@rzx/ohs 1.1.1 → 1.1.12

package/dist/index.js

@@ -286055,8 +286055,8 @@ function createDaemonImageToTextTool(options) {
   };
 }
 async function recognizeAttachment(input, context, options) {
-  if (Object.keys(input).some((key) => key !== "attachment_id")) {
-    return errorResult4("attachment_id cannot be combined with image_path, image_url, or prompt", "command");
+  if (Object.keys(input).some((key) => key !== "attachment_id" && key !== "prompt")) {
+    return errorResult4("attachment_id cannot be combined with another image source", "command");
   }
   const assetId = typeof input.attachment_id === "string" ? input.attachment_id.trim() : "";
   if (!assetId || !context.sessionId)
@@ -370567,12 +370567,12 @@ function createMcpCommand() {
 // src/commands/plugin.ts
 init_src15();
 init_src12();
-import { join as join47, resolve as resolve29 } from "node:path";
-import { mkdtemp as mkdtemp3, rm as rm8 } from "node:fs/promises";
+import { join as join49, resolve as resolve31 } from "node:path";
+import { mkdtemp as mkdtemp3, rm as rm9 } from "node:fs/promises";
 import { tmpdir as tmpdir5 } from "node:os";
 // ../../packages/plugin-converters/src/core/digest.ts
 import { createHash as createHash13 } from "node:crypto";
-import { readFile as readFile18, readdir as readdir9 } from "node:fs/promises";
+import { lstat as lstat6, readFile as readFile18, readdir as readdir9 } from "node:fs/promises";
 import { join as join43, relative as relative10 } from "node:path";
 function stable(value) {
   if (Array.isArray(value))
@@ -370598,12 +370598,20 @@ async function files(root, dir = root) {
   return out;
 }
 async function digestSource(root) {
+  if ((await lstat6(root)).isSymbolicLink())
+    throw new Error("Source root link is not allowed");
   const hash = createHash13("sha256");
+  hash.update(`openharness-source-v2
+`);
   for (const file of await files(root)) {
-    hash.update(relative10(root, file).replaceAll("\\", "/"));
-    hash.update("\x00");
-    hash.update(await readFile18(file));
-    hash.update("\x00");
+    const content = await readFile18(file);
+    hash.update(JSON.stringify([
+      relative10(root, file).replaceAll("\\", "/"),
+      content.length,
+      createHash13("sha256").update(content).digest("hex")
+    ]));
+    hash.update(`
+`);
   }
   return hash.digest("hex");
 }
@@ -370660,13 +370668,13 @@ async function detectClaudeCodePlugin(root) {
   return { converterId: "claude-code", confidence: evidence.includes(".claude-plugin/plugin.json") ? 1 : 0.7, evidence };
 }
 // ../../packages/plugin-converters/src/claude-code/parser.ts
-import { access as access7, lstat as lstat6, readFile as readFile19, readdir as readdir10 } from "node:fs/promises";
+import { access as access7, lstat as lstat7, readFile as readFile19, readdir as readdir10 } from "node:fs/promises";
 import { basename as basename13, isAbsolute as isAbsolute13, join as join45, relative as relative11, resolve as resolve27 } from "node:path";
 var exists5 = async (path) => access7(path).then(() => true, () => false);
 async function collect(root, path, extensions) {
   if (!await exists5(path))
     return [];
-  const info = await lstat6(path);
+  const info = await lstat7(path);
   if (info.isSymbolicLink())
     throw new Error(`Claude source symlink is not allowed: ${path}`);
   if (info.isFile())
@@ -371007,10 +371015,428 @@ class ClaudeCodePluginConverter {
     }
   }
 }
+// ../../packages/plugin-converters/src/codex/converter.ts
+init_src12();
+import { randomUUID as randomUUID28 } from "node:crypto";
+import { copyFile as copyFile2, lstat as lstat9, mkdir as mkdir15, readFile as readFile23, realpath as realpath8, rename as rename5, rm as rm8, writeFile as writeFile12 } from "node:fs/promises";
+import { dirname as dirname24, join as join48, relative as relative14, resolve as resolve30 } from "node:path";
+
+// ../../packages/plugin-converters/src/codex/source.ts
+import { lstat as lstat8, readFile as readFile21, readdir as readdir11 } from "node:fs/promises";
+import { dirname as dirname23, isAbsolute as isAbsolute14, join as join47, relative as relative13, resolve as resolve29 } from "node:path";
+var PORTABLE_PLUGIN_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json";
+var legacyManifest = ".codex-plugin/plugin.json";
+function object3(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${label} must be an object`);
+  return value;
+}
+async function exists6(path) {
