@rzx/ohs 1.1.0 → 1.1.12

package/dist/index.js

@@ -196887,6 +196887,18 @@ class OpenHarnessClient {
       signal: options.signal
     });
   }
+  async listSkills(options = {}) {
+    return await this.request("/skills", {
+      signal: options.signal
+    });
+  }
+  async removeSkill(id, input, options = {}) {
+    return await this.request(`/skills/${encodeURIComponent(id)}`, {
+      method: "DELETE",
+      body: input,
+      signal: options.signal
+    });
+  }
   async listAgentPersonas(options = {}) {
     const response = await this.request("/agent-personas", {
       signal: options.signal
@@ -276984,6 +276996,8 @@ function buildAgentTranscript(messages, parts) {
   const output = [];
   const attachmentsByMessageId = {};
   for (const message of [...messages].sort((a, b) => a.seq - b.seq)) {
+    if (isPresentationOnlyMessage(message))
+      continue;
     const messageParts = (byMessage.get(message.id) ?? []).sort((a, b) => a.seq - b.seq);
     const attachments = attachmentsFromParts(messageParts);
     if (attachments.length > 0)
@@ -277023,6 +277037,14 @@ function buildAgentTranscript(messages, parts) {
   }
   return { messages: output, attachmentsByMessageId };
 }
+function isPresentationOnlyMessage(message) {
+  const presentation = message.metadata.presentation;
+  if (!presentation || typeof presentation !== "object" || Array.isArray(presentation)) {
+    return false;
+  }
+  const value = presentation;
+  return value.kind === "model_switch" && typeof value.fromModel === "string" && Boolean(value.fromModel.trim()) && typeof value.toModel === "string" && Boolean(value.toModel.trim());
+}
 function agentMessagesToTranscript(messages) {
   const output = [];
   for (const message of messages) {
@@ -280509,15 +280531,39 @@ class SessionApplicationService {
     try {
       const before = this.context.events.checkpoint();
       const nextModel = metadata ? readSessionRuntimeConfig({ ...existing, metadata }).model : undefined;
-      const session = this.context.store.updateSession(sessionId, {
-        title: input.title,
-        model: nextModel,
-        agent: input.agent,
-        metadata
+      const modelChanged = nextModel !== undefined && nextModel !== existing.model;
+      const session = this.context.store.transaction(() => {
+        const updated = this.context.store.updateSession(sessionId, {
+          title: input.title,
+          model: nextModel,
+          agent: input.agent,
+          metadata
+        });
+        if (!modelChanged)
+          return updated;
+        const message = this.context.store.createMessage({
+          sessionId,
+          role: "system",
+          metadata: {
+            presentation: {
+              kind: "model_switch",
+              fromModel: existing.model,
+              toModel: nextModel
+            }
+          }
+        });
+        this.context.store.upsertMessagePart({
+          sessionId,
+          messageId: message.id,
+          type: "text",
+          status: "completed",
+          text: `模型已切换 ${existing.model} → ${nextModel}`
+        });
+        return updated;
       });
       if (runtimeConfigurationChanged)
         await this.context.agentPool.close(sessionId);
-      if (nextModel !== undefined && nextModel !== existing.model) {
+      if (modelChanged) {
         this.context.contextUsageCache?.invalidate(sessionId);
       }
       this.context.events.publishSince(before);
@@ -286009,8 +286055,8 @@ function createDaemonImageToTextTool(options) {
   };
 }
 async function recognizeAttachment(input, context, options) {
-  if (Object.keys(input).some((key) => key !== "attachment_id")) {
-    return errorResult4("attachment_id cannot be combined with image_path, image_url, or prompt", "command");
+  if (Object.keys(input).some((key) => key !== "attachment_id" && key !== "prompt")) {
+    return errorResult4("attachment_id cannot be combined with another image source", "command");
   }
   const assetId = typeof input.attachment_id === "string" ? input.attachment_id.trim() : "";
   if (!assetId || !context.sessionId)
@@ -286913,6 +286959,148 @@ var init_default_node_application = __esm(() => {
   init_daemon_application();
 });
 
+// ../../packages/server/src/application/skill-management-service.ts
+import { createHash as createHash12 } from "node:crypto";
+import { readFile as readFile17, realpath as realpath7, stat as stat9, unlink as unlink4 } from "node:fs/promises";
+import {
+  basename as basename12,
+  dirname as dirname20,
+  isAbsolute as isAbsolute12,
+  join as join39,
+  relative as relative9,
+  resolve as resolve26,
+  sep as sep4
+} from "node:path";
+
+class SkillManagementService {
+  options;
+  personalSkillsDir;
+  configDir;
+  bundledSkills;
+  constructor(options) {
+    this.options = options;
+    const defaultSkillsDir = getSkillsDir();
+    this.configDir = resolve26(options.configDir ?? dirname20(defaultSkillsDir));
+    this.personalSkillsDir = options.configDir ? join39(this.configDir, "skills") : resolve26(defaultSkillsDir);
+    this.bundledSkills = options.bundledSkills ?? BUNDLED_SKILLS;
+  }
+  async list() {
+    const warnings = [];
+    const projects = await validProjects(this.options.projects.list(), warnings);
+    const skills = this.bundledSkills.map((skill) => desktopSkill(skill, "bundled"));
+    const seen = new Set;
+    for (const project of projects) {
+      await this.load(join39(project.root, ".agents", "skills"), "agent", skills, seen, warnings, project);
+      await this.load(join39(project.root, ".claude", "skills"), "agent", skills, seen, warnings, project);
+      const managed = join39(project.root, ".openharness-ts", "skills");
+      if (key(managed) !== key(this.personalSkillsDir)) {
+        await this.load(managed, "project", skills, seen, warnings, project);
+      }
+    }
+    await this.load(this.personalSkillsDir, "personal", skills, seen, warnings);
+    return { skills, projects: projects.map(({ info }) => info), warnings };
+  }
+  async remove(input) {
+    const snapshot = await this.list();
+    const item = snapshot.skills.find((candidate) => candidate.id === input.id);
+    if (!item)
+      throw new Error("找不到指定技能，请刷新后重试。");
+    if (item.readOnly || item.source !== "project" && item.source !== "personal") {
+      throw new Error("此技能来自只读目录，不能删除。");
+    }
+    const target = await this.secureTarget(item);
+    const current = await readFile17(target, "utf8");
+    if (current !== input.expectedContent)
+      throw new Error("技能已在其他位置修改，请刷新后重试。");
+    await unlink4(target);
+    return await this.list();
+  }
+  async secureTarget(item) {
+    const target = await realpath7(item.path);
+    if (item.source === "personal") {
+      await assertTarget(this.configDir, this.personalSkillsDir, target);
+      return target;
+    }
+    if (!item.projectPath)
+      throw new Error("技能缺少所属项目。");
+    const project = await realpath7(item.projectPath);
+    await assertTarget(project, join39(project, ".openharness-ts", "skills"), target);
+    return target;
+  }
+  async load(directory, source, output, seen, warnings, project) {
+    const loader = new SkillLoader(new SkillRegistry);
+    const loaded = await loader.loadFromDirectory(directory, {
+      source: source === "personal" ? "user" : "project",
+      recursive: true
+    });
+    for (const skill of loaded) {
+      try {
+        const path = await realpath7(skill.path);
+        if (seen.has(key(path)))
+          continue;
+        seen.add(key(path));
+        output.push(desktopSkill({ ...skill, path }, source, project?.info));
+      } catch {
+        warnings.push(`无法读取技能文件：${skill.path}`);
+      }
+    }
+  }
+}
+function createSkillManagementService(options) {
+  return new SkillManagementService(options);
+}
+async function validProjects(input, warnings) {
+  const projects = [];
+  const seen = new Set;
+  for (const project of input) {
+    try {
+      const root = await realpath7(resolve26(project.path));
+      if (!(await stat9(root)).isDirectory() || seen.has(key(root)))
+        continue;
+      seen.add(key(root));
+      projects.push({
+        root,
+        info: { name: project.name.trim() || basename12(root), path: root }
+      });
+    } catch {
