@kitman-sh/cli 0.7.2 → 0.7.4

package/dist/{chunk-vjnae06n.js → chunk-s92k78ef.js}

@@ -13,10 +13,13 @@ import {
   none,
   isNone,
   isSome,
+  match,
   getOrUndefined,
+  flatMap,
   Service,
   get,
   merge,
+  Reference,
   succeed,
   fail,
   isResult,
@@ -36,11 +39,14 @@ import {
   isSuccess2,
   isFailure2,
   makeUnsafe,
+  make6,
   _await,
+  fail3,
   isDoneUnsafe,
+  succeed3,
   doneUnsafe,
   Scope,
-  make6,
+  make7,
   provide,
   addFinalizer,
   close,
@@ -61,7 +67,7 @@ import {
   fail4,
   die3,
   withFiber,
-  flatMap,
+  flatMap2,
   andThen,
   tap,
   result,
@@ -88,6 +94,7 @@ import {
   matchEffect,
   context,
   contextWith,
+  provide3,
   provideContext,
   updateContext,
   provideService,
@@ -106,28 +113,38 @@ import {
   logError,
   interrupt3,
   makeUnsafe3,
+  unbounded,
+  offer,
   makeUnsafe4,
-  make9,
+  make11,
+  fromQueue,
   map4,
   filter,
   decodeText,
   splitLines,
   runHead,
+  runForEach,
   FileSystem,
   Path,
   ChildProcessSpawner,
-  make11,
+  make13,
   Crypto,
   value,
   is,
+  decodeUnknownEffect,
+  decodeUnknownOption,
   optionalKey,
+  optional,
   Literal,
+  Unknown,
   String2,
   Boolean2,
   Struct,
   ArraySchema,
   Union,
   Literals,
+  NullOr,
+  Finite,
   Int,
   Date2,
   TaggedError2,
@@ -136,6 +153,7 @@ import {
   findForbiddenRepoBindingSecretPath,
   runnerAgentSandboxPolicy,
   agentNetworkAllowlist,
+  AgentHarnessIds,
   findForbiddenAgentEnvironmentSecretPath,
   redactedOutputTail,
   canonicalSha256,
@@ -147,12 +165,17 @@ import {
   encodePrettyJsonString,
   decodeJsonStringSync,
   encodeUnknownJsonStringSync,
+  schemaBodyJson,
+  filterStatusOk,
+  get4,
+  layer4,
   digestSha256,
   RunSettled,
   CommandFailed2,
   runCommand2,
   shellOutputTailChars2,
   runProcess2,
+  CommandRunner2,
   runShell2,
   optionalEnv,
   detectHarnesses2,
@@ -161,7 +184,7 @@ import {
   herdrRunnerCapabilitiesForRepoBinding2,
   herdrRunnerCapabilities2,
   assertHerdrRunnerCapability2
-} from "./chunk-704ws2q7.js";
+} from "./chunk-jd09xfx0.js";
 import {
   make4,
   readerString,
@@ -172,17 +195,17 @@ import {
   SocketUpgradeError,
   SocketCloseError,
   SocketError
-} from "./chunk-dwgta18y.js";
-import"./chunk-ztmwmk8t.js";
+} from "./chunk-q6hk9ceb.js";
+import"./chunk-h12rxyy9.js";
 import {
   programLease,
   programHostsEnv,
   undeclaredHostsEnv
-} from "./chunk-6kdj8psf.js";
-import"./chunk-ae7gx971.js";
+} from "./chunk-7f20xrc0.js";
+import"./chunk-j2psmzr4.js";
 import {
   nextInt
-} from "./chunk-6f4anyec.js";
+} from "./chunk-20nwe9zd.js";
 
 // packages/core/src/runner-trust.ts
 import { createHash } from "crypto";
@@ -524,7 +547,7 @@ var optionalString = (value, label) => gen(function* () {
   return yield* invalid(`${label} must be a non-empty string when provided`);
 });
 // packages/agent-runtime/src/config-convergence.ts
-var writeAgentEnvironmentConfigFile = fnUntraced(function* (file, content) {
+var writeAgentEnvironmentConfigFile = fnUntraced(function* (file, content, keep = {}) {
   const fs = yield* FileSystem;
   const paths = {
     path: yield* Path,
@@ -537,14 +560,16 @@ var writeAgentEnvironmentConfigFile = fnUntraced(function* (file, content) {
       return mergeCodexAgents(existing, content);
     if (file.endsWith("opencode.json")) {
       const managed = yield* readManagedNamesForConfig(paths, file);
-      return mergeOpenCodeConfig(existing, content, managed.mcpNames, managed.pluginNames);
+      return mergeOpenCodeConfig(existing, content, managed.mcpNames, without(managed.packageNames, keep.packages));
     }
     if (file.endsWith(".codex/config.toml")) {
       const managed = yield* readManagedNamesForConfig(paths, file);
-      return mergeCodexConfig(existing, content, managed.mcpNames, managed.skillPaths);
+      return mergeCodexConfig(existing, content, managed.mcpNames, managed.skillPaths, keep.kitmanPlugins === true);
+    }
+    if (isPiConfigPath(paths.path, file, "settings.json")) {
+      const managed = yield* readManagedNamesForConfig(paths, file);
+      return mergePiSettingsConfig(existing, content, without(managed.packageNames, keep.packages));
     }
-    if (isPiConfigPath(paths.path, file, "settings.json"))
-      return mergePiSettingsConfig(existing, content);
     if (isPiConfigPath(paths.path, file, "mcp.json")) {
       const managed = yield* readManagedNamesForConfig(paths, file);
       return mergePiMcpConfig(existing, content, managed.mcpNames);
@@ -553,6 +578,7 @@ var writeAgentEnvironmentConfigFile = fnUntraced(function* (file, content) {
   });
   yield* fs.writeFileString(file, merged);
 });
+var without = (names, kept = []) => new Set([...names].filter((name) => !kept.includes(name)));
 var KitmanAgentsStartMarker = "<!-- KITMAN_AGENT_ENVIRONMENT_START -->";
 var KitmanAgentsEndMarker = "<!-- KITMAN_AGENT_ENVIRONMENT_END -->";
 var KitmanGeneratedAgentsPrefix = "# Kitman AgentEnvironment\n\nThis file is generated by `kitman sync`";
@@ -575,27 +601,34 @@ ${KitmanAgentsEndMarker}`;
 ${block}
 `;
 }
-var readExistingText = (file) => flatMap(FileSystem, (fs) => fs.readFileString(file).pipe(catchReason("PlatformError", "NotFound", () => succeed5(""))));
+var readExistingText = (file) => flatMap2(FileSystem, (fs) => fs.readFileString(file).pipe(catchReason("PlatformError", "NotFound", () => succeed5(""))));
 var readManagedNamesForConfig = (paths, file) => gen(function* () {
   const manifest = parseJsonObject(yield* readExistingText(yield* managedManifestPathForConfig(paths, file)));
   const servers = Array.isArray(manifest.mcpServers) ? manifest.mcpServers : [];
   const plugins = Array.isArray(manifest.plugins) ? manifest.plugins : [];
-  const materializedSkills = Array.isArray(manifest.materializedSkills) ? manifest.materializedSkills : [];
   return {
     mcpNames: new Set(servers.flatMap((entry) => {
       const item = objectValue(objectValue(entry).item);
       return isString2(item.name) ? [item.name] : [];
     })),
-    pluginNames: new Set(plugins.flatMap((entry) => {
-      const item = objectValue(objectValue(entry).item);
-      return isString2(item.name) ? [item.name] : [];
+    packageNames: new Set(plugins.flatMap((entry) => {
+      const { source: legacySource, sources } = objectValue(objectValue(entry).item);
+      return (Array.isArray(sources) ? sources : legacySource === undefined ? [] : [legacySource]).flatMap((source) => {
+        const { kind, packageName } = objectValue(source);
+        return kind === "package" && isString2(packageName) ? [packageName] : [];
+      });
     })),
-    skillPaths: new Set(materializedSkills.flatMap((entry) => {
-      const item = objectValue(entry);
-      return isString2(item.skillPath) ? [item.skillPath] : [];
-    }))
+    skillPaths: manifestSkillPaths(manifest)
   };
 });
+function manifestSkillPaths(manifest) {
+  const materializedSkills = Array.isArray(manifest.materializedSkills) ? manifest.materializedSkills : [];
+  return new Set(materializedSkills.flatMap((entry) => {
+    const item = objectValue(entry);
+    return isString2(item.skillPath) ? [item.skillPath] : [];
+  }));
+}
+var readManifestSkillPaths = (manifestPath) => map3(readExistingText(manifestPath), (text) => manifestSkillPaths(parseJsonObject(text)));
 var managedManifestPathForConfig = (paths, file) => gen(function* () {
   const fs = yield* FileSystem;
   const manifestRoot = managedManifestRootPath(paths, file);
@@ -655,13 +688,13 @@ function manifestFileForHarness(harness) {
     return "agent-environment.manifest.json";
   return `agent-environment.${harness}.manifest.json`;
 }
-function mergeOpenCodeConfig(existingText, generatedText, managedMcpNames, managedPluginNames) {
+function mergeOpenCodeConfig(existingText, generatedText, managedMcpNames, managedPackageNames) {
   const existing = parseJsonObject(existingText);
   const generated = parseJsonObject(generatedText);
   const existingMcp = { ...objectValue(existing.mcp) };
   for (const name of managedMcpNames)
     delete existingMcp[name];
-  const existingPlugins = uniqueStrings(arrayValue(existing.plugin).filter((entry) => !pluginReferenceMatchesManaged(entry, managedPluginNames)));
+  const existingPlugins = uniqueStrings(arrayValue(existing.plugin).filter((entry) => !isManagedPackageReference(entry, managedPackageNames)));
   const merged = {
     ...existing,
     ...generated,
@@ -679,22 +712,25 @@ function mergeOpenCodeConfig(existingText, generatedText, managedMcpNames, manag
   return `${JSON.stringify(merged, null, 2)}
 `;
 }
-function pluginReferenceMatchesManaged(entry, managedPluginNames) {
+function isManagedPackageReference(entry, managedPackageNames, prefix = "") {
   if (!isString2(entry))
     return false;
-  for (const name of managedPluginNames) {
-    if (entry === name || entry.startsWith(`${name}@`))
+  for (const name of managedPackageNames) {
+    if (entry === `${prefix}${name}` || entry.startsWith(`${prefix}${name}@`))
       return true;
   }
   return false;
 }
-function mergePiSettingsConfig(existingText, generatedText) {
+function mergePiSettingsConfig(existingText, generatedText, managedPackageNames) {
   const existing = parseJsonObject(existingText);
   const generated = parseJsonObject(generatedText);
   const merged = {
     ...existing,
     ...generated,
