@orchid-labs/pluxx 0.1.22 → 0.1.24

package/dist/index.js

@@ -7841,6 +7841,61 @@ function definePlugin(config) {
   return PluginConfigSchema.parse(config);
 }
 
+// src/agent-translation-registry.ts
+var CODEX_AGENT_CAPABILITY_NOTE = 'Codex custom agents and subagents are real native surfaces, but they are not packaged the same way as Claude or Cursor plugin agents. Local May 13, 2026 headless probes prove explicit invocation, built-in-name override, project-local precedence, and discovered `.agents/skills` inheritance. The same maintained headless suite also showed two config-depth caveats: a parent `[[skills.config]] enabled = false` entry did not disable a discovered project skill, and an agent-local `[[skills.config]]` entry did not preload an undiscovered `skills/` path. The maintained `bun scripts/probe-codex-mcp-runtime.ts --json` headless probe was rerun on June 24, 2026: default project-scoped and user-scoped root MCP both emit a real `mcp_tool_call` item but fail with `user cancelled MCP tool call` before server-side `tools/call`; explicit `[mcp_servers.<id>.tools.<tool>] approval_mode = "approve"` unlocks project-scoped and user-scoped root MCP; custom agents that inherit those approved root MCP servers also reach `tools/call` and return `MCP_PROOF_MARKER_ALLOWED`. The June 24 run also shows that `mcp_servers = {}` in the child agent does not opt out of approved inherited root MCP for either project or user scope, while agent-local inline MCP and agent-local inline approval did not activate. Current custom-agent MCP success now surfaces a parent `mcp_tool_call` item in the `codex exec --json` stream, but `codex mcp list` still sees user-scoped servers and not project-scoped servers. The maintained `bun scripts/probe-codex-agents-interactive-runtime.ts --json` trusted interactive probe also showed the same `sandbox_mode = "read-only"` child agent still wrote to the workspace there too, so these fields are not yet uniformly trustworthy runtime boundaries.';
+var AGENT_PRIMITIVE_CAPABILITIES = {
+  "claude-code": {
+    mode: "preserve",
+    nativeSurfaces: ["agents/*.md"],
+    notes: "Claude plugin agents are a first-class native surface with rich frontmatter."
+  },
+  cursor: {
+    mode: "translate",
+    nativeSurfaces: ["agents/", ".cursor/agents/", "~/.cursor/agents/"],
+    notes: "Cursor specialization and tool access often live more naturally in subagents than in skills."
+  },
+  codex: {
+    mode: "translate",
+    nativeSurfaces: [".codex/agents/*.toml", "~/.codex/agents/*.toml", "subagent workflows"],
+    notes: CODEX_AGENT_CAPABILITY_NOTE
+  },
+  opencode: {
+    mode: "preserve",
+    nativeSurfaces: ["agents/*.md", "config agent definitions"],
+    notes: "OpenCode agents are first-class native surfaces. Prefer permission-first agent config for new builds; legacy tools remains compatibility input, not the preferred emitted shape."
+  }
+};
+function getAgentPrimitiveCapability(platform) {
+  return AGENT_PRIMITIVE_CAPABILITIES[platform];
+}
+
+// src/command-translation-registry.ts
+var CODEX_COMMAND_GUIDANCE_SURFACES = ["skills/", "AGENTS.md", ".codex/commands.generated.json"];
+var CODEX_COMMAND_GUIDANCE_NOTE = "Current Codex docs do not document plugin-packaged slash-command parity, so Pluxx keeps canonical command intent through routing guidance plus a generated companion mirror.";
+var COMMAND_PRIMITIVE_CAPABILITIES = {
+  "claude-code": {
+    mode: "preserve",
+    nativeSurfaces: ["commands/*.md", "skills/<skill>/SKILL.md"],
+    notes: "Claude still supports command files, but the product is increasingly converging command workflows into skills."
+  },
+  cursor: {
+    mode: "preserve",
+    nativeSurfaces: ["commands/*", "slash commands"]
+  },
+  codex: {
+    mode: "degrade",
+    nativeSurfaces: [...CODEX_COMMAND_GUIDANCE_SURFACES],
+    notes: CODEX_COMMAND_GUIDANCE_NOTE
+  },
+  opencode: {
+    mode: "preserve",
+    nativeSurfaces: ["commands/*.md", "config command definitions"]
+  }
+};
+function getCommandPrimitiveCapability(platform) {
+  return COMMAND_PRIMITIVE_CAPABILITIES[platform];
+}
+
 // src/hook-events.ts
 var CODEX_SUPPORTED_HOOK_EVENTS = [
   "SessionStart",
@@ -7989,6 +8044,7 @@ function getRuntimeReadinessCapability(platform, pluginRootVar = "PLUGIN_ROOT")
 }
 
 // src/validation/platform-rules.ts
+var CORE_FOUR_PLATFORMS = ["claude-code", "cursor", "codex", "opencode"];
 var STANDARD_SKILL_FRONTMATTER = [
   "name",
   "description",
@@ -8662,14 +8718,10 @@ var CORE_FOUR_PRIMITIVE_CAPABILITIES = {
         nativeSurfaces: ["skills/<skill>/SKILL.md"]
       },
       commands: {
-        mode: "preserve",
-        nativeSurfaces: ["commands/*.md", "skills/<skill>/SKILL.md"],
-        notes: "Claude still supports command files, but the product is increasingly converging command workflows into skills."
+        ...getCommandPrimitiveCapability("claude-code")
       },
       agents: {
-        mode: "preserve",
-        nativeSurfaces: ["agents/*.md"],
-        notes: "Claude plugin agents are a first-class native surface with rich frontmatter."
+        ...getAgentPrimitiveCapability("claude-code")
       },
       hooks: {
         mode: "preserve",
@@ -8705,13 +8757,10 @@ var CORE_FOUR_PRIMITIVE_CAPABILITIES = {
         notes: "Cursor skills preserve workflow meaning but document a narrower frontmatter set than Claude."
       },
       commands: {
-        mode: "preserve",
-        nativeSurfaces: ["commands/*", "slash commands"]
+        ...getCommandPrimitiveCapability("cursor")
       },
       agents: {
-        mode: "translate",
-        nativeSurfaces: ["agents/", ".cursor/agents/", "~/.cursor/agents/"],
-        notes: "Cursor specialization and tool access often live more naturally in subagents than in skills."
+        ...getAgentPrimitiveCapability("cursor")
       },
       hooks: {
         mode: "preserve",
@@ -8745,14 +8794,10 @@ var CORE_FOUR_PRIMITIVE_CAPABILITIES = {
         nativeSurfaces: ["skills/<skill>/SKILL.md"]
       },
       commands: {
-        mode: "degrade",
-        nativeSurfaces: ["skills/", "AGENTS.md", ".codex/commands.generated.json"],
-        notes: "Current Codex docs do not document plugin-packaged slash-command parity, so Pluxx keeps canonical command intent through routing guidance plus a generated companion mirror."
+        ...getCommandPrimitiveCapability("codex")
       },
       agents: {
-        mode: "translate",
-        nativeSurfaces: [".codex/agents/*.toml", "~/.codex/agents/*.toml", "subagent workflows"],
-        notes: 'Codex custom agents and subagents are real native surfaces, but they are not packaged the same way as Claude or Cursor plugin agents. Local May 13, 2026 headless probes now prove explicit invocation, built-in-name override, project-local precedence, and discovered `.agents/skills` inheritance. The same maintained headless suite also showed two config-depth caveats: a parent `[[skills.config]] enabled = false` entry did not disable a discovered project skill, and an agent-local `[[skills.config]]` entry did not preload an undiscovered `skills/` path. The maintained `bun scripts/probe-codex-mcp-runtime.ts --json` headless probe now also shows a more precise MCP approval split: default project-scoped and user-scoped root MCP both emit a real `mcp_tool_call` item but fail it with `user cancelled MCP tool call` before any server-side `tools/call`, while the default inline-agent path reaches startup plus `tools/list` and then falls back to `MCP_PROOF_MARKER_MISSING`. The same maintained suite now also proves five approved allow-paths: explicit `[mcp_servers.<id>.tools.<tool>] approval_mode = "approve"` works for project-scoped root MCP, user-scoped root MCP, agent-local inline `mcp_servers`, and custom agents that inherit an approved project-scoped or user-scoped root MCP server. All three approved custom-agent MCP paths still avoid a root `mcp_tool_call` item in the parent `codex exec --json` stream and instead surface child `agents_states` moving through `pending_init` to `completed`; project-scoped servers still do not appear in `codex mcp list`, and user-scoped servers do appear there. The maintained `bun scripts/probe-codex-agents-interactive-runtime.ts --json` trusted interactive probe also showed the same `sandbox_mode = "read-only"` child agent still wrote to the workspace there too, so these fields are not yet uniformly trustworthy runtime boundaries.'
+        ...getAgentPrimitiveCapability("codex")
       },
       hooks: {
         mode: "translate",
@@ -8767,7 +8812,7 @@ var CORE_FOUR_PRIMITIVE_CAPABILITIES = {
       runtime: {
         mode: "preserve",
         nativeSurfaces: [".mcp.json", ".app.json", ".codex/config.toml", "scripts/", "assets/"],
-        notes: `Bundle-local MCP config exists, but active MCP state also lives in config.toml. Local May 13, 2026 headless Codex MCP probes reached startup plus \`tools/list\` across project-scoped, user-scoped, and inline-agent config; default root MCP emitted a real \`mcp_tool_call\` item but failed it with \`user cancelled MCP tool call\` before any server-side \`tools/call\`, while the default inline-agent path fell back to \`MCP_PROOF_MARKER_MISSING\` after startup plus \`tools/list\`. The same maintained suite now proves five concrete approval paths: project-scoped root MCP, user-scoped root MCP, agent-local inline \`mcp_servers\`, a custom agent inheriting an approved project-scoped root MCP server, and a custom agent inheriting an approved user-scoped root MCP server all reach real server-side \`tools/call\` once explicit \`[mcp_servers.<id>.tools.<tool>] approval_mode = "approve"\` is present in the relevant layer. All three approved custom-agent MCP paths still avoid a root \`mcp_tool_call\` item in the parent \`codex exec --json\` stream and instead surface child \`agents_states\` moving through \`pending_init\` to \`completed\`; project-scoped servers still do not appear in \`codex mcp list\`, and user-scoped servers do appear there. ${getRuntimeReadinessExternalConfigNote()}`
+        notes: `Bundle-local MCP config exists, but active MCP state also lives in config.toml. Local June 24, 2026 headless Codex MCP probes reached startup plus \`tools/list\` for project-scoped and user-scoped root config. Default root MCP emitted a real \`mcp_tool_call\` item but failed with \`user cancelled MCP tool call\` before server-side \`tools/call\`. Explicit per-tool \`approval_mode = "approve"\` now proves four concrete root/inheritance paths: project-scoped root MCP, user-scoped root MCP, a custom agent inheriting an approved project-scoped root MCP server, and a custom agent inheriting an approved user-scoped root MCP server. The same run also proves that an explicit child-agent \`mcp_servers = {}\` does not opt out of those approved inherited root MCP servers. Agent-local inline MCP and agent-local inline approval did not activate in the June 24 run, so least-privilege delegated MCP still belongs in the gap column. Project-scoped servers still do not appear in \`codex mcp list\`, while user-scoped servers do. ${getRuntimeReadinessExternalConfigNote()}`
       },
       distribution: {
         mode: "preserve",
@@ -8789,13 +8834,10 @@ var CORE_FOUR_PRIMITIVE_CAPABILITIES = {
         nativeSurfaces: ["skills/<skill>/SKILL.md"]
       },
       commands: {
-        mode: "preserve",
-        nativeSurfaces: ["commands/*.md", "config command definitions"]
+        ...getCommandPrimitiveCapability("opencode")
       },
       agents: {
-        mode: "preserve",
-        nativeSurfaces: ["agents/*.md", "config agent definitions"],
-        notes: "OpenCode agents are first-class native surfaces. Prefer permission-first agent config for new builds; legacy tools remains compatibility input, not the preferred emitted shape."
+        ...getAgentPrimitiveCapability("opencode")
       },
       hooks: {
         mode: "translate",
@@ -9137,20 +9179,77 @@ function collectUserConfigEntries(config, platforms = config.targets) {
 }
 
