@lesliechan721/aw 0.1.0-beta.5 → 0.1.0-beta.50

package/dist/src/utils/local-marketplace.js

@@ -1,11 +1,16 @@
 import path from 'node:path';
 import fs from 'fs-extra';
-import { SKILL_OWNER_MARKER, readSkillOwnerMarker } from './ownership.js';
+import { readSkillOwnerMarker } from './ownership.js';
 import { readJsonFile } from './json.js';
 import { assertStrictSemVer } from './manifest.js';
 import { resolveCliPackageRoot } from './paths.js';
+import { canonicalizePathThroughExistingAncestor } from './state-paths.js';
 import { sanitizeCatalogSourceErrorMessage } from './catalog-public-error.js';
 import { normalizeMarketplaceProductToken } from './platform-support.js';
+import { CODEX_NATIVE_RENDER_RECEIPT_PATH, parseCodexNativeRenderReceipt, } from './codex-native-render-receipt.js';
+import { calculateCodexNativeRenderPayloadDigest } from './catalog-digests.js';
+import { createCodexSkillStagingTreeContentDigest } from './codex-skill-staging.js';
+import { readDynamicSkillTree } from './dynamic-skill-tree.js';
 const SOURCE_IDENTITY_PATTERN = /^sha256:[0-9a-f]{64}$/;
 export function getNamespacedMarketplaceName(sourceId) {
     return `aw-${sourceId}`;
@@ -32,6 +37,28 @@ export function projectMarketplaceManifestForPlatform(manifest, platform) {
 export function getLocalMarketplacePluginRoot(rootDir, pluginName) {
     return path.join(rootDir, 'plugins', pluginName);
 }
+export async function assertSafeNamespacedMarketplacePluginRoot(rootDir, pluginName) {
+    const pluginsRoot = path.join(rootDir, 'plugins');
+    const pluginRoot = getLocalMarketplacePluginRoot(rootDir, pluginName);
+    const pluginsStats = await lstatMarketplacePath(pluginsRoot);
+    if (pluginsStats && (!pluginsStats.isDirectory() || pluginsStats.isSymbolicLink())) {
+        throw new MarketplaceRootValidationError(pluginsRoot, 'marketplace plugins ancestor must be a regular directory.', 'unsafe');
+    }
+    const pluginStats = pluginsStats ? await lstatMarketplacePath(pluginRoot) : null;
+    if (pluginStats && (!pluginStats.isDirectory() || pluginStats.isSymbolicLink())) {
+        throw new MarketplaceRootValidationError(pluginRoot, 'marketplace plugin projection must be a regular directory.', 'unsafe');
+    }
+    const physicalRoot = await fs.realpath(rootDir);
+    for (const candidate of [pluginsStats ? pluginsRoot : null, pluginStats ? pluginRoot : null]) {
+        if (!candidate)
+            continue;
+        const relative = path.relative(physicalRoot, await fs.realpath(candidate));
+        if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+            throw new MarketplaceRootValidationError(candidate, 'marketplace plugin path escapes its physical root.', 'unsafe');
+        }
+    }
+    return pluginRoot;
+}
 export function getLocalMarketplaceCodexSkillsRoot(rootDir, pluginName) {
     return path.join(getLocalMarketplacePluginRoot(rootDir, pluginName), 'codex', 'skills');
 }
@@ -47,10 +74,12 @@ export async function readCliPackageInfo() {
 }
 export class MarketplaceRootValidationError extends Error {
     location;
+    reason;
     code = 'marketplaceRootInvalid';
-    constructor(location, message, cause) {
+    constructor(location, message, reason, cause) {
         super(`marketplaceRootInvalid: ${message}`, cause === undefined ? undefined : { cause });
         this.location = location;
+        this.reason = reason;
         this.name = 'MarketplaceRootValidationError';
     }
 }
@@ -59,7 +88,7 @@ function assertMarketplacePathBoundary(trustedRoot, candidatePath) {
