superpowers-manager 0.5.1 → 0.5.2

package/README.md

@@ -56,7 +56,7 @@ Codex installs the Manager-owned marketplace plugin after preparation and
 validation. Review upstream hook definitions with Codex's `/hooks` flow before
 trusting or running them; updates can change a referenced script or surface a
 new definition. The manager neither creates hooks nor changes Codex trust state.
-See the [Codex reference](https://github.com/j7an/superpowers-manager/blob/main/docs/codex.md).
+See the [Codex reference](https://github.com/j7an/superpowers-manager/blob/main/docs/codex.md#durable-storage-migration-and-recovery) for durable storage, migration, and recovery.
 
 ### Pi
 

package/dist/cli.js

@@ -341,7 +341,7 @@ async function dispatch(adapter, parsed) {
     }
     return status;
 }
-export { resolvePackageRoot, isMain, parseArgs, findTool, commandRequirements, commandRequirementsFor, preflight, preflightFor, usage, dispatch, main, };
+export { resolvePackageRoot, isMain, parseArgs, commandRequirements, commandRequirementsFor, preflight, usage, main, };
 if (isMain(import.meta.filename, process.argv[1])) {
     main().catch((cause) => {
         console.error(`error: ${oneLine(cause)}`);

package/dist/commands/install.js

@@ -190,18 +190,28 @@ async function gatherInstallStages(ctx, selection, artifact) {
                     const restoration = restored.ok
                         ? `installed state after rollback: ${restored.result.outcome.result.kind}; identity=${restored.result.outcome.result.observedIdentity}`
                         : "installed state after rollback could not be inspected";
-                    const message = !settlement.ok
+                    const verificationOutput = inspection === null
+                        ? null
+                        : ctx.adapter.presentation.renderInstallVerification(selection.desiredCommit, install.result, inspection);
+                    const inspectionMessage = verificationOutput === null && !inspected.ok
+                        ? inspected.message
+                        : null;
+                    const settlementMessage = !settlement.ok
                         ? settlement.message
-                        : !inspected.ok
-                            ? inspected.message
-                            : "installation could not be verified";
+                        : null;
                     return {
                         kind: "verified",
                         outcomes,
                         status: 1,
-                        stdout: [],
+                        stdout: verificationOutput?.stdout ?? [],
                         stderr: [
-                            ...(message === null ? [] : [`error: ${message}`]),
+                            ...(verificationOutput?.stderr ?? []),
+                            ...(inspectionMessage === null
+                                ? []
+                                : [`error: ${inspectionMessage}`]),
+                            ...(settlementMessage === null
+                                ? []
+                                : [`error: ${settlementMessage}`]),
                             restoration,
                         ],
                     };

package/dist/commands/prepare.js

@@ -418,7 +418,7 @@ async function performPrepare(argv, ctx) {
         // completed before cleanup ran, so it is not being reported as unverified
         // -- but something did still go wrong, and AGENTS.md's fail-closed rule
         // extends to it. Mirrors
-        // `src/commands/install.ts:546-554::if (cleanupWarning`.
+        // `src/commands/install.ts:562-570::if (cleanupWarning`.
         ctx.stderr.write(`error: ${cleanupWarning}\n`);
         return 1;
     }

package/dist/commands/uninstall.js

@@ -163,7 +163,7 @@ async function performUninstall(argv, ctx) {
         // blindly.
         //
         // A cause outside ctx.adapter's AdapterFailure guard
-        // (`src/harnesses/codex/adapter.ts:973-999::async function runCodexOperation(`) does NOT
+        // (`src/harnesses/codex/adapter.ts:1081::async function runCodexOperation<T = JsonValue>(`) does NOT
         // reach here: invoke() catches it inside gatherUninstall and converts it
         // to a hand-written message carried as UninstallOutcome data, exactly as
         // src/commands/probe.ts's inspect() does for the same cause.

