@lesliechan721/aw 0.1.0-beta.3

package/dist/src/commands/rebuild-integration.js

@@ -0,0 +1,3289 @@
+import crypto from 'node:crypto';
+import path from 'node:path';
+import fs from 'fs-extra';
+import { generateAgentArtifacts } from '../generators/agents.js';
+import { extractCodexHookGroups } from '../generators/hooks.js';
+import { generateInstructionArtifacts, renderCodexManagedInstructionBlock, } from '../generators/instructions.js';
+import { generateCodexPermissionArtifacts, mergeClaudePermissions, } from '../generators/permissions.js';
+import { buildGeneratedName } from '../generators/shared.js';
+import { applyConditionalCodexConfigTransactionFile, applyCodexConfigTransactionFile, composeManagedDeveloperInstructionsBlock, readCodexConfigFile, readRenderedCodexMcpServersFile, } from '../utils/codex-config.js';
+import { createCodexSkillExpectedTree, createCodexSkillStagingTreeContentDigest, } from '../utils/codex-skill-staging.js';
+import { createDynamicSkillExpectedTree, createDynamicSkillTreeContentDigest, skillDirectoryMatchesExpectedTree, validateSkillDirectory, writeDynamicSkillTree, } from '../utils/dynamic-skill-tree.js';
+import { parseCodexSharedHooksFile, renderTrackedHookGroupIdentity, resolvePlatformHookDefinitions, serializeTrackedHookGroupIdentity, } from '../utils/hooks-contract.js';
+import { buildCodexMarketplaceAddInvocation, buildCodexMarketplaceListInvocation, buildCodexMarketplaceRemoveInvocation, buildCodexPluginAddInvocation, buildCodexPluginListInvocation, buildCodexPluginRemoveInvocation, runNativeCliChecked, } from '../utils/native-cli.js';
+import { OWNED_TEXT_HEADER_PREFIX, createSharedOwnerToken, createSkillOwnerMarkerContent, parseSharedOwnerToken, parseOwnedTextHeader, readSkillOwnerMarker, inspectOwnedComponents, writeOwnedTextFile, } from '../utils/ownership.js';
+import { resolveArtifactRenderConfig, runArtifactRenderer } from '../utils/artifact-renderer.js';
+import { validateArtifactPlan } from '../utils/artifact-plan.js';
+import { readPluginManifest } from '../utils/manifest.js';
+import { resolvePlatformEntries } from '../utils/platform-entries.js';
+import { resolveAwHome, resolveClaudePaths, resolveCodexPaths, resolveRepoRoot, getCodexHome, } from '../utils/paths.js';
+import { runLifecycleScript } from '../utils/plugin-scripts.js';
+import { atomicRemoveConfigFile, atomicReplaceConfigFile, withConfigFileLock, } from '../utils/plugin-config.js';
+import { withActiveMarketplaceLifecycleLease, withActiveMarketplaceRuntimeLease, } from '../utils/active-marketplace-runtime-lock.js';
+import { readCatalogSourcesConfigSnapshot } from '../utils/catalog-sources.js';
+import { getNamespacedMarketplaceName, projectMarketplaceManifestForPlatform, replayNamespacedCodexSkillOverlays, } from '../utils/local-marketplace.js';
+import { cleanupOrphanNamespacedMarketplaceRoot, commitMarketplaceGenerationBackup, } from '../utils/orphan-marketplace-cleanup.js';
+import { readClaudeSettings, writeClaudeSettings } from '../adapters/helpers.js';
+import { requiresCodexNativePlugin } from '../utils/codex-project-surface.js';
+import { assertCanonicalProjectManagedRoots } from '../utils/project-boundary.js';
+import { findCodexRoleNameConflict, resolveCodexRoleNamespace, } from '../utils/codex-roles.js';
+const MARKETPLACE_NAME = 'aw';
+const MCP_OWNER_ENV = 'AW_AGENT_WORKFLOWS_OWNER';
+function ownerIdentity(plugin, artifactKey, platform, scope) {
+    return { owner: 'agent-workflows', plugin, artifactKey, platform, scope };
+}
+function pluginOwnerIdentity(plugin, artifactKey, platform, scope) {
+    return {
+        ...ownerIdentity(plugin.manifest.name, artifactKey, platform, scope),
+        ...(plugin.sourceId ? {
+            sourceId: plugin.sourceId,
+            sourceIdentity: plugin.sourceIdentity,
+            pluginId: plugin.pluginId,
+        } : {}),
+    };
+}
+function bindNamespacedOwnerIdentity(components, source) {
+    if (!source.sourceId)
+        return;
+    for (const component of components) {
+        component.identity.sourceId = source.sourceId;
+        component.identity.sourceIdentity = source.sourceIdentity;
+        component.identity.pluginId = source.pluginId;
+    }
+}
+function internalArtifactKey(kind, value) {
+    return `${kind}-${crypto.createHash('sha256').update(value).digest('hex').slice(0, 20)}`;
+}
+function pathComponent(options) {
+    if (options.kind !== 'skill-directory')
+        return options;
+    return {
+        ...options,
+        validateHealth: async () => {
+            await validateSkillDirectory(options.path, options.identity.platform === 'codex' ? 'codex.skill' : 'claude.skill', { ownerMarkerPolicy: 'ignore' });
+        },
+    };
+}
+function generatedTextWrite(options) {
+    const artifactPath = path.join(options.configDir, options.relativePath);
+    const identity = ownerIdentity(options.plugin.manifest.name, options.artifactKey, options.platform, options.scope);
+    const component = pathComponent({
+        kind: 'owned-text-file',
+        path: artifactPath,
+        allowedRoot: options.configDir,
+        identity,
+    });
+    return {
+        artifact: {
+            path: artifactPath,
+            kind: options.kind,
+            platform: options.platform,
+            artifactKey: options.artifactKey,
+        },
+        component,
+        write: async () => {
+            await fs.ensureDir(options.configDir);
+            await writeOwnedTextFile({
+                path: artifactPath,
+                allowedRoot: options.configDir,
+                identity,
+                content: options.content,
+            });
+        },
+    };
+}
+function mergePermissionStates(values) {
+    return {
+        allow: [...new Set(values.flatMap((value) => value?.allow ?? []))],
+        ask: [...new Set(values.flatMap((value) => value?.ask ?? []))],
+        deny: [...new Set(values.flatMap((value) => value?.deny ?? []))],
+    };
+}
+function subtractPermissionState(value, generated) {
+    const remove = {
+        allow: new Set(generated.allow),
+        ask: new Set(generated.ask),
+        deny: new Set(generated.deny),
+    };
+    return {
+        allow: (value?.allow ?? []).filter((entry) => !remove.allow.has(entry)),
+        ask: (value?.ask ?? []).filter((entry) => !remove.ask.has(entry)),
+        deny: (value?.deny ?? []).filter((entry) => !remove.deny.has(entry)),
+    };
+}
+function intersectPermissionState(value, generated) {
+    const keep = {
+        allow: new Set(generated.allow),
+        ask: new Set(generated.ask),
+        deny: new Set(generated.deny),
+    };
+    return {
+        allow: (value?.allow ?? []).filter((entry) => keep.allow.has(entry)),
+        ask: (value?.ask ?? []).filter((entry) => keep.ask.has(entry)),
+        deny: (value?.deny ?? []).filter((entry) => keep.deny.has(entry)),
+    };
+}
+function rebuildClaudePermissions(settings, ownerKey, desired) {
+    const previousGenerated = mergePermissionStates(Object.values(settings.awGenerated?.permissions ?? {}));
+    const currentPermissions = mergePermissionStates([settings.permissions]);
+    const manual = mergePermissionStates([
+        subtractPermissionState(currentPermissions, previousGenerated),
+        intersectPermissionState(intersectPermissionState(settings.awGenerated?.manualPermissions, previousGenerated), currentPermissions),
+    ]);
+    settings.awGenerated ??= {};
+    settings.awGenerated.permissions ??= {};
+    if (desired)
+        settings.awGenerated.permissions[ownerKey] = desired;
+    else
+        delete settings.awGenerated.permissions[ownerKey];
+    if (Object.keys(settings.awGenerated.permissions).length === 0) {
+        delete settings.awGenerated.permissions;
+    }
+    if (manual.allow.length || manual.ask.length || manual.deny.length) {
+        settings.awGenerated.manualPermissions = manual;
+    }
+    else {
+        delete settings.awGenerated.manualPermissions;
+    }
+    settings.permissions = mergePermissionStates([
+        manual,
+        ...Object.values(settings.awGenerated.permissions ?? {}),
+    ]);
+    if (settings.awGenerated.permissions === undefined
+        && settings.awGenerated.manualPermissions === undefined
+        && settings.awGenerated.hooks === undefined
+        && settings.awGenerated.manualHooks === undefined) {
+        delete settings.awGenerated;
+    }
+}
+function createClaudePermissionsComponent(options) {
+    const ownerKey = createSharedOwnerToken(options.identity);
+    return {
+        kind: 'shared-config',
+        identity: options.identity,
+        label: `${options.settingsPath}#awGenerated.permissions.${ownerKey}`,
+        inspect: async () => {
+            const settings = await readClaudeSettings(options.settingsPath);
+            return settings.awGenerated?.permissions?.[ownerKey] ? 'present' : 'absent';
+        },
+        remove: async () => {
+            const settings = await readClaudeSettings(options.settingsPath);
+            rebuildClaudePermissions(settings, ownerKey);
+            await writeClaudeSettings(options.settingsPath, settings);
+        },
+    };
+}
+function createCodexInstructionComponent(options) {
+    const ownerKey = createSharedOwnerToken(options.identity);
+    return {
+        kind: 'managed-block',
+        identity: options.identity,
+        label: `${options.configPath}#developer_instructions:${ownerKey}`,
+        inspect: async () => {
+            const config = await readCodexConfigFile(options.configPath);
+            return config.snapshot.developerInstructions.managedBlocks[ownerKey]
+                ? 'present'
+                : 'absent';
+        },
+        remove: async () => {
+            await applyCodexConfigTransactionFile(options.configPath, {
+                removeManagedInstructionPluginName: ownerKey,
+            });
+        },
+    };
+}
+function codexMcpOwner(actual) {
+    const envValue = actual?.value?.env;
+    return envValue
+        && typeof envValue === 'object'
+        && !Array.isArray(envValue)
+        && typeof envValue[MCP_OWNER_ENV] === 'string'
+        ? envValue[MCP_OWNER_ENV]
+        : null;
+}
+function createCodexMcpComponent(options) {
+    const ownerKey = createSharedOwnerToken(options.identity);
+    return {
+        kind: 'shared-config',
+        identity: options.identity,
+        label: `${options.configPath}#mcp_servers.${options.serverKey}`,
+        inspect: async () => {
+            const config = await readCodexConfigFile(options.configPath);
+            const actual = config.snapshot.mcpServers[options.serverKey];
+            if (!actual)
+                return 'absent';
+            return codexMcpOwner(actual) === ownerKey ? 'present' : 'foreign';
+        },
+        remove: async () => {
+            await applyConditionalCodexConfigTransactionFile(options.configPath, (snapshot) => {
+                const actual = snapshot.mcpServers[options.serverKey];
+                return codexMcpOwner(actual) === ownerKey
+                    ? { removeMcpServers: [options.serverKey] }
+                    : null;
+            });
+        },
+    };
+}
+async function codexRoleRegistrationOwned(options) {
+    if (!options.registration?.configFile)
+        return false;
+    const expected = path.normalize(path.relative(path.dirname(options.configPath), options.rolePath));
+    const actual = path.normalize(path.relative(path.dirname(options.configPath), path.resolve(path.dirname(options.configPath), options.registration.configFile)));
+    if (actual !== expected)
+        return false;
+    const raw = await fs.readFile(options.rolePath, 'utf8').catch(() => '');
+    try {
+        return Boolean(parseOwnedTextHeader(raw, options.fileIdentity));
+    }
+    catch {
+        return false;
+    }
+}
+function createCodexRoleRegistrationComponent(options) {
+    const inspect = async () => {
+        const config = await readCodexConfigFile(options.configPath);
+        const registration = config.snapshot.agents[options.roleKey];
+        if (!registration)
+            return 'absent';
+        return await codexRoleRegistrationOwned({ ...options, registration })
+            ? 'present'
+            : 'foreign';
+    };
+    return {
+        kind: 'shared-config',
+        identity: options.identity,
+        label: `${options.configPath}#agents.${options.roleKey}`,
+        inspect,
+        remove: async () => {
+            await applyConditionalCodexConfigTransactionFile(options.configPath, async (snapshot) => {
+                const registration = snapshot.agents[options.roleKey];
+                return await codexRoleRegistrationOwned({ ...options, registration })
+                    ? { removeAgentRegistrations: [options.roleKey] }
+                    : null;
+            });
+        },
+    };
+}
+async function readCodexHooks(hooksPath) {
+    if (!await fs.pathExists(hooksPath))
+        return parseCodexSharedHooksFile({ hooks: {} });
+    return parseCodexSharedHooksFile(await fs.readJson(hooksPath));
+}
+function renderCodexHookGroups(groups) {
+    const hooks = {};
+    for (const group of groups) {
+        hooks[group.event] ??= [];
+        hooks[group.event].push(group.rawGroup);
+    }
+    return `${JSON.stringify({ hooks }, null, 2)}\n`;
+}
+export async function applyCodexHookGroupsTransactionFile(hooksPath, update, testHooks) {
+    return withConfigFileLock({
+        filePath: hooksPath,
+        allowedRoot: path.dirname(hooksPath),
+        action: async () => {
+            const parsed = await readCodexHooks(hooksPath);
+            const groups = update(parsed);
+            if (!groups)
+                return false;
+            await testHooks?.beforeCommit?.();
+            if (groups.length === 0) {
+                await atomicRemoveConfigFile({
+                    filePath: hooksPath,
+                    allowedRoot: path.dirname(hooksPath),
+                });
+            }
+            else {
+                await atomicReplaceConfigFile({
+                    filePath: hooksPath,
+                    allowedRoot: path.dirname(hooksPath),
+                    content: renderCodexHookGroups(groups),
+                });
+            }
+            return true;
+        },
+    });
+}
+function renderCodexSharedHookGroup(identity) {
+    const rendered = renderTrackedHookGroupIdentity(identity);
+    const rawGroup = {
+        ...(rendered.matcher === undefined ? {} : { matcher: rendered.matcher }),
+        hooks: rendered.hooks,
+    };
+    return {
+        event: rendered.event,
+        matcher: rendered.matcher,
+        hooks: rendered.hooks,
+        rawGroup,
+    };
+}
+function createCodexHookComponent(options) {
+    const serialized = serializeTrackedHookGroupIdentity(options.identity);
+    return {
+        kind: 'shared-config',
+        identity: ownerIdentity(options.pluginName, internalArtifactKey('hook', serialized), 'codex', options.scope),
+        label: `${options.hooksPath}#${serialized}`,
+        inspect: async () => {
+            const parsed = await readCodexHooks(options.hooksPath);
+            return parsed.managedIdentities.some((entry) => serializeTrackedHookGroupIdentity(entry) === serialized)
+                ? 'present'
+                : 'absent';
+        },
+        remove: async () => {
+            await applyCodexHookGroupsTransactionFile(options.hooksPath, (parsed) => {
+                let removed = false;
+                const remaining = parsed.groups.flatMap((entry) => {
+                    if (!removed
+                        && entry.managedIdentity
+                        && serializeTrackedHookGroupIdentity(entry.managedIdentity) === serialized) {
+                        removed = true;
+                        return [];
+                    }
+                    return [entry.rawGroup];
+                });
+                return removed ? remaining : null;
+            });
+        },
+    };
+}
+function ownedCodexHookIdentity(options) {
+    const artifactKey = internalArtifactKey('hook', serializeTrackedHookGroupIdentity(options.identity));
+    const identity = {
+        ...ownerIdentity(options.pluginName, artifactKey, 'codex', options.scope),
+        ...(options.sourceId ? {
+            sourceId: options.sourceId,
+            sourceIdentity: options.sourceIdentity,
+            pluginId: options.pluginId,
+        } : {}),
+    };
+    return {
+        ...options.identity,
+        command: `${OWNED_TEXT_HEADER_PREFIX}${JSON.stringify(JSON.parse(createSkillOwnerMarkerContent(identity)))}\n${options.identity.command}`,
+    };
+}
+function sameOwnerIdentity(left, right) {
+    return left.owner === right.owner
+        && left.sourceId === right.sourceId
+        && left.sourceIdentity === right.sourceIdentity
+        && left.pluginId === right.pluginId
+        && left.plugin === right.plugin
+        && left.artifactKey === right.artifactKey
+        && left.platform === right.platform
+        && left.scope === right.scope;
+}
+function readOwnedHookIdentity(identity, scope) {
+    try {
+        const parsed = parseOwnedTextHeader(identity.command);
+        return parsed?.identity.platform === 'codex' && parsed.identity.scope === scope
+            ? parsed.identity
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function sharedOwnerPluginName(value) {
+    return parseSharedOwnerToken(value)?.plugin ?? value;
+}
+async function scanCodexSharedComponents(options) {
+    const output = [];
+    const expectedIdentity = (artifactKey) => ({
+        ...ownerIdentity(options.pluginName, artifactKey, 'codex', options.scope),
+        ...(options.sourceId ? {
+            sourceId: options.sourceId,
+            sourceIdentity: options.sourceIdentity,
+            pluginId: options.pluginId,
+        } : {}),
+    });
+    const corruptedComponent = (filePath, error) => ({
+        kind: 'shared-config',
+        identity: ownerIdentity(options.pluginName, internalArtifactKey('corrupted-shared-config', filePath), 'codex', options.scope),
+        label: filePath,
+        inspect: async () => {
+            throw new Error(`包含 ${options.pluginName} 的 AW ownership 证据，但共享配置无法解析：${error instanceof Error ? error.message : String(error)}`);
+        },
+        remove: async () => undefined,
+    });
+    const containsOwnedEvidence = (raw) => raw.includes(options.pluginName) && (raw.includes('[[aw-managed:start plugin=')
+        || raw.includes(MCP_OWNER_ENV)
+        || raw.includes(OWNED_TEXT_HEADER_PREFIX)
+        || raw.includes('agent-workflows'));
+    if (options.scanConfig) {
+        const config = await readCodexConfigFile(options.paths.configTomlPath).catch(async (error) => {
+            if (!options.ignoreReadErrors)
+                throw error;
+            const raw = await fs.readFile(options.paths.configTomlPath, 'utf8').catch(() => '');
+            if (containsOwnedEvidence(raw)) {
+                output.push(corruptedComponent(options.paths.configTomlPath, error));
+            }
+            return null;
+        });
+        const instructionIdentity = expectedIdentity('developer-instructions');
+        const instructionOwnerKey = createSharedOwnerToken(instructionIdentity);
+        if (config?.snapshot.developerInstructions.managedBlocks[instructionOwnerKey]) {
+            output.push(createCodexInstructionComponent({
+                identity: instructionIdentity,
+                scope: options.scope,
+                configPath: options.paths.configTomlPath,
+            }));
+        }
+        for (const [serverKey, server] of Object.entries(config?.snapshot.mcpServers ?? {})) {
+            const envValue = server.value?.env;
+            if (envValue
+                && typeof envValue === 'object'
+                && !Array.isArray(envValue)
