@hasna/skills 0.10.90 → 0.10.92

package/bin/mcp.js

@@ -38,7 +38,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.90",
+    version: "0.10.92",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -82,6 +82,7 @@ var init_package = __esm(() => {
       "docs/runtime-activation.md",
       "schemas/",
       "LICENSE",
+      "THIRD_PARTY_NOTICES",
       "README.md",
       "!dist/**/*test-utils.d.ts",
       "!dist/**/*fixtures.d.ts"
@@ -89,9 +90,9 @@ var init_package = __esm(() => {
     main: "./dist/index.js",
     types: "./dist/index.d.ts",
     scripts: {
-      clean: "rm -rf bin/ dist/",
-      build: "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @modelcontextprotocol/sdk ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
-      "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
+      clean: "rm -rf bin/ dist/ THIRD_PARTY_NOTICES",
+      build: "bun run clean && bun build --external @hasna/secrets --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @hasna/secrets --external @modelcontextprotocol/sdk ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/secrets --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/secrets --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/secrets --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/secrets --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build --external @hasna/secrets ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts && bun scripts/third-party-notices.ts",
+      "build:js": "rm -rf dist && bun build --external @hasna/secrets ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
       test: "bun test --timeout 30000",
       dev: "bun run ./src/cli/index.tsx",
       "dev:watch": "bun --watch run ./src/cli/index.tsx",
@@ -142,7 +143,6 @@ var init_package = __esm(() => {
       "@aws-sdk/client-ecs": "^3.1079.0",
       "@aws-sdk/client-s3": "^3.1079.0",
       "@hasna/events": "0.1.18",
-      "@hasna/secrets": "0.4.2",
       "@modelcontextprotocol/sdk": "^1.26.0",
       chalk: "^5.3.0",
       commander: "^12.1.0",
@@ -154,6 +154,9 @@ var init_package = __esm(() => {
       zod: "^4.3.6",
       "@hasna/contracts": "1.3.5"
     },
+    optionalDependencies: {
+      "@hasna/secrets": "0.4.2"
+    },
     engines: {
       bun: ">=1.0.0"
     },
@@ -1432,6 +1435,9 @@ async function resolveSkillsConnection(env = process.env, options = {}) {
     completed = await completePointerCredential(SKILLS_APP, pointer, explicitVault ? snapshotEnv : env);
   } catch (error) {
     const translated = asSkillsFleetCredentialError(error, pointer.pointerVaultKey);
+    if (translated?.message.includes("(@hasna/secrets) is not installed")) {
+      throw new SkillsFleetCredentialError(`${translated.message} @hasna/secrets is optional and private: install it with access to it.`, "MISSING_API_CREDENTIAL");
+    }
     if (translated)
       throw translated;
     throw error;
@@ -22520,6 +22526,11 @@ var init_agent_opencode = __esm(() => {
 });
 
 // src/lib/agent-adapters.ts
+function renderAgentHookCommand(command, agent, profileId, event) {
+  if (typeof profileId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(profileId) || profileId.includes(".."))
+    throw new Error("Invalid selection profile id");
+  return `'${command.replace(/'/g, `'\\''`)}' hook user-prompt --agent ${agent} --selection-profile ${profileId} --event ${event}`;
+}
 var INTEGRATION_AGENTS;
 var init_agent_adapters = __esm(() => {
   init_agent_opencode();
@@ -30550,6 +30561,17 @@ function parseHermesConfig(text2) {
       throw new Error(`Expected Hermes ${name} object`);
   return value;
 }
+function quoted(value) {
+  if (!value || /[\0\r\n]/.test(value))
+    throw new Error("Invalid Hermes Skills command");
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function hermesHookDefinitions(supervisor) {
+  if (!isAbsolute7(supervisor.runtime) || !isAbsolute7(supervisor.path))
+    throw new Error("Expected absolute Hermes supervisor paths");
+  const entry = (event) => ({ command: `${quoted(supervisor.runtime)} ${quoted(supervisor.path)} --event ${event}`, timeout: 15, ...event === "pre_tool_call" ? { fail_closed: true } : {} });
+  return { pre_llm_call: entry("pre_llm_call"), pre_tool_call: entry("pre_tool_call") };
+}
 function assertHermesEnvironment(home) {
   if (process.env.TERMINAL_CWD && process.env.TERMINAL_CWD !== process.cwd())
     throw new NativeBridgeIntegrityRefusal("NATIVE_SKILL_DRIFT: Hermes TERMINAL_CWD must match the checked process working directory; review the effective project before using this adapter");
@@ -38660,9 +38682,94 @@ function nativeDiscoveryAliasTargets(roots, home) {
   }
   return [...targets];
 }
+function hooksAreManagedBridge(agent, hooks, managed) {
+  const table = (value) => Boolean(value && typeof value === "object" && !Array.isArray(value));
+  const exactKeys3 = (value, keys2) => Object.keys(value).sort().join("\x00") === [...keys2].sort().join("\x00");
+  if (!table(hooks) || typeof managed.command !== "string" || !isAbsolute22(managed.command))
+    return false;
+  const events3 = agent === "gemini" ? ["BeforeAgent", "SessionStart", "BeforeTool"] : ["beforeSubmitPrompt", "sessionStart"];
+  for (const [event, entries] of Object.entries(hooks)) {
+    if (!events3.includes(event) || !Array.isArray(entries) || entries.length !== 1)
+      return false;
+    let expected;
+    try {
+      expected = renderAgentHookCommand(managed.command, agent, managed.profile, event);
+    } catch {
+      return false;
+    }
+    const entry = entries[0];
+    if (!table(entry))
+      return false;
+    if (agent === "cursor") {
+      if (!exactKeys3(entry, ["command", "timeout"]) || entry.timeout !== 15 || entry.command !== expected)
+        return false;
+      continue;
+    }
+    if (!exactKeys3(entry, event === "BeforeTool" ? ["hooks", "matcher"] : ["hooks"]) || event === "BeforeTool" && entry.matcher !== "activate_skill" || !Array.isArray(entry.hooks) || entry.hooks.length !== 1)
+      return false;
+    const hook = entry.hooks[0];
+    if (!table(hook) || !exactKeys3(hook, ["command", "timeout", "type"]) || hook.type !== "command" || hook.timeout !== 15000 || hook.command !== expected)
+      return false;
+  }
+  return true;
+}
+function sumiPluginLoadsOnlyBuiltins(text2) {
+  for (const match of text2.matchAll(/\b(?:import|require)\s*\(\s*(.?)/g)) {
+    const rest = text2.slice(match.index + match[0].length - match[1].length);
+    if (!/^(['"])node:[A-Za-z0-9_/.-]+\1/.test(rest))
+      return false;
+  }
+  for (const match of text2.matchAll(/\b(?:from|import)\s*(['"])([^'"]*)\1/g))
+    if (!match[2].startsWith("node:"))
+      return false;
+  return true;
+}
+function codexRootFreeControls(config2) {
+  const table = (value) => Boolean(value && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date));
+  const adapted = [];
+  const servers = config2.mcp_servers;
+  if (table(servers) && Object.keys(servers).length <= AGENT_POLICY_LIMITS.discoveryRoots && Object.entries(servers).every(([name, row]) => name !== "codex_apps" && name !== "_codex_apps" && isCodexLocalStdioMcpServer(name, row)))
+    adapted.push("mcp_servers");
+  const agents = config2.agents;
+  if (table(agents) && Object.keys(agents).length <= AGENT_POLICY_LIMITS.fields && Object.values(agents).every((value) => typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)))
+    adapted.push("agents");
+  return adapted;
+}
+function codexPluginHookHandlers(value) {
+  const table = (item) => Boolean(item && typeof item === "object" && !Array.isArray(item));
+  const identifier5 = (item) => typeof item === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(item);
+  const text2 = (item) => typeof item === "string" && item.length <= AGENT_POLICY_LIMITS.pathCharacters && !item.includes("\x00");
+  if (!table(value) || !Object.keys(value).every((key2) => key2 === "hooks" || key2 === "description") || value.description !== undefined && !text2(value.description) || !table(value.hooks) || Object.keys(value.hooks).length > 32)
+    return null;
+  const result = { commands: 0, servers: new Set };
+  for (const [event, groups] of Object.entries(value.hooks)) {
+    if (!CODEX_HOOK_EVENTS.has(event) || !Array.isArray(groups) || groups.length > 32)
+      return null;
+    for (const group of groups) {
+      if (!table(group) || !Object.keys(group).every((key2) => key2 === "hooks" || key2 === "matcher") || group.matcher !== undefined && !text2(group.matcher) || !Array.isArray(group.hooks) || group.hooks.length > 32)
+        return null;
+      for (const handler of group.hooks) {
+        if (!table(handler) || handler.timeout !== undefined && !(Number.isSafeInteger(handler.timeout) && handler.timeout >= 0) || handler.statusMessage !== undefined && !text2(handler.statusMessage))
+          return null;
+        if (handler.type === "command") {
+          if (!text2(handler.command) || !handler.command || !Object.keys(handler).every((key2) => ["type", "command", "commandWindows", "command_windows", "timeout", "async", "statusMessage", "additionalContextLimit"].includes(key2)))
+            return null;
+          result.commands++;
+        } else if (handler.type === "mcp_tool") {
+          if (!identifier5(handler.server) || !identifier5(handler.tool) || handler.input !== undefined && !table(handler.input) || !Object.keys(handler).every((key2) => ["type", "server", "tool", "input", "timeout", "statusMessage"].includes(key2)))
+            return null;
+          result.servers.add(handler.server);
+        } else
+          return null;
+      }
+    }
+  }
+  return result;
+}
 function resolveDiscovery(options, exclusion) {
   const canonical9 = options.canonical ?? resolve23, home = resolve23(options.home), agent = options.agent;
   const sources = [], roots = new Set, builtinNames = [];
+  const sumiLocalPluginTexts = new Map;
   const budget3 = discoveryByteBudget();
   let remainingEntries = AGENT_POLICY_LIMITS.discoveryDirectoryEntries;
   const entries = (path) => {
@@ -38739,12 +38846,38 @@ function resolveDiscovery(options, exclusion) {
     const controls = agent === "claude" ? claudeDiscoveryControlKeys(configText ?? "{}") : agent === "codex" ? codexDiscoveryControlKeys(config2) : Object.keys(config2).filter((key2) => /skill|plugin|hook|marketplace|extension|instruction/i.test(key2));
     const fieldKey = (key2) => /^[A-Za-z_$][A-Za-z0-9_$.-]{0,22}$/.test(key2) && !/(?:sk|rk|pk)_(?:live|test)_|whsec_/i.test(key2) ? JSON.stringify(key2) : "[withheld field key]";
     const unsupportedFields = (names, label) => unresolved(`unknown discovery controls have no root-exclusion adapter for ${label}${names.slice(0, 8).map(fieldKey).join(", ")}${names.length > 8 ? ", additional keys withheld" : ""} in ${quotedPath(canonical9(configPath))}`);
-    const unsupportedControls = controls.filter((key2) => !supported[agent].includes(key2));
+    const adapted = agent === "codex" ? codexRootFreeControls(config2) : agent === "opencode" && Array.isArray(config2.instructions) && config2.instructions.length === 0 ? ["instructions"] : [];
+    const unsupportedControls = controls.filter((key2) => !supported[agent].includes(key2) && !adapted.includes(key2));
     if (unsupportedControls.length)
       unsupportedFields(unsupportedControls, "");
     if (config2.hooks !== undefined && !object6(config2.hooks))
       unresolved("hooks must be an object");
-    const hasHooks = controls.includes("hooks") && config2.hooks !== undefined && Object.keys(config2.hooks).length > 0;
+    const managedSupervisorOnly = () => {
+      const supervisor = exclusion.managedHook?.supervisor;
+      if (agent !== "hermes" || !supervisor || typeof supervisor.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(supervisor.sha256) || !object6(config2.hooks))
+        return false;
+      let expected;
+      try {
+        expected = hermesHookDefinitions(supervisor);
+      } catch {
+        return false;
+      }
+      for (const [event, entries2] of Object.entries(config2.hooks)) {
+        const want = expected[event];
+        if (!want || !Array.isArray(entries2) || entries2.length !== 1 || !object6(entries2[0]))
+          return false;
+        const entry = entries2[0];
+        if (Object.keys(entry).sort().join("\x00") !== Object.keys(want).sort().join("\x00") || Object.keys(want).some((key2) => entry[key2] !== want[key2]))
+          return false;
+      }
+      try {
+        return hashRawDiscoveryFile(canonical9(supervisor.path), budget3) === supervisor.sha256;
+      } catch {
+        return false;
+      }
+    };
+    const managedBridgeOnly = (agent === "gemini" || agent === "cursor") && exclusion.managedHook !== undefined && hooksAreManagedBridge(agent, config2.hooks, exclusion.managedHook) || managedSupervisorOnly();
+    const hasHooks = controls.includes("hooks") && config2.hooks !== undefined && Object.keys(config2.hooks).length > 0 && !managedBridgeOnly;
     let hasPluginConfigs = false, hasFunctionHookEnvironment = false;
     const verifyCurrentOpaqueSettings = (label) => {
       const retained = exclusion.retained;
