superpowers-manager 0.4.0 → 0.5.0

package/dist/adapter.js

@@ -6,6 +6,7 @@ import { tmpdir } from "node:os";
 import { delimiter, isAbsolute, join } from "node:path";
 import { AdapterMessageLog, failureResult, successResult, } from "./adapter-result.js";
 import { activePluginVersionFromJson, installedListingHas, marketplaceRootFromJson, } from "./codex-json.js";
+import { CODEX_LEGACY_PLUGIN_ID, CODEX_MANAGER_PLUGIN_ID, inspectCodexConflicts, } from "./codex-conflicts.js";
 import { oneLine } from "./cli-arguments.js";
 import { installedCommitFromRoot, installedRootForVersion, pathsEqual, } from "./codex-state.js";
 import { validateGeneratedPlugin } from "./generated-plugin.js";
@@ -14,9 +15,9 @@ import { applyManifestOverlay } from "./manifest-overlay.js";
 import { readCodexBuildSource } from "./provenance.js";
 import { isAcceptedSplitValue } from "./validate-generated-plugin-cli.js";
 import { withWorkspace, workspaceRemovalFailure } from "./workspace.js";
-const PLUGIN_ID = "superpowers@superpowers-manager";
+const PLUGIN_ID = CODEX_MANAGER_PLUGIN_ID;
 const MARKETPLACE_NAME = "superpowers-manager";
-const LEGACY_PLUGIN_ID = "superpowers@superpowers-wrapper";
+const LEGACY_PLUGIN_ID = CODEX_LEGACY_PLUGIN_ID;
 const LEGACY_MARKETPLACE_NAME = "superpowers-wrapper";
 class AdapterFailure extends Error {
     code;
@@ -486,7 +487,7 @@ async function runUninstall(input, env, log) {
         throw cause;
     }
 }
-async function runInspect(view, env, log) {
+async function runInspect(view, context, env, log) {
     if (view === "update-control") {
         return { view: "update-control", update_control: "managed" };
     }
@@ -552,9 +553,11 @@ async function runInspect(view, env, log) {
                 let legacyPlugin;
                 let managerMarketplace;
                 let legacyMarketplace;
+                let conflicts;
                 try {
                     managerPlugin = installedListingHas(plugins.stdout, "installed", "pluginId", PLUGIN_ID);
                     legacyPlugin = installedListingHas(plugins.stdout, "installed", "pluginId", LEGACY_PLUGIN_ID);
+                    conflicts = await inspectCodexConflicts({ root: context.root, env }, plugins.stdout.toString("utf8"));
                 }
                 catch {
                     fail("inspect-failed", `cannot parse output of '${codexBin} plugin list --json'`);
@@ -585,6 +588,7 @@ async function runInspect(view, env, log) {
                         : legacyPresent
                             ? "legacy"
                             : "neither",
+                    conflicts: [...conflicts],
                 };
             }, { onCleanupFailure: reportOrphanedWorkspace(log) });
         }
@@ -622,7 +626,7 @@ export function codexRemove(input, context) {
     return runCodexOperation("uninstall", context, (env, log) => runUninstall(input, env, log));
 }
 export function codexInspect(view, context) {
-    return runCodexOperation("inspect", context, (env, log) => runInspect(view, env, log));
+    return runCodexOperation("inspect", context, (env, log) => runInspect(view, context, env, log));
 }
 export async function runAdapter(argv, context) {
     const rawOperation = argv[0];

