holycodex 0.15.0-dev.29.1 → 0.15.1-dev.35.1

package/dist/{binary-DYvVDqZ5.js → binary-BCtnZPMA.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env bun
-import { $ as EffortSchema, $t as scoped$2, At as filter, B as SPECIALIST_OUTCOME_VERSION, Bt as positive, Ct as Record, Dt as Unknown, Et as Union, Ft as maxLength, G as parseCliEnvelope, Gt as fail, H as SpecialistOutcomeV2Schema, Ht as _void, It as minItems, J as canonicalJson, Jt as orElseSucceed, K as specialistOutcomeFromCapabilityResult, Kt as gen, L as lookupPlan, Lt as minLength, Mt as greaterThanOrEqualTo, N as WorkflowRuntimeError, Nt as int, Ot as declare, Pt as maxItems, Q as DelegationModeSchema, Qt as runSync, R as lookupRoute, Rt as optional, S as isWorkflowFailure, St as Number$, Tt as Struct, U as normalizeSpecialistOutcome, Ut as acquireRelease, V as SpecialistOutcomeSchema, Vt as is, W as parseCapabilityResultV2, Wt as async, X as domainSeparatedSha256, Xt as raceFirst, Y as canonicalJsonUtf8, Yt as provide$2, Z as sha256DomainDigest, Zt as runPromise, _t as decodeUnknown, a as runExecutionPlan, an as mapError$2, at as ServiceTierSchema, bt as Literal, c as loadNativeWorkflowSource, cn as succeed$1, ct as createSha256Digest, d as CompileOptionsSchema, dn as isRight, dt as CapabilityNameSchema, en as succeed$2, et as PlanNameSchema, fn as CLI_SCHEMA_VERSION, ft as OPTIONAL_CAPABILITY_NAMES, gt as resolveOptionalCapabilitySelections, h as hydrateWorkflowPlanIR, ht as pluginIdsForOptionalCapabilities, i as makeCapacityService, in as fromEffect, it as RouteKeySchema, jt as greaterThan, kt as decodeUnknownEither, ln as Tag, lt as createTrustId, mt as migrateOptionalCapabilitySelections, n as evaluateWorkflowCompatibility, nn as tryPromise, nt as RoleSkillProfileSchema, on as provide$1, ot as lookupRoleDefinition, p as compileWorkflow, pn as STATE_SCHEMA_EPOCH, pt as capabilityHealth, q as canonicalIdentityUtf8, qt as mapError$3, rn as try_, rt as RoleTaskSchema, sn as scoped$1, st as createProjectId, tn as sync, tt as RoleSchema, un as isLeft, ut as CAPABILITY_REGISTRY, vt as Array$, wt as String$, xt as Null, yt as Boolean$, z as resolvePlanSelection, zt as pattern } from "./src-DamQOFzF.js";
+import { $ as DelegationModeSchema, $t as runSync, At as decodeUnknownEither, B as resolvePlanSelection, Bt as pattern, Ct as Number$, Dt as Union, Et as Struct, Ft as maxItems, G as parseCapabilityResultV2, Gt as async, H as SpecialistOutcomeSchema, Ht as is, It as maxLength, J as canonicalIdentityUtf8, Jt as mapError$3, K as parseCliEnvelope, Kt as fail, Lt as minItems, Mt as greaterThan, Nt as greaterThanOrEqualTo, Ot as Unknown, P as WorkflowRuntimeError, Pt as int, Q as sha256DomainDigest, Qt as runPromise, R as lookupPlan, Rt as minLength, S as isWorkflowFailure, St as Null, Tt as String$, U as SpecialistOutcomeV2Schema, Ut as _void, V as SPECIALIST_OUTCOME_VERSION, Vt as positive, W as normalizeSpecialistOutcome, Wt as acquireRelease, X as canonicalJsonUtf8, Xt as provide$2, Y as canonicalJson, Yt as orElseSucceed, Z as domainSeparatedSha256, Zt as raceFirst, _t as resolveOptionalCapabilitySelections, a as runExecutionPlan, an as fromEffect, at as RouteKeySchema, bt as Boolean$, c as loadNativeWorkflowSource, cn as scoped$1, ct as createProjectId, d as CompileOptionsSchema, dn as isLeft, dt as CAPABILITY_REGISTRY, en as scoped$2, et as EffortSchema, fn as isRight, ft as CapabilityNameSchema, gt as pluginIdsForOptionalCapabilities, h as hydrateWorkflowPlanIR, ht as migrateOptionalCapabilitySelections, i as makeCapacityService, in as try_, it as RoleTaskSchema, jt as filter, kt as declare, ln as succeed$1, lt as createSha256Digest, mn as STATE_SCHEMA_EPOCH, mt as capabilityHealth, n as evaluateWorkflowCompatibility, nn as sync, nt as RoleSchema, on as mapError$2, ot as ServiceTierSchema, p as compileWorkflow, pn as CLI_SCHEMA_VERSION, pt as OPTIONAL_CAPABILITY_NAMES, q as specialistOutcomeFromCapabilityResult, qt as gen, rn as tryPromise, rt as RoleSkillProfileSchema, sn as provide$1, st as lookupRoleDefinition, tn as succeed$2, tt as PlanNameSchema, un as Tag, ut as createTrustId, vt as decodeUnknown, wt as Record, xt as Literal, yt as Array$, z as lookupRoute, zt as optional } from "./src-BmUZJGuC.js";
 import { createRequire } from "node:module";
 import { copyFile, cp, link, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { execFileSync, spawn, spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
-import { homedir, tmpdir } from "node:os";
+import { spawn, spawnSync } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
 import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { connect } from "node:net";
 import { execPath } from "node:process";
@@ -159,6 +159,7 @@ const VALUE_OPTIONS = /* @__PURE__ */ new Set([
 	"scope",
 	"run-id",
 	"session-id",
+	"name",
 	"official-plugin",
 	"task",
 	"autonomy",
@@ -307,6 +308,14 @@ function positionalRange(command) {
 			min: 1,
 			max: 2
 		};
+		case "workflow create": return {
+			min: 1,
+			max: 2
+		};
+		case "workflow check": return {
+			min: 1,
+			max: 1
+		};
 		case "workflow show":
 		case "workflow inspect":
 		case "workflow pause":
@@ -398,6 +407,14 @@ function commandOptions(command) {
 			"trusted",
 			"compat-quickjs"
 		]);
+		case "workflow create": return /* @__PURE__ */ new Set([
+			...common,
+			"name",
+			"session-id",
+			"trusted",
+			"task"
+		]);
+		case "workflow check": return /* @__PURE__ */ new Set([...common, "trusted"]);
 		case "workflow resume": return /* @__PURE__ */ new Set([
 			...common,
 			"trusted",
@@ -441,7 +458,6 @@ function optionalChoiceOptions() {
 const VERSION_PATTERN = /^0\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/u;
 const EPOCH_PATTERN = /^[a-z][a-z0-9._:-]{0,63}$/u;
 const PLUGIN_NAME_PATTERN = /^[a-z][a-z0-9._-]{1,63}$/u;
-const SKILL_NAME_PATTERN = /^[a-z][a-z0-9-]{0,63}$/u;
 const DIGEST_PATTERN = /^[0-9a-f]{64}$/u;
 const SOURCE_MANIFEST_PATH = ".codex-plugin/plugin.json";
 const PAYLOAD_MANIFEST_PATH = ".codex-plugin/payload.json";
@@ -600,7 +616,6 @@ function comparePathText(left, right) {
 //#endregion
 //#region packages/plugin/src/schemas.ts
 const PluginNameSchema$1 = String$.pipe(pattern(PLUGIN_NAME_PATTERN));
-const SkillNameSchema = String$.pipe(pattern(SKILL_NAME_PATTERN));
 const VersionSchema$1 = String$.pipe(pattern(VERSION_PATTERN));
 const SchemaEpochSchema = String$.pipe(pattern(EPOCH_PATTERN));
 const DigestSchema$2 = String$.pipe(pattern(DIGEST_PATTERN));
@@ -613,9 +628,21 @@ const PathSchema = String$.pipe(filter((value) => {
 	}
 }));
 const DescriptionSchema = String$.pipe(filter((value) => value.length > 0 && value.length <= 300));
-const SkillNamesSchema = Array$(SkillNameSchema);
-const AssetPathsSchema = Array$(PathSchema);
-const CapabilityAssetPathsSchema = Array$(PathSchema);
+const SkillRootSchema = Literal("skills", "./skills", "skills/");
+const AuthorSchema = Struct({
+	name: String$.pipe(minLength(1)),
+	email: optional(String$),
+	url: optional(String$)
+});
+const InterfaceSchema = Struct({
+	displayName: String$.pipe(minLength(1)),
+	shortDescription: String$.pipe(minLength(1)),
+	longDescription: String$.pipe(minLength(1)),
+	developerName: String$.pipe(minLength(1)),
+	category: String$.pipe(minLength(1)),
+	capabilities: Array$(String$.pipe(minLength(1))),
+	defaultPrompt: Array$(String$.pipe(minLength(1)))
+});
 const PonytailMetadataSchema = Struct({
 	name: Literal("ponytail"),
 	version: Literal("4.9.0"),
@@ -630,24 +657,27 @@ const PonytailMetadataSchema = Struct({
 });
 const SourceManifestSchema = Struct({
 	name: PluginNameSchema$1,
+	version: VersionSchema$1,
 	description: DescriptionSchema,
+	author: AuthorSchema,
+	homepage: optional(String$),
+	repository: optional(String$),
 	license: optional(String$),
-	skills: optional(SkillNamesSchema),
-	assets: optional(AssetPathsSchema),
-	hooks: optional(CapabilityAssetPathsSchema),
-	rules: optional(CapabilityAssetPathsSchema),
-	compaction: optional(CapabilityAssetPathsSchema)
+	keywords: optional(Array$(String$.pipe(minLength(1)))),
+	skills: SkillRootSchema,
+	interface: InterfaceSchema
 });
 const GeneratedManifestSchema = Struct({
 	name: PluginNameSchema$1,
 	version: VersionSchema$1,
 	description: DescriptionSchema,
+	author: AuthorSchema,
+	homepage: optional(String$),
+	repository: optional(String$),
 	license: optional(String$),
-	skills: optional(SkillNamesSchema),
-	assets: optional(AssetPathsSchema),
-	hooks: optional(CapabilityAssetPathsSchema),
-	rules: optional(CapabilityAssetPathsSchema),
-	compaction: optional(CapabilityAssetPathsSchema)
