release-skill 0.2.1 → 0.2.2

package/adapters/workbuddy/bin/release-skill.bundle.mjs

@@ -9,7 +9,7 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.2.1"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.2.2"});
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -11041,7 +11041,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve24.call(this, root, ref);
+      let _sch = resolve25.call(this, root, ref);
       if (_sch === void 0) {
         const schema2 = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -11072,13 +11072,13 @@ var require_compile = __commonJS({
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
     __name(sameSchemaEnv, "sameSchemaEnv");
-    function resolve24(root, ref) {
+    function resolve25(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
       return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
     }
-    __name(resolve24, "resolve");
+    __name(resolve25, "resolve");
     function resolveSchema(root, ref) {
       const p = this.opts.uriResolver.parse(ref);
       const refPath = (0, resolve_1._getFullPath)(this.opts.uriResolver, p);
@@ -11730,56 +11730,56 @@ var require_fast_uri = __commonJS({
       return uri;
     }
     __name(normalize4, "normalize");
-    function resolve24(baseURI, relativeURI, options) {
+    function resolve25(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse2(baseURI, schemelessOptions), parse2(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
-    __name(resolve24, "resolve");
-    function resolveComponent(base, relative21, options, skipNormalization) {
+    __name(resolve25, "resolve");
+    function resolveComponent(base, relative22, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
         base = parse2(serialize(base, options), options);
-        relative21 = parse2(serialize(relative21, options), options);
+        relative22 = parse2(serialize(relative22, options), options);
       }
       options = options || {};
-      if (!options.tolerant && relative21.scheme) {
-        target.scheme = relative21.scheme;
-        target.userinfo = relative21.userinfo;
-        target.host = relative21.host;
-        target.port = relative21.port;
-        target.path = removeDotSegments(relative21.path || "");
-        target.query = relative21.query;
+      if (!options.tolerant && relative22.scheme) {
+        target.scheme = relative22.scheme;
+        target.userinfo = relative22.userinfo;
+        target.host = relative22.host;
+        target.port = relative22.port;
+        target.path = removeDotSegments(relative22.path || "");
+        target.query = relative22.query;
       } else {
-        if (relative21.userinfo !== void 0 || relative21.host !== void 0 || relative21.port !== void 0) {
-          target.userinfo = relative21.userinfo;
-          target.host = relative21.host;
-          target.port = relative21.port;
-          target.path = removeDotSegments(relative21.path || "");
-          target.query = relative21.query;
+        if (relative22.userinfo !== void 0 || relative22.host !== void 0 || relative22.port !== void 0) {
+          target.userinfo = relative22.userinfo;
+          target.host = relative22.host;
+          target.port = relative22.port;
+          target.path = removeDotSegments(relative22.path || "");
+          target.query = relative22.query;
         } else {
-          if (!relative21.path) {
+          if (!relative22.path) {
             target.path = base.path;
-            if (relative21.query !== void 0) {
-              target.query = relative21.query;
+            if (relative22.query !== void 0) {
+              target.query = relative22.query;
             } else {
               target.query = base.query;
             }
           } else {
-            if (relative21.path[0] === "/") {
-              target.path = removeDotSegments(relative21.path);
+            if (relative22.path[0] === "/") {
+              target.path = removeDotSegments(relative22.path);
             } else {
               if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
-                target.path = "/" + relative21.path;
+                target.path = "/" + relative22.path;
               } else if (!base.path) {
-                target.path = relative21.path;
+                target.path = relative22.path;
               } else {
-                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative21.path;
+                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative22.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative21.query;
+            target.query = relative22.query;
           }
           target.userinfo = base.userinfo;
           target.host = base.host;
@@ -11787,7 +11787,7 @@ var require_fast_uri = __commonJS({
         }
         target.scheme = base.scheme;
       }
-      target.fragment = relative21.fragment;
+      target.fragment = relative22.fragment;
       return target;
     }
     __name(resolveComponent, "resolveComponent");
@@ -11998,7 +11998,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize: normalize4,
-      resolve: resolve24,
+      resolve: resolve25,
       resolveComponent,
       equal,
       serialize,
@@ -16344,7 +16344,7 @@ async function walkDiscoveryFiles(root, maxDepth = 8) {
       const absolute = join2(directory, child.name);
       if (child.isDirectory()) {
         if (!SKIP_DIRS.has(child.name)) await walk(absolute, depth + 1);
-      } else if (child.isFile() && (child.name === "package.json" || child.name === "public-release.json" || child.name === "SKILL.md" || /^README(?:\.|$)/i.test(child.name) || /^LICENSE(?:\.|$)/i.test(child.name) || /^CHANGELOG(?:\.|$)/i.test(child.name) || absolute.endsWith("/.claude-plugin/plugin.json") || absolute.endsWith("/.codex-plugin/plugin.json") || absolute.endsWith("/.kimi-plugin/plugin.json") || absolute.endsWith("/.claude-plugin/marketplace.json") || absolute.endsWith("/.codex-plugin/marketplace.json"))) {
+      } else if (child.isFile() && (child.name === "package.json" || child.name === "public-release.json" || child.name === "SKILL.md" || /^README(?:\.|$)/i.test(child.name) || /^LICENSE(?:\.|$)/i.test(child.name) || /^CHANGELOG(?:\.|$)/i.test(child.name) || absolute.endsWith("/.claude-plugin/plugin.json") || absolute.endsWith("/.codex-plugin/plugin.json") || absolute.endsWith("/.kimi-plugin/plugin.json") || absolute.endsWith("/.codebuddy-plugin/plugin.json") || absolute.endsWith("/.claude-plugin/marketplace.json") || absolute.endsWith("/.codex-plugin/marketplace.json"))) {
         found.push(absolute);
       }
     }
@@ -16601,7 +16601,7 @@ async function discoverFacts(root) {
     const value = await readJsonBounded(path3, "discovered plugin manifest");
     manifests.push({
       path: safeRelative(root, path3),
-      host: path3.includes("/.claude-plugin/") ? "claude" : path3.includes("/.kimi-plugin/") ? "kimi" : "codex",
+      host: path3.includes("/.claude-plugin/") ? "claude" : path3.includes("/.kimi-plugin/") ? "kimi" : path3.includes("/.codebuddy-plugin/") ? "codebuddy" : "codex",
       kind: path3.endsWith("/marketplace.json") ? "marketplace" : "plugin",
       name: typeof value.name === "string" ? value.name : null,
       version: typeof value.version === "string" ? value.version : null
@@ -16620,7 +16620,7 @@ async function discoverFacts(root) {
     return {
       path: relPath,
       name: skillIndex >= 0 ? segments[skillIndex + 1] ?? null : null,
-      host: relPath.includes("/adapters/claude/") ? "claude" : relPath.includes("/adapters/codex/") ? "codex" : relPath.includes("/adapters/kimi/") ? "kimi" : "shared"
+      host: relPath.includes("/adapters/claude/") ? "claude" : relPath.includes("/adapters/codex/") ? "codex" : relPath.includes("/adapters/kimi/") ? "kimi" : relPath.includes("/adapters/workbuddy/") ? "codebuddy" : "shared"
     };
   }).filter((item) => item.name).sort((a, b) => canonicalJson(a).localeCompare(canonicalJson(b)));
   const unitGit = {};
@@ -16764,7 +16764,7 @@ function buildCandidates(facts) {
   const ids = /* @__PURE__ */ new Set();
   const knownFiles = new Set(facts.fileDigests.map((file) => file.path));
   const manifestRoots = facts.manifests.map((manifest) => {
-    const match = manifest.path.match(/^(.*?)(?:\/)?(?:\.claude-plugin|\.codex-plugin|\.kimi-plugin)\/(?:plugin|marketplace)\.json$/);
+    const match = manifest.path.match(/^(.*?)(?:\/)?(?:\.claude-plugin|\.codex-plugin|\.kimi-plugin|\.codebuddy-plugin)\/(?:plugin|marketplace)\.json$/);
     return { ...manifest, root: match?.[1] || "." };
   });
   const manifestOwners = /* @__PURE__ */ new Map();
@@ -16791,6 +16791,7 @@ function buildCandidates(facts) {
     if (pluginHosts.includes("claude")) distributions.push("claude-plugin");
     if (pluginHosts.includes("codex")) distributions.push("codex-plugin");
     if (pluginHosts.includes("kimi")) distributions.push("kimi-plugin");
+    if (pluginHosts.includes("codebuddy")) distributions.push("codebuddy-plugin");
     if (pkg.private && matchingLegacyUnits.length === 0 && facts.legacyReleaseConfigs.length > 0) continue;
     if (pkg.private && distributions.length === 0) continue;
     const unitGitEntry = unitGit[pkg.directory];
@@ -18196,7 +18197,7 @@ function identifyTopology(config) {
   const uniqueDistTypes = [...new Set(allDistTypes)];
   let type = "unknown";
   const hasNpm = uniqueDistTypes.includes("npm");
-  const hasPlugin = uniqueDistTypes.includes("claude-plugin") || uniqueDistTypes.includes("codex-plugin") || uniqueDistTypes.includes("kimi-plugin");
+  const hasPlugin = uniqueDistTypes.includes("claude-plugin") || uniqueDistTypes.includes("codex-plugin") || uniqueDistTypes.includes("kimi-plugin") || uniqueDistTypes.includes("codebuddy-plugin");
   if (units.length === 0) {
     type = "no-release-units";
   } else if (units.length === 1) {
@@ -18453,6 +18454,53 @@ async function checkPluginManifests(root, config) {
         }
       }
     }
+    if (distributionTypes.has("codebuddy-plugin")) {
+      const manifestPath = resolve7(unitRoot, ".codebuddy-plugin", "plugin.json");
+      const displayPath = unitFile(unit, ".codebuddy-plugin/plugin.json");
+      const exists = await fileExists(manifestPath);
+      if (!exists) {
+        gaps.push(
+          createGap({
+            scope: GapScope.PROFILE,
+            category: GapCategory.MANIFEST,
+            severity: Severity.ERROR,
+            code: "CODEBUDDY_MANIFEST_MISSING",
+            message: `\u53D1\u5E03\u5355\u5143 "${unit.id}" \u7F3A\u5C11 .codebuddy-plugin/plugin.json \u63D2\u4EF6\u6E05\u5355`,
+            file: displayPath
+          })
+        );
+      } else {
+        try {
+          const content = await readFile5(manifestPath, "utf8");
+          const manifest = JSON.parse(content);
+          const requiredFields = ["name", "version", "description"];
+          const missingFields = requiredFields.filter((f) => !(f in manifest));
+          if (missingFields.length > 0) {
+            gaps.push(
+              createGap({
+                scope: GapScope.PROFILE,
+                category: GapCategory.MANIFEST,
+                severity: Severity.ERROR,
+                code: "CODEBUDDY_MANIFEST_INCOMPLETE",
+                message: `CodeBuddy \u63D2\u4EF6\u6E05\u5355\u7F3A\u5C11\u5FC5\u586B\u5B57\u6BB5: ${missingFields.join(", ")}`,
+                file: displayPath
+              })
+            );
+          }
+        } catch {
+          gaps.push(
+            createGap({
+              scope: GapScope.PROFILE,
+              category: GapCategory.MANIFEST,
+              severity: Severity.ERROR,
+              code: "CODEBUDDY_MANIFEST_INVALID",
+              message: ".codebuddy-plugin/plugin.json \u89E3\u6790\u5931\u8D25",
+              file: displayPath
+            })
+          );
+        }
+      }
+    }
   }
   return gaps;
 }
@@ -19717,7 +19765,7 @@ function validateGate(gate) {
   if (!gate.scope || typeof gate.scope.unit !== "string") {
     throw gateError(gate, "must declare scope.unit");
   }
-  if (gate.phase === "consumer-verify" && !["npm", "claude-plugin", "codex-plugin", "kimi-plugin"].includes(gate.scope.distribution)) {
+  if (gate.phase === "consumer-verify" && !["npm", "claude-plugin", "codex-plugin", "kimi-plugin", "codebuddy-plugin"].includes(gate.scope.distribution)) {
     throw gateError(gate, "consumer-verify must declare a supported scope.distribution");
   }
   if (!Array.isArray(gate.command) || gate.command.length === 0 || gate.command.some((value) => typeof value !== "string")) {
@@ -20376,6 +20424,7 @@ var init_contract = __esm({
       CLAUDE_MARKETPLACE_INSTALL: "claude-marketplace-install",
       CODEX_MARKETPLACE_INSTALL: "codex-marketplace-install",
       KIMI_MARKETPLACE_INSTALL: "kimi-marketplace-install",
+      CODEBUDDY_MARKETPLACE_INSTALL: "codebuddy-marketplace-install",
       // default branch management
       SET_DEFAULT_BRANCH: "set-default-branch"
     });
@@ -20707,8 +20756,356 @@ var init_kimi = __esm({
   }
 });
 
+// src/platforms/codebuddy.mjs
+import { readFile as readFile8, mkdir as mkdir8 } from "node:fs/promises";
+import { join as join7, resolve as resolve12, relative as relative10, isAbsolute as isAbsolute9 } from "node:path";
+function normalizePlanForDigest2(plan) {
+  const normalized = { ...plan, status: "PREPARED" };
+  if (Array.isArray(plan.externalActions)) {
+    normalized.externalActions = plan.externalActions.map((action) => action && typeof action === "object" && !Array.isArray(action) ? { ...action, status: "PENDING" } : action);
+  }
+  return normalized;
+}
+async function resolveCodeBuddyBoundPlanDigest(context) {
+  const plan = context?.plan;
+  if (!plan || typeof plan !== "object" || Array.isArray(plan)) {
+    throw new Error("context.plan is required to bind the codebuddy plan digest");
+  }
+  const carried = plan.digest;
+  if (typeof carried !== "string" || !HEX_DIGEST_RE2.test(carried)) {
+    throw new Error("context.plan.digest must be a 64-char lowercase hex frozen plan digest");
+  }
+  const { computePlanDigest: computePlanDigest2 } = await init_plan().then(() => plan_exports);
+  const normalized = normalizePlanForDigest2(plan);
+  if (computePlanDigest2(normalized) !== carried) {
+    throw new Error("context.plan.digest does not match the normalized frozen plan (a non-lifecycle field was tampered)");
+  }
+  return carried;
+}
+function codebuddyAuthorityDir(context, planDigest, plugin) {
+  if (!context?.root) {
+    throw new Error("context.root is required for the codebuddy attestation authority");
+  }
+  if (!HEX_DIGEST_RE2.test(planDigest)) {
+    throw new Error("codebuddy attestation authority requires a 64-hex plan digest");
+  }
+  if (!SAFE_ID_RE.test(plugin)) {
+    throw new Error(`codebuddy attestation authority requires a safe plugin id: "${plugin}"`);
+  }
+  const base = resolve12(context.root, ".release-skill", "codebuddy-attestations");
+  const dir = resolve12(base, planDigest, plugin);
+  const rel = relative10(base, dir);
+  const sep4 = process.platform === "win32" ? "\\" : "/";
+  if (rel === "" || rel === ".." || isAbsolute9(rel) || rel.startsWith(`..${sep4}`) || rel.split(sep4).some((segment) => segment === ".." || segment === "")) {
+    throw new Error("codebuddy attestation authority path escapes its base");
+  }
+  return dir;
+}
+function codebuddyCliHome(attestationDir) {
+  return resolve12(attestationDir, "codebuddy-home");
+}
+function codebuddyCliInstallRoot(cliHome, marketplace, plugin) {
+  return resolve12(cliHome, CODEBUDDY_CLI_STATE_DIR, "plugins", "marketplaces", marketplace, "plugins", plugin);
+}
+function codebuddyDesktopTailSegments(marketplace, plugin) {
+  return [CODEBUDDY_DESKTOP_HOME_DIR, "plugins", "marketplaces", marketplace, "plugins", plugin];
+}
+function matchesDesktopLayout(installPath, marketplace, plugin) {
+  const segments = installPath.split(/[\\/]+/).filter((s) => s !== "" && s !== ".");
+  const tail = codebuddyDesktopTailSegments(marketplace, plugin);
+  if (segments.length < tail.length) return false;
+  const offset = segments.length - tail.length;
+  return tail.every((segment, index) => segments[offset + index] === segment);
+}
+function buildCodeBuddyManualInstructions({ plugin, version, ref, cliHome, attestationDir }) {
+  const cliInstallRoot = codebuddyCliInstallRoot(cliHome, CODEBUDDY_MARKETPLACE_NAME, plugin);
+  const desktopInstallRoot = `~/${CODEBUDDY_DESKTOP_HOME_DIR}/plugins/marketplaces/${CODEBUDDY_MARKETPLACE_NAME}/plugins/${plugin}`;
+  return [
+    `CodeBuddy/WorkBuddy plugin install cannot pin a frozen ref (the codebuddy CLI marketplace add/install have no ref option and track the default branch), so installation is a manual step proven by a human attestation.`,
+    `1) publish fails closed at this codebuddy checkpoint and leaves the run PARTIAL (the automated Git branch/tag, npm, and GitHub Release writes still complete first).`,
+    `2) PRIMARY PATH (WorkBuddy desktop): install release-skill from the unified marketplace "${CODEBUDDY_MARKETPLACE_NAME}" (${CODEBUDDY_MARKETPLACE_SOURCE}). Confirm "~/.workbuddy/settings.json" enabledPlugins contains "${plugin}@${CODEBUDDY_MARKETPLACE_NAME}": true. The plugin lands at "${desktopInstallRoot}/".`,
+    `3) ALTERNATE PATH (bundled codebuddy CLI, isolatable): run the CLI with the ISOLATED home from this requirement so the clone lands inside it: HOME="${cliHome}" <codebuddy binary> plugin marketplace add ${CODEBUDDY_MARKETPLACE_SOURCE} ; then HOME="${cliHome}" <codebuddy binary> plugin install ${plugin}@${CODEBUDDY_MARKETPLACE_NAME}. The CLI ships with WorkBuddy.app (macOS known path /Applications/WorkBuddy.app/Contents/Resources/app.asar.unpacked/cli/bin/codebuddy). The plugin lands at "${cliInstallRoot}/".`,
+    `4) REF LIMITATION WARNING: a codebuddy install tracks the marketplace default branch and CANNOT be pinned to frozen ref "${ref}". Before writing the attestation you MUST confirm the installed plugin manifest version equals the frozen version ${version}; otherwise do NOT issue an attestation.`,
+    `5) Write the attestation JSON to: ${attestationDir}/${CODEBUDDY_ATTESTATION_FILE}. planDigest MUST be the frozen plan digest; payloadDigest MUST be the frozen snapshot payload digest; installChannel MUST be "desktop" or "cli"; marketplace MUST be "${CODEBUDDY_MARKETPLACE_NAME}"; installPath MUST be the actual installed plugin directory for the chosen channel. attestedAt must not be in the future and expiresAt must be within 24 hours of attestedAt.`,
+    `   Required fields: consumer="codebuddy", plugin, version, entrySkill, repo, ref, marketplace, installChannel, installPath, planDigest, payloadDigest, attestedBy, attestedAt, expiresAt.`,
+    `6) Re-run release-skill reconcile (promotes PARTIAL -> PUBLISHED) and then verify (-> VERIFIED). Both read the attestation from this same plan-digest-keyed authority directory, so a fresh run directory does not lose the proof.`
+  ];
+}
+async function readCodeBuddyManifest(pluginRootReal) {
+  const manifestRelative = CODEBUDDY_PLUGIN_MANIFEST_RELATIVE;
+  const manifestPath = resolve12(pluginRootReal, manifestRelative);
+  let content;
+  try {
+    content = await readFile8(manifestPath, "utf8");
+  } catch {
+    throw new Error(`no codebuddy plugin manifest found (expected ${manifestRelative})`);
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(content);
+  } catch {
+    throw new Error(`codebuddy plugin manifest ${manifestRelative} is not valid JSON`);
+  }
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+    throw new Error(`codebuddy plugin manifest ${manifestRelative} is not an object`);
+  }
+  return { manifest, manifestRelative };
+}
+function validateCodeBuddyAttestation(attestation, action, isoNow, boundPlanDigest) {
+  if (!attestation || typeof attestation !== "object" || Array.isArray(attestation)) {
+    return { valid: false, error: "codebuddy attestation is not an object" };
+  }
+  const requiredStrings = ["plugin", "version", "entrySkill", "repo", "ref", "installPath", "payloadDigest", "planDigest", "attestedBy", "attestedAt", "expiresAt", "marketplace", "installChannel"];
+  for (const field of requiredStrings) {
+    if (typeof attestation[field] !== "string" || attestation[field].length === 0) {
+      return { valid: false, error: `codebuddy attestation missing required field "${field}"` };
+    }
+  }
+  if (attestation.consumer !== "codebuddy") {
+    return { valid: false, error: `codebuddy attestation consumer "${attestation.consumer}" must be "codebuddy"` };
+  }
+  if (!CODEBUDDY_INSTALL_CHANNELS.has(attestation.installChannel)) {
+    return { valid: false, error: `codebuddy attestation installChannel "${attestation.installChannel}" must be "desktop" or "cli"` };
+  }
+  if (attestation.marketplace !== CODEBUDDY_MARKETPLACE_NAME) {
+    return { valid: false, error: `codebuddy attestation marketplace "${attestation.marketplace}" must be "${CODEBUDDY_MARKETPLACE_NAME}"` };
+  }
+  if (!HEX_DIGEST_RE2.test(attestation.planDigest)) {
+    return { valid: false, error: "codebuddy attestation planDigest must be a 64-char lowercase hex digest" };
+  }
+  if (attestation.planDigest !== boundPlanDigest) {
+    return { valid: false, error: "codebuddy attestation planDigest does not match the frozen plan digest" };
+  }
+  if (attestation.plugin !== action.plugin) {
+    return { valid: false, error: `codebuddy attestation plugin "${attestation.plugin}" does not match action plugin "${action.plugin}"` };
+  }
+  if (attestation.version !== action.version) {
+    return { valid: false, error: `codebuddy attestation version "${attestation.version}" does not match action version "${action.version}"` };
+  }
+  if (attestation.entrySkill !== action.entrySkill) {
+    return { valid: false, error: `codebuddy attestation entrySkill "${attestation.entrySkill}" does not match action entrySkill "${action.entrySkill}"` };
+  }
+  if (attestation.repo !== action.repo) {
+    return { valid: false, error: `codebuddy attestation repo "${attestation.repo}" does not match action repo "${action.repo}"` };
+  }
+  const expectedRef = action.ref ?? `v${action.version}`;
+  if (attestation.ref !== expectedRef) {
+    return { valid: false, error: `codebuddy attestation ref "${attestation.ref}" does not match frozen ref "${expectedRef}"` };
+  }
+  if (attestation.payloadDigest !== action.manifestDigest) {
+    return { valid: false, error: "codebuddy attestation payloadDigest does not match the frozen payload digest" };
+  }
+  const attestedMs = Date.parse(attestation.attestedAt);
+  const expiresMs = Date.parse(attestation.expiresAt);
+  const nowMs = Date.parse(isoNow);
+  if (!Number.isFinite(attestedMs) || !Number.isFinite(expiresMs) || !Number.isFinite(nowMs)) {
+    return { valid: false, error: "codebuddy attestation attestedAt/expiresAt must be valid ISO timestamps" };
+  }
+  if (attestedMs > nowMs) {
+    return { valid: false, error: "codebuddy attestation attestedAt is in the future" };
+  }
+  if (expiresMs <= attestedMs) {
+    return { valid: false, error: "codebuddy attestation expiresAt must be after attestedAt" };
+  }
+  if (expiresMs - attestedMs > CODEBUDDY_MAX_ATTESTATION_VALIDITY_MS) {
+    return { valid: false, error: "codebuddy attestation validity must not exceed 24 hours" };
+  }
+  if (nowMs > expiresMs) {
+    return { valid: false, error: "codebuddy attestation has expired" };
+  }
+  if (attestation.installChannel === "desktop" && !matchesDesktopLayout(attestation.installPath, attestation.marketplace, attestation.plugin)) {
+    return { valid: false, error: `codebuddy attestation installPath does not match the WorkBuddy desktop marketplace layout (.workbuddy/plugins/marketplaces/${attestation.marketplace}/plugins/${attestation.plugin})` };
+  }
+  return { valid: true, error: null };
+}
+async function executeCodeBuddyManualRequirement(action, context) {
+  const actionType = ActionType.CODEBUDDY_MARKETPLACE_INSTALL;
+  let planDigest;
+  try {
+    planDigest = await resolveCodeBuddyBoundPlanDigest(context);
+  } catch (planErr) {
+    return createResult({
+      actionType,
+      status: ActionStatus.EXECUTE_FAILED,
+      error: `cannot bind codebuddy requirement to the frozen plan: ${planErr.message}`
+    });
+  }
+  try {
+    resolveTimeoutMs(action);
+  } catch (timeoutErr) {
+    return createResult({
+      actionType,
+      status: ActionStatus.EXECUTE_FAILED,
+      error: timeoutErr.message
+    });
+  }
+  const ref = action.ref ?? `v${action.version}`;
+  let attestationDir;
+  try {
+    attestationDir = codebuddyAuthorityDir(context, planDigest, action.plugin);
+  } catch (dirErr) {
+    return createResult({
+      actionType,
+      status: ActionStatus.EXECUTE_FAILED,
+      error: dirErr.message
+    });
+  }
+  const cliHome = codebuddyCliHome(attestationDir);
+  const cliInstallRoot = codebuddyCliInstallRoot(cliHome, CODEBUDDY_MARKETPLACE_NAME, action.plugin);
+  const desktopInstallRoot = `~/${CODEBUDDY_DESKTOP_HOME_DIR}/plugins/marketplaces/${CODEBUDDY_MARKETPLACE_NAME}/plugins/${action.plugin}`;
+  const instructions = buildCodeBuddyManualInstructions({
+    plugin: action.plugin,
+    version: action.version,
+    ref,
+    cliHome,
+    attestationDir
+  });
+  const requirement = {
+    kind: "codebuddy-manual-install-requirement",
+    consumer: "codebuddy",
+    plugin: action.plugin,
+    version: action.version,
+    entrySkill: action.entrySkill,
+    repo: action.repo,
+    ref,
+    marketplace: CODEBUDDY_MARKETPLACE_NAME,
+    marketplaceSource: CODEBUDDY_MARKETPLACE_SOURCE,
+    installChannels: ["desktop", "cli"],
+    // (A) planDigest binds to the real frozen plan digest;
+    // expectedPayloadDigest binds separately to the snapshot payload digest.
+    planDigest,
+    expectedPayloadDigest: action.manifestDigest,
+    isolatedHome: cliHome,
+    codebuddyHome: cliHome,
+    cliInstallRoot,
+    desktopInstallRoot,
+    attestationDir,
+    attestationFile: CODEBUDDY_ATTESTATION_FILE,
+    attestationTemplate: {
+      consumer: "codebuddy",
+      plugin: action.plugin,
+      version: action.version,
+      entrySkill: action.entrySkill,
+      repo: action.repo,
+      ref,
+      marketplace: CODEBUDDY_MARKETPLACE_NAME,
+      installChannel: '<"desktop" or "cli">',
+      installPath: "<actual installed plugin directory for the chosen channel>",
+      planDigest,
+      payloadDigest: action.manifestDigest,
+      attestedBy: "<person responsible for the manual install>",
+      attestedAt: "<ISO 8601 now; must not be in the future>",
+      expiresAt: "<ISO 8601; within 24h of attestedAt>"
+    },
+    instructions
+  };
+  try {
+    await mkdir8(cliHome, { recursive: true, mode: 448 });
+  } catch (mkdirErr) {
+    return createResult({
+      actionType,
+      status: ActionStatus.EXECUTE_FAILED,
+      error: `cannot create codebuddy isolated home directory: ${mkdirErr.message}`
+    });
+  }
+  const requirementPath = resolve12(attestationDir, CODEBUDDY_REQUIREMENT_FILE);
+  let existing = null;
+  let requirementMissing = false;
+  try {
+    const existingRaw = await readFile8(requirementPath, "utf8");
+    try {
+      existing = JSON.parse(existingRaw);
+    } catch (parseErr) {
+      return createResult({
+        actionType,
+        status: ActionStatus.EXECUTE_FAILED,
+        error: `existing codebuddy manual-install requirement is invalid JSON; refusing to overwrite: ${parseErr.message}`
+      });
+    }
+  } catch (readErr) {
+    if (readErr?.code === "ENOENT") {
+      requirementMissing = true;
+    } else {
+      return createResult({
+        actionType,
+        status: ActionStatus.EXECUTE_FAILED,
+        error: `existing codebuddy manual-install requirement cannot be read; refusing to overwrite: ${readErr.message}`
+      });
+    }
+  }
+  if (!requirementMissing) {
+    if (!existing || typeof existing !== "object" || Array.isArray(existing)) {
+      return createResult({
+        actionType,
+        status: ActionStatus.EXECUTE_FAILED,
+        error: "existing codebuddy manual-install requirement is not an object; refusing to overwrite"
+      });
+    }
+    const { createdAt: _existingCreatedAt, ...existingBody } = existing;
+    if (canonicalJson(existingBody) !== canonicalJson(requirement)) {
+      return createResult({
+        actionType,
+        status: ActionStatus.EXECUTE_FAILED,
+        error: "existing codebuddy manual-install requirement conflicts with the current frozen action; refusing to overwrite"
+      });
+    }
+  } else {
+    await writeEvidenceAtomic(requirementPath, { ...requirement, createdAt: (/* @__PURE__ */ new Date()).toISOString() });
+  }
+  return createResult({
+    actionType,
+    status: ActionStatus.EXECUTED,
+    observation: {
+      installed: false,
+      manualInstallRequired: true,
+      consumer: "codebuddy",
+      plugin: action.plugin,
+      version: action.version,
+      entrySkill: action.entrySkill,
+      repo: action.repo,
+      ref,
+      marketplace: CODEBUDDY_MARKETPLACE_NAME,
+      installChannels: ["desktop", "cli"],
+      planDigest,
+      attestationDir,
+      codebuddyHome: cliHome,
+      cliInstallRoot,
+      desktopInstallRoot,
+      instructions
+    }
+  });
+}
+var HEX_DIGEST_RE2, CODEBUDDY_REQUIREMENT_FILE, CODEBUDDY_ATTESTATION_FILE, CODEBUDDY_MAX_ATTESTATION_VALIDITY_MS, CODEBUDDY_MARKETPLACE_NAME, CODEBUDDY_MARKETPLACE_SOURCE, CODEBUDDY_PLUGIN_MANIFEST_RELATIVE, CODEBUDDY_INSTALL_CHANNELS, CODEBUDDY_DESKTOP_HOME_DIR, CODEBUDDY_CLI_STATE_DIR;
+var init_codebuddy = __esm({
+  "src/platforms/codebuddy.mjs"() {
+    init_contract();
+    init_digest();
+    HEX_DIGEST_RE2 = /^[a-f0-9]{64}$/;
+    __name(normalizePlanForDigest2, "normalizePlanForDigest");
+    CODEBUDDY_REQUIREMENT_FILE = "release-skill-codebuddy-manual-install.json";
+    CODEBUDDY_ATTESTATION_FILE = "release-skill-codebuddy-attestation.json";
+    CODEBUDDY_MAX_ATTESTATION_VALIDITY_MS = 24 * 60 * 60 * 1e3;
+    CODEBUDDY_MARKETPLACE_NAME = "artifact-skill-set";
+    CODEBUDDY_MARKETPLACE_SOURCE = "https://github.com/ifoohoo/artifact-skill-set";
+    CODEBUDDY_PLUGIN_MANIFEST_RELATIVE = join7(".codebuddy-plugin", "plugin.json");
+    CODEBUDDY_INSTALL_CHANNELS = /* @__PURE__ */ new Set(["desktop", "cli"]);
+    CODEBUDDY_DESKTOP_HOME_DIR = ".workbuddy";
+    CODEBUDDY_CLI_STATE_DIR = ".codebuddy";
+    __name(resolveCodeBuddyBoundPlanDigest, "resolveCodeBuddyBoundPlanDigest");
+    __name(codebuddyAuthorityDir, "codebuddyAuthorityDir");
+    __name(codebuddyCliHome, "codebuddyCliHome");
+    __name(codebuddyCliInstallRoot, "codebuddyCliInstallRoot");
+    __name(codebuddyDesktopTailSegments, "codebuddyDesktopTailSegments");
+    __name(matchesDesktopLayout, "matchesDesktopLayout");
+    __name(buildCodeBuddyManualInstructions, "buildCodeBuddyManualInstructions");
+    __name(readCodeBuddyManifest, "readCodeBuddyManifest");
+    __name(validateCodeBuddyAttestation, "validateCodeBuddyAttestation");
+    __name(executeCodeBuddyManualRequirement, "executeCodeBuddyManualRequirement");
+  }
+});
+
 // src/platforms/registry.mjs
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 function claudeParseListOutput(listOutput, pluginId) {
   if (!Array.isArray(listOutput)) {
     return { ok: false, error: "Claude plugin list did not return an array" };
@@ -20805,6 +21202,9 @@ function assertRegistry(registry = PLATFORMS) {
     if (!VALID_SOURCE_FORMS.has(platform.marketplaceSourceForm)) {
       throw new Error(`platform registry: ${label} has illegal marketplaceSourceForm "${platform.marketplaceSourceForm}"`);
     }
+    if (!VALID_MARKETPLACE_REF_FORMS.has(platform.marketplaceRefForm)) {
+      throw new Error(`platform registry: ${label} has illegal marketplaceRefForm "${platform.marketplaceRefForm}"`);
+    }
     if (!Array.isArray(platform.knownHostArtifacts)) {
       throw new Error(`platform registry: ${label} knownHostArtifacts must be an array`);
     }
@@ -20855,10 +21255,11 @@ function assertRegistry(registry = PLATFORMS) {
     }
   }
 }
-var CLAUDE, CODEX, KIMI, PLATFORMS, VALID_DISTRIBUTION_TYPES, VALID_ACTION_TYPES, VALID_SOURCE_FORMS, VALID_LIST_OUTPUTS, VALID_CLI_OUTPUTS, VALID_ENTRY_VERSION_BINDING;
+var CLAUDE, CODEX, KIMI, CODEBUDDY, PLATFORMS, VALID_DISTRIBUTION_TYPES, VALID_ACTION_TYPES, VALID_SOURCE_FORMS, VALID_MARKETPLACE_REF_FORMS, VALID_LIST_OUTPUTS, VALID_CLI_OUTPUTS, VALID_ENTRY_VERSION_BINDING;
 var init_registry = __esm({
   async "src/platforms/registry.mjs"() {
     await init_kimi();
+    init_codebuddy();
     __name(claudeParseListOutput, "claudeParseListOutput");
     __name(claudeExtractInstallPath, "claudeExtractInstallPath");
     __name(claudeExtractListIdentity, "claudeExtractListIdentity");
@@ -20888,7 +21289,7 @@ var init_registry = __esm({
         marketplaceAddOutput: null,
         pluginInstallOutput: null
       }),
-      isolationEnv: /* @__PURE__ */ __name((home) => ({ HOME: home, CLAUDE_CONFIG_DIR: join7(home, ".claude") }), "isolationEnv"),
+      isolationEnv: /* @__PURE__ */ __name((home) => ({ HOME: home, CLAUDE_CONFIG_DIR: join8(home, ".claude") }), "isolationEnv"),
       // execute pre-creates the claude config dir under the isolated HOME.
       isolationSubdirs: Object.freeze([".claude"]),
       manifestPaths: Object.freeze({
@@ -20899,6 +21300,10 @@ var init_registry = __esm({
       // Claude carries the authoritative version in the marketplace entry: the
       // preflight binds entry.version to the action version.
       marketplaceEntryCarriesVersion: true,
+      // External marketplace form: `claude plugin marketplace add repo@<ref>` can
+      // only pin a branch/tag NAME (a bare commit sha fails to clone and the
+      // resolved sha is not recorded locally) — name-form weak freeze.
+      marketplaceRefForm: "name",
       knownHostArtifacts: Object.freeze([".in_use"]),
       schemaRequiredFields: Object.freeze(["plugin", "marketplace", "entrySkill"]),
       skillRendering: Object.freeze({ mode: "verbatim", preamble: null, placeholder: "${CLAUDE_PLUGIN_ROOT}" }),
@@ -20947,6 +21352,9 @@ var init_registry = __esm({
       // Codex keeps the authoritative version in .codex-plugin/plugin.json; the
       // marketplace entry version is not bound to the action version.
       marketplaceEntryCarriesVersion: false,
+      // External marketplace form: `codex plugin marketplace add repo --ref <ref>`
+      // accepts a bare commit sha — sha-form strong freeze.
+      marketplaceRefForm: "sha",
       knownHostArtifacts: Object.freeze([".git", ".codex-plugin/migrated-command-skills"]),
       schemaRequiredFields: Object.freeze(["plugin", "marketplace", "entrySkill"]),
       skillRendering: Object.freeze({ mode: "substitute", preamble: "codex", placeholder: "${CLAUDE_PLUGIN_ROOT}" }),
@@ -20993,6 +21401,9 @@ var init_registry = __esm({
       // apply (null = N/A, never consulted: kimi preflight reads its manifest via
       // strategy.readManifest).
       marketplaceEntryCarriesVersion: null,
+      // kimi has no marketplace add at all, so the marketplace ref form does not
+      // apply (null = N/A, never consulted).
+      marketplaceRefForm: null,
       knownHostArtifacts: Object.freeze([".git"]),
       schemaRequiredFields: Object.freeze(["plugin", "entrySkill"]),
       skillRendering: Object.freeze({ mode: "substitute", preamble: "kimi", placeholder: "${CLAUDE_PLUGIN_ROOT}" }),
@@ -21013,10 +21424,72 @@ var init_registry = __esm({
         readManifest: readKimiManifest
       })
     });
-    PLATFORMS = Object.freeze([CLAUDE, CODEX, KIMI]);
-    VALID_DISTRIBUTION_TYPES = /* @__PURE__ */ new Set(["claude-plugin", "codex-plugin", "kimi-plugin"]);
-    VALID_ACTION_TYPES = /* @__PURE__ */ new Set(["claude-marketplace-install", "codex-marketplace-install", "kimi-marketplace-install"]);
+    CODEBUDDY = Object.freeze({
+      id: "codebuddy",
+      distributionType: "codebuddy-plugin",
+      actionType: "codebuddy-marketplace-install",
+      adapter: "plugin-marketplace",
+      automatable: false,
+      cli: null,
+      jsonProtocol: Object.freeze({
+        listOutput: null,
+        installPathSource: null,
+        marketplaceAddOutput: null,
+        pluginInstallOutput: null
+      }),
+      // The closed loop never execs the codebuddy CLI; HOME is the only isolation
+      // input and exists solely so the attestation's isolated cli-channel home has
+      // a base. No unverified host env vars are fabricated.
+      isolationEnv: /* @__PURE__ */ __name((home) => ({ HOME: home }), "isolationEnv"),
+      // codebuddy never execs a CLI; its isolated cli home is created by the
+      // manual-requirement strategy under the attestation authority.
+      isolationSubdirs: Object.freeze([]),
+      manifestPaths: Object.freeze({
+        // Single authoritative manifest (no precedence chain, unlike kimi).
+        plugin: ".codebuddy-plugin/plugin.json",
+        marketplace: null
+      }),
+      marketplaceSourceForm: null,
+      // codebuddy installs from a unified marketplace but carries no marketplace
+      // identity in the action (the marketplace is a fixed constant in
+      // ./codebuddy.mjs); the entry-version binding does not apply (null = N/A).
+      marketplaceEntryCarriesVersion: null,
+      // codebuddy has no marketplace add that can pin a frozen ref (attestation
+      // loop instead), so the marketplace ref form does not apply (null = N/A).
+      marketplaceRefForm: null,
+      knownHostArtifacts: Object.freeze([".git"]),
+      schemaRequiredFields: Object.freeze(["plugin", "entrySkill"]),
+      // Declarative rendering intent (the build-adapters producer keys on
+      // buildAdapter.name = 'workbuddy'): pure ${CLAUDE_PLUGIN_ROOT} ->
+      // ${CODEBUDDY_PLUGIN_ROOT} substitution, no entry-resolution preamble
+      // (CodeBuddy expands the variable inline in skill content).
+      skillRendering: Object.freeze({ mode: "substitute", preamble: null, placeholder: "${CODEBUDDY_PLUGIN_ROOT}" }),
+      buildAdapter: Object.freeze({
+        // Build adapter keeps the historical `workbuddy` directory name; the fields
+        // are byte-for-byte the legacy BUILD_ONLY workbuddy entry so the generated
+        // adapters/workbuddy/ tree is unchanged.
+        name: "workbuddy",
+        pluginDirName: ".codebuddy-plugin",
+        templateFileName: "plugin.json",
+        marketplaceFileName: null,
+        hasMarketplace: false
+      }),
+      strategy: Object.freeze({
+        parseListOutput: null,
+        extractInstallPath: null,
+        extractListIdentity: null,
+        crossValidateListEntry: null,
+        // codebuddy's side-effecting manual-requirement builder and manifest reader
+        // live in ./codebuddy.mjs (per-platform-module option, mirroring kimi).
+        buildManualRequirement: executeCodeBuddyManualRequirement,
+        readManifest: readCodeBuddyManifest
+      })
+    });
+    PLATFORMS = Object.freeze([CLAUDE, CODEX, KIMI, CODEBUDDY]);
+    VALID_DISTRIBUTION_TYPES = /* @__PURE__ */ new Set(["claude-plugin", "codex-plugin", "kimi-plugin", "codebuddy-plugin"]);
+    VALID_ACTION_TYPES = /* @__PURE__ */ new Set(["claude-marketplace-install", "codex-marketplace-install", "kimi-marketplace-install", "codebuddy-marketplace-install"]);
     VALID_SOURCE_FORMS = /* @__PURE__ */ new Set(["string", "local-path-object", null]);
+    VALID_MARKETPLACE_REF_FORMS = /* @__PURE__ */ new Set(["sha", "name", null]);
     VALID_LIST_OUTPUTS = /* @__PURE__ */ new Set(["array", "installed-object", null]);
     VALID_CLI_OUTPUTS = /* @__PURE__ */ new Set(["json", null]);
     VALID_ENTRY_VERSION_BINDING = /* @__PURE__ */ new Set([true, false, null]);
@@ -21027,17 +21500,28 @@ var init_registry = __esm({
 });
 