package/dist/artifact-tree.js

@@ -0,0 +1,110 @@
+import { createHash } from "node:crypto";
+import { lstat, readdir, readFile, readlink } from "node:fs/promises";
+import { join } from "node:path";
+import { assertExistingContained, assertNoFollowType, assertSymlinkTargetContained, } from "./safe-path.js";
+import { SafetyError } from "./safety-error.js";
+import { parseStrictJson } from "./strict-json.js";
+import { compareByCodePoint, DEFAULT_FS_DEPS, validateSkillFrontmatter, } from "./generated-plugin.js";
+export const ARTIFACT_RECEIPT = ".superpowers-manager.json";
+export const ARTIFACT_DIGEST_RE = /^[a-f0-9]{64}$/;
+const DECODER = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+export function addArtifactHashField(hash, bytes) {
+    const length = Buffer.alloc(8);
+    length.writeBigUInt64BE(BigInt(bytes.byteLength));
+    hash.update(length);
+    hash.update(bytes);
+}
+export async function readArtifactFile(root, path, limit = 1024 * 1024) {
+    try {
+        await assertExistingContained(root, path);
+        await assertNoFollowType(path, ["regular-file"]);
+        if ((await lstat(path)).size > limit)
+            throw new Error("size");
+        const bytes = await readFile(path);
+        if (bytes.length > limit)
+            throw new Error("size");
+        return bytes;
+    }
+    catch (cause) {
+        throw new SafetyError("artifact", `cannot read bounded artifact file: ${path}`, { cause });
+    }
+}
+export async function readArtifactObject(root, path) {
+    try {
+        const value = parseStrictJson(await readArtifactFile(root, path), {
+            duplicateKeys: "reject",
+            nonStandardConstants: "reject",
+            maxDepth: 64,
+        });
+        if (value === null || typeof value !== "object" || Array.isArray(value))
+            throw new Error("object");
+        return value;
+    }
+    catch (cause) {
+        throw new SafetyError("artifact", `invalid artifact JSON object: ${path}`, {
+            cause,
+        });
+    }
+}
+export async function validateNativeSkill(root) {
+    const path = join(root, "skills", "using-superpowers", "SKILL.md");
+    await readArtifactFile(root, path);
+    const errors = [];
+    await validateSkillFrontmatter(path, "using-superpowers", errors, DEFAULT_FS_DEPS);
+    if (errors.length)
+        throw new SafetyError("artifact", `invalid native bootstrap skill: ${path}`);
+}
+export async function digestArtifactTree(root) {
+    try {
+        await assertNoFollowType(root, ["directory"]);
+        const paths = [];
+        async function visit(relative) {
+            for (const bytes of await readdir(join(root, relative), {
+                encoding: "buffer",
+            })) {
+                const name = DECODER.decode(bytes);
+                const path = relative ? `${relative}/${name}` : name;
+                if (path === ARTIFACT_RECEIPT)
+                    continue;
+                paths.push(path);
+                if ((await lstat(join(root, path))).isDirectory())
+                    await visit(path);
+            }
+        }
+        await visit("");
+        const hash = createHash("sha256");
+        for (const path of paths.sort(compareByCodePoint)) {
+            const absolute = join(root, path), info = await lstat(absolute);
+            let kind, contents;
+            if (info.isDirectory()) {
+                kind = "directory";
+                contents = Buffer.alloc(0);
+            }
+            else if (info.isFile()) {
+                kind = "file";
+                contents = await readFile(absolute);
+            }
+            else if (info.isSymbolicLink()) {
+                await assertSymlinkTargetContained(root, absolute);
+                kind = "link";
+                contents = await readlink(absolute, { encoding: "buffer" });
+                DECODER.decode(contents);
+            }
+            else
+                throw new Error("entry type");
+            for (const bytes of [
+                Buffer.from(kind),
+                Buffer.from(path),
+                Buffer.from(String(info.isFile() ? info.mode & 0o111 : 0)),
+                contents,
+            ])
+                addArtifactHashField(hash, bytes);
+        }
+        return hash.digest("hex");
+    }
+    catch (cause) {
+        throw new SafetyError("artifact", `cannot digest artifact tree: ${root}`, {
+            cause,
+        });
+    }
+}