+	keywords: optional(Array$(String$.pipe(minLength(1)))),
+	skills: SkillRootSchema,
+	interface: InterfaceSchema
 });
 const PayloadFileSchema = Struct({
 	path: PathSchema,
@@ -705,6 +735,7 @@ async function readSourceManifest(root) {
 	const parsed = decodeSchema(SourceManifestSchema, input);
 	if (parsed === void 0) throw pluginError("manifest_invalid", "The source plugin manifest is invalid.", { summary: "Effect Schema rejected the source manifest." });
 	if (containsMcpDeclaration(input)) throw pluginError("manifest_invalid", "Plugin source manifests cannot declare external servers.");
+	if (typeof input === "object" && input !== null && !Array.isArray(input) && Object.keys(input).some((key) => !OFFICIAL_MANIFEST_KEYS.has(key))) throw pluginError("manifest_invalid", "The source plugin manifest contains unsupported fields.");
 	validateManifestDeclarations(parsed);
 	return parsed;
 }
@@ -739,41 +770,37 @@ async function readPayloadManifest(root) {
 	return parsed;
 }
 function validateManifestDeclarations(manifest) {
-	const skills = manifest.skills ?? [];
-	const assets = manifest.assets ?? [];
-	const hooks = manifest.hooks ?? [];
-	const rules = manifest.rules ?? [];
-	const compaction = manifest.compaction ?? [];
-	const declared = [
-		...assets,
-		...hooks,
-		...rules,
-		...compaction
-	];
-	if (new Set(skills).size !== skills.length || new Set(declared).size !== declared.length) throw pluginError("manifest_invalid", "Manifest asset declarations must be unique.");
-	const seen = /* @__PURE__ */ new Set();
-	for (const asset of declared) {
-		const normalized = normalizeRelativePath(asset);
-		if (normalized === ".codex-plugin/plugin.json" || normalized === ".codex-plugin/payload.json") throw pluginError("manifest_invalid", "Generated metadata paths are reserved.", { path: normalized });
-		if (seen.has(normalized)) throw pluginError("manifest_invalid", "Manifest asset declarations must be canonical.", { path: normalized });
-		seen.add(normalized);
-	}
+	if (manifest.skills !== "skills" && manifest.skills !== "./skills" && manifest.skills !== "skills/") throw pluginError("manifest_invalid", "The plugin skills path must resolve to `skills`.");
 }
-function declaredSourcePaths(manifest) {
+function declaredSourcePaths(_manifest, candidates = []) {
 	const paths = /* @__PURE__ */ new Set([SOURCE_MANIFEST_PATH]);
-	for (const asset of manifest.assets ?? []) paths.add(normalizeRelativePath(asset));
-	for (const skill of manifest.skills ?? []) {
-		paths.add(`skills/${skill}/SKILL.md`);
-		paths.add(`skills/${skill}/agents/openai.yaml`);
-	}
-	for (const path of [
-		...manifest.assets ?? [],
-		...manifest.hooks ?? [],
-		...manifest.rules ?? [],
-		...manifest.compaction ?? []
-	]) paths.add(normalizeRelativePath(path));
+	for (const candidate of candidates) {
+		const normalized = normalizeRelativePath(candidate);
+		if (isPayloadAssetPath(normalized)) paths.add(normalized);
+	}
 	return paths;
 }
+const OFFICIAL_MANIFEST_KEYS = /* @__PURE__ */ new Set([
+	"name",
+	"version",
+	"description",
+	"author",
+	"homepage",
+	"repository",
+	"license",
+	"keywords",
+	"skills",
+	"interface"
+]);
+function isPayloadAssetPath(path) {
+	return [
+		"agents/",
+		"skills/",
+		"hooks/",
+		"rules/",
+		"compaction/"
+	].some((prefix) => path.startsWith(prefix));
+}
 function isUsableDirectoryText(value) {
 	return value.length > 0 && !value.includes("\0");
 }
@@ -794,7 +821,7 @@ async function verifyPayload(input) {
 	const generatedManifest = await readGeneratedManifest(root);
 	if (generatedManifest.version !== payloadManifest.version) throw pluginError("payload_invalid", "Generated metadata versions do not match.");
 	if (payloadManifest.identity.epoch !== payloadManifest.schema_epoch) throw pluginError("payload_invalid", "Payload identity epoch does not match metadata.");
-	const declaredPaths = [...declaredSourcePaths(generatedManifest)].sort(comparePathText);
+	const declaredPaths = [...declaredSourcePaths(generatedManifest, payloadManifest.files.map((file) => file.path))].sort(comparePathText);
 	const manifestPaths = payloadManifest.files.map((file) => file.path);
 	if (declaredPaths.length !== manifestPaths.length || declaredPaths.some((path, index) => path !== manifestPaths[index])) throw pluginError("payload_invalid", "Generated metadata and the payload file manifest disagree.");
 	const expectedPaths = /* @__PURE__ */ new Set([...payloadManifest.files.map((file) => file.path), PAYLOAD_MANIFEST_PATH]);
@@ -814,7 +841,7 @@ async function verifyPayload(input) {
 		if (bytes.byteLength > 1048576 || totalSize > 8388608) throw pluginError("payload_invalid", "The payload exceeds the size limit.");
 		fileBytes.set(file.path, bytes);
 	}
-	if (generatedManifest.skills?.includes("ponytail") === true) await verifyPonytailMetadata(async (path) => {
+	if (payloadManifest.files.some((file) => file.path === "skills/ponytail/SKILL.md")) await verifyPonytailMetadata(async (path) => {
 		const bytes = fileBytes.get(path);
 		if (bytes === void 0) throw pluginError("payload_invalid", "A Ponytail metadata input is missing.", { path });
 		return bytes;
@@ -896,11 +923,13 @@ async function validateSource(input = pluginSourceRoot) {
 	const walkedFiles = [];
 	await walkSource(root, "", walkedFiles);
 	const manifest = await readSourceManifest(root);
-	const declaredPaths = declaredSourcePaths(manifest);
+	const declaredPaths = declaredSourcePaths(manifest, walkedFiles);
 	const walkedSet = new Set(walkedFiles);
+	const skillDirectories = new Set(walkedFiles.map((path) => /^skills\/([^/]+)\//u.exec(path)?.[1]).filter((name) => name !== void 0));
+	for (const skill of skillDirectories) if (!walkedSet.has(`skills/${skill}/SKILL.md`)) throw pluginError("source_invalid", "A skill directory is missing SKILL.md.", { skill });
 	for (const declaredPath of declaredPaths) if (!walkedSet.has(declaredPath)) throw pluginError("source_invalid", "A manifest-declared asset is missing.", { path: declaredPath });
 	for (const walkedPath of walkedFiles) if (!declaredPaths.has(walkedPath)) throw pluginError("source_invalid", "The plugin source contains an undeclared file.", { path: walkedPath });
-	if (manifest.skills?.includes("ponytail") === true) await verifyPonytailMetadata((path) => readSourceFile(root, path), "source_invalid");
+	if (walkedFiles.includes("skills/ponytail/SKILL.md")) await verifyPonytailMetadata((path) => readSourceFile(root, path), "source_invalid");
 	const files = [];
 	let totalSize = 0;
 	for (const path of [...walkedSet].sort()) {
@@ -958,14 +987,17 @@ function createGeneratedManifest(source, version) {
 	const manifest = {
 		name: source.name,
 		version,
-		description: source.description
-	};
-	if (source["license"] !== void 0) manifest["license"] = source["license"];
-	if (source["skills"] !== void 0) manifest["skills"] = [...source["skills"]];
-	if (source["assets"] !== void 0) manifest["assets"] = [...source["assets"]];
-	if (source["hooks"] !== void 0) manifest["hooks"] = [...source["hooks"]];
-	if (source["rules"] !== void 0) manifest["rules"] = [...source["rules"]];
-	if (source["compaction"] !== void 0) manifest["compaction"] = [...source["compaction"]];
+		description: source.description,
+		author: source.author,
+		skills: source.skills,
+		interface: source.interface
+	};
+	for (const key of [
+		"license",
+		"homepage",
+		"repository",
+		"keywords"
+	]) if (source[key] !== void 0) manifest[key] = source[key];
 	const parsed = decodeSchema(GeneratedManifestSchema, manifest);
 	if (parsed === void 0) throw pluginError("manifest_invalid", "Generated plugin metadata is invalid.", { summary: "Effect Schema rejected the generated plugin metadata." });
 	return parsed;
@@ -2220,6 +2252,9 @@ const SemanticAssignmentPacketSchema = Struct({
 	security: SecurityPolicySchema,
 	compatibility: CompatibilityPacketSchema,
 	skill_profile: Union(RoleSkillProfileSchema, Null),
+	/** Runtime metadata supplied by the host; never hardcode release or platform values here. */
+	canonical_version: optional(TextSchema),
+	platform: optional(Literal("win32", "posix")),
 	capability_input: optional(JsonObjectSchema$2),
 	retained_context: optional(RetainedContextSchema)
 });
@@ -2239,8 +2274,10 @@ function compileSpecialistAssignment(packet) {
 		`Assignment ID: ${packet.assignment.id}`,
 		`Objective: ${packet.assignment.objective}`,
 		`Role/task: ${packet.assignment.role_task.role}/${packet.assignment.role_task.task}`,
+		...packet.canonical_version === void 0 ? [] : [`Canonical version: ${packet.canonical_version}`],
 		`Authority: ${packet.assignment.authority}`