 // src/core/plan.mjs
-import { readFile as readFile8, writeFile as writeFile6, rename as rename2, mkdir as mkdir8, open as open5, link, unlink as unlink2, lstat as lstat7 } from "node:fs/promises";
-import { basename as basename3, dirname as dirname5, join as join8, resolve as resolve12, parse, sep as sep2 } from "node:path";
+var plan_exports = {};
+__export(plan_exports, {
+  assertAuthorityFileTarget: () => assertAuthorityFileTarget,
+  assertImmutablePlanAuthority: () => assertImmutablePlanAuthority,
+  computePlanDigest: () => computePlanDigest,
+  prepareAuthorityDirectory: () => prepareAuthorityDirectory,
+  validatePlan: () => validatePlan,
+  validatePlanActionCompleteness: () => validatePlanActionCompleteness,
+  writePlanAtomic: () => writePlanAtomic,
+  writePlanImmutable: () => writePlanImmutable
+});
+import { readFile as readFile9, writeFile as writeFile6, rename as rename2, mkdir as mkdir9, open as open5, link, unlink as unlink2, lstat as lstat7 } from "node:fs/promises";
+import { basename as basename3, dirname as dirname5, join as join9, resolve as resolve13, parse, sep as sep2 } from "node:path";
 async function assertNoSymlinkAncestors(directory) {
-  const absolute = resolve12(directory);
+  const absolute = resolve13(directory);
   const parsed = parse(absolute);
   const segments = absolute.slice(parsed.root.length).split(sep2).filter(Boolean);
   const releaseIndex = segments.lastIndexOf(".release-skill");
   const firstChecked = releaseIndex >= 0 ? releaseIndex : Math.max(0, segments.length - 1);
-  let current = join8(parsed.root, ...segments.slice(0, firstChecked));
+  let current = join9(parsed.root, ...segments.slice(0, firstChecked));
   for (const segment of segments.slice(firstChecked)) {
-    current = join8(current, segment);
+    current = join9(current, segment);
     let stat9;
     try {
       stat9 = await lstat7(current);
@@ -21055,14 +21539,14 @@ async function assertNoSymlinkAncestors(directory) {
   }
 }
 async function prepareAuthorityDirectory(directory) {
-  const absolute = resolve12(directory);
+  const absolute = resolve13(directory);
   await assertNoSymlinkAncestors(absolute);
-  await mkdir8(absolute, { recursive: true });
+  await mkdir9(absolute, { recursive: true });
   await assertNoSymlinkAncestors(absolute);
   return absolute;
 }
 async function assertAuthorityFileTarget(filePath) {
-  const absolute = resolve12(filePath);
+  const absolute = resolve13(filePath);
   await prepareAuthorityDirectory(dirname5(absolute));
   try {
     const stat9 = await lstat7(absolute);
@@ -21081,7 +21565,7 @@ async function assertAuthorityFileTarget(filePath) {
 function assertImmutablePlanAuthority(planPath, plan) {
   if (!plan?.production) return;
   const digest = computePlanDigest(plan);
-  const absolute = resolve12(planPath);
+  const absolute = resolve13(planPath);
   if (basename3(dirname5(absolute)) !== "plans" || basename3(absolute) !== `${digest}.json`) {
     throw new ReleaseError(
       GATE_FAILED,
@@ -21173,7 +21657,7 @@ async function writePlanImmutable(planPath, plan) {
   const dir = dirname5(planPath);
   await prepareAuthorityDirectory(dir);
   await assertAuthorityFileTarget(planPath);
-  const tmpPath = join8(dir, `.release-plan-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.tmp`);
+  const tmpPath = join9(dir, `.release-plan-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.tmp`);
   const handle = await open5(tmpPath, "wx", 384);
   try {
     await handle.writeFile(json, "utf8");
@@ -21185,7 +21669,7 @@ async function writePlanImmutable(planPath, plan) {
     await link(tmpPath, planPath);
   } catch (error) {
     if (error.code !== "EEXIST") throw error;
-    const existing = await readFile8(planPath, "utf8");
+    const existing = await readFile9(planPath, "utf8");
     if (existing !== json) {
       if (plan.planVersion === 2) {
         let existingPlan = null;
@@ -21527,6 +22011,12 @@ function validatePlanActionCompleteness(plan, options = {}) {
             `unit "${unitId}", action "${action.id}": status is "${action.status ?? "(missing)"}", expected "PENDING"`
           );
         }
+        const externalMarketplace = dist.marketplaceRepo !== void 0 && dist.marketplaceRepo !== null;
+        if (externalMarketplace && platform.marketplaceRefForm === null) {
+          failures.push(
+            `unit "${unitId}", action "${action.id}": ${platform.distributionType} distribution declares marketplaceRepo but the platform has no marketplace add capability`
+          );
+        }
         _checkRequired(action, "parameters.consumer", action.parameters?.consumer, platform.id, unitId, failures);
         _checkRequired(action, "parameters.plugin", action.parameters?.plugin, plugin, unitId, failures);
         if (requiresMarketplace) {
@@ -21536,12 +22026,44 @@ function validatePlanActionCompleteness(plan, options = {}) {
             `unit "${unitId}", action "${action.id}": parameters.marketplace is "${action.parameters.marketplace}", expected optional legacy value "${marketplace}"`
           );
         }
-        _checkRequired(action, "parameters.repo", action.parameters?.repo, publicRepo, unitId, failures);
+        if (externalMarketplace) {
+          _checkRequired(action, "parameters.repo", action.parameters?.repo, dist.marketplaceRepo, unitId, failures);
+          _checkRequired(action, "parameters.marketplaceLocation", action.parameters?.marketplaceLocation, "external", unitId, failures);
+        } else {
+          _checkRequired(action, "parameters.repo", action.parameters?.repo, publicRepo, unitId, failures);
+        }
         _checkRequired(action, "parameters.version", action.parameters?.version, targetVersion, unitId, failures);
         _checkRequired(action, "parameters.entrySkill", action.parameters?.entrySkill, entrySkill, unitId, failures);
         if (production) {
           _checkRequired(action, "parameters.snapshotPath", action.parameters?.snapshotPath, frozen?.path, unitId, failures);
-          _checkRequired(action, "parameters.ref", action.parameters?.ref, expectedTag, unitId, failures);
+          if (externalMarketplace) {
+            const ref = action.parameters?.ref;
+            if (ref === void 0 || ref === null) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.ref is missing, expected the frozen external marketplace add-ref`
+              );
+            } else if (!_isStructurallySafeExternalRef(ref)) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.ref is not a structurally safe ref: ${JSON.stringify(ref)}`
+              );
+            } else if (ref !== action.expected?.ref) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.ref is "${ref}", expected self-consistent expected.ref "${action.expected?.ref}"`
+              );
+            }
+            const sha = action.parameters?.marketplaceCommitSha;
+            if (sha === void 0 || sha === null) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.marketplaceCommitSha is missing, expected a frozen 40-hex commit sha`
+              );
+            } else if (typeof sha !== "string" || !EXTERNAL_MARKETPLACE_SHA_RE.test(sha)) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.marketplaceCommitSha must be a 40-hex commit sha, got: ${JSON.stringify(sha)}`
+              );
+            }
+          } else {
+            _checkRequired(action, "parameters.ref", action.parameters?.ref, expectedTag, unitId, failures);
+          }
           _checkRequired(action, "parameters.manifestDigest", action.parameters?.manifestDigest, frozen?.manifestDigest, unitId, failures);
         }
         {
@@ -21573,8 +22095,15 @@ function validatePlanActionCompleteness(plan, options = {}) {
         _checkRequired(action, "expected.entrySkill", action.expected?.entrySkill, entrySkill, unitId, failures);
         if (production) {
           _checkRequired(action, "expected.consumer", action.expected?.consumer, platform.id, unitId, failures);
-          _checkRequired(action, "expected.repo", action.expected?.repo, publicRepo, unitId, failures);
-          _checkRequired(action, "expected.ref", action.expected?.ref, expectedTag, unitId, failures);
+          if (externalMarketplace) {
+            _checkRequired(action, "expected.repo", action.expected?.repo, dist.marketplaceRepo, unitId, failures);
+            _checkRequired(action, "expected.ref", action.expected?.ref, action.parameters?.ref, unitId, failures);
+            _checkRequired(action, "expected.marketplaceLocation", action.expected?.marketplaceLocation, "external", unitId, failures);
+            _checkRequired(action, "expected.marketplaceCommitSha", action.expected?.marketplaceCommitSha, action.parameters?.marketplaceCommitSha, unitId, failures);
+          } else {
+            _checkRequired(action, "expected.repo", action.expected?.repo, publicRepo, unitId, failures);
+            _checkRequired(action, "expected.ref", action.expected?.ref, expectedTag, unitId, failures);
+          }
           _checkRequired(action, "expected.entrySkillFound", action.expected?.entrySkillFound, true, unitId, failures);
           _checkRequired(action, "expected.manifestDigest", action.expected?.manifestDigest, frozen?.manifestDigest, unitId, failures);
         }
@@ -21654,7 +22183,22 @@ function _checkRequired(action, fieldPath, actual, expected, unitId, failures) {
     );
   }
 }
-var import_ajv3, import_ajv_formats3, RELEASE_PLAN_SCHEMA, ajv3, validatePlanSchema, CANONICAL_COMMIT_TIMESTAMP_RE, REQUIRED_ACTION_TYPES;
+function _isStructurallySafeExternalRef(ref) {
+  if (typeof ref !== "string" || ref.length === 0) return false;
+  if (/[\x00-\x1f]/.test(ref)) return false;
+  if (ref.startsWith("-")) return false;
+  if (ref.includes("\\")) return false;
+  if (ref.includes("//")) return false;
+  if (ref.startsWith("/") || ref.endsWith("/")) return false;
+  if (ref.endsWith(".")) return false;
+  if (ref.endsWith(".lock")) return false;
+  if (ref.includes("@{")) return false;
+  if (ref === "@") return false;
+  if (ref.includes("..")) return false;
+  if (/[;|&`$(){}]/.test(ref)) return false;
+  return /^[a-zA-Z0-9][a-zA-Z0-9._/-]*$/.test(ref);
+}
+var import_ajv3, import_ajv_formats3, RELEASE_PLAN_SCHEMA, ajv3, validatePlanSchema, CANONICAL_COMMIT_TIMESTAMP_RE, REQUIRED_ACTION_TYPES, EXTERNAL_MARKETPLACE_SHA_RE;
 var init_plan = __esm({
   async "src/core/plan.mjs"() {
     import_ajv3 = __toESM(require_ajv(), 1);
@@ -21683,13 +22227,15 @@ var init_plan = __esm({
     REQUIRED_ACTION_TYPES = ["push-snapshot", "create-tag", "github-release"];
     __name(validatePlanActionCompleteness, "validatePlanActionCompleteness");
     __name(_checkRequired, "_checkRequired");
+    EXTERNAL_MARKETPLACE_SHA_RE = /^[0-9a-f]{40}$/;
+    __name(_isStructurallySafeExternalRef, "_isStructurallySafeExternalRef");
   }
 });
 
 // src/snapshot/public-map.mjs
-import { lstat as lstat8, readFile as readFile9, mkdir as mkdir9, readdir as readdir6, realpath as realpath8, chmod as fsChmod } from "node:fs/promises";
+import { lstat as lstat8, readFile as readFile10, mkdir as mkdir10, readdir as readdir6, realpath as realpath8, chmod as fsChmod } from "node:fs/promises";
 import { open as fsOpen } from "node:fs/promises";
-import { relative as relative10, resolve as resolve13, dirname as dirname6, sep as pathSep, isAbsolute as isAbsolute9 } from "node:path";
+import { relative as relative11, resolve as resolve14, dirname as dirname6, sep as pathSep, isAbsolute as isAbsolute10 } from "node:path";
 import { posix } from "node:path";
 import { constants as fsConstants3 } from "node:fs";
 import { createHash as createHash7 } from "node:crypto";
@@ -21698,14 +22244,14 @@ function _isContainedWith(relativeFn, isAbsoluteFn, root, candidate, relPathSep
   return rel !== "" && rel !== ".." && !rel.startsWith(`..${relPathSep}`) && !isAbsoluteFn(rel);
 }
 function isContained(root, candidate) {
-  return _isContainedWith(relative10, isAbsolute9, root, candidate);
+  return _isContainedWith(relative11, isAbsolute10, root, candidate);
 }
 async function assertNoAncestorSymlinks(root, filePath, fs = { lstat: lstat8 }) {
-  const rel = relative10(root, filePath);
+  const rel = relative11(root, filePath);
   const segments = rel.split(/[/\\]/);
   let current = root;
   for (const segment of segments) {
-    current = resolve13(current, segment);
+    current = resolve14(current, segment);
     try {
       const st = await fs.lstat(current, { stage: "source-ancestor" });
       if (st.isSymbolicLink()) {
@@ -21762,11 +22308,11 @@ async function assertOutputAncestorsNoFollow(effectiveOutputDir, fs = { lstat: l
   }
 }
 async function assertDestAncestorsNoFollow(realOutputRoot, destPath, fs = { lstat: lstat8 }) {
-  const relDest = relative10(realOutputRoot, destPath);
+  const relDest = relative11(realOutputRoot, destPath);
   const segments = relDest.split(pathSep).filter(Boolean);
   let current = realOutputRoot;
   for (const segment of segments) {
-    current = resolve13(current, segment);
+    current = resolve14(current, segment);
     try {
       const st = await fs.lstat(current, { stage: "dest-ancestor" });
       if (st.isSymbolicLink()) {
@@ -21922,9 +22468,9 @@ async function buildPublicStaging({
   const fs = {
     lstat: _fsOps.lstat ? (p, ctx) => _fsOps.lstat({ operation: "lstat", path: p, ...ctx }) : lstat8,
     realpath: _fsOps.realpath ? (p, ctx) => _fsOps.realpath({ operation: "realpath", path: p, ...ctx }) : realpath8,
-    readFile: _fsOps.readFile ? (p, ctx) => _fsOps.readFile({ operation: "readFile", path: p, ...ctx }) : readFile9,
+    readFile: _fsOps.readFile ? (p, ctx) => _fsOps.readFile({ operation: "readFile", path: p, ...ctx }) : readFile10,
     open: _fsOps.open ? (p, flags, mode, ctx) => _fsOps.open({ operation: "open", path: p, flags, mode, ...ctx }) : fsOpen,
-    mkdir: _fsOps.mkdir ? (p, opts, ctx) => _fsOps.mkdir({ operation: "mkdir", path: p, opts, ...ctx }) : mkdir9,
+    mkdir: _fsOps.mkdir ? (p, opts, ctx) => _fsOps.mkdir({ operation: "mkdir", path: p, opts, ...ctx }) : mkdir10,
     readdir: _fsOps.readdir ? (p, ctx) => _fsOps.readdir({ operation: "readdir", path: p, ...ctx }) : readdir6,
     chmod: _fsOps.chmod ? (p, mode, ctx) => _fsOps.chmod({ operation: "chmod", path: p, mode, ...ctx }) : fsChmod
   };
@@ -21957,7 +22503,7 @@ async function buildPublicStaging({
       { count: mappings.length, limit: MAX_MAPPINGS }
     );
   }
-  const unitRootLexical = resolve13(sourceRoot, unit.source);
+  const unitRootLexical = resolve14(sourceRoot, unit.source);
   let realUnitRoot;
   try {
     realUnitRoot = await fs.realpath(unitRootLexical, { stage: "unit-root-realpath" });
@@ -21970,14 +22516,14 @@ async function buildPublicStaging({
       { sourceRoot, unitSource: unit.source, cause: code }
     );
   }
-  const effectiveOutputDir = resolve13(
-    outputDir ?? resolve13(sourceRoot, ".release-skill", "staging")
+  const effectiveOutputDir = resolve14(
+    outputDir ?? resolve14(sourceRoot, ".release-skill", "staging")
   );
   const preflightRecords = [];
   const requiredTargetSet = new Set(unit.requiredPublicFiles ?? []);
   for (const mapping of mappings) {
-    const srcPath = resolve13(sourceRoot, mapping.from);
-    const destPath = resolve13(effectiveOutputDir, mapping.to);
+    const srcPath = resolve14(sourceRoot, mapping.from);
+    const destPath = resolve14(effectiveOutputDir, mapping.to);
     if (srcPath.length > MAX_PATH_LENGTH || destPath.length > MAX_PATH_LENGTH) {
       preflightRecords.push({
         ok: false,
@@ -22464,11 +23010,11 @@ async function buildPublicStaging({
       );
     }
     const destDir = dirname6(destPath);
-    const relDest = relative10(realOutputRoot, destDir);
+    const relDest = relative11(realOutputRoot, destDir);
     const destSegments = relDest.split(pathSep).filter(Boolean);
     let accumulatedPath = realOutputRoot;
     for (const seg of destSegments) {
-      accumulatedPath = resolve13(accumulatedPath, seg);
+      accumulatedPath = resolve14(accumulatedPath, seg);
       try {
         const segStat = await fs.lstat(accumulatedPath, { stage: "dest-ancestor-pre-mkdir" });
         if (segStat.isSymbolicLink()) {
@@ -22767,8 +23313,8 @@ var init_public_map = __esm({
 });
 