+                && parseSharedOwnerToken(String(envValue[MCP_OWNER_ENV]))?.pluginId === options.pluginId) {
+                const identity = expectedIdentity(internalArtifactKey('mcp', serverKey));
+                if (createSharedOwnerToken(identity) !== envValue[MCP_OWNER_ENV])
+                    continue;
+                output.push(createCodexMcpComponent({
+                    identity,
+                    scope: options.scope,
+                    configPath: options.paths.configTomlPath,
+                    serverKey,
+                    owned: true,
+                }));
+            }
+        }
+        for (const [roleKey, registration] of Object.entries(config?.snapshot.agents ?? {})) {
+            if (!registration.configFile)
+                continue;
+            const rolePath = path.resolve(path.dirname(options.paths.configTomlPath), registration.configFile);
+            const raw = await fs.readFile(rolePath, 'utf8').catch(() => '');
+            const parsed = (() => {
+                try {
+                    return parseOwnedTextHeader(raw);
+                }
+                catch {
+                    return null;
+                }
+            })();
+            if (!parsed || !sameOwnerIdentity(parsed.identity, expectedIdentity(roleKey)))
+                continue;
+            output.push(createCodexRoleRegistrationComponent({
+                identity: expectedIdentity(internalArtifactKey('role', roleKey)),
+                fileIdentity: expectedIdentity(roleKey),
+                configPath: options.paths.configTomlPath,
+                roleKey,
+                rolePath,
+            }));
+        }
+    }
+    if (options.scope === 'project' && options.scanHooks) {
+        const hooks = await readCodexHooks(options.paths.hooksPath).catch(async (error) => {
+            if (!options.ignoreReadErrors)
+                throw error;
+            const raw = await fs.readFile(options.paths.hooksPath, 'utf8').catch(() => '');
+            if (containsOwnedEvidence(raw)) {
+                output.push(corruptedComponent(options.paths.hooksPath, error));
+            }
+            return null;
+        });
+        for (const identity of hooks?.managedIdentities ?? []) {
+            const parsedIdentity = readOwnedHookIdentity(identity, options.scope);
+            if (!parsedIdentity || !sameOwnerIdentity(parsedIdentity, expectedIdentity(parsedIdentity.artifactKey)))
+                continue;
+            output.push(createCodexHookComponent({
+                pluginName: options.pluginName,
+                scope: options.scope,
+                hooksPath: options.paths.hooksPath,
+                identity,
+            }));
+        }
+    }
+    return output;
+}
+async function scanClaudeSharedComponents(options) {
+    const settings = await readClaudeSettings(options.settingsPath);
+    const identity = {
+        ...ownerIdentity(options.pluginName, 'permissions', 'claude', options.scope),
+        ...(options.sourceId ? {
+            sourceId: options.sourceId,
+            sourceIdentity: options.sourceIdentity,
+            pluginId: options.pluginId,
+        } : {}),
+    };
+    return settings.awGenerated?.permissions?.[createSharedOwnerToken(identity)]
+        ? [createClaudePermissionsComponent({ ...options, identity })]
+        : [];
+}
+async function scanOwnedTextFiles(options) {
+    if (!await fs.pathExists(options.root))
+        return [];
+    const output = [];
+    const pending = [options.root];
+    while (pending.length > 0) {
+        const current = pending.pop();
+        for (const entry of await fs.readdir(current, { withFileTypes: true })) {
+            const entryPath = path.join(current, entry.name);
+            if (entry.isSymbolicLink())
+                continue;
+            if (entry.isDirectory()) {
+                pending.push(entryPath);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            const raw = await fs.readFile(entryPath, 'utf8').catch(() => '');
+            if (!raw.includes(OWNED_TEXT_HEADER_PREFIX))
+                continue;
+            let parsed;
+            try {
+                parsed = parseOwnedTextHeader(raw);
+            }
+            catch {
+                continue;
+            }
+            if (parsed?.identity.plugin !== options.pluginName
+                || (options.sourceId !== undefined && parsed.identity.sourceId !== options.sourceId)
+                || parsed.identity.platform !== options.platform
+                || parsed.identity.scope !== options.scope)
+                continue;
+            output.push(pathComponent({
+                kind: 'owned-text-file',
+                path: entryPath,
+                allowedRoot: options.root,
+                identity: parsed.identity,
+            }));
+        }
+    }
+    return output;
+}
+async function scanOwnedSkills(options) {
+    if (!await fs.pathExists(options.root))
+        return [];
+    const output = [];
+    const pending = [options.root];
+    while (pending.length > 0) {
+        const current = pending.pop();
+        for (const entry of await fs.readdir(current, { withFileTypes: true })) {
+            if (!entry.isDirectory() || entry.isSymbolicLink())
+                continue;
+            const skillRoot = path.join(current, entry.name);
+            const marker = await readSkillOwnerMarker({
+                skillRoot,
+                allowedRoot: current,
+            }).catch(() => null);
+            if (marker?.plugin === options.pluginName
+                && (options.sourceId === undefined || marker.sourceId === options.sourceId)
+                && marker.platform === options.platform
+                && marker.scope === options.scope) {
+                output.push(pathComponent({
+                    kind: 'skill-directory',
+                    path: skillRoot,
+                    allowedRoot: current,
+                    identity: marker,
+                }));
+                continue;
+            }
+            pending.push(skillRoot);
+        }
+    }
+    return output;
+}
+function componentIdentityKey(component) {
+    return [
+        component.kind,
+        component.identity.artifactKey,
+        'path' in component ? path.resolve(component.path) : 'label' in component ? component.label : component.pluginId,
+    ].join('\0');
+}
+function dedupeComponents(components) {
+    const seen = new Set();
+    return components.filter((component) => {
+        const key = componentIdentityKey(component);
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+async function preflightCodexWriteSafety(options) {
+    const pluginName = options.plugin.manifest.name;
+    const userConfigPath = resolveCodexPaths(options.cwd, 'user', options.env).configTomlPath;
+    const projectConfigPath = resolveCodexPaths(options.cwd, 'project', options.env).configTomlPath;
+    let userConfig;
+    try {
+        userConfig = await readCodexConfigFile(userConfigPath);
+    }
+    catch (error) {
+        throw new Error(`codexProjectUserConfigUnreadable: 无法解析用户级 Codex 配置 ${userConfigPath}：${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (options.scope === 'project') {
+        const expectedPluginId = `${pluginName}@${options.plugin.marketplaceName ?? MARKETPLACE_NAME}`;
+        for (const [key, plugin] of Object.entries(userConfig.snapshot.plugins)) {
+            if (key !== expectedPluginId
+                && (key === pluginName || key.startsWith(`${pluginName}@`) || plugin.name === pluginName)) {
+                throw new Error(`externalOwnershipPresent: 用户级 Codex 已存在同名外部插件 ${key}。`);
+            }
+        }
+    }
+    const roleKeys = new Set((options.plugin.manifest.artifacts?.targets ?? [])
+        .filter((target) => target.platform === 'codex'
+        && target.scopes.includes(options.scope)
+        && target.target === 'codex.agentRole'
+        && target.roleKey)
+        .map((target) => target.roleKey));
+    const needsProjectConfig = options.scope === 'project' && Boolean(options.plugin.manifest.mcpServers
+        || resolvePlatformEntries(options.plugin.manifest.extensions?.instructions, 'codex').length > 0
+        || (options.plugin.manifest.artifacts?.targets ?? []).some((target) => target.platform === 'codex'
+            && target.scopes.includes('project')
+            && (target.target === 'codex.agentRole'
+                || target.target === 'codex.developerInstructionsBlock')));
+    if (needsProjectConfig) {
+        try {
+            await readCodexConfigFile(projectConfigPath);
+        }
+        catch (error) {
+            throw new Error(`projectConfigUnreadable: 无法解析项目级 Codex 配置 ${projectConfigPath}：${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    if (roleKeys.size === 0)
+        return;
+    for (const configPath of options.scope === 'project'
+        ? [userConfigPath, projectConfigPath]
+        : [userConfigPath]) {
+        const configScope = configPath === userConfigPath ? 'user' : 'project';
+        const ownedRolePaths = [];
+        const ownedRoleKeys = [];
+        for (const roleKey of roleKeys) {
+            const rolePath = path.join(path.dirname(configPath), 'agents', `${buildGeneratedName(pluginName, roleKey)}.toml`);
+            const raw = await fs.readFile(rolePath, 'utf8').catch(() => '');
+            try {
+                if (parseOwnedTextHeader(raw, pluginOwnerIdentity(options.plugin, roleKey, 'codex', configScope))) {
+                    ownedRolePaths.push(rolePath);
+                    ownedRoleKeys.push(roleKey);
+                }
+            }
+            catch {
+                // A foreign file remains external below.
+            }
+        }
+        let namespace;
+        try {
+            namespace = await resolveCodexRoleNamespace(configPath, {
+                strict: true,
+                awManagedTableKeys: ownedRoleKeys,
+                awManagedRoleLayerPaths: ownedRolePaths,
+            });
+        }
+        catch (error) {
+            throw new Error(`projectConfigUnreadable: 无法读取 Codex role namespace ${configPath}：${error instanceof Error ? error.message : String(error)}`);
+        }
+        for (const roleKey of roleKeys) {
+            const tableCollision = namespace.roles.find((role) => role.source === 'registration' && role.tableKey === roleKey && !role.awManaged);
+            const nameConflict = findCodexRoleNameConflict(namespace, roleKey);
+            if (tableCollision || nameConflict?.conflict) {
+                throw new Error(`roleNameConflict: Codex role "${roleKey}" 已由外部配置占用（${configPath}）。`);
+            }
+        }
+    }
+}
+function renderCodexRole(options) {
+    const stringValue = (value) => JSON.stringify(value.trim());
+    return [
+        `name = ${stringValue(options.roleKey)}`,
+        `description = ${stringValue(options.description)}`,
+        `developer_instructions = ${stringValue(options.developerInstructions)}`,
+        ...(options.model ? [`model = ${stringValue(options.model)}`] : []),
+        ...(options.modelReasoningEffort
+            ? [`model_reasoning_effort = ${stringValue(options.modelReasoningEffort)}`]
+            : []),
+        '',
+    ].join('\n');
+}
+async function resolveCodexMcpServers(plugin, scope) {
+    if (!plugin.manifest.mcpServers)
+        return {};
+    const relative = plugin.manifest.mcpServers.replace(/^\.\//u, '');
+    const direct = path.resolve(plugin.rootDir, relative);
+    const mcpPath = await fs.pathExists(direct)
+        ? direct
+        : path.resolve(plugin.rootDir, 'codex', relative);
+    const servers = await readRenderedCodexMcpServersFile(mcpPath);
+    return Object.fromEntries(Object.entries(servers).map(([key, server]) => {
+        const existingEnv = server.env;
+        if (existingEnv !== undefined && (typeof existingEnv !== 'object' || Array.isArray(existingEnv))) {
+            throw new Error(`MCP server ${key} 的 env 必须是 object。`);
+        }
+        const env = (existingEnv ?? {});
+        const ownerKey = createSharedOwnerToken(pluginOwnerIdentity(plugin, internalArtifactKey('mcp', key), 'codex', scope));
+        if (env[MCP_OWNER_ENV] !== undefined
+            && env[MCP_OWNER_ENV] !== plugin.manifest.name
+            && env[MCP_OWNER_ENV] !== ownerKey) {
+            throw new Error(`MCP server ${key} 不能覆盖保留的 ${MCP_OWNER_ENV} owner marker。`);
+        }
+        return [key, {
+                ...server,
+                env: { ...env, [MCP_OWNER_ENV]: ownerKey },
+            }];
+    }));
+}
+async function resolveDynamicArtifacts(options) {
+    const declarations = (options.plugin.manifest.artifacts?.targets ?? []).filter((target) => target.platform === options.platform && target.scopes.includes(options.scope));
+    if (declarations.length === 0)
+        return { artifacts: [], sourceDirs: () => [] };
+    const render = await runArtifactRenderer({
+        event: options.event,
+        plugin: options.plugin,
+        platform: options.platform,
+        scope: options.scope,
+        cwd: options.cwd,
+        commandEnv: options.env,
+        previousArtifacts: [...options.previousArtifacts],
+        scriptTimeoutMs: options.scriptTimeoutMs,
+    });
+    const config = await resolveArtifactRenderConfig({
+        sourceId: options.plugin.sourceId,
+        sourceIdentity: options.plugin.sourceIdentity,
+        pluginName: options.plugin.manifest.name,
+        manifest: options.plugin.manifest,
+        scope: options.scope,
+        cwd: options.cwd,
+        env: options.env,
+    });
+    const artifacts = validateArtifactPlan({
+        manifest: options.plugin.manifest,
+        plan: render.plan,
+        platform: options.platform,
+        scope: options.scope,
+        renderConfig: config,
+        rendererDigest: render.target.rendererDigest,
+        manifestDigest: render.target.manifestDigest,
+    }).artifacts;
+    return {
+        artifacts,
+        sourceDirs: (artifact) => render.context.artifactSources.find((entry) => entry.id === artifact.id && entry.target === artifact.target)?.sourceDirs ?? [],
+    };
+}
+function dynamicSkillWrite(options) {
+    const skillKey = 'skillKey' in options.artifact ? options.artifact.skillKey : '';
+    const identity = ownerIdentity(options.plugin.manifest.name, skillKey, options.platform, options.scope);
+    const component = pathComponent({
+        kind: 'skill-directory',
+        path: options.skillPath,
+        allowedRoot: options.allowedRoot,
+        identity,
+        ...(options.platform === 'codex' && options.scope === 'user'
+            ? {
+                unownedIsPristine: (actualPath) => skillDirectoryMatchesExpectedTree(actualPath, options.tree),
+            }
+            : {}),
+    });
+    return {
+        artifact: {
+            path: options.skillPath,
+            paths: Object.keys(options.tree.files).map((relativePath) => path.join(options.skillPath, relativePath.split('/').join(path.sep))),
+            kind: 'skill',
+            platform: options.platform,
+            artifactKey: skillKey,
+            id: options.artifact.id,
+            target: options.artifact.target,
+            state: options.artifact.state,
+            ...(options.artifact.disabledReason
+                ? { disabledReason: options.artifact.disabledReason }
+                : {}),
+            refreshKeys: [...options.artifact.refreshKeys],
+            configDigest: options.artifact.configDigest,
+            contentDigest: options.platform === 'codex'
+                ? createCodexSkillStagingTreeContentDigest(options.tree)
+                : createDynamicSkillTreeContentDigest(options.tree),
+        },
+        ...(options.artifact.state === 'present' ? { component } : {}),
+        write: async () => {
+            if (options.artifact.state === 'disabled') {
+                return;
+            }
+            await writeDynamicSkillTree(options.skillPath, options.tree, {
+                allowedRoot: options.allowedRoot,
+                identity,
+                allowPristineUnowned: options.platform === 'codex' && options.scope === 'user',
+            });
+        },
+    };
+}
+async function resolveCodexSkillsRelativeRoot(plugin, marketplaceFallbackRoot) {
+    const manifestPaths = [
+        path.join(plugin.rootDir, '.codex-plugin', 'plugin.json'),
+        ...(marketplaceFallbackRoot
+            ? [path.join(marketplaceFallbackRoot, '.codex-plugin', 'plugin.json')]
+            : []),
+    ];
+    let manifest = null;
+    for (const manifestPath of manifestPaths) {
+        manifest = await fs.readJson(manifestPath).catch(() => null);
+        if (manifest)
+            break;
+    }
+    const raw = typeof manifest?.skills === 'string' && manifest.skills.trim() !== ''
+        ? manifest.skills
+        : plugin.manifest.skills ?? './codex/skills';
+    const normalized = path.posix.normalize(raw.replace(/^\.\//u, ''));
+    if (normalized === '..' || normalized.startsWith('../') || path.isAbsolute(normalized)) {
+        throw new Error(`Codex plugin skills root 越界：${raw}`);
+    }
+    return normalized;
+}
+async function buildBundledCodexSkillWrites(options) {
+    const relativeRoot = await resolveCodexSkillsRelativeRoot(options.plugin);
+    const sourceRoot = path.join(options.plugin.rootDir, ...relativeRoot.split('/'));
+    if (!await fs.pathExists(sourceRoot))
+        return [];
+    const dynamicKeys = new Set((options.plugin.manifest.artifacts?.targets ?? [])
+        .filter((target) => target.target === 'codex.skill' && target.skillKey)
+        .map((target) => target.skillKey));
+    const targetRoot = options.scope === 'project'
+        ? path.join(options.repoRoot, '.agents', 'skills')
+        : path.join(options.marketplaceRoot ?? resolveAwHome(options.env), 'plugins', options.plugin.manifest.name, ...relativeRoot.split('/'));
+    const writes = [];
+    for (const entry of await fs.readdir(sourceRoot, { withFileTypes: true })) {
+        if (entry.isSymbolicLink()) {
+            throw new Error(`Codex skills source 不能包含符号链接：${entry.name}`);
+        }
+        if (!entry.isDirectory() || dynamicKeys.has(entry.name))
+            continue;
+        const skillSource = path.join(sourceRoot, entry.name);
+        if (!await fs.pathExists(path.join(skillSource, 'SKILL.md')))
+            continue;
+        const tree = await createCodexSkillExpectedTree({
+            artifact: {
+                target: 'codex.skill',
+                skillKey: entry.name,
+                state: 'present',
+                content: { files: {} },
+            },
+            sourceDirs: [skillSource],
+        });
+        const skillPath = path.join(targetRoot, entry.name);
+        const canRecoverPristine = options.scope === 'user'
+            && path.resolve(skillSource) !== path.resolve(skillPath);
+        const identity = ownerIdentity(options.plugin.manifest.name, entry.name, 'codex', options.scope);
+        const component = pathComponent({
+            kind: 'skill-directory',
+            path: skillPath,
+            allowedRoot: targetRoot,
+            identity,
+            ...(canRecoverPristine
+                ? {
+                    unownedIsPristine: (actualPath) => skillDirectoryMatchesExpectedTree(actualPath, tree),
+                }
+                : {}),
+        });
+        writes.push({
+            artifact: {
+                path: skillPath,
+                paths: Object.keys(tree.files).map((relativePath) => path.join(skillPath, relativePath)),
+                kind: 'skill',
+                platform: 'codex',
+                artifactKey: entry.name,
+            },
+            component,
+            write: async () => {
+                await writeDynamicSkillTree(skillPath, tree, {
+                    allowedRoot: targetRoot,
+                    identity,
+                    allowPristineUnowned: canRecoverPristine,
