data[0].cwd === home && !finalDiscovery.data[0].errors?.length && !finalDiscovery.data[0].warnings?.length && (!recordedNativeHooks || isDeepStrictEqual21(finalDiscovery.data[0].hooks.map(safeNativeHook), nativeHooks.map(safeNativeHook))), "RECONCILE_NATIVE_STATE_CHANGED");
+    need8(Array.isArray(finalDiscovery?.data) && finalDiscovery.data.length === 1 && finalDiscovery.data[0].cwd === home && !finalDiscovery.data[0].errors?.length && !finalDiscovery.data[0].warnings?.length && (!recordedNativeHooks || isDeepStrictEqual22(finalDiscovery.data[0].hooks.map(safeNativeHook), nativeHooks.map(safeNativeHook))), "RECONCILE_NATIVE_STATE_CHANGED");
     const finalConfig = await rpc.request("config/read", { includeLayers: true, cwd: home });
     const finalLayers = finalConfig?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
     need8(finalLayers?.length === 1 && !finalLayers[0].disabledReason && codexNativeConfigEqual(finalLayers[0].config, current), "RECONCILE_NATIVE_CONFIG_CHANGED");
@@ -124835,7 +124913,7 @@ async function enrollCodexNativeHooksUnlocked(options, connect, admission) {
       const groups = declarations[event];
       need8(Array.isArray(groups), "DECLARATION_CHANGED");
       const matches2 = groups.flatMap((group, gi) => (group.hooks ?? []).flatMap((entry, hi) => entry.command === command ? [{ group, entry, gi, hi }] : []));
-      need8(matches2.length === 1 && isDeepStrictEqual21(matches2[0].group, { hooks: [{ type: "command", command, timeout: 15 }] }), "DECLARATION_CHANGED");
+      need8(matches2.length === 1 && isDeepStrictEqual22(matches2[0].group, { hooks: [{ type: "command", command, timeout: 15 }] }), "DECLARATION_CHANGED");
       expected.push({ event: nativeEvent, key: `${join79(home, ".codex/hooks.json")}:${label}:${matches2[0].gi}:${matches2[0].hi}`, command });
     }
     codexTrustTextWitness(configFile.text, expected.map((h) => h.key));
@@ -124901,7 +124979,7 @@ async function enrollCodexNativeHooksUnlocked(options, connect, admission) {
     save(join79(journal, "hooks.before.json"), hooksFile.bytes);
     save(join79(journal, "policy.before.json"), policyFile.bytes);
     save(join79(journal, "intent.json"), json2({ ...digestInput, planDigest, hooks: planned, nativeHooks: discovered.map(safeNativeHook), ...codexAdmissionReceipt(admission) }));
-    need8(isDeepStrictEqual21(admit(await list2()), admitted), "NATIVE_DISCOVERY_CHANGED");
+    need8(isDeepStrictEqual22(admit(await list2()), admitted), "NATIVE_DISCOVERY_CHANGED");
     checkInputs();
     let result2;
     try {
@@ -124915,7 +124993,7 @@ async function enrollCodexNativeHooksUnlocked(options, connect, admission) {
     expectedConfig.hooks.state ??= {};
     for (const h of planned)
       expectedConfig.hooks.state[h.key] = { ...expectedConfig.hooks.state[h.key], enabled: true, trusted_hash: h.currentHash };
-    need8(isDeepStrictEqual21(structure3(after2.text), expectedConfig) && codexTrustTextWitness(after2.text, keys4) === preservationText, "PRESERVATION_FAILED");
+    need8(isDeepStrictEqual22(structure3(after2.text), expectedConfig) && codexTrustTextWitness(after2.text, keys4) === preservationText, "PRESERVATION_FAILED");
     const savedConfig = snapshot(join79(journal, "config.before.toml"), true);
     need8(savedConfig.sha256 === configFile.sha256, "JOURNAL_CHANGED");
     const discoveryTransition = binding.discovery?.codex ? createCodexHookDiscoveryRecovery(binding.discovery.codex, savedConfig, after2, planned) : undefined;
@@ -124923,8 +125001,8 @@ async function enrollCodexNativeHooksUnlocked(options, connect, admission) {
     unchanged2(hooksFile);
     assertManagedAgentBridge("codex", { home, dataDir: dataDir3, projectDir: home, codexDiscoveryRecovery: discoveryTransition });
     const current = await list2(), confirmed = admit(current);