 // src/distribution-lifecycle.ts
+var CORE_FOUR_INSTALL_DISCOVERY_CAPABILITIES = [
+  {
+    platform: "claude-code",
+    label: "Claude Code",
+    installMethod: "Native Claude plugin install from a generated local marketplace, or the generated release installer.",
+    localInstallPath: "~/.claude/plugins/cache/pluxx-local-<plugin>/<plugin>/<version> after native install; legacy direct installs may still appear at ~/.claude/plugins/<plugin>.",
+    reloadBehavior: "Run /reload-plugins in the active Claude window.",
+    cacheSemantics: "Claude copies the selected marketplace plugin into a versioned plugin cache. Pluxx verifies that cache path rather than assuming the source bundle is live.",
+    discoverySurface: "Claude plugin marketplace/listing commands and the active Claude plugin list after reload.",
+    brandListingSupport: "No shared manifest-backed brand fields from Pluxx brand today; instructions, skills, commands, and assets still ship inside the bundle.",
+    installFollowupNote: "Claude Code note: if Claude is already open, run /reload-plugins to pick up the new install.",
+    publishReloadInstruction: "If Claude is already open, run /reload-plugins."
+  },
+  {
+    platform: "cursor",
+    label: "Cursor",
+    installMethod: "Local plugin install or generated release installer that replaces the local bundle.",
+    localInstallPath: "~/.cursor/plugins/local/<plugin>",
+    reloadBehavior: "Use Developer: Reload Window or restart Cursor.",
+    cacheSemantics: "Pluxx installs the local bundle path directly; no separate Pluxx-managed active cache is modeled.",
+    discoverySurface: "Cursor local plugin directory and host plugin UI after reload or restart.",
+    brandListingSupport: "Narrow shared-brand translation: homepage and logo can be emitted; richer listing copy is not a shared Cursor surface today.",
+    installFollowupNote: "Cursor note: if Cursor is already open, use Developer: Reload Window or restart Cursor to pick up the new install.",
+    publishReloadInstruction: "If Cursor is already open, use Developer: Reload Window or restart Cursor so the plugin is picked up."
+  },
+  {
+    platform: "codex",
+    label: "Codex",
+    installMethod: "Local plugin install plus a local marketplace catalog entry, or the generated release installer.",
+    localInstallPath: "~/.codex/plugins/<plugin> plus a local marketplace catalog entry.",
+    reloadBehavior: "Use Plugins > Refresh when that UI action is available, otherwise restart Codex.",
+    cacheSemantics: "Codex may load a separate active cache under ~/.codex/plugins/cache/local-plugins/<plugin>/<version>. Pluxx clears local cache on install/uninstall and verify-install detects stale cache contents.",
+    discoverySurface: "Codex Plugins view and plugin detail page. Plugin-bundled MCP servers may appear on the plugin detail page without appearing in the global MCP servers settings page.",
+    brandListingSupport: "Richest current shared-brand target: display name, descriptions, category, color, icon/logo, screenshots, default prompt, website, and policy links can be emitted into .codex-plugin/plugin.json interface metadata.",
+    installFollowupNote: "Codex note: if Codex is already open, use Plugins > Refresh if that action is available in your current UI, or restart Codex to pick up the new install. Plugin-bundled MCP servers may appear on the plugin detail page without appearing in the global MCP servers settings page.",
+    publishReloadInstruction: "If Codex is already open, use Plugins > Refresh if that action is available in your current UI, or restart Codex so the plugin is picked up.",
+    verifyStaleAction: "in Codex, use Plugins > Refresh if available, or restart Codex so the plugin cache reloads"
+  },
+  {
+    platform: "opencode",
+    label: "OpenCode",
+    installMethod: "Local plugin directory plus generated entry wrapper, generated release installer, or npm-backed wrapper package path.",
+    localInstallPath: "~/.config/opencode/plugins/<plugin> plus ~/.config/opencode/plugins/<plugin>.ts and synced skills under ~/.config/opencode/skills/<plugin>-<skill>.",
+    reloadBehavior: "Restart or reload OpenCode.",
+    cacheSemantics: "Pluxx writes the local plugin wrapper and synced skill files directly; no separate Pluxx-managed active cache is modeled.",
+    discoverySurface: "OpenCode plugin loader, plugin wrapper file, and synced skill namespace.",
+    brandListingSupport: "No shared manifest-backed brand fields from Pluxx brand today; OpenCode receives functional plugin module, instructions, skills, and package metadata.",
+    installFollowupNote: "OpenCode note: if OpenCode is already open, restart or reload it so the plugin is picked up.",
+    publishReloadInstruction: "If OpenCode is already open, restart or reload it so the plugin is picked up."
+  }
+];
+var CORE_FOUR_CAPABILITIES_BY_PLATFORM = Object.fromEntries(
+  CORE_FOUR_INSTALL_DISCOVERY_CAPABILITIES.map((capability) => [capability.platform, capability])
+);
+var CORE_FOUR_PLATFORMS2 = new Set(
+  CORE_FOUR_INSTALL_DISCOVERY_CAPABILITIES.map((capability) => capability.platform)
+);
 var VERIFY_STALE_ACTIONS = {
-  codex: "in Codex, use Plugins > Refresh if available, or restart Codex so the plugin cache reloads"
-};
-var PUBLISH_RELOAD_INSTRUCTIONS = {
-  "claude-code": "If Claude is already open, run /reload-plugins in the active session.",
-  cursor: "If Cursor is already open, use Developer: Reload Window or restart Cursor so the plugin is picked up.",
-  codex: "If Codex is already open, use Plugins > Refresh if that action is available in your current UI, or restart Codex so the plugin is picked up.",
-  opencode: "If OpenCode is already open, restart or reload it so the plugin is picked up."
+  codex: CORE_FOUR_CAPABILITIES_BY_PLATFORM.codex.verifyStaleAction
 };
+function isCoreFourTarget(target) {
+  return CORE_FOUR_PLATFORMS2.has(target);
+}
+function getHostInstallDiscoveryCapability(target) {
+  return CORE_FOUR_CAPABILITIES_BY_PLATFORM[target];
+}
 function getVerifyInstallStaleAction(target) {
   return VERIFY_STALE_ACTIONS[target];
 }
 function getPublishReloadInstruction(target) {
-  return PUBLISH_RELOAD_INSTRUCTIONS[target];
+  return isCoreFourTarget(target) ? getHostInstallDiscoveryCapability(target).publishReloadInstruction : void 0;
 }
 
 // src/mcp-native-overrides.ts
@@ -9603,17 +9702,23 @@ process.exit(1)
 NODE
 }
 
+pluxx_can_prompt_config() {
+  [[ -r /dev/tty && -w /dev/tty ]] && { [[ -t 0 ]] || [[ -t 1 ]] || [[ -t 2 ]]; }
+}
+
 pluxx_prompt_secret_config() {
   local key="$1"
   local env_var="$2"
   local label="$3"
   local required="$4"
   local current_value="\${!env_var:-}"
+  local saved_value_invalid=0
 
   if [[ -z "$current_value" && "\${PLUXX_RECONFIGURE:-0}" != "1" ]]; then
     local saved_value=""
     if saved_value="$(pluxx_saved_config_value "$key" "$env_var")"; then
       if pluxx_is_placeholder_secret "$saved_value"; then
+        saved_value_invalid=1
         echo "Ignoring placeholder-looking saved config for $env_var." >&2
       else
         current_value="$saved_value"
@@ -9623,11 +9728,15 @@ pluxx_prompt_secret_config() {
   fi
 
   if [[ -z "$current_value" && "$required" == "1" ]]; then
-    if [[ -t 0 || -r /dev/tty ]]; then
+    if pluxx_can_prompt_config; then
       read -r -s -p "$label [$env_var]: " current_value </dev/tty
       echo >/dev/tty
     else
-      echo "Missing required config: export $env_var before running this installer." >&2
+      if [[ "$saved_value_invalid" == "1" ]]; then
+        echo "Refusing placeholder-looking saved config for $env_var. Set a real value and rerun the installer." >&2
+      else
+        echo "Missing required config: export $env_var before running this installer." >&2
+      fi
       exit 1
     fi
   fi
@@ -9656,7 +9765,7 @@ pluxx_prompt_text_config() {
   fi
 
   if [[ -z "$current_value" && "$required" == "1" ]]; then
-    if [[ -t 0 || -r /dev/tty ]]; then
+    if pluxx_can_prompt_config; then
       read -r -p "$label [$env_var]: " current_value </dev/tty
     else
       echo "Missing required config: export $env_var before running this installer." >&2
@@ -9670,7 +9779,7 @@ pluxx_prompt_text_config() {
 ${promptLines.join("\n")}
 
 if [[ "$PLUXX_REUSED_USER_CONFIG" == "1" ]]; then
-  echo "Found existing plugin config; reusing saved install values."
+  echo "Found existing $PLUGIN_NAME config; reusing saved install values."
 fi
 
 export PLUXX_USER_CONFIG_SPEC
@@ -10746,15 +10855,536 @@ function runPublish(config, options = {}) {
   };
 }
 