-    packages: uniquePackageEntries([...packageEntries(existing.packages), ...packageEntries(generated.packages)])
+    packages: uniquePackageEntries([
+      ...packageEntries(existing.packages).filter((entry) => !isManagedPackageReference(entry, managedPackageNames, "npm:")),
+      ...packageEntries(generated.packages)
+    ])
   };
   return `${JSON.stringify(merged, null, 2)}
 `;
@@ -732,8 +768,8 @@ function isPiConfigPath(path, file, name) {
   const parent = path.dirname(file);
   return path.basename(file) === name && (path.basename(parent) === ".pi" || path.basename(parent) === "agent" && path.basename(path.dirname(parent)) === ".pi");
 }
-function mergeCodexConfig(existingText, generatedText, managedMcpNames, managedSkillPaths = new Set) {
-  const preserved = stripTomlTables(existingText, new Set([...managedMcpNames, ...mcpServerNames(generatedText)]), new Set([...managedSkillPaths, ...codexSkillPaths(generatedText)])).trimEnd();
+function mergeCodexConfig(existingText, generatedText, managedMcpNames, managedSkillPaths, keepKitmanPlugins) {
+  const preserved = stripTomlTables(existingText, new Set([...managedMcpNames, ...mcpServerNames(generatedText)]), new Set([...managedSkillPaths, ...codexSkillPaths(generatedText)]), keepKitmanPlugins ? undefined : kitmanPluginNames(generatedText)).trimEnd();
   const generated = generatedText.trim();
   if (preserved.length === 0)
     return `${generated}
@@ -746,13 +782,17 @@ function mergeCodexConfig(existingText, generatedText, managedMcpNames, managedS
 ${generated}
 `;
 }
-function stripTomlTables(text, removeMcpServerNames, removeSkillPaths) {
+function stripTomlTables(text, removeMcpServerNames, removeSkillPaths, keptKitmanPlugins) {
   const lines = text.split(`
 `);
+  const staleHookState = (key) => {
+    const plugin = /^([^@]+)@kitman:/u.exec(key ?? "")?.[1];
+    return keptKitmanPlugins !== undefined && plugin !== undefined && !keptKitmanPlugins.has(plugin);
+  };
   const kept = [];
   for (let index = 0;index < lines.length; ) {
     const line = lines[index] ?? "";
-    const table = /^(\[\[?)([^\]]+)\]\]?/.exec(line)?.[2];
+    const table = tomlTableHeader(line);
     if (table === undefined) {
       kept.push(line);
       index += 1;
@@ -760,23 +800,65 @@ function stripTomlTables(text, removeMcpServerNames, removeSkillPaths) {
     }
     const block = [line];
     index += 1;
-    while (index < lines.length && !/^\[\[?[^\]]+\]\]?/.test(lines[index] ?? "")) {
+    while (index < lines.length && tomlTableHeader(lines[index] ?? "") === undefined) {
       block.push(lines[index] ?? "");
       index += 1;
     }
     const skillPath = table === "skills.config" ? codexSkillPathFromBlock(block) : undefined;
-    const drop = codexMcpServerName(table, removeMcpServerNames) !== undefined || skillPath !== undefined && removeSkillPaths.has(skillPath);
-    if (!drop)
+    const [first, second, hookKey, ...rest] = tomlKeyPath(table);
+    const hookState = first === "hooks" && second === "state";
+    const drop = keptKitmanPlugins !== undefined && isKitmanPluginTable([first ?? "", second ?? ""]) || hookState && rest.length === 0 && staleHookState(hookKey) || codexMcpServerName(table, removeMcpServerNames) !== undefined || skillPath !== undefined && removeSkillPaths.has(skillPath);
+    if (drop)
+      continue;
+    if (hookState && hookKey === undefined)
+      kept.push(...block.filter((entry) => !staleHookState(tomlKeyPath(/^([^=]+)=/u.exec(entry)?.[1] ?? "")[0])));
+    else
       kept.push(...block);
   }
   return kept.join(`
 `);
 }
+function tomlTableHeader(line) {
+  return /^\s*\[\[?((?:"(?:[^"\\]|\\.)*"|'[^']*'|[^"'[\]#])+)\]\]?\s*(?:#.*)?$/u.exec(line)?.[1];
+}
+function kitmanPluginNames(toml) {
+  return new Set(toml.split(`
+`).flatMap((line) => {
+    const [table, name] = tomlKeyPath(tomlTableHeader(line) ?? "");
+    return table === "plugins" && name?.endsWith("@kitman") === true ? [name.slice(0, -"@kitman".length)] : [];
+  }));
+}
+function isKitmanPluginTable([table, name]) {
+  return table === "marketplaces" && name === "kitman" || table === "plugins" && name?.endsWith("@kitman") === true;
+}
+function tomlKeyPath(key) {
+  const part = /\s*(?:"((?:[^"\\]|\\.)*)"|'([^']*)'|([\w-]+))\s*(?:\.|$)/uy;
+  const parts = [];
+  while (part.lastIndex < key.length) {
+    const match = part.exec(key);
+    if (match === null)
+      return [];
+    parts.push(match[3] ?? match[2] ?? unescapeTomlString(match[1] ?? ""));
+  }
+  return parts;
+}
+function unescapeTomlString(text) {
+  const escapes = new Map([
+    ["b", "\b"],
+    ["t", "\t"],
+    ["n", `
+`],
+    ["f", "\f"],
+    ["r", "\r"],
+    ["e", "\x1B"]
+  ]);
+  return text.replace(/\\(?:u([\da-fA-F]{4})|U([\da-fA-F]{8})|(.))/gu, (_, short, long, char) => short !== undefined || long !== undefined ? String.fromCodePoint(Number.parseInt(short ?? long, 16)) : escapes.get(char) ?? char);
+}
 function mcpServerNames(toml) {
   const names = new Set;
   for (const line of toml.split(`
 `)) {
-    const table = /^\[([^\]]+)\]/.exec(line)?.[1];
+    const table = tomlTableHeader(line);
     if (table === undefined)
       continue;
     const name = codexMcpServerTableName(table);
@@ -791,13 +873,13 @@ function codexSkillPaths(toml) {
 `);
   for (let index = 0;index < lines.length; ) {
     const line = lines[index] ?? "";
-    if (!line.startsWith("[[skills.config]]")) {
+    if (!/^\s*\[\[\s*skills\.config\s*\]\]/u.test(line)) {
       index += 1;
       continue;
     }
     const block = [line];
     index += 1;
-    while (index < lines.length && !/^\[\[?[^\]]+\]\]?/.test(lines[index] ?? "")) {
+    while (index < lines.length && tomlTableHeader(lines[index] ?? "") === undefined) {
       block.push(lines[index] ?? "");
       index += 1;
     }
@@ -838,6 +920,46 @@ function uniqueStrings(values) {
   return [...new Set(values)];
 }
 
+// packages/agent-runtime/src/source-resolver.ts
+import { tmpdir } from "os";
+class SourceResolutionFailed extends TaggedError("SourceResolutionFailed") {
+  get message() {
+    return this.reason;
+  }
+}
+var isCommitHash = (ref) => ref !== undefined && /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u.test(ref);
+var DistTags = Struct({ latest: String2 });
+var gitCommit = (url, ref) => gen(function* () {
+  const patterns = ref === undefined ? ["HEAD"] : [ref, `${ref}^{}`];
+  const output = yield* runCommand2("git", ["ls-remote", "--", url, ...patterns], {
+    cwd: tmpdir(),
+    timeout: "1 minute"
+  }).pipe(mapError((error) => new SourceResolutionFailed({ reason: error.message })));
+  const lines = output.split(`
+`).map((line) => line.split("\t"));
+  const names = ref === undefined ? ["HEAD"] : ref.startsWith("refs/") ? [ref] : [`refs/heads/${ref}`, `refs/tags/${ref}`];
+  const commit = (lines.find(([, name]) => names.some((candidate) => name === `${candidate}^{}`)) ?? lines.find(([, name]) => names.includes(name ?? "")))?.[0];
+  if (!isCommitHash(commit))
+    return yield* new SourceResolutionFailed({ reason: `${url} has no ${ref ?? "default branch"}` });
+  return commit;
+});
+var npmLatest = (packageName) => get4(`https://registry.npmjs.org/-/package/${packageName.replace("/", "%2F")}/dist-tags`).pipe(flatMap2(filterStatusOk), flatMap2(schemaBodyJson(DistTags)), map3((tags) => tags.latest), provide3(layer4), mapError((error) => new SourceResolutionFailed({ reason: `npm has no latest ${packageName}: ${error.message}` })));
+var SourceResolver = Reference("kitman/agent-runtime/SourceResolver", {
+  defaultValue: () => ({ gitCommit, npmLatest })
+});
+var withSourceResolutionCache = (effect) => gen(function* () {
+  const resolver = yield* SourceResolver;
+  const answers = new Map;
+  const once = (key, resolve) => suspend(() => answers.get(key) ?? resolve.pipe(exit, flatMap2((exit) => {
+    answers.set(key, exit);
+    return exit;
+  })));
+  return yield* effect.pipe(provideService(SourceResolver, {
+    gitCommit: (url, ref) => once(`git:${url}#${ref ?? ""}`, resolver.gitCommit(url, ref)),
+    npmLatest: (packageName) => once(`npm:${packageName}`, resolver.npmLatest(packageName))
+  }));
+});
+
 // packages/agent-runtime/src/config-writer.ts
 var Sources = {
   opencodeMcp: "https://opencode.ai/docs/mcp-servers/",
@@ -882,16 +1004,17 @@ var previewAgentEnvironmentConfigSync = fnUntraced(function* (previewInput) {
   const syncKitPath = input.syncKit === undefined ? undefined : findForbiddenAgentEnvironmentSecretPath(input.syncKit);
   if (syncKitPath !== undefined)
     plan.issues.push({ message: `Sync Kit contains forbidden secret-like value at ${syncKitPath}` });
-  if (input.environment.harness === "opencode")
-    renderOpenCode(input, plan);
-  else if (input.environment.harness === "codex")
-    renderCodex(input, plan);
-  else if (input.environment.harness === "claude-code")
-    renderClaudeCode(input, plan);
-  else if (input.environment.harness === "pi")
-    renderPi(input, plan);
-  renderSkillFiles(input, plan);
-  renderManifest(input, plan);
+  const context = { ...input, ...yield* resolvePackagePlugins(input, plan) };
+  if (context.environment.harness === "opencode")
+    renderOpenCode(context, plan);
+  else if (context.environment.harness === "codex")
+    renderCodex(context, plan);
+  else if (context.environment.harness === "claude-code")
+    renderClaudeCode(context, plan);
+  else if (context.environment.harness === "pi")