@@ -38849,7 +38982,9 @@ function resolveDiscovery(options, exclusion) {
           unresolved("malformed Sumi plugins");
     }
     if (agent === "hermes" && config2.skills !== undefined) {
-      keys2(config2.skills, ["external_dirs"], "Hermes skills");
+      keys2(config2.skills, ["external_dirs", "creation_nudge_interval"], "Hermes skills");
+      if (config2.skills.creation_nudge_interval !== undefined && !(Number.isSafeInteger(config2.skills.creation_nudge_interval) && config2.skills.creation_nudge_interval >= 0))
+        unresolved("malformed Hermes skills creation_nudge_interval");
       if (config2.skills.external_dirs !== undefined)
         paths(typeof config2.skills.external_dirs === "string" ? [config2.skills.external_dirs] : config2.skills.external_dirs, "Hermes external directories");
     }
@@ -38869,10 +39004,21 @@ function resolveDiscovery(options, exclusion) {
           unresolved(`malformed Codex ${key2}`);
       for (const value of Object.values(config2.plugins ?? {}))
         keys2(value, ["enabled"], "Codex plugin registration");
-      for (const value of Object.values(config2.marketplaces ?? {}))
-        keys2(value, ["source_type", "source"], "Codex marketplace registration");
+      for (const value of Object.values(config2.marketplaces ?? {})) {
+        keys2(value, ["source_type", "source", "last_updated"], "Codex marketplace registration");
+        if (value.last_updated !== undefined && (typeof value.last_updated !== "string" || !CODEX_MARKETPLACE_TIMESTAMP.test(value.last_updated)))
+          unresolved("malformed Codex marketplace refresh time");
+      }
       if (config2.skills !== undefined)
-        keys2(config2.skills, ["config", "bundled"], "Codex skills");
+        keys2(config2.skills, ["config", "bundled", "native_allowed_paths"], "Codex skills");
+      if (config2.skills?.native_allowed_paths !== undefined) {
+        for (const value of paths(config2.skills.native_allowed_paths, "Codex native allowed skill paths")) {
+          if (!isAbsolute22(value))
+            unresolved("relative Codex native allowed skill path");
+          const path = canonical9(value);
+          roots.add(path.endsWith(`${sep11}SKILL.md`) ? dirname24(path) : path);
+        }
+      }
       if (config2.skills?.bundled !== undefined) {
         keys2(config2.skills.bundled, ["enabled"], "Codex bundled skills");
         if (typeof config2.skills.bundled.enabled !== "boolean")
@@ -38930,7 +39076,9 @@ function resolveDiscovery(options, exclusion) {
           const target = join33(path, name);
           if (!lstatSync25(target).isFile())
             unresolved("local plugin packages need a dedicated discovery adapter");
-          witness(target);
+          const text2 = witness(target);
+          if (exclusion && text2 !== null)
+            sumiLocalPluginTexts.set(canonical9(target), text2);
         }
     }
     for (const root of roots) {
@@ -39064,16 +39212,88 @@ function resolveDiscovery(options, exclusion) {
     const unique = combined.filter((source, index) => combined.findIndex((candidate) => isDeepStrictEqual6(candidate, source)) === index);
     return { ...supplied, roots: [...new Set([...roots, ...supplied.roots])].sort(), sources: unique, ...agent === "gemini" ? { builtinNames } : {} };
   }
-  function plugin(root) {
+  const reviewedManifestAbsence = (root, manifestPath) => {
+    const retained = exclusion?.retained;
+    if (agent !== "claude" || retained?.method !== "reviewed" || ![join33(root, "skills"), root].some((path) => retained.roots.includes(path)))
+      return false;
+    const saved = retained.sources.filter((source) => source.path === canonical9(manifestPath) && source.hashMode === "path-bytes" && source.sha256 !== null && source.format === undefined && source.fields === undefined && source.managedPlugins === undefined);
+    return saved.length > 0 && saved.every((source) => projected(source, undefined, budget3) === source.sha256);
+  };
+  const reviewedInstalledCopy = (root, path, identity4) => {
+    const retained = exclusion?.retained;
+    if (agent !== "codex" || retained?.method !== "reviewed")
+      return false;
+    const inside = relative7(root, canonical9(path));
+    if (!inside || inside === ".." || inside.startsWith(`..${sep11}`) || isAbsolute22(inside))
+      return false;
+    const parent = canonical9(join33(nativeHome, "plugins/cache", identity4.marketplace, identity4.name));
+    const current = hashRawDiscoveryFile(canonical9(path), budget3);
+    if (current === null)
+      return false;
+    return retained.sources.some((source) => {
+      if (source.sha256 !== current || source.format !== undefined || source.fields !== undefined || ![undefined, "bytes"].includes(source.hashMode) || source.managedPlugins !== undefined || source.reviewArtifact !== undefined || !source.path.startsWith(parent + sep11))
+        return false;
+      const [version2, ...rest] = source.path.slice(parent.length + 1).split(sep11);
+      return Boolean(version2) && version2 !== "." && version2 !== ".." && rest.join(sep11) === inside;
+    });
+  };
+  const verifyCodexPluginHookClosure = (root, identity4, marketplaceSource, servers, declarations) => {
+    const retained = exclusion.retained;
+    if (retained.codexSemanticCache || retained.codexInstallationInputs || retained.codexRetiredMaterializations)
+      return verifyOpaqueClosure(declarations);
+    const within = (base, path) => path === base || path.startsWith(base + sep11);
+    const executables = [];
+    for (const server of servers) {
+      const row = config2.mcp_servers?.[server];
+      if (server === "codex_apps" || server === "_codex_apps" || !isCodexLocalStdioMcpServer(server, row))
+        unresolved("plugin hook MCP server is not a configured local stdio server");
+      for (const value of [row.command, ...row.args ?? []])
+        for (const candidate of [value, value.slice(value.indexOf("=") + 1)]) {
+          if (!isAbsolute22(candidate) || /[\0$]/.test(candidate) || executables.length >= AGENT_POLICY_LIMITS.discoveryRoots)
+            continue;
+          const path = canonical9(candidate);
+          if (lstatSync25(path, { throwIfNoEntry: false })?.isFile())
+            executables.push(path);
+        }
+    }
+    const cacheRoot = canonical9(join33(nativeHome, "plugins/cache"));
+    const ownCache = canonical9(join33(nativeHome, "plugins/cache", identity4.marketplace, identity4.name));
+    const ownCatalog = canonical9(join33(marketplaceSource, ".agents/plugins/marketplace.json"));
+    const account = canonical9(home);
+    const marketplaceRoots = Object.values(config2.marketplaces ?? {}).filter((market) => market?.source_type === "local" && typeof market.source === "string" && isAbsolute22(market.source)).map((market) => canonical9(market.source)).filter((path) => !within(path, account));
+    const otherPlugin = (path) => !within(root, path) && !within(ownCache, path) && path !== ownCatalog && !executables.includes(path) && (within(cacheRoot, path) || marketplaceRoots.some((base) => within(base, path)));
+    const sources2 = retained.sources.filter((source) => source.path !== canonical9(configPath) && !otherPlugin(source.path));
+    if (sources2.some((source) => source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || source.reviewArtifact !== undefined || ![undefined, "bytes", "path-bytes", "executable-v1"].includes(source.hashMode)))
+      return verifyOpaqueClosure(declarations);
+    const declared = declarations.map((path) => relative7(root, path));
+    const declaration = (path) => declarations.includes(path) || path.startsWith(ownCache + sep11) && declared.includes(path.slice(ownCache.length + 1).split(sep11).slice(1).join(sep11));
+    if (!sources2.some((source) => !declaration(source.path) && source.sha256 !== null))
+      unresolved("opaque executable dependency closure is unavailable");
+    for (const source of sources2)
+      if (projected(source, undefined, budget3) !== source.sha256) {
+        throw new NativeDiscoveryWitnessChange("input", source.path, `Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
+      }
+    verifyDiscoveryDirectories((retained.directories ?? []).filter((directory) => !otherPlugin(directory.path)));
+  };
+  const readCodexHookDeclaration = (text2, path) => {
+    if (text2 === null)
+      return null;
+    try {
+      return codexPluginHookHandlers(parseConfig(text2, path));
+    } catch {
+      return null;
+    }
+  };
+  function plugin(root, codex) {
     root = canonical9(root);
     safe6(root);
     if (exclusion)
       roots.add(root);
     const manifestPath = join33(root, agent === "claude" ? ".claude-plugin/plugin.json" : ".codex-plugin/plugin.json");
     const raw = witness(manifestPath, undefined, undefined, agent === "claude" ? "claude-plugin-manifest-v1" : undefined);
-    if (raw === null)
+    if (raw === null && !reviewedManifestAbsence(root, manifestPath))
       unresolved("plugin manifest missing");
-    const manifest = parseConfig(raw, manifestPath);
+    const manifest = raw === null ? {} : parseConfig(raw, manifestPath);
     if (exclusion && Object.keys(manifest).some((key2) => /skill|plugin|hook|marketplace|extension|instruction/i.test(key2) && !["skills", "hooks"].includes(key2)))
       unresolved("unknown plugin discovery controls");
     const hooks = witness(join33(root, "hooks/hooks.json"));
@@ -39081,20 +39301,35 @@ function resolveDiscovery(options, exclusion) {
       if (!exclusion || exclusion.retained?.method !== "reviewed")
         unresolved("plugin hooks require a separate no-skill-injection review");
       const required2 = [manifestPath, ...hooks !== null ? [join33(root, "hooks/hooks.json")] : []];
+      const scoped = agent === "codex" && codex !== undefined ? [] : undefined;
       if (manifest.hooks !== undefined) {
-        if (typeof manifest.hooks !== "string")
-          unresolved("unsupported plugin hooks target");
-        const hook = resolve23(root, manifest.hooks);
-        if (!hook.startsWith(root + sep11))
-          unresolved("plugin hooks target escapes its root");
-        required2.push(hook);
-      }
+        if (scoped && manifest.hooks && typeof manifest.hooks === "object" && !Array.isArray(manifest.hooks)) {
+          const inline = codexPluginHookHandlers(manifest.hooks);
+          if (!inline)
+            unresolved("unsupported inline plugin hooks");
+          scoped.push(inline);
+        } else {
+          if (typeof manifest.hooks !== "string")
+            unresolved("unsupported plugin hooks target");
+          const hook = resolve23(root, manifest.hooks);
+          if (!hook.startsWith(root + sep11))
+            unresolved("plugin hooks target escapes its root");
+          required2.push(hook);
+          if (scoped)
+            scoped.push(readCodexHookDeclaration(witness(hook), hook));
+        }
+      }
+      if (scoped && hooks !== null)
+        scoped.push(readCodexHookDeclaration(hooks, join33(root, "hooks/hooks.json")));
       for (const path of required2) {
         const saved = exclusion.retained.sources.filter((source) => source.path === canonical9(path) && source.sha256 !== null && source.format === undefined && source.fields === undefined);
-        if (!saved.length || saved.some((source) => projected(source, undefined, budget3) !== source.sha256))
+        if (saved.length ? saved.some((source) => projected(source, undefined, budget3) !== source.sha256) : !(scoped && reviewedInstalledCopy(root, path, codex)))
           unresolved("plugin hooks require current independently reviewed sources");
       }
-      verifyOpaqueClosure(required2.map((path) => canonical9(path)));
+      if (scoped && scoped.every((item) => item !== null && item.commands === 0)) {
+        verifyCodexPluginHookClosure(root, codex, codex.source, new Set(scoped.flatMap((item) => [...item.servers])), required2.map((path) => canonical9(path)));
+      } else
+        verifyOpaqueClosure(required2.map((path) => canonical9(path)));
     }
     const commands = join33(root, "commands");
     safe6(commands);
@@ -39150,7 +39385,7 @@ function resolveDiscovery(options, exclusion) {
       const catalog = parseConfig(catalogText, join33(market.source, ".agents/plugins/marketplace.json")), matches = Array.isArray(catalog.plugins) ? catalog.plugins.filter((item) => item.name === name) : [];
       if (matches.length !== 1 || matches[0]?.source?.source !== "local" || typeof matches[0]?.source?.path !== "string")
         unresolved("plugin catalog source is missing or ambiguous");
-      plugin(resolve23(market.source, matches[0].source.path));
+      plugin(resolve23(market.source, matches[0].source.path), exclusion ? { marketplace, name, source: market.source } : undefined);
     }
   } else if (agent === "opencode") {
     if (witness(join33(home, ".config/opencode/opencode.jsonc")) !== null || witness(join33(home, ".config/opencode/config.json")) !== null)
@@ -39167,7 +39402,11 @@ function resolveDiscovery(options, exclusion) {
     if (lstatSync25(localPlugins, { throwIfNoEntry: false }) && entries(localPlugins).some((name) => name !== "skills-cli.js"))