 // src/snapshot/scan.mjs
-import { readFile as readFile10, readdir as readdir7, stat as stat3 } from "node:fs/promises";
-import { join as join9, relative as relative11, extname, posix as posix2, win32 } from "node:path";
+import { readFile as readFile11, readdir as readdir7, stat as stat3 } from "node:fs/promises";
+import { join as join10, relative as relative12, extname, posix as posix2, win32 } from "node:path";
 import { createHash as createHash8 } from "node:crypto";
 async function collectFiles(dir, base = dir) {
   const results = [];
@@ -22780,12 +23326,12 @@ async function collectFiles(dir, base = dir) {
   }
   for (const entry of entries) {
     if (entry.name === ".git") continue;
-    const abs = join9(dir, entry.name);
+    const abs = join10(dir, entry.name);
     if (entry.isDirectory()) {
       const sub = await collectFiles(abs, base);
       results.push(...sub);
     } else if (entry.isFile()) {
-      results.push(relative11(base, abs));
+      results.push(relative12(base, abs));
     }
   }
   return results;
@@ -22836,7 +23382,7 @@ async function scanFile(relPath, absPath, forbiddenPaths, forbiddenContentPatter
   }
   let content;
   try {
-    content = await readFile10(absPath, "utf8");
+    content = await readFile11(absPath, "utf8");
   } catch {
     return findings;
   }
@@ -22905,10 +23451,10 @@ async function scanFile(relPath, absPath, forbiddenPaths, forbiddenContentPatter
 }
 async function scanForStaleDist(snapshotDir) {
   const findings = [];
-  const manifestPath = join9(snapshotDir, "dist", "manifest.json");
+  const manifestPath = join10(snapshotDir, "dist", "manifest.json");
   let manifest;
   try {
-    const raw = await readFile10(manifestPath, "utf8");
+    const raw = await readFile11(manifestPath, "utf8");
     manifest = JSON.parse(raw);
   } catch {
     return findings;
@@ -22916,13 +23462,13 @@ async function scanForStaleDist(snapshotDir) {
   if (!manifest.files || typeof manifest.files !== "object") {
     return findings;
   }
-  const distDir = join9(snapshotDir, "dist");
+  const distDir = join10(snapshotDir, "dist");
   for (const [fileRel, expectedHash] of Object.entries(manifest.files)) {
     if (typeof expectedHash !== "string") continue;
-    const fileAbs = join9(distDir, fileRel);
+    const fileAbs = join10(distDir, fileRel);
     let actualContent;
     try {
-      actualContent = await readFile10(fileAbs);
+      actualContent = await readFile11(fileAbs);
     } catch {
       findings.push({
         kind: STALE_BUILD_ARTIFACT,
@@ -22963,7 +23509,7 @@ async function scanSnapshot({ snapshotDir, policy = {} } = {}) {
   const relFiles = await collectFiles(snapshotDir);
   const seenKinds = /* @__PURE__ */ new Set();
   for (const relPath of relFiles) {
-    const absPath = join9(snapshotDir, relPath);
+    const absPath = join10(snapshotDir, relPath);
     const normRel = relPath.replaceAll(win32.sep, posix2.sep);
     if (await isBinaryFile(relPath, absPath)) continue;
     const fileFindings = await scanFile(normRel, absPath, forbiddenPaths, forbiddenContentPatterns, seenKinds);
@@ -23054,7 +23600,7 @@ var init_scan = __esm({
 });
 
 // src/readme/contract.mjs
-import { readFile as readFile11 } from "node:fs/promises";
+import { readFile as readFile12 } from "node:fs/promises";
 import path2 from "node:path";
 function extractMarkers(content) {
   const regex = /<!--\s*release-skill:((?:[\w-]+:)*[\w-]+)\s*-->/g;
@@ -23084,7 +23630,7 @@ function extractExecBlocks(content) {
 }
 async function safeRead(filePath) {
   try {
-    return await readFile11(filePath, "utf8");
+    return await readFile12(filePath, "utf8");
   } catch {
     return null;
   }
@@ -24173,10 +24719,10 @@ var require_commonjs = __commonJS({
        * Return a void Promise that resolves once the stream ends.
        */
       async promise() {
-        return new Promise((resolve24, reject) => {
+        return new Promise((resolve25, reject) => {
           this.on(DESTROYED, () => reject(new Error("stream destroyed")));
           this.on("error", (er) => reject(er));
-          this.on("end", () => resolve24());
+          this.on("end", () => resolve25());
         });
       }
       /**
@@ -24200,7 +24746,7 @@ var require_commonjs = __commonJS({
             return Promise.resolve({ done: false, value: res });
           if (this[EOF])
             return stop();
-          let resolve24;
+          let resolve25;
           let reject;
           const onerr = /* @__PURE__ */ __name((er) => {
             this.off("data", ondata);
@@ -24214,19 +24760,19 @@ var require_commonjs = __commonJS({
             this.off("end", onend);
             this.off(DESTROYED, ondestroy);
             this.pause();
-            resolve24({ value, done: !!this[EOF] });
+            resolve25({ value, done: !!this[EOF] });
           }, "ondata");
           const onend = /* @__PURE__ */ __name(() => {
             this.off("error", onerr);
             this.off("data", ondata);
             this.off(DESTROYED, ondestroy);
             stop();
-            resolve24({ done: true, value: void 0 });
+            resolve25({ done: true, value: void 0 });
           }, "onend");
           const ondestroy = /* @__PURE__ */ __name(() => onerr(new Error("stream destroyed")), "ondestroy");
           return new Promise((res2, rej) => {
             reject = rej;
-            resolve24 = res2;
+            resolve25 = res2;
             this.once(DESTROYED, ondestroy);
             this.once("error", onerr);
             this.once("end", onend);
@@ -25317,10 +25863,10 @@ var require_minipass = __commonJS({
       }
       // stream.promise().then(() => done, er => emitted error)
       promise() {
-        return new Promise((resolve24, reject) => {
+        return new Promise((resolve25, reject) => {
           this.on(DESTROYED, () => reject(new Error("stream destroyed")));
           this.on("error", (er) => reject(er));
-          this.on("end", () => resolve24());
+          this.on("end", () => resolve25());
         });
       }
       // for await (let chunk of stream)
@@ -25331,7 +25877,7 @@ var require_minipass = __commonJS({
             return Promise.resolve({ done: false, value: res });
           if (this[EOF])
             return Promise.resolve({ done: true });
-          let resolve24 = null;
+          let resolve25 = null;
           let reject = null;
           const onerr = /* @__PURE__ */ __name((er) => {
             this.removeListener("data", ondata);
@@ -25342,17 +25888,17 @@ var require_minipass = __commonJS({
             this.removeListener("error", onerr);
             this.removeListener("end", onend);
             this.pause();
-            resolve24({ value, done: !!this[EOF] });
+            resolve25({ value, done: !!this[EOF] });
           }, "ondata");
           const onend = /* @__PURE__ */ __name(() => {
             this.removeListener("error", onerr);
             this.removeListener("data", ondata);
-            resolve24({ done: true });
+            resolve25({ done: true });
           }, "onend");
           const ondestroy = /* @__PURE__ */ __name(() => onerr(new Error("stream destroyed")), "ondestroy");
           return new Promise((res2, rej) => {
             reject = rej;
-            resolve24 = res2;
+            resolve25 = res2;
             this.once(DESTROYED, ondestroy);
             this.once("error", onerr);
             this.once("end", onend);
@@ -29391,12 +29937,12 @@ var require_body = __commonJS({
         if (resTimeout && resTimeout.unref) {
           resTimeout.unref();
         }
-        return new Promise((resolve24) => {
+        return new Promise((resolve25) => {
           if (stream !== upstream) {
             upstream.on("error", (er) => stream.emit("error", er));
             upstream.pipe(stream);
           }
-          resolve24();
+          resolve25();
         }).then(() => stream.concat()).then((buf) => {
           clearTimeout(resTimeout);
           return buf;
@@ -30161,7 +30707,7 @@ var require_lib2 = __commonJS({
     var fetch = /* @__PURE__ */ __name(async (url, opts) => {
       if (/^data:/.test(url)) {
         const request = new Request(url, opts);
-        return Promise.resolve().then(() => new Promise((resolve24, reject) => {
+        return Promise.resolve().then(() => new Promise((resolve25, reject) => {
           let type, data;
           try {
             const { pathname, search } = new URL2(url);
@@ -30185,10 +30731,10 @@ var require_lib2 = __commonJS({
           if (type) {
             headers["Content-Type"] = type;
           }
-          return resolve24(new Response(data, { headers }));
+          return resolve25(new Response(data, { headers }));
         }));
       }
-      return new Promise((resolve24, reject) => {
+      return new Promise((resolve25, reject) => {
         const request = new Request(url, opts);
         let options;
         try {
@@ -30307,7 +30853,7 @@ var require_lib2 = __commonJS({
                 requestOpts.body = void 0;
                 requestOpts.headers.delete("content-length");
               }
-              resolve24(fetch(new Request(locationURL, requestOpts)));
+              resolve25(fetch(new Request(locationURL, requestOpts)));
               finalize();
               return;
             }
@@ -30335,7 +30881,7 @@ var require_lib2 = __commonJS({
           const codings = headers.get("Content-Encoding");
           if (!request.compress || request.method === "HEAD" || codings === null || res.statusCode === 204 || res.statusCode === 304) {
             response = new Response(body, responseOptions);
-            resolve24(response);
+            resolve25(response);
             return;
           }
           const zlibOptions = {
@@ -30354,7 +30900,7 @@ var require_lib2 = __commonJS({
               ).pipe(unzip),
               responseOptions
             );
-            resolve24(response);
+            resolve25(response);
             return;
           }
           if (codings === "deflate" || codings === "x-deflate") {
@@ -30366,7 +30912,7 @@ var require_lib2 = __commonJS({
                 (er) => decoder2.emit("error", er)
               ).pipe(decoder2);
               response = new Response(decoder2, responseOptions);
-              resolve24(response);
+              resolve25(response);
             });
             return;
           }
@@ -30384,11 +30930,11 @@ var require_lib2 = __commonJS({
               (er) => decoder.emit("error", er)
             ).pipe(decoder);
             response = new Response(decoder, responseOptions);
-            resolve24(response);
+            resolve25(response);
             return;
           }
           response = new Response(body, responseOptions);
-          resolve24(response);
+          resolve25(response);
         });
         writeToStream(req, request);
       });
@@ -30642,12 +31188,12 @@ var require_lib3 = __commonJS({
           return process.emit("input", "end");
         }, "end"),
         read: /* @__PURE__ */ __name(function(...args2) {
-          let resolve24, reject;
+          let resolve25, reject;
           const promise = new Promise((_resolve, _reject) => {
-            resolve24 = _resolve;
+            resolve25 = _resolve;
             reject = _reject;
           });
-          process.emit("input", "read", resolve24, reject, ...args2);
+          process.emit("input", "read", resolve25, reject, ...args2);
           return promise;
         }, "read")
       }
@@ -35062,7 +35608,7 @@ var require_npa = __commonJS({
           spec = arg;
         }
       }
-      return resolve24(name, spec, where, arg);
+      return resolve25(name, spec, where, arg);
     }
     __name(npa, "npa");
     function isFileSpec(spec) {
@@ -35085,7 +35631,7 @@ var require_npa = __commonJS({
       return spec.toLowerCase().startsWith("npm:");
     }
     __name(isAliasSpec, "isAliasSpec");
-    function resolve24(name, spec, where, arg) {
+    function resolve25(name, spec, where, arg) {
       const res = new Result({
         raw: arg,
         name,
@@ -35117,7 +35663,7 @@ var require_npa = __commonJS({
         return fromRegistry(res);
       }
     }
-    __name(resolve24, "resolve");
+    __name(resolve25, "resolve");
     function toPurl(arg, reg = defaultRegistry) {
       const res = npa(arg);
       if (res.type !== "version") {
@@ -35418,7 +35964,7 @@ var require_npa = __commonJS({
     }
     __name(fromRegistry, "fromRegistry");
     module.exports = npa;
-    module.exports.resolve = resolve24;
+    module.exports.resolve = resolve25;
     module.exports.toPurl = toPurl;
     module.exports.Result = Result;
   }
@@ -37191,7 +37737,7 @@ var require_lib7 = __commonJS({
     module.exports.fromStream = fromStream;
     function fromStream(stream, opts) {
       const istream = integrityStream(opts);
-      return new Promise((resolve24, reject) => {
+      return new Promise((resolve25, reject) => {
         stream.pipe(istream);
         stream.on("error", reject);
         istream.on("error", reject);
@@ -37199,7 +37745,7 @@ var require_lib7 = __commonJS({
         istream.on("integrity", (s) => {
           sri = s;
         });
-        istream.on("end", () => resolve24(sri));
+        istream.on("end", () => resolve25(sri));
         istream.resume();
       });
     }
@@ -37260,7 +37806,7 @@ var require_lib7 = __commonJS({
         ));
       }
       const checker = integrityStream(opts);
-      return new Promise((resolve24, reject) => {
+      return new Promise((resolve25, reject) => {
         stream.pipe(checker);
         stream.on("error", reject);
         checker.on("error", reject);
@@ -37268,7 +37814,7 @@ var require_lib7 = __commonJS({
         checker.on("verified", (s) => {
           verified = s;
         });
-        checker.on("end", () => resolve24(verified));
+        checker.on("end", () => resolve25(verified));
         checker.resume();
       });
     }
@@ -38150,7 +38696,7 @@ var require_polyfill = __commonJS({
       chmod: chmod5,
       copyFile,
       lstat: lstat15,
-      mkdir: mkdir19,
+      mkdir: mkdir20,
       readdir: readdir13,
       readlink: readlink2,
       stat: stat9,
@@ -38160,10 +38706,10 @@ var require_polyfill = __commonJS({
     } = __require("fs/promises");
     var {
       dirname: dirname15,
-      isAbsolute: isAbsolute18,
-      join: join25,
+      isAbsolute: isAbsolute19,
+      join: join26,
       parse: parse2,
-      resolve: resolve24,
+      resolve: resolve25,
       sep: sep4,
       toNamespacedPath
     } = __require("path");
@@ -38268,7 +38814,7 @@ var require_polyfill = __commonJS({
       if (dirExists) {
         return getStatsForCopy(destStat, src, dest, opts);
       }
-      await mkdir19(destParent, { recursive: true });
+      await mkdir20(destParent, { recursive: true });
       return getStatsForCopy(destStat, src, dest, opts);
     }
     __name(checkParentDir, "checkParentDir");
@@ -38281,8 +38827,8 @@ var require_polyfill = __commonJS({
     }
     __name(pathExists2, "pathExists");
     async function checkParentPaths(src, srcStat, dest) {
-      const srcParent = resolve24(dirname15(src));
-      const destParent = resolve24(dirname15(dest));
+      const srcParent = resolve25(dirname15(src));
+      const destParent = resolve25(dirname15(dest));
       if (destParent === srcParent || destParent === parse2(destParent).root) {
         return;
       }
@@ -38306,7 +38852,7 @@ var require_polyfill = __commonJS({
       return checkParentPaths(src, srcStat, destParent);
     }
     __name(checkParentPaths, "checkParentPaths");
-    var normalizePathToArray = /* @__PURE__ */ __name((path3) => resolve24(path3).split(sep4).filter(Boolean), "normalizePathToArray");
+    var normalizePathToArray = /* @__PURE__ */ __name((path3) => resolve25(path3).split(sep4).filter(Boolean), "normalizePathToArray");
     function isSrcSubdir(src, dest) {
       const srcArr = normalizePathToArray(src);
       const destArr = normalizePathToArray(dest);
@@ -38433,7 +38979,7 @@ var require_polyfill = __commonJS({
     }
     __name(onDir, "onDir");
     async function mkDirAndCopy(srcMode, src, dest, opts) {
-      await mkdir19(dest);
+      await mkdir20(dest);
       await copyDir(src, dest, opts);
       return setDestMode(dest, srcMode);
     }
@@ -38442,8 +38988,8 @@ var require_polyfill = __commonJS({
       const dir = await readdir13(src);
       for (let i = 0; i < dir.length; i++) {
         const item = dir[i];
-        const srcItem = join25(src, item);
-        const destItem = join25(dest, item);
+        const srcItem = join26(src, item);
+        const destItem = join26(dest, item);
         const { destStat } = await checkPaths(srcItem, destItem, opts);
         await startCopy(destStat, srcItem, destItem, opts);
       }
@@ -38451,8 +38997,8 @@ var require_polyfill = __commonJS({
     __name(copyDir, "copyDir");
     async function onLink(destStat, src, dest) {
       let resolvedSrc = await readlink2(src);
-      if (!isAbsolute18(resolvedSrc)) {
-        resolvedSrc = resolve24(dirname15(src), resolvedSrc);
+      if (!isAbsolute19(resolvedSrc)) {
+        resolvedSrc = resolve25(dirname15(src), resolvedSrc);
       }
       if (!destStat) {
         return symlink(resolvedSrc, dest);
@@ -38466,8 +39012,8 @@ var require_polyfill = __commonJS({
         }
         throw err;
       }
-      if (!isAbsolute18(resolvedDest)) {
-        resolvedDest = resolve24(dirname15(dest), resolvedDest);
+      if (!isAbsolute19(resolvedDest)) {
+        resolvedDest = resolve25(dirname15(dest), resolvedDest);
       }
       if (isSrcSubdir(resolvedSrc, resolvedDest)) {
         throw new ERR_FS_CP_EINVAL({
@@ -38519,15 +39065,15 @@ var require_cp = __commonJS({
 // ../../node_modules/.pnpm/@npmcli+fs@4.0.0/node_modules/@npmcli/fs/lib/with-temp-dir.js
 var require_with_temp_dir = __commonJS({
   "../../node_modules/.pnpm/@npmcli+fs@4.0.0/node_modules/@npmcli/fs/lib/with-temp-dir.js"(exports, module) {
-    var { join: join25, sep: sep4 } = __require("path");
+    var { join: join26, sep: sep4 } = __require("path");
     var getOptions = require_get_options();
-    var { mkdir: mkdir19, mkdtemp: mkdtemp5, rm: rm9 } = __require("fs/promises");
+    var { mkdir: mkdir20, mkdtemp: mkdtemp5, rm: rm9 } = __require("fs/promises");
     var withTempDir = /* @__PURE__ */ __name(async (root, fn, opts) => {
       const options = getOptions(opts, {
         copy: ["tmpPrefix"]
       });
-      await mkdir19(root, { recursive: true });
-      const target = await mkdtemp5(join25(`${root}${sep4}`, options.tmpPrefix || ""));
+      await mkdir20(root, { recursive: true });
+      const target = await mkdtemp5(join26(`${root}${sep4}`, options.tmpPrefix || ""));
       let err;
       let result;
       try {
@@ -38552,13 +39098,13 @@ var require_with_temp_dir = __commonJS({
 var require_readdir_scoped = __commonJS({
   "../../node_modules/.pnpm/@npmcli+fs@4.0.0/node_modules/@npmcli/fs/lib/readdir-scoped.js"(exports, module) {
     var { readdir: readdir13 } = __require("fs/promises");
-    var { join: join25 } = __require("path");
+    var { join: join26 } = __require("path");
     var readdirScoped = /* @__PURE__ */ __name(async (dir) => {
       const results = [];
       for (const item of await readdir13(dir)) {
         if (item.startsWith("@")) {
-          for (const scopedItem of await readdir13(join25(dir, item))) {
-            results.push(join25(item, scopedItem));
+          for (const scopedItem of await readdir13(join26(dir, item))) {
+            results.push(join26(item, scopedItem));
           }
         } else {
           results.push(item);
@@ -38573,7 +39119,7 @@ var require_readdir_scoped = __commonJS({
 // ../../node_modules/.pnpm/@npmcli+fs@4.0.0/node_modules/@npmcli/fs/lib/move-file.js
 var require_move_file = __commonJS({
   "../../node_modules/.pnpm/@npmcli+fs@4.0.0/node_modules/@npmcli/fs/lib/move-file.js"(exports, module) {
-    var { dirname: dirname15, join: join25, resolve: resolve24, relative: relative21, isAbsolute: isAbsolute18 } = __require("path");
+    var { dirname: dirname15, join: join26, resolve: resolve25, relative: relative22, isAbsolute: isAbsolute19 } = __require("path");
     var fs = __require("fs/promises");
     var pathExists2 = /* @__PURE__ */ __name(async (path3) => {
       try {
@@ -38603,7 +39149,7 @@ var require_move_file = __commonJS({
           if (sourceStat.isDirectory()) {
             const files = await fs.readdir(source);
             await Promise.all(files.map(
-              (file) => moveFile(join25(source, file), join25(destination, file), options, false, symlinks)
+              (file) => moveFile(join26(source, file), join26(destination, file), options, false, symlinks)
             ));
           } else if (sourceStat.isSymbolicLink()) {
             symlinks.push({ source, destination });
@@ -38617,12 +39163,12 @@ var require_move_file = __commonJS({
       if (root) {
         await Promise.all(symlinks.map(async ({ source: symSource, destination: symDestination }) => {
           let target = await fs.readlink(symSource);
-          if (isAbsolute18(target)) {
-            target = resolve24(symDestination, relative21(symSource, target));
+          if (isAbsolute19(target)) {
+            target = resolve25(symDestination, relative22(symSource, target));
           }
           let targetStat = "file";
           try {
-            targetStat = await fs.stat(resolve24(dirname15(symSource), target));
+            targetStat = await fs.stat(resolve25(dirname15(symSource), target));
             if (targetStat.isDirectory()) {
               targetStat = "junction";
             }
@@ -38695,7 +39241,7 @@ async function pMap(iterable, mapper, {
     const cleanup = /* @__PURE__ */ __name(() => {
       signal?.removeEventListener("abort", signalListener);
     }, "cleanup");
-    const resolve24 = /* @__PURE__ */ __name((value) => {
+    const resolve25 = /* @__PURE__ */ __name((value) => {
       resolve_(value);
       cleanup();
     }, "resolve");
@@ -38727,7 +39273,7 @@ async function pMap(iterable, mapper, {
           }
           isResolved = true;
           if (skippedIndexesMap.size === 0) {
-            resolve24(result);
+            resolve25(result);
             return;
           }
           const pureResult = [];
@@ -38737,7 +39283,7 @@ async function pMap(iterable, mapper, {
             }
             pureResult.push(value);
           }
-          resolve24(pureResult);
+          resolve25(pureResult);
         }
         return;
       }
@@ -38876,8 +39422,8 @@ var require_entry_index = __commonJS({
     var crypto = __require("crypto");
     var {
       appendFile,
-      mkdir: mkdir19,
-      readFile: readFile29,
+      mkdir: mkdir20,
+      readFile: readFile30,
       readdir: readdir13,
       rm: rm9,
       writeFile: writeFile11
@@ -38923,7 +39469,7 @@ var require_entry_index = __commonJS({
       }).join("\n");
       const setup = /* @__PURE__ */ __name(async () => {
         const target = uniqueFilename(path3.join(cache, "tmp"), opts.tmpPrefix);
-        await mkdir19(path3.dirname(target), { recursive: true });
+        await mkdir20(path3.dirname(target), { recursive: true });
         return {
           target,
           moved: false
@@ -38936,7 +39482,7 @@ var require_entry_index = __commonJS({
       }, "teardown");
       const write = /* @__PURE__ */ __name(async (tmp2) => {
         await writeFile11(tmp2.target, newIndex, { flag: "wx" });
-        await mkdir19(path3.dirname(bucket), { recursive: true });
+        await mkdir20(path3.dirname(bucket), { recursive: true });
         await moveFile(tmp2.target, bucket);
         tmp2.moved = true;
       }, "write");
@@ -38961,7 +39507,7 @@ var require_entry_index = __commonJS({
         metadata
       };
       try {
-        await mkdir19(path3.dirname(bucket), { recursive: true });
+        await mkdir20(path3.dirname(bucket), { recursive: true });
         const stringified = JSON.stringify(entry);
         await appendFile(bucket, `
 ${hashEntry(stringified)}	${stringified}`);
@@ -39069,7 +39615,7 @@ ${hashEntry(stringified)}	${stringified}`);
     __name(ls, "ls");
     module.exports.bucketEntries = bucketEntries;
     async function bucketEntries(bucket, filter) {
-      const data = await readFile29(bucket, "utf8");
+      const data = await readFile30(bucket, "utf8");
       return _bucketEntries(data, filter);
     }
     __name(bucketEntries, "bucketEntries");
@@ -42943,9 +43489,9 @@ var require_commonjs5 = __commonJS({
         if (this.#asyncReaddirInFlight) {
           await this.#asyncReaddirInFlight;
         } else {
-          let resolve24 = /* @__PURE__ */ __name(() => {
+          let resolve25 = /* @__PURE__ */ __name(() => {
           }, "resolve");
-          this.#asyncReaddirInFlight = new Promise((res) => resolve24 = res);
+          this.#asyncReaddirInFlight = new Promise((res) => resolve25 = res);
           try {
             for (const e of await this.#fs.promises.readdir(fullpath, {
               withFileTypes: true
@@ -42958,7 +43504,7 @@ var require_commonjs5 = __commonJS({
             children.provisional = 0;
           }
           this.#asyncReaddirInFlight = void 0;
-          resolve24();
+          resolve25();
         }
         return children.slice(0, children.provisional);
       }
@@ -44069,10 +44615,10 @@ var require_ignore = __commonJS({
       ignored(p) {
         const fullpath = p.fullpath();
         const fullpaths = `${fullpath}/`;
-        const relative21 = p.relative() || ".";
-        const relatives = `${relative21}/`;
+        const relative22 = p.relative() || ".";
+        const relatives = `${relative22}/`;
         for (const m of this.relative) {
-          if (m.match(relative21) || m.match(relatives))
+          if (m.match(relative22) || m.match(relatives))
             return true;
         }
         for (const m of this.absolute) {
@@ -44083,9 +44629,9 @@ var require_ignore = __commonJS({
       }
       childrenIgnored(p) {
         const fullpath = p.fullpath() + "/";
-        const relative21 = (p.relative() || ".") + "/";
+        const relative22 = (p.relative() || ".") + "/";
         for (const m of this.relativeChildren) {
-          if (m.match(relative21))
+          if (m.match(relative22))
             return true;
         }
         for (const m of this.absoluteChildren) {
@@ -45088,8 +45634,8 @@ var require_verify = __commonJS({
   "../../node_modules/.pnpm/cacache@19.0.1/node_modules/cacache/lib/verify.js"(exports, module) {
     "use strict";
     var {
-      mkdir: mkdir19,
-      readFile: readFile29,
+      mkdir: mkdir20,
+      readFile: readFile30,
       rm: rm9,
       stat: stat9,
       truncate,
@@ -45158,7 +45704,7 @@ var require_verify = __commonJS({
     __name(markEndTime, "markEndTime");
     async function fixPerms(cache, opts) {
       opts.log.silly("verify", "fixing cache permissions");
-      await mkdir19(cache, { recursive: true });
+      await mkdir20(cache, { recursive: true });
       return null;
     }
     __name(fixPerms, "fixPerms");
@@ -45176,8 +45722,8 @@ var require_verify = __commonJS({
           liveContent.add(integrity[algo].toString());
         }
       });
-      await new Promise((resolve24, reject) => {
-        indexStream.on("end", resolve24).on("error", reject);
+      await new Promise((resolve25, reject) => {
+        indexStream.on("end", resolve25).on("error", reject);
       });
       const contentDir = contentPath.contentDir(cache);
       const files = await glob(path3.join(contentDir, "**"), {
@@ -45316,7 +45862,7 @@ var require_verify = __commonJS({
     __name(writeVerifile, "writeVerifile");
     module.exports.lastRun = lastRun;
     async function lastRun(cache) {
-      const data = await readFile29(path3.join(cache, "_lastverified"), { encoding: "utf8" });
+      const data = await readFile30(path3.join(cache, "_lastverified"), { encoding: "utf8" });
       return /* @__PURE__ */ new Date(+data);
     }
     __name(lastRun, "lastRun");
@@ -45733,7 +46279,7 @@ var require_promise_retry = __commonJS({
         fn = temp;
       }
       operation = retry.operation(options);
-      return new Promise(function(resolve24, reject) {
+      return new Promise(function(resolve25, reject) {
         operation.attempt(function(number) {
           Promise.resolve().then(function() {
             return fn(function(err) {
@@ -45742,7 +46288,7 @@ var require_promise_retry = __commonJS({
               }
               throw errcode(new Error("Retrying"), "EPROMISERETRY", { retried: err });
             }, number);
-          }).then(resolve24, function(err) {
+          }).then(resolve25, function(err) {
             if (isRetryError(err)) {
               err = err.retried;
               if (operation.retry(err || new Error())) {
@@ -46627,8 +47173,8 @@ var require_helpers = __commonJS({
     function req(url, opts = {}) {
       const href = typeof url === "string" ? url : url.href;
       const req2 = (href.startsWith("https:") ? https : http).request(url, opts);
-      const promise = new Promise((resolve24, reject) => {
-        req2.once("response", resolve24).once("error", reject).end();
+      const promise = new Promise((resolve25, reject) => {
+        req2.once("response", resolve25).once("error", reject).end();
       });
       req2.then = promise.then.bind(promise);
       return req2;
@@ -46943,7 +47489,7 @@ var require_parse_proxy_response = __commonJS({
     var debug_1 = __importDefault(require_src());
     var debug = (0, debug_1.default)("https-proxy-agent:parse-proxy-response");
     function parseProxyResponse(socket) {
-      return new Promise((resolve24, reject) => {
+      return new Promise((resolve25, reject) => {
         let buffersLength = 0;
         const buffers = [];
         function read() {
@@ -47013,7 +47559,7 @@ var require_parse_proxy_response = __commonJS({
           }
           debug("got proxy server response: %o %o", firstLine, headers);
           cleanup();
-          resolve24({
+          resolve25({
             connect: {
               statusCode,
               statusText,
@@ -50692,12 +51238,12 @@ var require_socksclient = __commonJS({
     "use strict";
     var __awaiter = exports && exports.__awaiter || function(thisArg, _arguments, P, generator) {
       function adopt(value) {
-        return value instanceof P ? value : new P(function(resolve24) {
-          resolve24(value);
+        return value instanceof P ? value : new P(function(resolve25) {
+          resolve25(value);
         });
       }
       __name(adopt, "adopt");
-      return new (P || (P = Promise))(function(resolve24, reject) {
+      return new (P || (P = Promise))(function(resolve25, reject) {
         function fulfilled(value) {
           try {
             step(generator.next(value));
@@ -50715,7 +51261,7 @@ var require_socksclient = __commonJS({
         }
         __name(rejected, "rejected");
         function step(result) {
-          result.done ? resolve24(result.value) : adopt(result.value).then(fulfilled, rejected);
+          result.done ? resolve25(result.value) : adopt(result.value).then(fulfilled, rejected);
         }
         __name(step, "step");
         step((generator = generator.apply(thisArg, _arguments || [])).next());
@@ -50753,13 +51299,13 @@ var require_socksclient = __commonJS({
        * @returns { Promise }
        */
       static createConnection(options, callback) {
-        return new Promise((resolve24, reject) => {
+        return new Promise((resolve25, reject) => {
           try {
             (0, helpers_1.validateSocksClientOptions)(options, ["connect"]);
           } catch (err) {
             if (typeof callback === "function") {
               callback(err);
-              return resolve24(err);
+              return resolve25(err);
             } else {
               return reject(err);
             }
@@ -50770,16 +51316,16 @@ var require_socksclient = __commonJS({
             client.removeAllListeners();
             if (typeof callback === "function") {
               callback(null, info);
-              resolve24(info);
+              resolve25(info);
             } else {
-              resolve24(info);
+              resolve25(info);
             }
           });
           client.once("error", (err) => {
             client.removeAllListeners();
             if (typeof callback === "function") {
               callback(err);
-              resolve24(err);
+              resolve25(err);
             } else {
               reject(err);
             }
@@ -50796,13 +51342,13 @@ var require_socksclient = __commonJS({
        * @returns { Promise }
        */
       static createConnectionChain(options, callback) {
-        return new Promise((resolve24, reject) => __awaiter(this, void 0, void 0, function* () {
+        return new Promise((resolve25, reject) => __awaiter(this, void 0, void 0, function* () {
           try {
             (0, helpers_1.validateSocksClientChainOptions)(options);
           } catch (err) {
             if (typeof callback === "function") {
               callback(err);
-              return resolve24(err);
+              return resolve25(err);
             } else {
               return reject(err);
             }
@@ -50828,14 +51374,14 @@ var require_socksclient = __commonJS({
             }
             if (typeof callback === "function") {
               callback(null, { socket: sock });
-              resolve24({ socket: sock });
+              resolve25({ socket: sock });
             } else {
-              resolve24({ socket: sock });
+              resolve25({ socket: sock });
             }
           } catch (err) {
             if (typeof callback === "function") {
               callback(err);
-              resolve24(err);
+              resolve25(err);
             } else {
               reject(err);
             }
@@ -51523,12 +52069,12 @@ var require_dist6 = __commonJS({
         let { host } = opts;
         const { port, lookup: lookupFn = dns.lookup } = opts;
         if (shouldLookup) {
-          host = await new Promise((resolve24, reject) => {
+          host = await new Promise((resolve25, reject) => {
             lookupFn(host, {}, (err, res) => {
               if (err) {
                 reject(err);
               } else {
-                resolve24(res);
+                resolve25(res);
               }
             });
           });
@@ -52340,8 +52886,8 @@ var require_entry = __commonJS({
         let body = null;
         if (this.response.status === 200) {
           let cacheWriteResolve, cacheWriteReject;
-          const cacheWritePromise = new Promise((resolve24, reject) => {
-            cacheWriteResolve = resolve24;
+          const cacheWritePromise = new Promise((resolve25, reject) => {
+            cacheWriteResolve = resolve25;
             cacheWriteReject = reject;
           }).catch((err) => {
             body.emit("error", err);
@@ -53856,7 +54402,7 @@ var require_index_min = __commonJS({
 var require_lib17 = __commonJS({
   "../../node_modules/.pnpm/which@5.0.0/node_modules/which/lib/index.js"(exports, module) {
     var { isexe, sync: isexeSync } = require_index_min();
-    var { join: join25, delimiter, sep: sep4, posix: posix3 } = __require("path");
+    var { join: join26, delimiter, sep: sep4, posix: posix3 } = __require("path");
     var isWindows = process.platform === "win32";
     var rSlash = new RegExp(`[${posix3.sep}${sep4 === posix3.sep ? "" : sep4}]`.replace(/(\\)/g, "\\$1"));
     var rRel = new RegExp(`^\\.${rSlash.source}`);
@@ -53885,7 +54431,7 @@ var require_lib17 = __commonJS({
     var getPathPart = /* @__PURE__ */ __name((raw, cmd) => {
       const pathPart = /^".*"$/.test(raw) ? raw.slice(1, -1) : raw;
       const prefix = !pathPart && rRel.test(cmd) ? cmd.slice(0, 2) : "";
-      return prefix + join25(pathPart, cmd);
+      return prefix + join26(pathPart, cmd);
     }, "getPathPart");
     var which = /* @__PURE__ */ __name(async (cmd, opt = {}) => {
       const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
@@ -54008,9 +54554,9 @@ var require_lib18 = __commonJS({
       if (opts.shell) {
         return spawnWithShell(cmd, args2, opts, extra);
       }
-      let resolve24, reject;
+      let resolve25, reject;
       const promise = new Promise((_resolve, _reject) => {
-        resolve24 = _resolve;
+        resolve25 = _resolve;
         reject = _reject;
       });
       const closeError = new Error("command failed");
@@ -54043,7 +54589,7 @@ var require_lib18 = __commonJS({
         if (code || signal) {
           rejectWithOpts(closeError, { code, signal });
         } else {
-          resolve24(getResult({ code, signal }));
+          resolve25(getResult({ code, signal }));
         }
       });
       return promise;
@@ -55024,7 +55570,7 @@ var require_lib19 = __commonJS({
 // ../../node_modules/.pnpm/npm-normalize-package-bin@4.0.0/node_modules/npm-normalize-package-bin/lib/index.js
 var require_lib20 = __commonJS({
   "../../node_modules/.pnpm/npm-normalize-package-bin@4.0.0/node_modules/npm-normalize-package-bin/lib/index.js"(exports, module) {
-    var { join: join25, basename: basename10 } = __require("path");
+    var { join: join26, basename: basename10 } = __require("path");
     var normalize4 = /* @__PURE__ */ __name((pkg) => !pkg.bin ? removeBin(pkg) : typeof pkg.bin === "string" ? normalizeString(pkg) : Array.isArray(pkg.bin) ? normalizeArray(pkg) : typeof pkg.bin === "object" ? normalizeObject(pkg) : removeBin(pkg), "normalize");
     var normalizeString = /* @__PURE__ */ __name((pkg) => {
       if (!pkg.name) {
@@ -55049,11 +55595,11 @@ var require_lib20 = __commonJS({
       const clean = {};
       let hasBins = false;
       Object.keys(orig).forEach((binKey) => {
-        const base = join25("/", basename10(binKey.replace(/\\|:/g, "/"))).slice(1);
+        const base = join26("/", basename10(binKey.replace(/\\|:/g, "/"))).slice(1);
         if (typeof orig[binKey] !== "string" || !base) {
           return;
         }
-        const binTarget = join25("/", orig[binKey].replace(/\\/g, "/")).replace(/\\/g, "/").slice(1);
+        const binTarget = join26("/", orig[binKey].replace(/\\/g, "/")).replace(/\\/g, "/").slice(1);
         if (!binTarget) {
           return;
         }
@@ -57594,11 +58140,11 @@ var require_normalize = __commonJS({
 // ../../node_modules/.pnpm/@npmcli+package-json@6.2.0/node_modules/@npmcli/package-json/lib/read-package.js
 var require_read_package = __commonJS({
   "../../node_modules/.pnpm/@npmcli+package-json@6.2.0/node_modules/@npmcli/package-json/lib/read-package.js"(exports, module) {
-    var { readFile: readFile29 } = __require("fs/promises");
+    var { readFile: readFile30 } = __require("fs/promises");
     var parseJSON = require_lib16();
     async function read(filename) {
       try {
-        const data = await readFile29(filename, "utf8");
+        const data = await readFile30(filename, "utf8");
         return data;
       } catch (err) {
         err.message = `Could not read package.json: ${err}`;
@@ -57731,8 +58277,8 @@ var require_sort2 = __commonJS({
 // ../../node_modules/.pnpm/@npmcli+package-json@6.2.0/node_modules/@npmcli/package-json/lib/index.js
 var require_lib23 = __commonJS({
   "../../node_modules/.pnpm/@npmcli+package-json@6.2.0/node_modules/@npmcli/package-json/lib/index.js"(exports, module) {
-    var { readFile: readFile29, writeFile: writeFile11 } = __require("node:fs/promises");
-    var { resolve: resolve24 } = __require("node:path");
+    var { readFile: readFile30, writeFile: writeFile11 } = __require("node:fs/promises");
+    var { resolve: resolve25 } = __require("node:path");
     var parseJSON = require_lib16();
     var updateDeps = require_update_dependencies();
     var updateScripts = require_update_scripts();
@@ -57855,10 +58401,10 @@ var require_lib23 = __commonJS({
           parseErr = err;
         }
         if (parseErr) {
-          const indexFile = resolve24(this.path, "index.js");
+          const indexFile = resolve25(this.path, "index.js");
           let indexFileContent;
           try {
-            indexFileContent = await readFile29(indexFile, "utf8");
+            indexFileContent = await readFile30(indexFile, "utf8");
           } catch (err) {
             throw parseErr;
           }
@@ -57907,7 +58453,7 @@ var require_lib23 = __commonJS({
       }
       get filename() {
         if (this.path) {
-          return resolve24(this.path, "package.json");
+          return resolve25(this.path, "package.json");
         }
         return void 0;
       }
@@ -64833,12 +65379,12 @@ var require_fetcher = __commonJS({
     };
     exports.DefaultFetcher = DefaultFetcher;
     var writeBufferToStream = /* @__PURE__ */ __name(async (stream, buffer) => {
-      return new Promise((resolve24, reject) => {
+      return new Promise((resolve25, reject) => {
         stream.write(buffer, (err) => {
           if (err) {
             reject(err);
           }
-          resolve24(true);
+          resolve25(true);
         });
       });
     }, "writeBufferToStream");
@@ -65057,12 +65603,12 @@ var require_url = __commonJS({
   "../../node_modules/.pnpm/tuf-js@3.1.0/node_modules/tuf-js/dist/utils/url.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.join = join25;
+    exports.join = join26;
     var url_1 = __require("url");
-    function join25(base, path3) {
+    function join26(base, path3) {
       return new url_1.URL(ensureTrailingSlash(base) + removeLeadingSlash(path3)).toString();
     }
-    __name(join25, "join");
+    __name(join26, "join");
     function ensureTrailingSlash(path3) {
       return path3.endsWith("/") ? path3 : path3 + "/";
     }
@@ -65441,7 +65987,7 @@ var require_target = __commonJS({
     var error_1 = require_error8();
     async function readTarget(tuf, targetPath) {
       const path3 = await getTargetPath(tuf, targetPath);
-      return new Promise((resolve24, reject) => {
+      return new Promise((resolve25, reject) => {
         fs_1.default.readFile(path3, "utf-8", (err, data) => {
           if (err) {
             reject(new error_1.TUFError({
@@ -65450,7 +65996,7 @@ var require_target = __commonJS({
               cause: err
             }));
           } else {
-            resolve24(data);
+            resolve25(data);
           }
         });
       });
@@ -67167,7 +67713,7 @@ var require_dist15 = __commonJS({
 var require_provenance = __commonJS({
   "../../node_modules/.pnpm/libnpmpublish@11.1.0/node_modules/libnpmpublish/lib/provenance.js"(exports, module) {
     var sigstore = require_dist15();
-    var { readFile: readFile29 } = __require("node:fs/promises");
+    var { readFile: readFile30 } = __require("node:fs/promises");
     var ci = require_ci_info();
     var { env } = process;
     var INTOTO_PAYLOAD_TYPE = "application/vnd.in-toto+json";
@@ -67359,7 +67905,7 @@ var require_provenance = __commonJS({
     var verifyProvenance = /* @__PURE__ */ __name(async (subject, provenancePath) => {
       let provenanceBundle;
       try {
-        provenanceBundle = JSON.parse(await readFile29(provenancePath));
+        provenanceBundle = JSON.parse(await readFile30(provenancePath));
       } catch (err) {
         err.message = `Invalid provenance provided: ${err.message}`;
         throw err;
@@ -67698,9 +68244,9 @@ import { createHash as createHash9, randomUUID } from "node:crypto";
 import { execFile as execFileCb6, spawn as spawn3 } from "node:child_process";
 import { gunzipSync } from "node:zlib";
 import { promisify as promisify6 } from "node:util";
-import { dirname as dirname7, isAbsolute as isAbsolute10, join as join10, relative as relative12, resolve as resolve14 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute11, join as join11, relative as relative13, resolve as resolve15 } from "node:path";
 import { constants as fsConstants4 } from "node:fs";
-import { chmod as chmod3, lstat as lstat9, mkdtemp as mkdtemp2, open as open6, readFile as readFile12, realpath as realpath9, rm as rm5 } from "node:fs/promises";
+import { chmod as chmod3, lstat as lstat9, mkdtemp as mkdtemp2, open as open6, readFile as readFile13, realpath as realpath9, rm as rm5 } from "node:fs/promises";
 function validatePackageName(value) {
   if (typeof value !== "string" || value.length > 214 || !SAFE_PACKAGE_NAME.test(value)) {
     throw new Error("npm package must be a safe lowercase package name or @scope/name");
@@ -67754,7 +68300,7 @@ function expandNpmrcValue(raw, env) {
 async function tokensFromNpmrc(path3, key, env) {
   let contents;
   try {
-    contents = await readFile12(path3, "utf8");
+    contents = await readFile13(path3, "utf8");
   } catch (err) {
     if (err?.code === "ENOENT") return [];
     throw new Error("cannot read npm authentication config");
@@ -67777,7 +68323,7 @@ async function defaultResolveAuthToken({ registry, cwd, exec, env = process.env
     if (env[name]) candidates.push(env[name]);
   }
   const key = registryTokenKey(registry);
-  candidates.push(...await tokensFromNpmrc(join10(cwd, ".npmrc"), key, env));
+  candidates.push(...await tokensFromNpmrc(join11(cwd, ".npmrc"), key, env));
   const npmUserConfigKey = ["npm", "config", "userconfig"].join("_");
   const userConfig = env[npmUserConfigKey] ?? (await exec("npm", ["config", "get", "userconfig"], { cwd, shell: false })).stdout.trim();
   if (userConfig) candidates.push(...await tokensFromNpmrc(userConfig, key, env));
@@ -67806,10 +68352,10 @@ async function defaultWhoamiWithToken({ registry, token, cwd, exec }) {
 }
 function resolvePackageCwd(cwd, root) {
   if (!cwd || typeof cwd !== "string") throw new Error("NPM_PUBLISH requires a non-empty action.cwd (package directory)");
-  const rootPath = resolve14(root);
-  const packagePath = resolve14(root, cwd);
-  const rel = relative12(rootPath, packagePath);
-  if (isAbsolute10(rel) || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)) {
+  const rootPath = resolve15(root);
+  const packagePath = resolve15(root, cwd);
+  const rel = relative13(rootPath, packagePath);
+  if (isAbsolute11(rel) || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)) {
     throw new Error(`cwd "${cwd}" is outside project root "${root}"`);
   }
   return packagePath;
@@ -67822,12 +68368,12 @@ ${error?.message ?? ""}`;
   return /\bE404\b|\b404\b.*not found|not found.*\b404\b/i.test(text);
 }
 async function readVerifiedTarballBytes(action, root) {
-  if (!action.tarballPath || isAbsolute10(action.tarballPath)) throw new Error("tarballPath must be project-relative");
+  if (!action.tarballPath || isAbsolute11(action.tarballPath)) throw new Error("tarballPath must be project-relative");
   if (!/^[a-f0-9]{64}$/.test(action.tarballSha256 ?? "")) throw new Error("tarballSha256 must be a lowercase SHA-256 digest");
   const rootReal = await realpath9(root);
-  const lexical = resolve14(rootReal, action.tarballPath);
-  const rel = relative12(rootReal, lexical);
-  if (isAbsolute10(rel) || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)) {
+  const lexical = resolve15(rootReal, action.tarballPath);
+  const rel = relative13(rootReal, lexical);
+  if (isAbsolute11(rel) || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)) {
     throw new Error("tarballPath escapes project root");
   }
   const before = await lstat9(lexical);
@@ -68096,7 +68642,7 @@ function createNpmAdapter(deps = {}) {
             throw new Error("npm bearer authentication does not match the frozen registry and publisher");
           }
           if (typeof beforeBufferPublishHook === "function") {
-            await beforeBufferPublishHook(resolve14(context.root, action.tarballPath));
+            await beforeBufferPublishHook(resolve15(context.root, action.tarballPath));
           }
           try {
             await publishTarballBuffer({
@@ -68258,11 +68804,11 @@ var init_npm = __esm({
 });
 