     const candidate = path.resolve(candidatePath);
     const relative = path.relative(root, candidate);
     if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
-        throw new MarketplaceRootValidationError(candidate, 'marketplace path escapes its trusted root.');
+        throw new MarketplaceRootValidationError(candidate, 'marketplace path escapes its trusted root.', 'unsafe');
     }
     return { root, candidate };
 }
@@ -76,34 +105,48 @@ async function lstatMarketplacePath(filePath) {
 }
 async function inspectMarketplacePath(trustedRoot, candidatePath, finalKind) {
     const { root, candidate } = assertMarketplacePathBoundary(trustedRoot, candidatePath);
-    const paths = [root];
-    let current = root;
-    for (const segment of path.relative(root, candidate).split(path.sep).filter(Boolean)) {
-        current = path.join(current, segment);
-        paths.push(current);
-    }
-    let candidateStats = null;
-    for (const currentPath of paths) {
-        let stats;
-        try {
-            stats = await lstatMarketplacePath(currentPath);
-        }
-        catch (error) {
-            throw new MarketplaceRootValidationError(currentPath, 'marketplace path cannot be inspected.', error);
-        }
-        if (!stats)
-            return null;
-        const isFinal = currentPath === candidate;
-        const valid = isFinal && finalKind === 'file'
-            ? stats.isFile() && !stats.isSymbolicLink()
-            : stats.isDirectory() && !stats.isSymbolicLink();
-        if (!valid) {
-            throw new MarketplaceRootValidationError(currentPath, isFinal && finalKind === 'file'
-                ? 'marketplace JSON target must be a regular file.'
-                : 'marketplace path must be a regular directory.');
-        }
-        if (isFinal)
-            candidateStats = stats;
+    let rootStats;
+    let candidateStats;
+    try {
+        [rootStats, candidateStats] = await Promise.all([
+            lstatMarketplacePath(root),
+            lstatMarketplacePath(candidate),
+        ]);
+    }
+    catch (error) {
+        throw new MarketplaceRootValidationError(candidate, 'marketplace path cannot be inspected.', 'unreadable', error);
+    }
+    if (!rootStats)
+        return null;
+    if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) {
+        throw new MarketplaceRootValidationError(root, 'marketplace root must be a regular directory.', 'unsafe');
+    }
+    let physicalRoot;
+    let physicalCandidate;
+    try {
+        [physicalRoot, physicalCandidate] = await Promise.all([
+            canonicalizePathThroughExistingAncestor(root),
+            canonicalizePathThroughExistingAncestor(candidate),
+        ]);
+    }
+    catch (error) {
+        throw new MarketplaceRootValidationError(candidate, 'marketplace path cannot be resolved.', 'unreadable', error);
+    }
+    try {
+        assertMarketplacePathBoundary(physicalRoot, physicalCandidate);
+    }
+    catch {
+        throw new MarketplaceRootValidationError(candidate, 'marketplace physical path escapes its trusted root.', 'unsafe');
+    }
+    if (!candidateStats)
+        return null;
+    const valid = finalKind === 'file'
+        ? candidateStats.isFile() && !candidateStats.isSymbolicLink()
+        : candidateStats.isDirectory() && !candidateStats.isSymbolicLink();
+    if (!valid) {
+        throw new MarketplaceRootValidationError(candidate, finalKind === 'file'
+            ? 'marketplace JSON target must be a regular file.'