+// src/bundle-check.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync, statSync } from "fs";
+import { join, relative, resolve as resolve3 } from "path";
+
+// src/readiness.ts
+function getRuntimeReadinessPlan(readiness) {
+  if (!readiness || readiness.dependencies.length === 0 && readiness.gates.length === 0) {
+    return {
+      hasReadiness: false,
+      dependencyIds: [],
+      needsSessionStart: false,
+      needsMcpGate: false,
+      needsPromptGate: false,
+      hasNamedMcpTools: false,
+      hasNamedPromptTargets: false
+    };
+  }
+  return {
+    hasReadiness: true,
+    dependencyIds: readiness.dependencies.map((dependency) => dependency.id),
+    needsSessionStart: readiness.dependencies.length > 0,
+    needsMcpGate: readiness.gates.some((gate) => gate.applyTo.includes("mcp-tools")),
+    needsPromptGate: readiness.gates.some((gate) => gate.applyTo.includes("skills") || gate.applyTo.includes("commands")),
+    hasNamedMcpTools: readiness.gates.some((gate) => (gate.tools?.length ?? 0) > 0),
+    hasNamedPromptTargets: readiness.gates.some((gate) => (gate.skills?.length ?? 0) > 0 || (gate.commands?.length ?? 0) > 0)
+  };
+}
+
+// src/bundle-check.ts
+var MAKER_FIELD = "author";
+var CLAUDE_FAMILY_FIELDS = ["name", "version", "description", MAKER_FIELD, "license", "repository", "keywords"];
+var MANIFEST_DESCRIPTORS = {
+  "claude-code": {
+    path: ".claude-plugin/plugin.json",
+    expectedFields: (config) => commonExpectedFields(config, CLAUDE_FAMILY_FIELDS),
+    referenceFields: ["commands", "agents", "skills", "hooks", "mcpServers"]
+  },
+  cursor: {
+    path: ".cursor-plugin/plugin.json",
+    expectedFields: (config) => [
+      ...commonExpectedFields(config, ["name", "version", "description", MAKER_FIELD, "repository", "license", "keywords"]),
+      ...config.brand?.websiteURL ? [{ field: "homepage", expected: config.brand.websiteURL }] : [],
+      ...expectedStandardHooksManifestField(config)
+    ],
+    expectedReferences: expectedStandardHookReferences,
+    referenceFields: ["skills", "commands", "agents", "rules", "hooks", "mcpServers", "logo"]
+  },
+  codex: {
+    path: ".codex-plugin/plugin.json",
+    expectedFields: (config) => commonExpectedFields(config, ["name", "version", "description", MAKER_FIELD, "repository", "license", "keywords"]),
+    referenceFields: ["skills", "mcpServers", "apps", "hooks"],
+    collectExtraReferences: (manifest) => collectCodexInterfaceReferences(manifest)
+  },
+  opencode: {
+    path: "package.json",
+    expectedFields: (config) => [
+      { field: "name", expected: config.platforms?.opencode?.npmPackage ?? `opencode-${config.name}` },
+      { field: "version", expected: config.version },
+      { field: "description", expected: `${config.description} (OpenCode plugin)` },
+      { field: "main", expected: "index.ts" },
+      { field: "type", expected: "module" },
+      { field: MAKER_FIELD, expected: getMakerName(config) },
+      { field: "license", expected: config.license }
+    ]
+  },
+  "github-copilot": {
+    path: ".claude-plugin/plugin.json",
+    expectedFields: (config) => [
+      ...commonExpectedFields(config, CLAUDE_FAMILY_FIELDS),
+      ...expectedStandardHooksManifestField(config)
+    ],
+    expectedReferences: expectedStandardHookReferences,
+    referenceFields: ["commands", "agents", "skills", "hooks", "mcpServers"]
+  },
+  openhands: {
+    path: ".plugin/plugin.json",
+    expectedFields: (config) => [
+      ...commonExpectedFields(config, CLAUDE_FAMILY_FIELDS),
+      ...expectedStandardHooksManifestField(config)
+    ],
+    expectedReferences: expectedStandardHookReferences,
+    referenceFields: ["commands", "agents", "skills", "hooks", "mcpServers"]
+  },
+  "gemini-cli": {
+    path: "gemini-extension.json",
+    expectedFields: (config) => commonExpectedFields(config, ["name", "version", "description", MAKER_FIELD]),
+    referenceFields: ["skills"]
+  }
+};
+function checkGeneratedBundles(config, rootDir, targets = config.targets) {
+  const reports = targets.map((target) => {
+    const targetRoot = resolve3(rootDir, config.outDir, target);
+    const descriptor = MANIFEST_DESCRIPTORS[target];
+    const files = collectFileInventory(targetRoot);
+    const issues = [];
+    if (!descriptor) {
+      return { target, files, issues };
+    }
+    const manifestFile = resolve3(targetRoot, descriptor.path);
+    if (!existsSync3(manifestFile)) {
+      issues.push({
+        code: "manifest-missing",
+        target,
+        path: descriptor.path,
+        detail: `Generated ${target} bundle is missing manifest ${descriptor.path}.`
+      });
+      return { target, manifestPath: descriptor.path, files, issues };
+    }
+    let manifest;
+    try {
+      manifest = JSON.parse(readFileSync3(manifestFile, "utf-8"));
+    } catch (error) {
+      issues.push({
+        code: "manifest-invalid",
+        target,
+        path: descriptor.path,
+        detail: `Generated ${target} manifest is not parseable: ${error instanceof Error ? error.message : String(error)}`
+      });
+      return { target, manifestPath: descriptor.path, files, issues };
+    }
+    for (const { field, expected } of descriptor.expectedFields(config)) {
+      if (expected === void 0) continue;
+      const actual = getField(manifest, field);
+      if (!jsonEqual(actual, expected)) {
+        issues.push({
+          code: "manifest-field-drift",
+          target,
+          path: `${descriptor.path}#${field}`,
+          detail: `Generated ${target} manifest field "${field}" drifted from source config.`,
+          expected,
+          actual
+        });
+      }
+    }
+    const references = Array.from(/* @__PURE__ */ new Set([
+      ...collectManifestReferences(manifest, descriptor.referenceFields ?? []),
+      ...descriptor.expectedReferences?.(config) ?? [],
+      ...descriptor.collectExtraReferences?.(manifest) ?? []
+    ]));
+    for (const reference of references) {
+      const resolvedReference = resolveBundleReference(targetRoot, reference);
+      if (!resolvedReference || !existsSync3(resolvedReference)) {
+        issues.push({
+          code: "manifest-reference-missing",
+          target,
+          path: descriptor.path,
+          detail: `Generated ${target} manifest references missing bundle path: ${reference}.`
+        });
+      }
+    }
+    return { target, manifestPath: descriptor.path, files, issues };
+  });
+  return {
+    targets: reports,
+    issues: reports.flatMap((report) => report.issues)
+  };
+}
+function assertGeneratedBundlesCurrent(config, rootDir, targets = config.targets) {
+  const report = checkGeneratedBundles(config, rootDir, targets);
+  if (report.issues.length === 0) return report;
+  const details = report.issues.map((issue) => {
+    const expected = issue.expected !== void 0 ? ` expected=${JSON.stringify(issue.expected)}` : "";
+    const actual = issue.actual !== void 0 ? ` actual=${JSON.stringify(issue.actual)}` : "";
+    return `- [${issue.target}] ${issue.detail} (${issue.path})${expected}${actual}`;
+  }).join("\n");
+  throw new Error(`Generated bundle check failed:
+${details}`);
+}
+function getField(input, field) {
+  return field.split(".").reduce((value, key) => {
+    if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+    return value[key];
+  }, input);
+}
+function jsonEqual(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+function commonExpectedFields(config, fields) {
+  return fields.map((field) => ({ field, expected: getField(config, field) }));
+}
+function getMakerName(config) {
+  return config[MAKER_FIELD]?.name;
+}
+function expectsStandardHooksManifest(config) {
+  return Boolean(config.hooks || config.permissions || getRuntimeReadinessPlan(config.readiness).hasReadiness);
+}
+function expectedStandardHooksManifestField(config) {
+  return expectsStandardHooksManifest(config) ? [{ field: "hooks", expected: "./hooks/hooks.json" }] : [];
+}
+function expectedStandardHookReferences(config) {
+  return expectsStandardHooksManifest(config) ? ["./hooks/hooks.json"] : [];
+}
+function collectManifestReferences(manifest, fields) {
+  const references = [];
+  for (const field of fields) {
+    const value = getField(manifest, field);
+    if (typeof value === "string") {
+      references.push(value);
+    } else if (Array.isArray(value)) {
+      for (const item of value) {
+        if (typeof item === "string") references.push(item);
+      }
+    }
+  }
+  return references;
+}
+function collectCodexInterfaceReferences(manifest) {
+  const iface = manifest.interface;
+  if (!iface || typeof iface !== "object" || Array.isArray(iface)) return [];
+  return collectManifestReferences(iface, ["composerIcon", "logo", "screenshots"]);
+}
+function resolveBundleReference(rootDir, reference) {
+  if (reference.trim() === "") return void 0;
+  const stripped = reference.startsWith("./") ? reference.slice(2) : reference;
+  const resolvedPath = resolve3(rootDir, stripped);
+  const rel = relative(rootDir, resolvedPath);
+  if (rel.startsWith("..")) return void 0;
+  return resolvedPath;
+}
+function collectFileInventory(rootDir) {
+  if (!existsSync3(rootDir)) return [];
+  const files = [];
+  const visit = (dir) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const fullPath = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        visit(fullPath);
+      } else if (entry.isFile()) {
+        files.push(relative(rootDir, fullPath).replace(/\\/g, "/"));
+      } else if (entry.isSymbolicLink()) {
+        const stats = statSync(fullPath);
+        if (stats.isFile()) files.push(relative(rootDir, fullPath).replace(/\\/g, "/"));
+      }
+    }
+  };
+  visit(rootDir);
+  return files.sort();
+}
+
+// src/install-reference.ts
+var INSTALL_REFERENCE_SCHEMES = ["local", "github", "npm", "team"];
+var INSTALL_REFERENCE_HELP = "Install references must use <scheme>:<locator>[@<version>][#<target>] with scheme local, github, npm, or team.";
+var OWNER_PAIR_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+var NPM_PACKAGE_PATTERN = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
+var VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._+:/-]*$/;
+function parseInstallReference(rawReference) {
+  const raw = rawReference.trim();
+  if (!raw) {
+    throw installReferenceError("Provide an install reference.");
+  }
+  const schemeSeparator = raw.indexOf(":");
+  if (schemeSeparator <= 0) {
+    throw installReferenceError("Install reference is missing a scheme.");
+  }
+  const rawScheme = raw.slice(0, schemeSeparator);
+  if (!isInstallReferenceScheme(rawScheme)) {
+    throw installReferenceError(`Unsupported install reference scheme "${rawScheme}".`);
+  }
+  const rest = raw.slice(schemeSeparator + 1);
+  const { body, target } = splitInstallReferenceTarget(rest);
+  if (!body) {
+    throw installReferenceError(`Install reference "${rawScheme}:" is missing a locator.`);
+  }
+  if (rawScheme === "local") {
+    return buildLocalInstallReference(raw, body, target);
+  }
+  const { locator, version } = splitInstallReferenceVersion(body);
+  if (!locator) {
+    throw installReferenceError(`Install reference "${rawScheme}:" is missing a locator before the version.`);
+  }
+  validateInstallReferenceVersion(version);
+  switch (rawScheme) {
+    case "github":
+      return buildGitHubInstallReference(raw, locator, version, target);
+    case "npm":
+      return buildNpmInstallReference(raw, locator, version, target);