package/dist/harnesses/codex/adapter.js

@@ -5,10 +5,12 @@ import { access, copyFile, mkdir, readFile, realpath, stat, writeFile, } from "n
 import { tmpdir } from "node:os";
 import { delimiter, isAbsolute, join } from "node:path";
 import { AdapterMessageLog, failureResult, successResult, } from "../../adapter-result.js";
-import { activePluginVersionFromJson, installedListingHas, marketplaceRootFromJson, } from "./json.js";
+import { activePluginVersionFromJson, codexInstalledPluginsFromJson, installedListingHas, marketplaceRootFromJson, } from "./json.js";
 import { CODEX_LEGACY_PLUGIN_ID, CODEX_MANAGER_PLUGIN_ID, inspectCodexConflicts, } from "./conflicts.js";
 import { oneLine } from "../../cli-arguments.js";
 import { installedCommitFromRoot, installedRootForVersion, pathsEqual, } from "./state.js";
+import { codexHome } from "./paths.js";
+import { readCodexStoredState } from "./stored-state.js";
 import { validateGeneratedPlugin } from "./generated-plugin.js";
 import { classifyHooks, materializeHooks, readManifest, } from "./hooks.js";
 import { applyManifestOverlay } from "./manifest-overlay.js";
@@ -19,6 +21,12 @@ const PLUGIN_ID = CODEX_MANAGER_PLUGIN_ID;
 const MARKETPLACE_NAME = "superpowers-manager";
 const LEGACY_PLUGIN_ID = CODEX_LEGACY_PLUGIN_ID;
 const LEGACY_MARKETPLACE_NAME = "superpowers-wrapper";
+export function codexInstallRefreshMode(env) {
+    const refreshMode = env.SUPERPOWERS_INSTALL_REFRESH_MODE || "add-only";
+    return refreshMode === "add-only" || refreshMode === "remove-add"
+        ? refreshMode
+        : null;
+}
 class AdapterFailure extends Error {
     code;
     hints;
@@ -95,6 +103,14 @@ export { runCommand as runCommandForTest };
 function commandFailed(result) {
     return result.status !== 0;
 }
+async function storedStateAfterListingFailure(env, code, message) {
+    try {
+        return await readCodexStoredState(env, process.cwd());
+    }
+    catch {
+        fail(code, message);
+    }
+}
 // Exported only so its unit test can reach it. No integration test can cover
 // it: on Linux glibc, `execvp`'s ENOEXEC falls back to `/bin/sh`, so the spawn
 // still succeeds, and every other candidate errno is already peeled off by an
@@ -383,25 +399,27 @@ async function runInstall(packageRoot, env, log) {
         fail("invalid-arguments", `package root not found: ${packageRoot}`);
     }
     const codexBin = env.SUPERPOWERS_CODEX || "codex";
-    const refreshMode = env.SUPERPOWERS_INSTALL_REFRESH_MODE || "add-only";
+    const refreshMode = codexInstallRefreshMode(env);
     await requireCodex(codexBin, env);
-    if (refreshMode !== "add-only" && refreshMode !== "remove-add") {
-        fail("invalid-arguments", `unsupported SUPERPOWERS_INSTALL_REFRESH_MODE: ${refreshMode}`);
+    if (refreshMode === null) {
+        fail("invalid-arguments", `unsupported SUPERPOWERS_INSTALL_REFRESH_MODE: ${env.SUPERPOWERS_INSTALL_REFRESH_MODE}`);
     }
     let entered = false;
     try {
         return await withWorkspace(tmpdir(), "superpowers-manager.adapter-install.", async () => {
             entered = true;
             const marketplaceList = await listingCommand(log, codexBin, ["plugin", "marketplace", "list", "--json"], env);
-            if (commandFailed(marketplaceList)) {
-                fail("install-failed", `cannot list Codex marketplaces via '${codexBin} plugin marketplace list --json'`);
-            }
             let registeredRoot;
-            try {
-                registeredRoot = marketplaceRootFromJson(marketplaceList.stdout, MARKETPLACE_NAME);
+            if (commandFailed(marketplaceList)) {
+                registeredRoot = (await storedStateAfterListingFailure(env, "install-failed", `cannot list Codex marketplaces via '${codexBin} plugin marketplace list --json'`)).managerMarketplaceRoot;
             }
-            catch {
-                fail("install-failed", `cannot parse output of '${codexBin} plugin marketplace list --json'`);
+            else {
+                try {
+                    registeredRoot = marketplaceRootFromJson(marketplaceList.stdout, MARKETPLACE_NAME);
+                }
+                catch {