+            : 'marketplace path must be a regular directory.', 'unsafe');
     }
     return candidateStats;
 }
@@ -113,28 +156,14 @@ async function readStrictOptionalJsonObject(trustedRoot, filePath) {
     try {
         const value = await fs.readJson(filePath);
         if (!isRecord(value)) {
-            throw new MarketplaceRootValidationError(filePath, 'marketplace JSON must contain an object.');
+            throw new MarketplaceRootValidationError(filePath, 'marketplace JSON must contain an object.', 'invalid');
         }
         return value;
     }
     catch (error) {
         if (error instanceof MarketplaceRootValidationError)
             throw error;
-        throw new MarketplaceRootValidationError(filePath, 'marketplace JSON cannot be read.', error);
-    }
-}
-async function readOptionalJsonObject(filePath) {
-    try {
-        const value = await fs.readJson(filePath);
-        if (!isRecord(value))
-            throw new Error(`Expected a JSON object at ${filePath}.`);
-        return value;
-    }
-    catch (error) {
-        const code = error.code;
-        if (code === 'ENOENT' || code === 'ENOTDIR')
-            return null;
-        throw error;
+        throw new MarketplaceRootValidationError(filePath, 'marketplace JSON cannot be read.', error instanceof SyntaxError ? 'invalid' : 'unreadable', error);
     }
 }
 export async function readStrictNamespacedMarketplaceRoot(options) {
@@ -149,10 +178,12 @@ export async function readStrictNamespacedMarketplaceRoot(options) {
         || config.sourceId.length === 0
         || typeof config.sourceIdentity !== 'string'
         || !SOURCE_IDENTITY_PATTERN.test(config.sourceIdentity)
+        || (config.logicalIdentity !== undefined
+            && (typeof config.logicalIdentity !== 'string' || config.logicalIdentity.trim() === ''))
         || typeof config.marketplaceName !== 'string'
         || config.marketplaceName.length === 0
         || config.sourceId !== path.basename(options.rootDir)) {
-        throw new MarketplaceRootValidationError(configPath, 'marketplace config must contain a canonical schema 2 identity.');
+        throw new MarketplaceRootValidationError(configPath, 'marketplace config must contain a canonical schema 2 identity.', 'invalid');
     }
     if ((options.sourceId !== undefined && config.sourceId !== options.sourceId)
         || (options.sourceIdentity !== undefined && config.sourceIdentity !== options.sourceIdentity)
@@ -161,11 +192,11 @@ export async function readStrictNamespacedMarketplaceRoot(options) {
     }
     const agentsManifest = await readStrictOptionalJsonObject(trustedMarketplaceRoot, path.join(options.rootDir, '.agents', 'plugins', 'marketplace.json'));
     if (!agentsManifest || agentsManifest.name !== config.marketplaceName) {
-        throw new MarketplaceRootValidationError(path.join(options.rootDir, '.agents', 'plugins', 'marketplace.json'), 'Codex marketplace manifest name does not match config.');
+        throw new MarketplaceRootValidationError(path.join(options.rootDir, '.agents', 'plugins', 'marketplace.json'), 'Codex marketplace manifest name does not match config.', 'invalid');
     }
     const claudeManifest = await readStrictOptionalJsonObject(trustedMarketplaceRoot, path.join(options.rootDir, '.claude-plugin', 'marketplace.json'));
     if (claudeManifest && claudeManifest.name !== config.marketplaceName) {
-        throw new MarketplaceRootValidationError(path.join(options.rootDir, '.claude-plugin', 'marketplace.json'), 'Claude marketplace manifest name does not match config.');
+        throw new MarketplaceRootValidationError(path.join(options.rootDir, '.claude-plugin', 'marketplace.json'), 'Claude marketplace manifest name does not match config.', 'invalid');
     }
     return {
         rootDir: options.rootDir,
@@ -176,8 +207,14 @@ export async function readStrictNamespacedMarketplaceRoot(options) {
 }
 function normalizePluginRelativeDirectory(value, fallback) {
     const raw = typeof value === 'string' ? value : fallback;
-    const normalized = path.posix.normalize(raw.replace(/^\.\//, ''));
-    if (!normalized || normalized === '.' || normalized === '..' || normalized.startsWith('../')) {
+    const normalizedSeparators = raw.replace(/\\/gu, '/');
+    const normalized = path.posix.normalize(normalizedSeparators.replace(/^\.\//, ''));
+    if (!normalized
+        || normalized === '.'
+        || normalized === '..'