+                });
+            },
+        });
+    }
+    return writes;
+}
+async function buildClaudeWrites(options) {
+    const paths = resolveClaudePaths(options.cwd, options.scope, options.env);
+    const writes = [];
+    const dynamic = await resolveDynamicArtifacts({
+        ...options,
+        platform: 'claude',
+        previousArtifacts: options.historicalArtifacts,
+    });
+    for (const artifact of dynamic.artifacts.filter((entry) => entry.target === 'claude.skill')) {
+        const skillKey = artifact.skillKey;
+        const tree = await createDynamicSkillExpectedTree({
+            artifact,
+            sourceDirs: dynamic.sourceDirs(artifact),
+            requireReadme: true,
+        });
+        writes.push(dynamicSkillWrite({
+            ...options,
+            platform: 'claude',
+            artifact,
+            skillPath: path.join(paths.configDir, 'skills', skillKey),
+            allowedRoot: path.join(paths.configDir, 'skills'),
+            tree,
+        }));
+    }
+    for (const artifact of generateInstructionArtifacts(options.plugin.manifest.name, resolvePlatformEntries(options.plugin.manifest.extensions?.instructions, 'claude'), 'claude')) {
+        writes.push(generatedTextWrite({
+            ...options,
+            platform: 'claude',
+            configDir: paths.configDir,
+            relativePath: artifact.relativePath,
+            artifactKey: artifact.artifactKey,
+            content: artifact.content,
+            kind: 'instruction',
+        }));
+    }
+    const permissions = resolvePlatformEntries(options.plugin.manifest.extensions?.permissions, 'claude');
+    if (permissions.length > 0) {
+        const component = createClaudePermissionsComponent({
+            identity: pluginOwnerIdentity(options.plugin, 'permissions', 'claude', options.scope),
+            scope: options.scope,
+            settingsPath: paths.settingsPath,
+        });
+        writes.push({
+            artifact: { path: paths.settingsPath, kind: 'permission', platform: 'claude' },
+            component,
+            write: async () => {
+                const settings = await readClaudeSettings(paths.settingsPath);
+                rebuildClaudePermissions(settings, createSharedOwnerToken(component.identity), mergeClaudePermissions(permissions));
+                await writeClaudeSettings(paths.settingsPath, settings);
+            },
+        });
+    }
+    return writes;
+}
+async function buildCodexWrites(options) {
+    const paths = resolveCodexPaths(options.cwd, options.scope, options.env);
+    const writes = [];
+    const dynamic = await resolveDynamicArtifacts({
+        ...options,
+        platform: 'codex',
+        previousArtifacts: options.historicalArtifacts,
+    });
+    const dynamicInstructions = dynamic.artifacts.filter((entry) => entry.target === 'codex.developerInstructionsBlock');
+    const dynamicRoles = dynamic.artifacts.filter((entry) => entry.target === 'codex.agentRole');
+    const dynamicSkills = dynamic.artifacts.filter((entry) => entry.target === 'codex.skill');
+    const repoRoot = await resolveRepoRoot(options.cwd);
+    writes.push(...await buildBundledCodexSkillWrites({
+        plugin: options.plugin,
+        scope: options.scope,
+        repoRoot,
+        env: options.env,
+        marketplaceRoot: options.marketplaceRoot,
+    }));
+    const relativeSkillsRoot = await resolveCodexSkillsRelativeRoot(options.plugin);
+    const skillRoot = options.scope === 'user'
+        ? path.join(options.marketplaceRoot ?? resolveAwHome(options.env), 'plugins', options.plugin.manifest.name, ...relativeSkillsRoot.split('/'))
+        : path.join(repoRoot, '.agents', 'skills');
+    for (const artifact of dynamicSkills) {
+        const tree = await createCodexSkillExpectedTree({
+            artifact,
+            sourceDirs: dynamic.sourceDirs(artifact),
+            requireReadme: true,
+        });
+        writes.push(dynamicSkillWrite({
+            ...options,
+            platform: 'codex',
+            artifact,
+            skillPath: path.join(skillRoot, artifact.skillKey),
+            allowedRoot: skillRoot,
+            tree,
+        }));
+    }
+    const staticInstructions = dynamicInstructions.length > 0
+        ? []
+        : resolvePlatformEntries(options.plugin.manifest.extensions?.instructions, 'codex');
+    const mcpServers = await resolveCodexMcpServers(options.plugin, options.scope);
+    const hasInstructionOutput = dynamicInstructions.length > 0 || staticInstructions.length > 0;
+    if (hasInstructionOutput) {
+        const component = createCodexInstructionComponent({
+            identity: pluginOwnerIdentity(options.plugin, 'developer-instructions', 'codex', options.scope),
+            scope: options.scope,
+            configPath: paths.configTomlPath,
+        });
+        const dynamicBlock = dynamicInstructions.length > 0
+            ? composeManagedDeveloperInstructionsBlock(options.plugin.manifest.name, dynamicInstructions
+                .filter((entry) => entry.state === 'present')
+                .map((entry) => ({ artifactId: entry.id, value: entry.content })))
+            : undefined;
+        const block = dynamicBlock?.value
+            ? { ...dynamicBlock, pluginName: createSharedOwnerToken(component.identity) }
+            : staticInstructions.length > 0
+                ? {
+                    pluginName: createSharedOwnerToken(component.identity),
+                    value: renderCodexManagedInstructionBlock(options.plugin.manifest.name, staticInstructions),
+                }
+                : undefined;
+        for (const artifact of dynamicInstructions.length > 0 ? dynamicInstructions : [{
+                id: undefined,
+                target: undefined,
+                state: 'present',
+                refreshKeys: [],
+                configDigest: undefined,
+                disabledReason: undefined,
+            }]) {
+            writes.push({
+                artifact: {
+                    path: paths.configTomlPath,
+                    kind: 'instruction',
+                    platform: 'codex',
+                    ...(artifact.id ? { id: artifact.id } : {}),
+                    ...(artifact.target ? { target: artifact.target } : {}),
+                    state: artifact.state,
+                    refreshKeys: [...artifact.refreshKeys],
+                    ...(artifact.configDigest ? { configDigest: artifact.configDigest } : {}),
+                    ...(artifact.disabledReason ? { disabledReason: artifact.disabledReason } : {}),
+                },
+                ...(block ? { component } : {}),
+                write: async () => {
+                    await applyCodexConfigTransactionFile(paths.configTomlPath, block
+                        ? { upsertManagedInstructionBlock: block }
+                        : { removeManagedInstructionPluginName: createSharedOwnerToken(component.identity) });
+                },
+            });
+        }
+    }
+    for (const [serverKey, server] of Object.entries(mcpServers)) {
+        const component = createCodexMcpComponent({
+            identity: pluginOwnerIdentity(options.plugin, internalArtifactKey('mcp', serverKey), 'codex', options.scope),
+            scope: options.scope,
+            configPath: paths.configTomlPath,
+            serverKey,
+            owned: false,
+        });
+        writes.push({
+            artifact: {
+                path: paths.configTomlPath,
+                kind: 'mcpServer',
+                platform: 'codex',
+                artifactKey: serverKey,
+            },
+            component,
+            write: async () => {
+                await applyConditionalCodexConfigTransactionFile(paths.configTomlPath, (snapshot) => {
+                    const actual = snapshot.mcpServers[serverKey];
+                    const actualOwner = codexMcpOwner(actual);
+                    if (actual && actualOwner !== createSharedOwnerToken(component.identity)) {
+                        throw new Error(`Codex MCP server "${serverKey}" is foreign and cannot be overwritten by plugin "${options.plugin.manifest.name}".`);
+                    }
+                    return { upsertMcpServers: { [serverKey]: server } };
+                });
+            },
+        });
+    }
+    for (const artifact of dynamicRoles) {
+        const roleKey = artifact.roleKey;
+        const rolePath = path.join(paths.configDir, 'agents', `${buildGeneratedName(options.plugin.manifest.name, roleKey)}.toml`);
+        const roleComponent = pathComponent({
+            kind: 'owned-text-file',
+            path: rolePath,
+            allowedRoot: paths.configDir,
+            identity: pluginOwnerIdentity(options.plugin, roleKey, 'codex', options.scope),
+        });
+        const registrationComponent = createCodexRoleRegistrationComponent({
+            identity: pluginOwnerIdentity(options.plugin, internalArtifactKey('role', roleKey), 'codex', options.scope),
+            fileIdentity: roleComponent.identity,
+            configPath: paths.configTomlPath,
+            roleKey,
+            rolePath,
+        });
+        const roleFile = artifact.content?.roleFile;
+        const description = artifact.content?.registration?.description
+            ?? roleFile?.description;
+        const present = artifact.state === 'present';
+        if (present && (!description || !roleFile?.developer_instructions)) {
+            throw new Error(`Artifact "${artifact.id}" 的 codex.agentRole 缺少 description 或 developer_instructions。`);
+        }
+        writes.push({
+            artifact: {
+                path: rolePath,
+                paths: [paths.configTomlPath, rolePath],
+                kind: 'agent',
+                platform: 'codex',
+                artifactKey: roleKey,
+                roleKey,
+                id: artifact.id,
+                target: artifact.target,
+                state: artifact.state,
+                refreshKeys: [...artifact.refreshKeys],
+                configDigest: artifact.configDigest,
+                ...(artifact.disabledReason ? { disabledReason: artifact.disabledReason } : {}),
+            },
+            ...(present ? { component: roleComponent } : {}),
+            ...(present ? { additionalComponents: [registrationComponent] } : {}),
+            write: async () => {
+                if (!present) {
+                    return;
+                }
+                await fs.ensureDir(paths.configDir);
+                await writeOwnedTextFile({
+                    path: rolePath,
+                    allowedRoot: paths.configDir,
+                    identity: roleComponent.identity,
+                    content: renderCodexRole({
+                        roleKey,
+                        description: description,
+                        developerInstructions: roleFile.developer_instructions,
+                        model: roleFile.model,
+                        modelReasoningEffort: roleFile.model_reasoning_effort,
+                    }),
+                });
+                const registration = {
+                    description,
+                    configFile: path.relative(path.dirname(paths.configTomlPath), rolePath).split(path.sep).join('/'),
+                };
+                await applyConditionalCodexConfigTransactionFile(paths.configTomlPath, async (snapshot) => {
+                    const actual = snapshot.agents[roleKey];
+                    if (actual && !await codexRoleRegistrationOwned({
+                        fileIdentity: roleComponent.identity,
+                        configPath: paths.configTomlPath,
+                        roleKey,
+                        rolePath,
+                        registration: actual,
+                    })) {
+                        throw new Error(`Codex agent registration "${roleKey}" is foreign and cannot be overwritten by plugin "${options.plugin.manifest.name}".`);
+                    }
+                    return { upsertAgentRegistrations: { [roleKey]: registration } };
+                });
+            },
+        });
+    }
+    for (const artifact of generateCodexPermissionArtifacts(options.plugin.manifest.name, resolvePlatformEntries(options.plugin.manifest.extensions?.permissions, 'codex'))) {
+        writes.push(generatedTextWrite({
+            ...options,
+            platform: 'codex',
+            configDir: paths.configDir,
+            relativePath: artifact.relativePath,
+            artifactKey: artifact.artifactKey,
+            content: artifact.content,
+            kind: 'permission',
+        }));
+    }
+    for (const artifact of generateAgentArtifacts(options.plugin.manifest.name, resolvePlatformEntries(options.plugin.manifest.extensions?.agents, 'codex'), 'codex')) {
+        writes.push(generatedTextWrite({
+            ...options,
+            platform: 'codex',
+            configDir: paths.configDir,
+            relativePath: artifact.relativePath,
+            artifactKey: artifact.artifactKey,
+            content: artifact.content,
+            kind: 'agent',
+        }));
+    }
+    if (options.scope === 'project') {
+        const hooks = resolvePlatformHookDefinitions(options.plugin.manifest, 'codex');
+        for (const rawIdentity of extractCodexHookGroups(hooks)) {
+            const identity = ownedCodexHookIdentity({
+                pluginName: options.plugin.manifest.name,
+                sourceId: options.plugin.sourceId,
+                sourceIdentity: options.plugin.sourceIdentity,
+                pluginId: options.plugin.pluginId,
+                scope: options.scope,
+                identity: rawIdentity,
+            });
+            const component = createCodexHookComponent({
+                pluginName: options.plugin.manifest.name,
+                scope: options.scope,
+                hooksPath: paths.hooksPath,
+                identity,
+            });
+            writes.push({
+                artifact: {
+                    path: paths.hooksPath,
+                    kind: 'hook',
+                    platform: 'codex',
+                    hookGroups: [identity],
+                },
+                component,
+                write: async () => {
+                    await applyCodexHookGroupsTransactionFile(paths.hooksPath, (parsed) => {
+                        const serialized = serializeTrackedHookGroupIdentity(identity);
+                        const exists = parsed.managedIdentities.some((entry) => serializeTrackedHookGroupIdentity(entry) === serialized);
+                        return exists
+                            ? null
+                            : [...parsed.rawGroups, renderCodexSharedHookGroup(identity)];
+                    });
+                },
+            });
+        }
+    }
+    return writes;
+}
+async function buildInspectionWrites(options) {
+    const writes = [];
+    if (options.platform === 'claude') {
+        const paths = resolveClaudePaths(options.cwd, options.scope, options.env);
+        for (const artifact of generateInstructionArtifacts(options.plugin.manifest.name, resolvePlatformEntries(options.plugin.manifest.extensions?.instructions, 'claude'), 'claude')) {
+            writes.push(generatedTextWrite({
+                ...options,
+                configDir: paths.configDir,
+                relativePath: artifact.relativePath,
+                artifactKey: artifact.artifactKey,
+                content: artifact.content,
+                kind: 'instruction',
+            }));
+        }
+        if (resolvePlatformEntries(options.plugin.manifest.extensions?.permissions, 'claude').length > 0) {
+            writes.push({
+                artifact: { path: paths.settingsPath, kind: 'permission', platform: 'claude' },
+                component: createClaudePermissionsComponent({
+                    identity: pluginOwnerIdentity(options.plugin, 'permissions', 'claude', options.scope),
+                    scope: options.scope,
+                    settingsPath: paths.settingsPath,
+                }),
+                write: async () => undefined,
+            });
+        }
+        for (const target of options.plugin.manifest.artifacts?.targets ?? []) {
+            if (target.platform !== 'claude'
+                || !target.scopes.includes(options.scope)
+                || target.target !== 'claude.skill'
+                || !target.skillKey)
+                continue;
+            const state = target.states.includes('present') ? 'present' : 'disabled';
+            const skillPath = path.join(paths.configDir, 'skills', target.skillKey);
+            const component = pathComponent({
+                kind: 'skill-directory',
+                path: skillPath,
+                allowedRoot: path.dirname(skillPath),
+                identity: ownerIdentity(options.plugin.manifest.name, target.skillKey, 'claude', options.scope),
+            });
+            writes.push({
+                artifact: {
+                    path: skillPath,
+                    kind: 'skill',
+                    platform: 'claude',
+                    artifactKey: target.skillKey,
+                    id: target.id,
+                    target: target.target,
+                    state,
+                },
+                ...(state === 'present' ? { component } : {}),
+                ...(target.states.includes('present') && target.states.includes('disabled')
+                    ? { optional: true }
+                    : {}),
+                write: async () => undefined,
+            });
+        }
+        return writes;
+    }
+    const paths = resolveCodexPaths(options.cwd, options.scope, options.env);
+    const repoRoot = await resolveRepoRoot(options.cwd);
+    writes.push(...await buildBundledCodexSkillWrites({
+        plugin: options.plugin,
+        scope: options.scope,
+        repoRoot,
+        env: options.env,
+        marketplaceRoot: options.marketplaceRoot,
+    }));
+    const instructions = resolvePlatformEntries(options.plugin.manifest.extensions?.instructions, 'codex');
+    const targets = (options.plugin.manifest.artifacts?.targets ?? []).filter((target) => target.platform === 'codex' && target.scopes.includes(options.scope));
+    const instructionTargets = targets.filter((target) => target.target === 'codex.developerInstructionsBlock');
+    const presentCapableInstructionTargets = instructionTargets.filter((target) => target.states.includes('present'));
+    const instructionDesired = presentCapableInstructionTargets.length > 0;
+    const instructionOptional = presentCapableInstructionTargets.length > 0
+        && presentCapableInstructionTargets.every((target) => target.states.includes('disabled'));
+    if (instructions.length > 0 || instructionDesired) {
+        writes.push({
+            artifact: { path: paths.configTomlPath, kind: 'instruction', platform: 'codex' },
+            component: createCodexInstructionComponent({
+                identity: pluginOwnerIdentity(options.plugin, 'developer-instructions', 'codex', options.scope),
+                scope: options.scope,
+                configPath: paths.configTomlPath,
+            }),
+            ...(instructions.length === 0 && instructionOptional ? { optional: true } : {}),
+            write: async () => undefined,
+        });
+    }
+    const mcpServers = await resolveCodexMcpServers(options.plugin, options.scope);
+    for (const serverKey of Object.keys(mcpServers)) {
+        writes.push({
+            artifact: {
+                path: paths.configTomlPath,
+                kind: 'mcpServer',
+                platform: 'codex',
+                artifactKey: serverKey,
+            },
+            component: createCodexMcpComponent({
+                identity: pluginOwnerIdentity(options.plugin, internalArtifactKey('mcp', serverKey), 'codex', options.scope),