-    need8(confirmed.every((h) => h.enabled && h.trustStatus === "trusted") && isDeepStrictEqual21(confirmed.map((h) => [h.key, h.currentHash]), admitted.map((h) => [h.key, h.currentHash])), "NATIVE_NOT_ELIGIBLE");
-    need8(isDeepStrictEqual21(current.filter((h) => !keys4.includes(h.key)), discovered.filter((h) => !keys4.includes(h.key))), "UNRELATED_HOOK_CHANGED");
+    need8(confirmed.every((h) => h.enabled && h.trustStatus === "trusted") && isDeepStrictEqual22(confirmed.map((h) => [h.key, h.currentHash]), admitted.map((h) => [h.key, h.currentHash])), "NATIVE_NOT_ELIGIBLE");
+    need8(isDeepStrictEqual22(current.filter((h) => !keys4.includes(h.key)), discovered.filter((h) => !keys4.includes(h.key))), "UNRELATED_HOOK_CHANGED");
     unchanged2(after2);
     unchanged2(savedConfig);
     unchanged2(hooksFile);
@@ -125059,7 +125137,7 @@ var init_codex_native_trust = __esm(() => {
 import { createHash as createHash51 } from "crypto";
 import { lstatSync as lstatSync51, readFileSync as readFileSync49, readdirSync as readdirSync29, realpathSync as realpathSync24 } from "fs";
 import { basename as basename26, dirname as dirname52, isAbsolute as isAbsolute48, join as join81, relative as relative16, resolve as resolve45, sep as sep23 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual22 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual23 } from "util";
 function hashClaudeDiscoveryBinding(binding) {
   return sha8(JSON.stringify(binding));
 }
@@ -125382,7 +125460,7 @@ function reviewClaudeProspectiveCandidate(request2, requestFileSha256) {
     refuse8("candidate must select between one and 32 plugins from one marketplace");
   if (candidate2.functionHooksEnv !== undefined && candidate2.functionHooksEnv !== "1")
     refuse8("function-hook environment mutation only supports the explicit value 1");
-  const settingsMarketplaceWriterVersions = ["2.1.276", "2.1.278", "2.1.282", "2.1.287", "2.1.293", "2.1.296", "2.1.299", "2.1.300", "2.1.301", "2.1.302"];
+  const settingsMarketplaceWriterVersions = ["2.1.276", "2.1.278", "2.1.282", "2.1.287", "2.1.293", "2.1.296", "2.1.299", "2.1.300", "2.1.301", "2.1.302", "2.1.314", "2.1.316"];
   const nativeVersion = request2.native.executable.version;
   const measuredSettingsWriter = settingsMarketplaceWriterVersions.some((version2) => nativeVersion === version2 || nativeVersion === `${version2} (Claude Code)`);
   if (hasOwn2(candidate2, "settingsMarketplaceSource") && (candidate2.settingsMarketplaceSource !== "directory" || request2.scope.kind !== "user" || !measuredSettingsWriter))
@@ -125531,7 +125609,7 @@ function reviewClaudeProspectiveCandidate(request2, requestFileSha256) {
     refuse8("Skills discovery preimage differs from its reviewed binding");
   assertProjectDiscovery("claude", [request2.scope.projectPath], request2.native.home, canonical9, binding);
   const stored = snapshot2.value.bridge?.discovery?.claude;
-  if (!stored || !isDeepStrictEqual22(stored, binding) || snapshot2.value.bridge?.home !== request2.native.home)
+  if (!stored || !isDeepStrictEqual23(stored, binding) || snapshot2.value.bridge?.home !== request2.native.home)
     refuse8("Skills policy does not bind the reviewed current Claude discovery");
   assertExemptUnchanged();
   const delta = request2.delta;
@@ -125689,7 +125767,7 @@ function reviewClaudeProspectiveCandidate(request2, requestFileSha256) {
         refuse8("current known marketplace autoUpdate is not a boolean");
     }
   }
-  if (!isDeepStrictEqual22(delta.settingsAfter, settingsAfter))
+  if (!isDeepStrictEqual23(delta.settingsAfter, settingsAfter))
     refuse8("complete settings document differs from the exact selected plugin/options/environment/marketplace operations");
   const marketplaceRowBefore = marketplaces?.[candidate2.marketplace];
   if (marketplaceRowBefore !== undefined && !object13(marketplaceRowBefore))