+        || normalized.startsWith('../')
+        || path.posix.isAbsolute(normalizedSeparators)
+        || path.win32.isAbsolute(raw)) {
         return null;
     }
     return normalized;
@@ -190,19 +227,258 @@ async function assertTreeHasNoSymlinks(root) {
             await assertTreeHasNoSymlinks(path.join(root, entry.name));
     }
 }
-async function pathExists(filePath) {
+class CodexNativeProjectionNotReusableError extends Error {
+}
+function nativeCodexTargets(manifest) {
+    const targets = manifest.artifacts?.targets ?? [];
+    if (!Array.isArray(targets))
+        return [];
+    return targets.flatMap((target) => {
+        if (!isRecord(target)
+            || target.platform !== 'codex'
+            || target.target !== 'codex.skill'
+            || !isRecord(target.delivery)
+            || target.delivery.mode !== 'codex-native'
+            || typeof target.id !== 'string'
+            || typeof target.skillKey !== 'string')
+            return [];
+        return [{ id: target.id, skillKey: target.skillKey }];
+    }).sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0);
+}
+async function assertRegularProjectionTree(root, rejectOwnerMarker = false) {
+    for (const entry of await fs.readdir(root, { withFileTypes: true })) {
+        if (entry.isSymbolicLink() || (!entry.isDirectory() && !entry.isFile())) {
+            throw new Error(`codexNativeProjectionUnsafe: projection contains an unsafe node: ${entry.name}`);
+        }
+        if (rejectOwnerMarker && entry.name === '.agent-workflows-owner.json') {
+            throw new Error('codexNativeProjectionUnsafe: native Skill cannot contain an AW owner marker.');
+        }
+        if (entry.isDirectory()) {
+            await assertRegularProjectionTree(path.join(root, entry.name), rejectOwnerMarker);
+        }
+    }
+}
+async function readProjectionJson(trustedRoot, filePath) {
+    const stats = await inspectMarketplacePath(trustedRoot, filePath, 'file');
+    if (!stats)
+        throw new CodexNativeProjectionNotReusableError();
     try {
-        await fs.lstat(filePath);
-        return true;
+        const value = await fs.readJson(filePath);
+        if (!isRecord(value))
+            throw new CodexNativeProjectionNotReusableError();
+        return value;
     }
     catch (error) {
-        const code = error.code;
-        if (code === 'ENOENT' || code === 'ENOTDIR')
-            return false;
-        throw error;
+        if (error instanceof CodexNativeProjectionNotReusableError)
+            throw error;
+        if (error.code)
+            throw error;
+        throw new CodexNativeProjectionNotReusableError();
     }
 }
-async function readOverlayDirectory(directoryPath, redactedRoots) {
+async function preserveMarketplacePluginProjection(options) {
+    const sourcePluginRoot = path.join(options.sourceRoot, 'plugins', options.pluginName);
+    const stagingPluginRoot = path.join(options.stagingRoot, 'plugins', options.pluginName);
+    const sourceManifest = await readProjectionJson(options.sourceRoot, path.join(sourcePluginRoot, '.agents-plugin', 'plugin.json'));
+    const sourceTargets = nativeCodexTargets(sourceManifest);
+    if (sourceTargets.length === 0) {
+        await assertRegularProjectionTree(sourcePluginRoot);
+        if (sourceManifest.name !== options.pluginName) {
+            throw new Error('marketplaceProjectionIdentityMismatch: plugin identity does not match its marketplace path.');
+        }
+        if (!await inspectMarketplacePath(options.stagingRoot, stagingPluginRoot, 'directory')) {
+            throw new CodexNativeProjectionNotReusableError();
+        }
+        const stagingManifest = await readProjectionJson(options.stagingRoot, path.join(stagingPluginRoot, '.agents-plugin', 'plugin.json'));
+        if (stagingManifest.name !== options.pluginName) {
+            throw new Error('marketplaceProjectionIdentityMismatch: plugin identity does not match its marketplace path.');
+        }
+        for (const platform of ['codex', 'claude']) {
+            const manifestPath = path.join(sourcePluginRoot, `.${platform}-plugin`, 'plugin.json');
+            if (!await inspectMarketplacePath(options.sourceRoot, manifestPath, 'file'))
+                continue;
+            const manifest = await readProjectionJson(options.sourceRoot, manifestPath);
+            if (manifest.name !== options.pluginName) {