       unresolved("additional local plugin hooks require review");
   } else if (agent === "sumi") {
-    if ((config2.plugin?.length ?? 0) > 0 || (config2.plugins?.length ?? 0) > 0 || sources.some((source) => source.path !== canonical9(configPath) && source.path !== canonical9(join33(sumiConfigDirectory(home), "sumi.jsonc")) && source.sha256 !== null))
+    const pinnedLocalPlugin = (source) => {
+      const retained = exclusion?.retained, text2 = sumiLocalPluginTexts.get(source.path);
+      return retained?.method === "reviewed" && text2 !== undefined && sumiPluginLoadsOnlyBuiltins(text2) && retained.sources.some((saved) => saved.path === source.path && saved.sha256 === source.sha256 && saved.sha256 !== null && [undefined, "bytes"].includes(saved.hashMode) && saved.format === undefined && saved.fields === undefined && saved.managedPlugins === undefined && saved.reviewArtifact === undefined);
+    };
+    if ((config2.plugin?.length ?? 0) > 0 || (config2.plugins?.length ?? 0) > 0 || sources.some((source) => source.path !== canonical9(configPath) && source.path !== canonical9(join33(sumiConfigDirectory(home), "sumi.jsonc")) && source.sha256 !== null && !pinnedLocalPlugin(source)))
       unresolved("external or foreign local plugins require review");
   } else if (agent === "hermes") {
     for (const directory of [join33(home, ".hermes/plugins"), join33(home, ".hermes/hermes-agent")]) {
@@ -39207,11 +39446,12 @@ var DISCOVERY_RUNTIME_COMMANDS, quotedPath = (path) => JSON.stringify(path).repl
   } catch {
     return null;
   }
-}, digest2 = (text2) => createHash26("sha256").update(text2).digest("hex"), CLAUDE_CONTROL_WITNESS_MODES, CLAUDE_CONTROL_FILES, ADOPTABLE_SETTINGS_MATCHES, CLAUDE_PROJECT_DISCOVERY_KEYS;
+}, digest2 = (text2) => createHash26("sha256").update(text2).digest("hex"), CLAUDE_CONTROL_WITNESS_MODES, CLAUDE_CONTROL_FILES, ADOPTABLE_SETTINGS_MATCHES, CLAUDE_PROJECT_DISCOVERY_KEYS, CODEX_MARKETPLACE_TIMESTAMP, CODEX_HOOK_EVENTS;
 var init_agent_discovery = __esm(() => {
   init_sumi_settings_witness();
   init_agent_policy_limits();
   init_agent_hermes();
+  init_agent_adapters();
   init_agent_discovery_directories();
   init_agent_discovery_bytes();
   init_plugin_projection_store();
@@ -39241,6 +39481,8 @@ var init_agent_discovery = __esm(() => {
   CLAUDE_CONTROL_FILES = new Set(["settings.json", "settings.local.json", "installed_plugins.json", "known_marketplaces.json"]);
   ADOPTABLE_SETTINGS_MATCHES = Object.freeze(["exact", "screen-reader-receipt"]);
   CLAUDE_PROJECT_DISCOVERY_KEYS = Object.freeze(["enabledPlugins", "extraKnownMarketplaces", "additionalMarketplaces", "skillOverrides"]);
+  CODEX_MARKETPLACE_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?(?:Z|[+-]\d{2}:\d{2})$/;
+  CODEX_HOOK_EVENTS = new Set(["PreToolUse", "PermissionRequest", "PostToolUse", "PreCompact", "PostCompact", "SessionStart", "SessionEnd", "UserPromptSubmit", "SubagentStart", "SubagentStop", "Stop", "Interrupt"]);
 });
 
 // src/lib/authoring-path.ts
@@ -39318,7 +39560,10 @@ function configuredRoots(home, explicitHome) {
       if (recorded && (!executable || executable.target !== recorded.target || onPath && onPath.target !== recorded.target) || !executable && (binding.builtinNames?.length || binding.agent === "gemini" && binding.sources.some((source) => basename15(source.path) === "package.json"))) {
         throw new Error("Native discovery runtime target is unresolved or changed");
       }
-      roots.push(...resolveAgentDiscoveryExclusionRoots({ home, agent: binding.agent, canonical: physicalPath, retained: binding, executable, narrowed }));
+      const managedCommand = current.commands?.[agent], managedProfile = current.profiles?.[agent];
+      const supervisor = current.supervisors?.[agent];
+      const managedHook = (binding.agent === "gemini" || binding.agent === "cursor") && typeof managedCommand === "string" && typeof managedProfile === "string" ? { command: managedCommand, profile: managedProfile } : binding.agent === "hermes" && typeof managedCommand === "string" && typeof managedProfile === "string" && supervisor && typeof supervisor === "object" && typeof supervisor.path === "string" && typeof supervisor.runtime === "string" && typeof supervisor.sha256 === "string" ? { command: managedCommand, profile: managedProfile, supervisor: { path: supervisor.path, runtime: supervisor.runtime, sha256: supervisor.sha256 } } : undefined;
+      roots.push(...resolveAgentDiscoveryExclusionRoots({ home, agent: binding.agent, canonical: physicalPath, retained: binding, executable, narrowed, ...managedHook ? { managedHook } : {} }));
     }
   };
   if (homePolicy)
@@ -46326,1312 +46571,19 @@ var init_cloud_executions = __esm(() => {
   init_fleet_credentials();
 });
 
-// node_modules/@hasna/secrets/dist/sdk.js
-import { isIP as isIP2 } from "net";
-import { spawnSync as spawnSync5 } from "child_process";
-import { closeSync as closeSync22, fstatSync as fstatSync22, openSync as openSync22, readFileSync as readFileSync23 } from "fs";
-import { O_NOFOLLOW as O_NOFOLLOW3, O_NONBLOCK as O_NONBLOCK3, O_RDONLY as O_RDONLY3 } from "constants";
-import { createRequire as createRequire2 } from "module";
-import { hostname as osHostname2 } from "os";
-import { isAbsolute as isAbsolute28, join as join40 } from "path";
-import { createRequire as createRequire22 } from "module";
-function envToken2(name) {
-  return name.toUpperCase().replace(/-/g, "_");
-}
-function clientTransportEnvKeys2(name) {
-  const envSegment = envToken2(name);
-  return {
-    apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
-    apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
-  };
-}
-function credentialOverrideEnvKey2(name) {
-  return `HASNA_${envToken2(name)}_API_KEY_OVERRIDE`;
-}
-function credentialPointerEnvKey2(name) {
-  return `HASNA_${envToken2(name)}_API_KEY_REF`;
-}
-function homeDir2(env) {
-  const home = env.HOME?.trim();
-  return home ? home : null;
-}
-function absoluteOverride2(env, key2) {
-  const value = env[key2]?.trim();
-  return value && isAbsolute28(value) ? value : null;
-}
-function hasnaHomeDir2(env) {
-  const override = absoluteOverride2(env, HASNA_HOME_ENV_KEY2);
-  if (override)
-    return override;
-  const home = homeDir2(env);
-  return home ? join40(home, HASNA_HOME_DIR2) : null;
-}
-function appConfigDir2(name, env) {
-  const configRoot = absoluteOverride2(env, HASNA_CONFIG_HOME_ENV_KEY2);
-  if (configRoot)
-    return join40(configRoot, name);
-  const root = hasnaHomeDir2(env);
-  return root ? join40(root, name, CONFIG_SUBDIR2) : null;
-}
-function credentialDiskSourceList2(name, env, profile = null) {
-  if (!SAFE_APP_SLUG2.test(name))
-    return [];
-  const directory2 = appConfigDir2(name, env);
-  if (!directory2)
-    return [];
-  const file2 = profile ? `${CREDENTIALS_FILE2}-${profile}` : CREDENTIALS_FILE2;
-  return [{ path: join40(directory2, file2), tier: "disk" }];
-}
-function credentialDiskSources2(name, env) {
-  return credentialDiskSourceList2(name, env, null).map((s) => s.path);
-}
-function profileDiskSources2(name, env, profile) {
-  return credentialDiskSourceList2(name, env, profile).map((s) => s.path);
-}
-function parseEnvFile2(text4) {
-  const values = new Map;
-  const unusable = new Set;
-  for (const rawLine of text4.split(/\r?\n/)) {
-    const line = rawLine.trim();
-    if (line.length === 0 || line.startsWith("#"))
-      continue;
-    const withoutExport = line.startsWith("export ") ? line.slice("export ".length).trim() : line;
-    const equals = withoutExport.indexOf("=");
-    if (equals <= 0)
-      continue;
-    const key2 = withoutExport.slice(0, equals).trim();
-    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key2))
-      continue;
-    let value = withoutExport.slice(equals + 1).trim();
-    const quote3 = value[0];
-    if (quote3 === '"' || quote3 === "'") {
-      if (value.length < 2 || !value.endsWith(quote3)) {
-        unusable.add(key2);
-        continue;
-      }
-      value = value.slice(1, -1);
-    }
-    if (value.trim().length === 0) {
-      unusable.add(key2);
-      continue;
-    }
-    if (values.has(key2) && values.get(key2) !== value)
-      unusable.add(key2);
-    values.set(key2, value);
-  }
-  return { values, unusable };
-}
-function configFileModeAllowed2(mode) {
-  const permissions = mode & 4095;
-  return permissions === 256 || permissions === 384;
-}
-function configFileReadsCoherent2(before, after) {
-  return before.dev === after.dev && before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs;
-}
-function readAppConfigFile2(path) {
-  const unsafe = (reason2) => {
-    throw new CredentialFileUnsafeError2(path, reason2);
-  };
-  let fd = -1;
-  try {
-    fd = openSync22(path, O_RDONLY3 | O_NOFOLLOW3 | O_NONBLOCK3);
-  } catch (error61) {
-    const code2 = error61.code;
-    if (code2 === "ENOENT" || code2 === "ENOTDIR")
-      return null;
-    if (code2 === "ELOOP")
-      unsafe("the path is a symlink");
-    unsafe(`the path could not be opened (${code2 ?? "unknown error"})`);
-  }
-  try {
-    const before = fstatSync22(fd);
-    if (!before.isFile())
-      unsafe("the path is not a regular file");
-    if (!configFileModeAllowed2(before.mode)) {
-      unsafe(`permission mode ${(before.mode & 4095).toString(8).padStart(4, "0")} is not owner-only 0400 or 0600`);
-    }
-    const uid2 = process.getuid?.() ?? process.geteuid?.();
-    if (uid2 !== undefined && before.uid !== uid2)
-      unsafe("the file is not owned by the current user");
-    if (before.size > MAX_CREDENTIAL_FILE_BYTES2)
-      unsafe("the file exceeds the size limit");
-    const bytes = readFileSync23(fd);
-    const after = fstatSync22(fd);
-    if (!configFileReadsCoherent2(before, after)) {
-      unsafe("the file changed while being read");
-    }
-    return parseEnvFile2(bytes.toString("utf8"));
-  } finally {
-    if (fd !== -1)
-      closeSync22(fd);
-  }
-}
-function readCredentialFile2(path, apiKeyKeys) {
-  const parsed = readAppConfigFile2(path);
-  if (!parsed)
-    return null;
-  for (const key2 of apiKeyKeys) {
-    if (parsed.unusable.has(key2)) {
-      throw new CredentialFileUnsafeError2(path, `${key2} is declared but blank or malformed`);
-    }
-  }
-  const values = apiKeyKeys.map((key2) => parsed.values.get(key2)?.trim()).filter((value) => Boolean(value));
-  if (new Set(values).size > 1) {
-    throw new CredentialFileUnsafeError2(path, "credential aliases disagree");
-  }
-  return values[0] ?? null;
-}
-function appConfigDiskValue2(name, env, keys2) {
-  const wanted = keys2.filter((key2) => !CREDENTIAL_SHAPED_KEY2.test(key2));
-  if (wanted.length === 0)
-    return null;
-  for (const path of credentialDiskSources2(name, env)) {
-    const parsed = readAppConfigFile2(path);
-    if (!parsed)
-      continue;
-    if (wanted.some((key2) => parsed.unusable.has(key2))) {
-      return { key: wanted.find((key2) => parsed.unusable.has(key2)), value: "", path, unusable: true };
-    }
-    const values = wanted.map((key2) => parsed.values.get(key2)?.trim()).filter((value) => Boolean(value));
-    if (new Set(values).size > 1)
-      throw new CredentialFileUnsafeError2(path, "configuration aliases disagree");
-    for (const key2 of wanted) {
-      if (parsed.unusable.has(key2))
-        return { key: key2, value: "", path, unusable: true };
-      const value = parsed.values.get(key2)?.trim();
-      if (value)
-        return { key: key2, value, path };
-    }
-  }
-  return null;
-}
-function assertUsableCredential2(appName, source, value) {
-  if (VAULT_POINTER_SHAPE2.test(value)) {
-    throw new CredentialResolutionError2(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey2(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
-  }
-  if (!ILLEGAL_IN_HEADER_VALUE2.test(value))
-    return;
-  throw new CredentialResolutionError2(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
-}
-function sealCredential2(fields2) {
-  const { apiKey } = fields2;
-  const visible = {
-    tier: fields2.tier,
-    source: fields2.source,
-    deliberate: fields2.deliberate,
-    diskCandidates: Object.freeze([...fields2.diskCandidates]),
-    warning: fields2.warning
-  };
-  const sealed = { ...visible };
-  Object.defineProperty(sealed, "apiKey", {
-    value: apiKey,
-    enumerable: false,
-    writable: false,
-    configurable: false
-  });
-  if (fields2.pointerVaultKey !== undefined) {
-    Object.defineProperty(sealed, "pointerVaultKey", {
-      value: fields2.pointerVaultKey,
-      enumerable: false,
-      writable: false,
-      configurable: false
-    });
-  }
-  Object.defineProperty(sealed, INSPECT_CUSTOM2, {
-    value: () => ({ ...visible, apiKey: "[redacted]" }),
-    enumerable: false,
-    writable: false,
-    configurable: false
-  });
-  Object.defineProperty(sealed, CREDENTIAL_SEAL2, {
-    value: true,
-    enumerable: false,
-    writable: false,
-    configurable: false
-  });
-  return Object.freeze(sealed);
-}
-function isSealedCredential(credential) {
-  return credential[CREDENTIAL_SEAL2] === true;
-}
-function explicitCredential(appName, apiKey) {