@@ -125701,7 +125779,7 @@ function reviewClaudeProspectiveCandidate(request2, requestFileSha256) {
   if (marketplaceRowBefore?.lastUpdated !== undefined && !validUtcTimestamp(marketplaceRowBefore.lastUpdated))
     refuse8("current marketplace update timestamp is invalid");
   const targetMarketplaceLocation = candidate2.root;
-  const sameMarketplaceSource = isDeepStrictEqual22(marketplaceRowBefore?.source, { source: "directory", path: candidate2.root }) && marketplaceRowBefore?.installLocation === targetMarketplaceLocation;
+  const sameMarketplaceSource = isDeepStrictEqual23(marketplaceRowBefore?.source, { source: "directory", path: candidate2.root }) && marketplaceRowBefore?.installLocation === targetMarketplaceLocation;
   const afterMarketplace = {
     source: { source: "directory", path: candidate2.root },
     installLocation: targetMarketplaceLocation,
@@ -125710,7 +125788,7 @@ function reviewClaudeProspectiveCandidate(request2, requestFileSha256) {
   };
   const marketplacesAfter = marketplaces ? structuredClone(marketplaces) : {};
   marketplacesAfter[candidate2.marketplace] = afterMarketplace;
-  if (!isDeepStrictEqual22(delta.knownMarketplacesAfter, marketplacesAfter))
+  if (!isDeepStrictEqual23(delta.knownMarketplacesAfter, marketplacesAfter))
     refuse8("complete marketplace document differs from the exact selected-directory marketplace operation");
   const installedAfter = registrations ? structuredClone(registrations) : { version: 2, plugins: {} };
   if (installedAfter.plugins === undefined)
@@ -125730,7 +125808,7 @@ function reviewClaudeProspectiveCandidate(request2, requestFileSha256) {
       nextRows[index] = targetRegistration;
     installedAfter.plugins[pluginId2] = nextRows;
   }
-  if (!isDeepStrictEqual22(delta.installedPluginsAfter, installedAfter))
+  if (!isDeepStrictEqual23(delta.installedPluginsAfter, installedAfter))
     refuse8("complete installed plugin document changes an unrelated registration or has target rows not derived from every selected candidate");
   assertExemptUnchanged();
   const semanticDocumentsSha256 = sha8(canonicalJson3({ settings: settingsAfter, knownMarketplaces: marketplacesAfter, installedPlugins: installedAfter }));
@@ -126195,8 +126273,12 @@ var exports_agent_integration = {};
 __export(exports_agent_integration, {
   withSessionPinMigrationNotice: () => withSessionPinMigrationNotice,
   registerAgentIntegration: () => registerAgentIntegration,
+  managedHookSelectionArgs: () => managedHookSelectionArgs,
+  managedHookPromptMinPhraseWords: () => managedHookPromptMinPhraseWords,
   managedHookContextLimits: () => managedHookContextLimits,
   capManagedHookContext: () => capManagedHookContext,
+  MANAGED_HOOK_PROMPT_MIN_PHRASE_WORDS: () => MANAGED_HOOK_PROMPT_MIN_PHRASE_WORDS,
+  MANAGED_HOOK_INHERITED_BODIES: () => MANAGED_HOOK_INHERITED_BODIES,
   MANAGED_HOOK_CONTEXT_RESERVE_CHARS: () => MANAGED_HOOK_CONTEXT_RESERVE_CHARS,
   MANAGED_HOOK_CONTEXT_MAX_SKILLS: () => MANAGED_HOOK_CONTEXT_MAX_SKILLS,
   MANAGED_HOOK_CONTEXT_MAX_CHARS: () => MANAGED_HOOK_CONTEXT_MAX_CHARS
@@ -126217,6 +126299,14 @@ function managedHookContextLimits() {
   const maxSkills = boundedEnvInteger("SKILLS_HOOK_CONTEXT_MAX_SKILLS", MANAGED_HOOK_CONTEXT_MAX_SKILLS, HOOK_CONTEXT_SKILLS_RANGE);
   return { maxChars, maxSkills, bodyChars: maxChars - MANAGED_HOOK_CONTEXT_RESERVE_CHARS };
 }
+function managedHookPromptMinPhraseWords() {
+  return boundedEnvInteger("SKILLS_HOOK_PROMPT_MIN_PHRASE_WORDS", MANAGED_HOOK_PROMPT_MIN_PHRASE_WORDS, HOOK_PROMPT_PHRASE_WORDS_RANGE);
+}
+function managedHookSelectionArgs(agent) {
+  if (agent === "sumi" || agent === "cursor")
+    return [];
+  return ["--min-prompt-phrase-words", String(managedHookPromptMinPhraseWords()), "--inherited-bodies", String(MANAGED_HOOK_INHERITED_BODIES)];
+}
 function capManagedHookContext(context2, maxChars = managedHookContextLimits().maxChars) {