+    case "team":
+      return buildTeamInstallReference(raw, locator, version, target);
+  }
+}
+function formatInstallReference(reference) {
+  return reference.normalized;
+}
+function buildLocalInstallReference(raw, locator, target) {
+  return {
+    raw,
+    scheme: "local",
+    locator,
+    path: locator,
+    ...target ? { target } : {},
+    normalized: normalizeInstallReference("local", locator, void 0, target)
+  };
+}
+function buildGitHubInstallReference(raw, locator, version, target) {
+  if (!OWNER_PAIR_PATTERN.test(locator)) {
+    throw installReferenceError("GitHub install references must look like github:<owner>/<repo>[@<version>][#<target>].");
+  }
+  const [owner, repo] = locator.split("/");
+  return {
+    raw,
+    scheme: "github",
+    locator,
+    owner,
+    repo,
+    ...version ? { version } : {},
+    ...target ? { target } : {},
+    normalized: normalizeInstallReference("github", locator, version, target)
+  };
+}
+function buildNpmInstallReference(raw, locator, version, target) {
+  if (!NPM_PACKAGE_PATTERN.test(locator)) {
+    throw installReferenceError("npm install references must look like npm:<package>[@<version>][#<target>].");
+  }
+  return {
+    raw,
+    scheme: "npm",
+    locator,
+    packageName: locator,
+    ...version ? { version } : {},
+    ...target ? { target } : {},
+    normalized: normalizeInstallReference("npm", locator, version, target)
+  };
+}
+function buildTeamInstallReference(raw, locator, version, target) {
+  if (!OWNER_PAIR_PATTERN.test(locator)) {
+    throw installReferenceError("Team install references must look like team:<team>/<plugin>[@<version>][#<target>].");
+  }
+  const [team, plugin] = locator.split("/");
+  return {
+    raw,
+    scheme: "team",
+    locator,
+    team,
+    plugin,
+    ...version ? { version } : {},
+    ...target ? { target } : {},
+    normalized: normalizeInstallReference("team", locator, version, target)
+  };
+}
+function splitInstallReferenceTarget(input) {
+  const targetSeparator = input.lastIndexOf("#");
+  if (targetSeparator === -1) return { body: input };
+  const body = input.slice(0, targetSeparator).trim();
+  const rawTarget = input.slice(targetSeparator + 1).trim();
+  if (!rawTarget) {
+    throw installReferenceError('Install reference target cannot be empty after "#".');
+  }
+  const parsedTarget = TargetPlatform.safeParse(rawTarget);
+  if (!parsedTarget.success) {
+    throw installReferenceError(`Unknown install reference target "${rawTarget}".`);
+  }
+  return { body, target: parsedTarget.data };
+}
+function splitInstallReferenceVersion(input) {
+  const versionSeparator = input.lastIndexOf("@");
+  if (versionSeparator <= 0) {
+    return { locator: input.trim() };
+  }
+  const locator = input.slice(0, versionSeparator).trim();
+  const version = input.slice(versionSeparator + 1).trim();
+  if (!version) {
+    throw installReferenceError('Install reference version cannot be empty after "@".');
+  }
+  return { locator, version };
+}
+function validateInstallReferenceVersion(version) {
+  if (!version) return;
+  if (!VERSION_PATTERN.test(version)) {
+    throw installReferenceError(`Install reference version "${version}" is not valid.`);
+  }
+}
+function normalizeInstallReference(scheme, locator, version, target) {
+  return `${scheme}:${locator}${version ? `@${version}` : ""}${target ? `#${target}` : ""}`;
+}
+function isInstallReferenceScheme(value) {
+  return INSTALL_REFERENCE_SCHEMES.includes(value);
+}
+function installReferenceError(message) {
+  return new Error(`${message} ${INSTALL_REFERENCE_HELP}`);
+}
+
+// src/host-detection.ts
+import { accessSync, constants, existsSync as existsSync4, statSync as statSync2 } from "fs";
+import { delimiter, resolve as resolve4 } from "path";
+import { homedir } from "os";
+var CORE_HOST_FAMILIES = CORE_FOUR_PLATFORMS;
+var HOST_EVIDENCE = {
+  "claude-code": [
+    { type: "cli", label: "Claude Code CLI", command: "claude" },
+    { type: "user-config", label: "Claude user config", path: ({ homeDir }) => resolve4(homeDir, ".claude.json") },
+    { type: "user-config", label: "Claude settings directory", path: ({ homeDir }) => resolve4(homeDir, ".claude/settings.json") },
+    { type: "project-config", label: "Claude project MCP config", path: ({ rootDir }) => resolve4(rootDir, ".mcp.json") },
+    { type: "project-config", label: "Claude project settings", path: ({ rootDir }) => resolve4(rootDir, ".claude/settings.json") },
+    { type: "installed-plugin", label: "Claude plugin cache", path: ({ homeDir }) => resolve4(homeDir, ".claude/plugins/cache") },
+    { type: "installed-plugin", label: "Legacy Claude plugin directory", path: ({ homeDir }) => resolve4(homeDir, ".claude/plugins") }
+  ],
+  cursor: [
+    { type: "cli", label: "Cursor CLI", command: "cursor" },
+    { type: "cli", label: "Cursor agent CLI", command: "cursor-agent" },
+    { type: "app", label: "Cursor app bundle", path: ({ appDirs }) => resolveFirstAppPath(appDirs, "Cursor.app") },
+    { type: "user-config", label: "Cursor user MCP config", path: ({ homeDir }) => resolve4(homeDir, ".cursor/mcp.json") },
+    { type: "user-config", label: "Cursor user settings", path: ({ homeDir }) => resolve4(homeDir, ".cursor/settings.json") },
+    { type: "project-config", label: "Cursor project MCP config", path: ({ rootDir }) => resolve4(rootDir, ".cursor/mcp.json") },
+    { type: "project-config", label: "Cursor project rules", path: ({ rootDir }) => resolve4(rootDir, ".cursor/rules") },
+    { type: "project-config", label: "Cursor root MCP config", path: ({ rootDir }) => resolve4(rootDir, "mcp.json") },
+    { type: "installed-plugin", label: "Cursor local plugins", path: ({ homeDir }) => resolve4(homeDir, ".cursor/plugins/local") }
+  ],
+  codex: [
+    { type: "cli", label: "Codex CLI", command: "codex" },
+    { type: "app", label: "Codex app bundle", path: ({ appDirs }) => resolveFirstAppPath(appDirs, "Codex.app") },
+    { type: "user-config", label: "Codex user config", path: ({ homeDir }) => resolve4(homeDir, ".codex/config.toml") },
+    { type: "project-config", label: "Codex project config", path: ({ rootDir }) => resolve4(rootDir, ".codex/config.toml") },
+    { type: "project-config", label: "Codex project agents", path: ({ rootDir }) => resolve4(rootDir, ".codex/agents") },
+    { type: "installed-plugin", label: "Codex local plugins", path: ({ homeDir }) => resolve4(homeDir, ".codex/plugins") },
+    { type: "installed-plugin", label: "Codex local marketplace catalog", path: ({ homeDir }) => resolve4(homeDir, ".agents/plugins/marketplace.json") }
+  ],
+  opencode: [
+    { type: "cli", label: "OpenCode CLI", command: "opencode" },
+    { type: "user-config", label: "OpenCode user config", path: ({ homeDir }) => resolve4(homeDir, ".config/opencode/opencode.json") },
+    { type: "project-config", label: "OpenCode project config", path: ({ rootDir }) => resolve4(rootDir, "opencode.json") },
+    { type: "project-config", label: "OpenCode alternate project config", path: ({ rootDir }) => resolve4(rootDir, ".opencode.json") },
+    { type: "project-config", label: "OpenCode project directory", path: ({ rootDir }) => resolve4(rootDir, ".opencode") },
+    { type: "installed-plugin", label: "OpenCode local plugins", path: ({ homeDir }) => resolve4(homeDir, ".config/opencode/plugins") },
+    { type: "installed-plugin", label: "OpenCode synced skills", path: ({ homeDir }) => resolve4(homeDir, ".config/opencode/skills") }
+  ]
+};
+function detectHostFamilies(options = {}) {
+  const context = {
+    rootDir: options.rootDir ?? process.cwd(),
+    homeDir: options.homeDir ?? homedir(),
+    pathEnv: options.pathEnv ?? process.env.PATH ?? "",
+    appDirs: options.appDirs ?? defaultAppDirs(options.homeDir ?? homedir()),
+    platform: options.platform ?? process.platform
+  };
+  const hostSet = new Set(options.hosts ?? CORE_HOST_FAMILIES);
+  const hosts = CORE_HOST_FAMILIES.filter((host) => hostSet.has(host)).map((host) => detectHostFamily(host, context));
+  return {
+    hosts,
+    detectedHosts: hosts.filter((host) => host.detected).map((host) => host.host)
+  };
+}
+function buildHostTargetSelection(configTargets, explicitTargets, report) {
+  const selectedTargets = explicitTargets ?? configTargets;
+  const configCoreTargets = configTargets.filter(isCoreHostFamily);
+  const suggestedTargets = report.detectedHosts.filter((host) => configCoreTargets.includes(host));
+  const explicitOverride = explicitTargets !== void 0;
+  return {
+    source: explicitOverride ? "explicit-targets" : "config-targets",
+    selectedTargets,
+    detectedHosts: report.detectedHosts,
+    suggestedTargets,
+    explicitOverride,
+    note: explicitOverride ? "Explicit --target selection is authoritative; host detection did not change selected targets." : "Host detection is informational; install targets still come from pluxx.config targets."
+  };
+}
+function detectHostFamily(host, context) {
+  const evidence = HOST_EVIDENCE[host].map((candidate) => resolveEvidence(candidate, context)).filter((item) => item !== void 0);
+  return {
+    host,
+    detected: evidence.some(isMachineLevelEvidence),
+    evidence
+  };
+}
+function isMachineLevelEvidence(evidence) {
+  return evidence.type !== "project-config";
+}
+function resolveEvidence(candidate, context) {
+  if (candidate.command) {
+    const commandPath = findExecutable(candidate.command, context.pathEnv, context.platform);
+    if (!commandPath) return void 0;
+    return {
+      type: candidate.type,
+      label: candidate.label,
+      command: candidate.command,
+      path: commandPath
+    };
+  }
+  if (!candidate.path) return void 0;
+  const evidencePath = candidate.path(context);
+  if (!evidencePath || !existsSync4(evidencePath)) return void 0;
+  return {
+    type: candidate.type,
+    label: candidate.label,
+    path: evidencePath
+  };
+}
+function findExecutable(command, pathEnv, platform) {
+  if (!pathEnv.trim()) return void 0;
+  const names = platform === "win32" ? [command, `${command}.exe`, `${command}.cmd`, `${command}.bat`] : [command];
+  for (const dir of pathEnv.split(delimiter).filter(Boolean)) {
+    for (const name of names) {
+      const candidate = resolve4(dir, name);
+      if (isExecutableFile(candidate, platform)) return candidate;
+    }
+  }
+  return void 0;
+}
+function isExecutableFile(path, platform) {
+  try {
+    if (!statSync2(path).isFile()) return false;
+    if (platform === "win32") return true;
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function defaultAppDirs(homeDir) {
+  return [
+    "/Applications",
+    resolve4(homeDir, "Applications")
+  ];
+}
+function resolveFirstAppPath(appDirs, appName) {
+  return appDirs.map((dir) => resolve4(dir, appName)).find((path) => existsSync4(path)) ?? resolve4(appDirs[0] ?? "/", appName);
+}
+function isCoreHostFamily(target) {
+  return CORE_HOST_FAMILIES.includes(target);
+}
+
 // src/cli/verify-install.ts
-import { existsSync as existsSync5, lstatSync as lstatSync2, readdirSync as readdirSync3, readFileSync as readFileSync5, readlinkSync, realpathSync as realpathSync2, statSync } from "fs";
-import { resolve as resolve5 } from "path";
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync7, lstatSync as lstatSync2, readdirSync as readdirSync4, readFileSync as readFileSync6, readlinkSync, realpathSync as realpathSync2, statSync as statSync3 } from "fs";
+import { resolve as resolve7 } from "path";
 