+                scope: options.scope,
+                configPath: paths.configTomlPath,
+                serverKey,
+                owned: false,
+            }),
+            write: async () => undefined,
+        });
+    }
+    const relativeSkillsRoot = await resolveCodexSkillsRelativeRoot(options.plugin);
+    const dynamicSkillRoot = options.scope === 'user'
+        ? path.join(options.marketplaceRoot ?? resolveAwHome(options.env), 'plugins', options.plugin.manifest.name, ...relativeSkillsRoot.split('/'))
+        : path.join(repoRoot, '.agents', 'skills');
+    for (const target of targets) {
+        const state = target.states.includes('present') ? 'present' : 'disabled';
+        if (target.target === 'codex.skill' && target.skillKey) {
+            const skillPath = path.join(dynamicSkillRoot, target.skillKey);
+            const component = pathComponent({
+                kind: 'skill-directory',
+                path: skillPath,
+                allowedRoot: dynamicSkillRoot,
+                identity: ownerIdentity(options.plugin.manifest.name, target.skillKey, 'codex', options.scope),
+            });
+            writes.push({
+                artifact: {
+                    path: skillPath,
+                    kind: 'skill',
+                    platform: 'codex',
+                    artifactKey: target.skillKey,
+                    id: target.id,
+                    target: target.target,
+                    state,
+                },
+                ...(state === 'present' ? { component } : {}),
+                ...(target.states.includes('present') && target.states.includes('disabled')
+                    ? { optional: true }
+                    : {}),
+                write: async () => undefined,
+            });
+        }
+        if (target.target === 'codex.agentRole' && target.roleKey) {
+            const rolePath = path.join(paths.configDir, 'agents', `${buildGeneratedName(options.plugin.manifest.name, target.roleKey)}.toml`);
+            const roleComponent = pathComponent({
+                kind: 'owned-text-file',
+                path: rolePath,
+                allowedRoot: paths.configDir,
+                identity: pluginOwnerIdentity(options.plugin, target.roleKey, 'codex', options.scope),
+            });
+            const registrationComponent = createCodexRoleRegistrationComponent({
+                identity: pluginOwnerIdentity(options.plugin, internalArtifactKey('role', target.roleKey), 'codex', options.scope),
+                fileIdentity: pluginOwnerIdentity(options.plugin, target.roleKey, 'codex', options.scope),
+                configPath: paths.configTomlPath,
+                roleKey: target.roleKey,
+                rolePath,
+            });
+            writes.push({
+                artifact: {
+                    path: rolePath,
+                    kind: 'agent',
+                    platform: 'codex',
+                    artifactKey: target.roleKey,
+                    roleKey: target.roleKey,
+                    id: target.id,
+                    target: target.target,
+                    state,
+                },
+                ...(state === 'present'
+                    ? { component: roleComponent, additionalComponents: [registrationComponent] }
+                    : {}),
+                ...(target.states.includes('present') && target.states.includes('disabled')
+                    ? { optional: true }
+                    : {}),
+                write: async () => undefined,
+            });
+        }
+    }
+    for (const artifact of generateCodexPermissionArtifacts(options.plugin.manifest.name, resolvePlatformEntries(options.plugin.manifest.extensions?.permissions, 'codex'))) {
+        writes.push(generatedTextWrite({
+            ...options,
+            configDir: paths.configDir,
+            relativePath: artifact.relativePath,
+            artifactKey: artifact.artifactKey,
+            content: artifact.content,
+            kind: 'permission',
+        }));
+    }
+    for (const artifact of generateAgentArtifacts(options.plugin.manifest.name, resolvePlatformEntries(options.plugin.manifest.extensions?.agents, 'codex'), 'codex')) {
+        writes.push(generatedTextWrite({
+            ...options,
+            configDir: paths.configDir,
+            relativePath: artifact.relativePath,
+            artifactKey: artifact.artifactKey,
+            content: artifact.content,
+            kind: 'agent',
+        }));
+    }
+    if (options.scope === 'project') {
+        for (const rawIdentity of extractCodexHookGroups(resolvePlatformHookDefinitions(options.plugin.manifest, 'codex'))) {
+            const identity = ownedCodexHookIdentity({
+                pluginName: options.plugin.manifest.name,
+                sourceId: options.plugin.sourceId,
+                sourceIdentity: options.plugin.sourceIdentity,
+                pluginId: options.plugin.pluginId,
+                scope: options.scope,
+                identity: rawIdentity,
+            });
+            writes.push({
+                artifact: {
+                    path: paths.hooksPath,
+                    kind: 'hook',
+                    platform: 'codex',
+                    hookGroups: [identity],
+                },
+                component: createCodexHookComponent({
+                    pluginName: options.plugin.manifest.name,
+                    scope: options.scope,
+                    hooksPath: paths.hooksPath,
+                    identity,
+                }),
+                write: async () => undefined,
+            });
+        }
+    }
+    return writes;
+}
+async function buildHistoricalComponents(options) {
+    const components = [];
+    const paths = options.platform === 'codex'
+        ? resolveCodexPaths(options.cwd, options.scope, options.env)
+        : resolveClaudePaths(options.cwd, options.scope, options.env);
+    const historicalIdentity = (artifactKey) => ({
+        ...ownerIdentity(options.pluginName, artifactKey, options.platform, options.scope),
+        ...(options.sourceId ? {
+            sourceId: options.sourceId,
+            sourceIdentity: options.sourceIdentity,
+            pluginId: options.pluginId,
+        } : {}),
+    });
+    for (const artifact of options.artifacts) {
+        if (artifact.platform !== options.platform)
+            continue;
+        if (artifact.state === 'disabled')
+            continue;
+        if (artifact.kind === 'hook' && options.platform === 'codex') {
+            for (const identity of artifact.hookGroups ?? []) {
+                components.push(createCodexHookComponent({
+                    pluginName: options.pluginName,
+                    scope: options.scope,
+                    hooksPath: resolveCodexPaths(options.cwd, options.scope, options.env).hooksPath,
+                    identity,
+                }));
+            }
+            continue;
+        }
+        if (artifact.kind === 'mcpServer' && options.platform === 'codex' && artifact.artifactKey) {
+            components.push(createCodexMcpComponent({
+                identity: historicalIdentity(internalArtifactKey('mcp', artifact.artifactKey)),
+                scope: options.scope,
+                configPath: resolveCodexPaths(options.cwd, options.scope, options.env).configTomlPath,
+                serverKey: artifact.artifactKey,
+                owned: false,
+            }));
+            continue;
+        }
+        if (artifact.kind === 'instruction' && options.platform === 'codex' && !artifact.artifactKey) {
+            components.push(createCodexInstructionComponent({
+                identity: historicalIdentity('developer-instructions'),
+                scope: options.scope,
+                configPath: resolveCodexPaths(options.cwd, options.scope, options.env).configTomlPath,
+            }));
+            continue;
+        }
+        if (artifact.kind === 'permission' && options.platform === 'claude') {
+            components.push(createClaudePermissionsComponent({
+                identity: historicalIdentity('permissions'),
+                scope: options.scope,
+                settingsPath: resolveClaudePaths(options.cwd, options.scope, options.env).settingsPath,
+            }));
+            continue;
+        }
+        if (artifact.target === 'codex.agentRole'
+            && options.platform === 'codex'
+            && (artifact.roleKey || artifact.artifactKey)) {
+            const roleKey = artifact.roleKey ?? artifact.artifactKey;
+            components.push(createCodexRoleRegistrationComponent({
+                identity: historicalIdentity(internalArtifactKey('role', roleKey)),
+                fileIdentity: historicalIdentity(roleKey),
+                configPath: resolveCodexPaths(options.cwd, options.scope, options.env).configTomlPath,
+                roleKey,
+                rolePath: artifact.path,
+            }));
+        }
+        if (!artifact.artifactKey)
+            continue;
+        const identity = ownerIdentity(options.pluginName, artifact.artifactKey, options.platform, options.scope);
+        components.push(pathComponent({
+            kind: artifact.kind === 'skill' ? 'skill-directory' : 'owned-text-file',
+            path: artifact.path,
+            allowedRoot: artifact.kind === 'skill' ? path.dirname(artifact.path) : paths.configDir,
+            identity,
+        }));
+    }
+    return components;
+}
+function isAbsentCodexResiduePath(error) {
+    const code = error.code;
+    return code === 'ENOENT';
+}
+async function lstatCodexResidueIfPresent(filePath) {
+    return fs.lstat(filePath).catch((error) => {
+        if (isAbsentCodexResiduePath(error))
+            return null;
+        throw error;
+    });
+}
+async function readdirCodexResidueIfPresent(directory) {
+    const stats = await lstatCodexResidueIfPresent(directory);
+    if (!stats)
+        return [];
+    if (!stats.isDirectory() || stats.isSymbolicLink()) {
+        throw new Error(`Codex residue root is not a canonical directory: ${directory}`);
+    }
+    return fs.readdir(directory, { withFileTypes: true });
+}
+async function inspectCodexNativeResidue(options) {
+    const marketplaceName = options.marketplaceName ?? MARKETPLACE_NAME;
+    const marketplaceRoot = options.marketplaceRoot ?? resolveAwHome(options.env);
+    const pluginId = `${options.pluginName}@${marketplaceName}`;
+    const configPath = resolveCodexPaths(options.cwd, 'user', options.env).configTomlPath;
+    const config = await readCodexConfigFile(configPath);
+    const marketplace = config.snapshot.marketplaces[marketplaceName];
+    const canonicalMarketplace = marketplace?.sourceType === 'local'
+        && !marketplace.sourcePointsToManifest
+        && path.normalize(marketplace.source ?? '') === path.normalize(marketplaceRoot);
+    const cacheRoot = path.join(getCodexHome(options.env), 'plugins', 'cache', marketplaceName, options.pluginName);
+    const installedRoot = path.join(getCodexHome(options.env), 'plugins', pluginId);
+    const installedManifest = path.join(installedRoot, 'manifest.json');
+    const labels = [];
+    const foreignLabels = [];
+    const versions = new Set();
+    const configEntry = config.snapshot.plugins[pluginId];
+    if (configEntry) {
+        (canonicalMarketplace ? labels : foreignLabels).push(`${configPath}#plugins.${pluginId}`);
+    }
+    const inspectManifest = async (manifestPath, directoryVersion) => {
+        const stats = await lstatCodexResidueIfPresent(manifestPath);
+        if (!stats)
+            return;
+        if (!stats.isFile() || stats.isSymbolicLink()) {
+            foreignLabels.push(manifestPath);
+            return;
+        }
+        const manifest = await fs.readJson(manifestPath);
+        const identity = manifest?.id ?? manifest?.name;
+        const version = typeof manifest?.version === 'string' ? manifest.version : null;
+        if (!canonicalMarketplace
+            || (identity !== options.pluginName && identity !== pluginId)
+            || !version
+            || (directoryVersion !== undefined && version !== directoryVersion)) {
+            foreignLabels.push(manifestPath);
+            return;
+        }
+        labels.push(manifestPath);
+        versions.add(version);
+    };
+    for (const entry of await readdirCodexResidueIfPresent(cacheRoot)) {
+        if (!entry.isDirectory() || entry.isSymbolicLink()) {
+            foreignLabels.push(path.join(cacheRoot, entry.name));
+            continue;
+        }
+        const versionRoot = path.join(cacheRoot, entry.name);
+        const candidates = [
+            path.join(versionRoot, 'plugin.json'),
+            path.join(versionRoot, '.codex-plugin', 'plugin.json'),
+        ];
+        const existing = [];
+        for (const candidate of candidates) {
+            if (await lstatCodexResidueIfPresent(candidate))
+                existing.push(candidate);
+        }
+        if (existing.length === 0)
+            foreignLabels.push(versionRoot);
+        for (const candidate of existing)
+            await inspectManifest(candidate, entry.name);
+    }
+    const installedStats = await lstatCodexResidueIfPresent(installedRoot);
+    if (installedStats && (!installedStats.isDirectory() || installedStats.isSymbolicLink())) {
+        foreignLabels.push(installedRoot);
+    }
+    else if (installedStats) {
+        await inspectManifest(installedManifest);
+    }
+    return foreignLabels.length > 0
+        ? {
+            state: 'foreign', labels: [...labels, ...foreignLabels], versions: [...versions],
+            enabled: configEntry?.enabled === true,
+        }
+        : labels.length > 0
+            ? { state: 'present', labels, versions: [...versions], enabled: configEntry?.enabled === true }
+            : { state: 'absent', labels: [], versions: [], enabled: false };
+}
+export async function discoverCodexNativeResidueNames(options) {
+    const marketplaceName = options.marketplaceName ?? MARKETPLACE_NAME;
+    const marketplaceRoot = options.marketplaceRoot ?? resolveAwHome(options.env);
+    const names = new Set();
+    const config = await readCodexConfigFile(resolveCodexPaths(options.cwd, 'user', options.env).configTomlPath);
+    const marketplace = config.snapshot.marketplaces[marketplaceName];
+    const canonicalMarketplace = marketplace?.sourceType === 'local'
+        && !marketplace.sourcePointsToManifest
+        && path.normalize(marketplace.source ?? '') === path.normalize(marketplaceRoot);
+    const probeFailure = (location, cause, pluginName) => {
+        if (cause instanceof CodexNativeResidueProbeError)
+            throw cause;
+        throw new CodexNativeResidueProbeError(location, cause, pluginName);
+    };
+    for (const pluginId of canonicalMarketplace ? Object.keys(config.snapshot.plugins) : []) {
+        const suffix = `@${marketplaceName}`;
+        const match = pluginId.endsWith(suffix)
+            ? /^([a-z0-9]+(?:-[a-z0-9]+)*)$/u.exec(pluginId.slice(0, -suffix.length))
+            : null;
+        if (match)
+            names.add(match[1]);
+    }
+    const cacheRoot = path.join(getCodexHome(options.env), 'plugins', 'cache', marketplaceName);
+    const cacheEntries = await readdirCodexResidueIfPresent(cacheRoot).catch((error) => probeFailure(cacheRoot, error));
+    for (const entry of cacheEntries) {
+        const entryPath = path.join(cacheRoot, entry.name);
+        const pluginName = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(entry.name)
+            ? entry.name
+            : probeFailure(entryPath, new Error('Codex cache residue has an invalid plugin identity.'));
+        if (!entry.isDirectory() || entry.isSymbolicLink()) {
+            probeFailure(entryPath, new Error('Codex cache residue is not a canonical plugin directory.'), pluginName);
+        }
+        let versionEntries;
+        try {
+            versionEntries = await fs.readdir(entryPath, { withFileTypes: true });
+        }
+        catch (error) {
+            throw new CodexNativeResidueProbeError(entryPath, error, pluginName);
+        }
+        if (versionEntries.length === 0) {
+            if (names.has(pluginName)) {
+                probeFailure(entryPath, new Error('Codex cache residue manifest is missing.'), pluginName);
+            }
+            continue;
+        }
+        let residue;
+        try {
+            residue = await inspectCodexNativeResidue({ ...options, pluginName: entry.name });
+        }
+        catch (error) {
+            throw new CodexNativeResidueProbeError(entryPath, error, pluginName);
+        }
+        if (residue.state !== 'present') {
+            probeFailure(entryPath, new Error('Codex cache residue has foreign or incomplete manifest evidence.'), pluginName);
+        }
+        names.add(pluginName);
+    }
+    const pluginsRoot = path.join(getCodexHome(options.env), 'plugins');
+    const pluginEntries = await readdirCodexResidueIfPresent(pluginsRoot).catch((error) => probeFailure(pluginsRoot, error));
+    for (const entry of pluginEntries) {
+        const suffix = `@${marketplaceName}`;
+        const match = entry.name.endsWith(suffix)
+            ? /^([a-z0-9]+(?:-[a-z0-9]+)*)$/u.exec(entry.name.slice(0, -suffix.length))
+            : null;
+        if (!match)
+            continue;
+        const installedRoot = path.join(pluginsRoot, entry.name);
+        if (!entry.isDirectory() || entry.isSymbolicLink()) {
+            probeFailure(installedRoot, new Error('Codex installed residue is not a canonical plugin directory.'), match[1]);
+        }
+        const installedStats = await lstatCodexResidueIfPresent(installedRoot);
+        if (!installedStats || !installedStats.isDirectory() || installedStats.isSymbolicLink()) {
+            probeFailure(installedRoot, new Error('Codex installed residue is not a canonical plugin directory.'), match[1]);
+        }
+        const manifestPath = path.join(pluginsRoot, entry.name, 'manifest.json');
+        const stats = await lstatCodexResidueIfPresent(manifestPath);
+        if (!stats?.isFile() || stats.isSymbolicLink()) {
+            probeFailure(manifestPath, new Error('Codex installed residue manifest is missing or nonregular.'), match[1]);
+        }
+        let rawManifest;
+        try {
+            rawManifest = await fs.readJson(manifestPath);
+        }
+        catch (error) {
+            throw new CodexNativeResidueProbeError(manifestPath, error, match[1]);
+        }
+        if (!rawManifest || typeof rawManifest !== 'object' || Array.isArray(rawManifest)) {
+            probeFailure(manifestPath, new Error('Codex installed residue manifest must be an object.'), match[1]);
+        }
+        const manifest = rawManifest;
+        const identity = manifest.id ?? manifest.name;
+        if (!canonicalMarketplace
+            || (identity !== match[1] && identity !== entry.name)
+            || typeof manifest.version !== 'string'
+            || manifest.version.trim() === '') {
+            probeFailure(manifestPath, new Error('Codex installed residue manifest has foreign identity or version.'), match[1]);
+        }
+        names.add(match[1]);
+    }
+    return [...names];
+}
+export class CodexNativeResidueProbeError extends Error {
+    code = 'codexNativeResidueProbeFailed';
+    location;
+    pluginName;
+    constructor(location, cause, pluginName) {
+        super(`codexNativeResidueProbeFailed: cannot classify Codex native residue at ${location}.`, {
+            cause,
+        });
+        this.name = 'CodexNativeResidueProbeError';
+        this.location = location;
+        this.pluginName = pluginName;
+    }
+}
+async function ensureCodexActiveSkillsManifest(options) {
+    const relativeSkillsRoot = await resolveCodexSkillsRelativeRoot(options.plugin);