+                    fail("install-failed", `cannot parse output of '${codexBin} plugin marketplace list --json'`);
+                }
             }
             if (registeredRoot.length === 0) {
                 const added = await mutationCommand(log, codexBin, ["plugin", "marketplace", "add", packageRoot], env);
@@ -543,16 +561,34 @@ async function runInspect(view, context, env, log) {
                 entered = true;
                 const plugins = await listingCommand(log, codexBin, ["plugin", "list", "--json"], env);
                 if (commandFailed(plugins)) {
-                    fail("inspect-failed", `cannot list Codex plugins via '${codexBin} plugin list --json'`);
-                }
-                const marketplaces = await listingCommand(log, codexBin, ["plugin", "marketplace", "list", "--json"], env);
-                if (commandFailed(marketplaces)) {
-                    fail("inspect-failed", `cannot list Codex marketplaces via '${codexBin} plugin marketplace list --json'`);
+                    const stored = await storedStateAfterListingFailure(env, "inspect-failed", `cannot list Codex plugins via '${codexBin} plugin list --json'`);
+                    const conflicts = await inspectCodexConflicts({ root: context.root, env }, stored.installedListingJson);
+                    const managerPresent = stored.managerPluginPresent ||
+                        stored.managerMarketplaceRoot.length > 0;
+                    const legacyPresent = stored.legacyPluginPresent ||
+                        stored.legacyMarketplaceRoot !== null;
+                    return {
+                        view: "ownership",
+                        resources: {
+                            plugin: stored.managerPluginPresent,
+                            marketplace: true,
+                        },
+                        legacy_resources: {
+                            plugin: stored.legacyPluginPresent,
+                            marketplace: stored.legacyMarketplaceRoot !== null,
+                        },
+                        identity_state: managerPresent
+                            ? legacyPresent
+                                ? "both"
+                                : "manager"
+                            : legacyPresent
+                                ? "legacy"
+                                : "neither",
+                        conflicts: [...conflicts],
+                    };
                 }
                 let managerPlugin;
                 let legacyPlugin;
-                let managerMarketplace;
-                let legacyMarketplace;
                 let conflicts;
                 try {
                     managerPlugin = installedListingHas(plugins.stdout, "installed", "pluginId", PLUGIN_ID);
@@ -562,6 +598,35 @@ async function runInspect(view, context, env, log) {
                 catch {
                     fail("inspect-failed", `cannot parse output of '${codexBin} plugin list --json'`);
                 }
+                const marketplaces = await listingCommand(log, codexBin, ["plugin", "marketplace", "list", "--json"], env);
+                if (commandFailed(marketplaces)) {
+                    const stored = await storedStateAfterListingFailure(env, "inspect-failed", `cannot list Codex marketplaces via '${codexBin} plugin marketplace list --json'`);
+                    const conflicts = await inspectCodexConflicts({ root: context.root, env }, stored.installedListingJson);
+                    const managerPresent = true;
+                    const legacyPresent = stored.legacyPluginPresent ||
+                        stored.legacyMarketplaceRoot !== null;
+                    return {
+                        view: "ownership",
+                        resources: {
+                            plugin: stored.managerPluginPresent,
+                            marketplace: true,
+                        },
+                        legacy_resources: {
+                            plugin: stored.legacyPluginPresent,
+                            marketplace: stored.legacyMarketplaceRoot !== null,
+                        },
+                        identity_state: managerPresent