 // src/core/run.mjs
-import { link as link2, lstat as lstat10, mkdir as mkdir10, open as open7, readFile as readFile13, unlink as unlink3 } from "node:fs/promises";
+import { link as link2, lstat as lstat10, mkdir as mkdir11, open as open7, readFile as readFile14, unlink as unlink3 } from "node:fs/promises";
 import { realpathSync as realpathSync3 } from "node:fs";
-import { dirname as dirname8, join as join11, resolve as resolve15, basename as basename4, relative as relative13, isAbsolute as isAbsolute11 } from "node:path";
+import { dirname as dirname8, join as join12, resolve as resolve16, basename as basename4, relative as relative14, isAbsolute as isAbsolute12 } from "node:path";
 function resolveDefaultRunDir(planPath, command2, runId = `${command2}-${Date.now()}`) {
-  const absolute = resolve15(planPath);
+  const absolute = resolve16(planPath);
   const fileName = basename4(absolute);
   const parentDir = dirname8(absolute);
   if (fileName === "release-plan.json") {
@@ -68270,7 +68816,7 @@ function resolveDefaultRunDir(planPath, command2, runId = `${command2}-${Date.no
   }
   if (basename4(parentDir) === "plans") {
     const releaseDir = dirname8(parentDir);
-    return join11(releaseDir, "runs", runId);
+    return join12(releaseDir, "runs", runId);
   }
   return `${parentDir}/runs/${runId}`;
 }
@@ -68310,7 +68856,7 @@ function validateRun(run5, options = {}) {
 async function loadRun(runPath, options = {}) {
   let raw;
   try {
-    raw = await readFile13(runPath, "utf8");
+    raw = await readFile14(runPath, "utf8");
   } catch (err) {
     throw new ReleaseError(
       GATE_FAILED,
@@ -68335,7 +68881,7 @@ async function loadRun(runPath, options = {}) {
   return run5;
 }
 function assertImmutableRunAuthority(runPath, planPath, run5) {
-  const absolutePlan = realpathSync3(resolve15(planPath));
+  const absolutePlan = realpathSync3(resolve16(planPath));
   const planDir = dirname8(absolutePlan);
   if (basename4(planDir) !== "plans") {
     throw new ReleaseError(GATE_FAILED, "run authority requires an immutable plans/<digest>.json plan path");
@@ -68349,10 +68895,10 @@ function assertImmutableRunAuthority(runPath, planPath, run5) {
     }
     cursor = dirname8(cursor);
   }
-  const runsDir = join11(authorityRoot, "runs");
-  const absoluteRun = realpathSync3(resolve15(runPath));
-  const rel = relative13(runsDir, absoluteRun);
-  if (isAbsolute11(rel) || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)) {
+  const runsDir = join12(authorityRoot, "runs");
+  const absoluteRun = realpathSync3(resolve16(runPath));
+  const rel = relative14(runsDir, absoluteRun);
+  if (isAbsolute12(rel) || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)) {
     throw new ReleaseError(GATE_FAILED, "production run authority must be inside the plan sibling runs/ directory");
   }
   const fileName = basename4(absoluteRun);
@@ -68367,7 +68913,7 @@ function assertImmutableRunAuthority(runPath, planPath, run5) {
   }
 }
 async function createProductionRunDir(runDir, planPath) {
-  const absolutePlan = realpathSync3(resolve15(planPath));
+  const absolutePlan = realpathSync3(resolve16(planPath));
   const planDir = dirname8(absolutePlan);
   if (basename4(planDir) !== "plans") {
     throw new ReleaseError(GATE_FAILED, "production run directory requires an immutable plans/<digest>.json authority");
@@ -68376,7 +68922,7 @@ async function createProductionRunDir(runDir, planPath) {
   return createProductionRunDirWithinAuthority(runDir, authorityRoot);
 }
 async function createProductionPrepareRunDir(runDir, releaseDir) {
-  const authorityRoot = resolve15(releaseDir);
+  const authorityRoot = resolve16(releaseDir);
   let authorityStat;
   try {
     authorityStat = await lstat10(authorityRoot);
@@ -68404,7 +68950,7 @@ async function createProductionPrepareRunDir(runDir, releaseDir) {
   return createProductionRunDirWithinAuthority(runDir, physicalAuthorityRoot);
 }
 async function createProductionRunDirWithinAuthority(runDir, authorityRoot) {
-  const runsDir = join11(authorityRoot, "runs");
+  const runsDir = join12(authorityRoot, "runs");
   let runsStat;
   try {
     runsStat = await lstat10(runsDir);
@@ -68416,7 +68962,7 @@ async function createProductionRunDirWithinAuthority(runDir, authorityRoot) {
       });
     }
     try {
-      await mkdir10(runsDir, { mode: 448 });
+      await mkdir11(runsDir, { mode: 448 });
     } catch (mkdirError) {
       if (mkdirError.code !== "EEXIST") {
         throw new ReleaseError(GATE_FAILED, "cannot create production runs authority root", {
@@ -68442,7 +68988,7 @@ async function createProductionRunDirWithinAuthority(runDir, authorityRoot) {
       { runsDir, physicalRunsDir }
     );
   }
-  const requested = resolve15(runDir);
+  const requested = resolve16(runDir);
   let physicalParent;
   try {
     physicalParent = realpathSync3(dirname8(requested));
@@ -68472,7 +69018,7 @@ async function createProductionRunDirWithinAuthority(runDir, authorityRoot) {
     }
   }
   try {
-    await mkdir10(requested, { mode: 448 });
+    await mkdir11(requested, { mode: 448 });
   } catch (error) {
     throw new ReleaseError(GATE_FAILED, "cannot exclusively create production run directory", {
       runDir,
@@ -68493,7 +69039,7 @@ async function validateStatePredecessorChain(run5, runPath, options = {}) {
     return;
   }
   let current = run5;
-  let currentPath = realpathSync3(resolve15(runPath));
+  let currentPath = realpathSync3(resolve16(runPath));
   let traversed = 0;
   while (true) {
     const sequence = current.stateSequence;
@@ -68514,7 +69060,7 @@ async function validateStatePredecessorChain(run5, runPath, options = {}) {
     if (traversed > 1e5) {
       throw new ReleaseError(GATE_FAILED, "run state predecessor chain exceeds maximum depth");
     }
-    const previousPath = join11(dirname8(currentPath), `${String(sequence - 1).padStart(6, "0")}.json`);
+    const previousPath = join12(dirname8(currentPath), `${String(sequence - 1).padStart(6, "0")}.json`);
     const previous = await loadRun(previousPath, {
       requireDigest: true,
       ...options.production ? { authorityPlanPath: options.planPath } : {}
@@ -68607,7 +69153,7 @@ function validateRunPlanDigest(run5, plan, options = {}) {
       { runDigest: run5.planDigest, planDigest: expectedDigest }
     );
   }
-  if (plan.production && run5.planPath && options.planPath && resolve15(run5.planPath) !== resolve15(options.planPath)) {
+  if (plan.production && run5.planPath && options.planPath && resolve16(run5.planPath) !== resolve16(options.planPath)) {
     throw new ReleaseError(
       GATE_FAILED,
       "source run immutable plan path does not match the supplied plan authority",
@@ -68691,7 +69237,7 @@ async function writeRunAtomic(runPath, run5) {
   const json = JSON.stringify(sealed, null, 2);
   const dir = dirname8(runPath);
   const tmpPath = `${dir}/.release-run-${Date.now()}-${Math.random().toString(36).slice(2)}.tmp`;
-  await mkdir10(dir, { recursive: true });
+  await mkdir11(dir, { recursive: true });
   const handle = await open7(tmpPath, "wx", 384);
   try {
     await handle.writeFile(json, "utf8");
@@ -68705,7 +69251,7 @@ async function writeRunAtomic(runPath, run5) {
       await syncDirectory(dir);
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
-      const existing = await readFile13(runPath, "utf8");
+      const existing = await readFile14(runPath, "utf8");
       if (existing !== json) {
         throw new ReleaseError(
           GATE_FAILED,
@@ -68724,10 +69270,10 @@ async function appendRunState(runDir, sequence, run5) {
   if (!Number.isSafeInteger(sequence) || sequence < 0) {
     throw new ReleaseError(GATE_FAILED, "run state sequence must be a non-negative integer");
   }
-  const statesDir = join11(runDir, "states");
+  const statesDir = join12(runDir, "states");
   let previousStateDigest;
   if (sequence > 0) {
-    const previousPath = join11(statesDir, `${String(sequence - 1).padStart(6, "0")}.json`);
+    const previousPath = join12(statesDir, `${String(sequence - 1).padStart(6, "0")}.json`);
     const previous = await loadRun(previousPath, { requireDigest: true });
     if (previous.stateSequence !== sequence - 1 || previous.runId !== run5.runId || previous.command !== run5.command || previous.planDigest !== run5.planDigest) {
       throw new ReleaseError(
@@ -68744,7 +69290,7 @@ async function appendRunState(runDir, sequence, run5) {
     stateSequence: sequence,
     ...previousStateDigest ? { previousStateDigest } : {}
   });
-  const statePath = join11(statesDir, `${String(sequence).padStart(6, "0")}.json`);
+  const statePath = join12(statesDir, `${String(sequence).padStart(6, "0")}.json`);
   await writeRunAtomic(statePath, state);
   return Object.freeze({ state, statePath });
 }
@@ -68784,8 +69330,8 @@ var init_run = __esm({
 });
 