+    renderPi(context, plan);
+  renderSkillFiles(context, plan);
+  renderManifest(context, plan);
   if (plan.operations.some((operation) => isUnsafeConfigWritePath(operation.path))) {
     plan.issues.push({ message: "AgentEnvironment config sync produced an unsafe relative write path." });
   }
@@ -904,13 +1027,53 @@ var previewAgentEnvironmentConfigSync = fnUntraced(function* (previewInput) {
     ...input.syncKit === undefined ? undefined : { syncKitHash: input.syncKit.syncKitHash, kitRefs: input.syncKit.kitRefs }
   };
 });
+var resolvePackagePlugins = (input, plan) => gen(function* () {
+  const harness = input.environment.harness;
+  if (input.noInstall === true || harness !== "opencode" && harness !== "pi")
+    return { environment: input.environment, unresolvedPlugins: [] };
+  const resolver = yield* SourceResolver;
+  const unresolvedPlugins = [];
+  const plugins = yield* forEach(input.environment.plugins, (plugin) => {
+    const source = packageSource(plugin);
+    if (source === undefined || source.version !== undefined && input.versions !== "latest")
+      return succeed5([plugin]);
+    return resolver.npmLatest(source.packageName).pipe(map3((version) => [
+      {
+        ...plugin,
+        item: {
+          ...plugin.item,
+          sources: [
+            { ...source, version },
+            ...plugin.item.sources.filter((candidate) => candidate !== source)
+          ]
+        }
+      }
+    ]), catch_((error) => sync(() => {
+      const issue = {
+        message: `Kitman could not resolve plugin ${plugin.item.name} from npm package ${source.packageName}: ${error.message}`,
+        source: sourceLabel2(plugin.source)
+      };
+      if (plugin.item.policy === "required")
+        plan.issues.push(issue);
+      else {
+        plan.warnings.push(issue);
+        unresolvedPlugins.push(plugin);
+      }
+      return [];
+    })));
+  });
+  return { environment: { ...input.environment, plugins: plugins.flat() }, unresolvedPlugins };
+});
 var applyAgentEnvironmentConfigSync = fnUntraced(function* (plan) {
   if (plan.operations.some((operation) => isUnsafeConfigWritePath(operation.path)))
     return yield* new AgentEnvironmentConfigSyncError({
       issues: [{ message: "AgentEnvironment config apply rejected an unsafe relative write path." }]
     });
   for (const operation of plan.operations)
-    yield* writeAgentEnvironmentConfigFile(operation.path, operation.content);
+    yield* writeAgentEnvironmentConfigFile(operation.path, operation.content, {
+      kitmanPlugins: operation.keepKitmanPlugins === true,
+      ...operation.keepPackages === undefined ? undefined : { packages: operation.keepPackages }
+    });
   return plan;
 });
 var SafeModelReference = /^(?!.*(?:https?:\/\/|ftp:\/\/|file:\/\/|Bearer\s|secret|token|password))(?!.*(?:^|[\s])(?:\/|~\/|[A-Za-z]:\\\\))[A-Za-z0-9][A-Za-z0-9_.:/@-]{0,239}$/iu;
@@ -973,6 +1136,7 @@ function renderOpenCode(input, plan) {
     kind: "write_file",
     path: targetPath(input, "opencode.json"),
     description: "OpenCode project config for Kitman AgentEnvironment MCP servers and package plugins.",
+    ...keepUnresolvedPackages(input),
     content: json({
       $schema: "https://opencode.ai/config.json",
       ...model === undefined ? undefined : { model },
@@ -992,14 +1156,18 @@ function renderCodex(input, plan) {
     if (block !== undefined)
       serverBlocks.push(block);
   }
-  renderUnsupportedPlugins(input.environment.plugins, input.environment.harness, plan);
+  const materializedPlugins = input.materializedPlugins ?? [];
+  const pluginBlocks = renderCodexPlugins(materializedPlugins);
+  for (const plugin of unhandledPlugins(input))
+    reportUnsupported(plan, plugin.item.policy, `plugin ${plugin.item.name}`, input.environment.harness, input.scope !== "user" && plugin.item.sources.some((source) => source.kind === "git") ? "Codex git plugins install only at user scope" : unsupportedPluginReason(plugin), sourceLabel2(plugin.source));
   renderCodexInstructions(input, plan);
   plan.operations.push({
     kind: "write_file",
     path: targetPath(input, ".codex/config.toml"),
     description: "Codex project config.toml MCP server entries for Kitman AgentEnvironment.",
-    content: serverBlocks.length === 0 && model === undefined ? `# Kitman Codex MCP config generated by kitman sync
-` : `${[...model === undefined ? [] : [`model = ${tomlString(model)}`], ...serverBlocks].join(`
+    ...(input.skippedPlugins ?? []).length === 0 ? undefined : { keepKitmanPlugins: true },
+    content: serverBlocks.length === 0 && pluginBlocks.length === 0 && model === undefined ? `# Kitman Codex MCP config generated by kitman sync
+` : `${[...model === undefined ? [] : [`model = ${tomlString(model)}`], ...serverBlocks, ...pluginBlocks].join(`
 
 `)}
 `,
@@ -1027,7 +1195,7 @@ function renderCodexInstructions(input, plan) {
     "",
     "## Plugins",
     "",
-    ...markdownList(input.environment.plugins.map((entry) => `${entry.item.name} (${entry.item.policy}, ${entry.item.source.kind})`)),
+    ...markdownList(input.environment.plugins.map((entry) => `${entry.item.name} (${entry.item.policy}, ${sourceKinds(entry, ", ")})`)),
     "",
     "## Harness Settings",
     "",
@@ -1070,7 +1238,7 @@ function renderCodexInstructions(input, plan) {
 }
 function renderClaudeCode(input, plan) {
   const mcpServers = objectMap(input.environment.mcpServers, (server) => renderClaudeMcpServer(input, server, plan));
-  renderUnsupportedPlugins(input.environment.plugins, input.environment.harness, plan);
+  renderUnsupportedPlugins(unhandledPlugins(input), input.environment.harness, plan);
   const model = renderModelSetting(input, plan);
   const skillOverrides = Object.fromEntries((input.materializedSkills ?? []).map((skill) => [skill.name, "on"]));
   if (Object.keys(mcpServers).length > 0 || Object.keys(skillOverrides).length > 0) {
@@ -1103,18 +1271,17 @@ function renderPi(input, plan) {
     ...Object.keys(mcpServers).length === 0 ? [] : ["npm:pi-mcp-adapter"],
     ...renderPiPlugins(input.environment.plugins, plan)
   ];
-  if (packages.length > 0 || model !== undefined) {
-    plan.operations.push({
-      kind: "write_file",
-      path: targetPath(input, ".pi/settings.json"),
-      description: "Pi project settings generated from resolved non-secret MCP and model intent.",
-      content: json({
-        ...packages.length === 0 ? undefined : { packages },
-        ...model === undefined ? undefined : { model }
-      }),
-      sources: [Sources.piReadme, Sources.piMcpAdapter]
-    });
-  }
+  plan.operations.push({
+    kind: "write_file",
+    path: targetPath(input, ".pi/settings.json"),
+    description: "Pi project settings generated from resolved non-secret MCP and model intent.",
+    ...keepUnresolvedPackages(input),
+    content: json({
+      ...packages.length === 0 ? undefined : { packages },
+      ...model === undefined ? undefined : { model }
+    }),
+    sources: [Sources.piReadme, Sources.piMcpAdapter]
+  });
   plan.operations.push({
     kind: "write_file",
     path: targetPath(input, ".pi/mcp.json"),
@@ -1126,8 +1293,9 @@ function renderPi(input, plan) {
 function renderPiPlugins(plugins, plan) {
   const packages = [];
   for (const plugin of plugins) {
-    if (plugin.item.source.kind === "package") {
-      packages.push(`npm:${packageReference(plugin.item.source.packageName, plugin.item.source.version)}`);
+    const source = packageSource(plugin);
+    if (source) {
+      packages.push(`npm:${packageReference(source.packageName, source.version)}`);
       continue;
     }
     reportUnsupported(plan, plugin.item.policy, `plugin ${plugin.item.name}`, "pi", "Pi package plugins require an npm package source", sourceLabel2(plugin.source));
@@ -1250,20 +1418,52 @@ function hasNameArgument(args) {
 function renderOpenCodePlugins(plugins, plan) {
   const packages = [];
   for (const plugin of plugins) {
-    if (plugin.item.source.kind === "package") {
-      packages.push(packageReference(plugin.item.source.packageName, plugin.item.source.version));
+    const source = packageSource(plugin);
+    if (source) {
+      packages.push(packageReference(source.packageName, source.version));
       continue;
     }
     reportUnsupported(plan, plugin.item.policy, `plugin ${plugin.item.name}`, "opencode", "this writer only has source-verified OpenCode plugin config for package sources", sourceLabel2(plugin.source));
   }
   return packages;
 }
+function keepUnresolvedPackages(input) {
+  const packages = (input.unresolvedPlugins ?? []).flatMap((plugin) => packageSource(plugin)?.packageName ?? []);
+  return packages.length === 0 ? undefined : { keepPackages: packages };
+}
+function unhandledPlugins(input) {
+  const handled = new Set([
+    ...(input.materializedPlugins ?? []).map((plugin) => plugin.name),
+    ...input.skippedPlugins ?? []
+  ]);
+  return input.environment.plugins.filter((plugin) => !handled.has(plugin.item.name));
+}
+function renderCodexPlugins(plugins) {
+  const marketplaceRoot = plugins[0]?.marketplaceRoot;
+  if (marketplaceRoot === undefined)
+    return [];
+  return [
+    `[marketplaces.kitman]
+source_type = "local"
+source = ${tomlString(marketplaceRoot)}`,
+    ...plugins.map((plugin) => `[plugins.${tomlString(`${plugin.name}@kitman`)}]
+enabled = true`)
+  ];
+}