-  const source = "explicit apiKey option";
-  assertUsableCredential2(appName, source, apiKey);
-  return sealCredential2({
-    apiKey,
-    tier: "argument",
-    source,
-    deliberate: true,
-    diskCandidates: [],
-    warning: null
-  });
-}
-function validateAndSealResolvedCredential(appName, credential) {
-  const apiKey = credential.apiKey;
-  assertUsableCredential2(appName, CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE, apiKey);
-  if (!isSealedCredential(credential)) {
-    return sealCredential2({
-      apiKey,
-      tier: "argument",
-      source: CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE,
-      deliberate: true,
-      diskCandidates: [],
-      warning: null
-    });
-  }
-  return sealCredential2({
-    apiKey,
-    tier: credential.tier,
-    source: credential.source,
-    deliberate: credential.deliberate,
-    diskCandidates: credential.diskCandidates,
-    warning: credential.warning,
-    ...credential.pointerVaultKey !== undefined ? { pointerVaultKey: credential.pointerVaultKey } : {}
-  });
-}
-function firstEnvValue2(env, keys2) {
-  for (const key2 of keys2) {
-    if (!Object.prototype.hasOwnProperty.call(env, key2))
-      continue;
-    const value = env[key2]?.trim();
-    if (value)
-      return { key: key2, value };
-  }
-  return null;
-}
-function isAmbientEnvironment2(env) {
-  return env === process.env || env[AMBIENT_ENVIRONMENT2] === true;
-}
-function defaultKeychainRunner2(argv) {
-  const result = spawnSync5(KEYCHAIN_SECURITY_BIN2, [...argv], {
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"],
-    timeout: KEYCHAIN_SPAWN_TIMEOUT_MS2
-  });
-  return {
-    status: result.status,
-    stdout: result.stdout ?? "",
-    stderr: result.error ? result.error.message : result.stderr ?? ""
-  };
-}
-function keychainTierEnabled2(env, options) {
-  if ((options.platform ?? process.platform) !== "darwin")
-    return false;
-  if (options.enabled !== undefined)
-    return options.enabled;
-  return options.run !== undefined || isAmbientEnvironment2(env);
-}
-function keychainAccount2(env, options) {
-  const station = env[KEYCHAIN_STATION_ENV_KEY2]?.trim();
-  if (station)
-    return station;
-  const host = (options.hostname ?? osHostname2)().split(".")[0]?.trim() ?? "";
-  if (host)
-    return host;
-  const user = env.USER?.trim();
-  return user || null;
-}
-function keychainFailureHint2(text4) {
-  const line = text4.split(/\r?\n/).find((entry) => entry.trim().length > 0)?.trim() ?? "";
-  const clean = line.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, 200);
-  return clean ? `: ${clean}` : "";
-}
-function readKeychainItem2(name, env, kind, options) {
-  if (!SAFE_APP_SLUG2.test(name) || !keychainTierEnabled2(env, options))
-    return null;
-  const account = keychainAccount2(env, options);
-  if (!account)
-    return null;
-  const service = `${KEYCHAIN_SERVICE_PREFIX2}.${name}.${kind}`;
-  const source = `keychain:${service}@${account}`;
-  const run = options.run ?? defaultKeychainRunner2;
-  let result;
-  try {
-    result = run(["find-generic-password", "-a", account, "-s", service, "-w"]);
-  } catch (error61) {
-    const reason2 = keychainFailureHint2(error61 instanceof Error ? error61.message : String(error61));
-    throw new CredentialResolutionError2(name, `The Keychain lookup for ${source} could not run${reason2}. A Keychain failure is never resolved ` + `around: fix the keychain, or delete the item to fall through to the credential on disk.`, [source]);
-  }
-  if (result.status === KEYCHAIN_ITEM_NOT_FOUND_STATUS2)
-    return null;
-  if (result.status !== 0) {
-    throw new CredentialResolutionError2(name, `The Keychain lookup for ${source} failed (security exited ` + `${result.status ?? "without a status"}${keychainFailureHint2(result.stderr)}). A Keychain item that ` + `exists but cannot be read is never resolved around: unlock the keychain, run from a session that ` + `may use it, or delete the item to fall through to the credential on disk.`, [source]);
-  }
-  const value = result.stdout.trim();
-  if (!value) {
-    throw new CredentialResolutionError2(name, `${source} exists but holds an empty value; a declared item never falls through to another ` + `identity. Store a value in it or delete the item.`, [source]);
-  }
-  return { value, source };
-}
-function keychainConfigValue2(name, env, options = {}) {
-  return readKeychainItem2(name, env, "api-url", options);
-}
-function snapshotClientEnvironment2(name, env) {
-  const keys2 = clientTransportEnvKeys2(name);
-  const ambient = isAmbientEnvironment2(env);
-  const snapshot2 = Object.create(null);
-  for (const key2 of [
-    ...keys2.apiUrlKeys,
-    ...keys2.apiKeyKeys,
-    credentialOverrideEnvKey2(name),
-    credentialPointerEnvKey2(name),
-    CREDENTIAL_PROFILE_ENV_KEY2,
-    "HOME",
-    HASNA_HOME_ENV_KEY2,
-    HASNA_CONFIG_HOME_ENV_KEY2,
-    KEYCHAIN_STATION_ENV_KEY2,
-    "USER"
-  ]) {
-    const descriptor = Object.getOwnPropertyDescriptor(env, key2);
-    if (!descriptor)
-      continue;
-    if (!("value" in descriptor)) {
-      throw new CredentialResolutionError2(name, `${key2} is accessor-backed; client configuration requires own data properties.`, [key2]);
-    }
-    if (descriptor.value !== undefined && typeof descriptor.value !== "string") {
-      throw new CredentialResolutionError2(name, `${key2} must be a string data property.`, [key2]);
-    }
-    snapshot2[key2] = descriptor.value;
-  }
-  if (ambient) {
-    Object.defineProperty(snapshot2, AMBIENT_ENVIRONMENT2, {
-      value: true,
-      enumerable: false,
-      writable: false,
-      configurable: false
-    });
-  }
-  return Object.freeze(snapshot2);
-}
-function resolveCredential2(name, env, options = {}) {
-  env = snapshotClientEnvironment2(name, env);
-  const { apiKeyKeys } = clientTransportEnvKeys2(name);
-  const diskPaths = credentialDiskSources2(name, env);
-  if (options.apiKey !== undefined) {
-    const explicitKey = options.apiKey.trim();
-    if (!explicitKey) {
-      throw new CredentialResolutionError2(name, "The explicit apiKey argument is blank; an explicit credential never falls through to another identity.", ["explicit apiKey argument"]);
-    }
-    assertUsableCredential2(name, "the explicit apiKey argument", explicitKey);
-    return sealCredential2({
-      apiKey: explicitKey,
-      tier: "argument",
-      source: "explicit apiKey argument",
-      deliberate: true,
-      diskCandidates: diskPaths,
-      warning: null
-    });
-  }
-  const overrideKeyName = credentialOverrideEnvKey2(name);
-  const overrideRaw = Object.prototype.hasOwnProperty.call(env, overrideKeyName) ? env[overrideKeyName] : undefined;
-  if (overrideRaw !== undefined) {
-    const override = overrideRaw.trim();
-    if (!override) {
-      throw new CredentialResolutionError2(name, `${overrideKeyName} is set but empty. It is a deliberate override, so it is not resolved around: ` + `either give it a real key or unset it to fall back to the credential on disk.`, [overrideKeyName]);
-    }
-    assertUsableCredential2(name, overrideKeyName, override);
-    return sealCredential2({
-      apiKey: override,
-      tier: "override",
-      source: overrideKeyName,
-      deliberate: true,
-      diskCandidates: diskPaths,
-      warning: null
-    });
-  }
-  const pointerKeyName = credentialPointerEnvKey2(name);
-  const pointerRaw = Object.prototype.hasOwnProperty.call(env, pointerKeyName) ? env[pointerKeyName] : undefined;
-  if (pointerRaw !== undefined) {
-    const pointer = pointerRaw.trim();
-    if (!pointer) {
-      throw new CredentialResolutionError2(name, `${pointerKeyName} is set but empty. It is a deliberate vault pointer, so it is not resolved around: ` + `either give it a vault item key or unset it to fall back to the credential on disk.`, [pointerKeyName]);
-    }
-    if (!VAULT_POINTER_SHAPE2.test(pointer)) {
-      throw new CredentialResolutionError2(name, `${pointerKeyName} must name a vault ITEM KEY (a path-shaped reference like ` + `'namespace/app/live/api_key'), not a credential value. A pointer that carries a literal is refused.`, [pointerKeyName]);
-    }
-    return sealCredential2({
-      apiKey: "",
-      pointerVaultKey: pointer,
-      tier: "pointer",
-      source: pointerKeyName,
-      deliberate: true,
-      diskCandidates: diskPaths,
-      warning: null
-    });
-  }
-  if (options.profile !== undefined && !options.profile.trim()) {
-    throw new CredentialResolutionError2(name, "The explicit profile argument is blank; an explicit identity selection never falls through.", ["explicit profile argument"]);
-  }
-  const profileRaw = Object.prototype.hasOwnProperty.call(env, CREDENTIAL_PROFILE_ENV_KEY2) ? env[CREDENTIAL_PROFILE_ENV_KEY2] : undefined;
-  if (profileRaw !== undefined && !profileRaw.trim()) {
-    throw new CredentialResolutionError2(name, `${CREDENTIAL_PROFILE_ENV_KEY2} is set but blank.`, [CREDENTIAL_PROFILE_ENV_KEY2]);
-  }
-  const profile = options.profile?.trim() || profileRaw?.trim();
-  if (profile) {
-    const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY2;
-    if (!SAFE_PROFILE2.test(profile)) {
-      throw new CredentialResolutionError2(name, `Profile name from ${profileSource} is not usable in a path. ` + `Use letters, digits, dot, dash, or underscore.`, [profileSource]);
-    }
-    const paths = profileDiskSources2(name, env, profile);
-    for (const path of paths) {
-      const value = readCredentialFile2(path, apiKeyKeys);
-      if (value) {
-        assertUsableCredential2(name, path, value);
-        return sealCredential2({
-          apiKey: value,
-          tier: "profile",
-          source: path,
-          deliberate: true,
-          diskCandidates: paths,
-          warning: null
-        });
-      }
-    }
-    throw new CredentialResolutionError2(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY2}.`, paths);
-  }
-  const definedEnvEntries = apiKeyKeys.filter((key2) => Object.prototype.hasOwnProperty.call(env, key2) && env[key2] !== undefined).map((key2) => ({ key: key2, value: String(env[key2]).trim() }));
-  const blankEnv = definedEnvEntries.find((entry) => entry.value.length === 0);
-  if (blankEnv) {
-    throw new CredentialResolutionError2(name, `${blankEnv.key} is set but blank; a declared credential never falls through to another alias or identity.`, [blankEnv.key]);
-  }
-  if (definedEnvEntries.length > 1 && new Set(definedEnvEntries.map((entry) => entry.value)).size > 1) {
-    throw new CredentialResolutionError2(name, `${definedEnvEntries.map((entry) => entry.key).join(" and ")} disagree; credential aliases must be identical or only one may be set.`, definedEnvEntries.map((entry) => entry.key));
-  }
-  const envHit = firstEnvValue2(env, apiKeyKeys);
-  const keychainHit = readKeychainItem2(name, env, "api-key", options.keychain ?? {});
-  if (keychainHit) {
-    assertUsableCredential2(name, keychainHit.source, keychainHit.value);
-    const warning = envHit && envHit.value !== keychainHit.value ? `Credential sources disagree for '${name}': ${keychainHit.source} and ${envHit.key} hold ` + `different keys. ${keychainHit.source} wins, because the Keychain is re-read on every call while ` + `an environment variable is a snapshot. Reconcile them \u2014 a rotation that updated only one leaves ` + `the other to fail 401 wherever it is loaded first.` : null;
-    return sealCredential2({
-      apiKey: keychainHit.value,
-      tier: "keychain",
-      source: keychainHit.source,
-      deliberate: false,
-      diskCandidates: diskPaths,
-      warning
-    });
-  }
-  const diskSourceList = credentialDiskSourceList2(name, env, null);
-  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile2(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
-  if (diskHits.length > 0) {
-    const winner = diskHits[0];
-    assertUsableCredential2(name, winner.src.path, winner.value);
-    const divergentSources = [
-      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
-      ...envHit && envHit.value !== winner.value ? [envHit.key] : []
-    ];
-    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
-    return sealCredential2({
-      apiKey: winner.value,
-      tier: winner.src.tier,
-      source: winner.src.path,
-      deliberate: false,
-      diskCandidates: diskPaths,
-      warning
-    });
-  }
-  if (envHit) {
-    assertUsableCredential2(name, envHit.key, envHit.value);
-    return sealCredential2({
-      apiKey: envHit.value,
-      tier: "env",
-      source: envHit.key,
-      deliberate: false,
-      diskCandidates: diskPaths,
-      warning: null
-    });
-  }
-  return null;
-}
-async function completePointerCredential2(name, pointerResolution, env = process.env) {
-  const vaultKey = pointerResolution.pointerVaultKey;
-  const pointerEnvKey = pointerResolution.source;
-  if (!vaultKey) {
-    throw new CredentialResolutionError2(name, `Pointer resolution from ${pointerEnvKey} carries no vault item key; this is a defect in the resolver.`, [pointerEnvKey]);
-  }
-  let secretsSdk;
-  try {
-    secretsSdk = requireSecretsSdk2(SECRETS_PACKAGE_SPECIFIER);