 // src/cli/doctor.ts
 import { spawn, spawnSync as spawnSync2 } from "child_process";
-import { accessSync, constants, existsSync as existsSync4, lstatSync, readFileSync as readFileSync4, readdirSync as readdirSync2, realpathSync } from "fs";
-import { homedir } from "os";
-import { basename as basename2, dirname as dirname2, relative as relative2, resolve as resolve4 } from "path";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync6, lstatSync, readFileSync as readFileSync5, readdirSync as readdirSync3, realpathSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { basename as basename2, dirname as dirname2, relative as relative3, resolve as resolve6 } from "path";
 
 // node_modules/jiti/lib/jiti.mjs
 var import_jiti = __toESM(require_jiti(), 1);
@@ -10767,8 +11397,8 @@ var CONFIG_FILES = [
 ];
 
 // src/cli/install.ts
-import { resolve as resolve3, dirname, basename, relative } from "path";
-import { existsSync as existsSync3, symlinkSync, mkdirSync as mkdirSync2, rmSync as rmSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2, cpSync, readdirSync } from "fs";
+import { resolve as resolve5, dirname, basename, relative as relative2 } from "path";
+import { existsSync as existsSync5, symlinkSync, mkdirSync as mkdirSync2, rmSync as rmSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2, cpSync, readdirSync as readdirSync2 } from "fs";
 