+      warnings.push(`项目不存在或不是目录：${project.path}`);
+    }
+  }
+  return projects;
+}
+function desktopSkill(skill, source, project) {
+  return {
+    id: `skill_${createHash12("sha256").update(source).update("\x00").update(key(skill.path)).update("\x00").update(skill.name).digest("hex").slice(0, 24)}`,
+    name: skill.name,
+    description: skill.description,
+    content: skill.content,
+    path: skill.path,
+    source,
+    readOnly: source === "bundled" || source === "agent",
+    ...project ? { projectPath: project.path, projectName: project.name } : {}
+  };
+}
+async function assertTarget(owner, allowed, target) {
+  const physicalOwner = await realpath7(owner);
+  const physicalAllowed = await realpath7(allowed);
+  if (!within(physicalOwner, physicalAllowed))
+    throw new Error("技能目录通过符号链接指向了允许范围之外。");
+  if (!within(physicalAllowed, target))
+    throw new Error("技能文件位于允许范围之外。");
+}
+function within(root, target) {
+  const path = relative9(root, target);
+  return path !== "" && path !== ".." && !path.startsWith(`..${sep4}`) && !isAbsolute12(path);
+}
+function key(path) {
+  const normalized = resolve26(path);
+  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+var init_skill_management_service = __esm(() => {
+  init_src();
+  init_src2();
+});
+
 // ../../packages/server/src/shared/observability.ts
 function writeStructuredLog(event) {
   console.info(JSON.stringify({ timestamp: new Date().toISOString(), ...event }));
@@ -288121,7 +288309,9 @@ function createServiceRoutes(context) {
     if (!context.outputStyleService)
       return errorResponse(501, "Output style service is not configured");
     try {
-      return jsonResponse({ styles: await context.outputStyleService.list() });
+      return jsonResponse({
+        styles: await context.outputStyleService.list()
+      });
     } catch (error) {
       return errorResponse(500, error instanceof Error ? error.message : String(error));
     }
@@ -288159,7 +288349,10 @@ function createServiceRoutes(context) {
     if (!lease)
       return errorResponse(409, "Cannot uninstall plugins while session runs are active");
     try {
-      const result = await context.pluginService.uninstall({ cwd, id: c.req.param("id") });
+      const result = await context.pluginService.uninstall({
+        cwd,
+        id: c.req.param("id")
+      });
       if (result.restartRuntimes)
         await context.control.closeAllRuntimes();
       return jsonResponse({ message: result.message });
@@ -288191,6 +288384,36 @@ function createServiceRoutes(context) {
     } finally {
       lease.release();
     }
+  }).get("/skills", async () => {
+    if (!context.skillService)
+      return errorResponse(501, "Skill service is not configured");
+    try {
+      return jsonResponse(await context.skillService.list());
+    } catch (error) {
+      return errorResponse(500, error instanceof Error ? error.message : String(error));
+    }
+  }).delete("/skills/:id", async (c) => {
+    if (!context.skillService)
+      return errorResponse(501, "Skill service is not configured");
+    const lease = context.control.acquireGlobalMutation();
+    if (!lease)
+      return errorResponse(409, "Cannot remove skills while session runs are active");
+    try {
+      const body = await readJson(c);
+      if (typeof body.expectedContent !== "string") {
+        return errorResponse(400, "expectedContent is required");
+      }
+      const result = await context.skillService.remove({
+        id: c.req.param("id"),
+        expectedContent: body.expectedContent
+      });
+      await context.control.closeAllRuntimes();
+      return jsonResponse(result);
+    } catch (error) {
+      return errorResponse(400, error instanceof Error ? error.message : String(error));
+    } finally {
+      lease.release();
+    }
   }).get("/agent-personas", async () => {
     if (!context.agentPersonaService)
       return errorResponse(501, "Agent persona service is not configured");
@@ -288207,7 +288430,10 @@ function createServiceRoutes(context) {
       return errorResponse(400, "cwd is required");
     const sessionId = c.req.query("sessionId") ?? undefined;
     try {
-      const listed = await context.hooksService.list({ cwd, ...sessionId ? { sessionId } : {} });
+      const listed = await context.hooksService.list({
+        cwd,
+        ...sessionId ? { sessionId } : {}
+      });
       const hooks = [...listed.hooks];
       if (sessionId && context.control.runtimeInspectionAvailable) {
         if (!context.control.sessionExists(sessionId)) {
@@ -288263,7 +288489,13 @@ async function installLocalPlugin(context, c, link) {
   if (!lease)
     return errorResponse(409, "Cannot install plugins while session runs are active");
   try {
-    const result = await context.pluginService.installLocal({ cwd, sourcePath, scope, approvedPermissions, link });
+    const result = await context.pluginService.installLocal({
+      cwd,
+      sourcePath,
+      scope,
+      approvedPermissions,
+      link
+    });
     if (result.restartRuntimes)
       await context.control.closeAllRuntimes();
     return jsonResponse({ message: result.message });
@@ -289615,6 +289847,7 @@ class OpenHarnessHttpServer {
       outputStyleService: this.services.outputStyle,
       projectInitService: this.services.projectInit,
       pluginService: this.services.plugin,
+      skillService: this.services.skill ?? createSkillManagementService({ projects: this.application.projects }),
       agentPersonaService: this.services.agentPersona,
       hooksService: this.services.hooks,
       control: this.application.control
@@ -289680,6 +289913,7 @@ var init_server = __esm(() => {
   init_dist2();
   init_dist3();
   init_default_node_application();
+  init_skill_management_service();
   init_support2();
   init_auth();
   init_attachment4();
@@ -289896,10 +290130,10 @@ var init_auth_service = __esm(() => {
 
 // ../../packages/output-styles/src/index.ts
 import { readdirSync as readdirSync6, readFileSync as readFileSync14, mkdirSync as mkdirSync15 } from "node:fs";
-import { join as join39 } from "node:path";
+import { join as join40 } from "node:path";
 import { homedir as homedir11 } from "node:os";
 function getOutputStylesDir() {
-  const dir = join39(homedir11(), ".openharness-ts", "output_styles");
+  const dir = join40(homedir11(), ".openharness-ts", "output_styles");
   try {
     mkdirSync15(dir, { recursive: true });
   } catch {}
@@ -289916,7 +290150,7 @@ function loadOutputStyles() {
   }
   for (const file of files) {
     try {
-      const content = readFileSync14(join39(dir, file), "utf-8");
+      const content = readFileSync14(join40(dir, file), "utf-8");
       styles.push({ name: file.replace(/\.md$/, ""), content, source: "user" });
     } catch {}
   }
@@ -290575,14 +290809,14 @@ var init_profile_service = __esm(() => {
 });
 
 // ../../packages/server/src/application/default-services/project-init-service.ts
-import { join as join40 } from "node:path";
+import { join as join41 } from "node:path";
 function createDefaultProjectInitService() {
   return {
     async init({ cwd }) {
       const { writeFile, mkdir, access } = await import("node:fs/promises");
       const files = [
         {
-          path: join40(cwd, "CLAUDE.md"),
+          path: join41(cwd, "CLAUDE.md"),
           content: `# Project Rules
 
 Add your project-specific rules and instructions here.
@@ -290590,7 +290824,7 @@ Add your project-specific rules and instructions here.
           label: "CLAUDE.md"
         },
         {
-          path: join40(cwd, PROJECT_CONFIG_DIR_NAME, "README.md"),
+          path: join41(cwd, PROJECT_CONFIG_DIR_NAME, "README.md"),
           content: `# OpenHarness Config
 
 This directory contains OpenHarness project configuration.
@@ -290598,7 +290832,7 @@ This directory contains OpenHarness project configuration.
           label: `${PROJECT_CONFIG_DIR_NAME}/README.md`
         },
         {
-          path: join40(cwd, PROJECT_CONFIG_DIR_NAME, "memory", "MEMORY.md"),
+          path: join41(cwd, PROJECT_CONFIG_DIR_NAME, "memory", "MEMORY.md"),
           content: `# Memory
 
 This file stores project memory for the AI assistant.
@@ -290607,10 +290841,10 @@ This file stores project memory for the AI assistant.
