@openrig/cli 0.7.0 → 0.7.1

package/daemon/dist/adapters/codex-runtime-adapter.js

@@ -1,3 +1,4 @@
+import { codexEnvelopeArgs } from "../domain/codex-rebuild-permissions.js";
 import { operationalLaunchArg } from "./kernel-authority.js";
 import nodePath from "node:path";
 import fs from "node:fs";
@@ -5,6 +6,7 @@ import { createHash } from "node:crypto";
 import { execFile } from "node:child_process";
 import { createRequire } from "node:module";
 import os from "node:os";
+import { isDeepStrictEqual } from "node:util";
 import { parse as parseToml } from "smol-toml";
 import { codexPostureArg } from "./yolo-mode.js";
 import { resolveConcreteHint } from "../domain/runtime-adapter.js";
@@ -14,7 +16,7 @@ import { assessNativeResumeProbe, buildCodexResumeCore, hasCodexUpdateHeader } f
 import { unknownDaemonSupportMessage } from "../domain/codex-daemon-support.js";
 import { CODEX_NETWORK_DEFAULT_OVERRIDE, codexNetworkDefaultArg } from "../domain/codex-network-default.js";
 import { resolveCodexGitAddDirs } from "../domain/codex-git-add-dirs.js";
-import { mergeManagedBlock } from "../domain/managed-blocks.js";
+import { isPerSeatRoleGuidance, mergeManagedBlock, perSeatRoleSkipWarning } from "../domain/managed-blocks.js";
 import { excludeNewGeneratedFiles } from "../domain/generated-file-hygiene.js";
 import { codexQueueStateRoot, codexTeamWorkspaceArg } from "../domain/codex-team-workspace.js";
 import { shellQuote } from "./shell-quote.js";
@@ -32,6 +34,8 @@ const defaultCodexCli = (args, env) => new Promise((resolve) => {
 // Codex's hook trust recipe (the key and hash Codex records for a trusted hook), kept in one script.
 const codexHookTrust = createRequire(import.meta.url)("../../assets/plugins/openrig-core/hooks/scripts/codex-hook-trust.cjs");
 import { listNativeProcesses, observeCodexPaneProcess, observeCodexForkProcess, verifyPaneIdleShell } from "../domain/native-process-lineage.js";
+import { recordSeatSkillWrite, seatPluginSkillsLossNote, seatProjectionComplete, seatSkillWriteRefusal } from "../domain/seat-skill-storage.js";
+import { codexPluginContentHash, planOwnedCodexContentApproval, recordOwnedCodexApproval } from "../domain/codex-owned-plugin-trust.js";
 // The managed resume check's poll window: a quick phase, then an extended one for a slow boot.
 const RESUME_QUICK_ATTEMPTS = 6;
 const RESUME_EXTENDED_ATTEMPTS = 24;
@@ -88,6 +92,7 @@ export class CodexRuntimeAdapter {
     // so each of those runs its whole setup under this one lock, one after another.
     configLock = Promise.resolve();
     codexSystemConfigDir;
+    /** Build the Codex launch adapter with injectable filesystem, process, and CLI seams for isolated checks. */
     constructor(deps) {
         this.resolveCorePluginDir = deps.resolveCorePluginDir;
         this.resolveCorePluginSelected = deps.resolveCorePluginSelected;
@@ -183,9 +188,9 @@ export class CodexRuntimeAdapter {
     }
     /**
      * Install the vendored openrig-core plugin into Codex through Codex's own commands, so a seat that selected it gets its
-     * refocus and skills, trusting only exact shipped hooks on its first install. It runs only when the person's config
+     * refocus and skills, trusting exact shipped hooks on first install and renewing proven owned content approvals. It runs only when the person's config
      * doesn't disable the plugin (codexCorePluginEnablement), and only when the installed version differs from the vendored
-     * one. Codex owns its plugin cache; OpenRig writes the marketplace manifest and first-install exact-hook trust.
+     * one. Codex owns its plugin cache; its immutable legacy trust baseline is never rewritten.
      */
     async ensureCodexCorePlugin() {
         const report = (outcome, reason) => {
@@ -228,8 +233,17 @@ export class CodexRuntimeAdapter {
         });
         if (!matchesShipped(pluginDir))
             return report("skipped", "vendored hook files differ from this daemon's shipped plugin; existing choices are left alone");
+        // Installation retains the hook-file predicate; any approval requires the complete shipped tree.