 	];
+	if (packet.platform === "win32") lines.push("Use C:/Program Files/Git/bin/bash.exe for every shell command.");
 	const retained = completeRetainedContext(packet.retained_context);
 	if (packet.skill_profile !== null && retained === void 0) {
 		lines.push(`Skill reference: ${packet.skill_profile.reference}`);
@@ -2256,7 +2293,7 @@ function compileSpecialistAssignment(packet) {
 		if (value !== void 0 && value.length > 0) lines.push(`${label}: ${value.join("; ")}`);
 	}
 	lines.push(`Outcome protocol: ${SPECIALIST_OUTCOME_VERSION}; terminal shapes: completed {protocol_version,route,evidence,status,summary}; blocked {protocol_version,route,evidence,status,reason,needs_root_decision}; partial {protocol_version,route,evidence,status,summary,completed,remaining,needs_root_decision}; failed {protocol_version,route,evidence,status,error}.`);
-	lines.push("Boundary: Do not delegate or broaden scope; return material choices to Root.");
+	lines.push("Boundary: Stay within the assigned scope and return material choices to Root.");
 	return lines.join("\n");
 }
 const ExecutionBackendSchema = Literal("app-server-v1-fallback", "app-server-v2", "host-capability");
@@ -5508,11 +5545,11 @@ function executeCodexOperation(context, definition, pending, active, input) {
 		},
 		input: {
 			name: "json",
-			decode: (value) => value
+			decode: (value) => asJsonValue(value, "operation input")
 		},
 		output: {
 			name: "json",
-			decode: (value) => value
+			decode: (value) => asJsonValue(value, "operation output")
 		},
 		metadata: { id: input.operationId },
 		route: input.route
@@ -5521,7 +5558,7 @@ function executeCodexOperation(context, definition, pending, active, input) {
 	if (codex === void 0) return fail(workflowFailure("execution", "The workflow host Codex AgentExecution capability is unavailable."));
 	return gen(function* () {
 		const route = yield* resolvePlanRoute(definition, input.route);
-		const packet = yield* makeSemanticPacket(definition, pending, assignment, route);
+		const packet = yield* makeSemanticPacket(context, definition, pending, assignment, route);
 		return (yield* validateSemanticOutcome(yield* codex.execute(packet).pipe(mapError$3((cause) => codexFailure(cause, assignment))), assignment, roleTaskForRoute(route))).outcome;
 	});
 }
@@ -5537,7 +5574,7 @@ function executeCodexAssignment(context, definition, pending, active, agent, ass
 		} catch (cause) {
 			return yield* fail(workflowFailure(cause instanceof CostAccountingError ? cause.code : "estimate_unavailable", "The workflow assignment has no conservative pricing estimate.", { cause }));
 		}
-		const packet = yield* makeSemanticPacket(definition, pending, assignment, routeDefinition);
+		const packet = yield* makeSemanticPacket(context, definition, pending, assignment, routeDefinition);
 		const normalizedInput = normalizeSemanticAssignment(packet);
 		const authorityDigest = yield* tryPromise({
 			try: () => authorityScopeDigest(packet.assignment.authority, packet.assignment.scope),
@@ -5666,7 +5703,7 @@ function resolvePlanRoute(definition, route) {
 	const selected = lookupRoute(definition.identity.plan, route);
 	return selected.ok ? succeed$2(selected.value) : fail(workflowFailure("validation", "The assignment route is unavailable."));
 }
-function makeSemanticPacket(definition, pending, assignment, route, retainedContext) {
+function makeSemanticPacket(context, definition, pending, assignment, route, retainedContext) {
 	return try_({
 		try: () => {
 			const payload = asJsonValue(assignment.payload, "workflow assignment payload");
@@ -5732,6 +5769,8 @@ function makeSemanticPacket(definition, pending, assignment, route, retainedCont
 					prefer_multi_agent_v2: false,
 					require_multi_agent_v2: false
 				},
+				...context.canonicalVersion === void 0 ? {} : { canonical_version: context.canonicalVersion },
+				platform: context.platform,
 				skill_profile: role.skill_profile,
 				...capability === void 0 ? {} : { capability_input: options },
 				...retainedContext === void 0 ? {} : { retained_context: retainedContext }
@@ -5819,7 +5858,7 @@ function roleTaskForRoute(route) {
 function readFanOut(assignment) {
 	const payload = assignment.payload;
 	if (typeof payload === "object" && payload !== null && !Array.isArray(payload)) {
-		const options = "options" in payload ? payload.options : void 0;
+		const options = "options" in payload ? payload["options"] : void 0;
 		if (typeof options === "object" && options !== null && !Array.isArray(options)) return optionInteger(jsonObject(options, "assignment options"), "fan_out", 1);
 	}
 	return 1;
@@ -6512,11 +6551,11 @@ async function handleOperation(context, definition, plan, active, operation) {
 					},
 					input: {
 						name: "json",
-						decode: (value) => value
+						decode: (value) => asJsonValue(value, "operation input")
 					},
 					output: {
 						name: "json",
-						decode: (value) => value
+						decode: (value) => asJsonValue(value, "operation output")
 					},
 					metadata: { id: operationId },
 					route
@@ -6981,6 +7020,8 @@ var WorkflowHost = class {
 			approvalPolicy: assertIdentifier(options.approvalPolicy ?? "never", "approval policy"),
 			sandboxPolicy: assertIdentifier(options.sandboxPolicy, "sandbox policy"),
 			codexCapabilityDigest: assertDigest(options.codexCapabilityDigest, "Codex capability digest"),
+			canonicalVersion: options.canonicalVersion,
+			platform: options.platform ?? "posix",
 			telemetry: options.telemetry,
 			refinementsEnabled: options.refinementsEnabled ?? false,
 			pending: /* @__PURE__ */ new Map(),
@@ -7143,7 +7184,7 @@ function resolveInstallerPaths(options = {}, environment = process.env) {
 		payloadRoot: marketplacePlugins,
 		stagingRoot: join(safeMarketplaceRoot, "plugins", ".holycodex-staging"),
 		runsRoot: join(stateRoot, "runs"),
-		generatedWorkflowsRoot: join(stateRoot, "workflows")
+		generatedWorkflowsRoot: join(safeCodexHome, "workflows")
 	};
 }
 var PathBoundaryError = class extends Error {
@@ -7370,12 +7411,23 @@ var LockError = class extends Error {
 //#endregion
 //#region packages/cli/src/marketplace.ts
 const MarketplaceSchema = JsonObjectSchema$3;
-const MarketplaceEntrySchema = JsonObjectSchema$3;
+const MarketplaceEntrySchema = declare((value) => {
+	const parsed = decodeSchema$1(JsonObjectSchema$3, value);
+	return parsed !== void 0 && typeof parsed["name"] === "string";
+});
+const MarketplaceNameSchema = Literal("holycodex");
 const MANAGED_MARKETPLACE_OWNER = "holycodex";
 const MANAGED_MARKETPLACE_CATEGORY = "Development";
 const MANAGED_INSTALL_POLICY = "AVAILABLE";
 const MANAGED_AUTH_POLICY = "ON_INSTALL";
 async function readMarketplace(path) {
+	return (await readMarketplaceInternal(path, false)).document;
+}
+/** Reads the official document and repairs only the previous HolyCodex shape in memory. */
+async function readMarketplaceForInstall(path) {
+	return await readMarketplaceInternal(path, true);
+}
+async function readMarketplaceInternal(path, allowLegacyRepair) {
 	await assertNoSymlink(path).catch((error) => {
 		if (!isFsCode(error, "ENOENT")) throw error;
 	});
@@ -7384,18 +7436,88 @@ async function readMarketplace(path) {
 		document = await readJsonObject(path);
 	} catch (error) {
 		if (!isFsCode(error, "ENOENT")) throw error;
-		return { plugins: [] };
+		return {
+			document: emptyMarketplace(),
+			repaired: false
+		};
 	}
 	const parsed = decodeSchema$1(MarketplaceSchema, document);
-	if (parsed === void 0) throw new MarketplaceError("marketplace_invalid", "The marketplace file is not a JSON object.");
-	const rawPlugins = parsed["plugins"];
-	if (rawPlugins !== void 0 && (!Array.isArray(rawPlugins) || rawPlugins.some((item) => decodeSchema$1(MarketplaceEntrySchema, item) === void 0))) throw new MarketplaceError("marketplace_invalid", "The marketplace plugins list is invalid.");
-	const plugins = Array.isArray(rawPlugins) ? rawPlugins.filter((item) => decodeSchema$1(MarketplaceEntrySchema, item) !== void 0) : [];
+	if (parsed !== void 0) {
+		const official = parseOfficialMarketplace(parsed);
+		if (official !== void 0) return {
+			document: official,
+			repaired: false
+		};
+	}
+	if (allowLegacyRepair) {
+		const repaired = repairLegacyMarketplace(document);
+		if (repaired !== void 0) return {
+			document: repaired,
+			repaired: true
+		};
+	}
+	throw new MarketplaceError("marketplace_invalid", "The marketplace file is not a valid Codex marketplace.");
+}
+function parseOfficialMarketplace(document) {
+	if (decodeSchema$1(MarketplaceNameSchema, document["name"]) === void 0) return void 0;