 function renderUnsupportedPlugins(plugins, harness, plan) {
   for (const plugin of plugins) {
-    const sourceKind = plugin.item.source.kind === "package" ? "package sources" : `${plugin.item.source.kind} sources`;
-    reportUnsupported(plan, plugin.item.policy, `plugin ${plugin.item.name}`, harness, `this writer has no source-verified plugin installer for ${sourceKind}`, sourceLabel2(plugin.source));
+    reportUnsupported(plan, plugin.item.policy, `plugin ${plugin.item.name}`, harness, unsupportedPluginReason(plugin), sourceLabel2(plugin.source));
   }
 }
+function unsupportedPluginReason(plugin) {
+  return `this writer has no source-verified plugin installer for ${sourceKinds(plugin, " or ")} sources`;
+}
+function packageSource(plugin) {
+  return plugin.item.sources.find((source) => source.kind === "package");
+}
+function sourceKinds(plugin, separator) {
+  return [...new Set(plugin.item.sources.map((source) => source.kind))].join(separator);
+}
 function renderSkillFiles(input, plan) {
   const materializedSkillNames = new Set((input.materializedSkills ?? []).map((skill) => skill.name));
   for (const skill of input.environment.skills) {
@@ -1312,7 +1512,7 @@ function renderManifest(input, plan) {
       generatedBy: "kitman",
       harness: input.environment.harness,
       skills: input.environment.skills,
-      plugins: input.environment.plugins,
+      plugins: [...input.environment.plugins, ...input.unresolvedPlugins ?? []],
       mcpServers: input.environment.mcpServers,
       harnessSettings: input.environment.harnessSettings,
       providerAuthRefs: input.environment.providerAuthRefs,
@@ -1596,6 +1796,37 @@ function repositoryUrl(repoBinding) {
   return repoBinding.repositoryUrl ?? `https://${repoBinding.host}/${repoBinding.owner}/${repoBinding.name}.git`;
 }
 // packages/agent-runtime/src/skill-materializer.ts
+var gitSourceKey = (source) => `${source.url}#${source.ref ?? ""}:${source.path ?? ""}`;
+var approvedCommits = (approved, source) => approved.flatMap((entry) => {
+  const [commit, path] = entry.startsWith(`${source.url}#`) ? entry.slice(source.url.length + 1).split(/:(.*)/su) : [];
+  return isCommitHash(commit) && path === (source.path ?? "") ? [commit] : [];
+});
+var resolveGitSource = (subject, source, input) => gen(function* () {
+  if (!source.url.startsWith("https://"))
+    return { problem: `${subject} must come from an https URL, not ${source.url}.` };
+  const resolver = yield* SourceResolver;
+  const latest = input.versions === "latest";
+  const ref = latest ? undefined : source.ref;
+  const resolved = (isCommitHash(ref) ? succeed5(ref) : resolver.gitCommit(source.url, ref)).pipe(map3((commit) => ({ commit })), catch_((error) => succeed5({
+    problem: `Kitman could not resolve ${subject} from ${source.url}${ref === undefined ? "" : ` at ${ref}`}: ${error.message}`
+  })));
+  if (input.requireReviewedSources !== true)
+    return yield* resolved;
+  const approved = approvedCommits(input.approvedSkillSources ?? [], source);
+  const wanted = isCommitHash(ref) ? { commit: ref } : undefined;
+  if (ref === undefined && !latest && approved.length > 0)
+    return { commit: approved.at(-1) ?? "" };
+  const candidate = wanted ?? (yield* resolved);
+  if ("problem" in candidate)
+    return { rejected: true, problem: `${candidate.problem} Under review Kitman keeps no copy it cannot check.` };
+  if (approved.includes(candidate.commit))
+    return candidate;
+  return {
+    rejected: true,
+    problem: `${subject} is not approved at ${candidate.commit}; approve it by adding ${source.url}#${candidate.commit}:${source.path ?? ""} to approvedSkillSources in your Kitman user config, or remove it from the Kit.`
+  };
+});
+
 class AgentEnvironmentMaterializationError extends TaggedError("AgentEnvironmentMaterializationError") {
   get message() {
     return `AgentEnvironment materialization failed: ${this.issues.map((issue) => issue.message).join("; ")}`;
@@ -1605,6 +1836,7 @@ class AgentEnvironmentMaterializationError extends TaggedError("AgentEnvironment
 class SkillMaterializationRefused extends TaggedError("SkillMaterializationRefused") {
 }
 var previewAgentEnvironmentMaterialization = fnUntraced(function* (input) {
+  const fs = yield* FileSystem;
   const path = yield* Path;
   const home = input.rootDir ?? (yield* optionalEnv("HOME")) ?? ".";
   const harness = input.environment.harness;
@@ -1612,68 +1844,341 @@ var previewAgentEnvironmentMaterialization = fnUntraced(function* (input) {
   const targetRoot = skillBasePath2(path, harness, input.scope, input.rootDir, home);
   const operations = [];
   const materializedSkills = [];
+  const materializedPlugins = [];
+  const skippedPlugins = [];
   const warnings = [];
+  const unresolvedLinks = [];
   for (const skill of input.environment.skills) {
     const skillKey = skillIdentity(skill.item);
+    const targetPath = path.join(targetRoot, `${skillSlug2(skill.item.name)}-${hashSegment(skillKey)}`);
     const source = skill.item.source;
-    const skip = (message) => {
-      const issue = { message, skillName: skill.item.name, skillKey };
+    const fromKit = skill.source.label === undefined ? "" : ` (from Kit ${skill.source.label})`;
+    const gitSkillPath = path.join(sourceRoot, "git", hashSegment(skillKey), skillSlug2(skill.item.name));
+    const problem = source.kind === "kitman" ? source.contentMarkdown === undefined ? `Kitman skill ${skill.item.name} has no contentMarkdown to materialize.` : undefined : input.noInstall === true ? `Skipping materialization for ${skill.item.name} because sync was run with noInstall.` : source.kind !== "git" ? `Skill ${skill.item.name}${fromKit} comes from ${source.kind}, which Kitman cannot install yet; only Kitman and git skills are installed. Remove it from the Kit or make it recommended.` : undefined;
+    const resolution = problem === undefined && source.kind === "git" ? yield* resolveGitSource(`Git skill ${skill.item.name}${fromKit}`, source, input) : undefined;
+    const issueMessage = problem ?? (resolution !== undefined && "problem" in resolution ? resolution.problem : undefined);
+    if (issueMessage !== undefined) {
+      const issue = { message: issueMessage, skillName: skill.item.name, skillKey };
       if (skill.item.policy === "required")
-        return new AgentEnvironmentMaterializationError({ issues: [issue] });
+        return yield* new AgentEnvironmentMaterializationError({ issues: [issue] });
       warnings.push(issue);
-      return;
+      if (resolution !== undefined && "rejected" in resolution)
+        continue;
+      unresolvedLinks.push(targetPath);
+      if (source.kind === "git" && (yield* fs.exists(gitSkillPath).pipe(orElseSucceed(() => false))))
+        materializedSkills.push({
+          name: skill.item.name,
+          key: skillKey,
+          harness,
+          source,
+          skillPath: gitSkillPath,
+          managed: true
+        });
+      continue;
+    }
+    const commit = resolution !== undefined && "commit" in resolution ? resolution.commit : undefined;
+    const expose = (skillPath) => {
+      operations.push({
+        kind: "symlink_skill",
+        skillName: skill.item.name,
+        skillKey,
+        sourcePath: skillPath,
+        targetPath,
+        sourceRoot,
+        targetRoot
+      });
+      materializedSkills.push({
+        name: skill.item.name,
+        key: skillKey,
+        harness,
+        source,
+        skillPath,
+        managed: true,
+        ...commit === undefined ? undefined : { commit }
+      });
     };
-    const refusal = source.kind !== "kitman" ? skip(input.noInstall === true ? `Skipping materialization for ${skill.item.name} because sync was run with noInstall.` : `Materializing ${skill.item.name} from ${source.kind} is not supported; only Kitman skills are materialized.`) : source.contentMarkdown === undefined ? skip(`Kitman skill ${skill.item.name} has no contentMarkdown to materialize.`) : undefined;
-    if (refusal !== undefined)
-      return yield* refusal;
-    if (source.kind !== "kitman" || source.contentMarkdown === undefined)
+    if (source.kind === "git" && commit !== undefined) {
+      operations.push({
+        kind: "fetch_git_skill",
+        skillName: skill.item.name,
+        skillKey,
+        url: source.url,
+        ref: commit,
+        ...source.path === undefined ? undefined : { repositoryPath: source.path },
+        path: gitSkillPath
+      });
+      expose(gitSkillPath);
+    } else if (source.kind === "kitman" && source.contentMarkdown !== undefined) {
+      const skillPath = path.join(sourceRoot, "kitman", hashSegment(source.skillId ?? source.name ?? skill.item.name), skillSlug2(skill.item.name));
+      operations.push({
+        kind: "write_skill",
+        skillName: skill.item.name,
+        skillKey,
+        path: path.join(skillPath, "SKILL.md"),
+        content: skillMarkdown(skill.item.name, source.contentMarkdown)
+      });
+      expose(skillPath);
+    }
+  }
+  const codexMarketplace = harness === "codex" && input.scope === "user";
+  const marketplaceRoot = path.join(sourceRoot, "codex-marketplace");
+  const claudePluginsRoot = path.join(sourceRoot, "git-plugins");
+  for (const plugin of harness === "claude-code" || codexMarketplace ? input.environment.plugins : []) {
+    const source = plugin.item.sources.find((candidate) => candidate.kind === "git");