-  } catch {
-    throw new CredentialResolutionError2(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets SDK (@hasna/secrets) is not installed ` + `in this process. A vault pointer is TERMINAL: install @hasna/secrets to resolve it, or unset ${pointerEnvKey}.`, [pointerEnvKey]);
-  }
-  let client;
-  try {
-    client = secretsSdk.createSecretsClientFromEnv(env);
-  } catch {
-    throw new CredentialResolutionError2(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets client could not be configured from this ` + `environment (the secrets service URL and key env are missing or invalid). A vault pointer is TERMINAL and ` + `never falls through to a literal or disk credential.`, [pointerEnvKey]);
-  }
-  let secret;
+// src/lib/execution-secrets.ts
+import { constants as constants20, closeSync as closeSync22, fstatSync as fstatSync22, openSync as openSync22, readSync as readSync15, realpathSync as realpathSync12 } from "fs";
+import { hostname as stationHostname } from "os";
+async function defaultSecretsClientFactory(load2 = () => import("@hasna/secrets/sdk")) {
+  let sdk;
   try {
-    secret = await client.getSecret({ key: vaultKey });
+    sdk = await load2();
   } catch {
-    throw new CredentialResolutionError2(name, `${pointerEnvKey} names vault item '${vaultKey}', but the vault could not be reached or the item is ` + `unavailable. A vault pointer is TERMINAL and never falls through to a literal or disk credential.`, [pointerEnvKey]);
-  }
-  const value = secret.value;
-  if (!value) {
-    throw new CredentialResolutionError2(name, `${pointerEnvKey} resolved vault item '${vaultKey}', but it holds no value. A vault pointer is TERMINAL.`, [pointerEnvKey]);
-  }
-  assertUsableCredential2(name, `${pointerEnvKey} -> vault:${vaultKey}`, value);
-  return sealCredential2({
-    apiKey: value,
-    tier: "pointer",
-    source: `${pointerEnvKey} -> vault:${vaultKey}`,
-    deliberate: true,
-    diskCandidates: pointerResolution.diskCandidates,
-    warning: null
-  });
-}
-function defaultFleetGatewayBaseUrl2(name) {
-  return `${DEFAULT_FLEET_GATEWAY_ORIGIN2}/${validateAppSlug2(name)}`;
-}
-function isValidDnsDomain2(value) {
-  if (value.length === 0 || value.length > 253 || ASCII_CONTROL_PATTERN2.test(value) || /[^\x00-\x7f]/.test(value)) {
-    return false;
+    return refuse5("LOCAL_SECRET_UNAVAILABLE", "Vault secret bindings need the optional @hasna/secrets package, which this install could not load. Install @hasna/secrets with access to it, then run again.");
   }
-  return value.split(".").every((label) => label.length <= 63 && !label.startsWith("xn--") && DNS_LABEL_PATTERN2.test(label));
+  return () => sdk.createSecretsClientFromEnv();
 }
-function validateAppSlug2(name) {
-  if (name.length > 63 || !DNS_LABEL_PATTERN2.test(name)) {
-    throw new Error("App name must be one lowercase DNS label.");
-  }
-  return name;
-}
-function rawAuthority2(value) {
-  const match = /^[a-z][a-z0-9+.-]*:\/\//i.exec(value);
-  if (!match)
-    throw new Error("API URL must be absolute.");
-  const afterScheme = value.slice(match[0].length);
-  const boundary = afterScheme.search(/[/?#]/);
-  const authority = boundary === -1 ? afterScheme : afterScheme.slice(0, boundary);
-  if (!authority)
-    throw new Error("API URL must include a hostname.");
-  return authority;
-}
-function assertCanonicalPort2(port) {
-  if (!/^[0-9]+$/.test(port) || port.length > 1 && port.startsWith("0")) {
-    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
-  }
-  const numericPort = Number(port);
-  if (!Number.isSafeInteger(numericPort) || numericPort < 1 || numericPort > 65535) {
-    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
-  }
-}
-function canonicalAuthorityHostname2(authority) {
-  let rawHostname;
-  if (authority.startsWith("[")) {
-    const closingBracket = authority.indexOf("]");
-    if (closingBracket === -1) {
-      throw new Error("API URL authority must contain a canonical hostname.");
-    }
-    rawHostname = authority.slice(0, closingBracket + 1);
-    const portSuffix = authority.slice(closingBracket + 1);
-    if (portSuffix) {
-      if (!portSuffix.startsWith(":")) {
-        throw new Error("API URL authority must contain a canonical hostname and port.");
-      }
-      assertCanonicalPort2(portSuffix.slice(1));
-    }
-    if (isIP2(rawHostname.slice(1, -1)) !== 6) {
-      throw new Error("API URL authority must contain a canonical IPv6 literal.");
-    }
-  } else {
-    const firstColon = authority.indexOf(":");
-    const lastColon = authority.lastIndexOf(":");
-    if (firstColon !== lastColon) {
-      throw new Error("IPv6 API URL authorities must use brackets.");
-    }
-    if (lastColon !== -1) {
-      const port = authority.slice(lastColon + 1);
-      assertCanonicalPort2(port);
-      rawHostname = authority.slice(0, lastColon);
-    } else {
-      rawHostname = authority;
-    }
-    const ipVersion = isIP2(rawHostname);
-    const numericAddressParts = rawHostname.split(".");
-    const looksLikeNonCanonicalIpv4 = numericAddressParts.every((part) => /^(?:0x[0-9a-f]+|[0-9]+)$/i.test(part));
-    if (ipVersion !== 4 && looksLikeNonCanonicalIpv4 || ipVersion !== 4 && !isValidDnsDomain2(rawHostname.toLowerCase())) {
-      throw new Error("API URL authority must contain a canonical ASCII hostname.");
-    }
-  }
-  return rawHostname.toLowerCase();
-}
-function isDeliberateLoopbackHttpAuthority2(authority) {
-  return /^(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]+)?$/i.test(authority);
-}
-function toV1BaseUrl2(apiUrl) {
-  if (ASCII_CONTROL_PATTERN2.test(apiUrl)) {
-    throw new Error("API URL must not contain ASCII control characters.");
-  }
-  const input2 = apiUrl.trim();
-  const authority = rawAuthority2(input2);
-  if (authority.includes("@") || authority.includes("\\") || authority.includes("%") || /[^\x00-\x7f]/.test(authority)) {
-    throw new Error("API URL authority must be canonical ASCII without credentials.");
-  }
-  const canonicalHostname = canonicalAuthorityHostname2(authority);
-  const url2 = new URL(input2);
-  if (url2.protocol !== "http:" && url2.protocol !== "https:") {
-    throw new Error("API URL must use http or https.");
-  }
-  if (url2.username || url2.password) {
-    throw new Error("API URL must not include credentials.");
-  }
-  if (!url2.hostname || url2.hostname.endsWith(".")) {
-    throw new Error("API URL must include a canonical hostname.");
-  }
-  if (url2.hostname.toLowerCase() !== canonicalHostname) {
-    throw new Error("API URL authority must not rely on parser hostname normalization.");
-  }
-  if (url2.hostname.split(".").some((label) => label.toLowerCase().startsWith("xn--"))) {
-    throw new Error("API URL must not use IDN or punycode hostnames.");
-  }
-  if (url2.protocol === "http:" && !isDeliberateLoopbackHttpAuthority2(authority)) {
-    throw new Error("API URL may use http only for an exact loopback authority.");
-  }
-  if (url2.search || url2.hash) {
-    throw new Error("API URL must not include a query string or fragment.");
-  }
-  let path = url2.pathname.replace(/\/+$/, "");
-  if (path.endsWith("/v1"))
-    path = path.slice(0, -"/v1".length);
-  url2.pathname = `${path}/v1`;
-  return url2.toString().replace(/\/+$/, "");
-}
-function resolveClientTransportSnapshot(name, env = process.env, options = {}) {
-  env = snapshotClientEnvironment2(name, env);
-  const keys2 = clientTransportEnvKeys2(name);
-  const definedUrlEntries = keys2.apiUrlKeys.filter((key2) => Object.prototype.hasOwnProperty.call(env, key2) && env[key2] !== undefined).map((key2) => ({ key: key2, raw: String(env[key2]) }));
-  const blankUrl = definedUrlEntries.find((entry) => entry.raw.trim().length === 0);
-  if (blankUrl) {
-    throw new ClientTransportConfigurationError2(name, `${blankUrl.key} is set but blank; public clients require an explicit HTTPS API URL and never select local storage.`, [blankUrl.key]);
-  }
-  const controlledUrl = definedUrlEntries.find((entry) => ASCII_CONTROL_PATTERN2.test(entry.raw));
-  if (controlledUrl) {
-    throw new ClientTransportConfigurationError2(name, `${controlledUrl.key} contains ASCII control characters.`, [controlledUrl.key]);
-  }
-  const usableUrlEntries = definedUrlEntries.map((entry) => ({ key: entry.key, value: entry.raw.trim() }));
-  if (usableUrlEntries.length > 1 && new Set(usableUrlEntries.map((entry) => entry.value)).size > 1) {
-    throw new ClientTransportConfigurationError2(name, `${usableUrlEntries.map((entry) => entry.key).join(" and ")} disagree; client authority aliases must be identical or only one may be set.`, usableUrlEntries.map((entry) => entry.key));
-  }
-  const envUrlHit = usableUrlEntries[0] ?? null;
-  const keychainUrlHit = keychainConfigValue2(name, env, options.credentials?.keychain);
-  const diskConfigUrlHit = appConfigDiskValue2(name, env, keys2.apiUrlKeys);
-  if (diskConfigUrlHit?.unusable) {
-    throw new ClientTransportConfigurationError2(name, `${diskConfigUrlHit.key} in ${diskConfigUrlHit.path} is declared but blank or malformed; public clients require a valid HTTPS service authority.`, [diskConfigUrlHit.path]);
-  }
-  const urlCandidates = [
-    ...envUrlHit ? [envUrlHit] : [],
-    ...keychainUrlHit ? [{ key: keychainUrlHit.source, value: keychainUrlHit.value }] : [],
-    ...diskConfigUrlHit ? [{ key: diskConfigUrlHit.path, value: diskConfigUrlHit.value.trim() }] : []
-  ];
-  const configuredUrl = urlCandidates[0] ?? null;
-  const divergentUrls = urlCandidates.filter((candidate) => candidate.value !== configuredUrl?.value);
-  if (configuredUrl && divergentUrls.length > 0) {
-    throw new ClientTransportConfigurationError2(name, `${configuredUrl.key} and ${divergentUrls.map((candidate) => candidate.key).join(" and ")} select different service authorities; refusing to send a credential written for one authority to the other.`, urlCandidates.map((candidate) => candidate.key));
-  }
-  const warnings = [];
-  if (configuredUrl && !envUrlHit) {
-    warnings.push(`No ${keys2.apiUrlKeys[0]} in the environment; the server URL in ${configuredUrl.key} was used, so this client connects to the server. ` + `Keep that entry aligned with the intended service authority.`);
-  }
-  const credential = resolveCredential2(name, env, options.credentials);
-  if (!credential) {
-    const diskHint = credentialDiskSourcesForMessage(name, env);
-    const lead = configuredUrl ? `${configuredUrl.key} selects the HTTP server for '${name}', but no API key could be resolved` : `${keys2.apiUrlKeys[0]} is not set and no API key could be resolved for '${name}'; a credential is required before the default fleet gateway authority applies`;
-    warnings.push(`${lead}; refusing to create an unauthenticated client \u2014 public clients never fall back to SQLite or another local store. ` + `Looked in the Keychain (macOS only), then for a credential file at ${diskHint}, then for ${keys2.apiKeyKeys[0]} in the environment.`);
-    throw new ClientTransportConfigurationError2(name, warnings.join(" "), [configuredUrl?.key ?? keys2.apiUrlKeys[0]]);
-  }
-  if (credential.warning)
-    warnings.push(credential.warning);
-  let urlHit;
-  if (configuredUrl) {
-    urlHit = configuredUrl;
-  } else {
-    try {
-      urlHit = { key: DEFAULT_AUTHORITY_SOURCE, value: defaultFleetGatewayBaseUrl2(name) };
-    } catch (error61) {
-      const message = error61 instanceof Error ? error61.message : String(error61);
-      throw new ClientTransportConfigurationError2(name, `No ${keys2.apiUrlKeys[0]} is configured and the default fleet gateway authority cannot be composed for '${name}': ${message}`, [keys2.apiUrlKeys[0]]);
-    }
-  }
-  const apiUrlSource = urlHit.key;
-  let baseUrl;
-  try {
-    baseUrl = toV1BaseUrl2(urlHit.value);
-  } catch (error61) {
-    const message = error61 instanceof Error ? error61.message : String(error61);
-    throw new ClientTransportConfigurationError2(name, `Invalid API URL from ${apiUrlSource}: ${message}`, [apiUrlSource]);
-  }
-  return {
-    resolution: {
-      transport: "http",
-      transportSource: urlHit.key,
-      baseUrl,
-      apiUrlSource,
-      apiKeyPresent: true,
-      apiKeySource: credential.source,
-      apiKeyTier: credential.tier,
-      misconfigured: false,
-      warning: warnings.length > 0 ? warnings.join(" ") : null
-    },
-    credential
-  };
-}
-function resolveClientTransport(name, env = process.env, options = {}) {
-  return resolveClientTransportSnapshot(name, env, options).resolution;
-}
-function credentialDiskSourcesForMessage(name, env) {
-  const paths = credentialDiskSources2(name, env);
-  return paths.length > 0 ? paths.join(" or ") : "<no HOME or HASNA_HOME set in this environment, so no credential file was consulted>";
-}
-function currentCredential(name, apiKey) {
-  if (typeof apiKey === "function") {
-    return validateAndSealResolvedCredential(name, apiKey());
-  }
-  return explicitCredential(name, apiKey);
-}
-async function resolveRequestCredential(name, apiKey, env = process.env) {
-  const resolved = currentCredential(name, apiKey);
-  if (resolved.tier === "pointer") {