+        const matchesShippedTree = (dir) => {
+            try {
+                return codexPluginContentHash(dir, true) === codexPluginContentHash(shipped, true);
+            }
+            catch {
+                return false;
+            }
+        };
         const codexHome = nodePath.dirname(this.resolveCodexConfigPath());
-        const layers = codexReadableConfigLayers(codexHome, this.codexSystemConfigDir).map((layer) => {
+        const readLayers = () => codexReadableConfigLayers(codexHome, this.codexSystemConfigDir).map((layer) => {
             if (!this.fs.exists(layer.path))
                 return { ...layer, state: "absent" };
             try {
@@ -239,6 +253,7 @@ export class CodexRuntimeAdapter {
                 return { ...layer, state: "unreadable", reason: error.message };
             }
         });
+        const layers = readLayers();
         const enablement = codexCorePluginEnablement(layers);
         if (enablement.decision !== "allow")
             return report("skipped", enablement.reason);
@@ -263,11 +278,44 @@ export class CodexRuntimeAdapter {
         const cachedDir = nodePath.join(cacheRoot, version);
         const cached = this.fs.exists(cachedDir);
         // Codex's "continue without trusting" choice writes no state. An existing install/configuration may therefore be a
-        // decline even with no hooks.state entry. Only the very first installation earns automatic trust; reinstalls and
-        // upgrades retain whatever native choices already exist, including an unrecorded decline.
+        // decline even with no hooks.state entry. Absent grants still stay under native review. A proven owned grant may
+        // renew its content approval; an unrecorded skip of that exact owned upgrade cannot be distinguished from pending approval.
         const firstInstall = !this.fs.exists(cacheRoot) && !layers.some(layer => layer.state === "read"
             && Object.hasOwn((parseToml(layer.content).plugins ?? {}), CODEX_CORE_PLUGIN_KEY));
+        const renewContentApproval = (freshGrant = false) => {
+            const configPath = this.resolveCodexConfigPath();
+            const currentLayers = readLayers();
+            if (codexCorePluginEnablement(currentLayers).decision !== "allow")
+                return;
+            const before = this.fs.readFile(configPath);
+            const currentSource = recordedMarketplaceSource(before);
+            if (currentSource == null || canonical(currentSource) !== canonical(pluginsDir) || !userLayerEnablesCorePlugin(before))
+                return;
+            let content = before;
+            const planned = planOwnedCodexContentApproval({ configPath, content, layers: currentLayers, shipped, installed: cachedDir, freshGrant });
+            if (!planned)
+                return;
+            for (const [key, hash] of Object.entries(planned.hashes))
+                content = upsertCodexHookTrust(content, key, hash, "trusted_content_hash");
+            // The line writer must not alter examples in strings or duplicate quoted keys.
+            try {
+                const expected = parseToml(before);
+                for (const [key, hash] of Object.entries(planned.hashes))
+                    expected.hooks.state[key].trusted_content_hash = hash;
+                if (!isDeepStrictEqual(parseToml(content), expected))
+                    return;
+            }
+            catch {
+                return;
+            } // Leave native review and owner bytes intact for unsupported TOML spellings.
+            if (this.fs.readFile(configPath) !== before)
+                return; // A concurrent native choice wins.
+            if (content !== before)
+                this.fs.writeFile(configPath, content);
+            recordOwnedCodexApproval(configPath, planned.approval);
+        };
         if (cached && recorded !== undefined && userLayerEnablesCorePlugin(userConfig)) {
+            renewContentApproval();
             return report("current", `${CODEX_CORE_PLUGIN_KEY} ${version} is installed and registered`);
         }
         const manifestPath = nodePath.join(pluginsDir, CODEX_MARKETPLACE_MANIFEST_PATH);
@@ -285,9 +333,11 @@ export class CodexRuntimeAdapter {
         const installed = await this.runCodexCli(["plugin", "add", CODEX_CORE_PLUGIN_KEY], env);
         if (installed.status !== 0)
             return report("skipped", `codex plugin add failed: ${(installed.stderr || installed.stdout).trim() || `exit ${installed.status}`}`);
-        // Trust is over normalized definitions, not script contents. Byte equality is an additional pre-grant check;
-        // Codex remains responsible for later native review if definitions change. No cache files are rewritten here.