+                            ? legacyPresent
+                                ? "both"
+                                : "manager"
+                            : legacyPresent
+                                ? "legacy"
+                                : "neither",
+                        conflicts: [...conflicts],
+                    };
+                }
+                let managerMarketplace;
+                let legacyMarketplace;
                 try {
                     managerMarketplace = installedListingHas(marketplaces.stdout, "marketplaces", "name", MARKETPLACE_NAME);
                     legacyMarketplace = installedListingHas(marketplaces.stdout, "marketplaces", "name", LEGACY_MARKETPLACE_NAME);
@@ -628,6 +693,70 @@ export function codexRemove(input, context) {
 export function codexInspect(view, context) {
     return runCodexOperation("inspect", context, (env, log) => runInspect(view, context, env, log));
 }
+export function codexReadNativeState(context) {
+    return runCodexOperation("native-state", context, async (env, log) => {
+        const codexBin = env.SUPERPOWERS_CODEX || "codex";
+        await requireCodex(codexBin, env);
+        const plugins = await listingCommand(log, codexBin, ["plugin", "list", "--json"], env);
+        if (commandFailed(plugins)) {
+            const stored = await storedStateAfterListingFailure(env, "inspect-failed", `cannot list Codex plugins via '${codexBin} plugin list --json'`);
+            return {
+                marketplaceRoot: stored.managerMarketplaceRoot,
+                pluginPresent: stored.managerPluginPresent,
+                pluginEnabled: stored.managerPluginEnabled,
+                activeVersion: null,
+                activeRoot: null,
+            };
+        }
+        let manager;
+        let activeVersion;
+        try {
+            const managers = codexInstalledPluginsFromJson(plugins.stdout).filter((plugin) => plugin.pluginId === PLUGIN_ID);
+            if (managers.length > 1)
+                fail("inspect-failed", "Codex manager plugin appears more than once");
+            manager = managers[0];
+            activeVersion =
+                manager === undefined
+                    ? ""
+                    : activePluginVersionFromJson(plugins.stdout, PLUGIN_ID);
+        }
+        catch (cause) {
+            if (cause instanceof AdapterFailure)
+                throw cause;
+            fail("inspect-failed", `cannot parse output of '${codexBin} plugin list --json'`);
+        }
+        const marketplaces = await listingCommand(log, codexBin, ["plugin", "marketplace", "list", "--json"], env);
+        if (commandFailed(marketplaces)) {
+            const stored = await storedStateAfterListingFailure(env, "inspect-failed", `cannot list Codex marketplaces via '${codexBin} plugin marketplace list --json'`);
+            return {
+                marketplaceRoot: stored.managerMarketplaceRoot,
+                pluginPresent: stored.managerPluginPresent,
+                pluginEnabled: stored.managerPluginEnabled,
+                activeVersion: null,
+                activeRoot: null,
+            };
+        }
+        let marketplaceRoot;
+        try {
+            marketplaceRoot = marketplaceRootFromJson(marketplaces.stdout, MARKETPLACE_NAME, true);
+        }
+        catch (cause) {
+            if (cause instanceof AdapterFailure)
+                throw cause;
+            fail("inspect-failed", `cannot parse output of '${codexBin} plugin marketplace list --json'`);
+        }
+        const searchRoot = env.SUPERPOWERS_INSTALLED_SEARCH_ROOT || codexHome(env, process.cwd());
+        return {
+            marketplaceRoot: marketplaceRoot || null,
+            pluginPresent: manager !== undefined,
+            pluginEnabled: manager?.enabled === true,
+            activeVersion: activeVersion || null,
+            activeRoot: activeVersion
+                ? installedRootForVersion(searchRoot, MARKETPLACE_NAME, "superpowers", activeVersion)
+                : null,
+        };
+    });
+}
 export async function runAdapter(argv, context) {
     const rawOperation = argv[0];
     const operation = rawOperation || "adapter";