+                throw new Error('marketplaceProjectionIdentityMismatch: plugin identity does not match its marketplace path.');
+            }
+            if (manifest.version !== sourceManifest.version)
+                throw new CodexNativeProjectionNotReusableError();
+        }
+        await assertRegularProjectionTree(stagingPluginRoot);
+        await fs.remove(stagingPluginRoot);
+        await fs.copy(sourcePluginRoot, stagingPluginRoot, { dereference: false });
+        return;
+    }
+    await assertRegularProjectionTree(sourcePluginRoot);
+    const sourceCodexManifest = await readProjectionJson(options.sourceRoot, path.join(sourcePluginRoot, '.codex-plugin', 'plugin.json'));
+    if (sourceManifest.name !== options.pluginName || sourceCodexManifest.name !== options.pluginName) {
+        throw new Error('codexNativeProjectionIdentityMismatch: plugin identity does not match its marketplace path.');
+    }
+    const sourceSkillsRelative = normalizePluginRelativeDirectory(sourceCodexManifest.skills, 'codex/skills');
+    if (!sourceSkillsRelative) {
+        throw new Error('codexNativeProjectionUnsafe: Codex Skills root is unsafe.');
+    }
+    const receiptPath = path.join(sourcePluginRoot, CODEX_NATIVE_RENDER_RECEIPT_PATH);
+    const receiptStats = await inspectMarketplacePath(options.sourceRoot, receiptPath, 'file');
+    if (!receiptStats)
+        throw new CodexNativeProjectionNotReusableError();
+    let receipt;
+    try {
+        const receiptContent = await fs.readFile(receiptPath, 'utf8');
+        receipt = parseCodexNativeRenderReceipt(receiptContent);
+    }
+    catch (error) {
+        if (error.code)
+            throw error;
+        throw new CodexNativeProjectionNotReusableError();
+    }
+    const logicalPluginId = `${options.sourceId}/${options.pluginName}`;
+    if (receipt.logicalPluginId !== logicalPluginId || receipt.sourceIdentity !== options.sourceIdentity) {
+        throw new Error('codexNativeProjectionIdentityMismatch: receipt identity does not match its marketplace.');
+    }
+    if (!await inspectMarketplacePath(options.stagingRoot, stagingPluginRoot, 'directory')) {
+        throw new CodexNativeProjectionNotReusableError();
+    }
+    await assertRegularProjectionTree(stagingPluginRoot);
+    const stagingManifest = await readProjectionJson(options.stagingRoot, path.join(stagingPluginRoot, '.agents-plugin', 'plugin.json'));
+    if (stagingManifest.name !== options.pluginName) {
+        throw new Error('codexNativeProjectionIdentityMismatch: plugin identity does not match its marketplace path.');
+    }
+    if (sourceManifest.version !== receipt.pluginVersion
+        || sourceCodexManifest.version !== receipt.pluginVersion) {
+        throw new CodexNativeProjectionNotReusableError();
+    }
+    const receiptTargetIdentity = receipt.targets.map(({ id, skillKey }) => ({ id, skillKey }));
+    if (JSON.stringify(sourceTargets) !== JSON.stringify(receiptTargetIdentity)) {
+        throw new CodexNativeProjectionNotReusableError();
+    }
+    const sourceSkillsRoot = path.join(sourcePluginRoot, ...sourceSkillsRelative.split('/'));
+    const emptyArtifactDigest = createCodexSkillStagingTreeContentDigest({ skillKey: 'empty', files: {} });
+    for (const target of receipt.targets) {
+        const skillRoot = path.join(sourceSkillsRoot, target.skillKey);
+        const stats = await inspectMarketplacePath(options.sourceRoot, skillRoot, 'directory');
+        if (stats)
+            await assertRegularProjectionTree(skillRoot, true);
+        let tree;
+        try {
+            tree = stats ? await readDynamicSkillTree(skillRoot, 'codex.skill') : null;
+        }
+        catch (error) {
+            if (error.code)
+                throw error;
+            throw new CodexNativeProjectionNotReusableError();
+        }
+        if ((stats && !tree)
+            || (tree ? createCodexSkillStagingTreeContentDigest(tree) : emptyArtifactDigest) !== target.artifactDigest) {
+            throw new CodexNativeProjectionNotReusableError();
+        }
+    }
+    if (await calculateCodexNativeRenderPayloadDigest(sourcePluginRoot) !== receipt.payloadDigest) {
+        throw new CodexNativeProjectionNotReusableError();
+    }
+    const temporaryRoot = await fs.mkdtemp(path.join(options.stagingRoot, '.native-projection-'));
+    const candidateRoot = path.join(temporaryRoot, options.pluginName);
+    try {
+        // An unrelated operation must retain the installed version and its render inputs together.