+  try {
+    await lstat8(path);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return false;
+    throw error;
+  }
+}
+async function sourceFiles(root, directory = root) {
+  const info = await lstat8(directory);
+  if (info.isSymbolicLink())
+    throw new Error(`Codex source link is not allowed: ${directory}`);
+  if (!info.isDirectory())
+    throw new Error(`Codex source must be a directory: ${directory}`);
+  const files = [];
+  for (const entry of (await readdir11(directory, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+    const full = join47(directory, entry.name);
+    if (entry.isSymbolicLink())
+      throw new Error(`Codex source link is not allowed: ${full}`);
+    if (entry.isDirectory())
+      files.push(...await sourceFiles(root, full));
+    else if (entry.isFile())
+      files.push(relative13(root, full).replaceAll("\\", "/"));
+    else
+      throw new Error(`Unsupported Codex source file type: ${full}`);
+  }
+  return files;
+}
+function isWithin3(root, path) {
+  const rel = relative13(resolve29(root), resolve29(path));
+  return rel === "" || !isAbsolute14(rel) && rel !== ".." && !rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`);
+}
+function pathDeclaration(root, value) {
+  if (!value.startsWith("./") || /[\\:\0]/.test(value) || value.split("/").includes("..")) {
+    throw new Error(`Invalid Codex component path: ${value}`);
+  }
+  const full = resolve29(root, value);
+  if (full === root || !isWithin3(root, full))
+    throw new Error(`Codex component path escapes source: ${value}`);
+  const path = relative13(root, full).replaceAll("\\", "/");
+  if (path.split("/").some((part) => [".git", ".codex-plugin", ".claude-plugin", ".openharness-plugin", ".openharness-conversion"].includes(part))) {
+    throw new Error(`Reserved Codex component path: ${value}`);
+  }
+  return path;
+}
+async function declaredPaths(root, value, label, defaults) {
+  if (value === undefined)
+    return (await Promise.all(defaults.map(async (path) => await exists6(join47(root, path)) ? path : undefined))).filter((path) => path !== undefined);
+  const values = typeof value === "string" ? [value] : value;
+  if (!Array.isArray(values) || !values.every((path) => typeof path === "string"))
+    throw new Error(`${label} must be a path or path array`);
+  const paths = values.map((path) => pathDeclaration(root, path));
+  for (const path of paths)
+    if (!await exists6(join47(root, path)))
+      throw new Error(`Codex component path does not exist: ${path}`);
+  return [...new Set(paths)];
+}
+async function readJson2(root, path) {
+  return object3(JSON.parse(await readFile21(join47(root, path), "utf8")), path);
+}
+async function detectCodexPlugin(rootInput) {
+  const root = resolve29(rootInput);
+  if (await exists6(join47(root, legacyManifest)))
+    return { converterId: "codex", confidence: 1, evidence: [legacyManifest] };
+  if (!await exists6(join47(root, "plugin.json")))
+    return null;
+  await sourceFiles(root);
+  const manifest = await readJson2(root, "plugin.json");
+  return manifest.$schema === PORTABLE_PLUGIN_SCHEMA ? { converterId: "codex", confidence: 1, evidence: [`plugin.json:${PORTABLE_PLUGIN_SCHEMA}`] } : null;
+}
+async function readCodexSource(rootInput) {
+  const root = resolve29(rootInput);
+  const files = await sourceFiles(root);
+  const portableCandidate = files.includes("plugin.json") ? await readJson2(root, "plugin.json") : undefined;
+  if (typeof portableCandidate?.$schema === "string" && portableCandidate.$schema.startsWith("https://agent-plugins.org/") && portableCandidate.$schema !== PORTABLE_PLUGIN_SCHEMA) {
+    throw new Error(`Unsupported portable plugin schema: ${portableCandidate.$schema}`);
+  }
+  const portable = portableCandidate?.$schema === PORTABLE_PLUGIN_SCHEMA;
+  const extensions = portable && portableCandidate.extensions !== undefined ? object3(portableCandidate.extensions, "extensions") : {};
+  const inline = extensions["com.openai"];
+  const legacy = (!portable || inline === undefined) && files.includes(legacyManifest) ? await readJson2(root, legacyManifest) : undefined;
+  const manifest = portable ? portableCandidate : legacy;
+  if (!manifest)
+    throw new Error("Codex manifest is missing or the portable schema is not supported");
+  if (typeof manifest.name !== "string" || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(manifest.name))