+    if (source === undefined)
+      continue;
+    const name = plugin.item.name;
+    const pluginKey = `plugin:git:${gitSourceKey(source)}:${name}`;
+    const fromKit = plugin.source.label === undefined ? "" : ` (from Kit ${plugin.source.label})`;
+    if (input.noInstall === true) {
+      skippedPlugins.push(name);
+      warnings.push({
+        message: `Skipping materialization for plugin ${name} because sync was run with noInstall.`,
+        skillName: name,
+        skillKey: pluginKey
+      });
+      continue;
+    }
+    const directoryName = `${skillSlug2(name)}-${hashSegment(pluginKey)}`;
+    const [pluginPath, manifest] = harness === "codex" ? [path.join(marketplaceRoot, "plugins", directoryName), ".codex-plugin/plugin.json"] : [path.join(claudePluginsRoot, hashSegment(pluginKey), skillSlug2(name)), ".claude-plugin/plugin.json"];
+    const resolution = yield* resolveGitSource(`Git plugin ${name}${fromKit}`, source, input);
+    if ("problem" in resolution) {
+      const issue = { message: resolution.problem, skillName: name, skillKey: pluginKey };
+      if (plugin.item.policy === "required")
+        return yield* new AgentEnvironmentMaterializationError({ issues: [issue] });
+      warnings.push(issue);
+      if ("rejected" in resolution)
+        continue;
+      unresolvedLinks.push(path.join(targetRoot, directoryName));
+      if (yield* fs.exists(path.join(pluginPath, manifest)).pipe(orElseSucceed(() => false)))
+        materializedPlugins.push({
+          name,
+          key: pluginKey,
+          harness,
+          source,
+          pluginPath,
+          ...harness === "codex" ? { marketplaceRoot } : undefined
+        });
+      continue;
+    }
+    operations.push({
+      kind: "fetch_git_plugin",
+      pluginName: name,
+      pluginKey,
+      url: source.url,
+      ref: resolution.commit,
+      manifest,
+      path: pluginPath,
+      sourceRoot
+    });
+    if (harness === "codex") {
+      materializedPlugins.push({
+        name,
+        key: pluginKey,
+        harness,
+        source,
+        pluginPath,
+        marketplaceRoot,
+        commit: resolution.commit
+      });
       continue;
-    const skillPath = path.join(sourceRoot, "kitman", hashSegment(source.skillId ?? source.name ?? skill.item.name), skillSlug2(skill.item.name));
+    }
     operations.push({
-      kind: "write_skill",
-      skillName: skill.item.name,
-      skillKey,
-      path: path.join(skillPath, "SKILL.md"),
-      content: skillMarkdown(skill.item.name, source.contentMarkdown)
-    }, {
       kind: "symlink_skill",
-      skillName: skill.item.name,
-      skillKey,
-      sourcePath: skillPath,
-      targetPath: path.join(targetRoot, `${skillSlug2(skill.item.name)}-${hashSegment(skillKey)}`),
+      skillName: name,
+      skillKey: pluginKey,
+      sourcePath: pluginPath,
+      targetPath: path.join(targetRoot, directoryName),
       sourceRoot,
       targetRoot
     });
-    materializedSkills.push({ name: skill.item.name, key: skillKey, harness, source, skillPath, managed: true });
+    materializedPlugins.push({ name, key: pluginKey, harness, source, pluginPath, commit: resolution.commit });
   }
-  return { harness, operations, materializedSkills, warnings };
+  if (input.noInstall !== true)
+    operations.push({
+      kind: "unlink_stale_links",
+      path: targetRoot,
+      sourceRoot,
+      keepPaths: [
+        ...operations.flatMap((operation) => operation.kind === "symlink_skill" ? [operation.targetPath] : []),
+        ...unresolvedLinks
+      ],
+      sharedWith: AgentHarnessIds.filter((other) => other !== harness && skillBasePath2(path, other, input.scope, input.rootDir, home) === targetRoot).map((other) => ({
+        harness: other,
+        manifestPath: path.join(input.scope === "user" ? home : input.rootDir ?? ".", ".kitman", `agent-environment.${other}.manifest.json`)
+      }))
+    });
+  const marketplacePath = path.join(marketplaceRoot, ".agents", "plugins", "marketplace.json");
+  if (codexMarketplace && input.noInstall !== true)
+    operations.push({
+      kind: "write_codex_marketplace",
+      path: marketplacePath,
+      content: `${yield* encodePrettyJsonString({
+        name: "kitman",
+        interface: { displayName: "Kitman" },
+        plugins: materializedPlugins.map((plugin) => ({
+          name: plugin.name,
+          source: { source: "local", path: `./${path.relative(marketplaceRoot, plugin.pluginPath)}` },
+          policy: { installation: "INSTALLED_BY_DEFAULT", authentication: "ON_INSTALL" },
+          category: "Productivity"
+        }))
+      }).pipe(orDie)}
+`,
+      sourceRoot
+    });
+  return {
+    harness,
+    operations,
+    materializedSkills,
+    materializedPlugins,
+    skippedPlugins,
+    warnings,
+    ...codexMarketplace && materializedPlugins.length > 0 ? { codexHookTrust: { home, marketplacePath } } : undefined
+  };
 });
-var applyAgentEnvironmentMaterialization = fnUntraced(function* (plan) {
+var gitCheckouts = gen(function* () {
+  const scope = yield* Scope;
+  const trees = new Map;
+  const checkout = (url, ref) => gen(function* () {
+    const key = `${url}#${ref}`;
+    const known = trees.get(key);
+    if (known !== undefined)
+      return known;
+    const tree = yield* checkoutGitTree(url, ref).pipe(provide(scope));
+    trees.set(key, tree);
+    return tree;
+  });
+  return checkout;
+});
+var applyAgentEnvironmentMaterialization = (plan, checkout) => gen(function* () {
+  const checkoutTree = checkout ?? (yield* gitCheckouts);
   for (const operation of plan.operations) {
     if (operation.kind === "write_skill")
       yield* writeSkill(plan, operation);
+    else if (operation.kind === "fetch_git_skill")
+      yield* fetchGitSkill(plan, operation, checkoutTree);
+    else if (operation.kind === "fetch_git_plugin")
+      yield* fetchGitPlugin(operation, checkoutTree);
+    else if (operation.kind === "write_codex_marketplace")
+      yield* writeCodexMarketplace(operation);
+    else if (operation.kind === "unlink_stale_links")
+      yield* unlinkStaleLinks(operation);
     else
       yield* exposeSkill(operation);
   }
   return plan;
-});
+}).pipe(scoped);
 var refuse = (message) => fail4(new SkillMaterializationRefused({ message }));
-var writeSkill = (plan, operation) => gen(function* () {
-  const fs = yield* FileSystem;
-  const path = yield* Path;
-  const boundary = plan.operations.find((candidate) => candidate.kind === "symlink_skill" && candidate.skillKey === operation.skillKey);
+var managedSkillPath = (plan, skillKey, file) => gen(function* () {
+  const boundary = plan.operations.find((candidate) => candidate.kind === "symlink_skill" && candidate.skillKey === skillKey);
   if (boundary === undefined)
     return yield* refuse("SKILL_SYMLINK_BOUNDARY_MISSING");
-  const root = path.resolve(boundary.sourceRoot);
-  const target = path.resolve(operation.path);
+  return yield* managedPath(boundary.sourceRoot, file);
+});
+var managedPath = (sourceRoot, file) => gen(function* () {
+  const path = yield* Path;
+  const root = path.resolve(sourceRoot);
+  const target = path.resolve(file);
   if (!isPathWithin(path, root, target) || target === root)
     return yield* refuse("SKILL_WRITE_OUTSIDE_ROOT");
   yield* assertNoSymlinkComponents(path.dirname(target), "SKILL_WRITE_OUTSIDE_ROOT");
+  return target;
+});
+var writeSkill = (plan, operation) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const target = yield* managedSkillPath(plan, operation.skillKey, operation.path);
   if (yield* isSymbolicLink(target))
     return yield* refuse("SKILL_WRITE_SYMLINK");
   yield* fs.makeDirectory(path.dirname(target), { recursive: true });
   yield* fs.writeFileString(target, operation.content);
 });
+var checkoutGitTree = (url, ref) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const scratch = yield* fs.makeTempDirectoryScoped({ prefix: "kitman-git-" });
+  const repository = path.join(scratch, "repository");
+  const tree = path.join(scratch, "tree");
+  const git = (...args) => runCommand2("git", ["--git-dir", repository, ...args]);
+  yield* fs.makeDirectory(tree);
+  yield* runCommand2("git", ["init", "--quiet", "--bare", repository]);
+  yield* git("fetch", "--quiet", "--depth", "1", "--", url, ref);
+  yield* git("--work-tree", tree, "checkout", "FETCH_HEAD", "--", ".");
+  return tree;
+});
+var replaceWithCopy = (directory, target) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const staged = `${target}.partial`;
+  yield* fs.remove(staged, { recursive: true, force: true });
+  yield* fs.makeDirectory(path.dirname(target), { recursive: true });
+  yield* fs.copy(directory, staged);
+  yield* fs.remove(target, { recursive: true, force: true });
+  yield* fs.rename(staged, target);
+});
+var fetchGitSkill = (plan, operation, checkout) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const target = yield* managedSkillPath(plan, operation.skillKey, operation.path);
+  const tree = yield* checkout(operation.url, operation.ref);
+  const skillDirectory = path.resolve(tree, operation.repositoryPath ?? ".");
+  if (!isPathWithin(path, tree, skillDirectory))
+    return yield* refuse("SKILL_SOURCE_OUTSIDE_ROOT");
+  if (yield* containsSymbolicLink(tree, skillDirectory))