+    const skillsRoot = path.join(options.marketplaceRoot, 'plugins', options.plugin.manifest.name, ...relativeSkillsRoot.split('/'));
+    if (options.hasRequiredSkills && !await fs.pathExists(skillsRoot)) {
+        throw new Error(`Codex required Skills root 不存在：${skillsRoot}`);
+    }
+    const manifestPath = path.join(options.marketplaceRoot, 'plugins', options.plugin.manifest.name, '.codex-plugin', 'plugin.json');
+    const manifest = await fs.readJson(manifestPath).catch((error) => {
+        if (error.code === 'ENOENT')
+            return {};
+        throw error;
+    });
+    const updated = {
+        ...manifest,
+        name: options.plugin.manifest.name,
+        version: options.plugin.manifest.version,
+    };
+    if (options.hasRequiredSkills)
+        updated.skills = `./${relativeSkillsRoot}`;
+    else
+        delete updated.skills;
+    await fs.outputJson(manifestPath, updated, { spaces: 2 });
+    return options.hasRequiredSkills ? relativeSkillsRoot : null;
+}
+function createCodexMarketplaceComponent(options) {
+    const configPath = resolveCodexPaths(options.cwd, 'user', options.env).configTomlPath;
+    const inspectCanonicalMarketplace = async () => {
+        const config = await readCodexConfigFile(configPath);
+        const marketplace = config.snapshot.marketplaces[options.marketplaceName];
+        if (!marketplace)
+            return 'absent';
+        if (marketplace.sourceType !== 'local'
+            || marketplace.sourcePointsToManifest
+            || path.normalize(marketplace.source ?? '') !== path.normalize(options.marketplaceRoot))
+            return 'foreign';
+        return 'present';
+    };
+    const hasRemainingPlugins = async () => {
+        return (await discoverCodexNativeResidueNames({
+            cwd: options.cwd,
+            env: options.env,
+            marketplaceName: options.marketplaceName,
+            marketplaceRoot: options.marketplaceRoot,
+        })).some((name) => name !== options.pluginName);
+    };
+    const inspect = async () => {
+        const canonical = await inspectCanonicalMarketplace();
+        const plugin = await inspectCodexNativeResidue({
+            pluginName: options.pluginName,
+            cwd: options.cwd,
+            env: options.env,
+            marketplaceName: options.marketplaceName,
+            marketplaceRoot: options.marketplaceRoot,
+        });
+        if (plugin.state === 'foreign')
+            return 'foreign';
+        if (options.desired) {
+            return canonical === 'present' && plugin.state === 'present' && plugin.enabled
+                ? 'present'
+                : 'absent';
+        }
+        if (canonical !== 'present')
+            return canonical;
+        return await hasRemainingPlugins() ? 'absent' : 'present';
+    };
+    return {
+        kind: 'shared-config',
+        identity: ownerIdentity(options.pluginName, `marketplace-${options.marketplaceName}`, 'codex', 'user'),
+        label: `${configPath}#marketplaces.${options.marketplaceName}`,
+        inspect,
+        remove: async () => {
+            const currentResidue = await inspectCodexNativeResidue({
+                pluginName: options.pluginName,
+                cwd: options.cwd,
+                env: options.env,
+                marketplaceName: options.marketplaceName,
+                marketplaceRoot: options.marketplaceRoot,
+            });
+            if (currentResidue.state === 'foreign') {
+                throw new Error(`Codex native owner 为 foreign，拒绝移除 marketplace：${currentResidue.labels.join('，')}`);
+            }
+            if (await inspectCanonicalMarketplace() !== 'present'
+                || currentResidue.state === 'present'
+                || await hasRemainingPlugins())
+                return;
+            await runNativeCliChecked(buildCodexMarketplaceRemoveInvocation(options.marketplaceName, options.cwd, options.env), options.runner);
+            await runNativeCliChecked(buildCodexMarketplaceListInvocation(options.cwd, options.env), options.runner);
+        },
+    };
+}
+async function assertCodexNativeInstallState(options) {
+    const marketplaceName = options.marketplaceName ?? MARKETPLACE_NAME;
+    const pluginId = `${options.pluginName}@${marketplaceName}`;
+    const configPath = resolveCodexPaths(options.cwd, 'user', options.env).configTomlPath;
+    const config = await readCodexConfigFile(configPath);
+    const marketplace = config.snapshot.marketplaces[marketplaceName];
+    if (marketplace?.sourceType !== 'local'
+        || marketplace.sourcePointsToManifest
+        || path.normalize(marketplace.source ?? '') !== path.normalize(options.marketplaceRoot)) {
+        throw new Error(`Codex marketplace aw 未指向当前 AW_HOME：${options.marketplaceRoot}`);
+    }
+    if (config.snapshot.plugins[pluginId]?.enabled !== true) {
+        throw new Error(`Codex enabled config 缺少 ${pluginId}。`);
+    }
+    const cacheRoot = path.join(getCodexHome(options.env), 'plugins', 'cache', marketplaceName, options.pluginName, options.pluginVersion);
+    const candidates = [
+        path.join(cacheRoot, 'plugin.json'),
+        path.join(cacheRoot, '.codex-plugin', 'plugin.json'),
+    ];
+    const expectedRoot = path.join(options.marketplaceRoot, 'plugins', options.pluginName);
+    const assertExpectedPayload = async () => {
+        const collectFiles = async (root) => {
+            const output = [];
+            const pending = [''];
+            while (pending.length > 0) {
+                const relativeRoot = pending.pop();
+                for (const entry of await fs.readdir(path.join(root, relativeRoot), { withFileTypes: true })) {
+                    const relativePath = path.join(relativeRoot, entry.name);
+                    if (entry.isSymbolicLink()) {
+                        throw new Error(`Codex native payload 不能包含符号链接：${path.join(root, relativePath)}`);
+                    }
+                    if (entry.isDirectory())
+                        pending.push(relativePath);
+                    else if (entry.isFile())
+                        output.push(relativePath);
+                    else
+                        throw new Error(`Codex native payload 包含不支持的节点：${path.join(root, relativePath)}`);
+                }
+            }
+            return output;
+        };
+        const manifestPaths = new Set(['plugin.json', path.join('.codex-plugin', 'plugin.json')]);
+        const allowedMetadata = new Set(['metadata.json', '.metadata.json']);
+        const [expectedFiles, actualFiles] = await Promise.all([
+            collectFiles(expectedRoot),
+            collectFiles(cacheRoot),
+        ]);
+        const expectedSet = new Set(expectedFiles);
+        for (const relativePath of expectedFiles) {
+            if (manifestPaths.has(relativePath))
+                continue;
+            const expectedPath = path.join(expectedRoot, relativePath);
+            const actualPath = path.join(cacheRoot, relativePath);
+            const actualStats = await fs.lstat(actualPath).catch(() => null);
+            if (!actualStats?.isFile() || actualStats.isSymbolicLink()) {
+                throw new Error(`Codex native cache 缺少 expected payload：${actualPath}`);
+            }
+            const [expectedContent, actualContent] = await Promise.all([
+                fs.readFile(expectedPath),
+                fs.readFile(actualPath),
+            ]);
+            if (!expectedContent.equals(actualContent)) {
+                throw new Error(`Codex native cache expected payload digest 不匹配：${actualPath}`);
+            }
+        }
+        for (const relativePath of actualFiles) {
+            if (expectedSet.has(relativePath)
+                || manifestPaths.has(relativePath)
+                || allowedMetadata.has(relativePath))
+                continue;
+            throw new Error(`Codex native cache 包含 unexpected loadable payload：${path.join(cacheRoot, relativePath)}`);
+        }
+    };
+    let matchedManifest = false;
+    for (const candidate of candidates) {
+        if (!await fs.pathExists(candidate))
+            continue;
+        const manifest = await fs.readJson(candidate).catch(() => null);
+        if (!manifest) {
+            throw new Error(`Codex native cache manifest 无法解析：${candidate}`);
+        }
+        const identity = manifest.id ?? manifest.name;
+        const matches = ((identity === options.pluginName || identity === pluginId)
+            && manifest.version === options.pluginVersion
+            && (options.skillsRelativeRoot === null
+                ? typeof manifest.skills !== 'string'
+                : typeof manifest.skills === 'string'
+                    && path.posix.normalize(manifest.skills.replace(/^\.\//u, '')) === options.skillsRelativeRoot));
+        if (!matches) {
+            throw new Error(`Codex native cache manifest 不匹配：${candidate}`);
+        }
+        matchedManifest = true;
+    }
+    if (!matchedManifest) {
+        throw new Error(`Codex native cache 缺少匹配 ${pluginId}@${options.pluginVersion} 的 manifest：${cacheRoot}`);
+    }
+    for (const skillKey of options.requiredSkillKeys) {
+        const skillPath = path.join(cacheRoot, ...options.skillsRelativeRoot.split('/'), skillKey, 'SKILL.md');
+        if (!await fs.pathExists(skillPath)) {
+            throw new Error(`Codex native cache 缺少 required Skill：${skillPath}`);
+        }
+    }
+    await assertExpectedPayload();
+}
+async function readJsonObjectIfExists(filePath, label) {
+    let value;
+    try {
+        value = await fs.readJson(filePath);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return {};
+        throw new Error(`${label} 无法读取：${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${label} 必须是 JSON object。`);
+    }
+    return value;
+}
+function nonEmptyString(value) {
+    return typeof value === 'string' && value.trim() !== '' ? value : undefined;
+}
+function readClaudeMarketplaceSourcePath(value, label) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value === 'string') {
+        const source = nonEmptyString(value);
+        if (!source)
+            throw new Error(`${label} 必须是非空 string。`);
+        return source;
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${label} 必须是 string 或 object。`);
+    }
+    const record = value;
+    if (record.source && typeof record.source === 'object' && !Array.isArray(record.source)) {
+        return readClaudeMarketplaceSourcePath(record.source, `${label}.source`);
+    }
+    const source = nonEmptyString(record.source);
+    if (!source)
+        throw new Error(`${label}.source 必须是非空 string 或 object。`);
+    if (record.path === undefined)
+        return source;
+    const sourcePath = nonEmptyString(record.path);
+    if (!sourcePath)
+        throw new Error(`${label}.path 必须是非空 string。`);
+    return source === 'directory' ? sourcePath : null;
+}
+function classifyClaudeMarketplaceSources(sources, awHome) {
+    if (sources.some((source) => source === null || (source !== undefined && path.normalize(source) !== awHome))) {
+        return 'foreign';
+    }
+    return sources.some((source) => source !== undefined) ? 'canonical' : 'absent';
+}
+function readClaudeKnownMarketplaceSources(value, label) {
+    if (value === undefined)
+        return [];
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${label} 记录无效。`);
+    }
+    const record = value;
+    const sources = [];
+    if (record.installLocation !== undefined) {
+        const installLocation = nonEmptyString(record.installLocation);
+        if (!installLocation)
+            throw new Error(`${label}.installLocation 必须是非空 string。`);
+        sources.push(installLocation);
+    }
+    sources.push(readClaudeMarketplaceSourcePath(record.source, `${label}.source`));
+    return sources;
+}
+async function readClaudeNativeState(options) {
+    const paths = resolveClaudePaths(options.cwd, options.scope, options.env);
+    const marketplaceName = options.marketplaceName ?? MARKETPLACE_NAME;
+    const awHome = path.normalize(options.marketplaceRoot ?? resolveAwHome(options.env));
+    const settings = await readJsonObjectIfExists(paths.settingsPath, 'Claude settings');
+    const known = await readJsonObjectIfExists(paths.knownMarketplacesPath, 'Claude known_marketplaces');
+    const installed = await readJsonObjectIfExists(paths.installedPluginsPath, 'Claude installed_plugins');
+    if (settings.extraKnownMarketplaces !== undefined && (!settings.extraKnownMarketplaces
+        || typeof settings.extraKnownMarketplaces !== 'object'
+        || Array.isArray(settings.extraKnownMarketplaces)))
+        throw new Error('Claude settings.extraKnownMarketplaces 必须是 object。');
+    if (settings.plugins !== undefined && (!settings.plugins || typeof settings.plugins !== 'object' || Array.isArray(settings.plugins)))
+        throw new Error('Claude settings.plugins 必须是 object。');
+    if (settings.enabledPlugins !== undefined && (!settings.enabledPlugins
+        || typeof settings.enabledPlugins !== 'object'
+        || Array.isArray(settings.enabledPlugins)))
+        throw new Error('Claude settings.enabledPlugins 必须是 object。');
+    const settingsPlugins = settings.plugins;
+    if (settingsPlugins?.installed !== undefined && (!settingsPlugins.installed
+        || typeof settingsPlugins.installed !== 'object'
+        || Array.isArray(settingsPlugins.installed)))
+        throw new Error('Claude settings.plugins.installed 必须是 object。');
+    if (known.marketplaces !== undefined && (!known.marketplaces || typeof known.marketplaces !== 'object' || Array.isArray(known.marketplaces)))
+        throw new Error('Claude known_marketplaces.marketplaces 必须是 object。');
+    if (installed.plugins !== undefined && (!installed.plugins || typeof installed.plugins !== 'object' || Array.isArray(installed.plugins)))
+        throw new Error('Claude installed_plugins.plugins 必须是 object。');
+    const extraKnown = settings.extraKnownMarketplaces;
+    const settingsSourceValue = extraKnown?.[marketplaceName];
+    const settingsSource = readClaudeMarketplaceSourcePath(settingsSourceValue, 'Claude settings marketplace aw');
+    const legacyKnown = known.marketplaces;
+    const marketplaceDeclaredState = classifyClaudeMarketplaceSources([settingsSource], awHome);
+    const marketplaceMaterializedState = classifyClaudeMarketplaceSources(readClaudeKnownMarketplaceSources(known[marketplaceName], 'Claude known marketplace aw'), awHome);
+    const legacyMarketplaceState = classifyClaudeMarketplaceSources(readClaudeKnownMarketplaceSources(legacyKnown?.[marketplaceName], 'Claude known marketplace aw legacy'), awHome);
+    const marketplaceStates = [
+        marketplaceDeclaredState,
+        marketplaceMaterializedState,
+        legacyMarketplaceState,
+    ];
+    const marketplaceState = marketplaceStates.includes('foreign')
+        ? 'foreign'
+        : marketplaceStates.includes('canonical')
+            ? 'canonical'
+            : 'absent';
+    const pluginId = `${options.pluginName}@${marketplaceName}`;
+    const enabledPlugins = settings.enabledPlugins;
+    const rawEnabled = enabledPlugins?.[pluginId];
+    if (rawEnabled !== undefined
+        && typeof rawEnabled !== 'boolean'
+        && (!Array.isArray(rawEnabled) || !rawEnabled.every((entry) => typeof entry === 'string'))) {
+        throw new Error(`Claude settings.enabledPlugins 记录 ${pluginId} 必须是 boolean 或 string array。`);
+    }
+    const pluginEnabled = rawEnabled === true || Array.isArray(rawEnabled);
+    const enabledPluginEvidence = rawEnabled !== undefined;
+    const records = [];
+    const unboundPluginNames = new Set();
+    for (const [pluginKey, raw] of Object.entries(installed.plugins ?? {})) {
+        for (const entry of Array.isArray(raw) ? raw : [raw]) {
+            if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+                throw new Error(`Claude installed_plugins 记录 ${pluginKey} 必须是 object。`);
+            }
+            const record = entry;
+            const version = nonEmptyString(record.version);
+            if (!version)
+                throw new Error(`Claude installed_plugins 记录 ${pluginKey} 缺少 version。`);
+            if (record.scope !== undefined
+                && record.scope !== 'user'
+                && record.scope !== 'project'
+                && record.scope !== 'local') {
+                throw new Error(`Claude installed_plugins 记录 ${pluginKey} 的 scope 无效。`);
+            }
+            if (record.projectPath !== undefined && typeof record.projectPath !== 'string') {
+                throw new Error(`Claude installed_plugins 记录 ${pluginKey} 的 projectPath 无效。`);
+            }
+            const marketplaceSeparator = pluginKey.lastIndexOf('@');
+            const keyedMarketplace = marketplaceSeparator > 0 && marketplaceSeparator < pluginKey.length - 1
+                ? pluginKey.slice(marketplaceSeparator + 1)
+                : undefined;
+            if (!pluginKey.includes('@') && record.marketplace === undefined) {
+                unboundPluginNames.add(pluginKey);
+            }
+            records.push({
+                name: typeof record.name === 'string'
+                    ? record.name
+                    : keyedMarketplace ? pluginKey.slice(0, marketplaceSeparator) : pluginKey,
+                marketplace: typeof record.marketplace === 'string'
+                    ? record.marketplace
+                    : keyedMarketplace,
+                scope: record.scope === 'project' || record.scope === 'local' ? record.scope : 'user',
+                ...(typeof record.projectPath === 'string' ? { projectPath: record.projectPath } : {}),
+                version,
+            });
+        }
+    }
+    const projectPath = options.scope === 'project' ? path.normalize(await resolveRepoRoot(options.cwd)) : undefined;
+    const matchingRecords = records.filter((record) => record.name === options.pluginName
+        && record.marketplace === marketplaceName
+        && record.scope === options.scope
+        && (options.scope === 'user' || path.normalize(record.projectPath ?? '') === projectPath));
+    const settingsInstalled = settingsPlugins?.installed;
+    const rawSettingsRecord = settingsInstalled?.[options.pluginName];
+    if (rawSettingsRecord !== undefined && (!rawSettingsRecord || typeof rawSettingsRecord !== 'object' || Array.isArray(rawSettingsRecord)))
+        throw new Error(`Claude settings plugin 记录 ${options.pluginName} 必须是 object。`);
+    const settingsRecord = rawSettingsRecord;
+    if (settingsRecord && !nonEmptyString(settingsRecord.version)) {
+        throw new Error(`Claude settings plugin 记录 ${options.pluginName} 缺少 version。`);
+    }
+    if (settingsRecord && !nonEmptyString(settingsRecord.marketplace)) {
+        throw new Error(`Claude settings plugin 记录 ${options.pluginName} 缺少 marketplace。`);
+    }
+    if (settingsRecord?.scope !== undefined
+        && settingsRecord.scope !== 'user'
+        && settingsRecord.scope !== 'project'
+        && settingsRecord.scope !== 'local') {
+        throw new Error(`Claude settings plugin 记录 ${options.pluginName} 的 scope 无效。`);
+    }
+    if (settingsRecord?.projectPath !== undefined && typeof settingsRecord.projectPath !== 'string') {
+        throw new Error(`Claude settings plugin 记录 ${options.pluginName} 的 projectPath 无效。`);
+    }
+    const settingsMatchesScope = settingsRecord
+        && settingsRecord.marketplace === marketplaceName
+        && (settingsRecord.scope ?? 'user') === options.scope
+        && (options.scope === 'user'
+            || path.normalize(settingsRecord.projectPath ?? '') === projectPath);
+    const canonicalEvidence = matchingRecords.length > 0
+        || Boolean(settingsMatchesScope)
+        || enabledPluginEvidence;
+    const foreign = canonicalEvidence && marketplaceState === 'foreign';
+    const canonicalRecords = matchingRecords;