+    throw new Error("Codex name must use kebab-case");
+  if (manifest.version !== undefined && (typeof manifest.version !== "string" || !manifest.version.trim()))
+    throw new Error("Codex version must be a nonempty string");
+  const settings = portable ? extensions["com.openai"] === undefined ? legacy ?? {} : object3(extensions["com.openai"], "extensions.com.openai") : manifest;
+  const inventory = {};
+  const declaredSkillRoots = await declaredPaths(root, portable ? undefined : settings.skills, "skills", ["skills"]);
+  const skillRoots = declaredSkillRoots.filter((path) => !declaredSkillRoots.some((parent) => parent !== path && path.startsWith(`${parent}/`)));
+  inventory.skills = [];
+  for (const path of skillRoots) {
+    const skills = files.filter((file) => (file === path || file.startsWith(`${path}/`)) && file.split("/").at(-1) === "SKILL.md");
+    if (!skills.length)
+      throw new Error(`Codex skill path contains no SKILL.md: ${path}`);
+    inventory.skills.push(...skills.map((file) => join47(root, file)));
+  }
+  inventory.skills = [...new Set(inventory.skills)];
+  const mcp = [];
+  const mcpDeclaration = portable ? undefined : settings.mcpServers;
+  if (mcpDeclaration && typeof mcpDeclaration === "object" && !Array.isArray(mcpDeclaration)) {
+    const raw = object3(mcpDeclaration, "mcpServers");
+    mcp.push({ path: `${legacyManifest}#mcpServers`, servers: object3(raw.mcpServers ?? raw, "mcpServers"), portable: false });
+  } else {
+    for (const path of await declaredPaths(root, mcpDeclaration, "mcpServers", [portable ? "mcp.json" : ".mcp.json"])) {
+      const raw = await readJson2(root, path);
+      mcp.push({ path, servers: object3(raw.mcpServers, `${path}.mcpServers`), portable });
+    }
+  }
+  inventory.mcpServers = mcp.map((value) => value.path);
+  const unsupported = [];
+  if (portable) {
+    const portableFields = new Set(["$schema", "name", "version", "description", "author", "homepage", "repository", "license", "keywords", "extensions"]);
+    for (const key of Object.keys(manifest).filter((key) => !portableFields.has(key))) {
+      unsupported.push({ kind: "manifest", path: `plugin.json#${key}`, reason: `Unrecognized portable manifest field: ${key}` });
+    }
+    for (const [key, extension] of Object.entries(extensions)) {
+      if (key === "com.openai")
+        continue;
+      object3(extension, `extensions.${key}`);
+      unsupported.push({ kind: "extensions", path: `plugin.json#extensions.${key}`, reason: `Portable extension ${key} has no Native conversion` });
+    }
+  }
+  for (const skill of inventory.skills) {
+    const path = relative13(root, join47(dirname23(skill), "agents/openai.yaml")).replaceAll("\\", "/");
+    if (files.includes(path))
+      unsupported.push({ kind: "skillMetadata", path, reason: "Codex skill invocation policy, tool dependencies and presentation in agents/openai.yaml are not applied by Native" });
+  }
+  for (const kind of ["apps", "hooks", "agents", "commands", "lspServers", "tools", "workflows", "channels", "providers", "ui", "outputStyles", "themes", "monitors", "binaries"]) {
+    const declaration = settings[kind];
+    const defaults = kind === "hooks" ? ["hooks/hooks.json"] : [];
+    let paths;
+    if (declaration !== null && typeof declaration === "object" && (!Array.isArray(declaration) || declaration.some((item) => typeof item !== "string"))) {
+      paths = [`${portable ? "plugin.json" : legacyManifest}#${kind}`];
+    } else
+      paths = await declaredPaths(root, declaration, kind, defaults);
+    for (const path of paths)
+      unsupported.push({ kind, path, reason: `Codex ${kind} has no supported Native conversion in this version` });
+    if (paths.length)
+      inventory[kind] = paths;
+  }
+  const known = new Set(["$schema", "name", "version", "description", "author", "homepage", "repository", "license", "keywords", "skills", "mcpServers", "interface", "extensions", ...unsupported.map((item) => item.kind)]);
+  for (const key of Object.keys(settings).filter((key) => !known.has(key))) {
+    unsupported.push({ kind: key, path: `${portable ? "plugin.json" : legacyManifest}#${key}`, reason: `Unrecognized Codex manifest field: ${key}` });
+  }
+  const ui = settings.interface === undefined ? {} : object3(settings.interface, "interface");
+  return {
+    inspection: { root, format: "codex", identity: { id: `converted.codex.${manifest.name}`, name: manifest.name, version: manifest.version ?? "0.0.0" }, inventory, diagnostics: [] },