+        await fs.copy(sourcePluginRoot, candidateRoot, { dereference: false });
+        if (await calculateCodexNativeRenderPayloadDigest(candidateRoot) !== receipt.payloadDigest) {
+            throw new CodexNativeProjectionNotReusableError();
+        }
+        await fs.remove(stagingPluginRoot);
+        await fs.move(candidateRoot, stagingPluginRoot);
+    }
+    finally {
+        await fs.remove(temporaryRoot).catch(() => undefined);
+    }
+}
+/**
+ * Replays unselected plugin copies into a fresh Catalog generation.
+ * Retains their payload and marketplace entries even when the Catalog changes.
+ * Codex native dynamic projections must also retain their original validated receipt.
+ * Damaged weak projections are skipped so their owning plugin can recover by sync.
+ */
+export async function replayNamespacedMarketplacePluginProjections(options) {
+    let existing;
+    try {
+        existing = await readStrictNamespacedMarketplaceRoot({
+            trustedMarketplaceRoot: path.dirname(options.sourceRoot),
+            rootDir: options.sourceRoot,
+            sourceId: options.sourceId,
+            sourceIdentity: options.sourceIdentity,
+            marketplaceName: options.marketplaceName,
+        });
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith('sourceChanged:'))
+            throw error;
+        throw new Error(`marketplaceProjectionReadFailed: ${sanitizeCatalogSourceErrorMessage(error instanceof Error ? error.message : String(error), process.env, [options.sourceRoot, options.stagingRoot])}`);
+    }
+    if (!existing)
+        return;
+    const retainedPluginNames = new Set();
+    const pluginsRoot = path.join(options.sourceRoot, 'plugins');
+    let entries;
+    try {
+        entries = await readOverlayDirectory(options.sourceRoot, pluginsRoot, [options.sourceRoot, options.stagingRoot]);
+    }
+    catch (error) {
+        throw new Error(`marketplaceProjectionReadFailed: ${sanitizeCatalogSourceErrorMessage(error instanceof Error ? error.message : String(error), process.env, [options.sourceRoot, options.stagingRoot])}`);
+    }
+    for (const entry of entries) {
+        if (entry.isSymbolicLink()) {
+            throw new Error('codexNativeProjectionUnsafe: plugin root cannot be a symlink.');
+        }
+        if (!entry.isDirectory())
+            continue;
+        const logicalPluginId = `${options.sourceId}/${entry.name}`;
+        if (options.rematerializedPluginIds?.has(logicalPluginId))
+            continue;
+        try {
+            await preserveMarketplacePluginProjection({ ...options, pluginName: entry.name });
+            retainedPluginNames.add(entry.name);
+        }
+        catch (error) {
+            if (error instanceof CodexNativeProjectionNotReusableError)
+                continue;
+            throw new Error(`marketplaceProjectionReadFailed: ${sanitizeCatalogSourceErrorMessage(error instanceof Error ? error.message : String(error), process.env, [options.sourceRoot, options.stagingRoot])}`);
+        }
+    }
+    for (const [sourceManifest, relativePath] of [
+        [existing.agentsManifest, '.agents/plugins/marketplace.json'],
+        [existing.claudeManifest, '.claude-plugin/marketplace.json'],
+    ]) {
+        const manifestPath = path.join(options.stagingRoot, relativePath);
+        const stagingManifest = await readStrictOptionalJsonObject(options.stagingRoot, manifestPath);
+        if (!stagingManifest || retainedPluginNames.size === 0)
+            continue;
+        if (!Array.isArray(stagingManifest.plugins) || (sourceManifest && !Array.isArray(sourceManifest.plugins))) {