-        if (firstInstall && matchesShipped(cachedDir)) {
+        // First install grants declarations; Codex0.164 also requires full-bundle content approval. Existing declaration
+        // choices are never rewritten. No cache files or native baseline files are rewritten here.
+        let freshGrants = 0;
+        const grantLayers = readLayers();
+        if (firstInstall && codexCorePluginEnablement(grantLayers).decision === "allow" && matchesShippedTree(cachedDir)) {
             let content = this.fs.readFile(this.resolveCodexConfigPath());
             const hookManifest = JSON.parse(fs.readFileSync(nodePath.join(shipped, "hooks/codex.json"), "utf8"));
             for (const [event, groups] of Object.entries(hookManifest.hooks)) {
@@ -303,13 +353,15 @@ export class CodexRuntimeAdapter {
                         const value = doc;
                         return Object.hasOwn(value.hooks?.state ?? {}, key) || Object.values(doc).some(hasChoice);
                     };
-                    if (!hasChoice(parseToml(content)) && !layers.some(layer => layer.state === "read" && hasChoice(parseToml(layer.content)))) {
+                    if (!hasChoice(parseToml(content)) && !grantLayers.some(layer => layer.state === "read" && hasChoice(parseToml(layer.content)))) {
                         content = upsertCodexHookTrust(content, key, hash);
+                        freshGrants++;
                     }
                 }));
             }
             this.fs.writeFile(this.resolveCodexConfigPath(), content);
         }
+        renewContentApproval(freshGrants === 6);
         return report("installed", `${CODEX_CORE_PLUGIN_KEY} ${version} through Codex's own install (${enablement.reason})`);
     }
     /**
@@ -452,7 +504,7 @@ export class CodexRuntimeAdapter {
     }
     async listInstalled(binding) {
         const results = [];
-        const skillsDir = nodePath.join(binding.cwd, ".agents", "skills");
+        const skillsDir = binding.seatSkillsRoot ?? nodePath.join(binding.cwd, ".agents", "skills");
         if (this.fs.exists(skillsDir) && this.fs.listFiles) {
             for (const file of this.fs.listFiles(skillsDir)) {
                 results.push({ effectiveId: file, category: "skill", installedPath: nodePath.join(skillsDir, file) });
@@ -471,7 +523,7 @@ export class CodexRuntimeAdapter {
                 continue;
             }
             try {
-                const didProject = this.projectEntry(entry, binding.cwd, warnings);
+                const didProject = this.projectEntry(entry, binding.cwd, warnings, binding.seatSkillsRoot, binding.seatSkillsRefused);
                 if (didProject) {
                     projected.push(entry.effectiveId);
                 }
@@ -498,7 +550,7 @@ export class CodexRuntimeAdapter {
         for (const file of files) {
             try {
                 const content = this.fs.readFile(file.absolutePath);
-                const hint = file.deliveryHint === "auto" ? this.detectDeliveryHint(file.path, content) : file.deliveryHint;
+                const hint = file.deliveryHint === "auto" ? this.detectDeliveryHint(file.path, content, file.orientation) : file.deliveryHint;
                 switch (hint) {
                     case "guidance_merge": {
                         const targetPath = nodePath.join(binding.cwd, "AGENTS.md");
@@ -508,9 +560,18 @@ export class CodexRuntimeAdapter {
                         break;
                     }
                     case "skill_install": {
-                        const targetDir = nodePath.join(binding.cwd, ".agents", "skills", nodePath.basename(nodePath.dirname(file.absolutePath)));
+                        const targetDir = nodePath.join(binding.seatSkillsRoot ?? nodePath.join(binding.cwd, ".agents", "skills"), nodePath.basename(nodePath.dirname(file.absolutePath)));
+                        const skillTarget = nodePath.join(targetDir, nodePath.basename(file.path));
+                        // OPR.0.7.0.13: never write through a link out of the seat's storage.