+    files,
+    metadataPaths: [...portable ? ["plugin.json"] : [], ...mcp.map((item) => item.path), ...unsupported.map((item) => item.path)],
+    skillRoots,
+    mcp,
+    unsupported,
+    ...typeof manifest.description === "string" ? { description: manifest.description } : {},
+    ...typeof ui.displayName === "string" && ui.displayName.trim() ? { displayName: ui.displayName } : {}
+  };
+}
+
+// ../../packages/plugin-converters/src/codex/mcp.ts
+function stringMap(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((item) => typeof item === "string");
+}
+function mapCodexMcp(value, portable) {
+  let row;
+  try {
+    row = object3(value, "MCP server");
+  } catch {
+    return { reason: "MCP server must be an object" };
+  }
+  const unknown = Object.keys(row).filter((key) => !["type", "command", "args", "env", "url", "headers"].includes(key));
+  if (unknown.length)
+    return { reason: `MCP fields have no verified Native equivalent: ${unknown.sort().join(", ")}` };
+  if (/\$\{|\$[A-Z_][A-Z0-9_]*|%[A-Z_][A-Z0-9_]*%/.test(JSON.stringify(row)))
+    return { reason: "MCP environment or plugin-root interpolation is not supported" };
+  if (row.command !== undefined && row.url !== undefined)
+    return { reason: "MCP command and url cannot be combined" };
+  if (typeof row.url === "string") {
+    if (row.type !== undefined && row.type !== "http" && row.type !== "streamable-http" && row.type !== "sse")
+      return { reason: "Unsupported MCP transport" };
+    if (portable && row.type !== "streamable-http")
+      return { reason: "Portable HTTP MCP requires streamable-http transport" };
+    if (row.args !== undefined || row.env !== undefined || row.headers !== undefined && !stringMap(row.headers))
+      return { reason: "Unsupported HTTP MCP options" };
+    let url;
+    try {
+      url = new URL(row.url);
+    } catch {
+      return { reason: "Invalid MCP URL" };
+    }
+    if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.hash)
+      return { reason: "MCP requires an HTTP(S) URL without credentials or a fragment" };
+    return { config: { type: row.type === "sse" ? "sse" : "http", url: row.url, ...row.headers === undefined ? {} : { headers: row.headers } }, permissions: { network: [url.origin] }, reason: "MCP transport is adapted to Native; connection and authentication happen after installation" };
+  }
+  if (typeof row.command === "string" && /^[a-zA-Z0-9_-]+(?:\.exe)?$/.test(row.command)) {
+    if (row.type !== undefined && row.type !== "stdio" || portable && row.type !== "stdio" || row.headers !== undefined)
+      return { reason: "Unsupported stdio MCP options" };
+    if (row.args !== undefined && (!Array.isArray(row.args) || !row.args.every((item) => typeof item === "string")))
+      return { reason: "MCP args must be a string array" };
+    if (row.env !== undefined && !stringMap(row.env))
+      return { reason: "MCP env must contain strings" };
+    const args = row.args ?? [];
+    if (["npx", "npm", "pnpm", "yarn", "bunx", "uvx", "sh", "bash", "cmd", "powershell", "pwsh"].includes(row.command.toLowerCase().replace(/\.exe$/, "")) || args.some((arg) => /[\\/]|\.(?:[cm]?js|ts|py|sh|exe)$/.test(arg) || ["-e", "--eval", "-c", "--command"].includes(arg)))
+      return { reason: "MCP local paths, shell code or dependency execution require explicit preparation not supported by this converter" };
+    return { config: { type: "stdio", command: row.command, ...row.args === undefined ? {} : { args }, ...row.env === undefined ? {} : { env: row.env } }, permissions: { process: [row.command] }, reason: "MCP runs an already-installed executable from PATH; availability is checked when connecting" };
+  }
+  return { reason: "MCP requires a supported remote URL or an installed executable name" };
+}
+
+// ../../packages/plugin-converters/src/codex/converter.ts
+var VERSION3 = "1.0.0";
+var MAPPING_VERSION = "1";
+async function exists7(path) {
+  try {
+    await lstat9(path);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return false;
+    throw error;
+  }
+}
+async function prepare(inspection) {
+  const before = await digestSource(inspection.root);
+  const source = await readCodexSource(inspection.root);
+  if (digestValue(source.inspection) !== digestValue(inspection))
+    throw new Error("Source inspection changed; inspect and plan again");