 // src/mcp-stdio-paths.ts
 function findHostPluginRootVars(value) {
@@ -10797,57 +11427,57 @@ function getInstallTargets(pluginName) {
   return [
     {
       platform: "claude-code",
-      pluginDir: resolve3(home, ".claude/plugins", pluginName),
+      pluginDir: resolve5(home, ".claude/plugins", pluginName),
       description: `claude plugin install ${pluginName}@${getClaudeMarketplaceName(pluginName)}`
     },
     {
       platform: "cursor",
-      pluginDir: resolve3(home, ".cursor/plugins/local", pluginName),
+      pluginDir: resolve5(home, ".cursor/plugins/local", pluginName),
       description: `~/.cursor/plugins/local/${pluginName}`
     },
     {
       platform: "codex",
-      pluginDir: resolve3(home, ".codex/plugins", pluginName),
+      pluginDir: resolve5(home, ".codex/plugins", pluginName),
       description: `~/.codex/plugins/${pluginName} (via ~/.agents/plugins/marketplace.json)`
     },
     {
       platform: "opencode",
-      pluginDir: resolve3(home, ".config/opencode/plugins", pluginName),
+      pluginDir: resolve5(home, ".config/opencode/plugins", pluginName),
       description: `~/.config/opencode/plugins/${pluginName}.ts + ~/.config/opencode/plugins/${pluginName}/`
     },
     {
       platform: "github-copilot",
-      pluginDir: resolve3(home, ".github-copilot/plugins", pluginName),
+      pluginDir: resolve5(home, ".github-copilot/plugins", pluginName),
       description: `~/.github-copilot/plugins/${pluginName}`
     },
     {
       platform: "openhands",
-      pluginDir: resolve3(home, ".openhands/plugins", pluginName),
+      pluginDir: resolve5(home, ".openhands/plugins", pluginName),
       description: `~/.openhands/plugins/${pluginName}`
     },
     {
       platform: "warp",
-      pluginDir: resolve3(home, ".warp/plugins", pluginName),
+      pluginDir: resolve5(home, ".warp/plugins", pluginName),
       description: `~/.warp/plugins/${pluginName}`
     },
     {
       platform: "gemini-cli",
-      pluginDir: resolve3(home, ".gemini/extensions", pluginName),
+      pluginDir: resolve5(home, ".gemini/extensions", pluginName),
       description: `~/.gemini/extensions/${pluginName}`
     },
     {
       platform: "roo-code",
-      pluginDir: resolve3(home, ".roo/plugins", pluginName),
+      pluginDir: resolve5(home, ".roo/plugins", pluginName),
       description: `~/.roo/plugins/${pluginName}`
     },
     {
       platform: "cline",
-      pluginDir: resolve3(home, ".cline/plugins", pluginName),
+      pluginDir: resolve5(home, ".cline/plugins", pluginName),
       description: `~/.cline/plugins/${pluginName}`
     },
     {
       platform: "amp",
-      pluginDir: resolve3(home, ".amp/plugins", pluginName),
+      pluginDir: resolve5(home, ".amp/plugins", pluginName),
       description: `~/.amp/plugins/${pluginName}`
     }
   ];
@@ -10858,10 +11488,10 @@ function getClaudeMarketplaceName(pluginName) {
 function readBundleManifestVersion(rootDir, platform) {
   const manifestPath = manifestPathForPlatform(platform);
   if (!manifestPath) return void 0;
-  const filepath = resolve3(rootDir, manifestPath);
-  if (!existsSync3(filepath)) return void 0;
+  const filepath = resolve5(rootDir, manifestPath);
+  if (!existsSync5(filepath)) return void 0;
   try {
-    const manifest = JSON.parse(readFileSync3(filepath, "utf-8"));
+    const manifest = JSON.parse(readFileSync4(filepath, "utf-8"));
     return typeof manifest.version === "string" ? manifest.version : void 0;
   } catch {
     return void 0;
@@ -10870,7 +11500,7 @@ function readBundleManifestVersion(rootDir, platform) {
 function resolveClaudeInstalledCachePath(pluginName, version) {
   if (!version) return void 0;
   const home = process.env.HOME ?? "~";
-  return resolve3(home, ".claude/plugins/cache", getClaudeMarketplaceName(pluginName), pluginName, version);
+  return resolve5(home, ".claude/plugins/cache", getClaudeMarketplaceName(pluginName), pluginName, version);
 }
 function resolveExpectedInstalledConsumerPath(target, pluginName) {
   if (target.platform === "claude-code" && pluginName !== "") {
@@ -10885,8 +11515,8 @@ function resolveExpectedInstalledConsumerPath(target, pluginName) {
 function resolveInstalledConsumerPath(target, pluginName) {
   if (target.platform === "claude-code" && pluginName !== "") {
     const expectedPath = resolveExpectedInstalledConsumerPath(target, pluginName);
-    if (existsSync3(expectedPath)) return expectedPath;
-    if (existsSync3(target.pluginDir)) return target.pluginDir;
+    if (existsSync5(expectedPath)) return expectedPath;
+    if (existsSync5(target.pluginDir)) return target.pluginDir;
     return expectedPath;
   }
   return target.pluginDir;
@@ -10908,13 +11538,13 @@ function manifestPathForPlatform(platform) {
 function isRelativeBundlePath(value) {
   return value.startsWith("./") || value.startsWith("../") || value.startsWith(".\\") || value.startsWith("..\\");
 }
-function resolveBundleReference(rootDir, value) {
+function resolveBundleReference2(rootDir, value) {
   if (isRelativeBundlePath(value)) {
-    return resolve3(rootDir, value);
+    return resolve5(rootDir, value);
   }
   const pluginRootMatch = value.match(/^\$\{(?:CLAUDE_PLUGIN_ROOT|CURSOR_PLUGIN_ROOT|CODEX_PLUGIN_ROOT|OPENCODE_PLUGIN_ROOT|PLUGIN_ROOT|PLUXX_PLUGIN_ROOT)\}[\\/](.+)$/);
   if (pluginRootMatch) {
-    return resolve3(rootDir, pluginRootMatch[1]);
+    return resolve5(rootDir, pluginRootMatch[1]);
   }
   return void 0;
 }
@@ -10965,15 +11595,26 @@ function commandChangesToKnownPluginRoot(command) {
   return /\bcd\s+["']?\$\{?(?:CLAUDE_PLUGIN_ROOT|CURSOR_PLUGIN_ROOT|CODEX_PLUGIN_ROOT|OPENCODE_PLUGIN_ROOT|PLUGIN_ROOT|PLUXX_PLUGIN_ROOT)\}?/.test(command);
 }
 function formatBundleRelativePath(rootDir, filePath) {
-  const relativePath = relative(rootDir, filePath);
+  const relativePath = relative2(rootDir, filePath);
   return relativePath && !relativePath.startsWith("..") ? relativePath : filePath;
 }
 function findHookWrapperPaths(rootDir, command) {
-  return extractBundleCommandTargets(command).map((target) => resolveBundleReference(rootDir, target)).filter((target) => {
+  return extractBundleCommandTargets(command).map((target) => resolveBundleReference2(rootDir, target)).filter((target) => {
     if (!target) return false;
-    return existsSync3(target) && basename(target).startsWith("pluxx-hook-command-") && target.endsWith(".sh");
+    return existsSync5(target) && basename(target).startsWith("pluxx-hook-command-") && (target.endsWith(".sh") || target.endsWith(".mjs"));
   });
 }
+function extractGeneratedHookWrapperCommand(wrapper) {
+  const shellAssignment = wrapper.match(/^PLUXX_HOOK_COMMAND=(.*)$/m)?.[1];
+  if (shellAssignment) return shellAssignment;
+  const nodeAssignment = wrapper.match(/^const COMMAND = (.*)$/m)?.[1];
+  if (!nodeAssignment) return "";
+  try {
+    return JSON.parse(nodeAssignment);
+  } catch {
+    return nodeAssignment;
+  }
+}
 function findCodexCwdUnsafeHookCommands(rootDir, commands) {
   const issues = /* @__PURE__ */ new Set();
   for (const command of commands) {
@@ -10982,8 +11623,8 @@ function findCodexCwdUnsafeHookCommands(rootDir, commands) {
       issues.add(`${command} uses cwd-relative bundle target(s): ${relativeTargets.join(", ")}`);
     }
     for (const wrapperPath of findHookWrapperPaths(rootDir, command)) {
-      const wrapper = readFileSync3(wrapperPath, "utf-8");
-      const hookCommand = wrapper.match(/^PLUXX_HOOK_COMMAND=(.*)$/m)?.[1] ?? "";
+      const wrapper = readFileSync4(wrapperPath, "utf-8");
+      const hookCommand = extractGeneratedHookWrapperCommand(wrapper);
       const wrapperRelativeTargets = extractRelativeBundleCommandTargets(hookCommand);
       if (wrapperRelativeTargets.length > 0 && !commandChangesToKnownPluginRoot(wrapper)) {
         issues.add(`${formatBundleRelativePath(rootDir, wrapperPath)} evaluates cwd-relative bundle target(s): ${wrapperRelativeTargets.join(", ")}`);
@@ -10997,13 +11638,13 @@ function resolveInstalledHooksReference(rootDir, platform, manifest) {
   if (manifestReference) {
     return {
       reference: manifestReference,
-      path: resolveBundleReference(rootDir, manifestReference)
+      path: resolveBundleReference2(rootDir, manifestReference)
     };
   }
   if (platform === "claude-code") {
     const fallbackReference = "./hooks/hooks.json";
-    const fallbackPath = resolve3(rootDir, "hooks/hooks.json");
-    if (existsSync3(fallbackPath)) {
+    const fallbackPath = resolve5(rootDir, "hooks/hooks.json");
+    if (existsSync5(fallbackPath)) {
       return {
         reference: fallbackReference,
         path: fallbackPath
@@ -11016,9 +11657,9 @@ function getClaudeStandardHooksManifestIssue(rootDir, platform, manifest) {
   if (platform !== "claude-code") return void 0;
   const manifestReference = typeof manifest.hooks === "string" ? manifest.hooks : void 0;
   if (!manifestReference) return void 0;
-  const manifestHooksPath = resolveBundleReference(rootDir, manifestReference);
-  const standardHooksPath = resolve3(rootDir, "hooks/hooks.json");
-  if (!manifestHooksPath || manifestHooksPath !== standardHooksPath || !existsSync3(standardHooksPath)) {
+  const manifestHooksPath = resolveBundleReference2(rootDir, manifestReference);
+  const standardHooksPath = resolve5(rootDir, "hooks/hooks.json");
+  if (!manifestHooksPath || manifestHooksPath !== standardHooksPath || !existsSync5(standardHooksPath)) {
     return void 0;
   }
   return "Claude auto-loads hooks/hooks.json. Current Claude CLI releases report a duplicate hooks file load error when manifest.hooks also points at ./hooks/hooks.json, so manifest.hooks should only reference additional hook files.";
@@ -11033,8 +11674,8 @@ function findInstalledBundleIntegrityIssues(rootDir, platform) {
       invalidRuntimeScripts: []
     };
   }
-  const manifestFile = resolve3(rootDir, manifestPath);
-  if (!existsSync3(manifestFile)) {
+  const manifestFile = resolve5(rootDir, manifestPath);
+  if (!existsSync5(manifestFile)) {
     return {
       manifestIssue: `missing plugin manifest at ${manifestPath}`,
       missingManifestPaths: [],
@@ -11045,7 +11686,7 @@ function findInstalledBundleIntegrityIssues(rootDir, platform) {
   }
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync3(manifestFile, "utf-8"));
+    manifest = JSON.parse(readFileSync4(manifestFile, "utf-8"));
   } catch (error) {
     return {
       manifestIssue: `plugin manifest at ${manifestPath} is not parseable: ${error instanceof Error ? error.message : String(error)}`,
@@ -11056,8 +11697,8 @@ function findInstalledBundleIntegrityIssues(rootDir, platform) {
     };
   }
   const missingManifestPaths = readBundleManifestReferences(manifest).filter((value) => {
-    const resolved = resolveBundleReference(rootDir, value);
-    return resolved !== void 0 && !existsSync3(resolved);
+    const resolved = resolveBundleReference2(rootDir, value);
+    return resolved !== void 0 && !existsSync5(resolved);
   }).sort();
   const manifestIssue = getClaudeStandardHooksManifestIssue(rootDir, platform, manifest);
   const { reference: hooksReference, path: hooksPath } = resolveInstalledHooksReference(rootDir, platform, manifest);
@@ -11070,7 +11711,7 @@ function findInstalledBundleIntegrityIssues(rootDir, platform) {
       invalidRuntimeScripts: findInstalledRuntimeScriptIssues(rootDir, manifest)
     };
   }
-  if (!hooksPath || !existsSync3(hooksPath)) {
+  if (!hooksPath || !existsSync5(hooksPath)) {
     return {
       ...manifestIssue ? { manifestIssue } : {},
       missingManifestPaths,
@@ -11080,13 +11721,13 @@ function findInstalledBundleIntegrityIssues(rootDir, platform) {
     };
   }
   try {
-    const hooks = JSON.parse(readFileSync3(hooksPath, "utf-8"));
+    const hooks = JSON.parse(readFileSync4(hooksPath, "utf-8"));
     const commands = [];
     collectHookCommandStrings(hooks, commands);
     const missingHookTargets = [...new Set(
       commands.flatMap(extractBundleCommandTargets).filter((value) => {
-        const resolved = resolveBundleReference(rootDir, value);
-        return resolved !== void 0 && !existsSync3(resolved);
+        const resolved = resolveBundleReference2(rootDir, value);
+        return resolved !== void 0 && !existsSync5(resolved);
       })
     )].sort();
     const cwdUnsafeHookCommands = platform === "codex" ? findCodexCwdUnsafeHookCommands(rootDir, commands) : [];
@@ -11111,10 +11752,10 @@ function findInstalledBundleIntegrityIssues(rootDir, platform) {
 function findInstalledRuntimeScriptIssues(rootDir, manifest) {
   const mcpReference = typeof manifest.mcpServers === "string" ? manifest.mcpServers : void 0;
   if (!mcpReference) return [];
-  const mcpPath = resolveBundleReference(rootDir, mcpReference);
-  if (!mcpPath || !existsSync3(mcpPath)) return [];
+  const mcpPath = resolveBundleReference2(rootDir, mcpReference);
+  if (!mcpPath || !existsSync5(mcpPath)) return [];
   try {
-    const parsed = JSON.parse(readFileSync3(mcpPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync4(mcpPath, "utf-8"));
     const issues = /* @__PURE__ */ new Set();
     for (const [serverName, server] of Object.entries(parsed.mcpServers ?? {})) {
       if (!server || typeof server !== "object") continue;
@@ -11125,9 +11766,9 @@ function findInstalledRuntimeScriptIssues(rootDir, manifest) {
