From 2b06d35be84d658dce76c3725b269b6ea2733a77 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Fri, 2 Oct 2026 23:13:22 -0400
Subject: [PATCH 1/3] refactor(prerequisites): convert the 22
 prerequisites.json files and move the fleet reader to the node checker

Closes #5840

Converts every plugin's prerequisites.json from the retired `tools`
list to the `requires` schema, ships the shared Node checker into each
of those plugins, replaces the eight bash SessionStart probes with
`lib/prerequisites.mjs probe`, and rewrites the harness-ops fleet
reader in Node so it no longer needs python3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml                      |   7 -
 docs/conventions/prerequisites/README.md      |   9 +-
 lib/prerequisites.mjs                         |  29 +-
 lib/prerequisites.test.mjs                    | 111 +++-
 plugins/actionlint/.claude-plugin/plugin.json |   2 +-
 plugins/actionlint/CHANGELOG.md               |   7 +
 .../actionlint/hooks/actionlint-check.test.sh |   4 +-
 plugins/actionlint/hooks/hooks.json           |   7 +-
 .../actionlint/hooks/probe-prerequisite.sh    |  58 --
 plugins/actionlint/lib/prerequisites.mjs      | 597 ++++++++++++++++++
 plugins/actionlint/lib/prerequisites.ps1      |  14 +
 plugins/actionlint/lib/prerequisites.sh       |  17 +
 plugins/actionlint/prerequisites.json         |  59 +-
 plugins/autonomy/.claude-plugin/plugin.json   |   2 +-
 plugins/autonomy/CHANGELOG.md                 |   6 +
 plugins/autonomy/lib/prerequisites.mjs        | 597 ++++++++++++++++++
 plugins/autonomy/lib/prerequisites.ps1        |  14 +
 plugins/autonomy/lib/prerequisites.sh         |  17 +
 plugins/autonomy/prerequisites.json           |  40 +-
 .../bash-format/.claude-plugin/plugin.json    |   2 +-
 plugins/bash-format/CHANGELOG.md              |   7 +
 plugins/bash-format/hooks/bash-format.test.sh |  14 +-
 plugins/bash-format/hooks/hooks.json          |   7 +-
 .../bash-format/hooks/probe-prerequisite.sh   |  58 --
 plugins/bash-format/lib/prerequisites.mjs     | 597 ++++++++++++++++++
 plugins/bash-format/lib/prerequisites.ps1     |  14 +
 plugins/bash-format/lib/prerequisites.sh      |  17 +
 plugins/bash-format/prerequisites.json        |  78 ++-
 .../biome-format/.claude-plugin/plugin.json   |   2 +-
 plugins/biome-format/CHANGELOG.md             |   7 +
 plugins/biome-format/README.md                |   2 +-
 .../biome-format/hooks/biome-format.test.sh   |  14 +-
 plugins/biome-format/hooks/hooks.json         |   7 +-
 .../biome-format/hooks/probe-prerequisite.sh  |  58 --
 plugins/biome-format/lib/prerequisites.mjs    | 597 ++++++++++++++++++
 plugins/biome-format/lib/prerequisites.ps1    |  14 +
 plugins/biome-format/lib/prerequisites.sh     |  17 +
 plugins/biome-format/prerequisites.json       |  63 +-
 plugins/biome-format/skills/setup/SKILL.md    |   3 +-
 .../skills/setup/evals/evals.json             |   2 +-
 .../context-budget/.claude-plugin/plugin.json |   2 +-
 plugins/context-budget/CHANGELOG.md           |   6 +
 plugins/context-budget/lib/prerequisites.mjs  | 597 ++++++++++++++++++
 plugins/context-budget/lib/prerequisites.ps1  |  14 +
 plugins/context-budget/lib/prerequisites.sh   |  17 +
 plugins/context-budget/prerequisites.json     |  21 +-
 .../context-guard/.claude-plugin/plugin.json  |   2 +-
 plugins/context-guard/CHANGELOG.md            |   6 +
 plugins/context-guard/lib/prerequisites.mjs   | 597 ++++++++++++++++++
 plugins/context-guard/lib/prerequisites.ps1   |  14 +
 plugins/context-guard/lib/prerequisites.sh    |  17 +
 plugins/context-guard/prerequisites.json      |  42 +-
 plugins/context7/.claude-plugin/plugin.json   |   2 +-