+  const items = (inspection.inventory.skills ?? []).map((path) => {
+    const sourcePath = relative14(inspection.root, path).replaceAll("\\", "/");
+    return { id: `skills:${sourcePath}`, sourceKind: "skills", sourcePath, targetKind: "skills", fidelity: "exact" };
+  });
+  const servers = Object.create(null);
+  const seenServers = new Set;
+  const permissions = {};
+  for (const contribution of source.mcp) {
+    for (const [name, raw] of Object.entries(contribution.servers).sort(([a], [b]) => a.localeCompare(b))) {
+      if (!name.trim() || ["__proto__", "prototype", "constructor"].includes(name) || seenServers.has(name))
+        throw new Error(`Invalid or duplicate Codex MCP server name: ${name}`);
+      seenServers.add(name);
+      const mapped = mapCodexMcp(raw, contribution.portable);
+      const id = `mcpServers:${contribution.path}#${name}`;
+      const requiredApprovals = [id];
+      if (mapped.config) {
+        servers[name] = mapped.config;
+        for (const category of ["network", "process"]) {
+          for (const permission of mapped.permissions?.[category] ?? []) {
+            permissions[category] = [...new Set([...permissions[category] ?? [], permission])].sort();
+            requiredApprovals.push(`${category}:${permission}`);
+          }
+        }
+      }
+      items.push({
+        id,
+        sourceKind: "mcpServers",
+        sourcePath: contribution.path,
+        ...mapped.config ? { targetKind: "mcpServers" } : {},
+        fidelity: mapped.config ? "adapted" : "unsupported",
+        reason: mapped.reason,
+        requiredApprovals
+      });
+    }
+  }
+  for (const value of source.unsupported) {
+    const id = `${value.kind}:${value.path}`;
+    items.push({ id, sourceKind: value.kind, sourcePath: value.path, fidelity: "unsupported", reason: value.reason, requiredApprovals: [id] });
+  }
+  const sourceDigest = await digestSource(inspection.root);
+  if (before !== sourceDigest)
+    throw new Error("Source changed during conversion planning; inspect and plan again");
+  return {
+    source,
+    servers,
+    permissions,
+    plan: {
+      schemaVersion: 1,
+      converterId: "codex",
+      converterVersion: VERSION3,
+      sourceFormat: "codex",
+      sourceDigest,
+      optionsDigest: digestValue({}),
+      mappingVersion: MAPPING_VERSION,
+      items: items.sort((a, b) => a.id.localeCompare(b.id)),
+      diagnostics: []
+    }
+  };
+}
+async function checkOutput(sourceRoot, output) {
+  if (isWithin3(sourceRoot, output))
+    throw new Error("Conversion output cannot be inside the source directory");
+  if (await exists7(output))
+    throw new Error(`Conversion output already exists: ${output}`);
+  let parent = dirname24(output);
+  while (!await exists7(parent))
+    parent = dirname24(parent);
+  const canonicalOutput = resolve30(await realpath8(parent), relative14(parent, output));
+  if (isWithin3(await realpath8(sourceRoot), canonicalOutput))
+    throw new Error("Conversion output resolves inside the source directory");
+}
+function isSourceMetadata(path, source) {
+  const lower = path.toLowerCase();
+  const top = lower.split("/")[0];
+  if ([".git", ".codex-plugin", ".claude-plugin", ".openharness-plugin", ".openharness-conversion"].includes(top))
+    return true;
+  return source.metadataPaths.some((item) => item.toLowerCase() === lower);
+}
+
+class CodexPluginConverter {
+  id = "codex";
+  version = VERSION3;
+  sourceFormat = "codex";
+  detect = detectCodexPlugin;
+  async inspect(root) {
+    return (await readCodexSource(root)).inspection;
+  }
+  async plan(inspection, options = {}) {
+    if (Object.keys(options).length)
+      throw new Error("Codex conversion options are not supported in this version");
+    return (await prepare(inspection)).plan;
+  }
+  async convert(input) {
+    const output = resolve30(input.output);
+    await checkOutput(input.inspection.root, output);
+    await readCodexSource(input.inspection.root);
+    if (await digestSource(input.inspection.root) !== input.plan.sourceDigest)
+      throw new Error("Source changed after conversion planning; inspect and plan again");
+    const prepared = await prepare(input.inspection);
+    if (digestValue(prepared.plan) !== digestValue(input.plan))
+      throw new Error("Conversion plan does not match the current source and converter; plan again");
+    const missing = [...new Set(prepared.plan.items.flatMap((item) => item.requiredApprovals ?? []))].filter((item) => !input.approvals?.includes(item));