+    return yield* refuse(`Git skill ${operation.skillName} links to a file outside itself in ${operation.url}@${operation.ref}; Kitman does not install linked files.`);
+  if (!(yield* fs.exists(path.join(skillDirectory, "SKILL.md"))))
+    return yield* refuse(`Git skill ${operation.skillName} has no SKILL.md at ${operation.repositoryPath ?? "the repository root"} in ${operation.url}@${operation.ref}.`);
+  yield* replaceWithCopy(skillDirectory, target);
+});
+var writeCodexMarketplace = (operation) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const target = yield* managedPath(operation.sourceRoot, operation.path);
+  if (yield* isSymbolicLink(target))
+    return yield* refuse("SKILL_WRITE_SYMLINK");
+  yield* fs.makeDirectory(path.dirname(target), { recursive: true });
+  yield* fs.writeFileString(target, operation.content);
+});
+var fetchGitPlugin = (operation, checkout) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const target = yield* managedPath(operation.sourceRoot, operation.path);
+  const tree = yield* checkout(operation.url, operation.ref);
+  if (yield* containsSymbolicLink(tree, tree))
+    return yield* refuse(`Git plugin ${operation.pluginName} links to a file in ${operation.url}@${operation.ref}; Kitman does not install linked files.`);
+  if (!(yield* fs.exists(path.join(tree, operation.manifest))))
+    return yield* refuse(`Git plugin ${operation.pluginName} has no ${operation.manifest} at the root of ${operation.url}@${operation.ref}.`);
+  yield* replaceWithCopy(tree, target);
+});
+var unlinkStaleLinks = (operation) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  if (!(yield* fs.exists(operation.path)))
+    return;
+  yield* assertNoSymlinkComponents(operation.path, "SKILL_TARGET_SYMLINK_PARENT");
+  const sharedSkillPaths = new Set((yield* forEach(operation.sharedWith, (shared) => readManifestSkillPaths(shared.manifestPath))).flatMap((paths) => [...paths].map((skillPath) => path.resolve(skillPath))));
+  for (const entry of yield* fs.readDirectory(operation.path)) {
+    const link = path.join(operation.path, entry);
+    if (operation.keepPaths.includes(link) || !(yield* isSymbolicLink(link)))
+      continue;
+    const linkTarget = path.resolve(operation.path, yield* fs.readLink(link));
+    if (isPathWithin(path, operation.sourceRoot, linkTarget) && !sharedSkillPaths.has(linkTarget))
+      yield* fs.remove(link);
+  }
+});
+var containsSymbolicLink = (root, directory) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  for (let current = directory;current !== root; current = path.dirname(current))
+    if (yield* isSymbolicLink(current))
+      return true;
+  if (!(yield* fs.exists(directory)))
+    return false;
+  for (const entry of yield* fs.readDirectory(directory, { recursive: true }))
+    if (yield* isSymbolicLink(path.join(directory, entry)))
+      return true;
+  return false;
+});
 var exposeSkill = (operation) => gen(function* () {
   const fs = yield* FileSystem;
   const path = yield* Path;
@@ -1707,8 +2212,8 @@ var exposeSkill = (operation) => gen(function* () {
   }
   yield* fs.symlink(path.resolve(operation.sourcePath), targetPath);
 });
-var isSymbolicLink = (file) => flatMap(FileSystem, (fs) => fs.readLink(file).pipe(as(true), orElseSucceed(() => false)));
-var realPathOr = (file, reason) => flatMap(FileSystem, (fs) => fs.realPath(file).pipe(mapError(() => new SkillMaterializationRefused({ message: reason }))));
+var isSymbolicLink = (file) => flatMap2(FileSystem, (fs) => fs.readLink(file).pipe(as(true), orElseSucceed(() => false)));
+var realPathOr = (file, reason) => flatMap2(FileSystem, (fs) => fs.realPath(file).pipe(mapError(() => new SkillMaterializationRefused({ message: reason }))));
 var assertNoSymlinkComponents = (file, reason) => gen(function* () {
   const path = yield* Path;
   for (let current = path.resolve(file);; current = path.dirname(current)) {
@@ -1729,7 +2234,7 @@ function skillIdentity(skill) {
   if (source.kind === "kitman")
     return `kitman:${source.skillId ?? source.name ?? skill.name}:${skill.name}`;
   if (source.kind === "git")
-    return `git:${source.url}#${source.ref}:${source.path ?? ""}:${skill.name}`;
+    return `git:${source.url}#${source.ref ?? ""}:${source.path ?? ""}:${skill.name}`;
   if (source.kind === "package")
     return `package:${source.packageName}@${source.version}:${source.path ?? ""}:${skill.name}`;
   if (source.kind === "url")
@@ -1743,7 +2248,9 @@ var ProjectSkillDirectories = {
   pi: ".pi/skills"
 };
 function skillBasePath2(path, harness, scope, rootDir, home) {
-  return scope === "user" ? path.join(home, ".agents", "skills") : path.join(rootDir ?? ".", ProjectSkillDirectories[harness]);
+  if (scope !== "user")
+    return path.join(rootDir ?? ".", ProjectSkillDirectories[harness]);
+  return harness === "claude-code" ? path.join(home, ".claude", "skills") : path.join(home, ".agents", "skills");
 }
 function skillMarkdown(name, contentMarkdown) {
   const content = contentMarkdown.trimEnd();
@@ -1798,7 +2305,7 @@ var closeSocket = (conn, isOpen) => {
 var makeNet = (options) => fromDuplex(contextWith((context) => {
   let conn;
   let isOpen = false;
-  return flatMap(addFinalizer(get(context, Scope), sync(() => {
+  return flatMap2(addFinalizer(get(context, Scope), sync(() => {
     if (!conn)
       return;
     closeSocket(conn, isOpen);
@@ -2200,7 +2707,7 @@ class HerdrSocketClient {
     });
   }
   sessionSnapshot() {
-    return flatMap(this.request("session.snapshot", {}), (result) => {
+    return flatMap2(this.request("session.snapshot", {}), (result) => {
       const snapshot = isRecord(result) && result.type === "session_snapshot" ? result.snapshot : undefined;
       if (!isRecord(snapshot) || !isString2(snapshot.version) || !isNumber(snapshot.protocol) || !Number.isInteger(snapshot.protocol) || !Array.isArray(snapshot.workspaces) || !Array.isArray(snapshot.tabs) || !Array.isArray(snapshot.panes) || !Array.isArray(snapshot.layouts) || !Array.isArray(snapshot.agents))
         return fail4(fail2("herdr_session_snapshot_invalid"));
@@ -2315,7 +2822,7 @@ function isRecord(value) {
 // packages/agent-runtime/src/herdr-server-supervisor.ts
 class HerdrServerError extends TaggedError("HerdrServerError") {
 }
-var fail3 = (message) => new HerdrServerError({ message });
+var fail5 = (message) => new HerdrServerError({ message });
 
 class HerdrServerSupervisor {
   runnerId;
@@ -2347,9 +2854,9 @@ class HerdrServerSupervisor {
   }
   start = fnUntraced(function* () {
     if (this.started && this.client !== undefined)
-      return yield* this.client.sessionSnapshot().pipe(mapError((error) => fail3(error.message)));
+      return yield* this.client.sessionSnapshot().pipe(mapError((error) => fail5(error.message)));
     if (!["linux", "darwin"].includes(this.options.platform ?? process.platform))
-      return yield* fail3("herdr_platform_unsupported");
+      return yield* fail5("herdr_platform_unsupported");
     const defaultSession = this.options.session === "default";
     const runtime = defaultSession ? undefined : yield* this.prepareRuntime();
     const socketClientOptions = this.options.socketClientOptions ?? {};
@@ -2390,7 +2897,7 @@ class HerdrServerSupervisor {
     }
     const snapshot = yield* awaitReadiness(socketClient, this.readinessTimeoutMs);
     if (snapshot.protocol !== HERDR_SOCKET_PROTOCOL)
-      return yield* fail3("herdr_protocol_mismatch");
+      return yield* fail5("herdr_protocol_mismatch");
     return snapshot;
   });
   attachToDefaultSession = fnUntraced(function* (socketPath, socketClient) {
@@ -2398,7 +2905,7 @@ class HerdrServerSupervisor {
     if (isFailure(running)) {
       const message = running.failure.message;
       if (message !== "herdr_socket_connect_failed" && message !== "herdr_socket_closed")
-        return yield* fail3(message);
+        return yield* fail5(message);
       yield* (this.options.spawnServer ?? spawnServer)({
         command: this.options.herdrCommand ?? "herdr",
         args: ["server"],
@@ -2407,7 +2914,7 @@ class HerdrServerSupervisor {
     }
     const snapshot = isSuccess(running) ? running.success : yield* awaitReadiness(socketClient, this.readinessTimeoutMs);
     if (snapshot.protocol !== HERDR_SOCKET_PROTOCOL)
-      return yield* fail3("herdr_protocol_mismatch");
+      return yield* fail5("herdr_protocol_mismatch");
     return snapshot;
   });
   prepareRuntime = fnUntraced(function* () {
@@ -2419,7 +2926,7 @@ class HerdrServerSupervisor {
       fs.makeDirectory(path.dirname(directory), { recursive: true, mode: 448 }),
       fs.makeDirectory(directory, { recursive: true, mode: 448 }),
       fs.chmod(directory, 448)
-    ]), () => fail3("herdr_runtime_unavailable"));
+    ]), () => fail5("herdr_runtime_unavailable"));
     const sessionName = `kitman-herdr-${digest(this.runnerId)}`;
     const runtime = {
       directory,
@@ -2453,7 +2960,7 @@ var reclaimStaleRuntime = (runtime, runnerId, isAlive) => gen(function* () {
   if (!socketExists && owner === undefined)
     return false;
   if (owner === undefined || owner.runnerId !== runnerId || owner.socketPath !== runtime.socketPath)
-    return yield* fail3(`herdr_socket_ownership_unknown:${socketExists ? "socket_present" : "socket_missing"}:${owner === undefined ? "owner_missing" : "owner_mismatch"}`);