package/dist/harnesses/codex/generated-plugin.js

@@ -39,7 +39,7 @@ function decodePathBytes(bytes) {
  * syscall, so a string carrying one would open a different file than the
  * caller named. CPython raises `UnicodeEncodeError` instead.
  */
-export function hasUnpairedSurrogate(value) {
+function hasUnpairedSurrogate(value) {
     for (let index = 0; index < value.length; index += 1) {
         const unit = value.charCodeAt(index);
         if (unit >= 0xd800 && unit <= 0xdbff) {

package/dist/harnesses/codex/harness.js

@@ -1,11 +1,13 @@
-import { join, resolve } from "node:path";
 import { failureResult, hasTerminalControl, successResult, } from "../../adapter-result.js";
-import { codexInspect, codexInstall, codexRemove, } from "./adapter.js";
+import { codexInspect, codexInstall, } from "./adapter.js";
 import { codexPreparationLocation, inspectCodexPrepared, prepareCodexCandidate, readCodexPrepared, validateCodexPreparationBeforeFetch, } from "./prepare.js";
 import { codexInstallReceipt, codexPresentation } from "./presentation.js";
 import { reportLegacyState, requireManagedUpdateControl, requireNoLegacyState, verifyUninstalledResources, } from "./lifecycle.js";
-import { SafetyError } from "../../safety-error.js";
 import { commitMatches } from "../../status.js";
+import { codexHome, codexPaths } from "./paths.js";
+import { installCodexMarketplace, removeCodexMarketplace, } from "./publication.js";
+import { readCodexRecovery } from "./recovery.js";
+import { inspectCodexInstallation } from "./state.js";
 function preserveFailure(result) {
     if (result.outcome.ok) {
         throw new Error("cannot preserve a successful adapter result as failure");
@@ -281,16 +283,34 @@ function requirements(command, env) {
     ];
 }
 async function mutationRoots(ctx) {
-    const env = ctx.env ?? {};
-    const configured = env.CODEX_HOME;
-    if (configured !== undefined && configured.length > 0) {
-        return [resolve(configured)];
+    return [codexHome(ctx.env ?? {}, process.cwd())];
+}
+async function inspectCodexUpdateControl(ctx) {
+    const normalized = normalizeCodexControl(await codexInspect("update-control", ctx));
+    if (!normalized.outcome.ok)
+        return normalized;
+    const paths = codexPaths(ctx.env ?? {}, process.cwd());
+    let diagnostic = null;
+    try {
+        if ((await readCodexRecovery(paths)) !== null) {
+            diagnostic = `Codex recovery required; preserve material at ${paths.recoveryRoot} for manual resolution`;
+        }
     }
-    const home = env.HOME;
-    if (home === undefined || home.length === 0) {
-        throw new SafetyError("codex-harness", "cannot determine Codex state root without HOME");
+    catch {
+        diagnostic = `cannot inspect Codex recovery state at ${paths.recoveryRoot}`;
     }
-    return [join(resolve(home), ".codex")];
+    if (diagnostic === null)
+        return normalized;
+    const decision = {
+        kind: "blocked",
+        output: { stdout: [], stderr: [`error: ${diagnostic}`] },
+    };
+    return successResult(normalized.outcome.operation, {
+        probeEligibility: decision,
+        mutationEligibility: decision,
+        presentationValue: diagnostic,
+        recoveryState: "required",
+    }, normalized.outcome.messages);
 }
 export const codexHarness = {
     preparationLocation: codexPreparationLocation,
@@ -300,13 +320,11 @@ export const codexHarness = {
     inspectPrepared: inspectCodexPrepared,
     readPrepared: readCodexPrepared,
     inspectOwnership: async (ctx) => normalizeCodexOwnership(await codexInspect("ownership", ctx)),
-    inspectUpdateControl: async (ctx) => normalizeCodexControl(await codexInspect("update-control", ctx)),
-    inspectInstalled: async (selection, ctx) => normalizeCodexInstalled(await codexInspect("fingerprint", ctx), selection.desiredCommit),
-    install: async (_artifact, ctx) => {
-        return normalizeCodexInstallForContext(await codexInstall(ctx.root, ctx), ctx);
-    },
+    inspectUpdateControl: inspectCodexUpdateControl,
+    inspectInstalled: inspectCodexInstallation,
+    install: async (artifact, ctx) => installCodexMarketplace(artifact, ctx, async (root, context) => normalizeCodexInstallForContext(await codexInstall(root, context), context)),
     remove: async (input, ctx) => {
-        const result = await codexRemove(input, ctx);
+        const result = await removeCodexMarketplace(input, ctx);
         if (!result.outcome.ok)
             return preserveFailure(result);
         if (result.status !== 0) {

package/dist/harnesses/codex/hooks.js

@@ -4,7 +4,7 @@ import { assertExistingContained, assertProspectiveContained, classifyPathNoFoll
 import { SafetyError } from "../../safety-error.js";
 import { parseStrictJson } from "../../strict-json.js";
 // Annotated, not `as const`, matching
-// `src/provenance.ts:20::export const PROVENANCE_STRICT_PROFILE` and
+// `src/provenance.ts:20::const PROVENANCE_STRICT_PROFILE` and
 // `src/selection-store.ts:19::const SELECTION_JSON_PROFILE`. The annotation
 // rejects a misspelled or unsupported profile field here rather than at the
 // parseStrictJson call.