 plugins/context7/CHANGELOG.md                 |   6 +
 plugins/context7/lib/prerequisites.mjs        | 597 ++++++++++++++++++
 plugins/context7/lib/prerequisites.ps1        |  14 +
 plugins/context7/lib/prerequisites.sh         |  17 +
 plugins/context7/prerequisites.json           |  40 +-
 .../.claude-plugin/plugin.json                |   2 +-
 plugins/desktop-notification/CHANGELOG.md     |   6 +
 .../lib/prerequisites.mjs                     | 597 ++++++++++++++++++
 .../lib/prerequisites.ps1                     |  14 +
 .../desktop-notification/lib/prerequisites.sh |  17 +
 .../desktop-notification/prerequisites.json   |  40 +-
 .../disk-hygiene/.claude-plugin/plugin.json   |   2 +-
 plugins/disk-hygiene/CHANGELOG.md             |   6 +
 plugins/disk-hygiene/lib/prerequisites.mjs    | 597 ++++++++++++++++++
 plugins/disk-hygiene/lib/prerequisites.ps1    |  14 +
 plugins/disk-hygiene/lib/prerequisites.sh     |  17 +
 plugins/disk-hygiene/prerequisites.json       |  21 +-
 .../eol-normalizer/.claude-plugin/plugin.json |   2 +-
 plugins/eol-normalizer/CHANGELOG.md           |   6 +
 plugins/eol-normalizer/lib/prerequisites.mjs  | 597 ++++++++++++++++++
 plugins/eol-normalizer/lib/prerequisites.ps1  |  14 +
 plugins/eol-normalizer/lib/prerequisites.sh   |  17 +
 plugins/eol-normalizer/prerequisites.json     |  40 +-
 plugins/go-format/.claude-plugin/plugin.json  |   2 +-
 plugins/go-format/CHANGELOG.md                |   7 +
 plugins/go-format/hooks/go-format.test.sh     |   8 +-
 plugins/go-format/hooks/hooks.json            |   7 +-
 plugins/go-format/hooks/probe-prerequisite.sh |  58 --
 plugins/go-format/lib/prerequisites.mjs       | 597 ++++++++++++++++++
 plugins/go-format/lib/prerequisites.ps1       |  14 +
 plugins/go-format/lib/prerequisites.sh        |  17 +
 plugins/go-format/prerequisites.json          |  59 +-
 plugins/guardrails/.claude-plugin/plugin.json |   2 +-
 plugins/guardrails/CHANGELOG.md               |   6 +
 plugins/guardrails/lib/prerequisites.mjs      | 597 ++++++++++++++++++
 plugins/guardrails/lib/prerequisites.ps1      |  14 +
 plugins/guardrails/lib/prerequisites.sh       |  17 +
 plugins/guardrails/prerequisites.json         |  41 +-
 .../harness-ops/.claude-plugin/plugin.json    |   2 +-
 plugins/harness-ops/CHANGELOG.md              |   7 +
 plugins/harness-ops/lib/prerequisites.mjs     |  29 +-
 plugins/harness-ops/prerequisites.json        |  44 +-
 .../harness-ops/skills/prerequisites/SKILL.md |  10 +-
 .../skills/prerequisites/evals/evals.json     |   8 +-
 .../scripts/check-prerequisites.mjs           | 219 +++++++
 .../scripts/check-prerequisites.sh            | 238 -------
 .../scripts/check-prerequisites.test.sh       | 158 +++--
 .../.claude-plugin/plugin.json                |   2 +-
 plugins/markdown-format/CHANGELOG.md          |   8 +
 plugins/markdown-format/README.md             |  14 +-
 plugins/markdown-format/hooks/hooks.json      |   7 +-
 .../markdown-format/hooks/markdown-format.sh  |   2 +-
 .../hooks/markdown-format.test.sh             |   9 +-
 .../hooks/probe-prerequisite.sh               |  58 --
 plugins/markdown-format/lib/prerequisites.mjs | 597 ++++++++++++++++++
 plugins/markdown-format/lib/prerequisites.ps1 |  14 +
 plugins/markdown-format/lib/prerequisites.sh  |  17 +
 plugins/markdown-format/prerequisites.json    |  63 +-
 .../multi-agent/.claude-plugin/plugin.json    |   2 +-
 plugins/multi-agent/CHANGELOG.md              |   6 +
 plugins/multi-agent/lib/prerequisites.mjs     | 597 ++++++++++++++++++
 plugins/multi-agent/lib/prerequisites.ps1     |  14 +
 plugins/multi-agent/lib/prerequisites.sh      |  17 +