 // src/artifacts/transaction-journal.mjs
-import { readdir as readdir8, readFile as readFile14, rm as rm6, stat as stat4 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { readdir as readdir8, readFile as readFile15, rm as rm6, stat as stat4 } from "node:fs/promises";
+import { join as join13 } from "node:path";
 function failSchema(message, details) {
   throw new ReleaseError(TRANSACTION_INCOMPLETE, message, details);
 }
@@ -69792,11 +70338,11 @@ async function pruneTerminalTransactionRecords(transactionsRoot, {
     if (txnDirs.length <= retentionMax) return summary;
     const terminal = [];
     for (const entry of txnDirs) {
-      const recordDir = join12(transactionsRoot, entry.name);
+      const recordDir = join13(transactionsRoot, entry.name);
       let state = null;
       let createdAt = null;
       try {
-        const raw = await readFile14(join12(recordDir, "journal.json"), "utf8");
+        const raw = await readFile15(join13(recordDir, "journal.json"), "utf8");
         const journal = JSON.parse(raw);
         if (journal && typeof journal === "object") {
           state = typeof journal.state === "string" ? journal.state : null;
@@ -69860,7 +70406,7 @@ async function createTransactionJournal({
     );
     if (typeof root === "string" && root.length > 0) {
       await pruneTerminalTransactionRecords(
-        join12(root, ".release-skill", "transactions"),
+        join13(root, ".release-skill", "transactions"),
         { retentionMax }
       );
     }
@@ -70224,7 +70770,7 @@ __export(transaction_exports, {
   applyWriteSetUnderLock: () => applyWriteSetUnderLock
 });
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { relative as relative14 } from "node:path";
+import { relative as relative15 } from "node:path";
 function computeCanonicalPlanDigest(plan) {
   const { planDigest: _ignored, ...content } = plan;
   return `sha256:${sha256Hex(canonicalJson(content))}`;
@@ -71137,7 +71683,7 @@ async function applyArtifactPlanUnderLock({
   }
   const handle = await safeFs.openRoot(root);
   try {
-    const relPlanPath = canonicalArtifactPath(relative14(root, planPath)).path;
+    const relPlanPath = canonicalArtifactPath(relative15(root, planPath)).path;
     const planFileData = await withParentHandle(handle, relPlanPath, async (parent, leaf) => {
       const planEntry = await parent.readEntry(leaf);
       if (!planEntry || planEntry.kind === "absent") {
@@ -73552,7 +74098,7 @@ __export(refresh_service_exports, {
   planReleaseDocsRefreshForUnit: () => planReleaseDocsRefreshForUnit,
   runReleaseDocsRefresh: () => runReleaseDocsRefresh
 });
-import { isAbsolute as isAbsolute12, relative as relative15, resolve as resolve16, sep as sep3 } from "node:path";
+import { isAbsolute as isAbsolute13, relative as relative16, resolve as resolve17, sep as sep3 } from "node:path";
 function deepFreeze6(value) {
   if (Array.isArray(value)) {
     for (const item of value) deepFreeze6(item);
@@ -73635,7 +74181,7 @@ async function planReleaseDocsRefreshForUnit({
       field: "unit.source"
     });
   }
-  const unitRoot = resolve16(root, unit.source);
+  const unitRoot = resolve17(root, unit.source);
   const backend = await (backendFactory ?? loadSafeFs)();
   const sharedFactory = /* @__PURE__ */ __name(async () => backend, "sharedFactory");
   const notesSource = await loadReleaseNotesSource({
@@ -73845,9 +74391,9 @@ async function runReleaseDocsRefresh({
         });
       }
       const changedFiles = plan.files.filter((file) => file.changed);
-      const unitRoot = resolve16(root, unit.source);
-      const unitLocation = relative15(root, unitRoot);
-      if (unitLocation === ".." || unitLocation.startsWith(`..${sep3}`) || isAbsolute12(unitLocation)) {
+      const unitRoot = resolve17(root, unit.source);
+      const unitLocation = relative16(root, unitRoot);
+      if (unitLocation === ".." || unitLocation.startsWith(`..${sep3}`) || isAbsolute13(unitLocation)) {
         throw new ReleaseError(
           PATH_UNSAFE,
           "release unit source escapes the project root",
@@ -73905,7 +74451,7 @@ async function runReleaseDocsRefresh({
         if (err instanceof ReleaseError && err.code === TRANSACTION_INCOMPLETE && typeof err.details?.recover === "string") {
           const restored = await tryRestoreOldBytes(
             backend,
-            resolve16(root, unit.source),
+            resolve17(root, unit.source),
             changedFiles,
             modes
           );
@@ -73995,14 +74541,18 @@ var init_refresh_service = __esm({
 // src/commands/prepare.mjs
 var prepare_exports = {};
 __export(prepare_exports, {
+  buildExternalActions: () => buildExternalActions,
+  decodeExternalMarketplaceIndex: () => decodeExternalMarketplaceIndex,
+  parseExternalMarketplaceLsRemote: () => parseExternalMarketplaceLsRemote,
   prepareRelease: () => prepareRelease,
   readHeadCommitTimestamp: () => readHeadCommitTimestamp,
   resolveAllUnitVersions: () => resolveAllUnitVersions,
+  resolveExternalMarketplaceFreezes: () => resolveExternalMarketplaceFreezes,
   resolveUnitVersion: () => resolveUnitVersion,
   runDeclaredHooks: () => runDeclaredHooks
 });
-import { resolve as resolve17, relative as relative16, isAbsolute as isAbsolute13, normalize as normalize3, dirname as dirname9 } from "node:path";
-import { readFile as readFile15, mkdir as mkdir11, realpath as realpath10 } from "node:fs/promises";
+import { resolve as resolve18, relative as relative17, isAbsolute as isAbsolute14, normalize as normalize3, dirname as dirname9 } from "node:path";
+import { readFile as readFile16, mkdir as mkdir12, realpath as realpath10 } from "node:fs/promises";
 import { execFile as execFileCb7 } from "node:child_process";
 import { promisify as promisify7 } from "node:util";
 async function resolveUnitVersion(unit, root, explicitVersion) {
@@ -74014,18 +74564,18 @@ async function resolveUnitVersion(unit, root, explicitVersion) {
       { unitId: unit.id }
     );
   }
-  if (isAbsolute13(versionSource)) {
+  if (isAbsolute14(versionSource)) {
     throw new ReleaseError(
       CONFIG_INVALID,
       `unit "${unit.id}" version.source must be a relative path, got absolute: "${versionSource}"`,
       { unitId: unit.id, versionSource }
     );
   }
-  const unitRoot = resolve17(root, unit.source);
-  const resolvedPath = resolve17(unitRoot, versionSource);
+  const unitRoot = resolve18(root, unit.source);
+  const resolvedPath = resolve18(unitRoot, versionSource);
   const normalizedPath = normalize3(resolvedPath);
-  const rel = relative16(unitRoot, normalizedPath);
-  if (rel.startsWith("..") || rel === ".." || isAbsolute13(rel)) {
+  const rel = relative17(unitRoot, normalizedPath);
+  if (rel.startsWith("..") || rel === ".." || isAbsolute14(rel)) {
     throw new ReleaseError(
       CONFIG_INVALID,
       `unit "${unit.id}" version.source escapes unit root: "${versionSource}"`,
@@ -74034,7 +74584,7 @@ async function resolveUnitVersion(unit, root, explicitVersion) {
   }
   let content;
   try {
-    content = await readFile15(normalizedPath, "utf8");
+    content = await readFile16(normalizedPath, "utf8");
   } catch (err) {
     throw new ReleaseError(
       CONFIG_INVALID,
@@ -74324,7 +74874,7 @@ async function processSnapshots(config, root, evidence, runDir, production = fal
   const unitResults = [];
   const snapshotDigests = [];
   for (const unit of units) {
-    const outputDir = resolveUnitScopedPath(resolve17(runDir, "snapshots"), unit.id);
+    const outputDir = resolveUnitScopedPath(resolve18(runDir, "snapshots"), unit.id);
     await evidence.append({
       phase: "snapshot",
       status: "started",
@@ -74552,7 +75102,7 @@ async function buildProductionAssets(unitResults, resolvedVersions, root, runDir
     const { unit, manifest } = unitResults[index];
     const version = resolvedVersions[index];
     const { tag, branch, branchStrategy } = resolveProductionBranch(unit, version);
-    const snapshotPath = relative16(root, manifest.outputDir);
+    const snapshotPath = relative17(root, manifest.outputDir);
     const observed = await computeFrozenSnapshot(manifest.outputDir);
     if (observed.digest !== manifest.snapshotDigest) {
       throw new ReleaseError(
@@ -74563,7 +75113,7 @@ async function buildProductionAssets(unitResults, resolvedVersions, root, runDir
     }
     await sealFrozenSnapshot(manifest.outputDir);
     const sealed = await computeFrozenSnapshot(manifest.outputDir);
-    const repositoryDir = resolveUnitScopedPath(resolve17(runDir, "git"), unit.id, { suffix: ".git" });
+    const repositoryDir = resolveUnitScopedPath(resolve18(runDir, "git"), unit.id, { suffix: ".git" });
     const unitBaseline = unitBaselineResults.get(unit.id);
     const parent = branchStrategy === "create-release-branch" ? void 0 : {
       githubHost: unitBaseline.githubHost,
@@ -74584,13 +75134,13 @@ async function buildProductionAssets(unitResults, resolvedVersions, root, runDir
     if (npmDistribution) {
       npm = await buildFrozenNpmTarball({
         snapshotDir: manifest.outputDir,
-        tarballDir: resolveUnitScopedPath(resolve17(runDir, "tarballs"), unit.id),
+        tarballDir: resolveUnitScopedPath(resolve18(runDir, "tarballs"), unit.id),
         expectedSnapshotDigest: sealed.digest
       });
       await verifyFrozenNpmTarballIdentity({
         package: npmDistribution.package,
         version,
-        tarballPath: relative16(root, npm.tarballPath),
+        tarballPath: relative17(root, npm.tarballPath),
         tarballSha256: npm.sha256,
         integrity: npm.integrity
       }, root);
@@ -74598,7 +75148,7 @@ async function buildProductionAssets(unitResults, resolvedVersions, root, runDir
     assets.push({
       snapshotPath,
       manifestDigest: sealed.digest,
-      gitObjectDir: relative16(root, repositoryDir),
+      gitObjectDir: relative17(root, repositoryDir),
       commit: git2.commit,
       tree: git2.tree,
       commitTimestamp: canonicalFreezeTimestamp,
@@ -74607,7 +75157,7 @@ async function buildProductionAssets(unitResults, resolvedVersions, root, runDir
       branch,
       tag,
       npm: npm ? {
-        tarballPath: relative16(root, npm.tarballPath),
+        tarballPath: relative17(root, npm.tarballPath),
         tarballSha256: npm.sha256,
         integrity: npm.integrity,
         size: npm.size
@@ -74616,7 +75166,167 @@ async function buildProductionAssets(unitResults, resolvedVersions, root, runDir
   }
   return assets;
 }
-function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
+function parseExternalMarketplaceLsRemote(stdout) {
+  if (typeof stdout !== "string") return null;
+  const lines = stdout.trim().split("\n").filter((line) => line.length > 0);
+  let defaultBranch = null;
+  let sha = null;
+  for (const line of lines) {
+    const tabIndex = line.indexOf("	");
+    if (tabIndex < 0) continue;
+    const left = line.slice(0, tabIndex);
+    const right = line.slice(tabIndex + 1);
+    if (right !== "HEAD") continue;
+    if (left.startsWith("ref: refs/heads/")) {
+      defaultBranch = left.slice("ref: refs/heads/".length);
+    } else if (EXTERNAL_MARKETPLACE_SHA_RE2.test(left)) {
+      sha = left;
+    }
+  }
+  if (!sha || !defaultBranch) return null;
+  return { sha, defaultBranch };
+}
+function decodeExternalMarketplaceIndex(base64Content) {
+  if (typeof base64Content !== "string") return null;
+  try {
+    const base64 = base64Content.replace(/\s/g, "");
+    const content = Buffer.from(base64, "base64").toString("utf8");
+    const parsed = JSON.parse(content);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function defaultObserveExternalMarketplaceHead(repo, { githubHost = "github.com" } = {}) {
+  try {
+    const { stdout } = await execFile6(
+      "git",
+      ["ls-remote", "--symref", `https://${githubHost}/${repo}.git`, "HEAD"],
+      { shell: false, encoding: "utf8", timeout: 3e4 }
+    );
+    const parsed = parseExternalMarketplaceLsRemote(stdout);
+    if (!parsed) {
+      return { status: "unknown", error: "could not resolve HEAD commit sha and default branch from ls-remote --symref output" };
+    }
+    return { status: "observed", sha: parsed.sha, defaultBranch: parsed.defaultBranch };
+  } catch (error) {
+    return { status: "unknown", error: error.message };
+  }
+}
+async function defaultFetchExternalMarketplaceIndex(repo, manifestPath, ref, { githubHost = "github.com" } = {}) {
+  try {
+    const { stdout } = await execFile6(
+      "gh",
+      ["api", `repos/${repo}/contents/${manifestPath}?ref=${ref}`, "--jq", ".content"],
+      {
+        shell: false,
+        encoding: "utf8",
+        timeout: 3e4,
+        env: { ...process.env, GH_HOST: githubHost }
+      }
+    );
+    const index = decodeExternalMarketplaceIndex(stdout);
+    if (!index) {
+      return { status: "unknown", error: "could not decode external marketplace index content" };
+    }
+    return { status: "fetched", index };
+  } catch (error) {
+    return { status: "unknown", error: error.message };
+  }
+}
+async function resolveExternalMarketplaceFreezes({
+  unitResults,
+  resolvedVersions,
+  offline,
+  evidence,
+  observeHeadFn,
+  fetchIndexFn
+}) {
+  const freezes = /* @__PURE__ */ new Map();
+  for (let index = 0; index < unitResults.length; index += 1) {
+    const { unit } = unitResults[index];
+    const version = resolvedVersions[index];
+    const githubHost = unit.production?.githubHost ?? "github.com";
+    for (const dist of unit.distributions ?? []) {
+      if (dist.marketplaceRepo === void 0 || dist.marketplaceRepo === null) continue;
+      const platform = PLATFORMS.find((p) => p.distributionType === dist.type);
+      if (!platform || platform.marketplaceRefForm === null) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `unit "${unit.id}" ${dist.type} distribution declares marketplaceRepo but the platform has no marketplace add capability`,
+          { unitId: unit.id, distributionType: dist.type }
+        );
+      }
+      if (offline) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `unit "${unit.id}" ${dist.type} external marketplace form requires online production prepare to freeze the marketplace commit sha`,
+          { unitId: unit.id, marketplaceRepo: dist.marketplaceRepo }
+        );
+      }
+      const observed = await observeHeadFn(dist.marketplaceRepo, { githubHost });
+      if (observed.status !== "observed" || !EXTERNAL_MARKETPLACE_SHA_RE2.test(observed.sha ?? "") || !observed.defaultBranch) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `unit "${unit.id}" could not freeze external marketplace "${dist.marketplaceRepo}" HEAD: ${observed.error ?? "unknown"}`,
+          { unitId: unit.id, marketplaceRepo: dist.marketplaceRepo }
+        );
+      }
+      const sha = observed.sha;
+      const manifestPath = platform.manifestPaths.marketplace;
+      const fetched = await fetchIndexFn(dist.marketplaceRepo, manifestPath, sha, { githubHost });
+      if (fetched.status !== "fetched" || !fetched.index || typeof fetched.index !== "object") {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `unit "${unit.id}" could not read external marketplace index for "${dist.marketplaceRepo}" at ${sha}: ${fetched.error ?? "unknown"}`,
+          { unitId: unit.id, marketplaceRepo: dist.marketplaceRepo }
+        );
+      }
+      const marketplaceIndex = fetched.index;
+      if (marketplaceIndex.name !== dist.marketplace) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `unit "${unit.id}" external marketplace index name "${marketplaceIndex.name}" does not match distribution marketplace "${dist.marketplace}"`,
+          { unitId: unit.id, marketplaceRepo: dist.marketplaceRepo }
+        );
+      }
+      const pluginEntries = Array.isArray(marketplaceIndex.plugins) ? marketplaceIndex.plugins.filter((entry) => entry && entry.name === dist.plugin) : [];
+      if (pluginEntries.length !== 1) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `unit "${unit.id}" external marketplace index must contain exactly one plugin entry named "${dist.plugin}", found ${pluginEntries.length}`,
+          { unitId: unit.id, marketplaceRepo: dist.marketplaceRepo }
+        );
+      }
+      if (platform.marketplaceEntryCarriesVersion && pluginEntries[0].version !== version) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `unit "${unit.id}" external marketplace index entry version "${pluginEntries[0].version}" does not match target version "${version}"`,
+          { unitId: unit.id, marketplaceRepo: dist.marketplaceRepo }
+        );
+      }
+      const ref = platform.marketplaceRefForm === "sha" ? sha : observed.defaultBranch;
+      freezes.set(`${unit.id} ${dist.type}`, {
+        repo: dist.marketplaceRepo,
+        ref,
+        marketplaceCommitSha: sha,
+        marketplace: dist.marketplace
+      });
+      await evidence.append({
+        phase: "external-marketplace-freeze",
+        unitId: unit.id,
+        distributionType: dist.type,
+        status: "completed",
+        marketplaceRepo: dist.marketplaceRepo,
+        marketplaceCommitSha: sha,
+        defaultBranch: observed.defaultBranch,
+        addRef: ref
+      });
+    }
+  }
+  return freezes;
+}
+function buildExternalActions(unitResults, resolvedVersions, productionAssets, externalFreezes = /* @__PURE__ */ new Map()) {
   const actions = [];
   if (!productionAssets) {
     for (let index = 0; index < unitResults.length; index += 1) {
@@ -74677,6 +75387,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
         if (!dist) continue;
         const requiresMarketplace = platform.schemaRequiredFields.includes("marketplace");
         const timeoutMs = Number.isInteger(dist.timeoutMs) ? dist.timeoutMs : 3e5;
+        const externalMarketplace = dist.marketplaceRepo !== void 0 && dist.marketplaceRepo !== null;
         actions.push({
           id: `${platform.actionType}-${unit.id}`,
           type: platform.actionType,
@@ -74686,7 +75397,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
             consumer: platform.id,
             plugin: dist.plugin,
             ...requiresMarketplace ? { marketplace: dist.marketplace } : {},
-            repo: unit.publicRepo,
+            repo: externalMarketplace ? dist.marketplaceRepo : unit.publicRepo,
             version,
             entrySkill: dist.entrySkill,
             timeoutMs,
@@ -74694,14 +75405,18 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
             // payload is verified by declared-manifest containment; host-added
             // files are recorded, not failed. Frozen plans without this marker
             // keep the legacy full-tree equality semantics byte-for-byte.
-            payloadContract: "declared-manifest-v1"
+            // External marketplace form uses the external-marketplace-v1
+            // contract (whole-tree '.' containment; see plugin-marketplace).
+            payloadContract: externalMarketplace ? "external-marketplace-v1" : "declared-manifest-v1",
+            ...externalMarketplace ? { marketplaceLocation: "external" } : {}
           },
           expected: {
             installed: true,
             plugin: dist.plugin,
             ...requiresMarketplace ? { marketplace: dist.marketplace } : {},
             version,
-            entrySkill: dist.entrySkill
+            entrySkill: dist.entrySkill,
+            ...externalMarketplace ? { marketplaceLocation: "external", repo: dist.marketplaceRepo } : {}
           },
           status: "PENDING"
         });
@@ -74836,6 +75551,8 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
       if (!dist) continue;
       const requiresMarketplace = platform.schemaRequiredFields.includes("marketplace");
       const timeoutMs = Number.isInteger(dist.timeoutMs) ? dist.timeoutMs : 3e5;
+      const externalMarketplace = dist.marketplaceRepo !== void 0 && dist.marketplaceRepo !== null;
+      const freeze = externalMarketplace ? externalFreezes.get(`${unit.id} ${dist.type}`) : null;
       actions.push({
         id: `${platform.actionType}-${unit.id}`,
         type: platform.actionType,
@@ -74845,8 +75562,8 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
           consumer: platform.id,
           plugin: dist.plugin,
           ...requiresMarketplace ? { marketplace: dist.marketplace } : {},
-          repo: unit.publicRepo,
-          ref: resolvedTag,
+          repo: externalMarketplace ? dist.marketplaceRepo : unit.publicRepo,
+          ref: externalMarketplace ? freeze.ref : resolvedTag,
           version: unitVersion,
           entrySkill: dist.entrySkill,
           snapshotPath: asset.snapshotPath,
@@ -74856,19 +75573,23 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
           // payload is verified by declared-manifest containment; host-added
           // files are recorded, not failed. Frozen plans without this marker
           // keep the legacy full-tree equality semantics byte-for-byte.
-          payloadContract: "declared-manifest-v1"
+          // External marketplace form uses the external-marketplace-v1
+          // contract (whole-tree '.' containment; see plugin-marketplace).
+          payloadContract: externalMarketplace ? "external-marketplace-v1" : "declared-manifest-v1",
+          ...externalMarketplace ? { marketplaceLocation: "external", marketplaceCommitSha: freeze.marketplaceCommitSha } : {}
         },
         expected: {
           installed: true,
           consumer: platform.id,
           plugin: dist.plugin,
           ...requiresMarketplace ? { marketplace: dist.marketplace } : {},
-          repo: unit.publicRepo,
+          repo: externalMarketplace ? dist.marketplaceRepo : unit.publicRepo,
           version: unitVersion,
-          ref: resolvedTag,
+          ref: externalMarketplace ? freeze.ref : resolvedTag,
           entrySkill: dist.entrySkill,
           entrySkillFound: true,
-          manifestDigest: asset.manifestDigest
+          manifestDigest: asset.manifestDigest,
+          ...externalMarketplace ? { marketplaceLocation: "external", marketplaceCommitSha: freeze.marketplaceCommitSha } : {}
         },
         status: "PENDING"
       });
@@ -74903,25 +75624,25 @@ async function prepareRelease(options) {
     );
   }
   if (production) {
-    const canonicalOutput = resolve17(realRoot, ".release-skill", "release-plan.json");
-    if (output && resolve17(output) !== canonicalOutput) {
+    const canonicalOutput = resolve18(realRoot, ".release-skill", "release-plan.json");
+    if (output && resolve18(output) !== canonicalOutput) {
       throw new ReleaseError(
         GATE_FAILED,
         "production prepare requires the canonical .release-skill/release-plan.json output; custom --output is supported only outside production",
-        { output: resolve17(output), expected: canonicalOutput }
+        { output: resolve18(output), expected: canonicalOutput }
       );
     }
   }
   const lock = await acquireProjectLock({ root: realRoot, command: "prepare", mode: "exclusive" });
-  const releaseDir = resolve17(realRoot, ".release-skill");
+  const releaseDir = resolve18(realRoot, ".release-skill");
   const runId = `prepare-${Date.now()}`;
-  const rawRunDir = runDirOpt ?? resolve17(releaseDir, "runs", runId);
+  const rawRunDir = runDirOpt ?? resolve18(releaseDir, "runs", runId);
   let runDir;
   try {
     if (production) {
       runDir = await createProductionPrepareRunDir(rawRunDir, releaseDir);
     } else {
-      await mkdir11(rawRunDir, { recursive: true });
+      await mkdir12(rawRunDir, { recursive: true });
       runDir = await realpath10(rawRunDir);
     }
   } catch (error) {
@@ -74936,7 +75657,7 @@ async function prepareRelease(options) {
     await evidence.append({
       phase: "config",
       status: "completed",
-      configPath: relative16(realRoot, configPath),
+      configPath: relative17(realRoot, configPath),
       configDigest
     });
     const configUnits = config.releaseUnits ?? [];
@@ -75353,7 +76074,15 @@ To proceed, pass --acknowledge-hook-side-effects (CLI) or hooksAuthorized=true (
         ...unitBaseline ? { previousPublicBaseline: unitBaseline } : {}
       };
     });
-    const externalActions = buildExternalActions(unitResults, resolvedVersions, productionAssets);
+    const externalMarketplaceFreezes = production ? await resolveExternalMarketplaceFreezes({
+      unitResults,
+      resolvedVersions,
+      offline,
+      evidence,
+      observeHeadFn: options.observeExternalMarketplaceHeadFn ?? defaultObserveExternalMarketplaceHead,
+      fetchIndexFn: options.fetchExternalMarketplaceIndexFn ?? defaultFetchExternalMarketplaceIndex
+    }) : /* @__PURE__ */ new Map();
+    const externalActions = buildExternalActions(unitResults, resolvedVersions, productionAssets, externalMarketplaceFreezes);
     const overallSnapshotDigest = sha256Hex(snapshotDigests.join(":"));
     const plan = {
       planVersion: 2,
@@ -75372,7 +76101,7 @@ To proceed, pass --acknowledge-hook-side-effects (CLI) or hooksAuthorized=true (
       ...production ? {
         production: {
           mode: "github-npm-v1",
-          assetRoot: relative16(realRoot, runDir)
+          assetRoot: relative17(realRoot, runDir)
         }
       } : {},
       units,
@@ -75386,9 +76115,9 @@ To proceed, pass --acknowledge-hook-side-effects (CLI) or hooksAuthorized=true (
       actionCount: externalActions.length
     });
     await evidence.append({ phase: "plan-write", status: "started" });
-    const latestPlanPath = output ?? resolve17(releaseDir, "release-plan.json");
+    const latestPlanPath = output ?? resolve18(releaseDir, "release-plan.json");
     const plannedDigest = computePlanDigest(plan);
-    const immutablePlanPath = resolve17(dirname9(latestPlanPath), "plans", `${plannedDigest}.json`);
+    const immutablePlanPath = resolve18(dirname9(latestPlanPath), "plans", `${plannedDigest}.json`);
     const { planPath: writtenPath, planDigest } = await writePlanImmutable(immutablePlanPath, plan);
     await writePlanAtomic(latestPlanPath, plan);
     await evidence.append({
@@ -75429,7 +76158,7 @@ To proceed, pass --acknowledge-hook-side-effects (CLI) or hooksAuthorized=true (
     await lock.release();
   }
 }
-var execFile6;
+var execFile6, EXTERNAL_MARKETPLACE_SHA_RE2;
 var init_prepare = __esm({
   async "src/commands/prepare.mjs"() {
     await init_config();
@@ -75462,14 +76191,20 @@ var init_prepare = __esm({
     __name(normalizedProductionConfig, "normalizedProductionConfig");
     __name(readHeadCommitTimestamp, "readHeadCommitTimestamp");
     __name(buildProductionAssets, "buildProductionAssets");
+    EXTERNAL_MARKETPLACE_SHA_RE2 = /^[0-9a-f]{40}$/;
+    __name(parseExternalMarketplaceLsRemote, "parseExternalMarketplaceLsRemote");
+    __name(decodeExternalMarketplaceIndex, "decodeExternalMarketplaceIndex");
+    __name(defaultObserveExternalMarketplaceHead, "defaultObserveExternalMarketplaceHead");
+    __name(defaultFetchExternalMarketplaceIndex, "defaultFetchExternalMarketplaceIndex");
+    __name(resolveExternalMarketplaceFreezes, "resolveExternalMarketplaceFreezes");
     __name(buildExternalActions, "buildExternalActions");
     __name(prepareRelease, "prepareRelease");
   }
 });
 