-    return completePointerCredential2(name, resolved, env);
-  }
-  return resolved;
-}
-function authFailureGuidance(credential) {
-  const origin = `The API key for this request came from ${credential.source}`;
-  if (credential.deliberate) {
-    const remedy = credential.source === CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE ? `Fix that provider so it returns the current key, or replace it with resolveCredential() ` + `so diagnostics can name the original source.` : `Rotate that key, or unset the override to use the credential on disk.`;
-    return `${origin} \u2014 a credential you selected deliberately. It was NOT substituted with any other key: ` + `falling back here would authenticate as a different principal than the one you named, which is ` + `exactly the failure an override exists to prevent. ${remedy}`;
-  }
-  if (credential.tier === "env") {
-    const target = credential.diskCandidates[0];
-    const remedy = target ? `Store the CURRENT key in the Keychain or write it to ${target} \u2014 both are re-read on every call, so ` + `rotations take effect immediately and in every shell. Do not simply unset ${credential.source}: ` + `nothing was found in the Keychain or on disk, so that would leave this client with no credential at all.` : `This environment has no HOME or HASNA_HOME, so no credential file could be consulted; the disk tier is ` + `unavailable here and there is nothing to fall back to. Set HOME, or supply the key explicitly.`;
-    return `${origin}, a variable in this process's environment. If a wrapper injected it for this one process, the ` + `wrapper re-reads its store on every invocation and the stored key itself is being rejected \u2014 rotate it. ` + `If this SHELL exported it, the export is a snapshot taken when the shell started: a STALE SHELL that ` + `exported the key before it was rotated keeps sending the old one until it exits. ${remedy}`;
-  }
-  if (credential.tier === "keychain") {
-    return `${origin}, which was re-read from the Keychain on this very call \u2014 so a stale shell is NOT the cause ` + `here. The stored item is genuinely being rejected: update it with the current key, or re-run the fleet ` + `key distribution so this machine gets the current key.`;
-  }
-  return `${origin}, which was re-read from disk on this very call \u2014 so a stale shell is NOT the cause here. ` + `The stored credential is genuinely being rejected: rotate it, or re-run the fleet key distribution ` + `so this machine gets the current key.`;
-}
-function assertNoAuthorityOverrideHeaders(headers, source) {
-  if (!headers)
-    return;
-  const forbidden = Object.keys(headers).find((name) => AUTHORITY_OVERRIDE_HEADERS2.has(name.trim().toLowerCase()));
-  if (forbidden) {
-    throw new Error(`Authenticated ${source} headers must not set authority header '${forbidden}'.`);
-  }
-}
-function appendQuery(path, query) {
-  if (!query)
-    return path;
-  const params = query instanceof URLSearchParams ? query : new URLSearchParams;
-  if (!(query instanceof URLSearchParams)) {
-    for (const [key2, value] of Object.entries(query)) {
-      if (value === null || value === undefined)
-        continue;
-      if (Array.isArray(value)) {
-        for (const v of value)
-          params.append(key2, String(v));
-      } else {
-        params.append(key2, String(value));
-      }
-    }
-  }
-  const qs = params.toString();
-  if (!qs)
-    return path;
-  return `${path}${path.includes("?") ? "&" : "?"}${qs}`;
-}
-function createHasnaHttpTransportInternal(options, requestBindingProvider) {
-  const fetchImpl = options.fetchImpl ?? ((input2, init) => fetch(input2, init));
-  const base2 = toV1BaseUrl2(options.baseUrl);
-  const timeoutMs = options.timeoutMs ?? 30000;
-  const sleep = options.sleepImpl ?? defaultSleep;
-  const defaultRetry = options.retry;
-  function resolveRetry(callRetry) {
-    const chosen = callRetry !== undefined ? callRetry : defaultRetry;
-    if (chosen === false)
-      return null;
-    const r2 = chosen ?? {};
-    return {
-      retries: r2.retries ?? 2,
-      baseDelayMs: r2.baseDelayMs ?? 200,
-      maxDelayMs: r2.maxDelayMs ?? 2000,
-      retryStatuses: r2.retryStatuses ?? [...DEFAULT_RETRY_STATUSES]
-    };
-  }
-  async function once(method, rel, url2, body, opts, credential) {
-    assertNoAuthorityOverrideHeaders(options.headers, "transport");
-    assertNoAuthorityOverrideHeaders(opts.headers, "request");
-    const headers = {
-      "x-api-key": credential.apiKey,
-      Authorization: `Bearer ${credential.apiKey}`,
-      Accept: "application/json",
-      ...options.headers ?? {},
-      ...opts.headers ?? {}
-    };
-    if (opts.idempotencyKey)
-      headers["Idempotency-Key"] = opts.idempotencyKey;
-    const init = {
-      method,
-      headers,
-      redirect: "manual"
-    };
-    if (body !== undefined) {
-      headers["Content-Type"] = "application/json";
-      init.body = JSON.stringify(body);
-    }
-    const controller = new AbortController;
-    const onAbort = () => controller.abort();
-    if (opts.signal) {
-      if (opts.signal.aborted)
-        controller.abort();
-      else
-        opts.signal.addEventListener("abort", onAbort, { once: true });
-    }
-    const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? timeoutMs);
-    init.signal = controller.signal;
-    let response;
-    try {
-      response = await fetchImpl(url2, init);
-    } catch (error61) {
-      const err = error61 instanceof Error ? error61 : new Error(String(error61));
-      if (opts.signal?.aborted)
-        return { ok: false, retryable: false, error: err };
-      return { ok: false, retryable: true, error: err };
-    } finally {
-      clearTimeout(timer);
-      if (opts.signal)
-        opts.signal.removeEventListener("abort", onAbort);
-    }
-    const authenticationFailure = response.status === 401 || response.status === 403;
-    let parsed = undefined;
-    if (authenticationFailure) {
-      try {
-        await response.body?.cancel();
-      } catch {}
-    } else {
-      const text4 = await response.text();
-      if (text4.length > 0) {
-        try {
-          parsed = JSON.parse(text4);
-        } catch {
-          parsed = text4;
-        }
-      }
-    }
-    if (!response.ok) {
-      if (response.status >= 300 && response.status < 400) {
-        return {
-          ok: false,
-          retryable: false,
-          error: new HasnaHttpError(method, rel, response.status, parsed)
-        };
-      }
-      if (authenticationFailure) {
-        return {
-          ok: false,
-          retryable: false,
-          error: new HasnaHttpError(method, rel, response.status, undefined, {
-            source: credential.source,
-            tier: credential.tier,
-            guidance: authFailureGuidance(credential)
-          })
-        };
-      }
-      const retry = resolveRetry(opts.retry);
-      const retryable = retry ? retry.retryStatuses.includes(response.status) : false;
-      return { ok: false, retryable, error: new HasnaHttpError(method, rel, response.status, parsed) };
-    }
-    return { ok: true, value: parsed };
-  }
-  async function request(method, path, body, opts = {}) {
-    const upper = method.toUpperCase();
-    const rel = appendQuery(path.startsWith("/") ? path : `/${path}`, opts.query);
-    const retry = resolveRetry(opts.retry);
-    const methodRetryable = IDEMPOTENT_METHODS2.has(upper) || Boolean(opts.idempotencyKey);
-    const maxAttempts = retry && methodRetryable ? retry.retries + 1 : 1;
-    const binding = requestBindingProvider ? await requestBindingProvider() : {
-      baseUrl: base2,
-      credential: await resolveRequestCredential(options.name, options.apiKey)
-    };
-    const url2 = `${binding.baseUrl}${rel}`;
-    const credential = binding.credential;
-    let last = null;
-    for (let attempt = 1;attempt <= maxAttempts; attempt++) {
-      const result = await once(upper, rel, url2, body, opts, credential);
-      if (result.ok)
-        return result.value;
-      last = result;
-      const canRetry = retry !== null && methodRetryable && result.retryable && attempt < maxAttempts;
-      if (!canRetry)
-        break;
-      const backoff = Math.min(retry.maxDelayMs, retry.baseDelayMs * 2 ** (attempt - 1));
-      const jitter = Math.floor(Math.random() * (backoff / 2 + 1));
-      await sleep(backoff + jitter);
-    }
-    throw last.error;
-  }
-  return {
-    baseUrl: base2,
-    request,
-    get: (path, opts) => request("GET", path, undefined, opts),
-    post: (path, body, opts) => request("POST", path, body, opts),
-    put: (path, body, opts) => request("PUT", path, body, opts),
-    patch: (path, body, opts) => request("PATCH", path, body, opts),
-    del: (path, body, opts) => request("DELETE", path, body, opts)
-  };
-}
-function createHasnaHttpTransport(options) {
-  return createHasnaHttpTransportInternal(options);
-}
-
-class SecretsClient {
-  transport;
-  probeRoot;
-  fetchImpl;
-  baseHeaders;
-  constructor(options) {
-    if (!options.baseUrl)
-      throw new Error("SecretsClient requires a baseUrl.");
-    this.transport = createHasnaHttpTransport({
-      name: "secrets",
-      baseUrl: options.baseUrl.replace(/\/+$/, ""),
-      apiKey: options.apiKey ?? "",
-      ...options.fetch ? { fetchImpl: (input2, init) => options.fetch(input2, init) } : {},
-      ...options.headers ? { headers: options.headers } : {}
-    });
-    this.probeRoot = this.transport.baseUrl.replace(/\/v1$/, "");
-    this.fetchImpl = options.fetch ? (input2, init) => options.fetch(input2, init) : (input2, init) => fetch(input2, init);
-    this.baseHeaders = options.headers ?? {};
-  }
-  get baseUrl() {
-    return this.transport.baseUrl;
-  }
-  async probe(path, init) {
-    const headers = { Accept: "application/json", ...this.baseHeaders };
-    new Headers(init?.headers ?? {}).forEach((value, key2) => {
-      headers[key2] = value;
-    });
-    const response = await this.fetchImpl(`${this.probeRoot}${path}`, {
-      ...init,
-      method: "GET",
-      headers,
-      redirect: "manual"
-    });
-    const text4 = await response.text();
-    let body = undefined;
-    if (text4) {
-      try {
-        body = JSON.parse(text4);
-      } catch {
-        body = text4;
-      }
-    }
-    if (!response.ok) {
-      throw new ApiError(response.status, `GET ${path} failed: ${response.status}`, body);
-    }
-    return body;
-  }
-  async request(method, path, opts) {
-    const requestOpts = {};
-    if (opts.query)
-      requestOpts.query = opts.query;
-    const initHeaders = opts.init?.headers;
-    if (initHeaders)
-      requestOpts.headers = initHeaders;
-    if (opts.init?.signal)
-      requestOpts.signal = opts.init.signal;
-    try {
-      return await this.transport.request(method, path, opts.body, requestOpts);
-    } catch (error61) {
-      if (error61 instanceof HasnaHttpError) {
-        throw new ApiError(error61.status, `${method} ${path} failed: ${error61.status}`, error61.body);
-      }
-      throw error61;
-    }
-  }
-  async health(init) {
-    return this.probe(`/health`, init);
-  }
-  async ready(init) {
-    return this.probe(`/ready`, init);
-  }
-  async listAudit(query, init) {
-    return this.request("GET", `/audit`, {
-      body: undefined,
-      query,
-      init
-    });
-  }
-  async listItems(query, init) {
-    return this.request("GET", `/items`, {
-      body: undefined,
-      query,
-      init
-    });
-  }
-  async putItem(body, init) {
-    return this.request("POST", `/items`, {
-      body,
-      query: undefined,
-      init
-    });
-  }
-  async searchItems(query, init) {
-    return this.request("GET", `/items/search`, {
-      body: undefined,
-      query,
-      init
-    });
-  }
-  async getItem(id, init) {
-    return this.request("GET", `/items/${encodeURIComponent(String(id))}`, {
-      body: undefined,
-      query: undefined,
-      init
-    });
-  }
-  async deleteItem(id, init) {
-    return this.request("DELETE", `/items/${encodeURIComponent(String(id))}`, {
-      body: undefined,
-      query: undefined,
-      init
-    });
-  }
-  async listSecrets(query, init) {
-    return this.request("GET", `/secrets`, {
-      body: undefined,
-      query,
-      init
-    });
-  }
-  async putSecret(body, init) {
-    return this.request("POST", `/secrets`, {
-      body,
-      query: undefined,
-      init
-    });
-  }
-  async deleteSecret(query, init) {
-    return this.request("DELETE", `/secrets`, {
-      body: undefined,
-      query,
-      init
-    });
-  }
-  async getSecret(query, init) {
-    return this.request("GET", `/secrets/get`, {
-      body: undefined,
-      query,
-      init
-    });
-  }
-  async searchSecrets(query, init) {
-    return this.request("GET", `/secrets/search`, {
-      body: undefined,
-      query,
-      init
-    });
-  }
-  async listSecretVersions(query, init) {
-    return this.request("GET", `/secrets/versions`, {
-      body: undefined,
-      query,
-      init
-    });
-  }
-  async checkSecretVersion(query, init) {