+	const rawPlugins = document["plugins"];
+	if (!Array.isArray(rawPlugins)) return void 0;
+	const plugins = [];
+	for (const item of rawPlugins) {
+		const plugin = decodeSchema$1(MarketplaceEntrySchema, item);
+		if (plugin === void 0) return void 0;
+		plugins.push(plugin);
+	}
+	return {
+		...document,
+		name: MANAGED_MARKETPLACE_OWNER,
+		plugins
+	};
+}
+function repairLegacyMarketplace(document) {
+	const rawPlugins = document["plugins"];
+	if (!Array.isArray(rawPlugins)) return void 0;
+	const plugins = [];
+	for (const item of rawPlugins) {
+		if (!isJsonObject$1(item)) return void 0;
+		if (isLegacyManagedEntry(item)) {
+			const source = item["source"];
+			if (typeof source !== "string" || source.length === 0) return void 0;
+			plugins.push(repairLegacyEntry(item));
+		} else plugins.push(item);
+	}
 	return {
-		...parsed,
+		...document,
+		name: MANAGED_MARKETPLACE_OWNER,
+		interface: isJsonObject$1(document["interface"]) ? document["interface"] : { displayName: "HolyCodex" },
 		plugins
 	};
 }
+function repairLegacyEntry(entry) {
+	const source = entry["source"];
+	return {
+		name: MANAGED_MARKETPLACE_OWNER,
+		source: {
+			source: "local",
+			path: typeof source === "string" ? source : ""
+		},
+		policy: {
+			installation: MANAGED_INSTALL_POLICY,
+			authentication: MANAGED_AUTH_POLICY
+		},
+		category: MANAGED_MARKETPLACE_CATEGORY
+	};
+}
+function isLegacyManagedEntry(value) {
+	return isJsonObject$1(value) && (value["name"] === "holycodex" || isJsonObject$1(value["owner"]) && value["owner"]["name"] === "holycodex");
+}
+function emptyMarketplace() {
+	return {
+		name: MANAGED_MARKETPLACE_OWNER,
+		interface: { displayName: "HolyCodex" },
+		plugins: []
+	};
+}
 async function writeMarketplace(path, document) {
 	await ensureOwnedDirectory(dirname(path));
 	await writeAtomicJson(path, document);
@@ -7403,21 +7525,15 @@ async function writeMarketplace(path, document) {
 function managedMarketplaceEntry(record) {
 	return {
 		name: "holycodex",
-		source: record.relative_path,
-		version: record.version,
-		category: MANAGED_MARKETPLACE_CATEGORY,
-		install: MANAGED_INSTALL_POLICY,
-		auth: MANAGED_AUTH_POLICY,
-		owner: {
-			name: MANAGED_MARKETPLACE_OWNER,
-			schema: record.schema_epoch
+		source: {
+			source: "local",
+			path: record.relative_path
 		},
-		cache: { identity: {
-			version: record.version,
-			digest: record.digest,
-			epoch: record.epoch,
-			artifact_id: record.artifact_id
-		} }
+		policy: {
+			installation: MANAGED_INSTALL_POLICY,
+			authentication: MANAGED_AUTH_POLICY
+		},
+		category: MANAGED_MARKETPLACE_CATEGORY
 	};
 }
 function marketplaceWithManagedEntry(document, record) {
@@ -7454,12 +7570,8 @@ function pickManagedFields(entry) {
 	for (const key of [
 		"name",
 		"source",
-		"version",
-		"category",
-		"install",
-		"auth",
-		"owner",
-		"cache"
+		"policy",
+		"category"
 	]) {
 		const value = entry[key];
 		if (value !== void 0) result[key] = value;
@@ -8262,9 +8374,13 @@ async function installHolyCodex(request = {}, options = {}, environment = proces
 		try {
 			await writeAtomicJson(paths.activeRecord, asJsonValue$1(record));
 			await appendJournal(paths, runId, "active-written", { artifact_id: artifactId }, now);
-			const nextMarketplace = marketplaceWithManagedEntry(await readMarketplace(paths.marketplaceFile), record);
+			const marketplace = await readMarketplaceForInstall(paths.marketplaceFile);
+			const nextMarketplace = marketplaceWithManagedEntry(marketplace.document, record);
 			await writeMarketplace(paths.marketplaceFile, nextMarketplace);
-			await appendJournal(paths, runId, "marketplace-written", { artifact_id: artifactId }, now);
+			await appendJournal(paths, runId, "marketplace-written", {
+				artifact_id: artifactId,
+				legacy_repaired: marketplace.repaired ? 1 : 0
+			}, now);
 			await verifyActivation(paths, record);
 			await appendJournal(paths, runId, "activation-verified", { artifact_id: artifactId }, now);
 		} catch (error) {
@@ -8758,7 +8874,7 @@ async function runManagedProcess(input, runtime = defaultManagedProcessRuntime)
 			if (validated.stdin === void 0) childStdin.end();
 			else childStdin.end(validated.stdin);
 		} catch (error) {
-			finish(null, null, errorMessage$1(error), errorCode(error));
+			finish(null, null, errorMessage(error), errorCode(error));
 		}
 	});
 }
@@ -8847,7 +8963,7 @@ function processErrorResult(error) {
 		timedOut: false,
 		aborted: false,
 		outputTruncated: false,
-		error: errorMessage$1(error),
+		error: errorMessage(error),
 		...errorCode(error) === void 0 ? {} : { errorCode: errorCode(error) }
 	};
 }
@@ -8894,7 +9010,7 @@ function emptyOutput() {
 function outputText(state) {
 	return state.truncated ? `${state.head}${TRUNCATED_MARKER}${state.tail}` : state.head;
 }
-function errorMessage$1(error) {
+function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 function errorCode(error) {
@@ -9378,7 +9494,7 @@ const GENERATED_WORKFLOW_MAX_SESSION_ID_BYTES = 96;
 const GENERATED_WORKFLOW_MAX_NAME_BYTES = 64;
 const SafeSegmentSchema = String$.pipe(pattern(/^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$/u));
 const SafeWorkflowNameSchema = String$.pipe(pattern(/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u));
-const ShortHashSchema = String$.pipe(pattern(/^[0-9a-f]{16}$/u));
+const ShortHashSchema = String$.pipe(pattern(/^[0-9a-f]{4}$/u));
 const NativeWorkflowIdentitySchema = Struct({
 	source_sha256: DigestSchema$3,
 	ir_sha256: DigestSchema$3,
@@ -9432,46 +9548,55 @@ var GeneratedWorkflowStore = class {
 		await this.ensureOwnedDirectory(sessionDirectory);
 		await this.assertCaseSafeDirectory(sessionDirectory, name);
 		const sourceSha256 = sha256(bytes);
-		const shortHash = await shortWorkflowHash(ownerSessionId, name, sourceSha256);
-		const fileName = `${name}-${shortHash}.ts`;
-		const sourcePath = join(sessionDirectory, fileName);
-		const metadataPath = `${sourcePath}.metadata.json`;
-		const existing = await this.readMetadataIfPresent(metadataPath);
 		const now = this.now();
-		if (existing !== void 0) {
-			if (existing.owner_session_id !== ownerSessionId || existing.safe_name !== name || existing.short_hash !== shortHash || existing.source_path !== sourcePath) throw new GeneratedWorkflowStoreError("collision", "The generated workflow name collides with different persisted metadata.");
-			const existingBytes = await this.readOwnedBytes(sourcePath);
-			if (sha256(existingBytes) !== sourceSha256) throw new GeneratedWorkflowStoreError("collision", "The generated workflow short hash collides with different source bytes.");
+		for (let attempt = 0; attempt < 16; attempt += 1) {
+			const shortHash = await shortWorkflowHash(ownerSessionId, name, sourceSha256, attempt);
+			const fileName = `${name}-${shortHash}.ts`;
+			const sourcePath = join(sessionDirectory, fileName);
+			const metadataPath = `${sourcePath}.metadata.json`;
+			const existing = await this.readMetadataIfPresent(metadataPath);
+			if (existing !== void 0) {
+				const existingBytes = await this.readOwnedBytes(sourcePath);
+				if (sha256(existingBytes) !== sourceSha256) continue;
+				if (existing.owner_session_id !== ownerSessionId || existing.safe_name !== name || existing.short_hash !== shortHash || existing.source_path !== sourcePath) throw new GeneratedWorkflowStoreError("collision", "The generated workflow name collides with different persisted metadata.");
+				return {
+					metadata: await this.writeMetadata({
+						...existing,
+						last_access_at: now.toISOString(),
+						expires_at: new Date(now.getTime() + this.ttlMs).toISOString(),
+						active: true
+					}),
+					source: new TextDecoder().decode(existingBytes)
+				};
+			}
+			try {
+				await this.readOwnedBytes(sourcePath);
+				continue;
+			} catch (error) {
+				if (!isMissingPath(error)) throw error;
+			}
+			await this.writeAtomicBytes(sourcePath, bytes);
+			const metadata = await this.writeMetadata({
+				schema_epoch: GENERATED_WORKFLOW_SCHEMA_EPOCH,
+				naming_version: GENERATED_WORKFLOW_NAMING_VERSION,
+				owner_session_id: ownerSessionId,
+				safe_name: name,
+				short_hash: shortHash,
+				source_sha256: sourceSha256,
+				source_path: sourcePath,
+				created_at: now.toISOString(),
+				last_access_at: now.toISOString(),
+				expires_at: new Date(now.getTime() + this.ttlMs).toISOString(),
+				active: true
+			});
+			const verified = await this.readOwnedBytes(sourcePath);
+			if (sha256(verified) !== sourceSha256) throw new GeneratedWorkflowStoreError("integrity_uncertain", "The generated workflow failed post-write digest verification.");