         ...args
       ].flatMap(extractBundleCommandTargets);
       for (const target of commandTargets) {
-        const resolved = resolveBundleReference(rootDir, target);
-        if (!resolved || !existsSync3(resolved) || !resolved.endsWith(".sh")) continue;
-        const content = readFileSync3(resolved, "utf-8");
+        const resolved = resolveBundleReference2(rootDir, target);
+        if (!resolved || !existsSync5(resolved) || !resolved.endsWith(".sh")) continue;
+        const content = readFileSync4(resolved, "utf-8");
         if (!content.includes("check-env.sh")) continue;
         const relativePath = resolved.startsWith(`${rootDir}/`) ? resolved.slice(rootDir.length + 1) : resolved;
         issues.add(`runtime script ${relativePath} for MCP server "${serverName}" still references installer-owned scripts/check-env.sh`);
@@ -11142,12 +11783,12 @@ function planInstallPlugin(distDir, pluginName, platforms) {
   const targets = getInstallTargets(pluginName);
   const filtered = platforms ? targets.filter((t) => platforms.includes(t.platform)) : targets;
   return filtered.map((target) => {
-    const sourceDir = resolve3(distDir, target.platform);
+    const sourceDir = resolve5(distDir, target.platform);
     return {
       ...target,
       sourceDir,
-      built: existsSync3(sourceDir),
-      existing: existsSync3(target.pluginDir)
+      built: existsSync5(sourceDir),
+      existing: existsSync5(target.pluginDir)
     };
   });
 }
@@ -11487,29 +12128,29 @@ function looksLegacySecretIdentifier(value) {
 }
 function walkInstalledBundleFiles(rootDir, currentDir = rootDir) {
   const files = [];
-  for (const entry of readdirSync2(currentDir, { withFileTypes: true })) {
-    const absolutePath = resolve4(currentDir, entry.name);
+  for (const entry of readdirSync3(currentDir, { withFileTypes: true })) {
+    const absolutePath = resolve6(currentDir, entry.name);
     if (entry.isDirectory()) {
       files.push(...walkInstalledBundleFiles(rootDir, absolutePath));
       continue;
     }
     if (!entry.isFile()) continue;
-    files.push(relative2(rootDir, absolutePath).replace(/\\/g, "/"));
+    files.push(relative3(rootDir, absolutePath).replace(/\\/g, "/"));
   }
   return files.sort();
 }
 function readInstalledTextFile(rootDir, relativePath) {
-  const absolutePath = resolve4(rootDir, relativePath);
-  const content = readFileSync4(absolutePath);
+  const absolutePath = resolve6(rootDir, relativePath);
+  const content = readFileSync5(absolutePath);
   if (content.length > MAX_SECRET_SCAN_FILE_BYTES) return null;
   if (content.includes(0)) return null;
   return content.toString("utf-8");
 }
 function collectInstalledPlaintextSecretCandidates(rootDir) {
-  const userConfigPath = resolve4(rootDir, ".pluxx-user.json");
-  if (!existsSync4(userConfigPath)) return [];
+  const userConfigPath = resolve6(rootDir, ".pluxx-user.json");
+  if (!existsSync6(userConfigPath)) return [];
   try {
-    const payload = JSON.parse(readFileSync4(userConfigPath, "utf-8"));
+    const payload = JSON.parse(readFileSync5(userConfigPath, "utf-8"));
     if (payload.secretStorage === "materialized") return [];
     const secretKeys = new Set(Array.isArray(payload.secretKeys) ? payload.secretKeys.filter((value) => typeof value === "string") : []);
     const secretEnv = new Set(Array.isArray(payload.secretEnv) ? payload.secretEnv.filter((value) => typeof value === "string") : []);
@@ -11621,7 +12262,7 @@ function addRuntimeChecks(checks, mode) {
   }
 }
 function detectConsumerLayout(rootDir) {
-  if (existsSync4(resolve4(rootDir, ".claude-plugin/plugin.json"))) {
+  if (existsSync6(resolve6(rootDir, ".claude-plugin/plugin.json"))) {
     return {
       kind: "installed-platform",
       platform: "claude-code",
@@ -11629,7 +12270,7 @@ function detectConsumerLayout(rootDir) {
       mcpConfigPath: ".mcp.json"
     };
   }
-  if (existsSync4(resolve4(rootDir, ".cursor-plugin/plugin.json"))) {
+  if (existsSync6(resolve6(rootDir, ".cursor-plugin/plugin.json"))) {
     return {
       kind: "installed-platform",
       platform: "cursor",
@@ -11637,7 +12278,7 @@ function detectConsumerLayout(rootDir) {
       mcpConfigPath: "mcp.json"
     };
   }
-  if (existsSync4(resolve4(rootDir, ".codex-plugin/plugin.json"))) {
+  if (existsSync6(resolve6(rootDir, ".codex-plugin/plugin.json"))) {
     return {
       kind: "installed-platform",
       platform: "codex",
@@ -11645,11 +12286,11 @@ function detectConsumerLayout(rootDir) {
       mcpConfigPath: ".mcp.json"
     };
   }
-  const packagePath = resolve4(rootDir, "package.json");
-  const indexPath = resolve4(rootDir, "index.ts");
-  if (existsSync4(packagePath) && existsSync4(indexPath)) {
+  const packagePath = resolve6(rootDir, "package.json");
+  const indexPath = resolve6(rootDir, "index.ts");
+  if (existsSync6(packagePath) && existsSync6(indexPath)) {
     try {
-      const pkg = JSON.parse(readFileSync4(packagePath, "utf-8"));
+      const pkg = JSON.parse(readFileSync5(packagePath, "utf-8"));
       if (pkg.peerDependencies?.["@opencode-ai/plugin"] || pkg.keywords?.includes("opencode-plugin")) {
         return {
           kind: "installed-platform",
@@ -11665,22 +12306,22 @@ function detectConsumerLayout(rootDir) {
       };
     }
   }
-  if (CONFIG_FILES.some((filename) => existsSync4(resolve4(rootDir, filename)))) {
+  if (CONFIG_FILES.some((filename) => existsSync6(resolve6(rootDir, filename)))) {
     return { kind: "source-project" };
   }
-  if (["claude-code", "cursor", "codex", "opencode"].some((dir) => existsSync4(resolve4(rootDir, dir)))) {
+  if (["claude-code", "cursor", "codex", "opencode"].some((dir) => existsSync6(resolve6(rootDir, dir)))) {
     return { kind: "multi-target-dist" };
   }
   return { kind: "unknown" };
 }
 function readJsonFile(rootDir, relativePath) {
-  return JSON.parse(readFileSync4(resolve4(rootDir, relativePath), "utf-8"));
+  return JSON.parse(readFileSync5(resolve6(rootDir, relativePath), "utf-8"));
 }
 function listCodexConfigCandidates(projectRoot) {
-  const projectCandidate = resolve4(projectRoot ?? process.cwd(), ".codex/config.toml");
-  const homeDir = process.env.HOME?.trim() || homedir();
-  const codexHome = process.env.CODEX_HOME?.trim() || resolve4(homeDir, ".codex");
-  const userCandidate = resolve4(codexHome, "config.toml");
+  const projectCandidate = resolve6(projectRoot ?? process.cwd(), ".codex/config.toml");
+  const homeDir = process.env.HOME?.trim() || homedir2();
+  const codexHome = process.env.CODEX_HOME?.trim() || resolve6(homeDir, ".codex");
+  const userCandidate = resolve6(codexHome, "config.toml");
   const seen = /* @__PURE__ */ new Set();
   const candidates = [];
   for (const candidate of [
@@ -11695,7 +12336,7 @@ function listCodexConfigCandidates(projectRoot) {
 }
 function readCodexHooksFeatureFlag(filePath) {
   let inFeaturesTable = false;
-  const lines = readFileSync4(filePath, "utf-8").split(/\r?\n/);
+  const lines = readFileSync5(filePath, "utf-8").split(/\r?\n/);
   let pluginBundled;
   let recommended;
   let alternate;
@@ -11744,7 +12385,7 @@ function readCodexHooksFeatureFlag(filePath) {
 }
 function probeCodexHooksFeatureFlags(projectRoot) {
   return listCodexConfigCandidates(projectRoot).map((candidate) => {
-    if (!existsSync4(candidate.path)) {
+    if (!existsSync6(candidate.path)) {
       return {
         ...candidate,
         exists: false,
@@ -11779,7 +12420,7 @@ function probeCodexHooksFeatureFlags(projectRoot) {
 }
 function probeCodexMcpApprovalEntries(projectRoot) {
   return listCodexConfigCandidates(projectRoot).map((candidate) => {
-    if (!existsSync4(candidate.path)) {
+    if (!existsSync6(candidate.path)) {
       return {
         ...candidate,
         exists: false,
@@ -11790,7 +12431,7 @@ function probeCodexMcpApprovalEntries(projectRoot) {
       return {
         ...candidate,
         exists: true,
-        approvals: parseCodexApprovedMcpToolsFromToml(readFileSync4(candidate.path, "utf-8"))
+        approvals: parseCodexApprovedMcpToolsFromToml(readFileSync5(candidate.path, "utf-8"))
       };
     } catch (error) {
       return {
@@ -11805,7 +12446,7 @@ function probeCodexMcpApprovalEntries(projectRoot) {
 function getCodexProjectPathCandidates(projectRoot) {
   if (!projectRoot) return [];
   const candidates = /* @__PURE__ */ new Set();
-  const resolvedProjectRoot = resolve4(projectRoot);
+  const resolvedProjectRoot = resolve6(projectRoot);
   candidates.add(resolvedProjectRoot);
   try {
     candidates.add(realpathSync(resolvedProjectRoot));
@@ -11825,7 +12466,7 @@ function parseCodexProjectKeySegment(segment) {
 function readCodexProjectTrust(filePath, projectPaths) {
   const matchedPaths = /* @__PURE__ */ new Set();
   let currentProjectKey = null;
-  const lines = readFileSync4(filePath, "utf-8").split(/\r?\n/);
+  const lines = readFileSync5(filePath, "utf-8").split(/\r?\n/);
   for (const rawLine of lines) {
     const line = stripTomlComment(rawLine).trim();
     if (!line) continue;
@@ -11862,7 +12503,7 @@ function probeCodexProjectTrust(projectRoot) {
   if (projectPaths.length === 0) return void 0;
   const userConfig = listCodexConfigCandidates(projectRoot).find((candidate) => candidate.scope === "user");
   if (!userConfig) return void 0;
-  if (!existsSync4(userConfig.path)) {
+  if (!existsSync6(userConfig.path)) {
     return {
       path: userConfig.path,
       exists: false,
@@ -11901,16 +12542,16 @@ function getClaudeManagedSettingsPath() {
   }
 }
 function listClaudeSettingsCandidates(projectRoot) {
-  const homeDir = process.env.HOME?.trim() || homedir();
+  const homeDir = process.env.HOME?.trim() || homedir2();
   const candidates = [];
   const managedPath = getClaudeManagedSettingsPath();
   if (managedPath) {
     candidates.push({ path: managedPath, scope: "managed" });
   }
-  candidates.push({ path: resolve4(homeDir, ".claude/settings.json"), scope: "user" });
+  candidates.push({ path: resolve6(homeDir, ".claude/settings.json"), scope: "user" });
   if (projectRoot) {
-    candidates.push({ path: resolve4(projectRoot, ".claude/settings.json"), scope: "project" });
-    candidates.push({ path: resolve4(projectRoot, ".claude/settings.local.json"), scope: "local" });
+    candidates.push({ path: resolve6(projectRoot, ".claude/settings.json"), scope: "project" });
+    candidates.push({ path: resolve6(projectRoot, ".claude/settings.local.json"), scope: "local" });
   }
   const seen = /* @__PURE__ */ new Set();
   return candidates.filter((candidate) => {
@@ -11925,7 +12566,7 @@ function readClaudeDisableAllHooks(filePath) {
 }
 function probeClaudeDisableAllHooks(projectRoot) {
   return listClaudeSettingsCandidates(projectRoot).map((candidate) => {
-    if (!existsSync4(candidate.path)) {
+    if (!existsSync6(candidate.path)) {
       return {
         ...candidate,
         exists: false,
@@ -11949,7 +12590,7 @@ function probeClaudeDisableAllHooks(projectRoot) {
   });
 }
 function getInstalledClaudeHooksReference(rootDir, manifest) {
-  if (existsSync4(resolve4(rootDir, "hooks/hooks.json"))) {
+  if (existsSync6(resolve6(rootDir, "hooks/hooks.json"))) {
     return "./hooks/hooks.json";
   }
   const manifestReference = typeof manifest.hooks === "string" ? manifest.hooks : void 0;
@@ -11957,7 +12598,7 @@ function getInstalledClaudeHooksReference(rootDir, manifest) {
 }
 function checkConsumerBundlePath(checks, rootDir) {
   try {
-    accessSync(rootDir, constants.R_OK);
+    accessSync2(rootDir, constants2.R_OK);
     const details = lstatSync(rootDir);
     addCheck(checks, {
       level: "success",
@@ -12004,8 +12645,8 @@ function checkConsumerManifest(checks, rootDir, layout) {
 }
 function checkInstalledUserConfig(checks, rootDir) {
   const userConfigPath = ".pluxx-user.json";
-  const resolvedPath = resolve4(rootDir, userConfigPath);
-  if (!existsSync4(resolvedPath)) {
+  const resolvedPath = resolve6(rootDir, userConfigPath);
+  if (!existsSync6(resolvedPath)) {
     addCheck(checks, {
       level: "info",
       code: "consumer-user-config-missing",
@@ -12017,7 +12658,7 @@ function checkInstalledUserConfig(checks, rootDir) {
     return;
   }
   try {
-    const payload = JSON.parse(readFileSync4(resolvedPath, "utf-8"));
+    const payload = JSON.parse(readFileSync5(resolvedPath, "utf-8"));
     const valueCount = Object.keys(payload.values ?? {}).length;
     const envCount = Object.keys(payload.env ?? {}).length;
     const placeholderKeys = [
@@ -12055,8 +12696,8 @@ function checkInstalledUserConfig(checks, rootDir) {
 }
 function checkInstalledEnvValidation(checks, rootDir) {
   const envScriptPath = INSTALLER_OWNED_CHECK_ENV_PATH;
-  const resolvedPath = resolve4(rootDir, envScriptPath);
-  if (!existsSync4(resolvedPath)) {
+  const resolvedPath = resolve6(rootDir, envScriptPath);
+  if (!existsSync6(resolvedPath)) {
     addCheck(checks, {
       level: "info",
       code: "consumer-env-script-missing",
@@ -12067,7 +12708,7 @@ function checkInstalledEnvValidation(checks, rootDir) {
     });
     return;
   }
-  const content = readFileSync4(resolvedPath, "utf-8");
+  const content = readFileSync5(resolvedPath, "utf-8");
   if (content.includes(MATERIALIZED_ENV_MARKER)) {
     addCheck(checks, {
       level: "success",
@@ -12095,7 +12736,7 @@ function checkInstalledRuntimeScriptRoles(checks, rootDir) {