package/dist/atomic.js

@@ -1,6 +1,6 @@
 import { randomBytes } from "node:crypto";
 import { constants, lstat, open, readFile, rename, rm, unlink, } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { SafetyError } from "./safety-error.js";
 export async function atomicWriteFile(path, bytes, options) {
     const renamePath = options.hooks?.rename ?? rename;
@@ -92,18 +92,52 @@ async function chooseBackup(live) {
     }
     throw new SafetyError("atomic", "cannot choose unique backup path");
 }
-export async function atomicReplaceDir(candidate, live, options = {}) {
+async function validateRequestedBackup(backup, candidate, live) {
+    const resolvedBackup = resolve(backup);
+    const resolvedCandidate = resolve(candidate);
+    const resolvedLive = resolve(live);
+    const prefix = `.${basename(resolvedLive)}.bak.`;
+    if (dirname(resolvedBackup) !== dirname(resolvedLive) ||
+        !basename(resolvedBackup).startsWith(prefix) ||
+        basename(resolvedBackup).length === prefix.length ||
+        resolvedBackup === resolvedCandidate ||
+        resolvedBackup === resolvedLive ||
+        (await exists(backup))) {
+        throw new Error("invalid directory backup path");
+    }
+}
+async function directoryIdentity(path) {
+    const details = await lstat(path);
+    return { dev: details.dev, ino: details.ino };
+}
+function sameIdentity(left, right) {
+    return left.dev === right.dev && left.ino === right.ino;
+}
+function publicationFailure(message, cause) {
+    return new SafetyError("atomic", message, {
+        cause,
+        details: { phase: "post-replacement" },
+    });
+}
+export async function beginDirectoryPublication(candidate, live, options = {}) {
     const renamePath = options.hooks?.rename ?? rename;
     const removePath = options.hooks?.rm ?? rm;
     let backupCreated = false;
+    let backupIdentity = null;
     let phase = "pre-replacement";
     try {
-        const backup = await chooseBackup(live);
+        const backup = options.backupPath ?? (await chooseBackup(live));
+        if (options.backupPath !== undefined) {
+            await validateRequestedBackup(backup, candidate, live);
+        }
         if (await exists(live)) {
+            backupIdentity = await directoryIdentity(live);
             await renamePath(live, backup);
             backupCreated = true;
         }
+        let publishedIdentity;
         try {
+            publishedIdentity = await directoryIdentity(candidate);
             await renamePath(candidate, live);
             phase = "post-replacement";
         }
@@ -125,14 +159,72 @@ export async function atomicReplaceDir(candidate, live, options = {}) {
             await removePath(candidate, { recursive: true, force: true });
             throw new SafetyError("atomic", "directory activation failed; previous tree restored", { cause, details: { phase: "pre-replacement" } });
         }
-        if (backupCreated) {
+        const retainedBackup = backupCreated ? backup : null;
+        const retainedBackupIdentity = backupCreated ? backupIdentity : null;
+        let settled = false;
+        const claimSettlement = () => {
+            if (settled) {
+                throw publicationFailure("directory publication already settled", new Error("publication already settled"));
+            }
+            settled = true;
+        };
+        const requireRetainedBackup = async (action) => {
+            if (retainedBackup === null)
+                return;
+            let currentIdentity;
             try {
-                await removePath(backup, { recursive: true, force: true });
+                currentIdentity = await directoryIdentity(retainedBackup);
             }
             catch (cause) {
-                throw new SafetyError("atomic", `directory replacement succeeded but backup cleanup failed at ${backup}`, { cause, details: { phase: "post-replacement" } });
+                throw publicationFailure(`directory ${action} refused because backup changed unexpectedly at ${retainedBackup}`, cause);
             }
-        }
+            if (retainedBackupIdentity === null ||
+                !sameIdentity(currentIdentity, retainedBackupIdentity)) {
+                throw publicationFailure(`directory ${action} refused because backup changed unexpectedly at ${retainedBackup}`, new Error("retained backup directory identity changed"));
+            }
+        };
+        return {
+            live,
+            backup: retainedBackup,
+            async finalize() {
+                claimSettlement();
+                if (retainedBackup === null)
+                    return;
+                await requireRetainedBackup("finalization");
+                try {
+                    await removePath(retainedBackup, { recursive: true, force: true });
+                }
+                catch (cause) {
+                    throw publicationFailure(`directory replacement succeeded but backup cleanup failed at ${retainedBackup}`, cause);
+                }
+            },
+            async rollback() {
+                claimSettlement();
+                await requireRetainedBackup("rollback");
+                let currentIdentity;
+                try {
+                    currentIdentity = await directoryIdentity(live);
+                }
+                catch (cause) {
+                    throw publicationFailure(`directory rollback refused because live tree changed unexpectedly at ${live}`, cause);
+                }
+                if (!sameIdentity(currentIdentity, publishedIdentity)) {
+                    throw publicationFailure(`directory rollback refused because live tree changed unexpectedly at ${live}`, new Error("published directory identity changed"));
+                }
+                try {
+                    await removePath(live, { recursive: true, force: true });
+                    if (retainedBackup !== null) {
+                        await renamePath(retainedBackup, live);
+                    }
+                }
+                catch (cause) {
+                    const message = retainedBackup === null
+                        ? "directory rollback failed with no prior tree"
+                        : `directory rollback failed; backup preserved at ${retainedBackup}`;
+                    throw publicationFailure(message, cause);
+                }
+            },
+        };
     }
     catch (cause) {
         if (cause instanceof SafetyError)
@@ -140,3 +232,7 @@ export async function atomicReplaceDir(candidate, live, options = {}) {
         throw new SafetyError("atomic", "directory replacement failed", { cause, details: { phase } });
     }
 }
+export async function atomicReplaceDir(candidate, live, options = {}) {
+    const pending = await beginDirectoryPublication(candidate, live, options);
+    await pending.finalize();
+}