+                        const refusal = binding.seatSkillsRoot ? binding.seatSkillsRefused ?? seatSkillWriteRefusal(binding.seatSkillsRoot, skillTarget) : undefined;
+                        if (refusal) {
+                            warnings.push(`skill_install: ${refusal}`);
+                            continue;
+                        }
                         this.fs.mkdirp(targetDir);
-                        this.fs.writeFile(nodePath.join(targetDir, nodePath.basename(file.path)), content);
+                        this.fs.writeFile(skillTarget, content);
+                        if (binding.seatSkillsRoot)
+                            recordSeatSkillWrite(binding.seatSkillsRoot, skillTarget, file.absolutePath, content);
                         break;
                     }
                     case "send_text": {
@@ -548,7 +609,7 @@ export class CodexRuntimeAdapter {
         const prepared = await this.prepareLaunch(binding, opts.name, undefined, { installCorePlugin: !opts.resumeToken });
         if (!prepared.ok)
             return prepared;
-        const { modelArg, effortArg, appliedLaunch, postureArg, queueStateDirArg, daemonArg, networkArg } = prepared;
+        const { modelArg, effortArg, appliedLaunch, postureArg, queueStateDirArg, daemonArg, networkArg, suppressAutoAddDirs } = prepared;
         // Fork branch: `codex fork <parent_thread_id>`. Captures the NEW thread id
         // post-fork. Parent thread id is NOT persisted onto the new seat record
         // (identity-honesty bedrock).
@@ -602,9 +663,9 @@ export class CodexRuntimeAdapter {
         // -s danger-full-access (overrides even a named profile); otherwise the named profile, or
         // OpenRig's explicit -s workspace-write floor flag.
         // Issue #121: only the fresh launch adds git metadata dirs; resume and fork never did.
-        const gitDirArg = opts.resumeToken
+        const gitDirArg = opts.resumeToken || binding.codexRebuildPermissions
             ? ""
-            : (await this.resolveGitAddDirs(binding.cwd)).map((dir) => ` --add-dir ${shellQuote(dir)}`).join("");
+            : suppressAutoAddDirs ? "" : (await this.resolveGitAddDirs(binding.cwd)).map((dir) => ` --add-dir ${shellQuote(dir)}`).join("");
         const cmd = opts.resumeToken
             // 0.5.2-07 A2-3: the pod-aware RESUME path threads the SPEC model too (reverted before — the
             // grounding map assumed codex parity with the claude adapter, but only fresh emitted -m).
@@ -683,13 +744,19 @@ export class CodexRuntimeAdapter {
         const effortArg = effort ? ` -c ${shellQuote(`model_reasoning_effort="${effort}"`)}` : "";
         const profile = binding.codexConfigProfile?.trim();
         const profileArg = profile ? ` -p ${shellQuote(profile)}` : "";
-        const posture = codexPostureArg(profileArg, process.env, binding.launchPosture);
-        const appliedLaunch = observeCodexSandbox(posture);
+        const posture = binding.codexRebuildPermissions
+            ? profileArg + codexEnvelopeArgs(binding.codexRebuildPermissions)
+            : codexPostureArg(profileArg, process.env, binding.launchPosture);
+        const appliedLaunch = binding.codexRebuildPermissions
+            ? { runtime: "codex", axis: "sandbox", state: "observed", value: binding.codexRebuildPermissions.sandboxPolicy.type,
+                reason: "emitted_launch_arguments", ...(binding.codexRebuildPermissions.approvalPolicy === "never" ? { approvalPolicy: "never" } : {}) }
+            : observeCodexSandbox(posture);
         const postureArg = posture + operationalLaunchArg(this.runtime, binding);
         if (running) {
             // The running Codex already loaded its profile; drift in -p is the caller's to compare.
             return { ok: true, model, modelArg, effort, effortArg, profile, appliedLaunch, postureArg,
                 queueStateDirArg: running.addDirs.map((dir) => ` --add-dir ${shellQuote(dir)}`).join(""),
+                suppressAutoAddDirs: false,
                 daemonOptOut: running.daemonOptOut, daemonArg: running.daemonOptOut ? " --no-daemon" : "",
                 networkArg: running.networkOverride ? ` -c ${shellQuote(CODEX_NETWORK_DEFAULT_OVERRIDE)}` : "" };
         }
@@ -706,10 +773,15 @@ export class CodexRuntimeAdapter {
                 };
             }
         }
-        const teamWorkspaceArg = binding.teamPermissionDefault && !profile
+        // Codex rejects writable --add-dir roots under a read-only sandbox. Only
+        // suppress OpenRig's generated roots when later project layers cannot make it writable.