package/dist/harnesses/codex/json.js

@@ -66,9 +66,13 @@ export function codexInstalledPluginsFromJson(raw) {
         enabled: typeof item.enabled === "boolean" ? item.enabled : null,
     }));
 }
-export function marketplaceRootFromJson(raw, marketplaceName) {
+export function marketplaceRootFromJson(raw, marketplaceName, requireUnique = false) {
     const items = checkedItems(raw, ACCEPT_CONSTANTS, "marketplaces", "name");
-    const match = items.find((item) => item.name === marketplaceName);
+    const matches = items.filter((item) => item.name === marketplaceName);
+    if (requireUnique && matches.length > 1) {
+        fail("marketplace appears more than once");
+    }
+    const match = matches[0];
     if (match === undefined)
         return "";
     if (typeof match.root !== "string" || match.root.length === 0) {

package/dist/harnesses/codex/lifecycle.js

@@ -52,7 +52,7 @@ export function reportLegacyState(identityState) {
     }
     return unknownState(identityState);
 }
-export { verifyInstalledFingerprint, } from "./presentation.js";
+export { verifyInstalledFingerprint } from "./presentation.js";
 // Ported from
 // `git show ad56569a4c161e7b122967442e2b026eeb6395f6:scripts/core/lifecycle.sh:62-70::spw_require_managed_update_control`.
 // Both refusals reached spw_die in the shell, so both carry the `error: ` prefix