package/dist/cli-arguments.js

@@ -1,5 +1,42 @@
 export class UsageError extends Error {
 }
+export function extractHarnessOptions(command, argv) {
+    let harness = "codex";
+    let targeted = false;
+    let allowExperimental = false;
+    const args = [];
+    for (let index = 0; index < argv.length; index += 1) {
+        const token = argv[index];
+        if (token === "--harness" || token.startsWith("--harness=")) {
+            if (command === "pin" ||
+                command === "unpin" ||
+                command === "track-latest")
+                throw new UsageError("harness targeting is not available for shared selection commands");
+            if (targeted)
+                throw new UsageError("duplicate option: --harness");
+            targeted = true;
+            const value = token === "--harness"
+                ? argv[++index]
+                : token.slice("--harness=".length);
+            if (!value || value.startsWith("--"))
+                throw new UsageError("option --harness requires a value");
+            if (value !== "codex" && value !== "pi")
+                throw new UsageError(`unknown harness: ${value}`);
+            harness = value;
+        }
+        else if (token === "--allow-experimental") {
+            if (command !== "install" && command !== "update")
+                throw new UsageError("--allow-experimental is only available for install or update");
+            if (allowExperimental)
+                throw new UsageError("duplicate option: --allow-experimental");
+            allowExperimental = true;
+        }
+        else {
+            args.push(token);
+        }
+    }
+    return { options: { harness, allowExperimental }, args };
+}
 export function parseFlags(argv, names) {
     const allowed = new Set(names);
     const result = {};