+        const suppressAutoAddDirs = Boolean(!binding.codexRebuildPermissions && profile
+            && posture === profileArg && this.profileRemainsReadOnly(profile, binding.cwd));
+        const teamWorkspaceArg = !binding.codexRebuildPermissions && binding.teamPermissionDefault && !profile
             && appliedLaunch.state === "observed" && appliedLaunch.value === "workspace-write"
             ? codexTeamWorkspaceArg(this.prepareTeamWorkspace, name) : "";
-        const queueStateDirArg = teamWorkspaceArg || this.buildQueueStateAddDirArg(name);
+        const queueStateDirArg = binding.codexRebuildPermissions || suppressAutoAddDirs
+            ? "" : teamWorkspaceArg || this.buildQueueStateAddDirArg(name);
         // #69: one daemon-support decision for this launch, for the Codex the seat pane runs
         // (its cwd, the launch PATH), applied to fresh, fork and resume.
         const daemonSupport = this.detectDaemonSupport ? await this.detectDaemonSupport(binding.cwd) : undefined;
@@ -719,10 +791,11 @@ export class CodexRuntimeAdapter {
         const daemonOptOut = daemonSupport?.kind === "supported";
         const daemonArg = daemonOptOut ? " --no-daemon" : "";
         // #275: on the plain floor, network access unless Codex reports an opt-out or policy.
-        const networkArg = await codexNetworkDefaultArg(this.readNetworkDefault, appliedLaunch, binding.cwd, name);
+        const networkArg = binding.codexRebuildPermissions ? ""
+            : await codexNetworkDefaultArg(this.readNetworkDefault, appliedLaunch, binding.cwd, name);
         // The launch facts keep the probed daemon choice, so a printed recovery command can repeat it; no probe, no fact.
         const launchFacts = daemonSupport ? { ...appliedLaunch, daemonOptOut } : appliedLaunch;
-        return { ok: true, model, modelArg, effort, effortArg, profile, appliedLaunch: launchFacts, postureArg, queueStateDirArg, daemonOptOut, daemonArg, networkArg };
+        return { ok: true, model, modelArg, effort, effortArg, profile, appliedLaunch: launchFacts, postureArg, queueStateDirArg, suppressAutoAddDirs, daemonOptOut, daemonArg, networkArg };
     }
     resumeCore(prepared, resumeToken, binding) {
         const { profile, queueStateDirArg, model, postureArg, networkArg, daemonOptOut, effort } = prepared;
@@ -739,6 +812,81 @@ export class CodexRuntimeAdapter {
         const root = codexQueueStateRoot(sessionName, sharedDocsRoot);
         return root ? ` --add-dir ${shellQuote(root)}` : "";
     }
+    /**
+     * Return true only when visible config proves a read-only profile within Codex's default project root.
+     * Unknown markers or unreadable layers retain the generated roots for native launch handling.
+     */
+    profileRemainsReadOnly(profile, cwd) {
+        const root = this.codexHome ?? nodePath.join(this.fs.homedir ?? os.homedir(), ".codex");
+        const path = nodePath.join(root, `${profile}.config.toml`);
+        const userPath = nodePath.join(root, "config.toml");
+        if (!this.fs.exists(path))
+            return false;
+        try {
+            const value = parseToml(this.fs.readFile(path));
+            if (value.sandbox_mode !== "read-only" || value.default_permissions !== undefined || !nodePath.isAbsolute(cwd))
+                return false;
+            // A custom marker set may change the project boundary; leave the prior
+            // generated roots in place unless this default-marker scan proves it.
+            if (value.project_root_markers !== undefined)
+                return false;
+            // Codex merges fixed system/user/legacy-managed layers before choosing
+            // project markers. Any visible override or unreadable layer keeps roots.