     "scripts/bootstrap-runtime.sh",
     "scripts/start-mcp.sh"
   ];
-  const presentRoles = roleFiles.filter((relativePath) => existsSync4(resolve4(rootDir, relativePath))).map((relativePath) => getRuntimeScriptRoleForPath(relativePath)).filter((role) => role !== null);
+  const presentRoles = roleFiles.filter((relativePath) => existsSync6(resolve6(rootDir, relativePath))).map((relativePath) => getRuntimeScriptRoleForPath(relativePath)).filter((role) => role !== null);
   if (presentRoles.length === 0) return;
   addCheck(checks, {
     level: "info",
@@ -12118,8 +12759,8 @@ async function checkInstalledMcpConfig(checks, rootDir, layout) {
     });
     return;
   }
-  const resolvedPath = resolve4(rootDir, layout.mcpConfigPath);
-  if (!existsSync4(resolvedPath)) {
+  const resolvedPath = resolve6(rootDir, layout.mcpConfigPath);
+  if (!existsSync6(resolvedPath)) {
     addCheck(checks, {
       level: "info",
       code: "consumer-mcp-config-missing",
@@ -12439,12 +13080,12 @@ function checkInstalledCodexProjectTrust(checks, rootDir, layout, options) {
 function checkInstalledCodexPermissionCompanion(checks, rootDir, layout, options) {
   if (layout.platform !== "codex") return;
   if (checks.some((check) => check.code === "consumer-bundle-integrity-invalid")) return;
-  const companionPath = resolve4(rootDir, ".codex/config.generated.toml");
+  const companionPath = resolve6(rootDir, ".codex/config.generated.toml");
   const companionReference = ".codex/config.generated.toml";
-  if (!existsSync4(companionPath)) return;
+  if (!existsSync6(companionPath)) return;
   let expectedEntries;
   try {
-    expectedEntries = parseCodexApprovedMcpToolsFromToml(readFileSync4(companionPath, "utf-8"));
+    expectedEntries = parseCodexApprovedMcpToolsFromToml(readFileSync5(companionPath, "utf-8"));
   } catch (error) {
     addCheck(checks, {
       level: "error",
@@ -12573,11 +13214,11 @@ function smokeCheckInstalledPermissionHook(rootDir, layout) {
   if (layout.platform !== "claude-code" && layout.platform !== "cursor") {
     return null;
   }
-  const scriptPath = resolve4(rootDir, "hooks/pluxx-permissions.mjs");
-  if (!existsSync4(scriptPath)) {
+  const scriptPath = resolve6(rootDir, "hooks/pluxx-permissions.mjs");
+  if (!existsSync6(scriptPath)) {
     return null;
   }
-  const rules = parseInstalledPermissionRules(readFileSync4(scriptPath, "utf-8"));
+  const rules = parseInstalledPermissionRules(readFileSync5(scriptPath, "utf-8"));
   const selected = /* @__PURE__ */ new Map();
   for (const rule of rules) {
     if (selected.has(rule.action)) continue;
@@ -12663,8 +13304,8 @@ function findMissingInstalledStdioRuntimePaths(rootDir, stdioEntries) {
     const args = Array.isArray(server.args) ? server.args.filter((value) => typeof value === "string") : [];
     for (const candidate of [command, ...args]) {
       if (!candidate || !isLikelyLocalRuntimePath(candidate)) continue;
-      const resolvedPath = resolve4(rootDir, candidate);
-      if (!existsSync4(resolvedPath)) {
+      const resolvedPath = resolve6(rootDir, candidate);
+      if (!existsSync6(resolvedPath)) {
         missing.add(candidate);
       }
     }
@@ -12775,7 +13416,7 @@ function checkInstalledOpenCodeHostBridge(checks, rootDir) {
   const pluginName = basename2(rootDir);
   const entryPath = `${rootDir}.ts`;
   const entryRelativePath = `${pluginName}.ts`;
-  if (!existsSync4(entryPath)) {
+  if (!existsSync6(entryPath)) {
     addCheck(checks, {
       level: "error",
       code: "consumer-opencode-entry-missing",
@@ -12786,7 +13427,7 @@ function checkInstalledOpenCodeHostBridge(checks, rootDir) {
     });
     return;
   }
-  const entryContent = readFileSync4(entryPath, "utf-8");
+  const entryContent = readFileSync5(entryPath, "utf-8");
   const expectedImport = `import * as PluginModule from "./${pluginName}/index.ts"`;
   const expectedBridge = `directory: join(context.directory, "${pluginName}")`;
   if (!entryContent.includes(expectedImport) || !entryContent.includes(expectedBridge)) {
@@ -12814,8 +13455,8 @@ function checkInstalledOpenCodeSkills(checks, rootDir) {
     return;
   }
   const pluginName = basename2(rootDir);
-  const sourceSkillsDir = resolve4(rootDir, "skills");
-  if (!existsSync4(sourceSkillsDir)) {
+  const sourceSkillsDir = resolve6(rootDir, "skills");
+  if (!existsSync6(sourceSkillsDir)) {
     addCheck(checks, {
       level: "info",
       code: "consumer-opencode-skill-sync-not-applicable",
@@ -12826,21 +13467,21 @@ function checkInstalledOpenCodeSkills(checks, rootDir) {
     });
     return;
   }
-  const skillRoot = resolve4(dirname2(dirname2(rootDir)), "skills");
+  const skillRoot = resolve6(dirname2(dirname2(rootDir)), "skills");
   const missingSkills = [];
   const malformedSkills = [];
   let expectedSkillCount = 0;
-  for (const entry of readdirSync2(sourceSkillsDir, { withFileTypes: true })) {
+  for (const entry of readdirSync3(sourceSkillsDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const sourceSkillPath = resolve4(sourceSkillsDir, entry.name, "SKILL.md");
-    if (!existsSync4(sourceSkillPath)) continue;
+    const sourceSkillPath = resolve6(sourceSkillsDir, entry.name, "SKILL.md");
+    if (!existsSync6(sourceSkillPath)) continue;
     expectedSkillCount++;
-    const installedSkillPath = resolve4(skillRoot, `${pluginName}-${entry.name}`, "SKILL.md");
-    if (!existsSync4(installedSkillPath)) {
+    const installedSkillPath = resolve6(skillRoot, `${pluginName}-${entry.name}`, "SKILL.md");
+    if (!existsSync6(installedSkillPath)) {
       missingSkills.push(`${pluginName}-${entry.name}`);
       continue;
     }
-    const installedContent = readFileSync4(installedSkillPath, "utf-8");
+    const installedContent = readFileSync5(installedSkillPath, "utf-8");
     if (!installedContent.includes(`${pluginName}/`)) {
       malformedSkills.push(`${pluginName}-${entry.name}`);
     }
@@ -12943,7 +13584,7 @@ async function doctorConsumer(rootDir = process.cwd(), options = {}) {
 // src/cli/verify-install.ts
 function buildCheckFromReport(target, pluginName, report) {
   const consumerPath = resolveInstalledConsumerPath(target, pluginName);
-  const staleReason = target.built && existsSync5(consumerPath) ? detectStaleInstall(target, pluginName, consumerPath) : void 0;
+  const staleReason = target.built && existsSync7(consumerPath) ? detectStaleInstall(target, pluginName, consumerPath) : void 0;
   const stale = staleReason !== void 0;
   const issues = listVerifyInstallIssues(report.checks);
   return {
@@ -12951,7 +13592,7 @@ function buildCheckFromReport(target, pluginName, report) {
     installPath: consumerPath,
     consumerPath,
     built: target.built,
-    installed: existsSync5(consumerPath),
+    installed: existsSync7(consumerPath),
     stale,
     ...staleReason ? { staleReason } : {},
     ok: report.errors === 0 && !stale,
@@ -12990,10 +13631,10 @@ function manifestPathForPlatform2(platform) {
 function readInstalledManifestVersion(rootDir, platform) {
   const manifestPath = manifestPathForPlatform2(platform);
   if (!manifestPath) return void 0;
-  const filepath = resolve5(rootDir, manifestPath);
-  if (!existsSync5(filepath)) return void 0;
+  const filepath = resolve7(rootDir, manifestPath);
+  if (!existsSync7(filepath)) return void 0;
   try {
-    const manifest = JSON.parse(readFileSync5(filepath, "utf-8"));
+    const manifest = JSON.parse(readFileSync6(filepath, "utf-8"));
     return typeof manifest.version === "string" ? manifest.version : void 0;
   } catch {
     return void 0;
@@ -13001,16 +13642,16 @@ function readInstalledManifestVersion(rootDir, platform) {
 }
 function findCodexCacheCandidates(pluginName) {
   const home = process.env.HOME ?? "~";
-  const cacheRoot = resolve5(home, ".codex/plugins/cache");
-  if (!existsSync5(cacheRoot)) return [];
+  const cacheRoot = resolve7(home, ".codex/plugins/cache");
+  if (!existsSync7(cacheRoot)) return [];
   const candidates = [];
-  for (const marketplace of readdirSync3(cacheRoot)) {
-    const pluginRoot = resolve5(cacheRoot, marketplace, pluginName);
-    if (!existsSync5(pluginRoot)) continue;
-    for (const versionDir of readdirSync3(pluginRoot)) {
-      const candidatePath = resolve5(pluginRoot, versionDir);
+  for (const marketplace of readdirSync4(cacheRoot)) {
+    const pluginRoot = resolve7(cacheRoot, marketplace, pluginName);
+    if (!existsSync7(pluginRoot)) continue;
+    for (const versionDir of readdirSync4(pluginRoot)) {
+      const candidatePath = resolve7(pluginRoot, versionDir);
       try {
-        const stats = statSync(candidatePath);
+        const stats = statSync3(candidatePath);
         if (!stats.isDirectory()) continue;
         candidates.push({
           path: candidatePath,
@@ -13023,11 +13664,55 @@ function findCodexCacheCandidates(pluginName) {
   }
   return candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
 }
-function detectCodexCacheStaleness(pluginName, builtVersion) {
+function hashInstalledBundle(rootDir) {
+  const hash = createHash2("sha256");
+  const visit = (currentDir, relativePrefix = "") => {
+    for (const entry of readdirSync4(currentDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const absolutePath = resolve7(currentDir, entry.name);
+      const relativePath = relativePrefix ? `${relativePrefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        visit(absolutePath, relativePath);
+        continue;
+      }
+      const stats = lstatSync2(absolutePath);
+      if (stats.isSymbolicLink()) {
+        hash.update(relativePath);
+        hash.update("\0symlink\0");
+        hash.update(readlinkSync(absolutePath));
+        hash.update("\0");
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      hash.update(relativePath);
+      hash.update("\0file\0");
+      hash.update(readFileSync6(absolutePath));
+      hash.update("\0");
+    }
+  };
+  visit(rootDir);
+  return hash.digest("hex");
+}
+function detectCodexCacheStaleness(pluginName, builtVersion, consumerPath) {
   if (!builtVersion) return void 0;
   const candidates = findCodexCacheCandidates(pluginName);
   if (candidates.length === 0) return void 0;
-  if (candidates.some((candidate) => candidate.version === builtVersion)) return void 0;
+  const matchingVersionCandidates = candidates.filter((candidate) => candidate.version === builtVersion);
+  if (matchingVersionCandidates.length > 0) {
+    let installedSignature;
+    try {
+      installedSignature = hashInstalledBundle(consumerPath);
+    } catch {
+      return void 0;
+    }
+    for (const candidate of matchingVersionCandidates) {
+      try {
+        if (hashInstalledBundle(candidate.path) === installedSignature) return void 0;
+      } catch {
+      }
+    }
+    const newestMatchingVersion = matchingVersionCandidates[0];
+    return `Codex active cache appears stale at ${newestMatchingVersion.path}; cached version ${newestMatchingVersion.version ?? "unknown"} matches the built version but the cached bundle contents do not match the active local install at ${consumerPath}. Use Plugins > Refresh if available, or restart/reinstall Codex to load the current plugin bundle.`;
+  }
   const newest = candidates[0];
   return `Codex active cache appears stale at ${newest.path}; cached version ${newest.version ?? "unknown"} does not match built version ${builtVersion}. Use Plugins > Refresh if available, or restart/reinstall Codex to load the current plugin bundle.`;
 }
@@ -13050,13 +13735,13 @@ function detectStaleInstall(target, pluginName, consumerPath) {
     return `installed version ${installedVersion} does not match built version ${builtVersion}`;
   }
   if (target.platform === "codex") {
-    return detectCodexCacheStaleness(pluginName, builtVersion);
+    return detectCodexCacheStaleness(pluginName, builtVersion, consumerPath);
   }
   return void 0;
 }
 async function verifyInstall(config, options = {}) {
   const rootDir = options.rootDir ?? process.cwd();
-  const distDir = resolve5(rootDir, config.outDir);
+  const distDir = resolve7(rootDir, config.outDir);
   const targets = options.targets ?? config.targets;
   const installPlan = planInstallPlugin(distDir, config.name, targets);
   const filteredPlan = options.builtOnly ? installPlan.filter((target) => target.built) : installPlan;
@@ -13119,7 +13804,9 @@ function getVerifyInstallRecoveryActions(check) {
 }
 export {
   CORE_FOUR_PRIMITIVE_CAPABILITIES,
+  CORE_HOST_FAMILIES,
   INSTALLER_OWNED_CHECK_ENV_PATH,
+  INSTALL_REFERENCE_SCHEMES,
   PLATFORM_LIMITS,
   PLATFORM_LIMIT_POLICIES,
   PLATFORM_VALIDATION_RULES,
@@ -13127,10 +13814,15 @@ export {
   PLUXX_COMPILER_INTENT_PATH,
   PORTABLE_RUNTIME_SCRIPT_ROLES,
   PluginConfigSchema,
+  assertGeneratedBundlesCurrent,
   buildGeneratedPermissionHookScript,
+  buildHostTargetSelection,
   buildOpenCodePermissionMap,
+  checkGeneratedBundles,
   collectPermissionRules,
   definePlugin,
+  detectHostFamilies,
+  formatInstallReference,
   formatPublishPlan,
   getConfiguredCompilerBuckets,
   getConsumerEnvScriptActiveDetail,
@@ -13146,6 +13838,7 @@ export {
   getRuntimeReadinessCapability,
   getRuntimeReadinessExternalConfigNote,
   getRuntimeReadinessNamedPromptTargetNote,
+  parseInstallReference,
   parsePermissionRule,
   permissionRulesNeedToolLevelDowngrade,
   planPublish,