package/dist/cli.js

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { oneLine } from "./cli-arguments.js";
+import { extractHarnessOptions, oneLine, UsageError } from "./cli-arguments.js";
 import { codexHarness } from "./codex-harness.js";
+import { piHarness } from "./pi-harness.js";
+import { createResourceCoordinator } from "./resource-lock.js";
 import { runInstall } from "./commands/install.js";
 import { runPin } from "./commands/pin.js";
 import { runPrepare } from "./commands/prepare.js";
@@ -85,14 +87,28 @@ function isMain(moduleFilename, argvPath) {
 function parseArgs(argv) {
     const first = argv[0];
     if (argv.length === 0)
-        return { kind: "run", cmd: "update", args: [] };
+        return {
+            kind: "run",
+            cmd: "update",
+            args: [],
+            options: { harness: "codex", allowExperimental: false },
+        };
     if (first === "--help" || first === "-h")
         return { kind: "help" };
     if (first === "--version")
         return { kind: "version" };
     if (first && SUBCOMMANDS.includes(first)) {
         const command = first;
-        const args = argv.slice(1);
+        let extracted;
+        try {
+            extracted = extractHarnessOptions(command, argv.slice(1));
+        }
+        catch (cause) {
+            if (cause instanceof UsageError)
+                return { kind: "usage-error", message: cause.message };
+            throw cause;
+        }
+        const { args, options } = extracted;
         if (command === "pin" && args.length !== 1) {
             return {
                 kind: "usage-error",
@@ -128,7 +144,7 @@ function parseArgs(argv) {
                 message: "usage: superpowers-manager probe [--porcelain]",
             };
         }
-        return { kind: "run", cmd: command, args };
+        return { kind: "run", cmd: command, args, options };
     }
     return { kind: "usage-error", message: `unknown subcommand: ${first}` };
 }
@@ -232,6 +248,14 @@ function usage() {
         "  update     probe, then prepare/install only if needed (default when no subcommand)",
         "  uninstall  remove the manager plugin and marketplace from Codex",
         "",
+        "Target one invocation (default: codex; selection commands are shared):",
+        "  probe --harness pi [--porcelain]",
+        "  prepare --harness pi",
+        "  install --harness pi [--allow-experimental]",
+        "  update --harness pi [--allow-experimental]",
+        "  uninstall --harness pi",
+        "  --harness=codex and --harness=pi are also accepted after the command.",
+        "",
         "Environment overrides (used by in-process commands): SUPERPOWERS_REF,",
         "SUPERPOWERS_UPSTREAM_URL, SUPERPOWERS_CODEX, SUPERPOWERS_CACHE_DIR,",
         "SUPERPOWERS_CONFIG_DIR, XDG_CONFIG_HOME,",
@@ -264,11 +288,22 @@ async function main() {
         console.error(usage());
         process.exit(2);
     }
-    const pf = preflight(parsed.cmd, process.env, process.platform);
+    const status = parsed.options.harness === "pi"
+        ? await dispatch(piHarness, parsed)
+        : await dispatch(codexHarness, parsed);
+    process.exit(status);
+}
+async function dispatch(adapter, parsed) {
+    const root = resolvePackageRoot(import.meta.filename);
+    if (!root) {
+        console.error("error: cannot resolve the superpowers-manager package root");
+        return 1;
+    }
+    const pf = preflightFor(parsed.cmd, process.env, process.platform, adapter);
     if (!pf.ok) {
         for (const e of pf.errors)
             console.error(`error: ${e}`);
-        process.exit(1);
+        return 1;
     }
     // Dispatch is no longer a branch: slice 4b flipped the last spawned command,
     // so every subcommand runs here, and slice 6 deleted the DISPATCH table whose
@@ -281,15 +316,17 @@ async function main() {
     const handler = IN_PROCESS_HANDLERS[parsed.cmd];
     if (!handler) {
         console.error(`error: no in-process handler registered for: ${parsed.cmd}`);
-        process.exit(1);
+        return 1;
     }
     const ctx = {
         root,
         env: process.env,
         stdout: process.stdout,
         stderr: process.stderr,
+        options: parsed.options,
+        coordination: createResourceCoordinator(),
         // The ONLY production binding of a concrete harness implementation.
-        adapter: codexHarness,
+        adapter,
     };
     let status;
     try {
@@ -300,11 +337,11 @@ async function main() {
         // failures and returns a status code (see src/commands/unpin.ts). This
         // re-emits a subordinate module's own diagnostic if one somehow escapes.
         console.error(`error: ${oneLine(cause)}`);
-        process.exit(1);
+        return 1;
     }
-    process.exit(status);
+    return status;
 }
-export { resolvePackageRoot, isMain, parseArgs, findTool, commandRequirements, commandRequirementsFor, preflight, preflightFor, usage, main, };
+export { resolvePackageRoot, isMain, parseArgs, findTool, commandRequirements, commandRequirementsFor, preflight, preflightFor, usage, dispatch, main, };
 if (isMain(import.meta.filename, process.argv[1])) {
     main().catch((cause) => {
         console.error(`error: ${oneLine(cause)}`);