+            for (const fixedPath of [
+                nodePath.join(this.codexSystemConfigDir, "config.toml"),
+                userPath,
+                nodePath.join(this.codexSystemConfigDir, "managed_config.toml"),
+            ]) {
+                if (!this.fs.exists(fixedPath))
+                    continue;
+                const fixed = parseToml(this.fs.readFile(fixedPath));
+                if (fixed.default_permissions !== undefined || fixed.project_root_markers !== undefined)
+                    return false;
+            }
+            // Codex's default root is the nearest .git file or a .git directory
+            // containing HEAD. When none exists, Codex uses cwd itself.
+            let projectRoot = nodePath.normalize(cwd);
+            for (let dir = projectRoot;;) {
+                const marker = nodePath.join(dir, ".git");
+                if (this.fs.exists(marker)) {
+                    if (!this.fs.statMode)
+                        return false;
+                    const kind = this.fs.statMode(marker) & fs.constants.S_IFMT;
+                    // statMode may expose permission bits alone; that cannot prove a file.
+                    if (kind !== fs.constants.S_IFREG && kind !== fs.constants.S_IFDIR)
+                        return false;
+                    if (kind === fs.constants.S_IFREG || this.fs.exists(nodePath.join(marker, "HEAD"))) {
+                        projectRoot = dir;
+                        break;
+                    }
+                }
+                const parent = nodePath.dirname(dir);
+                if (parent === dir)
+                    break;
+                dir = parent;
+            }
+            // Trust can exclude a closer project file, leaving a writable ancestor active.
+            // Keep roots if any visible applicable ancestor could make the launch writable.
+            for (let dir = nodePath.normalize(cwd);;) {
+                const projectPath = nodePath.join(dir, ".codex", "config.toml");
+                // At the home ancestor this is the user config, which loaded before the profile.
+                if (projectPath !== userPath && this.fs.exists(projectPath)) {
+                    const project = parseToml(this.fs.readFile(projectPath));
+                    if (project.default_permissions !== undefined)
+                        return false;
+                    if (project.sandbox_mode !== undefined && project.sandbox_mode !== "read-only")
+                        return false;
+                }
+                if (dir === projectRoot)
+                    return true;
+                dir = nodePath.dirname(dir);
+            }
+        }
+        catch {
+            // Preflight owns profile errors; unreadable user or project state keeps prior roots.
+            return false;
+        }
+    }
     async captureProbeScreen(target) {
         // Current readiness belongs to the rendered screen. Scrollback may retain
         // dismissed prompts, loading headers, or refusals from earlier attempts.
@@ -865,14 +1013,14 @@ export class CodexRuntimeAdapter {
     ensureManagedBootstrap(binding) {
         this.provisionWorkspaceTrust(binding.cwd ?? null);
     }
-    projectEntry(entry, cwd, warnings) {
+    projectEntry(entry, cwd, warnings, seatSkillsRoot, seatSkillsRefused) {
         if (entry.category === "runtime_resource" && this.applyRuntimeResource(entry)) {
             return true;
         }
         if (entry.category === "guidance" && entry.mergeStrategy === "managed_block") {
             const targetPath = nodePath.join(cwd, "AGENTS.md");
             const content = this.fs.readFile(entry.absolutePath);
-            return this.mergeGuidance(targetPath, entry.effectiveId, content, warnings);
+            return this.mergeGuidance(targetPath, entry.effectiveId, content, warnings, entry.absolutePath);
         }
         // HG-1.3 plugin runtime applicability filter (per DESIGN.md §5.1):
         // - explicit pluginType="claude" → skip Codex projection
@@ -881,9 +1029,23 @@ export class CodexRuntimeAdapter {
         if (entry.category === "plugin" && !this.pluginAppliesToCodex(entry)) {
             return false;
         }
-        const targetDir = this.resolveTargetDir(entry, cwd);
+        const targetDir = this.resolveTargetDir(entry, cwd, seatSkillsRoot);
         if (!targetDir)
             return true;
+        // OPR.0.7.0.13: never write through a link out of the seat's storage.
+        // A refused seat storage refuses every skill meant for it, named; otherwise each destination is checked.
+        const refusal = seatSkillsRoot && entry.category === "skill"
+            ? seatSkillsRefused ?? seatSkillWriteRefusal(seatSkillsRoot, nodePath.join(targetDir, "SKILL.md")) : undefined;
+        if (refusal) {
+            warnings.push(`${entry.effectiveId}: ${refusal}`);
+            return false;
+        }
+        // OPR.0.7.0.13: destinations refused below (a link on the way); an entry with any is reported incomplete, not projected.