         }
       ];
       const dirs = [
-        join40(cwd, PROJECT_CONFIG_DIR_NAME),
-        join40(cwd, PROJECT_CONFIG_DIR_NAME, "memory"),
-        join40(cwd, PROJECT_CONFIG_DIR_NAME, "plugins"),
-        join40(cwd, PROJECT_CONFIG_DIR_NAME, "skills")
+        join41(cwd, PROJECT_CONFIG_DIR_NAME),
+        join41(cwd, PROJECT_CONFIG_DIR_NAME, "memory"),
+        join41(cwd, PROJECT_CONFIG_DIR_NAME, "plugins"),
+        join41(cwd, PROJECT_CONFIG_DIR_NAME, "skills")
       ];
       const lines = ["Initializing OpenHarness project...", ""];
       for (const dir of dirs) {
@@ -291041,6 +291275,7 @@ var init_application = __esm(() => {
   init_support();
   init_events2();
   init_project_application_service();
+  init_skill_management_service();
   init_channel3();
   init_application_backup();
   init_application_retention_service();
@@ -291082,7 +291317,7 @@ var init_src23 = __esm(() => {
 });
 
 // src/ensure-daemon.ts
-import { stat as stat9 } from "node:fs/promises";
+import { stat as stat10 } from "node:fs/promises";
 async function ensureLocalDaemon(options = {}) {
   const cliPath = options.cliPath ?? process.argv[1];
   if (!cliPath)
@@ -291090,7 +291325,7 @@ async function ensureLocalDaemon(options = {}) {
   const expectedVersion = options.expectedVersion ?? VERSION;
   const daemonProbeOptions = {
     expectedVersion,
-    minimumStartedAt: (await stat9(cliPath)).mtimeMs
+    minimumStartedAt: (await stat10(cliPath)).mtimeMs
   };
   await Promise.resolve().then(() => init_src23());
   const waitForDaemonRegistry = async (spawned) => {
@@ -370332,13 +370567,13 @@ function createMcpCommand() {
 // src/commands/plugin.ts
 init_src15();
 init_src12();
-import { join as join46, resolve as resolve28 } from "node:path";
-import { mkdtemp as mkdtemp3, rm as rm8 } from "node:fs/promises";
+import { join as join49, resolve as resolve31 } from "node:path";
+import { mkdtemp as mkdtemp3, rm as rm9 } from "node:fs/promises";
 import { tmpdir as tmpdir5 } from "node:os";
 // ../../packages/plugin-converters/src/core/digest.ts
-import { createHash as createHash12 } from "node:crypto";
-import { readFile as readFile17, readdir as readdir9 } from "node:fs/promises";
-import { join as join41, relative as relative9 } from "node:path";
+import { createHash as createHash13 } from "node:crypto";
+import { lstat as lstat6, readFile as readFile18, readdir as readdir9 } from "node:fs/promises";
+import { join as join43, relative as relative10 } from "node:path";
 function stable(value) {
   if (Array.isArray(value))
     return `[${value.map(stable).join(",")}]`;
@@ -370347,14 +370582,14 @@ function stable(value) {
   return JSON.stringify(value);
 }
 function digestValue(value) {
-  return createHash12("sha256").update(stable(value)).digest("hex");
+  return createHash13("sha256").update(stable(value)).digest("hex");
 }
 async function files(root, dir = root) {
   const out = [];
   for (const entry of (await readdir9(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
-    const full = join41(dir, entry.name);
+    const full = join43(dir, entry.name);
     if (entry.isSymbolicLink())
-      throw new Error(`Source symlink is not allowed: ${relative9(root, full)}`);
+      throw new Error(`Source symlink is not allowed: ${relative10(root, full)}`);
     if (entry.isDirectory())
       out.push(...await files(root, full));
     else if (entry.isFile())
@@ -370363,12 +370598,20 @@ async function files(root, dir = root) {
   return out;
 }
 async function digestSource(root) {
-  const hash = createHash12("sha256");
+  if ((await lstat6(root)).isSymbolicLink())
+    throw new Error("Source root link is not allowed");
+  const hash = createHash13("sha256");
+  hash.update(`openharness-source-v2
+`);
   for (const file of await files(root)) {
-    hash.update(relative9(root, file).replaceAll("\\", "/"));
-    hash.update("\x00");
-    hash.update(await readFile17(file));
-    hash.update("\x00");
+    const content = await readFile18(file);
+    hash.update(JSON.stringify([
+      relative10(root, file).replaceAll("\\", "/"),
+      content.length,
+      createHash13("sha256").update(content).digest("hex")
+    ]));
+    hash.update(`
+`);
   }
   return hash.digest("hex");
 }
@@ -370411,27 +370654,27 @@ class ConverterRegistry {
 }
 // ../../packages/plugin-converters/src/claude-code/detector.ts
 import { access as access6 } from "node:fs/promises";
-import { join as join43 } from "node:path";
+import { join as join44 } from "node:path";
 var exists4 = async (path) => access6(path).then(() => true, () => false);
 async function detectClaudeCodePlugin(root) {
   const evidence = [];
-  if (await exists4(join43(root, ".claude-plugin", "plugin.json")))
+  if (await exists4(join44(root, ".claude-plugin", "plugin.json")))
     evidence.push(".claude-plugin/plugin.json");
   for (const name of ["skills", "commands", "agents", "hooks", ".mcp.json", "SKILL.md"])
-    if (await exists4(join43(root, name)))
+    if (await exists4(join44(root, name)))
       evidence.push(name);
-  if (!evidence.length || evidence.length === 1 && evidence[0] === "SKILL.md" && !await exists4(join43(root, "SKILL.md")))
+  if (!evidence.length || evidence.length === 1 && evidence[0] === "SKILL.md" && !await exists4(join44(root, "SKILL.md")))
     return null;
   return { converterId: "claude-code", confidence: evidence.includes(".claude-plugin/plugin.json") ? 1 : 0.7, evidence };
 }
 // ../../packages/plugin-converters/src/claude-code/parser.ts
-import { access as access7, lstat as lstat6, readFile as readFile18, readdir as readdir10 } from "node:fs/promises";
-import { basename as basename12, isAbsolute as isAbsolute12, join as join44, relative as relative10, resolve as resolve26 } from "node:path";
+import { access as access7, lstat as lstat7, readFile as readFile19, readdir as readdir10 } from "node:fs/promises";
+import { basename as basename13, isAbsolute as isAbsolute13, join as join45, relative as relative11, resolve as resolve27 } from "node:path";
 var exists5 = async (path) => access7(path).then(() => true, () => false);
 async function collect(root, path, extensions) {
   if (!await exists5(path))
     return [];
-  const info = await lstat6(path);
+  const info = await lstat7(path);
   if (info.isSymbolicLink())
     throw new Error(`Claude source symlink is not allowed: ${path}`);
   if (info.isFile())
@@ -370440,7 +370683,7 @@ async function collect(root, path, extensions) {
   for (const entry of (await readdir10(path, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
     if (entry.isSymbolicLink())
       throw new Error(`Claude source symlink is not allowed: ${entry.name}`);
-    const full = join44(path, entry.name);
+    const full = join45(path, entry.name);
     if (entry.isDirectory())
       result.push(...await collect(root, full, extensions));
     else if (!extensions || extensions.some((x) => entry.name.toLowerCase().endsWith(x)))
@@ -370450,31 +370693,31 @@ async function collect(root, path, extensions) {
 }
 var asPaths = (value) => typeof value === "string" ? [value] : Array.isArray(value) && value.every((x) => typeof x === "string") ? value : [];
 function safe(root, value) {
-  const target = resolve26(root, value);
-  const rel = relative10(resolve26(root), target);
-  if (rel.startsWith("..") || isAbsolute12(rel) || target === resolve26(root))
+  const target = resolve27(root, value);
+  const rel = relative11(resolve27(root), target);
+  if (rel.startsWith("..") || isAbsolute13(rel) || target === resolve27(root))
     throw new Error(`Claude component path escapes source: ${value}`);
   return target;
 }
 async function inspectClaudeCodePlugin(rootInput) {
-  const root = resolve26(rootInput);
+  const root = resolve27(rootInput);
   let manifest = {};
-  const manifestPath = join44(root, ".claude-plugin", "plugin.json");
+  const manifestPath = join45(root, ".claude-plugin", "plugin.json");
   if (await exists5(manifestPath))
-    manifest = JSON.parse(await readFile18(manifestPath, "utf8"));
-  const name = typeof manifest.name === "string" ? manifest.name : basename12(root).toLowerCase().replace(/[^a-z0-9-]+/g, "-");
+    manifest = JSON.parse(await readFile19(manifestPath, "utf8"));
+  const name = typeof manifest.name === "string" ? manifest.name : basename13(root).toLowerCase().replace(/[^a-z0-9-]+/g, "-");
   const inventory = {};
-  const skillRoots = [join44(root, "skills"), ...asPaths(manifest.skills).map((x) => safe(root, x))];
-  if (await exists5(join44(root, "SKILL.md")))
-    skillRoots.push(join44(root, "SKILL.md"));
+  const skillRoots = [join45(root, "skills"), ...asPaths(manifest.skills).map((x) => safe(root, x))];