+    const canonicalSettingsRecord = settingsMatchesScope;
+    const marketplaceConsumerSuffix = `@${marketplaceName}`;
+    const hasMarketplaceConsumerKey = (pluginKey) => pluginKey.length > marketplaceConsumerSuffix.length
+        && pluginKey.endsWith(marketplaceConsumerSuffix);
+    const marketplaceConsumerEvidence = records.some((record) => record.marketplace === marketplaceName)
+        || Object.keys(enabledPlugins ?? {}).some(hasMarketplaceConsumerKey)
+        || Object.entries(settingsInstalled ?? {}).some(([pluginKey, raw]) => hasMarketplaceConsumerKey(pluginKey)
+            || (raw !== null
+                && typeof raw === 'object'
+                && !Array.isArray(raw)
+                && raw.marketplace === marketplaceName));
+    const marketplaceConsumers = records
+        .filter((record) => record.marketplace === marketplaceName)
+        .map((record) => ({
+        name: record.name,
+        scope: record.scope,
+        ...(record.projectPath ? { projectPath: record.projectPath } : {}),
+    }));
+    for (const pluginKey of Object.keys(enabledPlugins ?? {})) {
+        const suffix = `@${marketplaceName}`;
+        if (!pluginKey.endsWith(suffix))
+            continue;
+        marketplaceConsumers.push({
+            name: pluginKey.slice(0, -suffix.length),
+            scope: options.scope,
+            ...(projectPath ? { projectPath } : {}),
+        });
+    }
+    for (const [pluginKey, rawRecord] of Object.entries(settingsInstalled ?? {})) {
+        if (!rawRecord || typeof rawRecord !== 'object' || Array.isArray(rawRecord))
+            continue;
+        const record = rawRecord;
+        if (record.marketplace !== marketplaceName)
+            continue;
+        const name = nonEmptyString(record.name)
+            ?? (pluginKey.endsWith(`@${marketplaceName}`)
+                ? pluginKey.slice(0, -`@${marketplaceName}`.length)
+                : pluginKey);
+        const scope = record.scope === 'project' || record.scope === 'local' ? record.scope : 'user';
+        marketplaceConsumers.push({
+            name,
+            scope,
+            ...(typeof record.projectPath === 'string' ? { projectPath: record.projectPath } : {}),
+        });
+    }
+    const pluginState = foreign
+        ? 'foreign'
+        : canonicalEvidence
+            ? 'present'
+            : 'absent';
+    const pluginVersions = [
+        ...canonicalRecords.map((record) => record.version),
+        ...(canonicalSettingsRecord ? [nonEmptyString(settingsRecord.version)] : []),
+    ];
+    return {
+        paths,
+        marketplaceState,
+        marketplaceDeclaredState,
+        marketplaceMaterializedState,
+        legacyMarketplaceState,
+        pluginState,
+        pluginEnabled,
+        records,
+        marketplaceConsumers,
+        marketplaceConsumerEvidence,
+        unboundPluginNames: [...unboundPluginNames],
+        pluginVersions,
+    };
+}
+export async function assertNoClaudeUnboundNativeNameCollision(options) {
+    const state = await readClaudeNativeState({
+        pluginName: options.pluginName,
+        scope: 'user',
+        cwd: options.cwd,
+        env: options.env,
+    });
+    if (state.unboundPluginNames.includes(options.pluginName)) {
+        throw new Error(`externalOwnershipPresent: Claude has an unbound installed plugin named ${options.pluginName}; native install would overwrite it.`);
+    }
+}
+export async function inspectNativeMarketplaceRegistrations(options) {
+    const codexConfig = await readCodexConfigFile(resolveCodexPaths(options.cwd, 'user', options.env).configTomlPath);
+    const codexMarketplace = codexConfig.snapshot.marketplaces[options.marketplaceName];
+    const codexRegistration = codexMarketplace === undefined
+        ? 'absent'
+        : codexMarketplace.sourceType === 'local'
+            && !codexMarketplace.sourcePointsToManifest
+            && path.normalize(codexMarketplace.source ?? '') === path.normalize(options.marketplaceRoot)
+            ? 'canonical'
+            : 'foreign';
+    const codexConsumerSuffix = `@${options.marketplaceName}`;
+    const codex = codexRegistration === 'absent'
+        && Object.keys(codexConfig.snapshot.plugins).some((pluginId) => pluginId.length > codexConsumerSuffix.length && pluginId.endsWith(codexConsumerSuffix))
+        ? 'foreign'
+        : codexRegistration;
+    const claudeState = await readClaudeNativeState({
+        pluginName: '__marketplace_preflight__',
+        scope: 'user',
+        cwd: options.cwd,
+        env: options.env,
+        marketplaceName: options.marketplaceName,
+        marketplaceRoot: options.marketplaceRoot,
+    });
+    const claude = claudeState.marketplaceState === 'absent'
+        && claudeState.marketplaceConsumerEvidence
+        ? 'foreign'
+        : claudeState.marketplaceState;
+    return { codex, claude };
+}
+function createClaudeMarketplaceComponent(options) {
+    const inspect = async () => {
+        const state = await readClaudeNativeState(options);
+        if (state.pluginState === 'foreign')
+            return 'foreign';
+        if (options.desired) {
+            return state.marketplaceDeclaredState === 'canonical'
+                && state.marketplaceMaterializedState === 'canonical'
+                && state.pluginState === 'present'
+                && state.pluginEnabled
+                ? 'present'
+                : 'absent';
+        }
+        if (state.marketplaceState !== 'canonical')
+            return state.marketplaceState;
+        const projectPath = options.scope === 'project'
+            ? path.normalize(await resolveRepoRoot(options.cwd))
+            : undefined;
+        return state.marketplaceConsumers.some((consumer) => !(consumer.name === options.pluginName
+            && consumer.scope === options.scope
+            && (options.scope === 'user' || path.normalize(consumer.projectPath ?? '') === projectPath)))
+            ? 'absent'
+            : 'present';
+    };
+    return {
+        kind: 'shared-config',
+        identity: ownerIdentity(options.pluginName, `marketplace-${options.marketplaceName}`, 'claude', options.scope),
+        label: `${resolveClaudePaths(options.cwd, options.scope, options.env).settingsPath}#marketplaces.${options.marketplaceName}`,
+        inspect,
+        remove: async () => {
+            if (await inspect() !== 'present')
+                return;
+            const before = await readClaudeNativeState(options);
+            if (before.pluginState !== 'absent')
+                return;
+            if (before.marketplaceConsumers.length > 0)
+                return;
+            await runNativeCliChecked({
+                command: 'claude',
+                args: ['plugin', 'marketplace', 'remove', options.marketplaceName],
+                cwd: options.cwd,
+                env: options.env,
+            }, options.runner);
+            const after = await readClaudeNativeState(options);
+            if (after.marketplaceState !== 'absent') {
+                throw new Error('Claude marketplace remove 后 canonical aw source 仍存在。');
+            }
+        },
+    };
+}
+function createNativeVersionComponent(options) {
+    return {
+        kind: 'shared-config',
+        identity: ownerIdentity(options.pluginName, internalArtifactKey('native-version', options.pluginVersion), options.platform, options.scope),
+        label: `${options.pluginName}@${options.marketplaceName ?? MARKETPLACE_NAME}#version=${options.pluginVersion}`,
+        inspect: async () => {
+            let versions;
+            if (options.platform === 'codex') {
+                const residue = await inspectCodexNativeResidue({
+                    pluginName: options.pluginName,
+                    cwd: options.cwd,
+                    env: options.env,
+                    marketplaceName: options.marketplaceName,
+                    marketplaceRoot: options.marketplaceRoot,
+                });
+                versions = residue.enabled && residue.state === 'present' ? residue.versions : [];
+            }
+            else {
+                const state = await readClaudeNativeState({
+                    pluginName: options.pluginName,
+                    scope: options.scope,
+                    cwd: options.cwd,
+                    env: options.env,
+                    marketplaceName: options.marketplaceName,
+                    marketplaceRoot: options.marketplaceRoot,
+                });
+                versions = state.pluginEnabled && state.pluginState === 'present'
+                    ? state.pluginVersions
+                    : [];
+            }
+            return versions.includes(options.pluginVersion) ? 'present' : 'absent';
+        },
+        remove: async () => undefined,
+    };
+}
+async function mirrorCatalog(catalog, env, target) {
+    if (!target?.sourceId || !target.marketplaceRoot) {
+        const rootDir = resolveAwHome(env);
+        await fs.ensureDir(rootDir);
+        await fs.copy(catalog.rootDir, rootDir, { overwrite: true });
+        return { rootDir, commit: async () => undefined, rollback: async () => undefined };
+    }
+    const awHome = path.resolve(resolveAwHome(env));
+    const awHomeStats = await fs.lstat(awHome).catch((error) => {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    });
+    if (!awHomeStats?.isDirectory() || awHomeStats.isSymbolicLink()) {
+        throw new Error(`marketplaceRootInvalid: AW_HOME must be a regular directory: ${awHome}`);
+    }
+    const canonicalAwHome = await fs.realpath(awHome);
+    const expectedParent = path.join(canonicalAwHome, 'marketplaces');
+    const destination = target.marketplaceRoot;
+    const parent = path.dirname(destination);
+    if (path.resolve(parent) !== path.join(awHome, 'marketplaces')) {
+        throw new Error(`marketplaceRootInvalid: marketplace parent is not under canonical AW_HOME: ${parent}`);
+    }
+    let parentStats = await fs.lstat(parent).catch((error) => {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    });
+    if (!parentStats) {
+        await fs.mkdir(parent);
+        parentStats = await fs.lstat(parent);
+    }
+    if (!parentStats.isDirectory() || parentStats.isSymbolicLink()) {
+        throw new Error(`marketplaceRootInvalid: marketplace parent must be a regular directory: ${parent}`);
+    }
+    const canonicalParent = await fs.realpath(parent);
+    if (canonicalParent !== expectedParent) {
+        throw new Error(`marketplaceRootInvalid: marketplace parent is outside canonical AW_HOME: ${parent}`);
+    }
+    const staging = await fs.mkdtemp(path.join(parent, `.${target.sourceId}-staging-`));
+    try {
+        for (const entry of ['.agents', '.claude-plugin', 'plugins']) {
+            await fs.copy(path.join(catalog.rootDir, entry), path.join(staging, entry));
+        }
+        const marketplaceName = target.marketplaceName ?? getNamespacedMarketplaceName(target.sourceId);
+        for (const [platform, manifestPath] of [
+            ['codex', path.join(staging, '.agents', 'plugins', 'marketplace.json')],
+            ['claude', path.join(staging, '.claude-plugin', 'marketplace.json')],
+        ]) {
+            const manifest = await fs.readJson(manifestPath);
+            await fs.writeJson(manifestPath, {
+                ...projectMarketplaceManifestForPlatform(manifest, platform),
+                name: marketplaceName,
+            }, { spaces: 2 });
+        }
+        await fs.writeJson(path.join(staging, 'config.json'), {
+            schemaVersion: 2,
+            sourceId: target.sourceId,
+            sourceIdentity: target.sourceIdentity,
+            marketplaceName,
+        }, { spaces: 2 });
+        const destinationExists = await fs.lstat(destination).then(() => true, (error) => {
+            if (error.code === 'ENOENT' || error.code === 'ENOTDIR')
+                return false;
+            throw error;
+        });
+        if (destinationExists) {
+            await replayNamespacedCodexSkillOverlays({
+                sourceRoot: destination,
+                stagingRoot: staging,
+                sourceId: target.sourceId,
+                sourceIdentity: target.sourceIdentity,
+                marketplaceName,
+            });
+        }
+        const backup = `${destination}.backup-${crypto.randomUUID()}`;
+        if (destinationExists)
+            await fs.move(destination, backup);
+        try {
+            await fs.move(staging, destination);
+        }
+        catch (error) {
+            const backupStats = await fs.lstat(backup).catch((inspectionError) => {
+                if (inspectionError.code === 'ENOENT')
+                    return null;
+                throw inspectionError;
+            });
+            const destinationStats = await fs.lstat(destination).catch((inspectionError) => {
+                if (inspectionError.code === 'ENOENT')
+                    return null;
+                throw inspectionError;
+            });
+            if (backupStats && !destinationStats) {
+                await fs.move(backup, destination);
+            }
+            throw error;
+        }
+        let state = 'active';
+        return {
+            rootDir: destination,
+            commit: async () => {
+                if (state !== 'active')
+                    return;
+                try {
+                    await commitMarketplaceGenerationBackup({
+                        backupRoot: backup,
+                        sourceId: target.sourceId,
+                        sourceIdentity: target.sourceIdentity,
+                        ...(target.marketplaceName ? { marketplaceName: target.marketplaceName } : {}),
+                        env,
+                    });
+                    state = 'committed';
+                }
+                catch (error) {
+                    if (error.durableMaterializeCommit === true) {
+                        state = 'committed';
+                    }
+                    throw error;
+                }
+            },
+            rollback: async () => {
+                if (state !== 'active')
+                    return;
+                const backupStats = await fs.lstat(backup).catch((error) => {
+                    if (error.code === 'ENOENT')
+                        return null;
+                    throw error;
+                });
+                await fs.remove(destination);
+                if (backupStats)
+                    await fs.move(backup, destination);
+                state = 'rolledBack';
+            },
+        };
+    }
+    catch (error) {
+        await fs.remove(staging);
+        throw error;
+    }
+}
+function createNativeDriver(options) {
+    const runner = options.context.nativeCliRunner;
+    const materializeLeaseHeld = new WeakSet();
+    const mirrorTransactions = new WeakMap();
+    const finalizeNamespacedCleanup = async (target) => {
+        const { sourceId, sourceIdentity, marketplaceRoot, marketplaceName } = target.identity;
+        if (!sourceId || !sourceIdentity || !marketplaceRoot)
+            return;
+        await cleanupOrphanNamespacedMarketplaceRoot({
+            sourceId,
+            sourceIdentity,
+            ...(marketplaceName ? { marketplaceName } : {}),
+            cwd: target.identity.cwd,
+            env: options.context.env,
+        });
+    };
+    return {
+        withOwnershipLease: (target, operation) => (!options.context.runtimeLeaseHeld
+            && target.identity.platform === 'codex'
+            && target.identity.scope === 'user'
+            && !materializeLeaseHeld.has(target)
+            ? withActiveMarketplaceRuntimeLease(options.context.env, operation)
+            : operation()),
+        withMaterializeLease: (target, operation) => {
+            if (!target.identity.sourceId)
+                return operation();
+            if (options.context.runtimeLeaseHeld && !options.context.lifecycleLeaseHeld) {
+                throw new Error('lockOrderViolation: namespaced materialization cannot acquire lifecycle after runtime.');
+            }
+            const runOperation = async () => {
+                const previousRuntimeHeld = options.context.runtimeLeaseHeld;
+                options.context.runtimeLeaseHeld = true;
+                materializeLeaseHeld.add(target);
+                try {
+                    if (options.context.expectedCatalogConfigDigest) {
+                        const current = await readCatalogSourcesConfigSnapshot(options.context.env);
+                        if (current.digest !== options.context.expectedCatalogConfigDigest) {
+                            throw new Error('catalogSourceConflict: catalog source config changed before owner publication.');
+                        }
+                    }
+                    return await operation();
+                }
+                finally {
+                    materializeLeaseHeld.delete(target);
+                    options.context.runtimeLeaseHeld = previousRuntimeHeld;
+                }
+            };
+            const withRuntime = () => options.context.runtimeLeaseHeld
+                ? runOperation()
+                : withActiveMarketplaceRuntimeLease(options.context.env, runOperation);
+            if (options.context.lifecycleLeaseHeld)
+                return withRuntime();
+            return withActiveMarketplaceLifecycleLease(options.context.env, async () => {
+                const previousLifecycleHeld = options.context.lifecycleLeaseHeld;
+                options.context.lifecycleLeaseHeld = true;
+                try {
+                    return await withRuntime();
+                }
+                finally {
+                    options.context.lifecycleLeaseHeld = previousLifecycleHeld;
+                }
+            });
+        },
+        preflightMaterialize: async (target) => {
+            if (target.identity.platform === 'claude') {
+                await assertNoClaudeUnboundNativeNameCollision({
+                    pluginName: target.identity.pluginName,
+                    cwd: target.identity.cwd,
+                    env: options.context.env,
+                });
+                return;
+            }
+            const marketplaceName = target.identity.marketplaceName ?? MARKETPLACE_NAME;
+            const marketplaceRoot = target.identity.marketplaceRoot ?? resolveAwHome(options.context.env);
+            const config = await readCodexConfigFile(resolveCodexPaths(target.identity.cwd, 'user', options.context.env).configTomlPath);
+            const marketplace = config.snapshot.marketplaces[marketplaceName];
+            const canonical = marketplace?.sourceType === 'local'
+                && !marketplace.sourcePointsToManifest
+                && path.resolve(marketplace.source ?? '') === path.resolve(marketplaceRoot);
+            const expectedPluginId = `${target.identity.pluginName}@${marketplaceName}`;
+            if ((marketplace !== undefined && !canonical)
+                || (Object.hasOwn(config.snapshot.plugins, expectedPluginId) && !canonical)) {
+                throw new Error(`externalOwnershipPresent: Codex marketplace ${marketplaceName} has a foreign source instead of its canonical namespaced root.`);
+            }
+        },
+        commitMaterialize: async (target) => {
+            const transaction = mirrorTransactions.get(target);
+            if (!transaction)
+                return;
+            await transaction.commit();
+            mirrorTransactions.delete(target);
+        },
+        rollbackMaterialize: async (target) => {
+            const transaction = mirrorTransactions.get(target);
+            if (!transaction)
+                return;
+            await transaction.rollback();
+            mirrorTransactions.delete(target);
+        },
+        finalizeCleanup: finalizeNamespacedCleanup,
+        probeNative: async (component) => {