 			return {
-				metadata: await this.writeMetadata({
-					...existing,
-					last_access_at: now.toISOString(),
-					expires_at: new Date(now.getTime() + this.ttlMs).toISOString(),
-					active: true
-				}),
-				source: new TextDecoder().decode(existingBytes)
+				metadata,
+				source: new TextDecoder().decode(verified)
 			};
 		}
-		await this.writeAtomicBytes(sourcePath, bytes);
-		const metadata = await this.writeMetadata({
-			schema_epoch: GENERATED_WORKFLOW_SCHEMA_EPOCH,
-			naming_version: GENERATED_WORKFLOW_NAMING_VERSION,
-			owner_session_id: ownerSessionId,
-			safe_name: name,
-			short_hash: shortHash,
-			source_sha256: sourceSha256,
-			source_path: sourcePath,
-			created_at: now.toISOString(),
-			last_access_at: now.toISOString(),
-			expires_at: new Date(now.getTime() + this.ttlMs).toISOString(),
-			active: true
-		});
-		const verified = await this.readOwnedBytes(sourcePath);
-		if (sha256(verified) !== sourceSha256) throw new GeneratedWorkflowStoreError("integrity_uncertain", "The generated workflow failed post-write digest verification.");
-		return {
-			metadata,
-			source: new TextDecoder().decode(verified)
-		};
+		throw new GeneratedWorkflowStoreError("collision", "The generated workflow short hash collided with different source bytes.");
 	}
 	async read(sourcePath) {
 		const normalized = this.assertOwnedSourcePath(sourcePath);
@@ -9505,7 +9630,7 @@ var GeneratedWorkflowStore = class {
 		const directory = join(this.root, ownerSessionId);
 		await this.assertOwnedPath(directory, true);
 		const entries = await this.readOwnedDirectory(directory).catch((error) => {
-			if (isFsCode(error, "ENOENT")) return [];
+			if (isMissingPath(error)) return [];
 			throw error;
 		});
 		for (const entry of entries) {
@@ -9532,7 +9657,7 @@ var GeneratedWorkflowStore = class {
 			await this.assertTree(directory);
 			await this.requireBoundary().removeOwnedDirectory(this.root, directory);
 		} catch (error) {
-			if (isFsCode(error, "ENOENT")) return;
+			if (isMissingPath(error)) return;
 			if (error instanceof GeneratedWorkflowStoreError) throw error;
 			throw new GeneratedWorkflowStoreError("storage_failure", "The generated workflow session could not be removed.", error);
 		}
@@ -9548,7 +9673,7 @@ var GeneratedWorkflowStore = class {
 			await this.assertOwnedPath(directory, false);
 			return true;
 		} catch (error) {
-			if (isFsCode(error, "ENOENT")) return false;
+			if (isMissingPath(error)) return false;
 			throw error;
 		}
 	}
@@ -9587,7 +9712,7 @@ var GeneratedWorkflowStore = class {
 				if (!preview) await this.requireBoundary().removeOwnedDirectory(this.root, directory);
 				removed.push(directory);
 			} catch (error) {
-				if (isFsCode(error, "ENOENT")) continue;
+				if (isMissingPath(error)) continue;
 				uncertain.push(directory);
 			}
 		}
@@ -9644,7 +9769,7 @@ var GeneratedWorkflowStore = class {
 		try {
 			return await this.readMetadata(path);
 		} catch (error) {
-			if (isFsCode(error, "ENOENT")) return void 0;
+			if (isMissingPath(error)) return void 0;
 			throw error;
 		}
 	}
@@ -9654,7 +9779,7 @@ var GeneratedWorkflowStore = class {
 		try {
 			parsed = JSON.parse(new TextDecoder().decode(await this.requireBoundary().readOwnedFile(this.root, path)));
 		} catch (error) {
-			if (isFsCode(error, "ENOENT")) throw error;
+			if (isMissingPath(error)) throw error;
 			throw new GeneratedWorkflowStoreError("malformed_metadata", "Generated workflow metadata is not valid JSON.", error);
 		}
 		const metadata = decodeSchema$1(GeneratedWorkflowMetadataSchema, parsed);
@@ -9720,16 +9845,15 @@ function assertSafeWorkflowName(value) {
 	if (parsed === void 0 || value === "." || value === "..") throw new GeneratedWorkflowStoreError("invalid_name", "The generated workflow name is not filesystem-safe.");
 	return parsed;
 }
-async function shortWorkflowHash(sessionId, safeName, sourceSha256) {
+async function shortWorkflowHash(sessionId, safeName, sourceSha256, attempt = 0) {
 	assertSafeSessionId(sessionId);
 	assertSafeWorkflowName(safeName);
 	if (decodeSchema$1(DigestSchema$3, sourceSha256) === void 0) throw new GeneratedWorkflowStoreError("invalid_input", "The source digest is invalid.");
-	return (await domainSeparatedSha256("holycodex-generated-workflow-name-v1", [new TextEncoder().encode(canonicalJson({
-		version: GENERATED_WORKFLOW_NAMING_VERSION,
-		session_id: sessionId,
-		safe_name: safeName,
-		source_sha256: sourceSha256
-	}))])).slice(0, 16);
+	if (!Number.isSafeInteger(attempt) || attempt < 0 || attempt > 15) throw new GeneratedWorkflowStoreError("invalid_input", "The workflow hash attempt is invalid.");
+	return randomBytes(2).toString("hex");
+}
+function isMissingPath(error) {
+	return isFsCode(error, "ENOENT") || isFsCode(error, "not_found");
 }
 function sha256(bytes) {
 	return createHash("sha256").update(bytes).digest("hex");
@@ -9997,7 +10121,7 @@ async function cleanupHolyCodexUnlocked(scope, options, input, paths) {
 		const target = join(paths.generatedWorkflowsRoot, sessionId);
 		if (!pathWithin(paths.generatedWorkflowsRoot, target)) throw new CleanupError("cleanup_failed", "The workflow session path escaped the owned root.");
 		try {
-			const store = new GeneratedWorkflowStore(paths.stateRoot, {
+			const store = new GeneratedWorkflowStore(paths.codexHome, {
 				now: () => now,
 				...options.generatedWorkflowBoundary === void 0 ? {} : { boundary: options.generatedWorkflowBoundary }
 			});
@@ -10063,10 +10187,7 @@ async function cleanupHolyCodexUnlocked(scope, options, input, paths) {
 			reasons
 		};
 	}
-	const marketplace = await readMarketplace(paths.marketplaceFile).catch((error) => {
-		if (isFsCode(error, "ENOENT")) return { plugins: [] };
-		throw error;
-	});
+	const marketplace = await readMarketplace(paths.marketplaceFile);
 	const managed = active ? findManagedEntry(marketplace) : void 0;
 	if (active && managed && managedEntryMatches(managed, active)) {
 		const next = {
@@ -10096,7 +10217,7 @@ async function cleanupHolyCodexUnlocked(scope, options, input, paths) {
 }
 async function removeExpiredGeneratedWorkflows(paths, preview, removed, preserved, now, cutoff, boundary) {
 	try {
-		const result = await new GeneratedWorkflowStore(paths.stateRoot, {
+		const result = await new GeneratedWorkflowStore(paths.codexHome, {
 			now: () => now,
 			ttlMs: Math.max(1, now.getTime() - cutoff),
 			...boundary === void 0 ? {} : { boundary }
@@ -13517,9 +13638,8 @@ var GitBashError = class extends Error {
 //#endregion
 //#region packages/git-bash/src/git-bash-resolver.ts
 const GIT_BASH_ENV_KEY = "HOLYCODEX_GIT_BASH_PATH";
-const PROGRAM_FILES_GIT_BASH = "C:\\Program Files\\Git\\bin\\bash.exe";
-const PROGRAM_FILES_X86_GIT_BASH = "C:\\Program Files (x86)\\Git\\bin\\bash.exe";
-const DEFAULT_INSTALL_HINT = `Git Bash required. Install: winget install --id Git.Git -e --source winget\nCustom path: set ${GIT_BASH_ENV_KEY}=C:\\path\\to\\bash.exe`;
+const GIT_BASH_EXECUTABLE_PATH = "C:\\Program Files\\Git\\bin\\bash.exe";
+const DEFAULT_INSTALL_HINT = `Git Bash is required at ${GIT_BASH_EXECUTABLE_PATH}. Install: winget install --id Git.Git -e --source winget`;
 const EnvironmentShapeSchema$1 = Record({
 	key: String$,
 	value: Unknown
@@ -13537,54 +13657,22 @@ function resolveGitBash(input) {
 	if (configured !== void 0 && configured.length > 0) {
 		checkedPaths.push(configured);
 		const normalized = normalizeGitBashExecutablePath(configured, input.platform);
-		if (normalized !== null && available(input, configured, normalized)) return found(normalized, "env", checkedPaths);
+		if (normalized !== null && isRequiredGitBashExecutablePath(normalized, input.platform) && available(input, configured, normalized)) return found(normalized, "env", checkedPaths);
 		return missing(checkedPaths, `${GIT_BASH_ENV_KEY} is configured but invalid or unavailable; refusing fallback.\n${DEFAULT_INSTALL_HINT}`);
 	}
-	const fixedCandidates = [{
-		path: PROGRAM_FILES_GIT_BASH,
-		source: "program-files"
-	}, {
-		path: PROGRAM_FILES_X86_GIT_BASH,
-		source: "program-files-x86"
-	}];
-	for (const candidate of fixedCandidates) {
-		checkedPaths.push(candidate.path);
-		const normalized = normalizeGitBashExecutablePath(candidate.path, input.platform);
-		if (normalized !== null && available(input, candidate.path, normalized)) return found(normalized, candidate.source, checkedPaths);
-	}
-	let pathCandidates;
-	try {
-		pathCandidates = validateWhereOutput(input.where("bash"));
-	} catch (error) {
-		return missing(checkedPaths, `${DEFAULT_INSTALL_HINT}\nPATH lookup failed: ${errorMessage(error)}`);