+        const notProjected = [];
+        // OPR.0.7.0.13: a skill written to the seat's own storage is recorded, so cleanup and restore know it as OpenRig's.
+        const record = seatSkillsRoot && entry.category === "skill"
+            ? (dest, src, content) => recordSeatSkillWrite(seatSkillsRoot, dest, src, content)
+            : () => { };
         this.fs.mkdirp(targetDir);
         let isDir = false;
         if (this.fs.listFiles) {
@@ -899,10 +1061,26 @@ export class CodexRuntimeAdapter {
         const createdFiles = [];
         try {
             if (isDir && this.fs.listFiles) {
+                let skippedPluginSkills = 0;
                 for (const file of this.fs.listFiles(entry.absolutePath)) {
+                    // OPR.0.7.0.13: a seat with its own storage gets a selected plugin's bundled skills there, through its loadout, so
+                    // the project's copy of the plugin leaves its skills out; its manifest, hooks and settings are copied as before.
+                    if (seatSkillsRoot && entry.category === "plugin" && file.split(/[\\/]/)[0] === "skills") {
+                        skippedPluginSkills++;
+                        continue;
+                    }
                     const src = nodePath.join(entry.absolutePath, file);
                     const dest = nodePath.join(targetDir, file);
+                    // OPR.0.7.0.13: each destination in a seat's storage is checked before it's recorded, written or re-moded, so a
+                    // helper folder or file found to be a link is not written through (the identical-content, mode-only branch included).
+                    const refusedDest = seatSkillsRoot && entry.category === "skill" ? seatSkillWriteRefusal(seatSkillsRoot, dest) : undefined;
+                    if (refusedDest) {
+                        warnings.push(`${entry.effectiveId}: ${refusedDest}`);
+                        notProjected.push(dest);
+                        continue;
+                    }
                     const content = this.fs.readFile(src);
+                    record(dest, src, content);
                     // Reconcile mode even when the content write is skipped: a byte-identical dest
                     // projected earlier may still carry the wrong (default) mode.
                     if (this.fs.exists(dest) && hashContent(content) === hashContent(this.fs.readFile(dest))) {
@@ -916,10 +1094,19 @@ export class CodexRuntimeAdapter {
                         createdFiles.push(dest);
                     this.preserveMode(src, dest);
                 }
+                const pluginLoss = seatSkillsRefused ? seatPluginSkillsLossNote(entry.effectiveId, skippedPluginSkills, seatSkillsRefused) : undefined;
+                if (pluginLoss)
+                    warnings.push(pluginLoss);
             }
             else {
-                const content = this.fs.readFile(entry.absolutePath);
                 const destFile = nodePath.join(targetDir, nodePath.basename(entry.absolutePath));
+                const refusedFile = seatSkillsRoot && entry.category === "skill" ? seatSkillWriteRefusal(seatSkillsRoot, destFile) : undefined;
+                if (refusedFile) {
+                    warnings.push(`${entry.effectiveId}: ${refusedFile}`);
+                    return false;
+                }
+                const content = this.fs.readFile(entry.absolutePath);
+                record(destFile, entry.absolutePath, content);
                 if (this.fs.exists(destFile) && hashContent(content) === hashContent(this.fs.readFile(destFile))) {
                     this.preserveMode(entry.absolutePath, destFile);
                     return true;
@@ -935,7 +1122,7 @@ export class CodexRuntimeAdapter {
             if (entry.category === "plugin")
                 warnings.push(...excludeNewGeneratedFiles(cwd, createdFiles));
         }
-        return true;
+        return seatProjectionComplete(entry.effectiveId, notProjected, warnings);
     }
     /**
      * Reapply the source file's permission bits to the projected dest. Plain
@@ -960,9 +1147,9 @@ export class CodexRuntimeAdapter {
         // auto: detect via .codex-plugin/plugin.json presence in the source tree
         return this.fs.exists(nodePath.join(entry.absolutePath, ".codex-plugin", "plugin.json"));
     }
-    resolveTargetDir(entry, cwd) {
+    resolveTargetDir(entry, cwd, seatSkillsRoot) {
         switch (entry.category) {
-            case "skill": return nodePath.join(cwd, ".agents", "skills", entry.effectiveId);
+            case "skill": return nodePath.join(seatSkillsRoot ?? nodePath.join(cwd, ".agents", "skills"), entry.effectiveId);
             case "guidance": return null; // handled via merge
             case "subagent": return nodePath.join(cwd, ".agents"); // .agents/{id}.yaml per preserved contract
             case "plugin": return nodePath.join(cwd, ".codex", "plugins", entry.effectiveId);
@@ -995,14 +1182,17 @@ export class CodexRuntimeAdapter {
      * propagate the skip signal so ProjectionResult and StartupDeliveryResult
      * report honest counts.