package/dist/codex-compatibility.js

@@ -0,0 +1,126 @@
+import { join } from "node:path";
+import { validateNativeSkill } from "./artifact-tree.js";
+import { classifyPathNoFollow, assertExistingContained } from "./safe-path.js";
+import { classifyHooks, readManifest } from "./hooks.js";
+import { SEMVER_RE } from "./generated-plugin.js";
+import { validateSource } from "./selection.js";
+import { writeFile } from "node:fs/promises";
+import { ARTIFACT_DIGEST_RE, ARTIFACT_RECEIPT, digestArtifactTree, readArtifactObject, } from "./artifact-tree.js";
+import { COMMIT_RE } from "./domain/refs.js";
+import { validateGeneratedPlugin } from "./generated-plugin.js";
+import { SafetyError } from "./safety-error.js";
+export async function writeCodexAssessment(root, selection, manifestSource) {
+    const receipt = {
+        schema: 1,
+        manager: "superpowers-manager",
+        harness: "codex",
+        source: selection.effectiveSource,
+        commit: selection.desiredCommit,
+        generation: "codex-native-skills-v1",
+        manifestSource,
+        digest: await digestArtifactTree(root),
+    };
+    await writeFile(join(root, ARTIFACT_RECEIPT), JSON.stringify(receipt) + "\n", { flag: "wx" });
+}
+export async function readCodexAssessment(root) {
+    try {
+        const receipt = await readArtifactObject(root, join(root, ARTIFACT_RECEIPT));
+        const provenance = await readArtifactObject(root, join(root, ".superpowers-upstream.json"));
+        if (receipt.schema !== 1 ||
+            receipt.manager !== "superpowers-manager" ||
+            receipt.harness !== "codex" ||
+            receipt.generation !== "codex-native-skills-v1" ||
+            typeof receipt.source !== "string" ||
+            typeof receipt.commit !== "string" ||
+            !COMMIT_RE.test(receipt.commit) ||
+            typeof receipt.digest !== "string" ||
+            !ARTIFACT_DIGEST_RE.test(receipt.digest) ||
+            (receipt.manifestSource !== "upstream" &&
+                receipt.manifestSource !== "fallback") ||
+            receipt.source !== provenance.source ||
+            receipt.commit !== provenance.commit)
+            throw new Error("assessment fields");
+        validateSource(receipt.source);
+        if ((await digestArtifactTree(root)) !== receipt.digest)
+            throw new Error("assessment digest");
+        const manifest = await readManifest(join(root, ".codex-plugin/plugin.json"));
+        if (typeof manifest.version !== "string" ||
+            typeof provenance.requested_ref !== "string" ||
+            typeof provenance.resolved_ref !== "string" ||
+            typeof provenance.upstream_manifest_version !== "string")
+            throw new Error("provenance fields");
+        const errors = await validateGeneratedPlugin({
+            pluginRoot: root,
+            source: receipt.source,
+            commit: receipt.commit,
+            requestedRef: provenance.requested_ref,
+            resolvedRef: provenance.resolved_ref,
+            upstreamManifestVersion: provenance.upstream_manifest_version,
+            manifestVersion: manifest.version,
+            manifestSource: receipt.manifestSource,
+        });
+        if (errors.length)
+            throw new Error("generated resources");
+        const selection = {
+            effectiveSource: receipt.source,
+            desiredCommit: receipt.commit,
+            requestedRef: provenance.requested_ref,
+            resolvedRef: provenance.resolved_ref,
+            resolutionKind: "raw-commit",
+            selectionOrigin: "package-default",
+            selectionMode: "default",
+            upstreamSourceOrigin: "package-default",
+            saved: {
+                saved_mode: "none",
+                saved_source: "",
+                saved_requested_ref: "",
+                saved_resolved_ref: "",
+                saved_commit: "",
+            },
+        };
+        const compatibility = await assessCodexCompatibility(root, selection);
+        return {
+            root,
+            commit: receipt.commit,
+            identity: receipt.commit,
+            compatibility,
+        };
+    }
+    catch (cause) {
+        throw new SafetyError("codex-compatibility", `invalid Codex prepared assessment: ${root}`, { cause });
+    }
+}
+export async function assessCodexCompatibility(root, selection) {
+    try {
+        validateSource(selection.effectiveSource);
+        await validateNativeSkill(root);
+        for (const path of [
+            ".codex/superpowers-codex",
+            ".codex/superpowers-bootstrap.md",
+        ]) {
+            if ((await classifyPathNoFollow(join(root, path))) !== "missing")
+                throw new Error("legacy bootstrap");
+        }
+        const path = join(root, ".codex-plugin/plugin.json");
+        if ((await classifyPathNoFollow(path)) !== "missing") {
+            await assertExistingContained(root, path);
+            const manifest = await readManifest(path);
+            if (manifest.name !== "superpowers" ||
+                typeof manifest.version !== "string" ||
+                !SEMVER_RE.test(manifest.version))
+                throw new Error("manifest");
+            await classifyHooks(manifest, "upstream", root);
+        }
+        return {
+            kind: "supported",
+            generation: "codex-native-skills-v1",
+            reason: "native Codex skill discovery",
+        };
+    }
+    catch {
+        return {
+            kind: "unsupported",
+            reason: `Codex package does not provide compatible native skill discovery: ${root}`,
+        };
+    }
+}