-	}
-	const seen = /* @__PURE__ */ new Set();
-	for (const raw of pathCandidates) {
-		const candidate = raw.trim();
-		if (candidate.length === 0) continue;
-		checkedPaths.push(candidate);
-		const normalized = normalizeGitBashExecutablePath(candidate, input.platform);
-		if (normalized === null) continue;
-		const key = normalized.toLowerCase();
-		if (seen.has(key)) continue;
-		seen.add(key);
-		if (available(input, candidate, normalized)) return found(normalized, "path", checkedPaths);
-	}
+	checkedPaths.push(GIT_BASH_EXECUTABLE_PATH);
+	const normalized = normalizeGitBashExecutablePath(GIT_BASH_EXECUTABLE_PATH, input.platform);
+	if (normalized !== null && available(input, "C:\\Program Files\\Git\\bin\\bash.exe", normalized)) return found(normalized, "program-files", checkedPaths);
 	return missing(checkedPaths);
 }
 /** Resolves Git Bash using the current process and injectable platform seams. */
 function resolveGitBashForCurrentProcess(input = {}) {
-	const platform = input.platform ?? process.platform;
-	const environment = input.env ?? process.env;
 	return resolveGitBash({
-		platform,
-		env: environment,
+		platform: input.platform ?? process.platform,
+		env: input.env ?? process.env,
 		exists: input.exists ?? defaultExists,
 		inspect: input.inspect ?? (input.exists === void 0 ? defaultInspect : (path) => safeExists(input.exists, path) ? "file" : "missing"),
-		where: input.where ?? ((command) => {
-			if (platform !== "win32") return [];
-			return whereGitBash(command, environment);
-		})
+		where: input.where ?? (() => [])
 	});
 }
 /** Normalizes and validates an explicit Git Bash executable path without resolving links. */
@@ -13600,6 +13688,11 @@ function normalizeGitBashExecutablePath(value, platform) {
 	if (platform === "win32" && isRejectedWindowsAlias(normalized)) return null;
 	return normalized;
 }
+function isRequiredGitBashExecutablePath(path, platform) {
+	const normalized = normalizeGitBashExecutablePath(path, platform);
+	if (normalized === null) return false;
+	return platform !== "win32" || normalized.toLowerCase() === "C:\\Program Files\\Git\\bin\\bash.exe".toLowerCase();
+}
 /** Checks a candidate without following symbolic links or reparse aliases. */
 function isSafeGitBashExecutablePath(path) {
 	try {
@@ -13623,11 +13716,6 @@ function validateResolverInput(input) {
 	}
 	return Object.freeze(environment);
 }
-function validateWhereOutput(value) {
-	const decoded = decodeUnknownEither(Array$(String$), { onExcessProperty: "error" })(value);
-	if (isLeft(decoded)) throw new GitBashError("unavailable", "The Windows PATH lookup returned invalid candidates.", {}, { cause: decoded.left });
-	return decoded.right;
-}
 function available(input, raw, normalized) {
 	if ((input.inspect === void 0 ? "file" : safeInspect(input.inspect, normalized)) !== "file") return false;
 	return safeExists(input.exists, normalized) || raw !== normalized && safeExists(input.exists, raw);
@@ -13652,32 +13740,6 @@ function defaultExists(path) {
 function defaultInspect(path) {
 	return isSafeGitBashExecutablePath(path) ? "file" : "missing";
 }
-function whereGitBash(command, environment) {
-	try {
-		const output = execFileSync("where.exe", [command], {
-			encoding: "utf8",
-			windowsHide: true,
-			env: whereEnvironment(environment)
-		});
-		return String(output).split(/\r?\n/u).map((entry) => entry.trim()).filter((entry) => entry.length > 0);
-	} catch {
-		return [];
-	}
-}
-function whereEnvironment(input) {
-	const entries = Object.entries(input);
-	const exactPath = entries.find(([key, value]) => key === "PATH" && value !== void 0);
-	const fallbackPath = [...entries].reverse().find(([key, value]) => key.toLowerCase() === "path" && value !== void 0);
-	const pathEntry = exactPath ?? fallbackPath;
-	const environment = {};
-	for (const [key, value] of entries) {
-		const normalizedKey = key.toLowerCase();
-		if (normalizedKey === "path" || normalizedKey === "original_path" || value === void 0) continue;
-		environment[key] = value;
-	}
-	if (pathEntry !== void 0) environment["PATH"] = pathEntry[1];
-	return environment;
-}
 function isRejectedWindowsAlias(path) {
 	const normalized = path.toLowerCase().replaceAll("/", "\\");
 	return normalized.includes("\\windows\\system32\\") || normalized.split("\\").includes("windowsapps");
@@ -13697,9 +13759,6 @@ function missing(checkedPaths, installHint = DEFAULT_INSTALL_HINT) {
 		installHint
 	});
 }
-function errorMessage(error) {
-	return error instanceof Error ? error.message : String(error);
-}
 //#endregion
 //#region packages/git-bash/src/runner.ts
 const DEFAULT_MAX_OUTPUT_CHARS = 262144;
@@ -13721,6 +13780,7 @@ async function runGitBashCommand(input) {
 	const validated = validateRunInput(input);
 	const normalizedBashPath = normalizeGitBashExecutablePath(validated.bashPath, platform);
 	if (normalizedBashPath === null) throw new GitBashError("invalid_input", "Git Bash executable path must be absolute, traversal-free, and name bash.");
+	if (!isRequiredGitBashExecutablePath(normalizedBashPath, platform)) throw new GitBashError("invalid_input", "Windows Git Bash must be C:/Program Files/Git/bin/bash.exe.");
 	const safeExecutable = validated.isSafeExecutable ?? isSafeGitBashExecutablePath;
 	let executableIsSafe = false;
 	try {
@@ -13815,12 +13875,37 @@ function isAbortSignal(value) {
 //#region packages/cli/src/workflow.ts
 const MAX_WORKFLOW_SOURCE_BYTES = 1048576;
 async function executeWorkflowCommand(parsed, context) {
-	const service = context.workflowService ?? await createDefaultWorkflowService(context, parsed);
+	const service = parsed.command === "workflow create" || parsed.command === "workflow check" ? context.workflowService ?? {} : context.workflowService ?? await createDefaultWorkflowService(context, parsed);
 	switch (parsed.command) {
+		case "workflow create": {
+			const source = await readWorkflowSource(parsed.positionals[0] ?? "", parsed.positionals[1], parsed, context);
+			(await loadNativeWorkflowSource({ source: source.source })).dispose();
+			const sessionId = optionString$1(parsed, "session-id") ?? context.workflowSessionId;
+			const name = optionString$1(parsed, "name") ?? context.workflowName;
+			const materialized = await materializeGeneratedWorkflow(source, {
+				...context,
+				...sessionId === void 0 ? {} : { workflowSessionId: sessionId },
+				...name === void 0 ? {} : { workflowName: name }
+			});
+			await materialized.store.setSessionActivity(materialized.sessionId, false);
+			return asJsonValue$1((await materialized.store.read(materialized.source.path ?? "")).metadata);
+		}
+		case "workflow check": {
+			const source = await readWorkflowSource(parsed.positionals[0] ?? "", void 0, parsed, context);
+			const workflow = await loadNativeWorkflow(source);
+			try {
+				return asJsonValue$1({
+					valid: true,
+					execution_mode: "native",
+					source_path: source.path
+				});
+			} finally {
+				workflow.dispose();
+			}
+		}
 		case "workflow run": {
 			let workflow = await readWorkflowSource(parsed.positionals[0] ?? "", parsed.positionals[1], parsed, context);
-			const compatibility = parsed.options["compat-quickjs"] === true;
-			const nativeRequested = context.workflowService === void 0 && !compatibility;
+			const nativeRequested = context.workflowService === void 0;
 			const generatedStore = context.workflowService === void 0 && workflow.path === null ? await materializeGeneratedWorkflow(workflow, context) : void 0;
 			if (generatedStore !== void 0) workflow = generatedStore.source;
 			let nativeWorkflow;
@@ -13848,8 +13933,7 @@ async function executeWorkflowCommand(parsed, context) {
 					source: workflow.source,
 					args: workflow.args,
 					...generatedStore === void 0 || workflow.path === null ? {} : { sourcePath: workflow.path },
-					...nativeWorkflow === void 0 ? {} : { workflow: nativeWorkflow },
-					...compatibility ? { compatibility: true } : {}
+					...nativeWorkflow === void 0 ? {} : { workflow: nativeWorkflow }
 				}));
 			} finally {
 				nativeWorkflow?.dispose();
@@ -13863,8 +13947,7 @@ async function executeWorkflowCommand(parsed, context) {
 			const runId = requiredPosition(parsed, 0, "run id");
 			let workflow = await readWorkflowSource(requiredPosition(parsed, 1, "workflow source"), parsed.positionals[2], parsed, context);
 			await assertResumeInputIdentity(service, runId, workflow);
-			const compatibility = parsed.options["compat-quickjs"] === true;
-			const nativeRequested = context.workflowService === void 0 && !compatibility;