+  if (await exists5(join45(root, "SKILL.md")))
+    skillRoots.push(join45(root, "SKILL.md"));
   inventory.skills = (await Promise.all(skillRoots.map((x) => collect(root, x, ["skill.md"])))).flat();
   for (const kind of ["commands", "agents"]) {
     const custom = asPaths(manifest[kind]);
-    const roots = custom.length ? custom.map((x) => safe(root, x)) : [join44(root, kind)];
+    const roots = custom.length ? custom.map((x) => safe(root, x)) : [join45(root, kind)];
     inventory[kind] = (await Promise.all(roots.map((x) => collect(root, x, [".md"])))).flat();
   }
-  const hooks = join44(root, "hooks", "hooks.json");
-  const mcp = join44(root, ".mcp.json");
+  const hooks = join45(root, "hooks", "hooks.json");
+  const mcp = join45(root, ".mcp.json");
   inventory.hooks = await exists5(hooks) ? [hooks] : [];
   inventory.mcpServers = await exists5(mcp) ? [mcp] : [];
   return { root, format: "claude-code", identity: { id: `converted.claude.${name}`, name, version: typeof manifest.version === "string" ? manifest.version : "0.0.0" }, inventory, diagnostics: [] };
@@ -370584,34 +370827,34 @@ function convertClaudeAgentMarkdown(content) {
 // ../../packages/plugin-converters/src/claude-code/converter.ts
 init_src12();
 import { randomUUID as randomUUID27 } from "node:crypto";
-import { access as access8, cp as cp3, mkdir as mkdir14, readFile as readFile19, rename as rename4, rm as rm7, writeFile as writeFile11 } from "node:fs/promises";
-import { basename as basename13, dirname as dirname20, join as join45, relative as relative11, resolve as resolve27 } from "node:path";
-var rel = (inspection, path) => relative11(inspection.root, path).replaceAll("\\", "/");
+import { access as access8, cp as cp3, mkdir as mkdir14, readFile as readFile20, rename as rename4, rm as rm7, writeFile as writeFile11 } from "node:fs/promises";
+import { basename as basename14, dirname as dirname21, join as join46, relative as relative12, resolve as resolve28 } from "node:path";
+var rel = (inspection, path) => relative12(inspection.root, path).replaceAll("\\", "/");
 function componentPath(inspection, sourcePath, directory) {
   const parts = rel(inspection, sourcePath).split("/");
   const directoryIndex = parts.indexOf(directory);
   return (directoryIndex >= 0 ? parts.slice(directoryIndex + 1) : parts).join("/");
 }
 async function copySkillBundle(inspection, skillFile, targetRoot) {
-  const sourceDirectory = dirname20(skillFile);
-  const relativeDirectory = relative11(inspection.root, sourceDirectory);
-  const targetRelative = relativeDirectory === "" ? inspection.identity.name : dirname20(componentPath(inspection, skillFile, "skills"));
-  const targetDirectory = join45(targetRoot, targetRelative === "." ? inspection.identity.name : targetRelative);
+  const sourceDirectory = dirname21(skillFile);
+  const relativeDirectory = relative12(inspection.root, sourceDirectory);
+  const targetRelative = relativeDirectory === "" ? inspection.identity.name : dirname21(componentPath(inspection, skillFile, "skills"));
+  const targetDirectory = join46(targetRoot, targetRelative === "." ? inspection.identity.name : targetRelative);
   if (sourceDirectory !== inspection.root) {
     await cp3(sourceDirectory, targetDirectory, { recursive: true, errorOnExist: true, force: false });
     return;
   }
   await mkdir14(targetDirectory, { recursive: true });
-  await cp3(skillFile, join45(targetDirectory, "SKILL.md"), { errorOnExist: true, force: false });
+  await cp3(skillFile, join46(targetDirectory, "SKILL.md"), { errorOnExist: true, force: false });
   for (const resourceDirectory of ["assets", "references", "scripts"]) {
-    const sourceResource = join45(sourceDirectory, resourceDirectory);
+    const sourceResource = join46(sourceDirectory, resourceDirectory);
     if (await access8(sourceResource).then(() => true, () => false)) {
-      await cp3(sourceResource, join45(targetDirectory, resourceDirectory), { recursive: true, errorOnExist: true, force: false });
+      await cp3(sourceResource, join46(targetDirectory, resourceDirectory), { recursive: true, errorOnExist: true, force: false });
     }
   }
 }
 async function convertHooks(source, target) {
-  const raw = JSON.parse(await readFile19(source, "utf8"));
+  const raw = JSON.parse(await readFile20(source, "utf8"));
   const rows = raw.hooks && typeof raw.hooks === "object" ? raw.hooks : raw;
   const output = {};
   for (const [sourceEvent, entries] of Object.entries(rows)) {
@@ -370628,12 +370871,12 @@ async function convertHooks(source, target) {
   }
   if (!Object.keys(output).length)
     return false;
-  await mkdir14(dirname20(target), { recursive: true });
+  await mkdir14(dirname21(target), { recursive: true });
   await writeFile11(target, JSON.stringify(output, null, 2));
   return true;
 }
 async function convertMcp(source, target) {
-  const raw = JSON.parse(await readFile19(source, "utf8"));
+  const raw = JSON.parse(await readFile20(source, "utf8"));
   const servers = {};
   for (const [name, value] of Object.entries(raw.mcpServers ?? {})) {
     if (typeof value.command === "string")
@@ -370643,7 +370886,7 @@ async function convertMcp(source, target) {
     else
       throw new Error(`Ambiguous MCP server: ${name}`);
   }
-  await mkdir14(dirname20(target), { recursive: true });
+  await mkdir14(dirname21(target), { recursive: true });
   await writeFile11(target, JSON.stringify({ servers }, null, 2));
 }
 
@@ -370668,7 +370911,7 @@ class ClaudeCodePluginConverter {
         });
     }
     for (const hookFile of inspection.inventory.hooks ?? []) {
-      const raw = JSON.parse(await readFile19(hookFile, "utf8"));
+      const raw = JSON.parse(await readFile20(hookFile, "utf8"));
       const rows = raw.hooks && typeof raw.hooks === "object" ? raw.hooks : raw;
       if (Object.keys(rows).some((event) => CLAUDE_HOOK_EVENT_MAP[event])) {
         items.push({
@@ -370707,7 +370950,7 @@ class ClaudeCodePluginConverter {
       throw new Error(`Blocked conversion items require approval: ${blocked.map((x) => x.id).join(", ")}`);
     if (await digestSource(input.inspection.root) !== input.plan.sourceDigest)
       throw new Error("Source changed after conversion planning; inspect and plan again");
-    const output = resolve27(input.output);
+    const output = resolve28(input.output);
     if (await access8(output).then(() => true, () => false))
       throw new Error(`Conversion output already exists: ${output}`);
     const temporary = `${output}.tmp-${randomUUID27()}`;
@@ -370717,31 +370960,31 @@ class ClaudeCodePluginConverter {
       const components = {};
       const skills = input.inspection.inventory.skills ?? [];
       for (const skill of skills) {
-        await copySkillBundle(input.inspection, skill, join45(temporary, "skills"));
+        await copySkillBundle(input.inspection, skill, join46(temporary, "skills"));
       }
       const commands = input.inspection.inventory.commands ?? [];
       for (const command of commands) {
-        const name = basename13(command, ".md");
-        const target = join45(temporary, "skills", name, "SKILL.md");
-        await mkdir14(dirname20(target), { recursive: true });
-        await writeFile11(target, await readFile19(command, "utf8"));
+        const name = basename14(command, ".md");
+        const target = join46(temporary, "skills", name, "SKILL.md");
+        await mkdir14(dirname21(target), { recursive: true });
+        await writeFile11(target, await readFile20(command, "utf8"));
       }
       if (skills.length || commands.length)
         components.skills = ["./skills"];
       const agents = input.inspection.inventory.agents ?? [];
       for (const agent of agents) {
-        const target = join45(temporary, "agents", componentPath(input.inspection, agent, "agents"));
-        await mkdir14(dirname20(target), { recursive: true });
-        await writeFile11(target, convertClaudeAgentMarkdown(await readFile19(agent, "utf8")));
+        const target = join46(temporary, "agents", componentPath(input.inspection, agent, "agents"));
+        await mkdir14(dirname21(target), { recursive: true });
+        await writeFile11(target, convertClaudeAgentMarkdown(await readFile20(agent, "utf8")));
       }
       if (agents.length)
         components.agents = ["./agents"];
       const hooks = input.inspection.inventory.hooks?.[0];
-      if (hooks && await convertHooks(hooks, join45(temporary, "hooks.json")))
+      if (hooks && await convertHooks(hooks, join46(temporary, "hooks.json")))
         components.hooks = ["./hooks.json"];