+    if (missing.length)
+      throw new Error(`Explicit conversion approval required: ${missing.join(", ")}`);
+    const components = {};
+    const skillFiles = prepared.plan.items.filter((item) => item.sourceKind === "skills" && item.fidelity === "exact");
+    if (skillFiles.length)
+      components.skills = skillFiles.map((item) => `./${item.sourcePath}`);
+    if (Object.keys(prepared.servers).length)
+      components.mcpServers = ["./mcp/servers.json"];
+    if (!Object.keys(components).length)
+      throw new Error("Codex source contains no convertible components; see unsupported plan items");
+    const manifest = {
+      schemaVersion: 1,
+      ...input.inspection.identity,
+      ...prepared.source.description === undefined ? {} : { description: prepared.source.description },
+      ...prepared.source.displayName === undefined ? {} : { displayName: prepared.source.displayName },
+      components,
+      ...Object.keys(prepared.permissions).length ? { permissions: prepared.permissions } : {},
+      metadata: { origin: "converted", sourceFormat: this.sourceFormat, converterId: this.id, converterVersion: this.version }
+    };
+    const report = { schemaVersion: 1, status: input.plan.items.some((item) => item.fidelity === "unsupported") ? "partial" : "success", items: input.plan.items, diagnostics: input.plan.diagnostics };
+    const temporary = `${output}.tmp-${randomUUID28()}`;
+    const copied = [];
+    try {
+      await mkdir15(temporary, { recursive: true });
+      for (const path of prepared.source.files) {
+        if (isSourceMetadata(path, prepared.source))
+          continue;
+        if (components.mcpServers && path.toLowerCase() === "mcp/servers.json")
+          throw new Error("Source resource conflicts with generated Native MCP path");
+        const sourcePath = join48(input.inspection.root, path);
+        if (!(await lstat9(sourcePath)).isFile())
+          throw new Error(`Source file changed during conversion: ${path}`);
+        const target = join48(temporary, path);
+        await mkdir15(dirname24(target), { recursive: true });
+        await copyFile2(sourcePath, target);
+        copied.push(path);
+      }
+      const writeJson = async (path, value) => {
+        const target = join48(temporary, path);
+        await mkdir15(dirname24(target), { recursive: true });
+        await writeFile12(target, JSON.stringify(value, null, 2));
+      };
+      if (components.mcpServers)
+        await writeJson("mcp/servers.json", { servers: prepared.servers });
+      await writeJson(".openharness-plugin/plugin.json", manifest);
+      await writeJson(".openharness-conversion/plan.json", input.plan);
+      await writeJson(".openharness-conversion/report.json", report);
+      await writeJson(".openharness-conversion/provenance.json", { sourceFormat: this.sourceFormat, sourceDigest: input.plan.sourceDigest, converterId: this.id, converterVersion: this.version, mappingVersion: MAPPING_VERSION });
+      await readCodexSource(input.inspection.root);
+      if (await digestSource(input.inspection.root) !== input.plan.sourceDigest)
+        throw new Error("Source changed during conversion; inspect and plan again");
+      for (const path of copied) {
+        if (!(await readFile23(join48(temporary, path))).equals(await readFile23(join48(input.inspection.root, path))))
+          throw new Error(`Source changed while copying: ${path}`);
+      }
+      const validation = await validateNativePlugin(temporary);
+      if (validation.status !== "valid")
+        throw new Error(validation.diagnostics.map((item) => item.message).join("; "));
+      if (digestValue(requestedPluginPermissions(validation.plugin.manifest)) !== digestValue(requestedPluginPermissions(manifest)))
+        throw new Error("Converted permissions changed during validation");
+      await checkOutput(input.inspection.root, output);
+      await rename5(temporary, output);
+      return report;
+    } catch (error) {
+      await rm8(temporary, { recursive: true, force: true });
+      throw error;
+    }
+  }
+}
 // ../../packages/plugin-converters/src/index.ts
 function createBuiltinConverterRegistry() {
   const registry = new ConverterRegistry;
   registry.register(new ClaudeCodePluginConverter);
+  registry.register(new CodexPluginConverter);
   return registry;
 }
 