-    return this.request("GET", `/secrets/versions/check`, {
-      body: undefined,
-      query,
-      init
-    });
-  }
-  async restoreSecretVersion(body, init) {
-    return this.request("POST", `/secrets/restore`, {
-      body,
-      query: undefined,
-      init
-    });
-  }
-  async listUsers(query, init) {
-    return this.request("GET", `/users`, {
-      body: undefined,
-      query,
-      init
-    });
-  }
-  async registerUser(body, init) {
-    return this.request("POST", `/users`, {
-      body,
-      query: undefined,
-      init
-    });
-  }
-  async version(init) {
-    return this.probe(`/version`, init);
-  }
-}
-function createSecretsClientFromEnv(env = process.env, overrides = {}) {
-  const { credentials, ...clientOverrides } = overrides;
-  if (clientOverrides.baseUrl !== undefined) {
-    const pinnedKey = clientOverrides.apiKey ?? credentials?.apiKey;
-    if (pinnedKey === undefined || pinnedKey === "") {
-      throw new Error("createSecretsClientFromEnv: an explicit baseUrl requires an explicit apiKey; the ambient " + "credential (Keychain hasna.credentials.secrets.api-key, ~/.hasna/secrets/config/credentials, " + "HASNA_SECRETS_API_KEY) is never sent to a caller-supplied authority (hasna/apps#1794).");
-    }
-    return new SecretsClient({ ...clientOverrides, baseUrl: clientOverrides.baseUrl, apiKey: pinnedKey });
-  }
-  const clientEnv = env;
-  const resolverOptions = credentials ? { credentials } : {};
-  const resolution = resolveClientTransport("secrets", clientEnv, resolverOptions);
-  const baseUrl = resolution.baseUrl;
-  const apiKey = clientOverrides.apiKey ?? (() => {
-    const resolved = resolveCredential2("secrets", clientEnv, credentials);
-    if (!resolved) {
-      throw new Error("createSecretsClientFromEnv: no @hasna/secrets credential resolved (Keychain, " + "~/.hasna/secrets/config/credentials, HASNA_SECRETS_API_KEY).");
-    }
-    return resolved;
-  });
-  return new SecretsClient({ ...clientOverrides, baseUrl, apiKey });
-}
-var __esm2 = (fn, res) => () => (fn && (res = fn(fn = 0)), res), CREDENTIAL_PROFILE_ENV_KEY2 = "HASNA_PROFILE", CredentialResolutionError2, CredentialFileUnsafeError2, HASNA_HOME_ENV_KEY2 = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY2 = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY2 = "HASNA_STATION", HASNA_HOME_DIR2 = ".hasna", CONFIG_SUBDIR2 = "config", CREDENTIALS_FILE2 = "credentials", KEYCHAIN_SECURITY_BIN2 = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX2 = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS2 = 44, KEYCHAIN_SPAWN_TIMEOUT_MS2 = 1e4, MAX_CREDENTIAL_FILE_BYTES2, SAFE_APP_SLUG2, SAFE_PROFILE2, ILLEGAL_IN_HEADER_VALUE2, VAULT_POINTER_SHAPE2, CREDENTIAL_SHAPED_KEY2, INSPECT_CUSTOM2, CREDENTIAL_SEAL2, CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE = "caller-supplied CredentialProvider", AMBIENT_ENVIRONMENT2, SECRETS_PACKAGE_SPECIFIER, requireSecretsSdk2, DEFAULT_FLEET_GATEWAY_ORIGIN2 = "https://api.hasna.com", DEFAULT_AUTHORITY_SOURCE = "default", ASCII_CONTROL_PATTERN2, DNS_LABEL_PATTERN2, ClientTransportConfigurationError2, HasnaHttpError, DEFAULT_RETRY_STATUSES, IDEMPOTENT_METHODS2, AUTHORITY_OVERRIDE_HEADERS2, defaultSleep = (ms) => new Promise((resolve27) => setTimeout(resolve27, ms)), init_transport2, MAX_CREDENTIAL_FILE_BYTES22, INSPECT_CUSTOM22, CREDENTIAL_SEAL22, AMBIENT_ENVIRONMENT22, SECRETS_PACKAGE_SPECIFIER2, requireSecretsSdk22, IDEMPOTENT_METHODS22, AUTHORITY_OVERRIDE_HEADERS22, init_storage, PATHS_RESOLVER_APP_SLUG_RE2, SQLITE_SIDECAR_FILES, LEGACY_SERVICE_FILES, init_data_dir, SecretsTestIsolationError, TEST_ENTRYPOINT_RE, init_test_isolation, init_client, ApiError;
-var init_sdk = __esm(() => {
-  init_transport2 = __esm2(() => {
-    CredentialResolutionError2 = class CredentialResolutionError3 extends Error {
-      appName;
-      attempted;
-      constructor(appName, message, attempted) {
-        super(message);
-        this.name = "CredentialResolutionError";
-        this.appName = appName;
-        this.attempted = attempted;
-      }
-    };
-    CredentialFileUnsafeError2 = class CredentialFileUnsafeError3 extends Error {
-      path;
-      constructor(path, reason2) {
-        super(`Refusing unsafe credential/config file ${path}: ${reason2}.`);
-        this.name = "CredentialFileUnsafeError";
-        this.path = path;
-      }
-    };
-    MAX_CREDENTIAL_FILE_BYTES2 = 64 * 1024;
-    SAFE_APP_SLUG2 = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
-    SAFE_PROFILE2 = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
-    ILLEGAL_IN_HEADER_VALUE2 = /[^\t\x20-\x7e]/;
-    VAULT_POINTER_SHAPE2 = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
-    CREDENTIAL_SHAPED_KEY2 = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)(?:_|$)/;
-    INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
-    CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
-    AMBIENT_ENVIRONMENT2 = Symbol.for("hasna:contracts:ambientClientEnvironment");
-    SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
-    requireSecretsSdk2 = createRequire2(import.meta.url);
-    ASCII_CONTROL_PATTERN2 = /[\u0000-\u001f\u007f]/;
-    DNS_LABEL_PATTERN2 = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
-    ClientTransportConfigurationError2 = class ClientTransportConfigurationError3 extends Error {
-      appName;
-      sources;
-      constructor(appName, message, sources = []) {
-        super(message);
-        this.name = "ClientTransportConfigurationError";
-        this.appName = appName;
-        this.sources = Object.freeze([...sources]);
-      }
-    };
-    HasnaHttpError = class HasnaHttpError2 extends Error {
-      status;
-      method;
-      path;
-      credentialSource;
-      credentialTier;
-      constructor(method, path, status, body, credential) {
-        const guidance = credential ? `. ${credential.guidance}` : "";
-        super(`Hasna cloud request failed: ${method} ${path} -> ${status}${guidance}`);
-        this.name = "HasnaHttpError";
-        this.status = status;
-        this.method = method;
-        this.path = path;
-        Object.defineProperty(this, "body", {
-          value: body,
-          enumerable: status !== 401 && status !== 403,
-          writable: false,
-          configurable: false
-        });
-        this.credentialSource = credential?.source ?? null;
-        this.credentialTier = credential?.tier ?? null;
-      }
-    };
-    DEFAULT_RETRY_STATUSES = [408, 425, 429, 500, 502, 503, 504];
-    IDEMPOTENT_METHODS2 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
-    AUTHORITY_OVERRIDE_HEADERS2 = new Set([
-      "host",
-      ":authority",
-      "forwarded",
-      "x-forwarded-host",
-      "x-original-host"
-    ]);
-  });
-  init_storage = __esm2(() => {
-    MAX_CREDENTIAL_FILE_BYTES22 = 64 * 1024;
-    INSPECT_CUSTOM22 = Symbol.for("nodejs.util.inspect.custom");
-    CREDENTIAL_SEAL22 = Symbol.for("hasna:contracts:sealedCredential");
-    AMBIENT_ENVIRONMENT22 = Symbol.for("hasna:contracts:ambientClientEnvironment");
-    SECRETS_PACKAGE_SPECIFIER2 = "@hasna/" + "secrets";
-    requireSecretsSdk22 = createRequire22(import.meta.url);
-    IDEMPOTENT_METHODS22 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
-    AUTHORITY_OVERRIDE_HEADERS22 = new Set([
-      "host",
-      ":authority",
-      "forwarded",
-      "x-forwarded-host",
-      "x-original-host"
-    ]);
-  });
-  init_data_dir = __esm2(() => {
-    PATHS_RESOLVER_APP_SLUG_RE2 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-    SQLITE_SIDECAR_FILES = ["vault.db-wal", "vault.db-shm", "vault.db-journal"];
-    LEGACY_SERVICE_FILES = [
-      "vault.key",
-      "vault.key.enc",
-      "kms.json",
-      "aws.json",
-      ".serve-token"
-    ];
-  });
-  init_test_isolation = __esm2(() => {
-    init_data_dir();
-    SecretsTestIsolationError = class SecretsTestIsolationError2 extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "SecretsTestIsolationError";
-      }
-    };
-    TEST_ENTRYPOINT_RE = /\.(test|spec)\.[cm]?[jt]sx?$/;
-  });
-  init_client = __esm2(() => {
-    init_transport2();
-    init_storage();
-    init_test_isolation();
-    init_transport2();
-  });
-  init_client();
-  ApiError = class ApiError extends Error {
-    status;
-    body;
-    constructor(status, message, body) {
-      super(message);
-      this.status = status;
-      this.body = body;
-      this.name = "ApiError";
-    }
-  };
-  init_client();
-});
-
-// src/lib/execution-secrets.ts
-import { constants as constants20, closeSync as closeSync23, fstatSync as fstatSync23, openSync as openSync23, readSync as readSync15, realpathSync as realpathSync12 } from "fs";
-import { hostname as stationHostname } from "os";
-function selectedSecretBindingsTemplate(scope, names, createClient = createSecretsClientFromEnv) {
+function selectedSecretBindingsTemplate(scope, names, createClient) {
   let secretsAuthority;
   try {
     secretsAuthority = createClient().baseUrl;
@@ -47701,12 +46653,13 @@ function validateSelectedSecretBindings(value, scope, names) {
   }
   return structuredClone(value);
 }
-async function resolveSelectedSecrets(bindings, createClient = createSecretsClientFromEnv) {
+async function resolveSelectedSecrets(bindings, createClient) {
   if (!Object.keys(bindings.bindings).length)
     return {};
+  const factory = createClient ?? await defaultSecretsClientFactory();
   let client;
   try {
-    client = createClient();
+    client = factory();
   } catch {
     return refuse5("LOCAL_SECRET_UNAVAILABLE", "The configured Secrets client could not authenticate. No ambient credential fallback was attempted.");
   }
@@ -47739,7 +46692,6 @@ function redactExecutionSecrets(text4, env) {
   return text4;
 }
 var init_execution_secrets = __esm(() => {
-  init_sdk();
   init_selection_cache();
 });
 
@@ -47878,7 +46830,7 @@ __export(exports_selected_run, {
 import { createHash as createHash31 } from "crypto";
 import { spawn as spawn2 } from "child_process";
 import { mkdirSync as mkdirSync13, mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync12, realpathSync as realpathSync13 } from "fs";
-import { dirname as dirname30, join as join41, resolve as resolve27 } from "path";
+import { dirname as dirname30, join as join40, resolve as resolve27 } from "path";
 import { tmpdir, hostname as stationHostname2 } from "os";
 async function resolveSelectedRun(spec, profileId, options = {}) {
   const context2 = await resolveSelectionContext(profileId, options);
@@ -47935,7 +46887,7 @@ async function prepareSelectedSecretBindings(selected, cwd = process.cwd()) {
   const names = declaredSecretNames(manifest.runtime?.env);
   if (!names.length)
     throw new SkillSelectionError("NO_DECLARED_SECRETS", "This selected executable does not declare any environment references.");
-  return selectedSecretBindingsTemplate({ selection: selected.selection, profileId: selected.profileId, cwd }, names);
+  return selectedSecretBindingsTemplate({ selection: selected.selection, profileId: selected.profileId, cwd }, names, await defaultSecretsClientFactory());
 }
 async function executeSelectedLocal(selected, options = {}) {
   const selection2 = structuredClone(selected.selection), profileId = selected.profileId;
@@ -48001,7 +46953,7 @@ async function executeSelectedLocal(selected, options = {}) {
         throw new SkillSelectionError("INVALID_SECRET_BINDINGS", "Explicit environment values must be bounded strings without NUL bytes.");
       secretEnv[name] = value;
     }
-  const runDirectory = mkdtempSync3(join41(tmpdir(), "skills-execution-"));
+  const runDirectory = mkdtempSync3(join40(tmpdir(), "skills-execution-"));
   const paths = new SkillEntryPaths;
   for (const entry of entries) {
     paths.add(entry.path, 100, () => {
@@ -48009,7 +46961,7 @@ async function executeSelectedLocal(selected, options = {}) {
     }, () => {
       throw new SkillSelectionError("INVALID_BUNDLE_PATH", "The execution bundle path exceeds its limit.");
     });
-    const destination = join41(runDirectory, entry.path);
+    const destination = join40(runDirectory, entry.path);
     mkdirSync13(dirname30(destination), { recursive: true, mode: 448 });
     writeFileSync12(destination, entry.bytes, { flag: "wx", mode: entry.mode & 511 });
   }
@@ -48037,7 +46989,7 @@ async function executeSelectedLocal(selected, options = {}) {
   }
   if (bindings)
     secretEnv = await resolveSelectedSecrets(bindings, options.createSecretsClient);
-  const result = await subprocess([executable, ...runtimeName === "bun" ? ["--no-env-file"] : [], join41(runDirectory, declaredEntry), ...args], runDirectory, { ...env, ...secretEnv }, input2, timeoutMs);
+  const result = await subprocess([executable, ...runtimeName === "bun" ? ["--no-env-file"] : [], join40(runDirectory, declaredEntry), ...args], runDirectory, { ...env, ...secretEnv }, input2, timeoutMs);
   result.stdout = redactExecutionSecrets(result.stdout, secretEnv);
   result.stderr = redactExecutionSecrets(result.stderr, secretEnv);
   const receipt = {
@@ -48051,7 +47003,7 @@ async function executeSelectedLocal(selected, options = {}) {