+			const nativeRequested = context.workflowService === void 0;
 			const generatedStore = context.workflowService === void 0 && workflow.path === null ? await materializeGeneratedWorkflow(workflow, context) : void 0;
 			if (generatedStore !== void 0) workflow = generatedStore.source;
 			let nativeWorkflow;
@@ -13876,8 +13959,7 @@ async function executeWorkflowCommand(parsed, context) {
 					source: workflow.source,
 					args: workflow.args,
 					...generatedStore === void 0 || workflow.path === null ? {} : { sourcePath: workflow.path },
-					...nativeWorkflow === void 0 ? {} : { workflow: nativeWorkflow },
-					...compatibility ? { compatibility: true } : {}
+					...nativeWorkflow === void 0 ? {} : { workflow: nativeWorkflow }
 				}));
 			} finally {
 				nativeWorkflow?.dispose();
@@ -13890,8 +13972,7 @@ async function executeWorkflowCommand(parsed, context) {
 			return asJsonValue$1(await requireCapability(service.continuation, "continuation")({
 				runId,
 				source: workflow.source,
-				args: workflow.args,
-				...parsed.options["compat-quickjs"] === true ? { compatibility: true } : {}
+				args: workflow.args
 			}));
 		}
 		case "workflow goal": return asJsonValue$1(await requireCapability(service.goal, "goal")(requiredPosition(parsed, 0, "run id"), requiredPosition(parsed, 1, "goal summary")));
@@ -13936,7 +14017,7 @@ async function readWorkflowSource(reference, argumentText, parsed, context) {
 	}
 	if (reference.length === 0 || extname(reference) !== ".ts") throw new WorkflowCommandError("invalid_argument", "Workflow source must be a TypeScript file or stdin.");
 	const path = resolve(context.cwd ?? process.cwd(), reference);
-	const generatedStore = new GeneratedWorkflowStore(resolveWorkflowInstallerPaths(context.installer, context.env).stateRoot, {
+	const generatedStore = new GeneratedWorkflowStore(resolveWorkflowInstallerPaths(context.installer, context.env).codexHome, {
 		...context.now === void 0 ? {} : { now: context.now },
 		...context.generatedWorkflowBoundary === void 0 ? {} : { boundary: context.generatedWorkflowBoundary }
 	});
@@ -13966,7 +14047,7 @@ async function readWorkflowSource(reference, argumentText, parsed, context) {
 }
 /** Load a file-backed native workflow through the bounded runtime source boundary. */
 async function loadNativeWorkflow(source) {
-	if (source.path === null) throw new WorkflowCommandError("invalid_argument", "Native workflows require a trusted TypeScript file; use --compat-quickjs with stdin.");
+	if (source.path === null) throw new WorkflowCommandError("invalid_argument", "Workflows require a trusted TypeScript file; use workflow create for generated sources.");
 	try {
 		return await loadNativeWorkflowSource({ source: source.source });
 	} catch (error) {
@@ -13987,7 +14068,7 @@ function defaultObjective(path, reference) {
 async function materializeGeneratedWorkflow(source, context) {
 	const sessionId = context.workflowSessionId;
 	if (sessionId === void 0) throw new WorkflowCommandError("invalid_argument", "Generated workflow storage requires an explicit caller session identity.");
-	const store = new GeneratedWorkflowStore(resolveWorkflowInstallerPaths(context.installer, context.env).stateRoot, {
+	const store = new GeneratedWorkflowStore(resolveWorkflowInstallerPaths(context.installer, context.env).codexHome, {
 		...context.now === void 0 ? {} : { now: context.now },
 		...context.generatedWorkflowBoundary === void 0 ? {} : { boundary: context.generatedWorkflowBoundary }
 	});
@@ -14080,7 +14161,9 @@ async function createDefaultWorkflowService(context, parsed) {
 			maxCalls: planDefinition.value.budget.maxCalls,
 			costMax: planDefinition.value.budget.costMax
 		},
-		refinementsEnabled: true
+		refinementsEnabled: true,
+		canonicalVersion: await readCanonicalVersion(),
+		platform: process.platform === "win32" ? "win32" : "posix"
 	});
 	return {
 		create: async (input) => await host.create({
@@ -14111,22 +14194,28 @@ async function createDefaultWorkflowService(context, parsed) {
 		stop: async (runId) => await host.stop(runId),
 		stopAgent: async (runId, callId) => await host.stopAgent(runId, callId),
 		save: async (scope, name, source) => await saveWorkflow(stateRoot, scope, name, source, cwd, context.now ?? (() => /* @__PURE__ */ new Date())),
-		invoke: async (scope, name, args, useCompatibility = false) => {
+		invoke: async (scope, name, args, _compatibilityAlias = false) => {
 			const saved = await readSavedWorkflow(stateRoot, scope, name, cwd);
-			if (!useCompatibility) throw new WorkflowCommandError("invalid_argument", "Saved native workflows require a file-backed module; invoke with --compat-quickjs for stored source.");
-			const created = await host.create({
-				source: saved.source,
-				args,
-				objective: `workflow:${saved.name}`,
-				plan,
-				serviceTier,
-				expectedConcurrency: maxSubagents
-			});
-			return asJsonValue$1(await host.run({
-				runId: created.run_id,
-				source: saved.source,
-				args
-			}));
+			const workflow = await loadNativeWorkflowSource({ source: saved.source });
+			try {
+				const created = await host.create({
+					source: saved.source,
+					args,
+					objective: `workflow:${saved.name}`,
+					plan,
+					serviceTier,
+					expectedConcurrency: maxSubagents,
+					workflow
+				});
+				return asJsonValue$1(await host.run({
+					runId: created.run_id,
+					source: saved.source,
+					args,
+					workflow
+				}));
+			} finally {
+				workflow.dispose();
+			}
 		},
 		refinements: {
 			list: async () => await listRefinements(stateRoot),
@@ -14145,10 +14234,7 @@ async function createDefaultWorkflowService(context, parsed) {
 	};
 }
 function resolveWorkflowInstallerPaths(installer, environment) {
-	return resolveInstallerPaths({ paths: {
-		codexHome: installer?.paths?.codexHome ?? environment?.["CODEX_HOME"] ?? resolve(process.cwd(), ".codex"),
-		marketplaceRoot: installer?.paths?.marketplaceRoot ?? environment?.["HOLYCODEX_MARKETPLACE_ROOT"] ?? resolve(process.cwd(), ".marketplace")
-	} }, environment);
+	return resolveInstallerPaths(installer, environment);
 }
 async function invokeWorkflowCapability(capability, options, context) {
 	if (decodeSchema$1(CapabilityNameSchema, capability) === void 0) throw new WorkflowCommandError("invalid_argument", "The capability name is invalid.");
@@ -14809,10 +14895,9 @@ Options:
   --json           Emit one validated JSON envelope.
   --no-tui         Disable prompts and interactive UI behavior.
 
-Workflow execution is native Effect workflow-module execution by default. A
-trusted TypeScript file must export a default workflow.wait(...) value. The
-explicit --compat-quickjs flag selects the compatibility-only string evaluator;
-stdin requires that flag and an explicit --task objective.
+Workflow execution uses one capability-denied QuickJS TypeScript evaluator. A
+trusted TypeScript file must export a default workflow.wait(...) value. Use
+workflow create for generated sources; stdin requires an explicit --task objective.
 
 Optional Work, Web, Security, Computer Use, LSP, LSP setup, and Git Bash
 providers are independently capability-gated. Missing providers fail closed;
@@ -14822,6 +14907,8 @@ const WORKFLOW_HELP = `Workflow commands
 
 Usage:
   holycodex workflow run <file.ts|-> [args.json] [options]
+  holycodex workflow create <file.ts|-> [args.json] [--name <name>] [--session-id <id>]
+  holycodex workflow check <file.ts> [options]
   holycodex workflow list [options]
   holycodex workflow show <run-id> [options]
   holycodex workflow inspect <run-id> [--follow] [options]
@@ -14841,12 +14928,12 @@ Options:
   --autonomy <mode>      Select manual, assisted, or autonomous execution.
   --max-subagents <n>    Bound specialist concurrency.
   --trusted              Assert the caller has established project trust.
-  --compat-quickjs       Explicitly select the string/QuickJS compatibility path.
-  --task <objective>     Required for native-unsupported stdin compatibility runs.
+  --compat-quickjs       Deprecated one-release alias; the same evaluator is used.
+  --task <objective>     Required when workflow source is read from stdin.
   --json, --no-tui       Select machine/non-interactive output behavior.
 
-Native workflow files must export a default workflow.wait(...) value. The
-compatibility evaluator is never selected implicitly; use --compat-quickjs.
+Workflow files must export a default workflow.wait(...) value. workflow check
+performs type, import, schema, and security validation without host effects.
 `;
 const INSTALL_HELP = `Install HolyCodex into the owned scope.