 plugins/multi-agent/prerequisites.json        |  21 +-
 plugins/playwright/.claude-plugin/plugin.json |   2 +-
 plugins/playwright/CHANGELOG.md               |   6 +
 plugins/playwright/lib/prerequisites.mjs      | 597 ++++++++++++++++++
 plugins/playwright/lib/prerequisites.ps1      |  14 +
 plugins/playwright/lib/prerequisites.sh       |  17 +
 plugins/playwright/prerequisites.json         |  39 +-
 .../.claude-plugin/plugin.json                |   2 +-
 plugins/powershell-format/CHANGELOG.md        |   7 +
 plugins/powershell-format/hooks/hooks.json    |   7 +-
 .../hooks/powershell-format.test.sh           |  12 +-
 .../hooks/probe-prerequisite.sh               |  58 --
 .../powershell-format/lib/prerequisites.mjs   | 597 ++++++++++++++++++
 .../powershell-format/lib/prerequisites.ps1   |  14 +
 .../powershell-format/lib/prerequisites.sh    |  17 +
 plugins/powershell-format/prerequisites.json  |  59 +-
 .../.claude-plugin/plugin.json                |   2 +-
 plugins/rate-limit-guard/CHANGELOG.md         |   6 +
 .../rate-limit-guard/lib/prerequisites.mjs    | 597 ++++++++++++++++++
 .../rate-limit-guard/lib/prerequisites.ps1    |  14 +
 plugins/rate-limit-guard/lib/prerequisites.sh |  17 +
 plugins/rate-limit-guard/prerequisites.json   |  40 +-
 .../ruff-format/.claude-plugin/plugin.json    |   2 +-
 plugins/ruff-format/CHANGELOG.md              |   7 +
 plugins/ruff-format/hooks/hooks.json          |   7 +-
 .../ruff-format/hooks/probe-prerequisite.sh   |  58 --
 plugins/ruff-format/hooks/ruff-format.test.sh |  14 +-
 plugins/ruff-format/lib/prerequisites.mjs     | 597 ++++++++++++++++++
 plugins/ruff-format/lib/prerequisites.ps1     |  14 +
 plugins/ruff-format/lib/prerequisites.sh      |  17 +
 plugins/ruff-format/prerequisites.json        |  64 +-
 .../session-flow/.claude-plugin/plugin.json   |   2 +-
 plugins/session-flow/CHANGELOG.md             |   6 +
 plugins/session-flow/lib/prerequisites.mjs    | 597 ++++++++++++++++++
 plugins/session-flow/lib/prerequisites.ps1    |  14 +
 plugins/session-flow/lib/prerequisites.sh     |  17 +
 plugins/session-flow/prerequisites.json       |  40 +-
 .../source-control/.claude-plugin/plugin.json |   2 +-
 plugins/source-control/CHANGELOG.md           |   6 +
 plugins/source-control/lib/prerequisites.mjs  | 597 ++++++++++++++++++
 plugins/source-control/lib/prerequisites.ps1  |  14 +
 plugins/source-control/lib/prerequisites.sh   |  17 +
 plugins/source-control/prerequisites.json     |  44 +-
 plugins/testing/.claude-plugin/plugin.json    |   2 +-
 plugins/testing/CHANGELOG.md                  |   6 +
 plugins/testing/lib/prerequisites.mjs         | 597 ++++++++++++++++++
 plugins/testing/lib/prerequisites.ps1         |  14 +
 plugins/testing/lib/prerequisites.sh          |  17 +
 plugins/testing/prerequisites.json            |  45 +-
 .../typos-format/.claude-plugin/plugin.json   |   2 +-
 plugins/typos-format/CHANGELOG.md             |   7 +
 plugins/typos-format/hooks/hooks.json         |   7 +-
 .../typos-format/hooks/probe-prerequisite.sh  |  58 --
 .../typos-format/hooks/typos-format.test.sh   |  12 +-
 plugins/typos-format/lib/prerequisites.mjs    | 597 ++++++++++++++++++
 plugins/typos-format/lib/prerequisites.ps1    |  14 +
 plugins/typos-format/lib/prerequisites.sh     |  17 +
 plugins/typos-format/prerequisites.json       |  60 +-
 scripts/check-prerequisite-probes.test.sh     |  86 ---
 scripts/cross-plugin-source-registry.txt      |   5 -
 scripts/prerequisites-baseline.txt            |  61 --
 scripts/shared-copies.txt                     |  66 ++
 178 files changed, 15515 insertions(+), 1224 deletions(-)
 delete mode 100755 plugins/actionlint/hooks/probe-prerequisite.sh