@@ -371022,6 +371448,15 @@ async function client() {
   return new OpenHarnessClient({ baseUrl: daemon.url, token: daemon.token });
 }
 var collect2 = (value, previous) => [...previous, value];
+function formatConversionPlan(plan) {
+  return plan.items.map((item) => [
+    `${item.fidelity.padEnd(11)} ${item.id}`,
+    ...item.reason ? [`  ${item.reason}`] : [],
+    ...(item.requiredApprovals ?? []).map((approval) => `  --approve ${JSON.stringify(approval)}`)
+  ].join(`
+`)).join(`
+`);
+}
 var activationLabels = {
   inactive: "inactive",
   active: "active",
@@ -371091,11 +371526,11 @@ function formatPluginList(result, verbose = false) {
 function createPluginCommand() {
   const cmd = new Command3("plugin").description("Manage Native Plugins");
   cmd.command("list").option("--cwd <path>").option("--verbose", "show permissions, contributions, runtime, and diagnostics").option("--json", "print the complete machine-readable response").action(async (options) => {
-    const result = await (await client()).listPlugins({ cwd: resolve29(options.cwd ?? process.cwd()) });
+    const result = await (await client()).listPlugins({ cwd: resolve31(options.cwd ?? process.cwd()) });
     console.log(options.json ? JSON.stringify(result, null, 2) : formatPluginList(result, options.verbose));
   });
   cmd.command("validate").argument("<path>").action(async (path) => {
-    const result = await validateNativePlugin(resolve29(path));
+    const result = await validateNativePlugin(resolve31(path));
     if (result.status === "valid")
       console.log(`Valid Native Plugin: ${result.plugin.manifest.id}@${result.plugin.manifest.version}`);
     else {
@@ -371106,7 +371541,7 @@ function createPluginCommand() {
   });
   for (const [name, link] of [["install-local", false], ["link", true]]) {
     cmd.command(name).argument("<path>").option("--cwd <path>").option("--approve <permission>", "approve a requested permission", collect2, []).action(async (path, options) => {
-      const sourcePath = resolve29(path);
+      const sourcePath = resolve31(path);
       const validation = await validateNativePlugin(sourcePath);
       if (!validation.plugin)
         throw new Error(validation.diagnostics.map((item) => item.message).join("; "));
@@ -371116,7 +371551,7 @@ function createPluginCommand() {
       if (missing.length)
         throw new Error(`Explicit approval required: ${missing.join(", ")}`);
       const result = await (await client()).installLocalPlugin({
-        cwd: resolve29(options.cwd ?? process.cwd()),
+        cwd: resolve31(options.cwd ?? process.cwd()),
         sourcePath,
         scope: "user",
         approvedPermissions: approved,
@@ -371128,25 +371563,25 @@ function createPluginCommand() {
   for (const action of ["enable", "disable"])
     cmd.command(action).argument("<id>").option("--cwd <path>").action(async (id, options) => {
       const api = await client();
-      const input = { cwd: resolve29(options.cwd ?? process.cwd()) };
+      const input = { cwd: resolve31(options.cwd ?? process.cwd()) };
       console.log((action === "enable" ? await api.enablePlugin(id, input) : await api.disablePlugin(id, input)).message);
     });
   cmd.command("uninstall").argument("<id>").option("--cwd <path>").action(async (id, options) => {
-    console.log((await (await client()).uninstallPlugin(id, { cwd: resolve29(options.cwd ?? process.cwd()) })).message);
+    console.log((await (await client()).uninstallPlugin(id, { cwd: resolve31(options.cwd ?? process.cwd()) })).message);
   });
   cmd.command("details").argument("<id>").option("--cwd <path>").action(async (id, options) => {
-    const listed = await (await client()).listPlugins({ cwd: resolve29(options.cwd ?? process.cwd()) });
+    const listed = await (await client()).listPlugins({ cwd: resolve31(options.cwd ?? process.cwd()) });
     const plugin = listed.plugins.find((item) => item.identity.id === id);
     if (!plugin)
       throw new Error(`Plugin not found: ${id}`);
     console.log(JSON.stringify(plugin, null, 2));
   });
-  cmd.command("install").argument("<source>").requiredOption("--from <converter>").option("--cwd <path>").option("--approve <item>", "approve conversion item or permission", collect2, []).action(async (source, options) => {
-    const temporaryRoot = await mkdtemp3(join47(tmpdir5(), "ohs-plugin-import-"));
-    const output = join47(temporaryRoot, "native");