     ...bindings ? { secretBinding: { schema: bindings.schema, selection: bindings.selection, consumer: bindings.consumer, secretsAuthority: bindings.secretsAuthority, bindings: bindings.bindings } } : {},
     ...result
   };
-  writeFileSync12(join41(runDirectory, ".execution-receipt.json"), JSON.stringify({ ...receipt, stdout: undefined, stderr: undefined }), { mode: 384 });
+  writeFileSync12(join40(runDirectory, ".execution-receipt.json"), JSON.stringify({ ...receipt, stdout: undefined, stderr: undefined }), { mode: 384 });
   return receipt;
 }
 async function subprocess(command, cwd, env, input2, timeoutMs) {
@@ -48241,7 +47193,7 @@ var init_blog_article = __esm(() => {
 
 // src/mcp/operation-tools.ts
 import { existsSync as existsSync16, readdirSync as readdirSync13, statSync as statSync12 } from "fs";
-import { join as join42 } from "path";
+import { join as join41 } from "path";
 function registerOperationTools(server) {
   server.registerTool("cloud_skill_eligibility", {
     title: "Cloud Skill Eligibility",
@@ -48723,7 +47675,7 @@ function registerOperationTools(server) {
       if (exists) {
         try {
           skillCount = readdirSync13(agentSkillsPath).filter((f) => {
-            const full = join42(agentSkillsPath, f);
+            const full = join41(agentSkillsPath, f);
             return !f.startsWith(".") && statSync12(full).isDirectory();
           }).length;
         } catch {}
@@ -48791,10 +47743,10 @@ var init_operation_tools = __esm(() => {
 
 // src/lib/feedback.ts
 import { appendFileSync, existsSync as existsSync17, mkdirSync as mkdirSync14 } from "fs";
-import { dirname as dirname31, join as join43 } from "path";
+import { dirname as dirname31, join as join42 } from "path";
 import { Database } from "bun:sqlite";
 function getFeedbackDbPath() {
-  return join43(getDataDir(), "skills.db");
+  return join42(getDataDir(), "skills.db");
 }
 function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
@@ -48826,7 +47778,7 @@ function saveFeedback(input2) {
     throw new Error("Feedback message is required");
   const category = input2.category ?? "general";
   if (isApiMode()) {
-    const path = join43(getDataDir(), "feedback.jsonl");
+    const path = join42(getDataDir(), "feedback.jsonl");
     const dir = dirname31(path);
     if (!existsSync17(dir))
       mkdirSync14(dir, { recursive: true });
@@ -48990,23 +47942,23 @@ var init_resource_meta_tools = __esm(() => {
 });
 
 // src/lib/scheduler.ts
-import { existsSync as existsSync18, readFileSync as readFileSync24, writeFileSync as writeFileSync13, mkdirSync as mkdirSync15 } from "fs";
-import { join as join44 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync23, writeFileSync as writeFileSync13, mkdirSync as mkdirSync15 } from "fs";
+import { join as join43 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
-  return join44(targetDir, ".skills", "schedules.json");
+  return join43(targetDir, ".skills", "schedules.json");
 }
 function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
   if (existsSync18(path)) {
     try {
-      return JSON.parse(readFileSync24(path, "utf-8"));
+      return JSON.parse(readFileSync23(path, "utf-8"));
     } catch {}
   }
   return { version: 1, schedules: [] };
 }
 function saveSchedules(data, targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  const dir = join44(targetDir, ".skills");
+  const dir = join43(targetDir, ".skills");
   if (!existsSync18(dir))
     mkdirSync15(dir, { recursive: true });
   writeFileSync13(path, JSON.stringify(data, null, 2));
@@ -49282,12 +48234,12 @@ import { createHash as createHash32, createHmac } from "crypto";
 import {
   existsSync as existsSync19,
   mkdirSync as mkdirSync16,
-  readFileSync as readFileSync25,
+  readFileSync as readFileSync24,
   readdirSync as readdirSync14,
   statSync as statSync13,
   writeFileSync as writeFileSync14
 } from "fs";
-import { dirname as dirname32, join as join45, normalize as normalize5, relative as relative10, sep as sep15 } from "path";
+import { dirname as dirname32, join as join44, normalize as normalize5, relative as relative10, sep as sep15 } from "path";
 function resolveSkillsNativeStorageConfig(env = process.env) {
   assertNoRetiredModeEnvVars(env, {
     app: SKILLS_ENV_NAMESPACE,
@@ -49328,7 +48280,7 @@ function getSkillsNativeStorageStatus(options = {}) {
     local: {
       dataDir: getDataDir(),
       projectStateDir: getProjectStateDir(targetDir),
-      feedbackDbPath: join45(getDataDir(), "skills.db")
+      feedbackDbPath: join44(getDataDir(), "skills.db")
     },
     remote: {
       databaseConfigured: Boolean(config2.databaseUrl),
@@ -49350,7 +48302,7 @@ function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
   const files = [];
   if (existsSync19(projectStateDir)) {
     for (const filePath of walkFiles2(projectStateDir)) {
-      const bytes = readFileSync25(filePath);
+      const bytes = readFileSync24(filePath);
       const relativePath = toPosix(relative10(targetDir, filePath));
       files.push({
         path: relativePath,
@@ -49409,7 +48361,7 @@ function parsePositiveInteger(value) {
 function walkFiles2(dir) {
   const files = [];
   for (const entry of readdirSync14(dir)) {
-    const full = join45(dir, entry);
+    const full = join44(dir, entry);
     const stats = statSync13(full);
     if (stats.isDirectory())
       files.push(...walkFiles2(full));
@@ -49678,11 +48630,11 @@ var init_private_publication_customer = __esm(() => {
 });
 
 // src/lib/private-publication-recovery.ts
-import { constants as constants21, closeSync as closeSync24, fsyncSync as fsyncSync6, fstatSync as fstatSync24, lstatSync as lstatSync29, mkdirSync as mkdirSync17, openSync as openSync24, readSync as readSync16, realpathSync as realpathSync14, renameSync as renameSync8, unlinkSync as unlinkSync7, writeFileSync as writeFileSync15 } from "fs";
-import { dirname as dirname33, isAbsolute as isAbsolute29, join as join46, resolve as resolve28 } from "path";
+import { constants as constants21, closeSync as closeSync23, fsyncSync as fsyncSync6, fstatSync as fstatSync23, lstatSync as lstatSync29, mkdirSync as mkdirSync17, openSync as openSync23, readSync as readSync16, realpathSync as realpathSync14, renameSync as renameSync8, unlinkSync as unlinkSync7, writeFileSync as writeFileSync15 } from "fs";
+import { dirname as dirname33, isAbsolute as isAbsolute28, join as join45, resolve as resolve28 } from "path";
 import { randomUUID as randomUUID4 } from "crypto";
 function safeDirectory(directory2) {
-  if (!isAbsolute29(directory2) || directory2 !== resolve28(directory2) || realpathSync14(directory2) !== directory2)
+  if (!isAbsolute28(directory2) || directory2 !== resolve28(directory2) || realpathSync14(directory2) !== directory2)
     return fail2();
   for (let path = directory2;; path = dirname33(path)) {
     const stat3 = lstatSync29(path);
@@ -49702,10 +48654,10 @@ function unchangedDirectory(directory2, identity4) {
     return fail2();
 }
 function readOwned(directory2, name, max) {
-  const identity4 = safeDirectory(directory2), file2 = join46(directory2, name);
-  const fd = openSync24(file2, constants21.O_RDONLY | constants21.O_NOFOLLOW);
+  const identity4 = safeDirectory(directory2), file2 = join45(directory2, name);
+  const fd = openSync23(file2, constants21.O_RDONLY | constants21.O_NOFOLLOW);
   try {
-    const stat3 = fstatSync24(fd);
+    const stat3 = fstatSync23(fd);
     if (!stat3.isFile() || stat3.nlink !== 1 || stat3.size > max || stat3.size < 1 || (stat3.mode & 63) !== 0 || process.getuid && stat3.uid !== process.getuid())
       return fail2();
     const buffer = Buffer.alloc(Math.min(max, stat3.size) + 1);
@@ -49716,22 +48668,22 @@ function readOwned(directory2, name, max) {
         break;
       length += count;
     }
-    const bytes = buffer.subarray(0, length), after = fstatSync24(fd);
+    const bytes = buffer.subarray(0, length), after = fstatSync23(fd);
     unchangedDirectory(directory2, identity4);
     if (bytes.length !== stat3.size || stat3.size !== after.size || stat3.mtimeMs !== after.mtimeMs || stat3.ctimeMs !== after.ctimeMs)
       return fail2();
     return bytes;
   } finally {
-    closeSync24(fd);
+    closeSync23(fd);
   }
 }
 function writeOwned(directory2, name, bytes) {
-  const fd = openSync24(join46(directory2, name), constants21.O_WRONLY | constants21.O_CREAT | constants21.O_EXCL | constants21.O_NOFOLLOW, 384);
+  const fd = openSync23(join45(directory2, name), constants21.O_WRONLY | constants21.O_CREAT | constants21.O_EXCL | constants21.O_NOFOLLOW, 384);
   try {
     writeFileSync15(fd, bytes);
     fsyncSync6(fd);
   } finally {
-    closeSync24(fd);
+    closeSync23(fd);
   }
 }
 function save(directory2, value) {
@@ -49739,12 +48691,12 @@ function save(directory2, value) {
   writeOwned(directory2, temporary, JSON.stringify(value) + `
 `);
   unchangedDirectory(directory2, identity4);
-  renameSync8(join46(directory2, temporary), join46(directory2, "receipt.json"));
-  const fd = openSync24(directory2, constants21.O_RDONLY | constants21.O_NOFOLLOW);
+  renameSync8(join45(directory2, temporary), join45(directory2, "receipt.json"));
+  const fd = openSync23(directory2, constants21.O_RDONLY | constants21.O_NOFOLLOW);
   try {
     fsyncSync6(fd);
   } finally {
-    closeSync24(fd);
+    closeSync23(fd);
   }
 }
 function bind(client, receipt) {
@@ -49752,21 +48704,21 @@ function bind(client, receipt) {
     throw new PrivatePublicationError("PUBLICATION_IDENTITY_CHANGED", "The fresh session does not match the recovery directory's server, account and membership.");
 }
 async function locked(directory2, action) {
-  const identity4 = safeDirectory(directory2), file2 = join46(directory2, "operation.lock");
+  const identity4 = safeDirectory(directory2), file2 = join45(directory2, "operation.lock");
   let fd;
   try {
-    fd = openSync24(file2, constants21.O_WRONLY | constants21.O_CREAT | constants21.O_EXCL | constants21.O_NOFOLLOW, 384);
+    fd = openSync23(file2, constants21.O_WRONLY | constants21.O_CREAT | constants21.O_EXCL | constants21.O_NOFOLLOW, 384);
   } catch {
     throw new PrivatePublicationError("PUBLICATION_RECOVERY_BUSY", "Another operation holds this recovery directory. If it crashed, confirm that process has stopped before explicitly removing operation.lock and resuming.");
   }
-  const lock = fstatSync24(fd);
+  const lock = fstatSync23(fd);
   try {
     writeFileSync15(fd, JSON.stringify({ pid: process.pid }) + `
 `);
     fsyncSync6(fd);
     return await action();
   } finally {
-    closeSync24(fd);
+    closeSync23(fd);
     unchangedDirectory(directory2, identity4);
     const now = lstatSync29(file2);
     if (now.dev !== lock.dev || now.ino !== lock.ino || !now.isFile() || now.isSymbolicLink())
@@ -49820,15 +48772,15 @@ async function preparePrivatePublication(client, sourceDirectory, recoveryDirect
     phase: "prepared",
     intent: null
   };
-  if (!isAbsolute29(recoveryDirectory) || resolve28(recoveryDirectory) !== recoveryDirectory || realpathSync14(dirname33(recoveryDirectory)) !== dirname33(recoveryDirectory))
+  if (!isAbsolute28(recoveryDirectory) || resolve28(recoveryDirectory) !== recoveryDirectory || realpathSync14(dirname33(recoveryDirectory)) !== dirname33(recoveryDirectory))
     return fail2();
   mkdirSync17(recoveryDirectory, { mode: 448 });
   safeDirectory(recoveryDirectory);
-  const parent = openSync24(dirname33(recoveryDirectory), constants21.O_RDONLY | constants21.O_NOFOLLOW);
+  const parent = openSync23(dirname33(recoveryDirectory), constants21.O_RDONLY | constants21.O_NOFOLLOW);
   try {
     fsyncSync6(parent);
   } finally {
-    closeSync24(parent);
+    closeSync23(parent);
   }
   writeOwned(recoveryDirectory, "bundle.tgz", packed.bytes);
   save(recoveryDirectory, receipt);
@@ -49921,10 +48873,10 @@ var init_private_publication_recovery = __esm(() => {
 });
 
 // src/mcp/private-publication-tools.ts
-import { isAbsolute as isAbsolute30 } from "path";
+import { isAbsolute as isAbsolute29 } from "path";
 function registerPrivatePublicationTools(server) {
   const uuid9 = exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/);
-  const directory2 = exports_external.string().max(4096).refine(isAbsolute30, "Use an absolute local directory");
+  const directory2 = exports_external.string().max(4096).refine(isAbsolute29, "Use an absolute local directory");
   const verification2 = { email: exports_external.string().email().max(254), code: exports_external.string().regex(/^\d{6}$/), userId: uuid9, membershipId: uuid9, recoveryDirectory: directory2 };
   const description = "Manage a private source publication using fresh workspace-bound verification and a host-local recovery directory. Publishing requires explicit UUID current-version comparison and upload consent. Resume reuses immutable saved bytes and intent; an uncertain PUT is finalized for server verification, never uploaded twice. Sessions and signed URLs are not returned or persisted. Private execution is unavailable. Host request history may contain the supplied verification code.";
   const handler = (action) => async (value) => {