 create mode 100755 plugins/actionlint/lib/prerequisites.mjs
 create mode 100644 plugins/actionlint/lib/prerequisites.ps1
 create mode 100755 plugins/actionlint/lib/prerequisites.sh
 create mode 100755 plugins/autonomy/lib/prerequisites.mjs
 create mode 100644 plugins/autonomy/lib/prerequisites.ps1
 create mode 100755 plugins/autonomy/lib/prerequisites.sh
 delete mode 100755 plugins/bash-format/hooks/probe-prerequisite.sh
 create mode 100755 plugins/bash-format/lib/prerequisites.mjs
 create mode 100644 plugins/bash-format/lib/prerequisites.ps1
 create mode 100755 plugins/bash-format/lib/prerequisites.sh
 delete mode 100755 plugins/biome-format/hooks/probe-prerequisite.sh
 create mode 100755 plugins/biome-format/lib/prerequisites.mjs
 create mode 100644 plugins/biome-format/lib/prerequisites.ps1
 create mode 100755 plugins/biome-format/lib/prerequisites.sh
 create mode 100755 plugins/context-budget/lib/prerequisites.mjs
 create mode 100644 plugins/context-budget/lib/prerequisites.ps1
 create mode 100755 plugins/context-budget/lib/prerequisites.sh
 create mode 100755 plugins/context-guard/lib/prerequisites.mjs
 create mode 100644 plugins/context-guard/lib/prerequisites.ps1
 create mode 100755 plugins/context-guard/lib/prerequisites.sh
 create mode 100755 plugins/context7/lib/prerequisites.mjs
 create mode 100644 plugins/context7/lib/prerequisites.ps1
 create mode 100755 plugins/context7/lib/prerequisites.sh
 create mode 100755 plugins/desktop-notification/lib/prerequisites.mjs
 create mode 100644 plugins/desktop-notification/lib/prerequisites.ps1
 create mode 100755 plugins/desktop-notification/lib/prerequisites.sh
 create mode 100755 plugins/disk-hygiene/lib/prerequisites.mjs
 create mode 100644 plugins/disk-hygiene/lib/prerequisites.ps1
 create mode 100755 plugins/disk-hygiene/lib/prerequisites.sh
 create mode 100755 plugins/eol-normalizer/lib/prerequisites.mjs
 create mode 100644 plugins/eol-normalizer/lib/prerequisites.ps1
 create mode 100755 plugins/eol-normalizer/lib/prerequisites.sh
 delete mode 100755 plugins/go-format/hooks/probe-prerequisite.sh
 create mode 100755 plugins/go-format/lib/prerequisites.mjs
 create mode 100644 plugins/go-format/lib/prerequisites.ps1
 create mode 100755 plugins/go-format/lib/prerequisites.sh
 create mode 100755 plugins/guardrails/lib/prerequisites.mjs
 create mode 100644 plugins/guardrails/lib/prerequisites.ps1
 create mode 100755 plugins/guardrails/lib/prerequisites.sh
 create mode 100644 plugins/harness-ops/skills/prerequisites/scripts/check-prerequisites.mjs
 delete mode 100755 plugins/harness-ops/skills/prerequisites/scripts/check-prerequisites.sh
 delete mode 100755 plugins/markdown-format/hooks/probe-prerequisite.sh
 create mode 100755 plugins/markdown-format/lib/prerequisites.mjs
 create mode 100644 plugins/markdown-format/lib/prerequisites.ps1
 create mode 100755 plugins/markdown-format/lib/prerequisites.sh
 create mode 100755 plugins/multi-agent/lib/prerequisites.mjs
 create mode 100644 plugins/multi-agent/lib/prerequisites.ps1
 create mode 100755 plugins/multi-agent/lib/prerequisites.sh
 create mode 100755 plugins/playwright/lib/prerequisites.mjs
 create mode 100644 plugins/playwright/lib/prerequisites.ps1
 create mode 100755 plugins/playwright/lib/prerequisites.sh
 delete mode 100755 plugins/powershell-format/hooks/probe-prerequisite.sh
 create mode 100755 plugins/powershell-format/lib/prerequisites.mjs
 create mode 100644 plugins/powershell-format/lib/prerequisites.ps1
 create mode 100755 plugins/powershell-format/lib/prerequisites.sh
 create mode 100755 plugins/rate-limit-guard/lib/prerequisites.mjs