+    return yield* fail5(`herdr_socket_ownership_unknown:${socketExists ? "socket_present" : "socket_missing"}:${owner === undefined ? "owner_missing" : "owner_mismatch"}`);
   if (yield* isAlive(owner.pid))
     return true;
   yield* removeRuntimeFiles(runtime);
@@ -2464,8 +2971,8 @@ var awaitReadiness = (client, readinessTimeoutMs) => gen(function* () {
   for (;; ) {
     const remaining = deadline - (yield* currentTimeMillis);
     if (remaining <= 0)
-      return yield* fail3("herdr_socket_connect_failed");
-    const attempt = yield* result(client.sessionSnapshot().pipe(mapError((error) => fail3(error.message)), timeoutOrElse({ duration: remaining, orElse: () => fail4(fail3("herdr_readiness_timeout")) })));
+      return yield* fail5("herdr_socket_connect_failed");
+    const attempt = yield* result(client.sessionSnapshot().pipe(mapError((error) => fail5(error.message)), timeoutOrElse({ duration: remaining, orElse: () => fail4(fail5("herdr_readiness_timeout")) })));
     if (isSuccess(attempt))
       return attempt.success;
     const message = attempt.failure.message;
@@ -2493,15 +3000,15 @@ var homeDirectory = map3(optionalEnv("HOME"), (home) => home ?? "/");
 var temporaryDirectory = map3(optionalEnv("TMPDIR"), (tmp) => tmp ?? "/tmp");
 var spawnServer = (input) => gen(function* () {
   const spawner = yield* ChildProcessSpawner;
-  const scope = yield* make6();
-  const handle = yield* spawner.spawn(make11(input.command, [...input.args], {
+  const scope = yield* make7();
+  const handle = yield* spawner.spawn(make13(input.command, [...input.args], {
     env: { HERDR_SOCKET_PATH: input.socketPath },
     extendEnv: true,
     detached: true,
     stdin: "ignore",
     stdout: "ignore",
     stderr: "ignore"
-  })).pipe(provide(scope), mapError(() => fail3("herdr_server_start_failed")));
+  })).pipe(provide(scope), mapError(() => fail5("herdr_server_start_failed")));
   yield* ignore(handle.unref);
   return {
     pid: handle.pid,
@@ -2521,7 +3028,7 @@ var writeOwnerMarker = (path, marker) => gen(function* () {
   yield* fs.writeFileString(path, `${encodeJsonStringSync(marker)}
 `, { mode: 384 });
   yield* fs.chmod(path, 384);
-}).pipe(mapError(() => fail3("herdr_runtime_unavailable")));
+}).pipe(mapError(() => fail5("herdr_runtime_unavailable")));
 var readOwnerMarker = (path) => gen(function* () {
   const fs = yield* FileSystem;
   const text = yield* fs.readFileString(path);
@@ -2570,7 +3077,7 @@ function shortId(value) {
 function isRecord2(value) {
   return isObject(value) && value !== null && !Array.isArray(value);
 }
-var requestRecord = (client, method, params, expectedType) => flatMap(client.request(method, params), (response) => {
+var requestRecord = (client, method, params, expectedType) => flatMap2(client.request(method, params), (response) => {
   const result = recordValue(response);
   return result === undefined || result.type !== expectedType ? fail4(new HerdrHarnessError({ message: `${method}_response_invalid` })) : succeed5(result);
 });
@@ -2720,7 +3227,7 @@ var HarnessAdapters = [
     auth: ["~/.codex"],
     providerHosts: ["api.openai.com", "auth.openai.com", "chatgpt.com"],
     effortArgs: ["-c", 'model_reasoning_effort="{effort}"'],
-    autoPermissionArgs: ["--dangerously-bypass-approvals-and-sandbox"],
+    autoPermissionArgs: ["--dangerously-bypass-approvals-and-sandbox", "--dangerously-bypass-hook-trust"],
     firstMessage: "herdr_prompt",
     mcp: { kind: "toml_overrides", flag: "-c" },
     skills: { kind: "skills_config", root: "skills" },
@@ -3289,7 +3796,7 @@ var executeHerdrStepAttempt = (input) => gen(function* () {
     });
     yield* input.harness.prompt({ targetId: launched.targetId, text: firstMessage(input.agent, worktreePath) });
     const steering = input.control.steering;
-    const deliveries = steering === undefined ? undefined : yield* forkScoped(forever(flatMap(steering.next, (note) => input.harness.prompt({ targetId: launched.targetId, text: note.text }).pipe(matchEffect({
+    const deliveries = steering === undefined ? undefined : yield* forkScoped(forever(flatMap2(steering.next, (note) => input.harness.prompt({ targetId: launched.targetId, text: note.text }).pipe(matchEffect({
       onSuccess: () => steering.report(note, true),
       onFailure: () => steering.report(note, false)
     })))));
@@ -3700,7 +4207,7 @@ var findSession = (adapter, place) => gen(function* () {
 }).pipe(orElseSucceed(() => {
   return;
 }));
-var packSession = (path) => map3(flatMap(FileSystem, (fs) => fs.readFile(path)), (content) => new Uint8Array(gzipSync(content)));
+var packSession = (path) => map3(flatMap2(FileSystem, (fs) => fs.readFile(path)), (content) => new Uint8Array(gzipSync(content)));
 var restoreSession = (adapter, place) => gen(function* () {
   const fs = yield* FileSystem;
   const location = adapter.session?.location;
@@ -3971,8 +4478,8 @@ function runReplica(control, executor, signals) {
     if (work === undefined)
       return { status: "idle" };
     const lease = leaseInput(work);
-    const workHeartbeat = sleep(heartbeatInterval(work)).pipe(flatMap(() => call("heartbeatWork", () => control.heartbeatWork(work.id, lease))), repeat({ until: (heartbeat) => heartbeat?.settled === true }), as({ status: "settled" }));
-    const pushedStop = signals === undefined ? never : signals.stopped(work.id).pipe(flatMap((stop) => stop === "canceled" ? fail4(new RunnerReplicaCancellation) : succeed5({ status: "settled" })), ensuring(signals.forget(work.id)));
+    const workHeartbeat = sleep(heartbeatInterval(work)).pipe(flatMap2(() => call("heartbeatWork", () => control.heartbeatWork(work.id, lease))), repeat({ until: (heartbeat) => heartbeat?.settled === true }), as({ status: "settled" }));
+    const pushedStop = signals === undefined ? never : signals.stopped(work.id).pipe(flatMap2((stop) => stop === "canceled" ? fail4(new RunnerReplicaCancellation) : succeed5({ status: "settled" })), ensuring(signals.forget(work.id)));
     let completed = false;
     let leaseLost = false;
     return yield* gen(function* () {
@@ -4356,7 +4863,101 @@ function runnerStepAttemptFromAgentStep(work) {
     }
   };
 }
+// packages/agent-runtime/src/codex-hook-trust.ts
+class CodexAppServerFailed extends TaggedError("CodexAppServerFailed") {
+  get message() {
+    return this.reason;
+  }
+}
+var RpcResponse = Struct({
+  id: Finite,
+  result: optional(Unknown),
+  error: optional(Struct({ message: String2 }))
+});
+var HooksList = Struct({
+  data: ArraySchema(Struct({
+    hooks: ArraySchema(Struct({
+      key: String2,
+      pluginId: optional(NullOr(String2)),
+      currentHash: String2,
+      trustStatus: String2
+    }))
+  }))
+});
+var codexAppServer = (binary = "codex") => (env) => gen(function* () {
+  const spawner = yield* ChildProcessSpawner;
+  const input = yield* unbounded();
+  const pending = new Map;
+  let lastId = 0;
+  const handle = yield* spawner.spawn(make13(binary, ["app-server"], {
+    cwd: env.home,
+    extendEnv: true,
+    env: { HOME: env.home, CODEX_HOME: env.codexHome },
+    stdin: fromQueue(input),
+    stderr: "ignore"
+  })).pipe(catchReason("PlatformError", "NotFound", () => fail4(new CodexAppServerFailed({ reason: `${binary} is not on the PATH` }))), mapError((error) => new CodexAppServerFailed({ reason: error.message })));
+  const settle = (line) => match(flatMap(decodeJsonStringOption(line), decodeUnknownOption(RpcResponse)), {
+    onNone: () => void_2,
+    onSome: (response) => {
+      const deferred = pending.get(response.id);
+      if (deferred === undefined)
+        return void_2;
+      pending.delete(response.id);
+      return response.error === undefined ? succeed3(deferred, response.result) : fail3(deferred, new CodexAppServerFailed({ reason: response.error.message }));
+    }
+  });
+  yield* handle.stdout.pipe(decodeText, splitLines, runForEach(settle), ignore, ensuring(forEach(pending.values(), (deferred) => fail3(deferred, new CodexAppServerFailed({ reason: `${binary} app-server exited` })))), forkScoped);
+  const send = (message) => offer(input, new TextEncoder().encode(`${encodeJsonStringSync(message)}
+`));
+  return {
+    request: (method, params) => gen(function* () {
+      const id = ++lastId;
+      const deferred = yield* make6();
+      pending.set(id, deferred);
+      yield* send({ id, method, params });
+      return yield* _await(deferred).pipe(mapError((error) => new CodexAppServerFailed({ reason: `${method}: ${error.message}` })));
+    }),
+    notify: (method) => asVoid(send({ method }))
+  };
+});
+var CodexAppServer = Reference("kitman/agent-runtime/CodexAppServer", {
+  defaultValue: () => codexAppServer()
+});
+var trustCodexPluginHooks = (input) => gen(function* () {
+  const launch = yield* CodexAppServer;
+  const codex = yield* launch({ home: input.home, codexHome: `${input.home}/.codex` });
+  const pluginIds = new Set(input.plugins.map((plugin) => `${plugin}@kitman`));
+  yield* codex.request("initialize", { clientInfo: { name: "kitman", title: "Kitman", version: "1" } });
+  yield* codex.notify("initialized");
+  for (const pluginName of input.plugins)
+    yield* codex.request("plugin/install", { marketplacePath: input.marketplacePath, pluginName });
+  const listed = yield* decodeUnknownEffect(HooksList)(yield* codex.request("hooks/list", { cwds: [input.home] })).pipe(mapError(() => new CodexAppServerFailed({ reason: "hooks/list: unexpected response" })));