 
@@ -14883,6 +14970,8 @@ function helpText(topic) {
 		case "version": return VERSION_HELP;
 		case "workflow":
 		case "workflow run":
+		case "workflow create":
+		case "workflow check":
 		case "workflow list":
 		case "workflow show":
 		case "workflow inspect":
@@ -15263,14 +15352,68 @@ function isJsonObject(value) {
 }
 function emitProgress(context, json, message) {
 	if (json || parsedVerbose(context) === false) return;
-	context.io?.writeStderr?.(`${message}\n`);
+	context.io?.writeStderr?.(`${renderProgress(message, {
+		stderrIsTTY: context.io?.stderrIsTTY,
+		env: context.env
+	})}\n`);
 }
 function parsedVerbose(context) {
 	return context.io?.stderrIsTTY === true || context.io?.stderrIsTTY === void 0;
 }
-function renderHuman(result) {
-	if (result.envelope.ok) return `${result.envelope.command}: ok\n${JSON.stringify(result.envelope.data, null, 2)}\n`;
-	return `${result.envelope.command}: error ${result.envelope.error.code}\n${result.envelope.error.message}\n`;
+function renderHuman(result, options = {}) {
+	const color = colorEnabled(options);
+	if (result.envelope.ok) return `${paint("✔", "green", color)} ${result.envelope.command}\n${renderData(result.envelope.data, color)}`;
+	const error = result.envelope.error;
+	const hint = actionableHint(error.code, result.envelope.command);
+	return [
+		`${paint("✖", "red", color)} ${result.envelope.command}`,
+		`  ${paint(error.code, "red", color)}: ${error.message}`,
+		...renderDetails(error.details, color),
+		...hint === void 0 ? [] : [`  hint: ${hint}`],
+		""
+	].join("\n");
+}
+function renderProgress(message, options = {}) {
+	return `${paint("•", "cyan", colorEnabled({
+		...options,
+		stream: "stderr"
+	}))} ${message}`;
+}
+function renderData(data, color) {
+	if (typeof data !== "object" || data === null || Array.isArray(data)) return `  ${paint(formatValue(data), "dim", color)}\n`;
+	const entries = Object.entries(data);
+	if (entries.length === 0) return "";
+	const width = Math.max(...entries.map(([key]) => key.length));
+	return `${entries.map(([key, value]) => `  ${key.padEnd(width)}: ${formatValue(value)}`).join("\n")}\n`;
+}
+function renderDetails(details, color) {
+	return Object.entries(details).map(([key, value]) => `  ${key}: ${paint(formatValue(value), "dim", color)}`);
+}
+function formatValue(value) {
+	if (typeof value === "string") return value;
+	if (value === null || typeof value === "number" || typeof value === "boolean") return String(value);
+	return JSON.stringify(value);
+}
+function actionableHint(code, command) {
+	if (code === "invalid_argument" || code === "unknown_command") return `holycodex ${command.split(" ")[0] ?? "help"} --help`;
+	if (code === "non_tty_confirmation_required") return "rerun with --yes or use an interactive terminal";
+	if (code === "capability_denied") return "run `holycodex doctor` to inspect capability availability";
+}
+function colorEnabled(options) {
+	const env = options.env ?? {};
+	if (env["NO_COLOR"] !== void 0 || env["TERM"] === "dumb") return false;
+	if (env["FORCE_COLOR"] !== void 0 && env["FORCE_COLOR"] !== "0") return true;
+	if (env["CI"] !== void 0 && env["CI"] !== "false") return false;
+	return (options.stream === "stderr" ? options.stderrIsTTY : options.stdoutIsTTY) === true;
+}
+function paint(value, color, enabled) {
+	if (!enabled) return value;
+	return `\u001b[${{
+		red: "31",
+		green: "32",
+		cyan: "36",
+		dim: "2"
+	}[color]}m${value}\u001b[0m`;
 }
 var CliCommandError = class extends Error {
 	code;
@@ -15305,8 +15448,18 @@ async function runBinary(argv = Bun.argv.slice(2), binaryIo = processIo()) {
 	if (helpRequested(argv) && !jsonRequested(argv)) context.io?.writeStdout?.(helpText(helpTopic(argv)));
 	else if (argv[0] === "help" && !jsonRequested(argv)) context.io?.writeStdout?.(helpText(helpTopic(argv)));
 	else if (jsonRequested(argv)) context.io?.writeStdout?.(`${JSON.stringify(result.envelope)}\n`);
-	else if (result.envelope.ok) context.io?.writeStdout?.(renderHuman(result));
-	else context.io?.writeStderr?.(renderHuman(result));
+	else if (result.envelope.ok) context.io?.writeStdout?.(renderHuman(result, {
+		stdoutIsTTY: context.io?.stdoutIsTTY,
+		stderrIsTTY: context.io?.stderrIsTTY,
+		env: context.env,
+		stream: "stdout"
+	}));
+	else context.io?.writeStderr?.(renderHuman(result, {
+		stdoutIsTTY: context.io?.stderrIsTTY,
+		stderrIsTTY: context.io?.stderrIsTTY,
+		env: context.env,
+		stream: "stderr"
+	}));
 	return result.exitCode;
 }
 function processIo() {
@@ -15331,4 +15484,4 @@ async function* stdinChunks() {
 	if (tail.length > 0) yield tail;
 }
 //#endregion
-export { acquireInstallLock as $, installHolyCodex as A, WorkflowStoreError as B, GENERATED_WORKFLOW_SCHEMA_EPOCH as C, assertSafeWorkflowName as D, assertSafeSessionId as E, MIGRATION_RECORD_NAME as F, readCanonicalVersion as G, OfficialPluginManagerError as H, inspectLegacyState as I, managedEntryMatches as J, updateCanonicalVersion as K, migrateLegacyState as L, verifyActivation as M, LEGACY_SCHEMA_EPOCH as N, shortWorkflowHash as O, MIGRATED_STATE_NAME as P, LockError as Q, readMigratedInstallerSelections as R, GENERATED_WORKFLOW_NAMING_VERSION as S, GeneratedWorkflowStoreError as T, publicManifestPath as U, CodexOfficialPluginManager as V, readCanonicalBaseVersion as W, readMarketplace as X, managedMarketplaceEntry as Y, writeMarketplace as Z, doctorHolyCodex as _, helpRequested as a, ArgumentError as at, GENERATED_WORKFLOW_MAX_SESSION_ID_BYTES as b, WorkflowCommandError as c, CapabilityStateRecordSchema as ct, invokeWorkflowCapability as d, PathBoundaryError as et, loadNativeWorkflow as f, cleanupHolyCodex as g, CleanupError as h, runCli as i, resolveInstallerPaths as it, readActiveInstallRecord as j, InstallerError as k, createDefaultWorkflowService as l, InstallRecordSchema as lt, readWorkflowSource as m, executeCommand as n, assertRootText as nt, helpText as o, parseArgv as ot, optionalArgs as p, MarketplaceError as q, renderHuman as r, pathWithin as rt, helpTopic as s, CapabilityInstallStateSchema as st, runBinary as t, STATE_SCHEMA as tt, executeWorkflowCommand as u, GENERATED_WORKFLOW_DEFAULT_TTL_MS as v, GeneratedWorkflowStore as w, GENERATED_WORKFLOW_MAX_SOURCE_BYTES as x, GENERATED_WORKFLOW_MAX_NAME_BYTES as y, RefinementStoreError as z };
+export { writeMarketplace as $, InstallerError as A, RefinementStoreError as B, GENERATED_WORKFLOW_NAMING_VERSION as C, assertSafeSessionId as D, GeneratedWorkflowStoreError as E, MIGRATED_STATE_NAME as F, readCanonicalBaseVersion as G, CodexOfficialPluginManager as H, MIGRATION_RECORD_NAME as I, MarketplaceError as J, readCanonicalVersion as K, inspectLegacyState as L, readActiveInstallRecord as M, verifyActivation as N, assertSafeWorkflowName as O, LEGACY_SCHEMA_EPOCH as P, readMarketplaceForInstall as Q, migrateLegacyState as R, GENERATED_WORKFLOW_MAX_SOURCE_BYTES as S, GeneratedWorkflowStore as T, OfficialPluginManagerError as U, WorkflowStoreError as V, publicManifestPath as W, managedMarketplaceEntry as X, managedEntryMatches as Y, readMarketplace as Z, cleanupHolyCodex as _, runCli as a, pathWithin as at, GENERATED_WORKFLOW_MAX_NAME_BYTES as b, helpTopic as c, parseArgv as ct, executeWorkflowCommand as d, InstallRecordSchema as dt, LockError as et, invokeWorkflowCapability as f, CleanupError as g, readWorkflowSource as h, renderProgress as i, assertRootText as it, installHolyCodex as j, shortWorkflowHash as k, WorkflowCommandError as l, CapabilityInstallStateSchema as lt, optionalArgs as m, executeCommand as n, PathBoundaryError as nt, helpRequested as o, resolveInstallerPaths as ot, loadNativeWorkflow as p, updateCanonicalVersion as q, renderHuman as r, STATE_SCHEMA as rt, helpText as s, ArgumentError as st, runBinary as t, acquireInstallLock as tt, createDefaultWorkflowService as u, CapabilityStateRecordSchema as ut, doctorHolyCodex as v, GENERATED_WORKFLOW_SCHEMA_EPOCH as w, GENERATED_WORKFLOW_MAX_SESSION_ID_BYTES as x, GENERATED_WORKFLOW_DEFAULT_TTL_MS as y, readMigratedInstallerSelections as z };