       const mcp = input.inspection.inventory.mcpServers?.[0];
       if (mcp) {
-        await convertMcp(mcp, join45(temporary, "mcp.json"));
+        await convertMcp(mcp, join46(temporary, "mcp.json"));
         components.mcpServers = ["./mcp.json"];
       }
       if (!Object.keys(components).length)
@@ -370754,13 +370997,13 @@ class ClaudeCodePluginConverter {
         metadata: { origin: "converted", sourceFormat: this.sourceFormat, converterId: this.id, converterVersion: this.version },
         components
       };
-      await mkdir14(join45(temporary, ".openharness-plugin"));
-      await writeFile11(join45(temporary, ".openharness-plugin", "plugin.json"), JSON.stringify(manifest, null, 2));
+      await mkdir14(join46(temporary, ".openharness-plugin"));
+      await writeFile11(join46(temporary, ".openharness-plugin", "plugin.json"), JSON.stringify(manifest, null, 2));
       const report = { schemaVersion: 1, status: input.plan.items.some((x) => x.fidelity === "unsupported") ? "partial" : "success", items: input.plan.items, diagnostics: input.plan.diagnostics };
-      await mkdir14(join45(temporary, ".openharness-conversion"));
-      await writeFile11(join45(temporary, ".openharness-conversion", "plan.json"), JSON.stringify(input.plan, null, 2));
-      await writeFile11(join45(temporary, ".openharness-conversion", "report.json"), JSON.stringify(report, null, 2));
-      await writeFile11(join45(temporary, ".openharness-conversion", "provenance.json"), JSON.stringify({ sourceFormat: this.sourceFormat, sourceDigest: input.plan.sourceDigest, converterId: this.id, converterVersion: this.version, mappingVersion: CLAUDE_MAPPING_VERSION }, null, 2));
+      await mkdir14(join46(temporary, ".openharness-conversion"));
+      await writeFile11(join46(temporary, ".openharness-conversion", "plan.json"), JSON.stringify(input.plan, null, 2));
+      await writeFile11(join46(temporary, ".openharness-conversion", "report.json"), JSON.stringify(report, null, 2));
+      await writeFile11(join46(temporary, ".openharness-conversion", "provenance.json"), JSON.stringify({ sourceFormat: this.sourceFormat, sourceDigest: input.plan.sourceDigest, converterId: this.id, converterVersion: this.version, mappingVersion: CLAUDE_MAPPING_VERSION }, null, 2));
       const validation = await validateNativePlugin(temporary);
       if (validation.status !== "valid")
         throw new Error(validation.diagnostics.map((x) => x.message).join("; "));
@@ -370772,10 +371015,428 @@ class ClaudeCodePluginConverter {
     }
   }
 }
+// ../../packages/plugin-converters/src/codex/converter.ts
+init_src12();
+import { randomUUID as randomUUID28 } from "node:crypto";
+import { copyFile as copyFile2, lstat as lstat9, mkdir as mkdir15, readFile as readFile23, realpath as realpath8, rename as rename5, rm as rm8, writeFile as writeFile12 } from "node:fs/promises";
+import { dirname as dirname24, join as join48, relative as relative14, resolve as resolve30 } from "node:path";
+
+// ../../packages/plugin-converters/src/codex/source.ts
+import { lstat as lstat8, readFile as readFile21, readdir as readdir11 } from "node:fs/promises";
+import { dirname as dirname23, isAbsolute as isAbsolute14, join as join47, relative as relative13, resolve as resolve29 } from "node:path";
+var PORTABLE_PLUGIN_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json";
+var legacyManifest = ".codex-plugin/plugin.json";
+function object3(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${label} must be an object`);
+  return value;
+}
+async function exists6(path) {
+  try {
+    await lstat8(path);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return false;
+    throw error;
+  }
+}
+async function sourceFiles(root, directory = root) {
+  const info = await lstat8(directory);
+  if (info.isSymbolicLink())
+    throw new Error(`Codex source link is not allowed: ${directory}`);
+  if (!info.isDirectory())
+    throw new Error(`Codex source must be a directory: ${directory}`);
+  const files = [];
+  for (const entry of (await readdir11(directory, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+    const full = join47(directory, entry.name);
+    if (entry.isSymbolicLink())
+      throw new Error(`Codex source link is not allowed: ${full}`);
+    if (entry.isDirectory())
+      files.push(...await sourceFiles(root, full));
+    else if (entry.isFile())
+      files.push(relative13(root, full).replaceAll("\\", "/"));
+    else
+      throw new Error(`Unsupported Codex source file type: ${full}`);
+  }
+  return files;
+}
+function isWithin3(root, path) {
+  const rel = relative13(resolve29(root), resolve29(path));
+  return rel === "" || !isAbsolute14(rel) && rel !== ".." && !rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`);
+}
+function pathDeclaration(root, value) {
+  if (!value.startsWith("./") || /[\\:\0]/.test(value) || value.split("/").includes("..")) {
+    throw new Error(`Invalid Codex component path: ${value}`);
+  }
+  const full = resolve29(root, value);
+  if (full === root || !isWithin3(root, full))
+    throw new Error(`Codex component path escapes source: ${value}`);
+  const path = relative13(root, full).replaceAll("\\", "/");
+  if (path.split("/").some((part) => [".git", ".codex-plugin", ".claude-plugin", ".openharness-plugin", ".openharness-conversion"].includes(part))) {
+    throw new Error(`Reserved Codex component path: ${value}`);
+  }
+  return path;
+}
+async function declaredPaths(root, value, label, defaults) {
+  if (value === undefined)
+    return (await Promise.all(defaults.map(async (path) => await exists6(join47(root, path)) ? path : undefined))).filter((path) => path !== undefined);
+  const values = typeof value === "string" ? [value] : value;
+  if (!Array.isArray(values) || !values.every((path) => typeof path === "string"))
+    throw new Error(`${label} must be a path or path array`);
+  const paths = values.map((path) => pathDeclaration(root, path));
+  for (const path of paths)
+    if (!await exists6(join47(root, path)))
+      throw new Error(`Codex component path does not exist: ${path}`);
+  return [...new Set(paths)];
+}
+async function readJson2(root, path) {
+  return object3(JSON.parse(await readFile21(join47(root, path), "utf8")), path);
+}
+async function detectCodexPlugin(rootInput) {
+  const root = resolve29(rootInput);
+  if (await exists6(join47(root, legacyManifest)))
+    return { converterId: "codex", confidence: 1, evidence: [legacyManifest] };
+  if (!await exists6(join47(root, "plugin.json")))
+    return null;
+  await sourceFiles(root);
+  const manifest = await readJson2(root, "plugin.json");
+  return manifest.$schema === PORTABLE_PLUGIN_SCHEMA ? { converterId: "codex", confidence: 1, evidence: [`plugin.json:${PORTABLE_PLUGIN_SCHEMA}`] } : null;
+}
+async function readCodexSource(rootInput) {
+  const root = resolve29(rootInput);
+  const files = await sourceFiles(root);
+  const portableCandidate = files.includes("plugin.json") ? await readJson2(root, "plugin.json") : undefined;
+  if (typeof portableCandidate?.$schema === "string" && portableCandidate.$schema.startsWith("https://agent-plugins.org/") && portableCandidate.$schema !== PORTABLE_PLUGIN_SCHEMA) {
+    throw new Error(`Unsupported portable plugin schema: ${portableCandidate.$schema}`);
+  }
+  const portable = portableCandidate?.$schema === PORTABLE_PLUGIN_SCHEMA;
+  const extensions = portable && portableCandidate.extensions !== undefined ? object3(portableCandidate.extensions, "extensions") : {};
+  const inline = extensions["com.openai"];
+  const legacy = (!portable || inline === undefined) && files.includes(legacyManifest) ? await readJson2(root, legacyManifest) : undefined;
+  const manifest = portable ? portableCandidate : legacy;
+  if (!manifest)
+    throw new Error("Codex manifest is missing or the portable schema is not supported");
+  if (typeof manifest.name !== "string" || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(manifest.name))
+    throw new Error("Codex name must use kebab-case");
+  if (manifest.version !== undefined && (typeof manifest.version !== "string" || !manifest.version.trim()))
+    throw new Error("Codex version must be a nonempty string");
+  const settings = portable ? extensions["com.openai"] === undefined ? legacy ?? {} : object3(extensions["com.openai"], "extensions.com.openai") : manifest;
+  const inventory = {};
+  const declaredSkillRoots = await declaredPaths(root, portable ? undefined : settings.skills, "skills", ["skills"]);
+  const skillRoots = declaredSkillRoots.filter((path) => !declaredSkillRoots.some((parent) => parent !== path && path.startsWith(`${parent}/`)));
+  inventory.skills = [];