package/dist/harnesses/codex/marketplace.js

@@ -0,0 +1,148 @@
+import { copyFile, cp, lstat, mkdir, readdir, rm, writeFile, } from "node:fs/promises";
+import { join } from "node:path";
+import { ARTIFACT_DIGEST_RE, ARTIFACT_RECEIPT, digestArtifactTree, readArtifactObject, } from "../../artifact-tree.js";
+import { assertNoFollowType, classifyPathNoFollow } from "../../safe-path.js";
+import { SafetyError } from "../../safety-error.js";
+import { readCodexAssessment } from "./compatibility.js";
+const MARKETPLACE_PATH = ".agents/plugins/marketplace.json";
+const PLUGIN_PATH = "plugins/superpowers";
+function inspectionError(root, cause) {
+    return new SafetyError("codex-marketplace", `cannot inspect owned Codex marketplace: ${root}`, { cause });
+}
+function validateMarketplace(value) {
+    const plugins = value.plugins;
+    if (!Array.isArray(plugins) || plugins.length !== 1) {
+        throw new Error("marketplace plugins");
+    }
+    const plugin = plugins[0];
+    if (plugin === null || typeof plugin !== "object" || Array.isArray(plugin)) {
+        throw new Error("marketplace plugin");
+    }
+    const source = plugin.source;
+    if (plugin.name !== "superpowers" ||
+        source === null ||
+        typeof source !== "object" ||
+        Array.isArray(source) ||
+        source.source !== "local" ||
+        source.path !== "./plugins/superpowers") {
+        throw new Error("marketplace source");
+    }
+}
+async function requireEntries(root, expected) {
+    const actual = await readdir(root);
+    if (actual.length !== expected.length ||
+        actual.some((entry) => !expected.includes(entry))) {
+        throw new Error("tree entries");
+    }
+}
+async function readMarketplace(root) {
+    try {
+        await assertNoFollowType(root, ["directory"]);
+        const before = await lstat(root);
+        await requireEntries(root, [".agents", "plugins", ARTIFACT_RECEIPT]);
+        await assertNoFollowType(join(root, ".agents"), ["directory"]);
+        await assertNoFollowType(join(root, "plugins"), ["directory"]);
+        await assertNoFollowType(join(root, ARTIFACT_RECEIPT), ["regular-file"]);
+        await requireEntries(join(root, ".agents"), ["plugins"]);
+        await requireEntries(join(root, ".agents", "plugins"), [
+            "marketplace.json",
+        ]);
+        await requireEntries(join(root, "plugins"), ["superpowers"]);
+        const pluginRoot = join(root, PLUGIN_PATH);
+        await assertNoFollowType(pluginRoot, ["directory"]);
+        validateMarketplace(await readArtifactObject(root, join(root, MARKETPLACE_PATH)));
+        const receipt = await readArtifactObject(root, join(root, ARTIFACT_RECEIPT));
+        if (receipt.schema !== 1 ||
+            receipt.manager !== "superpowers-manager" ||
+            receipt.harness !== "codex" ||
+            receipt.generation !== "codex-marketplace-v1" ||
+            typeof receipt.digest !== "string" ||
+            !ARTIFACT_DIGEST_RE.test(receipt.digest)) {
+            throw new Error("receipt");
+        }
+        const digest = await digestArtifactTree(root);
+        if (digest !== receipt.digest)
+            throw new Error("digest");
+        const artifact = await readCodexAssessment(pluginRoot);
+        const after = await lstat(root);
+        if (before.dev !== after.dev || before.ino !== after.ino) {
+            throw new Error("root changed");
+        }
+        return {
+            root,
+            dev: before.dev,
+            ino: before.ino,
+            digest,
+            artifact,
+        };
+    }
+    catch (cause) {
+        throw inspectionError(root, cause);
+    }
+}
+async function removeOwnedCandidate(root, identity) {
+    try {
+        await assertNoFollowType(root, ["directory"]);
+        const current = await lstat(root);
+        if (current.dev !== identity.dev || current.ino !== identity.ino)
+            return;
+        await rm(root, { recursive: true });
+    }
+    catch {
+        // A candidate that cannot still be proven as ours must remain untouched.
+    }
+}
+export async function stageCodexMarketplace(artifact, packageRoot, candidateRoot) {
+    let candidateIdentity = null;
+    try {
+        const assessed = await readCodexAssessment(artifact.root);
+        if (assessed.commit !== artifact.commit)
+            throw new Error("artifact commit");
+        const sourceDigest = await digestArtifactTree(artifact.root);
+        await assertNoFollowType(candidateRoot, ["missing"]);
+        await mkdir(candidateRoot, { mode: 0o700 });
+        const candidate = await lstat(candidateRoot);
+        candidateIdentity = { dev: candidate.dev, ino: candidate.ino };
+        await mkdir(join(candidateRoot, ".agents", "plugins"), { recursive: true });
+        await mkdir(join(candidateRoot, "plugins"), { recursive: true });
+        await copyFile(join(packageRoot, MARKETPLACE_PATH), join(candidateRoot, MARKETPLACE_PATH), 0);
+        await cp(artifact.root, join(candidateRoot, PLUGIN_PATH), {
+            dereference: false,
+            errorOnExist: true,
+            force: false,
+            recursive: true,
+            verbatimSymlinks: true,
+        });
+        const copied = await readCodexAssessment(join(candidateRoot, PLUGIN_PATH));
+        if (copied.commit !== artifact.commit ||
+            (await digestArtifactTree(copied.root)) !== sourceDigest) {
+            throw new Error("copied artifact");
+        }
+        validateMarketplace(await readArtifactObject(candidateRoot, join(candidateRoot, MARKETPLACE_PATH)));
+        const receipt = {
+            schema: 1,
+            manager: "superpowers-manager",
+            harness: "codex",
+            generation: "codex-marketplace-v1",
+            digest: await digestArtifactTree(candidateRoot),
+        };
+        await writeFile(join(candidateRoot, ARTIFACT_RECEIPT), JSON.stringify(receipt) + "\n", { flag: "wx" });
+        return await readMarketplace(candidateRoot);
+    }
+    catch (cause) {
+        if (candidateIdentity !== null) {
+            await removeOwnedCandidate(candidateRoot, candidateIdentity);
+        }
+        throw new SafetyError("codex-marketplace", `cannot stage owned Codex marketplace: ${candidateRoot}`, { cause });
+    }
+}
+export async function readCodexMarketplace(root) {
+    try {
+        if ((await classifyPathNoFollow(root)) === "missing")
+            return null;
+    }
+    catch (cause) {
+        throw inspectionError(root, cause);
+    }
+    return await readMarketplace(root);
+}