+            const target = [...plansTargetEntries(options.plans)].find((entry) => entry.target.identity.pluginName === component.identity.plugin
+                && entry.target.identity.sourceId === component.identity.sourceId
+                && entry.target.identity.platform === component.identity.platform
+                && entry.target.identity.scope === component.identity.scope)?.target;
+            if (!target)
+                throw new Error('Native ownership probe cannot resolve its desired target.');
+            if (target.identity.platform === 'claude') {
+                const state = await readClaudeNativeState({
+                    pluginName: target.identity.pluginName,
+                    scope: target.identity.scope,
+                    cwd: target.identity.cwd,
+                    env: options.context.env,
+                    marketplaceName: target.identity.marketplaceName,
+                    marketplaceRoot: target.identity.marketplaceRoot,
+                });
+                return state.pluginState;
+            }
+            if (target.identity.platform === 'codex' && target.identity.scope === 'user') {
+                const residue = await inspectCodexNativeResidue({
+                    pluginName: target.identity.pluginName,
+                    cwd: target.identity.cwd,
+                    env: options.context.env,
+                    marketplaceName: target.identity.marketplaceName,
+                    marketplaceRoot: target.identity.marketplaceRoot,
+                });
+                return residue.state;
+            }
+            return 'absent';
+        },
+        probeNativeHealth: async (component) => {
+            const target = [...plansTargetEntries(options.plans)].find((entry) => entry.target.identity.pluginName === component.identity.plugin
+                && entry.target.identity.sourceId === component.identity.sourceId
+                && entry.target.identity.platform === component.identity.platform
+                && entry.target.identity.scope === component.identity.scope)?.target;
+            if (!target)
+                throw new Error('Native health probe cannot resolve its desired target.');
+            if (target.identity.platform === 'claude') {
+                const state = await readClaudeNativeState({
+                    pluginName: target.identity.pluginName,
+                    scope: target.identity.scope,
+                    cwd: target.identity.cwd,
+                    env: options.context.env,
+                    marketplaceName: target.identity.marketplaceName,
+                    marketplaceRoot: target.identity.marketplaceRoot,
+                });
+                if (state.pluginState !== 'present')
+                    return state.pluginState;
+                return state.pluginEnabled ? 'present' : 'partial';
+            }
+            if (target.identity.platform === 'codex' && target.identity.scope === 'user') {
+                const residue = await inspectCodexNativeResidue({
+                    pluginName: target.identity.pluginName,
+                    cwd: target.identity.cwd,
+                    env: options.context.env,
+                    marketplaceName: target.identity.marketplaceName,
+                    marketplaceRoot: target.identity.marketplaceRoot,
+                });
+                if (residue.state !== 'present')
+                    return residue.state;
+                return residue.enabled ? 'present' : 'partial';
+            }
+            return 'absent';
+        },
+        removeNative: async (component) => {
+            const target = [...plansTargetEntries(options.plans)].find((entry) => entry.target.identity.pluginName === component.identity.plugin
+                && entry.target.identity.sourceId === component.identity.sourceId
+                && entry.target.identity.platform === component.identity.platform
+                && entry.target.identity.scope === component.identity.scope)?.target;
+            if (!target)
+                throw new Error('Native ownership removal cannot resolve its desired target.');
+            if (target.identity.platform === 'codex') {
+                const before = await inspectCodexNativeResidue({
+                    pluginName: target.identity.pluginName,
+                    cwd: target.identity.cwd,
+                    env: options.context.env,
+                    marketplaceName: target.identity.marketplaceName,
+                    marketplaceRoot: target.identity.marketplaceRoot,
+                });
+                if (before.state === 'foreign') {
+                    throw new Error(`Codex native owner 为 foreign，拒绝调用 plugin remove：${before.labels.join('，')}`);
+                }
+                if (before.state === 'absent')
+                    return;
+                await runNativeCliChecked(buildCodexPluginRemoveInvocation(component.pluginId, target.identity.cwd, options.context.env), runner);
+                const residue = await inspectCodexNativeResidue({
+                    pluginName: target.identity.pluginName,
+                    cwd: target.identity.cwd,
+                    env: options.context.env,
+                    marketplaceName: target.identity.marketplaceName,
+                    marketplaceRoot: target.identity.marketplaceRoot,
+                });
+                if (residue.state !== 'absent') {
+                    throw new Error(`Codex native remove 后仍有残留：${residue.labels.join('，')}`);
+                }
+            }
+            else {
+                await runNativeCliChecked({
+                    command: 'claude',
+                    args: ['plugin', 'uninstall', component.pluginId, '--scope', target.identity.scope],
+                    cwd: target.identity.cwd,
+                    env: options.context.env,
+                }, runner);
+                await runNativeCliChecked({
+                    command: 'claude',
+                    args: ['plugin', 'list'],
+                    cwd: target.identity.cwd,
+                    env: options.context.env,
+                }, runner);
+                const after = await readClaudeNativeState({
+                    pluginName: target.identity.pluginName,
+                    scope: target.identity.scope,
+                    cwd: target.identity.cwd,
+                    env: options.context.env,
+                    marketplaceName: target.identity.marketplaceName,
+                    marketplaceRoot: target.identity.marketplaceRoot,
+                });
+                if (after.pluginState !== 'absent') {
+                    throw new Error(`Claude native uninstall 后仍有 ${after.pluginState} plugin evidence。`);
+                }
+            }
+        },
+        writeNative: async (target) => {
+            const plan = options.plans.get(target);
+            if (!plan)
+                throw new Error('Missing rebuild integration plan.');
+            const marketplaceName = target.identity.marketplaceName ?? MARKETPLACE_NAME;
+            const expectedMarketplaceRoot = target.identity.marketplaceRoot ?? resolveAwHome(options.context.env);
+            const writeGeneration = async () => {
+                if (mirrorTransactions.has(target)) {
+                    throw new Error('Marketplace mirror transaction is already active for this target.');
+                }
+                {
+                    if (target.identity.platform === 'codex') {
+                        const config = await readCodexConfigFile(resolveCodexPaths(target.identity.cwd, 'user', options.context.env).configTomlPath);
+                        const marketplace = config.snapshot.marketplaces[marketplaceName];
+                        if (marketplace && (marketplace.sourceType !== 'local'
+                            || marketplace.sourcePointsToManifest
+                            || path.normalize(marketplace.source ?? '') !== path.normalize(expectedMarketplaceRoot))) {
+                            throw new Error(`externalOwnershipPresent: Codex marketplace ${marketplaceName} 已由 foreign source 占用，拒绝覆盖。`);
+                        }
+                    }
+                    else {
+                        const state = await readClaudeNativeState({
+                            pluginName: target.identity.pluginName,
+                            scope: target.identity.scope,
+                            cwd: target.identity.cwd,
+                            env: options.context.env,
+                            marketplaceName,
+                            marketplaceRoot: expectedMarketplaceRoot,
+                        });
+                        if (state.marketplaceState === 'foreign') {
+                            throw new Error(`Claude marketplace ${marketplaceName} 已由 foreign source 占用，拒绝覆盖。`);
+                        }
+                    }
+                    const mirrored = await mirrorCatalog(plan.catalog, options.context.env, target.identity);
+                    mirrorTransactions.set(target, mirrored);
+                    const marketplaceRoot = mirrored.rootDir;
+                    const pluginId = `${target.identity.pluginName}@${marketplaceName}`;
+                    if (target.identity.platform === 'codex') {
+                        const requiredSkillWrites = plan.writes.filter((entry) => !entry.optional
+                            && entry.component?.kind === 'skill-directory'
+                            && entry.artifact.kind === 'skill'
+                            && entry.artifact.state !== 'disabled'
+                            && target.identity.scope === 'user');
+                        for (const write of requiredSkillWrites) {
+                            await write.write();
+                        }
+                        const skillsRelativeRoot = await ensureCodexActiveSkillsManifest({
+                            plugin: target.plugin,
+                            marketplaceRoot,
+                            hasRequiredSkills: requiredSkillWrites.length > 0,
+                        });
+                        const config = await readCodexConfigFile(resolveCodexPaths(target.identity.cwd, 'user', options.context.env).configTomlPath);
+                        const marketplace = config.snapshot.marketplaces[marketplaceName];
+                        if (path.normalize(marketplace?.source ?? '') !== path.normalize(marketplaceRoot)) {
+                            await runNativeCliChecked(buildCodexMarketplaceAddInvocation(marketplaceRoot, target.identity.cwd, options.context.env), runner);
+                        }
+                        await runNativeCliChecked(buildCodexMarketplaceListInvocation(target.identity.cwd, options.context.env), runner);
+                        await runNativeCliChecked(buildCodexPluginAddInvocation(pluginId, target.identity.cwd, options.context.env), runner);
+                        await runNativeCliChecked(buildCodexPluginListInvocation(target.identity.cwd, options.context.env), runner);
+                        await assertCodexNativeInstallState({
+                            pluginName: target.identity.pluginName,
+                            pluginVersion: target.identity.pluginVersion,
+                            cwd: target.identity.cwd,
+                            env: options.context.env,
+                            marketplaceRoot,
+                            marketplaceName,
+                            skillsRelativeRoot,
+                            requiredSkillKeys: requiredSkillWrites.flatMap((write) => write.artifact.artifactKey ? [write.artifact.artifactKey] : []),
+                        });
+                    }
+                    else {
+                        await runNativeCliChecked({
+                            command: 'claude',
+                            args: ['plugin', 'marketplace', 'add', marketplaceRoot, '--scope', target.identity.scope],
+                            cwd: target.identity.cwd,
+                            env: options.context.env,
+                        }, runner);
+                        await runNativeCliChecked({
+                            command: 'claude',
+                            args: ['plugin', 'install', pluginId, '--scope', target.identity.scope],
+                            cwd: target.identity.cwd,
+                            env: options.context.env,
+                        }, runner);
+                        await runNativeCliChecked({
+                            command: 'claude',
+                            args: ['plugin', 'list'],
+                            cwd: target.identity.cwd,
+                            env: options.context.env,
+                        }, runner);
+                        const after = await readClaudeNativeState({
+                            pluginName: target.identity.pluginName,
+                            scope: target.identity.scope,
+                            cwd: target.identity.cwd,
+                            env: options.context.env,
+                            marketplaceName,
+                            marketplaceRoot,
+                        });
+                        if (after.marketplaceDeclaredState !== 'canonical'
+                            || after.marketplaceMaterializedState !== 'canonical'
+                            || after.pluginState !== 'present'
+                            || !after.pluginEnabled
+                            || !after.pluginVersions.includes(target.identity.pluginVersion)) {
+                            throw new Error(`Claude native install postcheck 失败：declaredMarketplace=${after.marketplaceDeclaredState}，materializedMarketplace=${after.marketplaceMaterializedState}，plugin=${after.pluginState}，enabled=${after.pluginEnabled}，versions=${after.pluginVersions.join(',')}。`);
+                        }
+                    }
+                }
+            };
+            await (target.identity.sourceId
+                && !options.context.runtimeLeaseHeld
+                && !materializeLeaseHeld.has(target)
+                ? withActiveMarketplaceRuntimeLease(options.context.env, writeGeneration)
+                : writeGeneration());
+        },
+        writeArtifacts: async (target) => {
+            const plan = options.plans.get(target);
+            if (!plan)
+                throw new Error('Missing rebuild integration plan.');
+            const writeAll = async () => {
+                for (const write of plan.writes)
+                    await write.write();
+                return plan.writes.map((write) => write.artifact);
+            };
+            return !options.context.runtimeLeaseHeld
+                && !materializeLeaseHeld.has(target)
+                && target.identity.platform === 'codex' && target.identity.scope === 'user'
+                ? withActiveMarketplaceRuntimeLease(options.context.env, writeAll)
+                : writeAll();
+        },
+        runLifecycle: async (invocation) => {
+            await runLifecycleScript({
+                event: invocation.event,
+                pluginName: invocation.plugin.manifest.name,
+                platform: invocation.target.identity.platform,
+                scope: invocation.target.identity.scope,
+                cwd: invocation.target.identity.cwd,
+                context: options.context,
+                currentPlugin: invocation.plugin,
+                artifacts: [...invocation.artifacts],
+                scriptTimeoutMs: options.scriptTimeoutMs,
+            });
+        },
+    };
+}
+const planTargets = new WeakMap();
+function plansTargetEntries(plans) {
+    return (planTargets.get(plans) ?? []).flatMap((target) => {
+        const plan = plans.get(target);
+        return plan ? [{ target, plan }] : [];
+    });
+}
+export function createRebuildIntegration(options) {
+    const plans = new WeakMap();
+    planTargets.set(plans, []);
+    const driver = createNativeDriver({ plans, ...options });
+    return {
+        driver,
+        buildTarget: async (input) => {
+            const materializing = input.command !== 'cleanup'
+                && input.command !== 'uninstall'
+                && input.readOnlyInspectionPlan !== true;
+            if (input.scope === 'project') {
+                const canonicalRepoRoot = await assertCanonicalProjectManagedRoots({
+                    cwd: input.cwd,
+                    rootNames: input.platform === 'codex' ? ['.agents', '.codex'] : ['.claude'],
+                    managedPaths: input.platform === 'codex'
+                        ? ['.codex/config.toml', '.codex/hooks.json']
+                        : ['.claude/settings.json'],
+                });
+                input = { ...input, cwd: canonicalRepoRoot };
+                if (materializing && input.platform === 'codex' && input.plugin.manifest.apps) {
+                    throw new Error(`Codex project scope 不支持 apps：${input.plugin.manifest.name}`);
+                }
+            }
+            if (materializing && input.platform === 'codex') {
+                await preflightCodexWriteSafety({
+                    plugin: input.plugin,
+                    scope: input.scope,
+                    cwd: input.cwd,
+                    env: options.context.env,
+                });
+            }
+            const event = input.command === 'upgrade' ? 'upgrade' : 'install';
+            let historicalArtifacts = [];
+            if (input.includeHistoricalLifecycleArtifacts) {
+                const loadPlugin = (bundleRoot) => readPluginManifest(bundleRoot, { mode: 'bundle' });
+                const { readLifecycleActiveSnapshot } = await import('../utils/lifecycle-active-store.js');
+                const active = await readLifecycleActiveSnapshot({
+                    ...(input.sourceId ? {
+                        sourceId: input.sourceId,
+                        sourceIdentity: input.sourceIdentity,
+                    } : {}),
+                    pluginName: input.plugin.manifest.name,
+                    platform: input.platform,
+                    scope: input.scope,
+                    cwd: input.cwd,
+                    env: options.context.env,
+                    loadPlugin,
+                });
+                historicalArtifacts = active?.artifacts ?? [];
+            }
+            let writes = [];
+            if (input.command !== 'cleanup' && input.command !== 'uninstall') {
+                if (input.readOnlyInspectionPlan) {
+                    writes = await buildInspectionWrites({
+                        plugin: input.plugin,
+                        platform: input.platform,
+                        scope: input.scope,
+                        cwd: input.cwd,
+                        env: options.context.env,
+                        marketplaceRoot: input.marketplaceRoot,
+                    });
+                }
+                else if (input.platform === 'codex') {
+                    writes = await buildCodexWrites({
+                        ...input,
+                        env: options.context.env,
+                        event,
+                        historicalArtifacts,
+                        scriptTimeoutMs: options.scriptTimeoutMs,
+                    });
+                }
+                else {
+                    writes = await buildClaudeWrites({
+                        ...input,
+                        env: options.context.env,
+                        event,
+                        historicalArtifacts,
+                        scriptTimeoutMs: options.scriptTimeoutMs,
+                    });
+                }
+            }
+            const desiredComponents = writes.filter((write) => !write.optional).flatMap((write) => [
+                ...(write.additionalComponents ?? []),
+                ...(write.component ? [write.component] : []),
+            ]);