 // src/core/approval.mjs
-import { readFile as readFile16 } from "node:fs/promises";
-import { basename as basename5, dirname as dirname10, join as join13, resolve as resolve18 } from "node:path";
+import { readFile as readFile17 } from "node:fs/promises";
+import { basename as basename5, dirname as dirname10, join as join14, resolve as resolve19 } from "node:path";
 function validateApprovalRecordSchema(approval) {
   if (validateApprovalSchema(approval)) return;
   const errors = validateApprovalSchema.errors ?? [];
@@ -75486,7 +76221,7 @@ function assertImmutableApprovalAuthority(approvalPath, plan, rawApproval) {
   if (!plan?.production) return;
   const planDigest = computePlanDigest(plan);
   const approvalDigest = computeApprovalDigest(rawApproval);
-  const absolute = resolve18(approvalPath);
+  const absolute = resolve19(approvalPath);
   const planDirectory = dirname10(absolute);
   if (basename5(absolute) !== `${approvalDigest}.json` || basename5(planDirectory) !== planDigest || basename5(dirname10(planDirectory)) !== "approvals") {
     throw new ReleaseError(
@@ -75755,8 +76490,8 @@ var approve_exports = {};
 __export(approve_exports, {
   approvePlan: () => approvePlan
 });
-import { readFile as readFile17, writeFile as writeFile7 } from "node:fs/promises";
-import { resolve as resolve19, dirname as dirname11, basename as basename6 } from "node:path";
+import { readFile as readFile18, writeFile as writeFile7 } from "node:fs/promises";
+import { resolve as resolve20, dirname as dirname11, basename as basename6 } from "node:path";
 function defaultClock() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
@@ -75782,7 +76517,7 @@ async function approvePlan(options) {
   }
   let planRaw;
   try {
-    planRaw = await readFile17(planPath, "utf8");
+    planRaw = await readFile18(planPath, "utf8");
   } catch (err) {
     throw new ReleaseError(
       GATE_FAILED,
@@ -75886,18 +76621,18 @@ async function approvePlan(options) {
     expiresAt
   };
   validateApprovalRecordSchema(approvalRecord);
-  const planDir = dirname11(resolve19(planPath));
+  const planDir = dirname11(resolve20(planPath));
   const releaseDir = basename6(planDir) === "plans" && basename6(planPath) === `${actualDigest}.json` ? dirname11(planDir) : planDir;
-  if (plan.production?.mode === "github-npm-v1" && outputPath && resolve19(outputPath) !== resolve19(releaseDir, "approval-record.json")) {
+  if (plan.production?.mode === "github-npm-v1" && outputPath && resolve20(outputPath) !== resolve20(releaseDir, "approval-record.json")) {
     throw new ReleaseError(
       GATE_FAILED,
       "production approve requires the canonical approval-record.json alias next to the immutable plan authority; custom --output is supported only outside production",
-      { outputPath: resolve19(outputPath), expected: resolve19(releaseDir, "approval-record.json") }
+      { outputPath: resolve20(outputPath), expected: resolve20(releaseDir, "approval-record.json") }
     );
   }
   const json = JSON.stringify(approvalRecord, null, 2);
   const approvalDigest = computeApprovalDigest(json);
-  const immutableApprovalPath = resolve19(
+  const immutableApprovalPath = resolve20(
     releaseDir,
     "approvals",
     actualDigest,
@@ -75909,7 +76644,7 @@ async function approvePlan(options) {
     await writeFile7(immutableApprovalPath, json, { encoding: "utf8", flag: "wx", mode: 384 });
   } catch (error) {
     if (error.code !== "EEXIST") throw error;
-    const existing = await readFile17(immutableApprovalPath, "utf8");
+    const existing = await readFile18(immutableApprovalPath, "utf8");
     if (existing !== json) {
       throw new ReleaseError(
         GATE_FAILED,
@@ -75918,7 +76653,7 @@ async function approvePlan(options) {
       );
     }
   }
-  const writePath = outputPath ?? resolve19(releaseDir, "approval-record.json");
+  const writePath = outputPath ?? resolve20(releaseDir, "approval-record.json");
   await prepareAuthorityDirectory(dirname11(writePath));
   await assertAuthorityFileTarget(writePath);
   await writeFile7(writePath, json, "utf8");
@@ -75976,7 +76711,8 @@ var init_checkpoints = __esm({
       "github-release",
       "claude-marketplace-install",
       "codex-marketplace-install",
-      "kimi-marketplace-install"
+      "kimi-marketplace-install",
+      "codebuddy-marketplace-install"
     ];
     ADAPTER_ACTION_TYPE_MAP = {
       "push-commit": "git-push",
@@ -75987,7 +76723,8 @@ var init_checkpoints = __esm({
       "github-release": "github-release",
       "claude-marketplace-install": "claude-marketplace-install",
       "codex-marketplace-install": "codex-marketplace-install",
-      "kimi-marketplace-install": "kimi-marketplace-install"
+      "kimi-marketplace-install": "kimi-marketplace-install",
+      "codebuddy-marketplace-install": "codebuddy-marketplace-install"
     };
     TIER_TABLE = [
       ["push-commit", "push-snapshot"],
@@ -75996,7 +76733,7 @@ var init_checkpoints = __esm({
       // Tier 1
       ["github-release", "claude-marketplace-install", "codex-marketplace-install"],
       // Tier 2
-      ["kimi-marketplace-install"]
+      ["kimi-marketplace-install", "codebuddy-marketplace-install"]
       // Tier 3
     ];
     TIER_OF = /* @__PURE__ */ new Map();
@@ -76096,7 +76833,7 @@ function defaultSleep(ms) {
   if (process.env.RELEASE_SKILL_OBSERVE_RETRY_NO_WAIT === "1") {
     return Promise.resolve();
   }
-  return new Promise((resolve24) => setTimeout(resolve24, ms));
+  return new Promise((resolve25) => setTimeout(resolve25, ms));
 }
 function isPropagatingMissing(result) {
   if (result == null) return true;
@@ -76185,8 +76922,8 @@ var reconcile_exports = {};
 __export(reconcile_exports, {
   reconcileRelease: () => reconcileRelease
 });
-import { readFile as readFile18, mkdir as mkdir12 } from "node:fs/promises";
-import { join as join14 } from "node:path";
+import { readFile as readFile19, mkdir as mkdir13 } from "node:fs/promises";
+import { join as join15 } from "node:path";
 function defaultClock3() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
@@ -76215,7 +76952,7 @@ async function reconcileRelease(options) {
   }
   let planRaw;
   try {
-    planRaw = await readFile18(planPath, "utf8");
+    planRaw = await readFile19(planPath, "utf8");
   } catch (err) {
     throw new ReleaseError(GATE_FAILED, `cannot read release plan: ${err.message}`, { planPath, cause: err.code });
   }
@@ -76233,7 +76970,7 @@ async function reconcileRelease(options) {
   if (isProductionPlan) {
     runDir = await createProductionRunDir(runDir, planPath);
   } else {
-    await mkdir12(runDir, { recursive: true });
+    await mkdir13(runDir, { recursive: true });
   }
   const evidence = createEvidenceWriter({ runDir, command: "reconcile", clock: clockFn });
   try {
@@ -76294,7 +77031,7 @@ async function reconcileRelease(options) {
           { sourceRunId: sourceRun.runId }
         );
       }
-      const sourceApprovalRaw = await readFile18(consumedApprovalPath, "utf8").catch((error) => {
+      const sourceApprovalRaw = await readFile19(consumedApprovalPath, "utf8").catch((error) => {
         throw new ReleaseError(GATE_FAILED, "source run approval authority is unavailable", {
           sourceRunId: sourceRun.runId,
           cause: error.code
@@ -76472,7 +77209,7 @@ async function reconcileRelease(options) {
     if (approvalPath) {
       let approvalRaw;
       try {
-        approvalRaw = await readFile18(approvalPath, "utf8");
+        approvalRaw = await readFile19(approvalPath, "utf8");
       } catch (err) {
         throw new ReleaseError(
           GATE_FAILED,
@@ -77273,7 +78010,7 @@ async function reconcileRelease(options) {
         status: status === "succeeded" ? "succeeded" : status === "failed" ? "failed" : status === "skipped" ? "skipped" : status === "uncertain" ? "uncertain" : "pending"
       };
     });
-    const runPath = join14(runDir, "release-run.json");
+    const runPath = join15(runDir, "release-run.json");
     const sourceRunDigest = sourceAuthorityDigest;
     const runState = {
       runId,
@@ -77346,7 +78083,8 @@ var init_reconcile = __esm({
     MARKETPLACE_TYPES = /* @__PURE__ */ new Set([
       "claude-marketplace-install",
       "codex-marketplace-install",
-      "kimi-marketplace-install"
+      "kimi-marketplace-install",
+      "codebuddy-marketplace-install"
     ]);
     __name(defaultClock3, "defaultClock");
     __name(reconcileRelease, "reconcileRelease");
@@ -77943,8 +78681,8 @@ __export(plugin_marketplace_exports, {
 });
 import { execFile as execFileCb10 } from "node:child_process";
 import { promisify as promisify10 } from "node:util";
-import { readFile as readFile19, stat as stat5, mkdir as mkdir13, readdir as readdir9, realpath as realpath11, lstat as lstat11 } from "node:fs/promises";
-import { join as join15, resolve as resolve20, relative as relative17, isAbsolute as isAbsolute14, basename as basename7 } from "node:path";
+import { readFile as readFile20, stat as stat5, mkdir as mkdir14, readdir as readdir9, realpath as realpath11, lstat as lstat11 } from "node:fs/promises";
+import { join as join16, resolve as resolve21, relative as relative18, isAbsolute as isAbsolute15, basename as basename7 } from "node:path";
 import { createHash as createHash10 } from "node:crypto";
 function transportPayload(entries) {
   return entries.map(({ path: path3, type, mode, size, contentDigest }) => ({
@@ -77974,13 +78712,16 @@ function extractDeclaredPluginSource(consumer, entry) {
   return segments.length === 0 ? "." : segments.join("/");
 }
 async function resolveInstalledPayloadSubpath(snapshotDir, sourceEntries, action, consumer) {
+  if (action.payloadContract === PAYLOAD_CONTRACT_EXTERNAL_MARKETPLACE || action.marketplaceLocation === "external") {
+    return ".";
+  }
   const marketplaceRelative = getPlatform(consumer).manifestPaths.marketplace;
   if (marketplaceRelative === null) return ".";
   const anchored = sourceEntries.some((entry) => entry.type === "file" && entry.path === marketplaceRelative);
   if (!anchored) {
     throw new Error(`frozen snapshot is missing the marketplace manifest ${marketplaceRelative}`);
   }
-  const result = await validateManifestFile(resolve20(snapshotDir, marketplaceRelative), ["name", "plugins"]);
+  const result = await validateManifestFile(resolve21(snapshotDir, marketplaceRelative), ["name", "plugins"]);
   if (!result.valid) {
     throw new Error(`frozen snapshot ${marketplaceRelative} invalid: ${result.error}`);
   }
@@ -78019,10 +78760,10 @@ async function verifyInstalledMarketplacePayload(action, context, installPath, c
     throw new Error("frozen snapshot contains no payload under the declared marketplace source");
   }
   const payloadContract = action.payloadContract;
-  if (payloadContract !== void 0 && payloadContract !== PAYLOAD_CONTRACT_DECLARED_MANIFEST) {
+  if (payloadContract !== void 0 && payloadContract !== PAYLOAD_CONTRACT_DECLARED_MANIFEST && payloadContract !== PAYLOAD_CONTRACT_EXTERNAL_MARKETPLACE) {
     throw new Error(`unsupported marketplace payload contract: ${JSON.stringify(payloadContract)}`);
   }
-  if (payloadContract === PAYLOAD_CONTRACT_DECLARED_MANIFEST) {
+  if (payloadContract === PAYLOAD_CONTRACT_DECLARED_MANIFEST || payloadContract === PAYLOAD_CONTRACT_EXTERNAL_MARKETPLACE) {
     const installedSnapshot2 = await computeFrozenSnapshot(installPath);
     const authorityPayload = transportPayload(authorityEntries);
     const installedByPath = new Map(
@@ -78047,7 +78788,7 @@ async function verifyInstalledMarketplacePayload(action, context, installPath, c
       const listed = conflicts.slice(0, PAYLOAD_CONFLICT_REPORT_CAP).join("; ");
       const overflow = conflicts.length > PAYLOAD_CONFLICT_REPORT_CAP ? `; and ${conflicts.length - PAYLOAD_CONFLICT_REPORT_CAP} more conflicting path(s)` : "";
       throw new Error(
-        `installed marketplace payload differs in path, bytes, size, or non-write mode bits (${PAYLOAD_CONTRACT_DECLARED_MANIFEST}): ${listed}${overflow}`
+        `installed marketplace payload differs in path, bytes, size, or non-write mode bits (${payloadContract}): ${listed}${overflow}`
       );
     }
     const authorityPaths = new Set(authorityPayload.map((entry) => entry.path));
@@ -78094,26 +78835,26 @@ async function resolveKimiEntrySkillFile(pluginRootReal, manifest, entrySkill) {
   }
   let entryAbs;
   if (manifest.skills === void 0 || manifest.skills === null) {
-    entryAbs = resolve20(pluginRootReal, "SKILL.md");
+    entryAbs = resolve21(pluginRootReal, "SKILL.md");
   } else {
     const skillsRel = normalizeKimiSkillsRel(manifest.skills);
-    const skillsRootAbs = skillsRel === "" ? pluginRootReal : resolve20(pluginRootReal, skillsRel);
+    const skillsRootAbs = skillsRel === "" ? pluginRootReal : resolve21(pluginRootReal, skillsRel);
     const skillsRootReal = await realpath11(skillsRootAbs).catch(() => null);
     if (!skillsRootReal) {
       throw new Error(`kimi manifest skills root does not exist: ${manifest.skills}`);
     }
-    const skillsContainment = relative17(pluginRootReal, skillsRootReal);
+    const skillsContainment = relative18(pluginRootReal, skillsRootReal);
     const sepK = process.platform === "win32" ? "\\" : "/";
-    if (skillsContainment !== "" && (isAbsolute14(skillsContainment) || skillsContainment === ".." || skillsContainment.startsWith(`..${sepK}`))) {
+    if (skillsContainment !== "" && (isAbsolute15(skillsContainment) || skillsContainment === ".." || skillsContainment.startsWith(`..${sepK}`))) {
       throw new Error(`kimi manifest skills "${manifest.skills}" escapes the plugin root after symlink resolution`);
     }
-    entryAbs = resolve20(skillsRootReal, entrySkill, "SKILL.md");
+    entryAbs = resolve21(skillsRootReal, entrySkill, "SKILL.md");
   }
   let entryLexicalStat;
   try {
     entryLexicalStat = await lstat11(entryAbs);
   } catch {
-    throw new Error(`kimi entry skill not found: ${relative17(pluginRootReal, entryAbs) || "SKILL.md"}`);
+    throw new Error(`kimi entry skill not found: ${relative18(pluginRootReal, entryAbs) || "SKILL.md"}`);
   }
   if (entryLexicalStat.isSymbolicLink()) {
     throw new Error("kimi entry skill must not be a symlink");
@@ -78123,15 +78864,73 @@ async function resolveKimiEntrySkillFile(pluginRootReal, manifest, entrySkill) {
   }
   const entryReal = await realpath11(entryAbs).catch(() => null);
   if (!entryReal) {
-    throw new Error(`kimi entry skill not found: ${relative17(pluginRootReal, entryAbs) || "SKILL.md"}`);
+    throw new Error(`kimi entry skill not found: ${relative18(pluginRootReal, entryAbs) || "SKILL.md"}`);
   }
-  const entryContainment = relative17(pluginRootReal, entryReal);
+  const entryContainment = relative18(pluginRootReal, entryReal);
   const sepE = process.platform === "win32" ? "\\" : "/";
-  if (entryContainment !== "" && (isAbsolute14(entryContainment) || entryContainment === ".." || entryContainment.startsWith(`..${sepE}`))) {
+  if (entryContainment !== "" && (isAbsolute15(entryContainment) || entryContainment === ".." || entryContainment.startsWith(`..${sepE}`))) {
     throw new Error("kimi entry skill escapes the plugin root after symlink resolution");
   }
   return entryReal;
 }
+function normalizeCodeBuddySkillsRel(skillsRaw) {
+  if (typeof skillsRaw !== "string" || skillsRaw.length === 0) {
+    throw new Error("codebuddy manifest skills must be a non-empty relative path when present");
+  }
+  if (skillsRaw.startsWith("/") || skillsRaw.includes("..") || skillsRaw.includes("\\") || /^https?:\/\//i.test(skillsRaw)) {
+    throw new Error(`codebuddy manifest skills "${skillsRaw}" is not a safe relative path`);
+  }
+  let rel = skillsRaw.replace(/^\.\//, "");
+  rel = rel.replace(/\/+$/, "");
+  if (rel.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) {
+    throw new Error(`codebuddy manifest skills "${skillsRaw}" is not a safe relative path`);
+  }
+  return rel;
+}
+async function resolveCodeBuddyEntrySkillFile(pluginRootReal, manifest, entrySkill) {
+  if (!entrySkill || typeof entrySkill !== "string" || !SAFE_ID_RE.test(entrySkill)) {
+    throw new Error(`unsafe entrySkill: "${entrySkill}"`);
+  }
+  let entryAbs;
+  if (manifest.skills === void 0 || manifest.skills === null) {
+    entryAbs = resolve21(pluginRootReal, "SKILL.md");
+  } else {
+    const skillsRel = normalizeCodeBuddySkillsRel(manifest.skills);
+    const skillsRootAbs = skillsRel === "" ? pluginRootReal : resolve21(pluginRootReal, skillsRel);
+    const skillsRootReal = await realpath11(skillsRootAbs).catch(() => null);
+    if (!skillsRootReal) {
+      throw new Error(`codebuddy manifest skills root does not exist: ${manifest.skills}`);
+    }
+    const skillsContainment = relative18(pluginRootReal, skillsRootReal);
+    const sepK = process.platform === "win32" ? "\\" : "/";
+    if (skillsContainment !== "" && (isAbsolute15(skillsContainment) || skillsContainment === ".." || skillsContainment.startsWith(`..${sepK}`))) {
+      throw new Error(`codebuddy manifest skills "${manifest.skills}" escapes the plugin root after symlink resolution`);
+    }
+    entryAbs = resolve21(skillsRootReal, entrySkill, "SKILL.md");
+  }
+  let entryLexicalStat;
+  try {
+    entryLexicalStat = await lstat11(entryAbs);
+  } catch {
+    throw new Error(`codebuddy entry skill not found: ${relative18(pluginRootReal, entryAbs) || "SKILL.md"}`);
+  }
+  if (entryLexicalStat.isSymbolicLink()) {
+    throw new Error("codebuddy entry skill must not be a symlink");
+  }
+  if (!entryLexicalStat.isFile()) {
+    throw new Error("codebuddy entry skill is not a regular file");
+  }
+  const entryReal = await realpath11(entryAbs).catch(() => null);
+  if (!entryReal) {
+    throw new Error(`codebuddy entry skill not found: ${relative18(pluginRootReal, entryAbs) || "SKILL.md"}`);
+  }
+  const entryContainment = relative18(pluginRootReal, entryReal);
+  const sepE = process.platform === "win32" ? "\\" : "/";
+  if (entryContainment !== "" && (isAbsolute15(entryContainment) || entryContainment === ".." || entryContainment.startsWith(`..${sepE}`))) {
+    throw new Error("codebuddy entry skill escapes the plugin root after symlink resolution");
+  }
+  return entryReal;
+}
 function validateSafeRef(ref) {
   if (!ref || typeof ref !== "string") {
     return { valid: false, error: "ref is required" };
@@ -78213,7 +79012,7 @@ async function run4(cmd, args2, options = {}) {
 }
 async function validateManifestFile(manifestPath, requiredFields) {
   try {
-    const content = await readFile19(manifestPath, "utf8");
+    const content = await readFile20(manifestPath, "utf8");
     const manifest = JSON.parse(content);
     const missing = requiredFields.filter((f) => !(f in manifest));
     return {
@@ -78235,7 +79034,7 @@ async function checkRequiredFiles(dir, requiredFiles) {
   const missing = [];
   for (const file of requiredFiles) {
     try {
-      await stat5(resolve20(dir, file));
+      await stat5(resolve21(dir, file));
     } catch {
       missing.push(file);
     }
@@ -78311,7 +79110,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
             status: ActionStatus.PREFLIGHT_PASSED
           });
         }
-        if (actionType === ActionType.CLAUDE_MARKETPLACE_INSTALL || actionType === ActionType.CODEX_MARKETPLACE_INSTALL || actionType === ActionType.KIMI_MARKETPLACE_INSTALL) {
+        if (actionType === ActionType.CLAUDE_MARKETPLACE_INSTALL || actionType === ActionType.CODEX_MARKETPLACE_INSTALL || actionType === ActionType.KIMI_MARKETPLACE_INSTALL || actionType === ActionType.CODEBUDDY_MARKETPLACE_INSTALL) {
           const validation = validateMarketplaceParams(action);
           if (!validation.valid) {
             return createResult({
@@ -78387,6 +79186,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
             });
           }
           if (!platform.automatable) {
+            const manifestLabel = consumer === "codebuddy" ? "codebuddy" : "kimi";
             let kimiManifestResult;
             try {
               kimiManifestResult = await platform.strategy.readManifest(snapshotDirReal);
@@ -78394,7 +79194,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
               return createResult({
                 actionType,
                 status: ActionStatus.PREFLIGHT_FAILED,
-                error: `frozen snapshot kimi manifest invalid: ${manifestErr.message}`
+                error: `frozen snapshot ${manifestLabel} manifest invalid: ${manifestErr.message}`
               });
             }
             const kimiManifest = kimiManifestResult.manifest;
@@ -78415,110 +79215,152 @@ function createPluginMarketplaceAdapter(deps = {}) {
             kimiSnapshotManifest = kimiManifest;
           }
           if (platform.automatable) {
-            const marketplaceRelative = platform.manifestPaths.marketplace;
-            const marketplacePath = resolve20(snapshotDirReal, marketplaceRelative);
-            const marketplaceResult = await validateManifestFile(marketplacePath, ["name"]);
-            if (!marketplaceResult.valid) {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `frozen snapshot ${marketplaceRelative} invalid: ${marketplaceResult.error}`
-              });
-            }
-            if (marketplaceResult.manifest.name !== action.marketplace) {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `marketplace.json name "${marketplaceResult.manifest.name}" does not match action marketplace "${action.marketplace}"`
-              });
-            }
-            const plugins = marketplaceResult.manifest.plugins;
-            if (!Array.isArray(plugins)) {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `${marketplaceRelative} must have a plugins[] array`
-              });
-            }
-            const pluginEntry = plugins.filter((p) => p.name === action.plugin);
-            if (pluginEntry.length !== 1) {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `expected exactly one plugins[] entry with name "${action.plugin}", found ${pluginEntry.length}`
-              });
-            }
-            const entry = pluginEntry[0];
-            let sourcePath;
-            try {
-              sourcePath = extractDeclaredPluginSource(consumer, entry);
-            } catch (sourceErr) {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: sourceErr.message
-              });
-            }
-            const sourceDirAbs = resolve20(snapshotDirReal, sourcePath);
-            const sourceDirReal = await realpath11(sourceDirAbs).catch(() => null);
-            if (!sourceDirReal) {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `marketplace plugin entry source directory does not exist: ${sourcePath}`
-              });
-            }
-            const sourceRelCheck = relative17(snapshotDirReal, sourceDirReal);
-            if (sourceRelCheck.startsWith("..") || isAbsolute14(sourceRelCheck)) {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `marketplace plugin entry source "${sourcePath}" escapes the frozen snapshot`
-              });
-            }
-            const manifestRelative = join15(sourcePath, platform.manifestPaths.plugin);
-            const manifestPath = resolve20(snapshotDirReal, manifestRelative);
-            const manifestResult = await validateManifestFile(manifestPath, ["name", "version"]);
-            if (!manifestResult.valid) {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `frozen snapshot ${manifestRelative} invalid: ${manifestResult.error}`
-              });
-            }
-            if (platform.marketplaceEntryCarriesVersion && entry.version !== action.version) {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `marketplace plugin entry version "${entry.version}" does not match action version "${action.version}"`
-              });
-            }
-            const pluginManifestResult = await validateManifestFile(manifestPath, ["name", "version"]);
-            if (!pluginManifestResult.valid) {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `frozen snapshot ${manifestRelative} invalid: ${pluginManifestResult.error}`
-              });
-            }
-            if (pluginManifestResult.manifest.name !== entry.name) {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `plugin manifest name "${pluginManifestResult.manifest.name}" does not match marketplace entry name "${entry.name}"`
-              });
-            }
-            if (pluginManifestResult.manifest.version !== action.version) {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `plugin manifest version "${pluginManifestResult.manifest.version}" does not match action version "${action.version}"`
-              });
+            if (action.marketplaceLocation === "external") {
+              if (typeof action.marketplaceCommitSha !== "string" || !/^[0-9a-f]{40}$/.test(action.marketplaceCommitSha)) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.PREFLIGHT_FAILED,
+                  error: `external marketplace marketplaceCommitSha must be a 40-hex commit sha, got ${JSON.stringify(action.marketplaceCommitSha)}`
+                });
+              }
+              if (typeof action.repo !== "string" || !/^[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*$/.test(action.repo)) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.PREFLIGHT_FAILED,
+                  error: `external marketplace repo must be an owner/name repository, got ${JSON.stringify(action.repo)}`
+                });
+              }
+              const externalManifestRelative = platform.manifestPaths.plugin;
+              const externalManifestPath = resolve21(snapshotDirReal, externalManifestRelative);
+              const externalManifestResult = await validateManifestFile(externalManifestPath, ["name", "version"]);
+              if (!externalManifestResult.valid) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.PREFLIGHT_FAILED,
+                  error: `frozen snapshot ${externalManifestRelative} invalid: ${externalManifestResult.error}`
+                });
+              }
+              if (externalManifestResult.manifest.name !== action.plugin) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.PREFLIGHT_FAILED,
+                  error: `plugin manifest name "${externalManifestResult.manifest.name}" does not match action plugin "${action.plugin}"`
+                });
+              }
+              if (externalManifestResult.manifest.version !== action.version) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.PREFLIGHT_FAILED,
+                  error: `plugin manifest version "${externalManifestResult.manifest.version}" does not match action version "${action.version}"`
+                });
+              }
+            } else {
+              const marketplaceRelative = platform.manifestPaths.marketplace;
+              const marketplacePath = resolve21(snapshotDirReal, marketplaceRelative);
+              const marketplaceResult = await validateManifestFile(marketplacePath, ["name"]);
+              if (!marketplaceResult.valid) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.PREFLIGHT_FAILED,
+                  error: `frozen snapshot ${marketplaceRelative} invalid: ${marketplaceResult.error}`
+                });
+              }
+              if (marketplaceResult.manifest.name !== action.marketplace) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.PREFLIGHT_FAILED,
+                  error: `marketplace.json name "${marketplaceResult.manifest.name}" does not match action marketplace "${action.marketplace}"`
+                });
+              }
+              const plugins = marketplaceResult.manifest.plugins;
+              if (!Array.isArray(plugins)) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.PREFLIGHT_FAILED,
+                  error: `${marketplaceRelative} must have a plugins[] array`
+                });
+              }
+              const pluginEntry = plugins.filter((p) => p.name === action.plugin);
+              if (pluginEntry.length !== 1) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.PREFLIGHT_FAILED,
+                  error: `expected exactly one plugins[] entry with name "${action.plugin}", found ${pluginEntry.length}`
+                });
+              }
+              const entry = pluginEntry[0];
+              let sourcePath;
+              try {
+                sourcePath = extractDeclaredPluginSource(consumer, entry);
+              } catch (sourceErr) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.PREFLIGHT_FAILED,
+                  error: sourceErr.message
+                });
+              }
+              const sourceDirAbs = resolve21(snapshotDirReal, sourcePath);
+              const sourceDirReal = await realpath11(sourceDirAbs).catch(() => null);
+              if (!sourceDirReal) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.PREFLIGHT_FAILED,
+                  error: `marketplace plugin entry source directory does not exist: ${sourcePath}`
+                });
+              }
+              const sourceRelCheck = relative18(snapshotDirReal, sourceDirReal);
+              if (sourceRelCheck.startsWith("..") || isAbsolute15(sourceRelCheck)) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.PREFLIGHT_FAILED,
+                  error: `marketplace plugin entry source "${sourcePath}" escapes the frozen snapshot`
+                });
+              }
+              const manifestRelative = join16(sourcePath, platform.manifestPaths.plugin);
+              const manifestPath = resolve21(snapshotDirReal, manifestRelative);
+              const manifestResult = await validateManifestFile(manifestPath, ["name", "version"]);
+              if (!manifestResult.valid) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.PREFLIGHT_FAILED,
+                  error: `frozen snapshot ${manifestRelative} invalid: ${manifestResult.error}`
+                });
+              }
+              if (platform.marketplaceEntryCarriesVersion && entry.version !== action.version) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.PREFLIGHT_FAILED,
+                  error: `marketplace plugin entry version "${entry.version}" does not match action version "${action.version}"`
+                });
+              }
+              const pluginManifestResult = await validateManifestFile(manifestPath, ["name", "version"]);
+              if (!pluginManifestResult.valid) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.PREFLIGHT_FAILED,
+                  error: `frozen snapshot ${manifestRelative} invalid: ${pluginManifestResult.error}`
+                });
+              }
+              if (pluginManifestResult.manifest.name !== entry.name) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.PREFLIGHT_FAILED,
+                  error: `plugin manifest name "${pluginManifestResult.manifest.name}" does not match marketplace entry name "${entry.name}"`
+                });
+              }
+              if (pluginManifestResult.manifest.version !== action.version) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.PREFLIGHT_FAILED,
+                  error: `plugin manifest version "${pluginManifestResult.manifest.version}" does not match action version "${action.version}"`
+                });
+              }
             }
           }
           if (!platform.automatable) {
+            const resolveEntrySkillFile = consumer === "codebuddy" ? resolveCodeBuddyEntrySkillFile : resolveKimiEntrySkillFile;
             try {
-              await resolveKimiEntrySkillFile(snapshotDirReal, kimiSnapshotManifest, action.entrySkill);
+              await resolveEntrySkillFile(snapshotDirReal, kimiSnapshotManifest, action.entrySkill);
             } catch (entryErr) {
               return createResult({
                 actionType,
@@ -78527,7 +79369,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
               });
             }
           } else {
-            const entrySkillFile = resolve20(snapshotDirReal, "skills", action.entrySkill, "SKILL.md");
+            const entrySkillFile = resolve21(snapshotDirReal, "skills", action.entrySkill, "SKILL.md");
             try {
               await stat5(entrySkillFile);
             } catch {
@@ -78634,7 +79476,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
           }
           if (action.entryPoint) {
             try {
-              await exec(process.execPath, ["--check", resolve20(pluginDir, action.entryPoint)]);
+              await exec(process.execPath, ["--check", resolve21(pluginDir, action.entryPoint)]);
             } catch (checkErr) {
               return createResult({
                 actionType,
@@ -78660,7 +79502,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
           });
         }
       }
-      if (actionType === ActionType.CLAUDE_MARKETPLACE_INSTALL || actionType === ActionType.CODEX_MARKETPLACE_INSTALL || actionType === ActionType.KIMI_MARKETPLACE_INSTALL) {
+      if (actionType === ActionType.CLAUDE_MARKETPLACE_INSTALL || actionType === ActionType.CODEX_MARKETPLACE_INSTALL || actionType === ActionType.KIMI_MARKETPLACE_INSTALL || actionType === ActionType.CODEBUDDY_MARKETPLACE_INSTALL) {
         try {
           assertIsolatedConsumerWritesAuthorized(context, actionType);
           const validation = validateMarketplaceParams(action);
@@ -78691,21 +79533,21 @@ function createPluginMarketplaceAdapter(deps = {}) {
           }
           const consumer = action.consumer;
           const runDir = context.runDir;
-          const isolatedHome = resolve20(runDir, "consumers", `${consumer}-${action.plugin}`);
+          const isolatedHome = resolve21(runDir, "consumers", `${consumer}-${action.plugin}`);
           const runDirReal = await realpath11(runDir).catch(() => runDir);
           const isolatedHomePreReal = await realpath11(isolatedHome).catch(() => isolatedHome);
-          const relToRun = relative17(runDirReal, isolatedHomePreReal);
+          const relToRun = relative18(runDirReal, isolatedHomePreReal);
           const sepE = process.platform === "win32" ? "\\" : "/";
-          if (relToRun !== "" && (isAbsolute14(relToRun) || relToRun === ".." || relToRun.startsWith(`..${sepE}`))) {
+          if (relToRun !== "" && (isAbsolute15(relToRun) || relToRun === ".." || relToRun.startsWith(`..${sepE}`))) {
             return createResult({
               actionType,
               status: ActionStatus.EXECUTE_FAILED,
               error: `consumer directory escapes runDir: ${isolatedHome}`
             });
           }
-          await mkdir13(isolatedHome, { recursive: true, mode: 448 });
+          await mkdir14(isolatedHome, { recursive: true, mode: 448 });
           for (const subdir of platform.isolationSubdirs) {
-            await mkdir13(resolve20(isolatedHome, subdir), { recursive: true, mode: 448 });
+            await mkdir14(resolve21(isolatedHome, subdir), { recursive: true, mode: 448 });
           }
           const cliCmd = platform.cli.binary;
           const baseEnv = { ...process.env, ...context.env };
@@ -78799,9 +79641,9 @@ function createPluginMarketplaceAdapter(deps = {}) {
                         error: `plugin install JSON missing installedPath`
                       });
                     }
-                    const installPathAbs = resolve20(installFields.installedPath);
-                    const installPathRel = relative17(isolatedHome, installPathAbs);
-                    if (isAbsolute14(installPathRel) || installPathRel === ".." || installPathRel.startsWith(`..${sepE}`)) {
+                    const installPathAbs = resolve21(installFields.installedPath);
+                    const installPathRel = relative18(isolatedHome, installPathAbs);
+                    if (isAbsolute15(installPathRel) || installPathRel === ".." || installPathRel.startsWith(`..${sepE}`)) {
                       return createResult({
                         actionType,
                         status: ActionStatus.EXECUTE_FAILED,
@@ -78859,9 +79701,9 @@ function createPluginMarketplaceAdapter(deps = {}) {
             executedAt: (/* @__PURE__ */ new Date()).toISOString(),
             ...extraInstalledPathsAudit(executeBinding)
           };
-          const evidenceDir = resolve20(runDir, "evidence", `${consumer}-${action.plugin}`);
-          await mkdir13(evidenceDir, { recursive: true, mode: 448 });
-          const evidencePath = resolve20(evidenceDir, "release-skill-install-evidence.json");
+          const evidenceDir = resolve21(runDir, "evidence", `${consumer}-${action.plugin}`);
+          await mkdir14(evidenceDir, { recursive: true, mode: 448 });
+          const evidencePath = resolve21(evidenceDir, "release-skill-install-evidence.json");
           await writeEvidenceAtomic(evidencePath, evidence);
           const executeObservation = {
             ...evidence,
@@ -78910,7 +79752,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
         if (actionType === ActionType.PLUGIN_MANIFEST_VALIDATE) {
           const manifestPath = action.manifestPath;
           try {
-            const content = await readFile19(manifestPath, "utf8");
+            const content = await readFile20(manifestPath, "utf8");
             const manifest = JSON.parse(content);
             return createResult({
               actionType,
@@ -78943,7 +79785,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
             }
           });
         }
-        if (actionType === ActionType.CLAUDE_MARKETPLACE_INSTALL || actionType === ActionType.CODEX_MARKETPLACE_INSTALL || actionType === ActionType.KIMI_MARKETPLACE_INSTALL) {
+        if (actionType === ActionType.CLAUDE_MARKETPLACE_INSTALL || actionType === ActionType.CODEX_MARKETPLACE_INSTALL || actionType === ActionType.KIMI_MARKETPLACE_INSTALL || actionType === ActionType.CODEBUDDY_MARKETPLACE_INSTALL) {
           const consumer = action.consumer;
           const runDir = context.runDir;
           if (!runDir) {
@@ -78953,7 +79795,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
               observation: { installed: false, error: "context.runDir is required" }
             });
           }
-          const isolatedHome = resolve20(runDir, "consumers", `${consumer}-${action.plugin}`);
+          const isolatedHome = resolve21(runDir, "consumers", `${consumer}-${action.plugin}`);
           const platform = PLATFORMS.find((p) => p.id === consumer) ?? null;
           const cliCmd = platform ? platform.cli ? platform.cli.binary : null : "kimi";
           const baseEnv = { ...process.env, ...context.env ?? {} };
@@ -78972,7 +79814,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
               error: timeoutErr.message
             });
           }
-          if (platform && !platform.automatable) {
+          if (platform && !platform.automatable && actionType === ActionType.KIMI_MARKETPLACE_INSTALL) {
             const expectedRef = action.ref ?? `v${action.version}`;
             let boundPlanDigest;
             try {
@@ -78999,7 +79841,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
             }
             let requirement = null;
             try {
-              requirement = JSON.parse(await readFile19(resolve20(attestationDir, KIMI_REQUIREMENT_FILE), "utf8"));
+              requirement = JSON.parse(await readFile20(resolve21(attestationDir, KIMI_REQUIREMENT_FILE), "utf8"));
             } catch {
               return createResult({
                 actionType,
@@ -79023,7 +79865,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
             }
             let attestation = null;
             try {
-              attestation = JSON.parse(await readFile19(resolve20(attestationDir, KIMI_ATTESTATION_FILE), "utf8"));
+              attestation = JSON.parse(await readFile20(resolve21(attestationDir, KIMI_ATTESTATION_FILE), "utf8"));
             } catch {
               return createResult({
                 actionType,
@@ -79033,7 +79875,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
                   manualInstallRequired: true,
                   installUrl: requirement.installUrl,
                   attestationDir,
-                  error: `kimi attestation is missing; write ${resolve20(attestationDir, KIMI_ATTESTATION_FILE)} after the interactive install (${requirement.installUrl})`
+                  error: `kimi attestation is missing; write ${resolve21(attestationDir, KIMI_ATTESTATION_FILE)} after the interactive install (${requirement.installUrl})`
                 }
               });
             }
@@ -79045,7 +79887,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
                 observation: { installed: false, error: attestationCheck.error }
               });
             }
-            const kimiCodeHome = resolve20(attestationDir, "kimi-home");
+            const kimiCodeHome = resolve21(attestationDir, "kimi-home");
             const kimiCodeHomeReal = await realpath11(kimiCodeHome).catch(() => null);
             if (!kimiCodeHomeReal) {
               return createResult({
@@ -79057,18 +79899,18 @@ function createPluginMarketplaceAdapter(deps = {}) {
                 }
               });
             }
-            const managedRootReal = await realpath11(resolve20(kimiCodeHomeReal, KIMI_MANAGED_SUBPATH, action.plugin)).catch(() => null);
+            const managedRootReal = await realpath11(resolve21(kimiCodeHomeReal, KIMI_MANAGED_SUBPATH, action.plugin)).catch(() => null);
             if (!managedRootReal) {
               return createResult({
                 actionType,
                 status: ActionStatus.OBSERVED,
                 observation: {
                   installed: false,
-                  error: `kimi managed plugin root does not exist: ${resolve20(kimiCodeHomeReal, KIMI_MANAGED_SUBPATH, action.plugin)}`
+                  error: `kimi managed plugin root does not exist: ${resolve21(kimiCodeHomeReal, KIMI_MANAGED_SUBPATH, action.plugin)}`
                 }
               });
             }
-            const installPath2 = resolve20(attestation.installPath);
+            const installPath2 = resolve21(attestation.installPath);
             let installPathStat;
             try {
               installPathStat = await lstat11(installPath2);
@@ -79102,8 +79944,8 @@ function createPluginMarketplaceAdapter(deps = {}) {
               });
             }
             const sepK = process.platform === "win32" ? "\\" : "/";
-            const relToManaged = relative17(managedRootReal, installPathReal2);
-            if (relToManaged !== "" && (isAbsolute14(relToManaged) || relToManaged === ".." || relToManaged.startsWith(`..${sepK}`))) {
+            const relToManaged = relative18(managedRootReal, installPathReal2);
+            if (relToManaged !== "" && (isAbsolute15(relToManaged) || relToManaged === ".." || relToManaged.startsWith(`..${sepK}`))) {
               return createResult({
                 actionType,
                 status: ActionStatus.OBSERVED,
@@ -79205,9 +80047,245 @@ function createPluginMarketplaceAdapter(deps = {}) {
               observation: observation2
             });
           }
+          if (platform && !platform.automatable && actionType === ActionType.CODEBUDDY_MARKETPLACE_INSTALL) {
+            const expectedRef = action.ref ?? `v${action.version}`;
+            let boundPlanDigest;
+            try {
+              boundPlanDigest = await resolveCodeBuddyBoundPlanDigest(context);
+            } catch (planErr) {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: {
+                  installed: false,
+                  error: `cannot bind codebuddy observation to the frozen plan: ${planErr.message}`
+                }
+              });
+            }
+            let attestationDir;
+            try {
+              attestationDir = codebuddyAuthorityDir(context, boundPlanDigest, action.plugin);
+            } catch (dirErr) {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: { installed: false, error: dirErr.message }
+              });
+            }
+            let requirement = null;
+            try {
+              requirement = JSON.parse(await readFile20(resolve21(attestationDir, CODEBUDDY_REQUIREMENT_FILE), "utf8"));
+            } catch {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: {
+                  installed: false,
+                  manualInstallRequired: true,
+                  error: "codebuddy manual-install requirement is missing; run execute first"
+                }
+              });
+            }
+            if (requirement.planDigest !== boundPlanDigest || requirement.plugin !== action.plugin || requirement.version !== action.version || requirement.entrySkill !== action.entrySkill || requirement.repo !== action.repo || requirement.ref !== expectedRef) {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: {
+                  installed: false,
+                  error: "codebuddy manual-install requirement does not match the frozen plan/action"
+                }
+              });
+            }
+            let attestation = null;
+            try {
+              attestation = JSON.parse(await readFile20(resolve21(attestationDir, CODEBUDDY_ATTESTATION_FILE), "utf8"));
+            } catch {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: {
+                  installed: false,
+                  manualInstallRequired: true,
+                  marketplaceSource: CODEBUDDY_MARKETPLACE_SOURCE,
+                  attestationDir,
+                  error: `codebuddy attestation is missing; write ${resolve21(attestationDir, CODEBUDDY_ATTESTATION_FILE)} after the manual install (marketplace ${CODEBUDDY_MARKETPLACE_SOURCE})`
+                }
+              });
+            }
+            const attestationCheck = validateCodeBuddyAttestation(attestation, action, (/* @__PURE__ */ new Date()).toISOString(), boundPlanDigest);
+            if (!attestationCheck.valid) {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: { installed: false, error: attestationCheck.error }
+              });
+            }
+            const installPath2 = resolve21(attestation.installPath);
+            let installPathStat;
+            try {
+              installPathStat = await lstat11(installPath2);
+            } catch {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: { installed: false, error: `codebuddy install path does not exist: ${attestation.installPath}` }
+              });
+            }
+            if (installPathStat.isSymbolicLink()) {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: { installed: false, error: `codebuddy install path must not be a symlink: ${attestation.installPath}` }
+              });
+            }
+            if (!installPathStat.isDirectory()) {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: { installed: false, error: `codebuddy install path must be a directory: ${attestation.installPath}` }
+              });
+            }
+            const installPathReal2 = await realpath11(installPath2).catch(() => null);
+            if (!installPathReal2) {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: { installed: false, error: `codebuddy install path cannot be resolved: ${attestation.installPath}` }
+              });
+            }
+            if (attestation.installChannel === "cli") {
+              const cliHome = codebuddyCliHome(attestationDir);
+              const cliHomeReal = await realpath11(cliHome).catch(() => null);
+              if (!cliHomeReal) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.OBSERVED,
+                  observation: {
+                    installed: false,
+                    error: `codebuddy isolated CLI home does not exist or cannot be resolved: ${cliHome}`
+                  }
+                });
+              }
+              const cliRootAbs = codebuddyCliInstallRoot(cliHomeReal, attestation.marketplace, action.plugin);
+              const cliRootReal = await realpath11(cliRootAbs).catch(() => null);
+              if (!cliRootReal) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.OBSERVED,
+                  observation: {
+                    installed: false,
+                    error: `codebuddy CLI marketplace plugin root does not exist: ${cliRootAbs}`
+                  }
+                });
+              }
+              const sepC = process.platform === "win32" ? "\\" : "/";
+              const relToRoot = relative18(cliRootReal, installPathReal2);
+              if (relToRoot !== "" && (isAbsolute15(relToRoot) || relToRoot === ".." || relToRoot.startsWith(`..${sepC}`))) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.OBSERVED,
+                  observation: {
+                    installed: false,
+                    error: `codebuddy install path escapes the isolated CLI marketplace root (${cliRootReal}): ${attestation.installPath}`
+                  }
+                });
+              }
+            }
+            let manifestDigest2;
+            let payloadBinding2 = null;
+            try {
+              payloadBinding2 = await verifyInstalledMarketplacePayload(action, context, installPathReal2, consumer);
+              manifestDigest2 = payloadBinding2.manifestDigest;
+            } catch (digestErr) {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: {
+                  installed: true,
+                  installPath: installPathReal2,
+                  error: `failed to bind installed codebuddy payload to frozen authority: ${digestErr.message}`
+                }
+              });
+            }
+            if (manifestDigest2 !== action.manifestDigest) {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: {
+                  installed: true,
+                  installPath: installPathReal2,
+                  error: "installed codebuddy payload digest does not match the frozen plan digest"
+                }
+              });
+            }
+            let installedManifest;
+            try {
+              const readManifest = await platform.strategy.readManifest(installPathReal2);
+              installedManifest = readManifest.manifest;
+              await resolveCodeBuddyEntrySkillFile(installPathReal2, installedManifest, action.entrySkill);
+            } catch (entryErr) {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: {
+                  installed: true,
+                  installPath: installPathReal2,
+                  manifestDigest: manifestDigest2,
+                  entrySkillFound: false,
+                  error: `codebuddy entry skill not resolvable in installed copy: ${entryErr.message}`
+                }
+              });
+            }
+            if (installedManifest.name !== action.plugin) {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: {
+                  installed: true,
+                  installPath: installPathReal2,
+                  manifestDigest: manifestDigest2,
+                  entrySkillFound: true,
+                  error: `installed codebuddy manifest name "${installedManifest.name}" does not match action plugin "${action.plugin}"`
+                }
+              });
+            }
+            if (installedManifest.version !== action.version) {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: {
+                  installed: true,
+                  installPath: installPathReal2,
+                  manifestDigest: manifestDigest2,
+                  entrySkillFound: true,
+                  error: `installed codebuddy manifest version "${installedManifest.version}" does not match action version "${action.version}"`
+                }
+              });
+            }
+            const observation2 = {
+              installed: true,
+              installPath: installPathReal2,
+              entrySkillFound: true,
+              entrySkill: action.entrySkill,
+              manifestDigest: manifestDigest2,
+              consumer,
+              plugin: installedManifest.name,
+              version: installedManifest.version,
+              repo: action.repo,
+              ref: expectedRef,
+              marketplace: attestation.marketplace,
+              installChannel: attestation.installChannel,
+              ...extraInstalledPathsAudit(payloadBinding2)
+            };
+            return createResult({
+              actionType,
+              status: ActionStatus.OBSERVED,
+              observation: observation2
+            });
+          }
           let evidence = null;
           try {
-            const evidenceRaw = await readFile19(resolve20(runDir, "evidence", `${consumer}-${action.plugin}`, "release-skill-install-evidence.json"), "utf8");
+            const evidenceRaw = await readFile20(resolve21(runDir, "evidence", `${consumer}-${action.plugin}`, "release-skill-install-evidence.json"), "utf8");
             evidence = JSON.parse(evidenceRaw);
           } catch {
             return createResult({
@@ -79292,9 +80370,9 @@ function createPluginMarketplaceAdapter(deps = {}) {
           }
           const isolatedHomeReal = await realpath11(isolatedHome).catch(() => isolatedHome);
           const installPathReal = await realpath11(installPath).catch(() => installPath);
-          const relToHome = relative17(isolatedHomeReal, installPathReal);
+          const relToHome = relative18(isolatedHomeReal, installPathReal);
           const sep4 = process.platform === "win32" ? "\\" : "/";
-          if (relToHome !== "" && (isAbsolute14(relToHome) || relToHome === ".." || relToHome.startsWith(`..${sep4}`))) {
+          if (relToHome !== "" && (isAbsolute15(relToHome) || relToHome === ".." || relToHome.startsWith(`..${sep4}`))) {
             return createResult({
               actionType,
               status: ActionStatus.OBSERVED,
@@ -79304,7 +80382,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
               }
             });
           }
-          const entrySkillPath = resolve20(installPath, "skills", action.entrySkill, "SKILL.md");
+          const entrySkillPath = resolve21(installPath, "skills", action.entrySkill, "SKILL.md");
           let entrySkillFound = false;
           try {
             const skillStat = await lstat11(entrySkillPath);
@@ -79373,8 +80451,8 @@ function createPluginMarketplaceAdapter(deps = {}) {
             });
           }
           try {
-            const installedManifestPath = resolve20(installPath, platform.manifestPaths.plugin);
-            const installedManifestContent = await readFile19(installedManifestPath, "utf8");
+            const installedManifestPath = resolve21(installPath, platform.manifestPaths.plugin);
+            const installedManifestContent = await readFile20(installedManifestPath, "utf8");
             const installedManifest = JSON.parse(installedManifestContent);
             const expectedName = observation.plugin;
             if (expectedName && installedManifest.name !== expectedName) {
@@ -79444,6 +80522,10 @@ function createPluginMarketplaceAdapter(deps = {}) {
           }
           if (evidence.repo) observation.repo = evidence.repo;
           if (evidence.ref) observation.ref = evidence.ref;
+          if (action.marketplaceLocation === "external") {
+            observation.marketplaceLocation = action.marketplaceLocation;
+            observation.marketplaceCommitSha = action.marketplaceCommitSha;
+          }
           return createResult({
             actionType,
             status: ActionStatus.OBSERVED,
@@ -79489,17 +80571,19 @@ function createPluginMarketplaceAdapter(deps = {}) {
     }
   });
 }
-var execFile9, NAME4, PAYLOAD_CONTRACT_DECLARED_MANIFEST, EXTRA_INSTALLED_PATHS_CAP, PAYLOAD_CONFLICT_REPORT_CAP, SUPPORTED_TYPES, SAFE_REPO_RE, CONSUMER_IDS, STRICT_SEMVER_RE;
+var execFile9, NAME4, PAYLOAD_CONTRACT_DECLARED_MANIFEST, PAYLOAD_CONTRACT_EXTERNAL_MARKETPLACE, EXTRA_INSTALLED_PATHS_CAP, PAYLOAD_CONFLICT_REPORT_CAP, SUPPORTED_TYPES, SAFE_REPO_RE, CONSUMER_IDS, STRICT_SEMVER_RE;
 var init_plugin_marketplace = __esm({
   async "src/adapters/plugin-marketplace.mjs"() {
     init_contract();
     init_frozen();
     await init_registry();
     await init_kimi();
+    init_codebuddy();
     execFile9 = promisify10(execFileCb10);
     NAME4 = "plugin-marketplace";
     __name(transportPayload, "transportPayload");
     PAYLOAD_CONTRACT_DECLARED_MANIFEST = "declared-manifest-v1";
+    PAYLOAD_CONTRACT_EXTERNAL_MARKETPLACE = "external-marketplace-v1";
     EXTRA_INSTALLED_PATHS_CAP = 200;
     PAYLOAD_CONFLICT_REPORT_CAP = 10;
     __name(extractDeclaredPluginSource, "extractDeclaredPluginSource");
@@ -79508,12 +80592,15 @@ var init_plugin_marketplace = __esm({
     __name(extraInstalledPathsAudit, "extraInstalledPathsAudit");
     __name(normalizeKimiSkillsRel, "normalizeKimiSkillsRel");
     __name(resolveKimiEntrySkillFile, "resolveKimiEntrySkillFile");
+    __name(normalizeCodeBuddySkillsRel, "normalizeCodeBuddySkillsRel");
+    __name(resolveCodeBuddyEntrySkillFile, "resolveCodeBuddyEntrySkillFile");
     SUPPORTED_TYPES = [
       ActionType.PLUGIN_MANIFEST_VALIDATE,
       ActionType.PLUGIN_INSTALL_CHECK,
       ActionType.CLAUDE_MARKETPLACE_INSTALL,
       ActionType.CODEX_MARKETPLACE_INSTALL,
-      ActionType.KIMI_MARKETPLACE_INSTALL
+      ActionType.KIMI_MARKETPLACE_INSTALL,
+      ActionType.CODEBUDDY_MARKETPLACE_INSTALL
     ];
     SAFE_REPO_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*\/[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
     CONSUMER_IDS = new Set(PLATFORMS.map((p) => p.id));
@@ -79533,8 +80620,8 @@ __export(verify_exports, {
   runSmokeTest: () => runSmokeTest,
   verifyRelease: () => verifyRelease
 });
-import { readFile as readFile20, writeFile as writeFile8, mkdtemp as mkdtemp3, rm as rm7, mkdir as mkdir14, lstat as lstat12, realpath as realpath12 } from "node:fs/promises";
-import { dirname as dirname12, join as join16, relative as relative18, isAbsolute as isAbsolute15, resolve as resolve21 } from "node:path";
+import { readFile as readFile21, writeFile as writeFile8, mkdtemp as mkdtemp3, rm as rm7, mkdir as mkdir15, lstat as lstat12, realpath as realpath12 } from "node:fs/promises";
+import { dirname as dirname12, join as join17, relative as relative19, isAbsolute as isAbsolute16, resolve as resolve22 } from "node:path";
 import { tmpdir as tmpdir2 } from "node:os";
 import { execFile as execFileCb11 } from "node:child_process";
 import { promisify as promisify11 } from "node:util";
@@ -79560,8 +80647,8 @@ function matchesSubset2(actual, expected) {
 }
 async function runSmokeTest(plan, root, options = {}) {
   const baseDir = options.baseDir ?? tmpdir2();
-  await mkdir14(baseDir, { recursive: true });
-  const tmpDir = await mkdtemp3(join16(baseDir, "verify-smoke-"));
+  await mkdir15(baseDir, { recursive: true });
+  const tmpDir = await mkdtemp3(join17(baseDir, "verify-smoke-"));
   const npmExec = options.npmExecutor ?? defaultNpmExecutor;
   const installFlags = [
     "--ignore-scripts",
@@ -79607,7 +80694,7 @@ async function runSmokeTest(plan, root, options = {}) {
     for (const { package: pkgName, registry, targetVersion, unitId, smokeBin, smokeArgs, smokeExpectedJson } of npmDistributions) {
       const packageAtVersion = `${pkgName}@${targetVersion}`;
       const installDir = resolveUnitScopedPath(tmpDir, unitId);
-      await mkdir14(join16(installDir, "node_modules"), { recursive: true });
+      await mkdir15(join17(installDir, "node_modules"), { recursive: true });
       const registryFlags = [...installFlags, "--registry", registry];
       const installResult = await npmExec.install(
         packageAtVersion,
@@ -79625,10 +80712,10 @@ async function runSmokeTest(plan, root, options = {}) {
           }
         };
       }
-      const installedPkgPath = join16(installDir, "node_modules", pkgName, "package.json");
+      const installedPkgPath = join17(installDir, "node_modules", pkgName, "package.json");
       let installedPkg;
       try {
-        installedPkg = JSON.parse(await readFile20(installedPkgPath, "utf8"));
+        installedPkg = JSON.parse(await readFile21(installedPkgPath, "utf8"));
       } catch {
         return {
           passed: false,
@@ -79659,7 +80746,7 @@ async function runSmokeTest(plan, root, options = {}) {
           }
         };
       }
-      const pkgRoot = join16(installDir, "node_modules", pkgName);
+      const pkgRoot = join17(installDir, "node_modules", pkgName);
       gateResults.push(...await runConsumerVerificationGates({
         plan,
         unitId,
@@ -79701,10 +80788,10 @@ async function runSmokeTest(plan, root, options = {}) {
           }
         };
       }
-      const binPath = resolve21(pkgRoot, binRelative);
-      const relBin = relative18(pkgRoot, binPath);
+      const binPath = resolve22(pkgRoot, binRelative);
+      const relBin = relative19(pkgRoot, binPath);
       const sep4 = process.platform === "win32" ? "\\" : "/";
-      if (isAbsolute15(relBin) || relBin === ".." || relBin.startsWith(`..${sep4}`)) {
+      if (isAbsolute16(relBin) || relBin === ".." || relBin.startsWith(`..${sep4}`)) {
         return {
           passed: false,
           details: {
@@ -79718,8 +80805,8 @@ async function runSmokeTest(plan, root, options = {}) {
       try {
         binStat = await lstat12(binPath);
         const [pkgRootReal, binPathReal] = await Promise.all([realpath12(pkgRoot), realpath12(binPath)]);
-        const relReal = relative18(pkgRootReal, binPathReal);
-        if (!binStat.isFile() || binStat.isSymbolicLink() || isAbsolute15(relReal) || relReal === ".." || relReal.startsWith(`..${sep4}`)) {
+        const relReal = relative19(pkgRootReal, binPathReal);
+        if (!binStat.isFile() || binStat.isSymbolicLink() || isAbsolute16(relReal) || relReal === ".." || relReal.startsWith(`..${sep4}`)) {
           throw new Error("bin is not a regular file inside the installed package");
         }
       } catch (err) {
@@ -79849,7 +80936,7 @@ async function verifyRelease(options) {
   }
   let planRaw;
   try {
-    planRaw = await readFile20(planPath, "utf8");
+    planRaw = await readFile21(planPath, "utf8");
   } catch (err) {
     throw new ReleaseError(
       GATE_FAILED,
@@ -79871,7 +80958,7 @@ async function verifyRelease(options) {
   const runId = `verify-${Date.now()}`;
   const requestedRunDir = runDirOpt ?? resolveDefaultRunDir(planPath, "verify", runId);
   const runDir = plan.production ? await createProductionRunDir(requestedRunDir, planPath) : requestedRunDir;
-  if (!plan.production) await mkdir14(runDir, { recursive: true });
+  if (!plan.production) await mkdir15(runDir, { recursive: true });
   const evidence = createEvidenceWriter({ runDir, command: "verify", clock: clockFn });
   try {
     await evidence.append({ phase: "verify", step: "plan-load", status: "started" });
@@ -79919,7 +81006,7 @@ async function verifyRelease(options) {
       }
       let approvalRaw;
       try {
-        approvalRaw = await readFile20(sourceRun.approvalPath, "utf8");
+        approvalRaw = await readFile21(sourceRun.approvalPath, "utf8");
       } catch (error) {
         throw new ReleaseError(
           GATE_FAILED,
@@ -79978,7 +81065,8 @@ async function verifyRelease(options) {
     const MARKETPLACE_TYPES3 = /* @__PURE__ */ new Set([
       "claude-marketplace-install",
       "codex-marketplace-install",
-      "kimi-marketplace-install"
+      "kimi-marketplace-install",
+      "codebuddy-marketplace-install"
     ]);
     for (const action of actions) {
       const adapterActionType = ADAPTER_ACTION_TYPE_MAP2[action.type];
@@ -80077,14 +81165,14 @@ async function verifyRelease(options) {
           evidence,
           env: gateEnv ?? process.env,
           fixedEnv: action.type === "claude-marketplace-install" ? {
-            HOME: resolve21(runDir, "consumers", `claude-${action.parameters.plugin}`),
-            CLAUDE_CONFIG_DIR: resolve21(runDir, "consumers", `claude-${action.parameters.plugin}`, ".claude")
+            HOME: resolve22(runDir, "consumers", `claude-${action.parameters.plugin}`),
+            CLAUDE_CONFIG_DIR: resolve22(runDir, "consumers", `claude-${action.parameters.plugin}`, ".claude")
           } : action.type === "codex-marketplace-install" ? {
-            HOME: resolve21(runDir, "consumers", `codex-${action.parameters.plugin}`),
-            CODEX_HOME: resolve21(runDir, "consumers", `codex-${action.parameters.plugin}`)
+            HOME: resolve22(runDir, "consumers", `codex-${action.parameters.plugin}`),
+            CODEX_HOME: resolve22(runDir, "consumers", `codex-${action.parameters.plugin}`)
           } : {
-            HOME: resolve21(runDir, "consumers", `kimi-${action.parameters.plugin}`),
-            KIMI_CODE_HOME: resolve21(runDir, "consumers", `kimi-${action.parameters.plugin}`)
+            HOME: resolve22(runDir, "consumers", `kimi-${action.parameters.plugin}`),
+            KIMI_CODE_HOME: resolve22(runDir, "consumers", `kimi-${action.parameters.plugin}`)
           }
         }));
       } else {
@@ -80165,7 +81253,7 @@ async function verifyRelease(options) {
     assertTransition(PUBLISHED, VERIFIED);
     await evidence.append({ phase: "verify", status: "completed", overallStatus: VERIFIED });
     const sourceRunDigest = sourceRun.runDigest ?? computeRunDigest(sourceRun);
-    const verifyRunPath = join16(runDir, "release-run.json");
+    const verifyRunPath = join17(runDir, "release-run.json");
     const verifyRunState = {
       runId,
       command: "verify",
@@ -80246,7 +81334,8 @@ var init_verify = __esm({
       "github-release": "github-release",
       "claude-marketplace-install": "claude-marketplace-install",
       "codex-marketplace-install": "codex-marketplace-install",
-      "kimi-marketplace-install": "kimi-marketplace-install"
+      "kimi-marketplace-install": "kimi-marketplace-install",
+      "codebuddy-marketplace-install": "codebuddy-marketplace-install"
     };
     __name(defaultClock4, "defaultClock");
     __name(matchesSubset2, "matchesSubset");
@@ -80260,7 +81349,7 @@ var init_verify = __esm({
           exec: execFile10,
           env: process.env
         });
-        const userConfig = join16(cwd, ".release-skill-npmrc");
+        const userConfig = join17(cwd, ".release-skill-npmrc");
         await writeFile8(
           userConfig,
           `registry=${normalizedRegistry}/
@@ -80320,11 +81409,11 @@ __export(publish_exports, {
   classifyPreObservation: () => classifyPreObservation,
   publishRelease: () => publishRelease
 });
-import { readFile as readFile21, mkdir as mkdir15 } from "node:fs/promises";
-import { isAbsolute as isAbsolute16, join as join17, relative as relative19 } from "node:path";
+import { readFile as readFile22, mkdir as mkdir16 } from "node:fs/promises";
+import { isAbsolute as isAbsolute17, join as join18, relative as relative20 } from "node:path";
 function assertInsideAssetRoot(assetRoot, candidate, label) {
-  const rel = relative19(assetRoot, candidate);
-  if (rel === "" || isAbsolute16(rel) || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)) {
+  const rel = relative20(assetRoot, candidate);
+  if (rel === "" || isAbsolute17(rel) || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)) {
     throw new ReleaseError(GATE_FAILED, `${label} must be a child of the production asset root`);
   }
 }
@@ -80554,7 +81643,7 @@ async function publishRelease(options) {
   const captureBaselineActual = typeof captureBaselineFn === "function" ? captureBaselineFn : captureBaseline;
   let planRaw;
   try {
-    planRaw = await readFile21(planPath, "utf8");
+    planRaw = await readFile22(planPath, "utf8");
   } catch (err) {
     throw new ReleaseError(GATE_FAILED, `cannot read release plan: ${err.message}`, { planPath, cause: err.code });
   }
@@ -80572,7 +81661,7 @@ async function publishRelease(options) {
   if (isProductionPlan) {
     runDir = await createProductionRunDir(runDir, planPath);
   } else {
-    await mkdir15(runDir, { recursive: true });
+    await mkdir16(runDir, { recursive: true });
   }
   const evidence = createEvidenceWriter({ runDir, command: "publish", clock: clockFn });
   try {
@@ -80664,7 +81753,7 @@ async function publishRelease(options) {
     await evidence.append({ phase: "safety-gate", gate: "approval-load", status: "started" });
     let approvalRaw;
     try {
-      approvalRaw = await readFile21(approvalPath, "utf8");
+      approvalRaw = await readFile22(approvalPath, "utf8");
     } catch (err) {
       throw new ReleaseError(
         GATE_FAILED,
@@ -80936,7 +82025,7 @@ async function publishRelease(options) {
       }
     }
     await evidence.append({ phase: "safety-gate", gate: "global-preflight", status: "passed" });
-    const runPath = join17(runDir, "release-run.json");
+    const runPath = join18(runDir, "release-run.json");
     const checkpoints = orderedActions.map((action) => ({
       actionId: action.id,
       actionType: action.type,
@@ -81165,7 +82254,8 @@ var init_publish = __esm({
     MARKETPLACE_TYPES2 = /* @__PURE__ */ new Set([
       "claude-marketplace-install",
       "codex-marketplace-install",
-      "kimi-marketplace-install"
+      "kimi-marketplace-install",
+      "codebuddy-marketplace-install"
     ]);
     __name(defaultClock5, "defaultClock");
     __name(deepClone, "deepClone");
@@ -81183,8 +82273,8 @@ var init_publish = __esm({
 });
 