+            throw new Error('marketplaceProjectionInvalid: marketplace plugins must be an array.');
+        }
+        const retainedEntries = (sourceManifest?.plugins ?? []).filter((entry) => isRecord(entry)
+            && typeof entry.name === 'string' && retainedPluginNames.has(entry.name));
+        await fs.writeJson(manifestPath, {
+            ...stagingManifest,
+            plugins: [
+                ...stagingManifest.plugins.filter((entry) => !isRecord(entry) || !retainedPluginNames.has(String(entry.name))),
+                ...retainedEntries.map((entry) => ({
+                    ...entry,
+                    source: `./plugins/${entry.name}`,
+                })),
+            ],
+        }, { spaces: 2 });
+    }
+}
+async function inspectOverlayPath(trustedRoot, targetPath, finalKind, redactedRoots) {
+    try {
+        return await inspectMarketplacePath(trustedRoot, targetPath, finalKind);
+    }
+    catch (error) {
+        throw new Error(`marketplaceOverlayReadFailed: ${sanitizeCatalogSourceErrorMessage(error instanceof Error ? error.message : String(error), process.env, redactedRoots)}`);
+    }
+}
+async function readOverlayDirectory(trustedRoot, directoryPath, redactedRoots) {
+    if (!await inspectOverlayPath(trustedRoot, directoryPath, 'directory', redactedRoots))
+        return [];
     try {
         return await fs.readdir(directoryPath, { withFileTypes: true });
     }
@@ -233,7 +509,7 @@ export async function replayNamespacedCodexSkillOverlays(options) {
         return;
     const pluginsRoot = path.join(options.sourceRoot, 'plugins');
     const redactedRoots = [options.sourceRoot, options.stagingRoot];
-    for (const pluginEntry of await readOverlayDirectory(pluginsRoot, redactedRoots)) {
+    for (const pluginEntry of await readOverlayDirectory(options.sourceRoot, pluginsRoot, redactedRoots)) {
         if (pluginEntry.isSymbolicLink()) {
             throw new Error(`Codex Skill overlay plugin root cannot be a symlink: ${pluginEntry.name}`);
         }
@@ -241,28 +517,25 @@ export async function replayNamespacedCodexSkillOverlays(options) {
             continue;
         const pluginName = pluginEntry.name;
         const sourcePluginRoot = path.join(pluginsRoot, pluginName);
-        const sourcePlatformManifest = await readOptionalJsonObject(path.join(sourcePluginRoot, '.codex-plugin', 'plugin.json'));
+        const sourcePlatformManifest = await readStrictOptionalJsonObject(options.sourceRoot, path.join(sourcePluginRoot, '.codex-plugin', 'plugin.json'));
         const sourceSkillsRelative = normalizePluginRelativeDirectory(sourcePlatformManifest?.skills, 'codex/skills');
         if (!sourceSkillsRelative)
             continue;
         const sourceSkillsRoot = path.join(sourcePluginRoot, ...sourceSkillsRelative.split('/'));
         const overlays = [];
-        for (const entry of await readOverlayDirectory(sourceSkillsRoot, redactedRoots)) {
+        for (const entry of await readOverlayDirectory(options.sourceRoot, sourceSkillsRoot, redactedRoots)) {
             if (entry.isSymbolicLink()) {
                 throw new Error(`Codex Skill overlay cannot be a symlink: ${path.join(sourceSkillsRoot, entry.name)}`);
             }
             if (!entry.isDirectory())
                 continue;
             const skillRoot = path.join(sourceSkillsRoot, entry.name);
-            if (!await pathExists(path.join(skillRoot, SKILL_OWNER_MARKER)))
-                continue;
-            await readSkillOwnerMarker({
+            const owner = await readSkillOwnerMarker({
                 skillRoot,
                 allowedRoot: sourceSkillsRoot,
                 expectedIdentity: {