 create mode 100644 plugins/rate-limit-guard/lib/prerequisites.ps1
 create mode 100755 plugins/rate-limit-guard/lib/prerequisites.sh
 delete mode 100755 plugins/ruff-format/hooks/probe-prerequisite.sh
 create mode 100755 plugins/ruff-format/lib/prerequisites.mjs
 create mode 100644 plugins/ruff-format/lib/prerequisites.ps1
 create mode 100755 plugins/ruff-format/lib/prerequisites.sh
 create mode 100755 plugins/session-flow/lib/prerequisites.mjs
 create mode 100644 plugins/session-flow/lib/prerequisites.ps1
 create mode 100755 plugins/session-flow/lib/prerequisites.sh
 create mode 100755 plugins/source-control/lib/prerequisites.mjs
 create mode 100644 plugins/source-control/lib/prerequisites.ps1
 create mode 100755 plugins/source-control/lib/prerequisites.sh
 create mode 100755 plugins/testing/lib/prerequisites.mjs
 create mode 100644 plugins/testing/lib/prerequisites.ps1
 create mode 100755 plugins/testing/lib/prerequisites.sh
 delete mode 100755 plugins/typos-format/hooks/probe-prerequisite.sh
 create mode 100755 plugins/typos-format/lib/prerequisites.mjs
 create mode 100644 plugins/typos-format/lib/prerequisites.ps1
 create mode 100755 plugins/typos-format/lib/prerequisites.sh
 delete mode 100755 scripts/check-prerequisite-probes.test.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ee04a70f53..e4b73aa3d7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1940,13 +1940,6 @@ jobs:
         run: |
           [ "$LEG" = 2 ] || exit 0
           bash scripts/lib/read-list.test.sh
-      # This suite ties each plugins/*/hooks/probe-prerequisite.sh to that
-      # plugin's prerequisites.json; run-plugin-tests.sh does not discover scripts/.
-      - name: Run prerequisite-probe manifest tests
-        if: needs.changes.outputs.run_tests == 'true'
-        run: |
-          [ "$LEG" = 2 ] || exit 0
-          bash scripts/check-prerequisite-probes.test.sh
       # scripts/lib/test-harness.sh is the ok/fail/report contract the
       # scripts/*.test.sh suites share. A recorded failure that still exits 0
       # is the false-green this library exists to refuse (#3160).
diff --git a/docs/conventions/prerequisites/README.md b/docs/conventions/prerequisites/README.md
index 9191218201..c373a422e7 100644
--- a/docs/conventions/prerequisites/README.md
+++ b/docs/conventions/prerequisites/README.md
@@ -96,12 +96,19 @@ listed in `scripts/shared-copies.txt` and regenerated by `scripts/sync-shared-co
 | --- | --- | --- |
 | `check <plugin-root> [--for <scope>] [--data-dir <dir>]` | Setup and check skills, and a skill's own entry point | One `PASS`, `FAIL`, `WARN` or `INFO` line per entry, with the `degrade`, `install` and `check` text on a failure, then a summary line. `--for` keeps that scope's entries plus the `plugin` ones. |
 | `report --plugin-root <dir>...` | The fleet table | A TSV table (`plugin id kind need status check install`) and `missing=N present=M`. |
-| `probe <plugin-root>` | A SessionStart hook | A notice on both hook channels for each missing entry a `hook:` scope needs, once per session. |
+| `probe <plugin-root> [--run-if-unset-or-true <OPTION>]` | A SessionStart hook | A notice on both hook channels for each missing entry a `hook:` scope needs, once per session. `--run-if-unset-or-true` closes the probe when `CLAUDE_PLUGIN_OPTION_<OPTION>` is set to anything but `true`, so the plugin's kill switch silences it. |
 
 Exit codes: 0 when every required entry resolves, 1 when a required entry is missing or below its
 floor, 2 on a usage error or a file that fails the schema. `probe` exits 0 after a notice, because
 Claude Code reads a hook's JSON output only from a zero exit; it still exits 2 on a bad file.