 // src/artifacts/policy.mjs
-import { readFile as readFile22 } from "node:fs/promises";
-import { join as join18 } from "node:path";
+import { readFile as readFile23 } from "node:fs/promises";
+import { join as join19 } from "node:path";
 import { createHash as createHash11 } from "node:crypto";
 function validateArtifactPolicy(policy) {
   const ok = _validate(policy);
@@ -81280,10 +82370,10 @@ async function parseSafeYamlWithinRoot(root, policyPath) {
     }
     throw err;
   }
-  const fullPath = join18(root, policyPath);
+  const fullPath = join19(root, policyPath);
   let content;
   try {
-    content = await readFile22(fullPath, "utf8");
+    content = await readFile23(fullPath, "utf8");
   } catch (err) {
     throw new ReleaseError(
       ARTIFACT_POLICY_INVALID,
@@ -81394,8 +82484,8 @@ var init_policy = __esm({
 });
 
 // src/artifacts/entry.mjs
-import { lstat as lstat13, readdir as readdir10, readFile as readFile23 } from "node:fs/promises";
-import { join as join19 } from "node:path";
+import { lstat as lstat13, readdir as readdir10, readFile as readFile24 } from "node:fs/promises";
+import { join as join20 } from "node:path";
 import { promisify as promisify12 } from "node:util";
 import { execFile as execFile11 } from "node:child_process";
 function statToGitMode(stat9) {
@@ -81418,7 +82508,7 @@ async function enumerateTreeEntries(root, dirPath, relBase) {
   const items = await readdir10(dirPath, { withFileTypes: true });
   for (const item of items) {
     if (SKIP_DIRS2.has(item.name)) continue;
-    const absPath = join19(dirPath, item.name);
+    const absPath = join20(dirPath, item.name);
     const relPath = relBase ? `${relBase}/${item.name}` : item.name;
     const st = await lstat13(absPath);
     if (st.isSymbolicLink()) {
@@ -81439,7 +82529,7 @@ async function enumerateTreeEntries(root, dirPath, relBase) {
       const subEntries = await enumerateTreeEntries(root, absPath, relPath);
       entries.push(...subEntries);
     } else {
-      const content = await readFile23(absPath);
+      const content = await readFile24(absPath);
       entries.push(
         Object.freeze({
           path: relPath,
@@ -81469,7 +82559,7 @@ async function readEntry({ root, path: path3, source = "worktree" } = {}) {
   if (source !== "worktree") {
     throw new ReleaseError(PATH_UNSAFE, `unsupported readEntry source: ${source}`, { source });
   }
-  const absPath = join19(root, path3);
+  const absPath = join20(root, path3);
   let st;
   try {
     st = await lstat13(absPath);
@@ -81502,7 +82592,7 @@ async function readEntry({ root, path: path3, source = "worktree" } = {}) {
       { path: path3, nlink: st.nlink }
     );
   }
-  const content = await readFile23(absPath);
+  const content = await readFile24(absPath);
   return Object.freeze({
     kind: "regular",
     path: path3,
@@ -81765,8 +82855,8 @@ var init_graph = __esm({
 });
 