      */
-    mergeGuidance(targetPath, blockId, content, warnings) {
+    mergeGuidance(targetPath, blockId, content, warnings, sourcePath) {
         // Mirrors Claude Code adapter: the `rig-role` managed block collides across
         // pod-mates because the regenerator pairs (target-file × spec) without
         // seat correlation. Per-seat role content is delivered through `send_text`
         // startup instead. Refuse the merge loudly; silent skip would mask the
         // collision. See ADR-0006.
-        if (blockId === "rig-role") {
-            console.log(`[openrig] skip: effectiveId is rig-role, per-seat delivery via send_text path required (target=${targetPath})`);
+        if (isPerSeatRoleGuidance(blockId, sourcePath)) {
+            console.log(`[openrig] skip: effectiveId is ${blockId}, a seat's own role; per-seat delivery via send_text path required (target=${targetPath})`);
+            const warning = perSeatRoleSkipWarning(blockId, targetPath);
+            if (warning)
+                warnings.push(warning);
             return false;
         }
         mergeManagedBlock(this.fs, targetPath, blockId, content, {
@@ -1011,8 +1201,8 @@ export class CodexRuntimeAdapter {
         });
         return true;
     }
-    detectDeliveryHint(path, content) {
-        return resolveConcreteHint(path, content);
+    detectDeliveryHint(path, content, orientation) {
+        return resolveConcreteHint(path, content, orientation);
     }
     provisionWorkspaceTrust(cwd) {
         if (!cwd)
@@ -1484,11 +1674,11 @@ export function computeCodexHookTrust(event, input) {
  * `[hooks.state."<key>"] trusted_hash = "<hash>"` record. Mirrors upsertCodexProjectTrust:
  * find/create the exact table header, splice ONLY its `trusted_hash` line, leave every other
  * `[hooks.state]` / `[projects]` entry and the managed hook block byte-identical. Same key+hash
- * ⇒ no-op. Only called for our authored inline or exact first-install plugin keys (never blanket trust).
+ * ⇒ no-op. Only called for our authored inline or verified owned plugin keys (never blanket trust).
  */
-export function upsertCodexHookTrust(content, key, hash) {
+export function upsertCodexHookTrust(content, key, hash, field = "trusted_hash") {
     const header = `[hooks.state.${JSON.stringify(key)}]`;
-    const trustLine = `trusted_hash = ${JSON.stringify(hash)}`;
+    const trustLine = `${field} = ${JSON.stringify(hash)}`;
     const lines = content.length > 0 ? content.split("\n") : [];
     const headerIndex = lines.findIndex((line) => line.trim() === header);
     if (headerIndex === -1) {
@@ -1503,14 +1693,14 @@ export function upsertCodexHookTrust(content, key, hash) {
             break;
         }
     }
-    const hashIndex = lines.findIndex((line, index) => index > headerIndex && index < nextSectionIndex && line.trim().startsWith("trusted_hash"));
+    const hashIndex = lines.findIndex((line, index) => index > headerIndex && index < nextSectionIndex && line.trim().startsWith(field));
     if (hashIndex >= 0) {
         lines[hashIndex] = trustLine;
     }
     else {
         lines.splice(headerIndex + 1, 0, trustLine);
     }
-    return `${lines.join("\n").replace(/\n*$/, "\n")}`;
+    return field === "trusted_content_hash" ? lines.join("\n") : `${lines.join("\n").replace(/\n*$/, "\n")}`;
 }
 export function isCodex013xOrLater(version) {
     const match = /^(\d+)\.(\d+)/.exec(version);