   if (context2.length <= maxChars)
     return context2;
@@ -126255,14 +126345,16 @@ function withSessionPinMigrationNotice(agent, event, input3, result2) {
 `);
   } catch {}
 }
-async function contextForHook(input3, profileId, cached2, deadline) {
+async function contextForHook(agent, input3, profileId, cached2, deadline) {
   const { childMs, renewalBudgetMs } = managedContextChildLimits(deadline - Date.now());
   if (childMs <= 0)
     throw new HookDiagnosticError("SKILLS_HOOK_TIMEOUT", "context");
   const limits = managedHookContextLimits();
-  const args2 = ["context", "--stdin", "--json", "--selection-profile", profileId, "--max-chars", String(limits.bodyChars), "--max-skills", String(limits.maxSkills)];
+  const args2 = ["context", "--stdin", "--json", "--selection-profile", profileId, "--max-chars", String(limits.bodyChars), "--max-skills", String(limits.maxSkills), ...managedHookSelectionArgs(agent)];
   if (cached2)
     args2.push("--cached", "--auto-reconcile-safe");
+  else
+    args2.push("--pointer-cache-first");
   if (cached2 && sessionPinMigrationEnabled())
     args2.push("--auto-migrate-session-pin");
   if (cached2)
@@ -126291,7 +126383,7 @@ async function contextForHook(input3, profileId, cached2, deadline) {
   if (status !== 0) {
     const failure = hookChildError(output2, "context");
     if (cached2 && RECOVERABLE_CONTEXT_CACHE_ERRORS.has(failure.code)) {
-      return contextForHook(input3, profileId, false, deadline);
+      return contextForHook(agent, input3, profileId, false, deadline);
     }
     throw failure;
   }
@@ -126725,7 +126817,7 @@ function registerAgentIntegration(parent) {
         }
       }
       selectionProfile = pinnedHookProfile(input3, selectionProfile);
-      const result2 = await contextForHook(input3, selectionProfile, true, deadline);
+      const result2 = await contextForHook(options.agent, input3, selectionProfile, true, deadline);
       withSessionPinMigrationNotice(options.agent, event, input3, result2);
       if (syncNotice)
         result2.context = [syncNotice, result2.context].filter(Boolean).join(`
@@ -126809,8 +126901,9 @@ ${driftWarning}` : unavailable2, ...output2 }));
     }
   });
 }
-var RECOVERABLE_CONTEXT_CACHE_ERRORS, MANAGED_HOOK_CONTEXT_MAX_CHARS = 12000, MANAGED_HOOK_CONTEXT_MAX_SKILLS = 2, MANAGED_HOOK_CONTEXT_RESERVE_CHARS = 2500, HOOK_CONTEXT_CHARS_RANGE, HOOK_CONTEXT_SKILLS_RANGE, HOOK_CONTEXT_TRUNCATED = "[Skills context truncated at the hook limit; read the rest with `skills load <slug>`.]", SESSION_START_SYNC_CONTINUES;
+var RECOVERABLE_CONTEXT_CACHE_ERRORS, MANAGED_HOOK_CONTEXT_MAX_CHARS = 12000, MANAGED_HOOK_CONTEXT_MAX_SKILLS = 2, MANAGED_HOOK_CONTEXT_RESERVE_CHARS = 2500, MANAGED_HOOK_PROMPT_MIN_PHRASE_WORDS = 2, MANAGED_HOOK_INHERITED_BODIES = 0, HOOK_PROMPT_PHRASE_WORDS_RANGE, HOOK_CONTEXT_CHARS_RANGE, HOOK_CONTEXT_SKILLS_RANGE, HOOK_CONTEXT_TRUNCATED = "[Skills context truncated at the hook limit; read the rest with `skills load <slug>`.]", SESSION_START_SYNC_CONTINUES;
 var init_agent_integration2 = __esm(() => {
+  init_selection_resolver();
   init_claude_hook_disable();
   init_opencode_hook_protocol();
   init_sumi_settings_witness();
@@ -126840,7 +126933,8 @@ var init_agent_integration2 = __esm(() => {
   init_self_spawn();
   init_config();
   init_claude_installer_capture();
-  RECOVERABLE_CONTEXT_CACHE_ERRORS = new Set(["CACHED_PROFILE_EXPIRED", "CACHED_PROFILE_MISSING", "CACHED_BUNDLE_MISSING"]);
+  RECOVERABLE_CONTEXT_CACHE_ERRORS = RECOVERABLE_CACHE_ERRORS;
+  HOOK_PROMPT_PHRASE_WORDS_RANGE = [MANAGED_HOOK_PROMPT_MIN_PHRASE_WORDS, 16];
   HOOK_CONTEXT_CHARS_RANGE = [MANAGED_HOOK_CONTEXT_RESERVE_CHARS + 512, MANAGED_HOOK_CONTEXT_MAX_CHARS];
   HOOK_CONTEXT_SKILLS_RANGE = [1, MANAGED_HOOK_CONTEXT_MAX_SKILLS];
   SESSION_START_SYNC_CONTINUES = new Set(["SKILLS_HOOK_TIMEOUT", "SKILLS_API_UNAVAILABLE"]);