 // src/artifacts/producer-registry.mjs
-import { readFile as readFile24, readdir as readdir11, stat as stat6, mkdir as mkdir16, writeFile as writeFile9, rm as rm8 } from "node:fs/promises";
-import { join as join20 } from "node:path";
+import { readFile as readFile25, readdir as readdir11, stat as stat6, mkdir as mkdir17, writeFile as writeFile9, rm as rm8 } from "node:fs/promises";
+import { join as join21 } from "node:path";
 import { mkdtemp as mkdtemp4 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
 import { createHash as createHash12 } from "node:crypto";
@@ -81787,7 +82877,7 @@ function collectStaticImports(filePath, visited = /* @__PURE__ */ new Set()) {
   const dir = abs.replace(/\/[^/]*$/, "");
   while ((match = importRe.exec(source)) !== null) {
     const spec = match[1];
-    let resolved = join20(dir, spec);
+    let resolved = join21(dir, spec);
     if (!resolved.endsWith(".mjs")) resolved += ".mjs";
     results.push(...collectStaticImports(resolved, visited));
   }
@@ -81795,10 +82885,10 @@ function collectStaticImports(filePath, visited = /* @__PURE__ */ new Set()) {
 }
 async function createBuiltInProducerRegistry() {
   const producers = /* @__PURE__ */ new Map();
-  const lockfilePath = join20(new URL("../../..", import.meta.url).pathname, "pnpm-lock.yaml");
+  const lockfilePath = join21(new URL("../../..", import.meta.url).pathname, "pnpm-lock.yaml");
   let lockfileBytes;
   try {
-    lockfileBytes = await readFile24(lockfilePath);
+    lockfileBytes = await readFile25(lockfilePath);
   } catch {
     lockfileBytes = Buffer.from("");
   }
@@ -81815,7 +82905,7 @@ async function createBuiltInProducerRegistry() {
     const allModuleBytes = await Promise.all(
       allModulePaths.map(async (p) => {
         try {
-          return await readFile24(p);
+          return await readFile25(p);
         } catch {
           return Buffer.from("");
         }
@@ -81835,13 +82925,13 @@ async function readDirEntries(dirPath, relBase = "") {
   const items = await readdir11(dirPath, { withFileTypes: true });
   for (const item of items) {
     if (item.name === ".git") continue;
-    const absPath = join20(dirPath, item.name);
+    const absPath = join21(dirPath, item.name);
     const relPath = relBase ? `${relBase}/${item.name}` : item.name;
     const st = await stat6(absPath);
     if (st.isDirectory()) {
       entries.push(...await readDirEntries(absPath, relPath));
     } else {
-      const content = await readFile24(absPath);
+      const content = await readFile25(absPath);
       entries.push(Object.freeze({
         path: relPath,
         type: "blob",
@@ -81858,11 +82948,11 @@ async function readDirEntries(dirPath, relBase = "") {
 async function materializeEntries(entries, dirPath) {
   for (const entry of entries) {
     if (!entry.path) continue;
-    const targetPath = join20(dirPath, entry.path);
+    const targetPath = join21(dirPath, entry.path);
     if (entry.type === "tree" || entry.kind === "tree") {
-      await mkdir16(targetPath, { recursive: true });
+      await mkdir17(targetPath, { recursive: true });
     } else {
-      await mkdir16(join20(targetPath, ".."), { recursive: true });
+      await mkdir17(join21(targetPath, ".."), { recursive: true });
       if (entry.content) {
         await writeFile9(targetPath, entry.content);
       }
@@ -81906,7 +82996,7 @@ async function runProducerClosure({
   graph,
   inputSnapshot,
   artifactIds,
-  tempRootFactory = /* @__PURE__ */ __name(async () => mkdtemp4(join20(tmpdir3(), "producer-")), "tempRootFactory")
+  tempRootFactory = /* @__PURE__ */ __name(async () => mkdtemp4(join21(tmpdir3(), "producer-")), "tempRootFactory")
 } = {}) {
   const generatedSet = new Set(graph.topologicalOrder);
   for (const id of artifactIds) {
@@ -81943,7 +83033,7 @@ async function runProducerClosure({
         if (inputEntries) {
           const first = inputEntries[0];
           if (first && first.path) {
-            const absPath = first.path.startsWith("/") ? first.path : join20(process.cwd(), first.path);
+            const absPath = first.path.startsWith("/") ? first.path : join21(process.cwd(), first.path);
             try {
               const st = await stat6(absPath);
               if (st.isDirectory()) {
@@ -82367,7 +83457,7 @@ var init_state = __esm({
 });
 
 // src/artifacts/artifact-plan.mjs
-import { writeFile as writeFile10, mkdir as mkdir17, readFile as readFile25, rename as rename3, open as open8 } from "node:fs/promises";
+import { writeFile as writeFile10, mkdir as mkdir18, readFile as readFile26, rename as rename3, open as open8 } from "node:fs/promises";
 import { dirname as dirname13 } from "node:path";
 function assemblePlan({
   operation,
@@ -82392,7 +83482,7 @@ function assemblePlan({
 }
 async function writePlan(plan, outputPath) {
   const dir = dirname13(outputPath);
-  await mkdir17(dir, { recursive: true });
+  await mkdir18(dir, { recursive: true });
   const tmpPath = `${outputPath}.tmp`;
   const content = JSON.stringify(plan, null, 2);
   const fh = await open8(tmpPath, "w");
@@ -83056,8 +84146,8 @@ var init_adoption = __esm({
 // src/artifacts/inspect.mjs
 import { promisify as promisify15 } from "node:util";
 import { execFile as execFile14 } from "node:child_process";
-import { readdir as readdir12, stat as stat7, readFile as readFile26 } from "node:fs/promises";
-import { join as join21 } from "node:path";
+import { readdir as readdir12, stat as stat7, readFile as readFile27 } from "node:fs/promises";
+import { join as join22 } from "node:path";
 async function hasNestedGitRoots(root) {
   try {
     const { stdout } = await execFileAsync5(
@@ -83067,9 +84157,9 @@ async function hasNestedGitRoots(root) {
     );
     const dirs = stdout.split("\n").filter((s) => s.length > 0);
     for (const dir of dirs) {
-      const absDir = join21(root, dir);
+      const absDir = join22(root, dir);
       try {
-        const nestedGit = join21(absDir, ".git");
+        const nestedGit = join22(absDir, ".git");
         await stat7(nestedGit);
         return true;
       } catch {
@@ -83328,8 +84418,8 @@ var init_inspect = __esm({
 });
 
 // src/artifacts/resolution.mjs
-import { mkdir as mkdir18, open as open9, readFile as readFile27, stat as stat8, lstat as lstat14, chmod as chmod4 } from "node:fs/promises";
-import { join as join22, resolve as resolve22, relative as relative20, isAbsolute as isAbsolute17, basename as basename8 } from "node:path";
+import { mkdir as mkdir19, open as open9, readFile as readFile28, stat as stat8, lstat as lstat14, chmod as chmod4 } from "node:fs/promises";
+import { join as join23, resolve as resolve23, relative as relative21, isAbsolute as isAbsolute18, basename as basename8 } from "node:path";
 function decodeBuffer(value, label) {
   if (value == null) return null;
   if (Buffer.isBuffer(value)) return value;
@@ -83431,9 +84521,9 @@ function assertSafeArtifactId(id) {
 }
 async function assertNoSymlinksInPath(root, artifactId) {
   const levels = [
-    join22(root, ".release-skill"),
-    join22(root, ".release-skill", "resolution"),
-    join22(root, ".release-skill", "resolution", artifactId)
+    join23(root, ".release-skill"),
+    join23(root, ".release-skill", "resolution"),
+    join23(root, ".release-skill", "resolution", artifactId)
   ];
   for (const dir of levels) {
     try {
@@ -83449,11 +84539,11 @@ async function assertNoSymlinksInPath(root, artifactId) {
   }
 }
 async function assertSafeResolvedPath(root, artifactId, resolvedPath) {
-  const resolutionDir = resolve22(root, ".release-skill", "resolution", artifactId);
-  const resolved = resolve22(resolvedPath);
+  const resolutionDir = resolve23(root, ".release-skill", "resolution", artifactId);
+  const resolved = resolve23(resolvedPath);
   await assertNoSymlinksInPath(root, artifactId);
-  const rel = relative20(resolutionDir, resolved);
-  if (rel.startsWith("..") || isAbsolute17(rel)) {
+  const rel = relative21(resolutionDir, resolved);
+  if (rel.startsWith("..") || isAbsolute18(rel)) {
     throw new ReleaseError(
       PATH_UNSAFE,
       `resolvedPath must be inside resolution directory ${resolutionDir}`,
@@ -83468,7 +84558,7 @@ async function assertSafeResolvedPath(root, artifactId, resolvedPath) {
       { resolvedPath, expected: `${artifactId}.resolved`, actual: filename }
     );
   }
-  if (resolved !== resolve22(resolutionDir, `${artifactId}.resolved`)) {
+  if (resolved !== resolve23(resolutionDir, `${artifactId}.resolved`)) {
     throw new ReleaseError(
       PATH_UNSAFE,
       "resolvedPath must be the exact materialized resolution file",
@@ -83612,13 +84702,13 @@ async function materializeResolution({
   const template = buildConflictTemplate(artifact.conflict ?? {}, decodedBuffers);
   const templateDigest = sha256Hex(template);
   await assertNoSymlinksInPath(root, artifactId);
-  const resolutionDir = join22(root, ".release-skill", "resolution", artifactId);
-  await mkdir18(resolutionDir, { recursive: true, mode: 448 });
+  const resolutionDir = join23(root, ".release-skill", "resolution", artifactId);
+  await mkdir19(resolutionDir, { recursive: true, mode: 448 });
   const dirStat = await stat8(resolutionDir);
   if ((dirStat.mode & 511) !== 448) {
     await chmod4(resolutionDir, 448);
   }
-  const resolvedPath = join22(resolutionDir, `${artifactId}.resolved`);
+  const resolvedPath = join23(resolutionDir, `${artifactId}.resolved`);
   const fh = await open9(resolvedPath, "wx", 384);
   try {
     await fh.write(template, 0, template.length);
@@ -83660,7 +84750,7 @@ async function submitResolution({
 async function readAndValidateResolvedFile(resolvedPath) {
   let content;
   try {
-    content = await readFile27(resolvedPath);
+    content = await readFile28(resolvedPath);
   } catch (err) {
     throw new ReleaseError(MISSING_PARAMETERS, `cannot read resolved file: ${err.message}`, { resolvedPath, cause: err.code });
   }
@@ -83828,8 +84918,8 @@ var artifacts_exports = {};
 __export(artifacts_exports, {
   runArtifactsCommand: () => runArtifactsCommand
 });
-import { readFile as readFile28 } from "node:fs/promises";
-import { join as join23 } from "node:path";
+import { readFile as readFile29 } from "node:fs/promises";
+import { join as join24 } from "node:path";
 async function runArtifactsCommand({ subcommand, args: args2, root } = {}) {
   if (!VALID_SUBCOMMANDS.has(subcommand)) {
     throw new ReleaseError(
@@ -83957,7 +85047,7 @@ async function handleAdopt({ args: args2, root }) {
       { subcommand: "adopt" }
     );
   }
-  const planRaw = await readFile28(planPath, "utf8");
+  const planRaw = await readFile29(planPath, "utf8");
   const plan = JSON.parse(planRaw);
   if (expectedDigest && plan.planDigest !== expectedDigest) {
     throw new ReleaseError(
@@ -83972,7 +85062,7 @@ async function handleAdopt({ args: args2, root }) {
     if (artifact.path) {
       const entry = await readEntry({ root, path: artifact.path, source: "worktree" });
       if (entry.kind === "regular") {
-        const bytes = await readFile28(join23(root, artifact.path));
+        const bytes = await readFile29(join24(root, artifact.path));
         currentEntries.set(artifact.id, Object.freeze({ ...entry, bytes, content: bytes }));
       } else {
         currentEntries.set(artifact.id, entry);
@@ -84037,7 +85127,7 @@ async function handleBootstrap({ args: args2, root }) {
       { subcommand: "bootstrap" }
     );
   }
-  const planRaw = await readFile28(planPath, "utf8");
+  const planRaw = await readFile29(planPath, "utf8");
   const adoptionPlan = JSON.parse(planRaw);
   const currentEntries = /* @__PURE__ */ new Map();
   for (const id of new Set((adoptionPlan.protectedHunks ?? []).map((h) => h.artifactId))) {
@@ -84049,12 +85139,12 @@ async function handleBootstrap({ args: args2, root }) {
     if (entry.kind !== "regular") {
       throw new ReleaseError("PLAN_STALE", `artifact is no longer a regular file: ${id}`, { id });
     }
-    const bytes = await readFile28(join23(root, artifactPath));
+    const bytes = await readFile29(join24(root, artifactPath));
     currentEntries.set(id, Object.freeze({ ...entry, bytes, content: bytes }));
   }
   let replacementBytes;
   if (action === "replace" && replacementPath) {
-    replacementBytes = await readFile28(replacementPath);
+    replacementBytes = await readFile29(replacementPath);
   }
   const updated = await discardBootstrapHunk({
     adoptionPlan,
@@ -84092,7 +85182,7 @@ async function handleResolve({ args: args2, root }) {
       { subcommand: "resolve" }
     );
   }
-  const planRaw = await readFile28(planPath, "utf8");
+  const planRaw = await readFile29(planPath, "utf8");
   const plan = JSON.parse(planRaw);
   if (plan.planDigest !== expectedDigest) {
     throw new ReleaseError(
@@ -84460,7 +85550,7 @@ var init_docs = __esm({
 });
 
 // bin/release-skill-cli.mjs
-import { basename as basename9, dirname as dirname14, join as join24, resolve as resolve23 } from "node:path";
+import { basename as basename9, dirname as dirname14, join as join25, resolve as resolve24 } from "node:path";
 import { execFile as execFileCb12 } from "node:child_process";
 import { promisify as promisify16 } from "node:util";
 
@@ -84525,6 +85615,24 @@ async function checkDependency(command2, versionArgs = ["--version"]) {
   }
 }
 __name(checkDependency, "checkDependency");
+var CODEBUDDY_MACOS_ABS_PATH = "/Applications/WorkBuddy.app/Contents/Resources/app.asar.unpacked/cli/bin/codebuddy";
+async function checkCodeBuddyDependency() {
+  const candidates = [
+    { source: "PATH:codebuddy", command: "codebuddy" },
+    { source: "PATH:cbc", command: "cbc" },
+    { source: "macOS-bundle", command: CODEBUDDY_MACOS_ABS_PATH }
+  ];
+  const diagnostics = [];
+  for (const { source, command: command2 } of candidates) {
+    const result = await checkDependency(command2, ["--version"]);
+    if (result.available) {
+      return { available: true, version: result.version, diagnostic: "ok", source };
+    }
+    diagnostics.push(`${source}: ${result.diagnostic}`);
+  }
+  return { available: false, version: null, diagnostic: diagnostics.join("; "), source: null };
+}
+__name(checkCodeBuddyDependency, "checkCodeBuddyDependency");
 async function performEnvironmentChecks() {
   const checks = {};
   const nodeCheck = await checkDependency("node", ["--version"]);
@@ -84576,6 +85684,12 @@ async function performEnvironmentChecks() {
     required: false,
     usage: "\u4EC5\u5F53\u8BA1\u5212\u58F0\u660E kimi-plugin distribution \u65F6\u7528\u4E8E\u6D88\u8D39\u8005\u5B89\u88C5\u9A8C\u8BC1"
   };
+  const codebuddyCheck = await checkCodeBuddyDependency();
+  checks.codebuddy = {
+    ...codebuddyCheck,
+    required: false,
+    usage: "\u4EC5\u5F53\u8BA1\u5212\u58F0\u660E codebuddy-plugin distribution \u65F6\u7528\u4E8E\u6D88\u8D39\u8005\u5B89\u88C5\u9A8C\u8BC1\uFF08\u4EBA\u5DE5 attestation \u95ED\u73AF\uFF1BCLI \u65E0\u6CD5\u9489\u6B7B\u51BB\u7ED3 ref\uFF0C\u5B89\u88C5\u7531\u4EBA\u5DE5\u5B8C\u6210\u5E76\u51FA\u5177 attestation\uFF09"
+  };
   return checks;
 }
 __name(performEnvironmentChecks, "performEnvironmentChecks");
@@ -84604,7 +85718,7 @@ function getCapabilityMaturity() {
     publish: {
       available: true,
       mode: "controlled production (protocol-tested; no OS/network sandbox)",
-      description: "Publishes frozen GitHub/npm artifacts and runs configured Claude/Codex/Kimi consumer checkpoints with approval and exact digest confirmation"
+      description: "Publishes frozen GitHub/npm artifacts and runs configured Claude/Codex/Kimi/CodeBuddy consumer checkpoints (CodeBuddy via human attestation closed loop) with approval and exact digest confirmation"
     },
     reconcile: {
       available: true,
@@ -84614,7 +85728,7 @@ function getCapabilityMaturity() {
     verify: {
       available: true,
       mode: "fresh consumer verification (protocol-tested; no OS/network sandbox)",
-      description: "Recheck remote state, exact npm installation, CLI help, and configured Claude/Codex/Kimi installs before VERIFIED"
+      description: "Recheck remote state, exact npm installation, CLI help, and configured Claude/Codex/Kimi/CodeBuddy installs (CodeBuddy via human attestation) before VERIFIED"
     }
   };
 }
@@ -84690,7 +85804,7 @@ if (!command && (args.includes("--version") || args.includes("-v"))) {
   } else {
     const { readFileSync: readFileSync5 } = await import("node:fs");
     const { fileURLToPath: fileURLToPath3 } = await import("node:url");
-    const pkgPath = join24(dirname14(fileURLToPath3(import.meta.url)), "..", "package.json");
+    const pkgPath = join25(dirname14(fileURLToPath3(import.meta.url)), "..", "package.json");
     pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
   }
   if (hasJson) {
@@ -84739,7 +85853,8 @@ if (!command || command === "help") {
           conditionalConsumers: {
             claude: "\u58F0\u660E claude-plugin distribution \u65F6\u5FC5\u987B\u53EF\u7528",
             codex: "\u58F0\u660E codex-plugin distribution \u65F6\u5FC5\u987B\u53EF\u7528",
-            kimi: "\u58F0\u660E kimi-plugin distribution \u65F6\u5FC5\u987B\u53EF\u7528"
+            kimi: "\u58F0\u660E kimi-plugin distribution \u65F6\u5FC5\u987B\u53EF\u7528",
+            codebuddy: "\u58F0\u660E codebuddy-plugin distribution \u65F6\u7528\u4E8E\u4EBA\u5DE5 attestation \u95ED\u73AF\uFF08CLI \u65E0\u6CD5\u9489\u6B7B\u51BB\u7ED3 ref\uFF0C\u5B89\u88C5\u7531\u4EBA\u5DE5\u5B8C\u6210\u5E76\u51FA\u5177 attestation\uFF09"
           }
         }
       },
@@ -84751,9 +85866,9 @@ if (!command || command === "help") {
         prepare: "offline local writes; configured hooks/gates require their explicit side-effect acknowledgements",
         docs: "read-only dry-run by default; write requires --write, exact --confirm-refresh, and --ack-local-document-write; never commits, pushes, or publishes",
         onlinePrepare: "previous-public-baseline observation available; production mode freezes publish artifacts and fails closed on drift or unknown state",
-        publish: "GitHub/npm plus configured Claude/Codex/Kimi consumer checkpoints are protocol-tested without an OS/network sandbox; approval and exact digest confirmation required",
+        publish: "GitHub/npm plus configured Claude/Codex/Kimi/CodeBuddy consumer checkpoints are protocol-tested without an OS/network sandbox (CodeBuddy via human attestation closed loop); approval and exact digest confirmation required",
         reconcile: "PARTIAL recovery is protocol-tested without an OS/network sandbox; remote conflicts require human intervention",
-        verify: "fresh exact npm and Claude/Codex/Kimi consumer installation checks are protocol-tested without an OS/network sandbox; configured consumer processes require explicit acknowledgement; success reaches VERIFIED"
+        verify: "fresh exact npm and Claude/Codex/Kimi/CodeBuddy consumer installation checks are protocol-tested without an OS/network sandbox (CodeBuddy via human attestation); configured consumer processes require explicit acknowledgement; success reaches VERIFIED"
       },
       recommendations: []
     };
@@ -84783,6 +85898,9 @@ if (!command || command === "help") {
     if (!checks.kimi.available) {
       output.recommendations.push("Install Kimi Code CLI before releasing a configured kimi-plugin distribution");
     }
+    if (!checks.codebuddy.available) {
+      output.recommendations.push("Install WorkBuddy (bundled codebuddy CLI) before releasing a configured codebuddy-plugin distribution; the install is a manual attestation closed loop because the CLI cannot pin a frozen ref");
+    }
     console.log(JSON.stringify(output, null, 2));
     process.exit(readiness.status === "READY" ? 0 : 1);
   } else {
@@ -84807,7 +85925,7 @@ if (!COMMANDS.has(command)) {
 if (command === "setup") {
   const rootIdx = args.indexOf("--root");
   const rawRoot = rootIdx !== -1 && args[rootIdx + 1] ? args[rootIdx + 1] : process.cwd();
-  const root = resolve23(rawRoot);
+  const root = resolve24(rawRoot);
   const answersIdx = args.indexOf("--answers");
   const answersPath = answersIdx !== -1 && args[answersIdx + 1] ? args[answersIdx + 1] : void 0;
   const confirmationIdx = args.indexOf("--confirm-setup");
@@ -84842,7 +85960,7 @@ if (command === "setup") {
 if (command === "assess") {
   const rootIdx = args.indexOf("--root");
   const rawRoot = rootIdx !== -1 && args[rootIdx + 1] ? args[rootIdx + 1] : process.cwd();
-  const root = resolve23(rawRoot);
+  const root = resolve24(rawRoot);
   const offline = args.includes("--offline") || !args.includes("--online");
   const outputIdx = args.indexOf("--output");
   const output = outputIdx !== -1 && args[outputIdx + 1] ? args[outputIdx + 1] : void 0;
@@ -84873,7 +85991,7 @@ if (command === "assess") {
 if (command === "prepare") {
   const rootIdx = args.indexOf("--root");
   const rawRoot = rootIdx !== -1 && args[rootIdx + 1] ? args[rootIdx + 1] : process.cwd();
-  const root = resolve23(rawRoot);
+  const root = resolve24(rawRoot);
   const offline = args.includes("--offline") || !args.includes("--online");
   let targetVersion;
   for (const flag of ["--target-version", "--version"]) {
@@ -84888,9 +86006,9 @@ if (command === "prepare") {
   const hookCache = !args.includes("--no-hook-cache");
   const production = args.includes("--production");
   const outputIdx = args.indexOf("--output");
-  const output = outputIdx !== -1 && args[outputIdx + 1] ? resolve23(args[outputIdx + 1]) : void 0;
+  const output = outputIdx !== -1 && args[outputIdx + 1] ? resolve24(args[outputIdx + 1]) : void 0;
   const runDirIdx = args.indexOf("--run-dir");
-  const runDir = runDirIdx !== -1 && args[runDirIdx + 1] ? resolve23(args[runDirIdx + 1]) : void 0;
+  const runDir = runDirIdx !== -1 && args[runDirIdx + 1] ? resolve24(args[runDirIdx + 1]) : void 0;
   try {
     const { prepareRelease: prepareRelease2 } = await init_prepare().then(() => prepare_exports);
     const { readFile: readFileFs } = await import("node:fs/promises");
@@ -84943,7 +86061,7 @@ if (command === "approve") {
   const actorIdx = args.indexOf("--actor");
   const actor = actorIdx !== -1 && args[actorIdx + 1] ? args[actorIdx + 1] : void 0;
   const outputIdx = args.indexOf("--output");
-  const outputPath = outputIdx !== -1 && args[outputIdx + 1] ? resolve23(args[outputIdx + 1]) : void 0;
+  const outputPath = outputIdx !== -1 && args[outputIdx + 1] ? resolve24(args[outputIdx + 1]) : void 0;
   if (!planPath || !expectedDigest || !actor) {
     const msg = "approve requires --plan <path>, --digest <sha256>, and --actor <name>";
     if (hasJson) {
@@ -84955,10 +86073,10 @@ if (command === "approve") {
   }
   try {
     const { approvePlan: approvePlan2 } = await init_approve().then(() => approve_exports);
-    const resolvedPlanPath = resolve23(planPath);
+    const resolvedPlanPath = resolve24(planPath);
     const planDir = dirname14(resolvedPlanPath);
     const releaseDir = basename9(planDir) === "plans" && basename9(resolvedPlanPath) === `${expectedDigest}.json` ? dirname14(planDir) : planDir;
-    const approvalPath = outputPath ?? join24(releaseDir, "approval-record.json");
+    const approvalPath = outputPath ?? join25(releaseDir, "approval-record.json");
     const record = await approvePlan2({ planPath, expectedDigest, actor, outputPath: approvalPath });
     if (hasJson) {
       console.log(JSON.stringify(record, null, 2));
@@ -84985,13 +86103,13 @@ if (command === "approve") {
 if (command === "reconcile") {
   const rootIdx = args.indexOf("--root");
   const rawRoot = rootIdx !== -1 && args[rootIdx + 1] ? args[rootIdx + 1] : process.cwd();
-  const root = resolve23(rawRoot);
+  const root = resolve24(rawRoot);
   const planIdx = args.indexOf("--plan");
-  const planPath = planIdx !== -1 && args[planIdx + 1] ? resolve23(args[planIdx + 1]) : void 0;
+  const planPath = planIdx !== -1 && args[planIdx + 1] ? resolve24(args[planIdx + 1]) : void 0;
   const runIdx = args.indexOf("--run");
-  const runPath = runIdx !== -1 && args[runIdx + 1] ? resolve23(args[runIdx + 1]) : void 0;
+  const runPath = runIdx !== -1 && args[runIdx + 1] ? resolve24(args[runIdx + 1]) : void 0;
   const approvalIdx = args.indexOf("--approval");
-  const approvalPath = approvalIdx !== -1 && args[approvalIdx + 1] ? resolve23(args[approvalIdx + 1]) : void 0;
+  const approvalPath = approvalIdx !== -1 && args[approvalIdx + 1] ? resolve24(args[approvalIdx + 1]) : void 0;
   const confirmationIdx = args.indexOf("--confirm-production");
   const productionConfirmation = confirmationIdx !== -1 && args[confirmationIdx + 1] ? args[confirmationIdx + 1] : void 0;
   if (!planPath || !runPath) {
@@ -85050,11 +86168,11 @@ if (command === "reconcile") {
 if (command === "verify") {
   const rootIdx = args.indexOf("--root");
   const rawRoot = rootIdx !== -1 && args[rootIdx + 1] ? args[rootIdx + 1] : process.cwd();
-  const root = resolve23(rawRoot);
+  const root = resolve24(rawRoot);
   const planIdx = args.indexOf("--plan");
-  const planPath = planIdx !== -1 && args[planIdx + 1] ? resolve23(args[planIdx + 1]) : void 0;
+  const planPath = planIdx !== -1 && args[planIdx + 1] ? resolve24(args[planIdx + 1]) : void 0;
   const runIdx = args.indexOf("--run");
-  const runPath = runIdx !== -1 && args[runIdx + 1] ? resolve23(args[runIdx + 1]) : void 0;
+  const runPath = runIdx !== -1 && args[runIdx + 1] ? resolve24(args[runIdx + 1]) : void 0;
   const verificationGatesAuthorized = args.includes("--acknowledge-gate-side-effects");
   if (!planPath || !runPath) {
     const msg = "verify requires --plan <path> and --run <path>";
@@ -85110,11 +86228,11 @@ if (command === "verify") {
 if (command === "publish") {
   const rootIdx = args.indexOf("--root");
   const rawRoot = rootIdx !== -1 && args[rootIdx + 1] ? args[rootIdx + 1] : process.cwd();
-  const root = resolve23(rawRoot);
+  const root = resolve24(rawRoot);
   const planIdx = args.indexOf("--plan");
-  const planPath = planIdx !== -1 && args[planIdx + 1] ? resolve23(args[planIdx + 1]) : void 0;
+  const planPath = planIdx !== -1 && args[planIdx + 1] ? resolve24(args[planIdx + 1]) : void 0;
   const approvalIdx = args.indexOf("--approval");
-  const approvalPath = approvalIdx !== -1 && args[approvalIdx + 1] ? resolve23(args[approvalIdx + 1]) : void 0;
+  const approvalPath = approvalIdx !== -1 && args[approvalIdx + 1] ? resolve24(args[approvalIdx + 1]) : void 0;
   const confirmationIdx = args.indexOf("--confirm-production");
   const productionConfirmation = confirmationIdx !== -1 && args[confirmationIdx + 1] ? args[confirmationIdx + 1] : void 0;
   if (!planPath || !approvalPath || !productionConfirmation) {
@@ -85173,9 +86291,9 @@ if (command === "publish") {
 if (command === "artifacts") {
   const rootIdx = args.indexOf("--root");
   const rawRoot = rootIdx !== -1 && args[rootIdx + 1] ? args[rootIdx + 1] : process.cwd();
-  const root = resolve23(rawRoot);
+  const root = resolve24(rawRoot);
   const outputIdx = args.indexOf("--output");
-  const output = outputIdx !== -1 && args[outputIdx + 1] ? resolve23(args[outputIdx + 1]) : void 0;
+  const output = outputIdx !== -1 && args[outputIdx + 1] ? resolve24(args[outputIdx + 1]) : void 0;
   const subcommand = positional[1] ?? "status";
   try {
     const { runArtifactsCommand: runArtifactsCommand2 } = await Promise.resolve().then(() => (init_artifacts(), artifacts_exports));
@@ -85242,7 +86360,7 @@ if (command === "docs") {
         );
       }
     }
-    const root = resolve23(rawRoot);
+    const root = resolve24(rawRoot);
     const valuedDocsFlags = /* @__PURE__ */ new Set(["--root", "--unit", "--confirm-refresh"]);
     const booleanDocsFlags = /* @__PURE__ */ new Set(["--json", "--write", "--ack-local-document-write"]);
     let docsSubcommand;