+  for (const path of skillRoots) {
+    const skills = files.filter((file) => (file === path || file.startsWith(`${path}/`)) && file.split("/").at(-1) === "SKILL.md");
+    if (!skills.length)
+      throw new Error(`Codex skill path contains no SKILL.md: ${path}`);
+    inventory.skills.push(...skills.map((file) => join47(root, file)));
+  }
+  inventory.skills = [...new Set(inventory.skills)];
+  const mcp = [];
+  const mcpDeclaration = portable ? undefined : settings.mcpServers;
+  if (mcpDeclaration && typeof mcpDeclaration === "object" && !Array.isArray(mcpDeclaration)) {
+    const raw = object3(mcpDeclaration, "mcpServers");
+    mcp.push({ path: `${legacyManifest}#mcpServers`, servers: object3(raw.mcpServers ?? raw, "mcpServers"), portable: false });
+  } else {
+    for (const path of await declaredPaths(root, mcpDeclaration, "mcpServers", [portable ? "mcp.json" : ".mcp.json"])) {
+      const raw = await readJson2(root, path);
+      mcp.push({ path, servers: object3(raw.mcpServers, `${path}.mcpServers`), portable });
+    }
+  }
+  inventory.mcpServers = mcp.map((value) => value.path);
+  const unsupported = [];
+  if (portable) {
+    const portableFields = new Set(["$schema", "name", "version", "description", "author", "homepage", "repository", "license", "keywords", "extensions"]);
+    for (const key of Object.keys(manifest).filter((key) => !portableFields.has(key))) {
+      unsupported.push({ kind: "manifest", path: `plugin.json#${key}`, reason: `Unrecognized portable manifest field: ${key}` });
+    }
+    for (const [key, extension] of Object.entries(extensions)) {
+      if (key === "com.openai")
+        continue;
+      object3(extension, `extensions.${key}`);
+      unsupported.push({ kind: "extensions", path: `plugin.json#extensions.${key}`, reason: `Portable extension ${key} has no Native conversion` });
+    }
+  }
+  for (const skill of inventory.skills) {
+    const path = relative13(root, join47(dirname23(skill), "agents/openai.yaml")).replaceAll("\\", "/");
+    if (files.includes(path))
+      unsupported.push({ kind: "skillMetadata", path, reason: "Codex skill invocation policy, tool dependencies and presentation in agents/openai.yaml are not applied by Native" });
+  }
+  for (const kind of ["apps", "hooks", "agents", "commands", "lspServers", "tools", "workflows", "channels", "providers", "ui", "outputStyles", "themes", "monitors", "binaries"]) {
+    const declaration = settings[kind];
+    const defaults = kind === "hooks" ? ["hooks/hooks.json"] : [];
+    let paths;
+    if (declaration !== null && typeof declaration === "object" && (!Array.isArray(declaration) || declaration.some((item) => typeof item !== "string"))) {
+      paths = [`${portable ? "plugin.json" : legacyManifest}#${kind}`];
+    } else
+      paths = await declaredPaths(root, declaration, kind, defaults);
+    for (const path of paths)
+      unsupported.push({ kind, path, reason: `Codex ${kind} has no supported Native conversion in this version` });
+    if (paths.length)
+      inventory[kind] = paths;
+  }
+  const known = new Set(["$schema", "name", "version", "description", "author", "homepage", "repository", "license", "keywords", "skills", "mcpServers", "interface", "extensions", ...unsupported.map((item) => item.kind)]);
+  for (const key of Object.keys(settings).filter((key) => !known.has(key))) {
+    unsupported.push({ kind: key, path: `${portable ? "plugin.json" : legacyManifest}#${key}`, reason: `Unrecognized Codex manifest field: ${key}` });
+  }
+  const ui = settings.interface === undefined ? {} : object3(settings.interface, "interface");
+  return {
+    inspection: { root, format: "codex", identity: { id: `converted.codex.${manifest.name}`, name: manifest.name, version: manifest.version ?? "0.0.0" }, inventory, diagnostics: [] },
+    files,
+    metadataPaths: [...portable ? ["plugin.json"] : [], ...mcp.map((item) => item.path), ...unsupported.map((item) => item.path)],
+    skillRoots,
+    mcp,
+    unsupported,
+    ...typeof manifest.description === "string" ? { description: manifest.description } : {},
+    ...typeof ui.displayName === "string" && ui.displayName.trim() ? { displayName: ui.displayName } : {}
+  };
+}
+
+// ../../packages/plugin-converters/src/codex/mcp.ts
+function stringMap(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((item) => typeof item === "string");
+}
+function mapCodexMcp(value, portable) {
+  let row;
+  try {
+    row = object3(value, "MCP server");
+  } catch {
+    return { reason: "MCP server must be an object" };
+  }
+  const unknown = Object.keys(row).filter((key) => !["type", "command", "args", "env", "url", "headers"].includes(key));
+  if (unknown.length)
+    return { reason: `MCP fields have no verified Native equivalent: ${unknown.sort().join(", ")}` };
+  if (/\$\{|\$[A-Z_][A-Z0-9_]*|%[A-Z_][A-Z0-9_]*%/.test(JSON.stringify(row)))
+    return { reason: "MCP environment or plugin-root interpolation is not supported" };
+  if (row.command !== undefined && row.url !== undefined)
+    return { reason: "MCP command and url cannot be combined" };
+  if (typeof row.url === "string") {
+    if (row.type !== undefined && row.type !== "http" && row.type !== "streamable-http" && row.type !== "sse")
+      return { reason: "Unsupported MCP transport" };
+    if (portable && row.type !== "streamable-http")
+      return { reason: "Portable HTTP MCP requires streamable-http transport" };
+    if (row.args !== undefined || row.env !== undefined || row.headers !== undefined && !stringMap(row.headers))
+      return { reason: "Unsupported HTTP MCP options" };
+    let url;
+    try {
+      url = new URL(row.url);
+    } catch {
+      return { reason: "Invalid MCP URL" };
+    }
+    if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.hash)
+      return { reason: "MCP requires an HTTP(S) URL without credentials or a fragment" };
+    return { config: { type: row.type === "sse" ? "sse" : "http", url: row.url, ...row.headers === undefined ? {} : { headers: row.headers } }, permissions: { network: [url.origin] }, reason: "MCP transport is adapted to Native; connection and authentication happen after installation" };
+  }
+  if (typeof row.command === "string" && /^[a-zA-Z0-9_-]+(?:\.exe)?$/.test(row.command)) {
+    if (row.type !== undefined && row.type !== "stdio" || portable && row.type !== "stdio" || row.headers !== undefined)
+      return { reason: "Unsupported stdio MCP options" };
+    if (row.args !== undefined && (!Array.isArray(row.args) || !row.args.every((item) => typeof item === "string")))
+      return { reason: "MCP args must be a string array" };
+    if (row.env !== undefined && !stringMap(row.env))
+      return { reason: "MCP env must contain strings" };
+    const args = row.args ?? [];
+    if (["npx", "npm", "pnpm", "yarn", "bunx", "uvx", "sh", "bash", "cmd", "powershell", "pwsh"].includes(row.command.toLowerCase().replace(/\.exe$/, "")) || args.some((arg) => /[\\/]|\.(?:[cm]?js|ts|py|sh|exe)$/.test(arg) || ["-e", "--eval", "-c", "--command"].includes(arg)))
+      return { reason: "MCP local paths, shell code or dependency execution require explicit preparation not supported by this converter" };
+    return { config: { type: "stdio", command: row.command, ...row.args === undefined ? {} : { args }, ...row.env === undefined ? {} : { env: row.env } }, permissions: { process: [row.command] }, reason: "MCP runs an already-installed executable from PATH; availability is checked when connecting" };
+  }
+  return { reason: "MCP requires a supported remote URL or an installed executable name" };
+}
+
+// ../../packages/plugin-converters/src/codex/converter.ts
+var VERSION3 = "1.0.0";
+var MAPPING_VERSION = "1";
+async function exists7(path) {
+  try {
+    await lstat9(path);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return false;
+    throw error;
+  }
+}
+async function prepare(inspection) {
+  const before = await digestSource(inspection.root);
+  const source = await readCodexSource(inspection.root);
+  if (digestValue(source.inspection) !== digestValue(inspection))
+    throw new Error("Source inspection changed; inspect and plan again");
+  const items = (inspection.inventory.skills ?? []).map((path) => {
+    const sourcePath = relative14(inspection.root, path).replaceAll("\\", "/");
+    return { id: `skills:${sourcePath}`, sourceKind: "skills", sourcePath, targetKind: "skills", fidelity: "exact" };
+  });
+  const servers = Object.create(null);
+  const seenServers = new Set;
+  const permissions = {};
+  for (const contribution of source.mcp) {
+    for (const [name, raw] of Object.entries(contribution.servers).sort(([a], [b]) => a.localeCompare(b))) {