+            const optionalComponents = writes
+                .filter((write) => write.optional)
+                .flatMap((write) => [
+                ...(write.additionalComponents ?? []),
+                ...(write.component ? [write.component] : []),
+            ]);
+            const optionalComponentKeys = new Set(optionalComponents.map(componentIdentityKey));
+            const configDir = input.platform === 'codex'
+                ? resolveCodexPaths(input.cwd, input.scope, options.context.env).configDir
+                : resolveClaudePaths(input.cwd, input.scope, options.context.env).configDir;
+            const textRoots = input.platform === 'codex'
+                ? [path.join(configDir, 'rules'), path.join(configDir, 'agents')]
+                : [path.join(configDir, 'rules'), path.join(configDir, 'agents')];
+            const scannedText = (await Promise.all(textRoots.map((root) => scanOwnedTextFiles({
+                sourceId: input.sourceId,
+                sourceIdentity: input.sourceIdentity,
+                root,
+                pluginName: input.plugin.manifest.name,
+                platform: input.platform,
+                scope: input.scope,
+            })))).flat();
+            const skillRoots = input.platform === 'codex'
+                ? input.scope === 'project'
+                    ? [path.join(await resolveRepoRoot(input.cwd), '.agents', 'skills')]
+                    : [path.join(input.marketplaceRoot ?? resolveAwHome(options.context.env), 'plugins', input.plugin.manifest.name)]
+                : [path.join(configDir, 'skills')];
+            const scanSkills = () => Promise.all(skillRoots.map((root) => scanOwnedSkills({
+                sourceId: input.sourceId,
+                sourceIdentity: input.sourceIdentity,
+                root,
+                pluginName: input.plugin.manifest.name,
+                platform: input.platform,
+                scope: input.scope,
+            })));
+            const scannedSkills = (await (input.platform === 'codex'
+                && input.scope === 'user'
+                && input.readOnlyInspectionPlan !== true
+                ? withActiveMarketplaceRuntimeLease(options.context.env, scanSkills)
+                : scanSkills())).flat();
+            const historicalComponents = await buildHistoricalComponents({
+                sourceId: input.sourceId,
+                sourceIdentity: input.sourceIdentity,
+                pluginId: input.pluginId,
+                pluginName: input.plugin.manifest.name,
+                platform: input.platform,
+                scope: input.scope,
+                cwd: input.cwd,
+                env: options.context.env,
+                artifacts: historicalArtifacts,
+            });
+            const sharedComponents = input.platform === 'codex'
+                ? await scanCodexSharedComponents({
+                    sourceId: input.sourceId,
+                    sourceIdentity: input.sourceIdentity,
+                    pluginId: input.pluginId,
+                    pluginName: input.plugin.manifest.name,
+                    scope: input.scope,
+                    paths: resolveCodexPaths(input.cwd, input.scope, options.context.env),
+                    scanConfig: true,
+                    scanHooks: true,
+                    ignoreReadErrors: true,
+                })
+                : await scanClaudeSharedComponents({
+                    sourceId: input.sourceId,
+                    sourceIdentity: input.sourceIdentity,
+                    pluginId: input.pluginId,
+                    pluginName: input.plugin.manifest.name,
+                    scope: input.scope,
+                    settingsPath: resolveClaudePaths(input.cwd, input.scope, options.context.env).settingsPath,
+                });
+            const nativeRequired = input.platform === 'claude'
+                || (input.scope === 'user' && requiresCodexNativePlugin(input.plugin, input.scope));
+            const nativeCleanupCandidate = input.platform === 'claude' || input.scope === 'user';
+            const nativePlugin = (nativeRequired || nativeCleanupCandidate)
+                ? [{
+                        kind: 'native-plugin',
+                        identity: ownerIdentity(input.plugin.manifest.name, 'native', input.platform, input.scope),
+                        pluginId: `${input.plugin.manifest.name}@${input.marketplaceName ?? MARKETPLACE_NAME}`,
+                    }]
+                : [];
+            const marketplaceDesired = nativeRequired
+                && input.command !== 'cleanup'
+                && input.command !== 'uninstall';
+            const marketplace = input.platform === 'codex' && input.scope === 'user'
+                ? [createCodexMarketplaceComponent({
+                        pluginName: input.plugin.manifest.name,
+                        cwd: input.cwd,
+                        env: options.context.env,
+                        runner: options.context.nativeCliRunner,
+                        marketplaceName: input.marketplaceName ?? MARKETPLACE_NAME,
+                        marketplaceRoot: input.marketplaceRoot ?? resolveAwHome(options.context.env),
+                        desired: marketplaceDesired,
+                    })]
+                : input.platform === 'claude'
+                    ? [createClaudeMarketplaceComponent({
+                            pluginName: input.plugin.manifest.name,
+                            scope: input.scope,
+                            cwd: input.cwd,
+                            env: options.context.env,
+                            runner: options.context.nativeCliRunner,
+                            marketplaceName: input.marketplaceName ?? MARKETPLACE_NAME,
+                            marketplaceRoot: input.marketplaceRoot ?? resolveAwHome(options.context.env),
+                            desired: marketplaceDesired,
+                        })]
+                    : [];
+            const nativeVersion = nativeRequired
+                && input.command !== 'cleanup'
+                && input.command !== 'uninstall'
+                ? [createNativeVersionComponent({
+                        pluginName: input.plugin.manifest.name,
+                        pluginVersion: input.plugin.manifest.version,
+                        platform: input.platform,
+                        scope: input.scope,
+                        cwd: input.cwd,
+                        env: options.context.env,
+                        marketplaceName: input.marketplaceName,
+                        marketplaceRoot: input.marketplaceRoot,
+                    })]
+                : [];
+            if (nativeRequired
+                && input.command !== 'cleanup'
+                && input.command !== 'uninstall')
+                desiredComponents.push(...nativePlugin, ...marketplace, ...nativeVersion);
+            const allComponents = dedupeComponents([
+                ...desiredComponents,
+                ...optionalComponents,
+                ...(input.platform === 'codex' ? sharedComponents : []),
+                ...scannedText,
+                ...scannedSkills,
+                ...historicalComponents,
+                ...(input.platform === 'claude' ? sharedComponents : []),
+                ...nativePlugin,
+                ...marketplace,
+                ...nativeVersion,
+            ]);
+            bindNamespacedOwnerIdentity(allComponents, input);
+            const desiredKeys = new Set(desiredComponents.map(componentIdentityKey));
+            const target = {
+                plugin: input.plugin,
+                identity: {
+                    ...(input.sourceId ? {
+                        sourceId: input.sourceId,
+                        sourceIdentity: input.sourceIdentity,
+                        pluginId: input.pluginId,
+                        marketplaceName: input.marketplaceName,
+                        marketplaceRoot: input.marketplaceRoot,
+                    } : {}),
+                    pluginName: input.plugin.manifest.name,
+                    pluginVersion: input.plugin.manifest.version,
+                    platform: input.platform,
+                    scope: input.scope,
+                    cwd: input.cwd,
+                },
+                ownedComponents: allComponents,
+                desiredOwnedComponents: allComponents.filter((component) => desiredKeys.has(componentIdentityKey(component))),
+                optionalOwnedComponents: allComponents.filter((component) => optionalComponentKeys.has(componentIdentityKey(component))),
+                requiresNative: nativeRequired
+                    && input.command !== 'cleanup'
+                    && input.command !== 'uninstall',
+                artifacts: writes.map((write) => write.artifact),
+                lifecycleSource: input.plugin,
+            };
+            plans.set(target, {
+                catalog: input.catalog,
+                event,
+                writes,
+            });
+            planTargets.get(plans).push(target);
+            return target;
+        },
+    };
+}
+export async function inspectRebuildTarget(options) {
+    const integration = createRebuildIntegration({ context: options.context });
+    const target = await integration.buildTarget({
+        ...(options.sourceId ? {
+            sourceId: options.sourceId,
+            sourceIdentity: options.sourceIdentity,
+            pluginId: options.pluginId,
+            marketplaceName: options.marketplaceName,
+            marketplaceRoot: options.marketplaceRoot,
+        } : {}),
+        plugin: options.plugin,
+        platform: options.platform,
+        scope: options.scope,
+        cwd: options.cwd,
+        command: 'install',
+        catalog: options.catalog,
+        includeHistoricalLifecycleArtifacts: false,
+        readOnlyInspectionPlan: true,
+    });
+    const inspection = await inspectOwnedComponents({
+        components: target.ownedComponents,
+        nativeProbe: integration.driver.probeNativeHealth ?? integration.driver.probeNative,
+        verifyHealth: true,
+    });
+    return { target, inspection };
+}
+async function discoverOwnerNamesInTextRoot(root, platform, scope) {
+    if (!await fs.pathExists(root))
+        return [];
+    const names = new Set();
+    const pending = [root];
+    while (pending.length > 0) {
+        const current = pending.pop();
+        for (const entry of await fs.readdir(current, { withFileTypes: true })) {
+            const entryPath = path.join(current, entry.name);
+            if (entry.isSymbolicLink())
+                continue;
+            if (entry.isDirectory()) {
+                pending.push(entryPath);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            const raw = await fs.readFile(entryPath, 'utf8').catch(() => '');
+            if (!raw.includes(OWNED_TEXT_HEADER_PREFIX))
+                continue;
+            const parsed = (() => {
+                try {
+                    return parseOwnedTextHeader(raw);
+                }
+                catch {
+                    return null;
+                }
+            })();
+            if (parsed?.identity.platform === platform && parsed.identity.scope === scope) {
+                names.add(parsed.identity.plugin);
+            }
+        }
+    }
+    return [...names];
+}
+async function discoverOwnerNamesInSkillRoot(root, platform, scope) {
+    if (!await fs.pathExists(root))
+        return [];
+    const names = new Set();
+    for (const entry of await fs.readdir(root, { withFileTypes: true })) {
+        if (!entry.isDirectory() || entry.isSymbolicLink())
+            continue;
+        const marker = await readSkillOwnerMarker({
+            skillRoot: path.join(root, entry.name),
+            allowedRoot: root,
+        }).catch(() => null);
+        if (marker?.platform === platform && marker.scope === scope)
+            names.add(marker.plugin);
+    }
+    return [...names];
+}
+export async function discoverRebuildTargetNames(options) {
+    if (options.scope === 'project') {
+        const canonicalRepoRoot = await assertCanonicalProjectManagedRoots({
+            cwd: options.cwd,
+            rootNames: options.platform === 'codex' ? ['.agents', '.codex'] : ['.claude'],
+            managedPaths: options.platform === 'codex'
+                ? ['.codex/config.toml', '.codex/hooks.json']
+                : ['.claude/settings.json'],
+        });
+        options = { ...options, cwd: canonicalRepoRoot };
+    }
+    const names = new Set();
+    const paths = options.platform === 'codex'
+        ? resolveCodexPaths(options.cwd, options.scope, options.env)
+        : resolveClaudePaths(options.cwd, options.scope, options.env);
+    const textRoots = [path.join(paths.configDir, 'rules'), path.join(paths.configDir, 'agents')];
+    for (const name of (await Promise.all(textRoots.map((root) => discoverOwnerNamesInTextRoot(root, options.platform, options.scope)))).flat())
+        names.add(name);
+    const skillRoots = options.platform === 'codex'
+        ? options.scope === 'project'
+            ? [path.join(await resolveRepoRoot(options.cwd), '.agents', 'skills')]
+            : [path.join(resolveAwHome(options.env), 'plugins')]
+        : [path.join(paths.configDir, 'skills')];
+    if (options.platform === 'codex' && options.scope === 'user') {
+        const pluginsRoot = skillRoots[0];
+        if (await fs.pathExists(pluginsRoot)) {
+            for (const pluginEntry of await fs.readdir(pluginsRoot, { withFileTypes: true })) {
+                if (!pluginEntry.isDirectory())
+                    continue;
+                const pluginRoot = path.join(pluginsRoot, pluginEntry.name);
+                const platformManifest = await fs.readJson(path.join(pluginRoot, '.codex-plugin', 'plugin.json')).catch(() => null);
+                const relativeSkillsRoot = typeof platformManifest?.skills === 'string'
+                    ? path.posix.normalize(platformManifest.skills.replace(/^\.\//u, ''))
+                    : 'codex/skills';
+                if (relativeSkillsRoot === '..'
+                    || relativeSkillsRoot.startsWith('../')
+                    || path.isAbsolute(relativeSkillsRoot))
+                    continue;
+                for (const name of await discoverOwnerNamesInSkillRoot(path.join(pluginRoot, ...relativeSkillsRoot.split('/')), options.platform, options.scope))
+                    names.add(name);
+            }
+        }
+    }
+    else {
+        for (const root of skillRoots) {
+            for (const name of await discoverOwnerNamesInSkillRoot(root, options.platform, options.scope)) {
+                names.add(name);
+            }
+        }
+    }
+    if (options.platform === 'codex') {
+        const config = await readCodexConfigFile(resolveCodexPaths(options.cwd, options.scope, options.env).configTomlPath);
+        for (const name of Object.keys(config.snapshot.developerInstructions.managedBlocks)) {
+            names.add(sharedOwnerPluginName(name));
+        }
+        for (const server of Object.values(config.snapshot.mcpServers)) {
+            const envValue = server.value?.env;
+            const owner = envValue
+                && typeof envValue === 'object'
+                && !Array.isArray(envValue)
+                && typeof envValue[MCP_OWNER_ENV] === 'string'
+                ? envValue[MCP_OWNER_ENV]
+                : null;
+            if (owner)
+                names.add(sharedOwnerPluginName(owner));
+        }
+        if (options.scope === 'project') {
+            const hooksPath = resolveCodexPaths(options.cwd, options.scope, options.env).hooksPath;
+            const hooks = await readCodexHooks(hooksPath).catch(() => null);
+            for (const identity of hooks?.managedIdentities ?? []) {
+                const owner = readOwnedHookIdentity(identity, options.scope);
+                if (owner)
+                    names.add(owner.plugin);
+            }
+        }
+        else {
+            for (const name of await discoverCodexNativeResidueNames({
+                cwd: options.cwd,
+                env: options.env,
+                marketplaceName: options.marketplaceName,
+                marketplaceRoot: options.marketplaceRoot,
+            }))
+                names.add(name);
+        }
+    }
+    else {
+        const settings = await readClaudeSettings(resolveClaudePaths(options.cwd, options.scope, options.env).settingsPath);
+        for (const name of Object.keys(settings.awGenerated?.permissions ?? {})) {
+            names.add(sharedOwnerPluginName(name));
+        }
+        const installed = await readJsonObjectIfExists(resolveClaudePaths(options.cwd, options.scope, options.env).installedPluginsPath, 'Claude installed_plugins');
+        const installedPlugins = installed.plugins;
+        if (installedPlugins !== undefined && (!installedPlugins || typeof installedPlugins !== 'object' || Array.isArray(installedPlugins)))
+            throw new Error('Claude installed_plugins.plugins 必须是 object。');
+        const candidates = new Set();
+        for (const [pluginKey, raw] of Object.entries(installedPlugins ?? {})) {
+            for (const entry of Array.isArray(raw) ? raw : [raw]) {
+                const record = entry && typeof entry === 'object' && !Array.isArray(entry)
+                    ? entry
+                    : null;
+                const name = typeof record?.name === 'string'
+                    ? record.name
+                    : pluginKey.includes('@') ? pluginKey.slice(0, pluginKey.indexOf('@')) : pluginKey;
+                if (/^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(name))
+                    candidates.add(name);
+            }
+        }
+        const rawSettings = await readJsonObjectIfExists(resolveClaudePaths(options.cwd, options.scope, options.env).settingsPath, 'Claude settings');
+        const settingsPlugins = rawSettings.plugins;
+        const settingsInstalled = settingsPlugins
+            && typeof settingsPlugins === 'object'
+            && !Array.isArray(settingsPlugins)
+            ? settingsPlugins.installed
+            : undefined;
+        if (settingsInstalled !== undefined && (!settingsInstalled || typeof settingsInstalled !== 'object' || Array.isArray(settingsInstalled)))
+            throw new Error('Claude settings.plugins.installed 必须是 object。');
+        for (const name of Object.keys(settingsInstalled ?? {})) {
+            if (/^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(name))
+                candidates.add(name);
+        }
+        const enabledPlugins = rawSettings.enabledPlugins;
+        if (enabledPlugins !== undefined && (!enabledPlugins || typeof enabledPlugins !== 'object' || Array.isArray(enabledPlugins)))
+            throw new Error('Claude settings.enabledPlugins 必须是 object。');
+        for (const pluginId of Object.keys(enabledPlugins ?? {})) {
+            const suffix = `@${options.marketplaceName ?? MARKETPLACE_NAME}`;
+            if (!pluginId.endsWith(suffix))
+                continue;
+            const name = pluginId.slice(0, -suffix.length);
+            if (/^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(name))
+                candidates.add(name);
+        }
+        for (const name of candidates) {
+            const state = await readClaudeNativeState({
+                pluginName: name,
+                scope: options.scope,
+                cwd: options.cwd,
+                env: options.env,
+                marketplaceName: options.marketplaceName,
+                marketplaceRoot: options.marketplaceRoot,
+            });
+            if (state.pluginState === 'present')
+                names.add(name);
+        }
+    }
+    return [...names].sort();
+}
+//# sourceMappingURL=rebuild-integration.js.map