+  cmd.command("install").argument("<source>").requiredOption("--from <converter>", "source converter: claude-code or codex").option("--cwd <path>").option("--approve <item>", "approve conversion item or permission", collect2, []).action(async (source, options) => {
+    const temporaryRoot = await mkdtemp3(join49(tmpdir5(), "ohs-plugin-import-"));
+    const output = join49(temporaryRoot, "native");
     try {
-      const { converter } = await createBuiltinConverterRegistry().detect(resolve29(source), options.from);
-      const inspection = await converter.inspect(resolve29(source));
+      const { converter } = await createBuiltinConverterRegistry().detect(resolve31(source), options.from);
+      const inspection = await converter.inspect(resolve31(source));
       const plan = await converter.plan(inspection, {});
       await converter.convert({ inspection, plan, output, approvals: options.approve });
       const validation = await validateNativePlugin(output);
@@ -371157,29 +371592,28 @@ function createPluginCommand() {
       if (missing.length)
         throw new Error(`Explicit permission approval required: ${missing.join(", ")}`);
       const result = await (await client()).installLocalPlugin({
-        cwd: resolve29(options.cwd ?? process.cwd()),
+        cwd: resolve31(options.cwd ?? process.cwd()),
         sourcePath: output,
         scope: "user",
         approvedPermissions: requested
       });
       console.log(result.message);
     } finally {
-      await rm8(temporaryRoot, { recursive: true, force: true });
+      await rm9(temporaryRoot, { recursive: true, force: true });
     }
   });
-  cmd.command("convert").argument("<source>").option("--from <converter>").option("--output <path>").option("--dry-run").option("--json").option("--approve <item>", "approve a blocked conversion item", collect2, []).action(async (source, options) => {
+  cmd.command("convert").argument("<source>").option("--from <converter>", "source converter: claude-code or codex").option("--output <path>").option("--dry-run").option("--json").option("--approve <item>", "approve a conversion change, omitted component, or permission shown in the plan", collect2, []).action(async (source, options) => {
     const registry = createBuiltinConverterRegistry();
-    const { converter, detection } = await registry.detect(resolve29(source), options.from);
-    const inspection = await converter.inspect(resolve29(source));
+    const { converter, detection } = await registry.detect(resolve31(source), options.from);
+    const inspection = await converter.inspect(resolve31(source));
     const plan = await converter.plan(inspection, {});
     if (options.dryRun) {
-      console.log(options.json ? JSON.stringify({ detection, inspection, plan }, null, 2) : plan.items.map((item) => `${item.fidelity.padEnd(11)} ${item.id}`).join(`
-`));
+      console.log(options.json ? JSON.stringify({ detection, inspection, plan }, null, 2) : formatConversionPlan(plan));
       return;
     }
     if (!options.output)
       throw new Error("--output is required unless --dry-run is used");
-    const report = await converter.convert({ inspection, plan, output: resolve29(options.output), approvals: options.approve });
+    const report = await converter.convert({ inspection, plan, output: resolve31(options.output), approvals: options.approve });
     console.log(options.json ? JSON.stringify(report, null, 2) : `Converted ${inspection.identity.id}: ${report.status}`);
   });
   return cmd;
@@ -371696,7 +372130,7 @@ function createSandboxCommand() {
 init_src3();
 init_src9();
 import { readFileSync as readFileSync15 } from "node:fs";
-import { resolve as resolve30 } from "node:path";
+import { resolve as resolve33 } from "node:path";
 import { Command as Command8 } from "commander";
 function createWorkflowCommand() {
   const cmd = new Command8("workflow").description("Inspect and manage persisted workflow runs");
@@ -371853,7 +372287,7 @@ function readJsonOption(path, inlineJson) {
   if (inlineJson)
     return JSON.parse(inlineJson);
   if (path)
-    return JSON.parse(readFileSync15(resolve30(path), "utf-8"));
+    return JSON.parse(readFileSync15(resolve33(path), "utf-8"));
   return;
 }
 function parseCsv(value) {
@@ -372450,4 +372884,4 @@ program.command("doctor").description("Check environment and dependencies").acti
 });
 program.parse();
 
-//# debugId=A30D9095E02E07FA64756E2164756E21
+//# debugId=037007773B000ECC64756E2164756E21