+      if (!name.trim() || ["__proto__", "prototype", "constructor"].includes(name) || seenServers.has(name))
+        throw new Error(`Invalid or duplicate Codex MCP server name: ${name}`);
+      seenServers.add(name);
+      const mapped = mapCodexMcp(raw, contribution.portable);
+      const id = `mcpServers:${contribution.path}#${name}`;
+      const requiredApprovals = [id];
+      if (mapped.config) {
+        servers[name] = mapped.config;
+        for (const category of ["network", "process"]) {
+          for (const permission of mapped.permissions?.[category] ?? []) {
+            permissions[category] = [...new Set([...permissions[category] ?? [], permission])].sort();
+            requiredApprovals.push(`${category}:${permission}`);
+          }
+        }
+      }
+      items.push({
+        id,
+        sourceKind: "mcpServers",
+        sourcePath: contribution.path,
+        ...mapped.config ? { targetKind: "mcpServers" } : {},
+        fidelity: mapped.config ? "adapted" : "unsupported",
+        reason: mapped.reason,
+        requiredApprovals
+      });
+    }
+  }
+  for (const value of source.unsupported) {
+    const id = `${value.kind}:${value.path}`;
+    items.push({ id, sourceKind: value.kind, sourcePath: value.path, fidelity: "unsupported", reason: value.reason, requiredApprovals: [id] });
+  }
+  const sourceDigest = await digestSource(inspection.root);
+  if (before !== sourceDigest)
+    throw new Error("Source changed during conversion planning; inspect and plan again");
+  return {
+    source,
+    servers,
+    permissions,
+    plan: {
+      schemaVersion: 1,
+      converterId: "codex",
+      converterVersion: VERSION3,
+      sourceFormat: "codex",
+      sourceDigest,
+      optionsDigest: digestValue({}),
+      mappingVersion: MAPPING_VERSION,
+      items: items.sort((a, b) => a.id.localeCompare(b.id)),
+      diagnostics: []
+    }
+  };
+}
+async function checkOutput(sourceRoot, output) {
+  if (isWithin3(sourceRoot, output))
+    throw new Error("Conversion output cannot be inside the source directory");
+  if (await exists7(output))
+    throw new Error(`Conversion output already exists: ${output}`);
+  let parent = dirname24(output);
+  while (!await exists7(parent))
+    parent = dirname24(parent);
+  const canonicalOutput = resolve30(await realpath8(parent), relative14(parent, output));
+  if (isWithin3(await realpath8(sourceRoot), canonicalOutput))
+    throw new Error("Conversion output resolves inside the source directory");
+}
+function isSourceMetadata(path, source) {
+  const lower = path.toLowerCase();
+  const top = lower.split("/")[0];
+  if ([".git", ".codex-plugin", ".claude-plugin", ".openharness-plugin", ".openharness-conversion"].includes(top))
+    return true;
+  return source.metadataPaths.some((item) => item.toLowerCase() === lower);
+}
+
+class CodexPluginConverter {
+  id = "codex";
+  version = VERSION3;
+  sourceFormat = "codex";
+  detect = detectCodexPlugin;
+  async inspect(root) {
+    return (await readCodexSource(root)).inspection;
+  }
+  async plan(inspection, options = {}) {
+    if (Object.keys(options).length)
+      throw new Error("Codex conversion options are not supported in this version");
+    return (await prepare(inspection)).plan;
+  }
+  async convert(input) {
+    const output = resolve30(input.output);
+    await checkOutput(input.inspection.root, output);
+    await readCodexSource(input.inspection.root);
+    if (await digestSource(input.inspection.root) !== input.plan.sourceDigest)
+      throw new Error("Source changed after conversion planning; inspect and plan again");
+    const prepared = await prepare(input.inspection);
+    if (digestValue(prepared.plan) !== digestValue(input.plan))
+      throw new Error("Conversion plan does not match the current source and converter; plan again");
+    const missing = [...new Set(prepared.plan.items.flatMap((item) => item.requiredApprovals ?? []))].filter((item) => !input.approvals?.includes(item));
+    if (missing.length)
+      throw new Error(`Explicit conversion approval required: ${missing.join(", ")}`);
+    const components = {};
+    const skillFiles = prepared.plan.items.filter((item) => item.sourceKind === "skills" && item.fidelity === "exact");
+    if (skillFiles.length)
+      components.skills = skillFiles.map((item) => `./${item.sourcePath}`);
+    if (Object.keys(prepared.servers).length)
+      components.mcpServers = ["./mcp/servers.json"];
+    if (!Object.keys(components).length)
+      throw new Error("Codex source contains no convertible components; see unsupported plan items");
+    const manifest = {
+      schemaVersion: 1,
+      ...input.inspection.identity,
+      ...prepared.source.description === undefined ? {} : { description: prepared.source.description },
+      ...prepared.source.displayName === undefined ? {} : { displayName: prepared.source.displayName },
+      components,
+      ...Object.keys(prepared.permissions).length ? { permissions: prepared.permissions } : {},
+      metadata: { origin: "converted", sourceFormat: this.sourceFormat, converterId: this.id, converterVersion: this.version }
+    };
+    const report = { schemaVersion: 1, status: input.plan.items.some((item) => item.fidelity === "unsupported") ? "partial" : "success", items: input.plan.items, diagnostics: input.plan.diagnostics };
+    const temporary = `${output}.tmp-${randomUUID28()}`;
+    const copied = [];
+    try {
+      await mkdir15(temporary, { recursive: true });
+      for (const path of prepared.source.files) {
+        if (isSourceMetadata(path, prepared.source))
+          continue;
+        if (components.mcpServers && path.toLowerCase() === "mcp/servers.json")
+          throw new Error("Source resource conflicts with generated Native MCP path");
+        const sourcePath = join48(input.inspection.root, path);
+        if (!(await lstat9(sourcePath)).isFile())
+          throw new Error(`Source file changed during conversion: ${path}`);
+        const target = join48(temporary, path);
+        await mkdir15(dirname24(target), { recursive: true });
+        await copyFile2(sourcePath, target);
+        copied.push(path);
+      }
+      const writeJson = async (path, value) => {
+        const target = join48(temporary, path);
+        await mkdir15(dirname24(target), { recursive: true });
+        await writeFile12(target, JSON.stringify(value, null, 2));
+      };
+      if (components.mcpServers)
+        await writeJson("mcp/servers.json", { servers: prepared.servers });
+      await writeJson(".openharness-plugin/plugin.json", manifest);
+      await writeJson(".openharness-conversion/plan.json", input.plan);
+      await writeJson(".openharness-conversion/report.json", report);
+      await writeJson(".openharness-conversion/provenance.json", { sourceFormat: this.sourceFormat, sourceDigest: input.plan.sourceDigest, converterId: this.id, converterVersion: this.version, mappingVersion: MAPPING_VERSION });
+      await readCodexSource(input.inspection.root);
+      if (await digestSource(input.inspection.root) !== input.plan.sourceDigest)
+        throw new Error("Source changed during conversion; inspect and plan again");
+      for (const path of copied) {
+        if (!(await readFile23(join48(temporary, path))).equals(await readFile23(join48(input.inspection.root, path))))
+          throw new Error(`Source changed while copying: ${path}`);
+      }
+      const validation = await validateNativePlugin(temporary);
+      if (validation.status !== "valid")
+        throw new Error(validation.diagnostics.map((item) => item.message).join("; "));
+      if (digestValue(requestedPluginPermissions(validation.plugin.manifest)) !== digestValue(requestedPluginPermissions(manifest)))
+        throw new Error("Converted permissions changed during validation");
+      await checkOutput(input.inspection.root, output);
+      await rename5(temporary, output);
+      return report;
+    } catch (error) {
+      await rm8(temporary, { recursive: true, force: true });
+      throw error;
+    }
+  }
+}
 // ../../packages/plugin-converters/src/index.ts
 function createBuiltinConverterRegistry() {
   const registry = new ConverterRegistry;
   registry.register(new ClaudeCodePluginConverter);
+  registry.register(new CodexPluginConverter);
   return registry;
 }
 
@@ -370787,6 +371448,15 @@ async function client() {
   return new OpenHarnessClient({ baseUrl: daemon.url, token: daemon.token });
 }
 var collect2 = (value, previous) => [...previous, value];
+function formatConversionPlan(plan) {