                     owner: 'agent-workflows',
                     sourceId: options.sourceId,
-                    sourceIdentity: options.sourceIdentity,
                     pluginId: `${options.sourceId}/${pluginName}`,
                     plugin: pluginName,
                     artifactKey: entry.name,
@@ -270,47 +543,44 @@ export async function replayNamespacedCodexSkillOverlays(options) {
                     scope: 'user',
                 },
             });
+            if (!owner)
+                continue;
             overlays.push({ key: entry.name, root: skillRoot });
         }
         if (overlays.length === 0)
             continue;
         const stagingPluginRoot = path.join(options.stagingRoot, 'plugins', pluginName);
-        if (!await pathExists(stagingPluginRoot)) {
-            await assertTreeHasNoSymlinks(sourcePluginRoot);
-            await fs.copy(sourcePluginRoot, stagingPluginRoot, {
-                overwrite: false, errorOnExist: true, dereference: false,
-            });
+        if (!await inspectOverlayPath(options.stagingRoot, stagingPluginRoot, 'directory', redactedRoots))
             continue;
-        }
-        const stagingManifest = await readOptionalJsonObject(path.join(stagingPluginRoot, '.agents-plugin', 'plugin.json'));
+        const stagingManifest = await readStrictOptionalJsonObject(options.stagingRoot, path.join(stagingPluginRoot, '.agents-plugin', 'plugin.json'));
         const targets = stagingManifest?.artifacts?.targets ?? [];
         const dynamicKeys = new Set(targets.flatMap((target) => {
             if (!isRecord(target))
                 return [];
             return target.platform === 'codex'
                 && target.target === 'codex.skill'
+                && isRecord(target.delivery)
+                && target.delivery.mode === 'codex-native'
                 && Array.isArray(target.scopes)
                 && target.scopes.includes('user')
                 && typeof target.skillKey === 'string'
                 ? [target.skillKey]
                 : [];
         }));
-        const stagingPlatformManifest = await readOptionalJsonObject(path.join(stagingPluginRoot, '.codex-plugin', 'plugin.json'));
+        const stagingPlatformManifest = await readStrictOptionalJsonObject(options.stagingRoot, path.join(stagingPluginRoot, '.codex-plugin', 'plugin.json'));
         const stagingSkillsRelative = normalizePluginRelativeDirectory(stagingPlatformManifest?.skills, 'codex/skills');
         if (!stagingSkillsRelative)
             continue;
         const stagingSkillsRoot = path.join(stagingPluginRoot, ...stagingSkillsRelative.split('/'));
+        await inspectOverlayPath(options.stagingRoot, stagingSkillsRoot, 'directory', redactedRoots);
         for (const overlay of overlays) {
+            if (!dynamicKeys.has(overlay.key))
+                continue;
             const destination = path.join(stagingSkillsRoot, overlay.key);
-            if (dynamicKeys.has(overlay.key) || !await pathExists(destination)) {
-                await assertTreeHasNoSymlinks(overlay.root);
-                await fs.copy(overlay.root, destination, {
-                    overwrite: true, errorOnExist: false, dereference: false,
-                });
-            }
-            else {
-                await fs.copyFile(path.join(overlay.root, SKILL_OWNER_MARKER), path.join(destination, SKILL_OWNER_MARKER));
-            }
+            await assertTreeHasNoSymlinks(overlay.root);
+            await fs.copy(overlay.root, destination, {
+                overwrite: true, errorOnExist: false, dereference: false,
+            });
         }
     }
 }