+  const untrusted = listed.data.flatMap((entry) => entry.hooks).filter((hook) => pluginIds.has(hook.pluginId ?? "") && (hook.trustStatus === "untrusted" || hook.trustStatus === "modified"));
+  if (untrusted.length > 0)
+    yield* codex.request("config/batchWrite", {
+      edits: [
+        {
+          keyPath: "hooks.state",
+          mergeStrategy: "upsert",
+          value: Object.fromEntries(untrusted.map((hook) => [hook.key, { trusted_hash: hook.currentHash }]))
+        }
+      ],
+      reloadUserConfig: true
+    });
+  return [];
+}).pipe(scoped, timeoutOrElse({
+  duration: "1 minute",
+  orElse: () => fail4(new CodexAppServerFailed({ reason: "timed out" }))
+}), catch_((error) => succeed5(input.plugins.map((plugin) => `Kitman could not record trust for ${plugin}'s hooks (${error.message}); Codex will ask in /hooks.`))));
+
 // packages/agent-runtime/src/materialization-plan.ts
+var HarnessUpdaters = {
+  "claude-code": ["claude", "update"],
+  codex: ["codex", "update"],
+  opencode: ["opencode", "upgrade"],
+  pi: ["pi", "update", "--self"]
+};
+
 class AgentEnvironmentPlanApplyError extends TaggedError("AgentEnvironmentPlanApplyError") {
   get message() {
     return `AgentEnvironment plan apply failed during ${this.phase}: ${this.cause.message}`;
@@ -4368,11 +4969,18 @@ var previewAgentEnvironmentPlan = fnUntraced(function* (input) {
     ...input.rootDir === undefined ? undefined : { rootDir: input.rootDir },
     ...input.scope === undefined ? undefined : { scope: input.scope },
     ...input.cacheRoot === undefined ? undefined : { cacheRoot: input.cacheRoot },
-    ...input.noInstall === undefined ? undefined : { noInstall: input.noInstall }
+    ...input.noInstall === undefined ? undefined : { noInstall: input.noInstall },
+    ...input.approvedSkillSources === undefined ? undefined : { approvedSkillSources: input.approvedSkillSources },
+    ...input.requireReviewedSources === undefined ? undefined : { requireReviewedSources: input.requireReviewedSources },
+    ...input.versions === undefined ? undefined : { versions: input.versions }
   });
   const harnessConfig = yield* previewAgentEnvironmentConfigSync({
     environment: input.environment,
     materializedSkills: skills.materializedSkills,
+    materializedPlugins: skills.materializedPlugins,
+    skippedPlugins: skills.skippedPlugins,
+    ...input.noInstall === undefined ? undefined : { noInstall: input.noInstall },
+    ...input.versions === undefined ? undefined : { versions: input.versions },
     ...input.syncKit === undefined ? undefined : { syncKit: input.syncKit },
     ...input.rootDir === undefined ? undefined : { rootDir: input.rootDir },
     ...input.scope === undefined ? undefined : { scope: input.scope },
@@ -4383,19 +4991,50 @@ var previewAgentEnvironmentPlan = fnUntraced(function* (input) {
     ...input.syncKit === undefined ? undefined : { syncKitHash: input.syncKit.syncKitHash },
     skills,
     harnessConfig,
+    ...input.versions === "latest" && input.noInstall !== true ? { harnessUpdater: HarnessUpdaters[input.environment.harness] } : undefined,
     operationCount: skills.operations.length + harnessConfig.operations.length,
     warnings: [...skills.warnings, ...harnessConfig.warnings].map((item) => item.message)
   };
 });
 function composeAgentEnvironmentSyncPlan(targets) {
-  return { version: 1, planId: canonicalSha256(targets), targets };
+  const unlinks = targets.flatMap((target) => target.skills.operations.flatMap((operation) => operation.kind === "unlink_stale_links" ? [operation] : []));
+  const composed = targets.map((target) => ({
+    ...target,
+    skills: {
+      ...target.skills,
+      operations: target.skills.operations.map((operation) => operation.kind === "unlink_stale_links" ? {
+        ...operation,
+        keepPaths: unlinks.flatMap((unlink) => unlink.path === operation.path ? unlink.keepPaths : []),
+        sharedWith: operation.sharedWith.filter((shared) => !targets.some((other) => other.harness === shared.harness))
+      } : operation)
+    }
+  }));
+  return { version: 1, planId: canonicalSha256(composed), targets: composed };
 }
+var updateHarness = (argv) => gen(function* () {
+  const run = yield* CommandRunner2;
+  const failure = yield* run(argv).pipe(map3((result) => result.exitCode === 0 ? undefined : result.output.trim().split(`
+`).at(-1) ?? `exit code ${result.exitCode}`), catch_((error) => succeed5(error.message)));
+  return failure === undefined ? [] : [`Kitman could not update ${argv[0]} with \`${argv.join(" ")}\`: ${failure}`];
+});
 var applyAgentEnvironmentPlans = fnUntraced(function* (plan) {
-  for (const target of plan.targets)
-    yield* applyAgentEnvironmentMaterialization(target.skills).pipe(mapError((cause) => new AgentEnvironmentPlanApplyError({ phase: "skills", cause })));
+  yield* gen(function* () {
+    const checkout = yield* gitCheckouts;
+    for (const target of plan.targets)
+      yield* applyAgentEnvironmentMaterialization(target.skills, checkout).pipe(mapError((cause) => new AgentEnvironmentPlanApplyError({ phase: "skills", cause })));
+  }).pipe(scoped);
+  const updateWarnings = yield* forEach(plan.targets, (target) => target.harnessUpdater === undefined ? succeed5([]) : updateHarness(target.harnessUpdater));
   for (const target of plan.targets)
     yield* applyAgentEnvironmentConfigSync(target.harnessConfig).pipe(mapError((cause) => new AgentEnvironmentPlanApplyError({ phase: "harness_config", cause })));
-  return plan;
+  const targets = yield* forEach(plan.targets, (target, index) => map3(target.skills.codexHookTrust === undefined ? succeed5([]) : trustCodexPluginHooks({
+    ...target.skills.codexHookTrust,
+    plugins: target.skills.materializedPlugins.map((plugin) => plugin.name)
+  }), (trustWarnings) => [...updateWarnings[index] ?? [], ...trustWarnings]).pipe(map3((warnings) => ({
+    ...target,
+    skills: { ...target.skills, warnings: [...target.skills.warnings, ...warnings.map((message) => ({ message }))] },
+    warnings: [...target.warnings, ...warnings]
+  }))));
+  return { ...plan, targets };
 });
 // packages/agent-runtime/src/herdr-executor-surface.ts
 class HerdrExecutorSurfaceError extends TaggedError("HerdrExecutorSurfaceError") {
@@ -4431,7 +5070,7 @@ function herdrExecutorSurface(input) {
     executionClient: {
       request: (method, params) => supervisor.executionClient.request(method, params).pipe(tap((response) => record(method, response)))
     },
-    start: () => supervisor.start().pipe(mapError((error) => new HerdrExecutorSurfaceError({ reason: "start_failed", message: error.message })), flatMap((readiness) => readiness.protocol === HERDR_SOCKET_PROTOCOL ? void_2 : fail4(new HerdrExecutorSurfaceError({ reason: "start_failed", message: "herdr_protocol_mismatch" })))),
+    start: () => supervisor.start().pipe(mapError((error) => new HerdrExecutorSurfaceError({ reason: "start_failed", message: error.message })), flatMap2((readiness) => readiness.protocol === HERDR_SOCKET_PROTOCOL ? void_2 : fail4(new HerdrExecutorSurfaceError({ reason: "start_failed", message: "herdr_protocol_mismatch" })))),
     stop: () => andThen(prune, supervisor.stop())
   };
 }
@@ -4451,10 +5090,10 @@ var handshake = [
 `).join("");
 var kitmanMcpPreflight = (mcp) => gen(function* () {
   const spawner = yield* ChildProcessSpawner;
-  const server = yield* spawner.spawn(make11(mcp.command, [...mcp.args], {
+  const server = yield* spawner.spawn(make13(mcp.command, [...mcp.args], {
     extendEnv: true,
     env: mcp.env,
-    stdin: { stream: make9(new TextEncoder().encode(handshake)), endOnDone: false },
+    stdin: { stream: make11(new TextEncoder().encode(handshake)), endOnDone: false },
     stderr: "ignore"
   }));
   const reply = yield* server.stdout.pipe(decodeText, splitLines, map4((line) => recordValue(getOrUndefined(decodeJsonStringOption(line)))), filter((message) => message?.id === 2), runHead);
@@ -4526,8 +5165,8 @@ var programProcessExecutor = (input) => (work) => gen(function* () {
   };
   const exitCode = sandbox === undefined ? yield* gen(function* () {
     const spawner = yield* ChildProcessSpawner;
-    const handle = yield* spawner.spawn(make11(input.bun ?? process.execPath, [file], {
-      stdin: make9(new TextEncoder().encode(stdin)),
+    const handle = yield* spawner.spawn(make13(input.bun ?? process.execPath, [file], {
+      stdin: make11(new TextEncoder().encode(stdin)),
       stdout: "inherit",
       stderr: "inherit",
       extendEnv: false,
@@ -4679,6 +5318,7 @@ export {
   AgentRuntimePackageName,
   BundleRefused,
   CommandFailed2 as CommandFailed,
+  CommandRunner2 as CommandRunner,
   ContainerError,
   EgressProxyImage,
   HERDR_SOCKET_PROTOCOL,
@@ -4715,6 +5355,7 @@ export {
   dockerContainerRunner,
   dockerMissing,
   executeHerdrStepAttempt,
+  gitCheckouts,
   harnessAdapter,
   herdrAgentBackendLayer,
   herdrExecutionExtension2 as herdrExecutionExtension,
@@ -4745,6 +5386,7 @@ export {
   previewAgentEnvironmentPlan,
   probeSandboxHost,
   programProcessExecutor,
+  readManifestSkillPaths,
   recordList,
   recordValue,
   refuseAgentRequest,
@@ -4780,6 +5422,7 @@ export {
   stringValue,
   superviseReplica,
   verificationExecutor,
+  withSourceResolutionCache,
   writeAgentEnvironmentConfigFile,
   writeSrtSettings
 };