+  return plan.items.map((item) => [
+    `${item.fidelity.padEnd(11)} ${item.id}`,
+    ...item.reason ? [`  ${item.reason}`] : [],
+    ...(item.requiredApprovals ?? []).map((approval) => `  --approve ${JSON.stringify(approval)}`)
+  ].join(`
+`)).join(`
+`);
+}
 var activationLabels = {
   inactive: "inactive",
   active: "active",
@@ -370856,11 +371526,11 @@ function formatPluginList(result, verbose = false) {
 function createPluginCommand() {
   const cmd = new Command3("plugin").description("Manage Native Plugins");
   cmd.command("list").option("--cwd <path>").option("--verbose", "show permissions, contributions, runtime, and diagnostics").option("--json", "print the complete machine-readable response").action(async (options) => {
-    const result = await (await client()).listPlugins({ cwd: resolve28(options.cwd ?? process.cwd()) });
+    const result = await (await client()).listPlugins({ cwd: resolve31(options.cwd ?? process.cwd()) });
     console.log(options.json ? JSON.stringify(result, null, 2) : formatPluginList(result, options.verbose));
   });
   cmd.command("validate").argument("<path>").action(async (path) => {
-    const result = await validateNativePlugin(resolve28(path));
+    const result = await validateNativePlugin(resolve31(path));
     if (result.status === "valid")
       console.log(`Valid Native Plugin: ${result.plugin.manifest.id}@${result.plugin.manifest.version}`);
     else {
@@ -370871,7 +371541,7 @@ function createPluginCommand() {
   });
   for (const [name, link] of [["install-local", false], ["link", true]]) {
     cmd.command(name).argument("<path>").option("--cwd <path>").option("--approve <permission>", "approve a requested permission", collect2, []).action(async (path, options) => {
-      const sourcePath = resolve28(path);
+      const sourcePath = resolve31(path);
       const validation = await validateNativePlugin(sourcePath);
       if (!validation.plugin)
         throw new Error(validation.diagnostics.map((item) => item.message).join("; "));
@@ -370881,7 +371551,7 @@ function createPluginCommand() {
       if (missing.length)
         throw new Error(`Explicit approval required: ${missing.join(", ")}`);
       const result = await (await client()).installLocalPlugin({
-        cwd: resolve28(options.cwd ?? process.cwd()),
+        cwd: resolve31(options.cwd ?? process.cwd()),
         sourcePath,
         scope: "user",
         approvedPermissions: approved,
@@ -370893,25 +371563,25 @@ function createPluginCommand() {
   for (const action of ["enable", "disable"])
     cmd.command(action).argument("<id>").option("--cwd <path>").action(async (id, options) => {
       const api = await client();
-      const input = { cwd: resolve28(options.cwd ?? process.cwd()) };
+      const input = { cwd: resolve31(options.cwd ?? process.cwd()) };
       console.log((action === "enable" ? await api.enablePlugin(id, input) : await api.disablePlugin(id, input)).message);
     });
   cmd.command("uninstall").argument("<id>").option("--cwd <path>").action(async (id, options) => {
-    console.log((await (await client()).uninstallPlugin(id, { cwd: resolve28(options.cwd ?? process.cwd()) })).message);
+    console.log((await (await client()).uninstallPlugin(id, { cwd: resolve31(options.cwd ?? process.cwd()) })).message);
   });
   cmd.command("details").argument("<id>").option("--cwd <path>").action(async (id, options) => {
-    const listed = await (await client()).listPlugins({ cwd: resolve28(options.cwd ?? process.cwd()) });
+    const listed = await (await client()).listPlugins({ cwd: resolve31(options.cwd ?? process.cwd()) });
     const plugin = listed.plugins.find((item) => item.identity.id === id);
     if (!plugin)
       throw new Error(`Plugin not found: ${id}`);
     console.log(JSON.stringify(plugin, null, 2));
   });
-  cmd.command("install").argument("<source>").requiredOption("--from <converter>").option("--cwd <path>").option("--approve <item>", "approve conversion item or permission", collect2, []).action(async (source, options) => {
-    const temporaryRoot = await mkdtemp3(join46(tmpdir5(), "ohs-plugin-import-"));
-    const output = join46(temporaryRoot, "native");
+  cmd.command("install").argument("<source>").requiredOption("--from <converter>", "source converter: claude-code or codex").option("--cwd <path>").option("--approve <item>", "approve conversion item or permission", collect2, []).action(async (source, options) => {
+    const temporaryRoot = await mkdtemp3(join49(tmpdir5(), "ohs-plugin-import-"));
+    const output = join49(temporaryRoot, "native");
     try {
-      const { converter } = await createBuiltinConverterRegistry().detect(resolve28(source), options.from);
-      const inspection = await converter.inspect(resolve28(source));
+      const { converter } = await createBuiltinConverterRegistry().detect(resolve31(source), options.from);
+      const inspection = await converter.inspect(resolve31(source));
       const plan = await converter.plan(inspection, {});
       await converter.convert({ inspection, plan, output, approvals: options.approve });
       const validation = await validateNativePlugin(output);
@@ -370922,29 +371592,28 @@ function createPluginCommand() {
       if (missing.length)
         throw new Error(`Explicit permission approval required: ${missing.join(", ")}`);
       const result = await (await client()).installLocalPlugin({
-        cwd: resolve28(options.cwd ?? process.cwd()),
+        cwd: resolve31(options.cwd ?? process.cwd()),
         sourcePath: output,
         scope: "user",
         approvedPermissions: requested
       });
       console.log(result.message);
     } finally {
-      await rm8(temporaryRoot, { recursive: true, force: true });
+      await rm9(temporaryRoot, { recursive: true, force: true });
     }
   });
-  cmd.command("convert").argument("<source>").option("--from <converter>").option("--output <path>").option("--dry-run").option("--json").option("--approve <item>", "approve a blocked conversion item", collect2, []).action(async (source, options) => {
+  cmd.command("convert").argument("<source>").option("--from <converter>", "source converter: claude-code or codex").option("--output <path>").option("--dry-run").option("--json").option("--approve <item>", "approve a conversion change, omitted component, or permission shown in the plan", collect2, []).action(async (source, options) => {
     const registry = createBuiltinConverterRegistry();
-    const { converter, detection } = await registry.detect(resolve28(source), options.from);
-    const inspection = await converter.inspect(resolve28(source));
+    const { converter, detection } = await registry.detect(resolve31(source), options.from);
+    const inspection = await converter.inspect(resolve31(source));
     const plan = await converter.plan(inspection, {});
     if (options.dryRun) {
-      console.log(options.json ? JSON.stringify({ detection, inspection, plan }, null, 2) : plan.items.map((item) => `${item.fidelity.padEnd(11)} ${item.id}`).join(`
-`));
+      console.log(options.json ? JSON.stringify({ detection, inspection, plan }, null, 2) : formatConversionPlan(plan));
       return;
     }
     if (!options.output)
       throw new Error("--output is required unless --dry-run is used");
-    const report = await converter.convert({ inspection, plan, output: resolve28(options.output), approvals: options.approve });
+    const report = await converter.convert({ inspection, plan, output: resolve31(options.output), approvals: options.approve });
     console.log(options.json ? JSON.stringify(report, null, 2) : `Converted ${inspection.identity.id}: ${report.status}`);
   });
   return cmd;
@@ -371461,7 +372130,7 @@ function createSandboxCommand() {
 init_src3();
 init_src9();
 import { readFileSync as readFileSync15 } from "node:fs";
-import { resolve as resolve29 } from "node:path";
+import { resolve as resolve33 } from "node:path";
 import { Command as Command8 } from "commander";
 function createWorkflowCommand() {
   const cmd = new Command8("workflow").description("Inspect and manage persisted workflow runs");
@@ -371618,7 +372287,7 @@ function readJsonOption(path, inlineJson) {
   if (inlineJson)
     return JSON.parse(inlineJson);
   if (path)
-    return JSON.parse(readFileSync15(resolve29(path), "utf-8"));
+    return JSON.parse(readFileSync15(resolve33(path), "utf-8"));
   return;
 }
 function parseCsv(value) {
@@ -372215,4 +372884,4 @@ program.command("doctor").description("Check environment and dependencies").acti
 });
 program.parse();
 
-//# debugId=2D32AB0B747CF29E64756E2164756E21
+//# debugId=037007773B000ECC64756E2164756E21