 
+A hook plugin registers the probe as its SessionStart row, with no bash probe script beside it:
+
+```json
+"command": "node",
+"args": ["${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs", "probe", "${CLAUDE_PLUGIN_ROOT}", "--run-if-unset-or-true", "BIOME_FORMAT_ENABLED"]
+```
+
 A skill runs the checker with the plugin's paths substituted inline, because the Bash tool's
 environment has no plugin variables:
 
diff --git a/lib/prerequisites.mjs b/lib/prerequisites.mjs
index 7b8f078428..e19bd0a9b4 100755
--- a/lib/prerequisites.mjs
+++ b/lib/prerequisites.mjs
@@ -4,7 +4,7 @@
 //
 //   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
 //   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
-//   prerequisites.mjs probe <plugin-root>
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
 //
 // report  One TSV table across plugins, then a missing/present summary line.
 // check   One line per entry with the remediation, for setup and check skills.
@@ -14,6 +14,9 @@
 // probe   A SessionStart hook. Notifies once per session for each missing entry a
 //         hook needs, on both hook channels. Always exits 0 on a valid manifest,
 //         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
 //
 // Exit 0: every required entry resolves. Exit 1: a required entry is missing or
 // below its version floor. Exit 2: a usage error or a manifest that fails the schema.
@@ -52,6 +55,7 @@ const MIN_RE = /^\d+(\.\d+)*$/;
 const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
 const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
 const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
 const SERVER_RE = /^[A-Za-z0-9._-]+$/;
 const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
 const PROBE_TIMEOUT_MS = 5000;
@@ -384,7 +388,7 @@ function inScope(entry, scope) {
 const USAGE = [
   "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
   "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
-  "       prerequisites.mjs probe <plugin-root>",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
 ].join("\n");
 
 class UsageError extends Error {}
@@ -393,7 +397,7 @@ function parseArgs(argv) {
   const [mode, ...rest] = argv;
   if (!["report", "check", "probe"].includes(mode))
     throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
-  const opts = { mode, roots: [], scope: null, dataDir: null };
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
   for (let i = 0; i < rest.length; i++) {
     const arg = rest[i];
     if (arg === "--plugin-root" && mode === "report") {
@@ -405,6 +409,11 @@ function parseArgs(argv) {
     } else if (arg === "--data-dir" && mode === "check") {
       if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
       opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
     } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
       opts.roots.push(arg);
     } else {
@@ -480,13 +489,15 @@ function cmdCheck(opts, ctx, out) {
   return counts.failed ? 1 : 0;
 }
 
-function cmdReport(opts, ctx, out) {
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
   out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
   let missing = 0;
   let present = 0;
   let requiredMissing = false;
   let invalid = false;
-  for (const root of opts.roots) {
+  for (const root of roots) {
     const { plugin, manifest, errors, absent } = loadManifest(root);
     if (absent) continue;
     if (errors.length) {
@@ -510,7 +521,15 @@ function cmdReport(opts, ctx, out) {
   return requiredMissing ? 1 : 0;
 }
 
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
 function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
   const root = opts.roots[0];
   const { plugin, manifest, errors, absent } = loadManifest(root);
   if (absent) return 0;
diff --git a/lib/prerequisites.test.mjs b/lib/prerequisites.test.mjs
index 2e23d73e2e..2caa0473d0 100644
--- a/lib/prerequisites.test.mjs
+++ b/lib/prerequisites.test.mjs
@@ -1,12 +1,21 @@
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
-import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import process from "node:process";
 import { after, describe, test } from "node:test";
 import { fileURLToPath } from "node:url";
-import { compareVersions, KINDS, main, NEEDS, validateManifest } from "./prerequisites.mjs";
+import { compareVersions, KINDS, loadManifest, main, NEEDS, report, validateManifest } from "./prerequisites.mjs";
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const checker = path.join(here, "prerequisites.mjs");
@@ -483,6 +492,104 @@ describe("probe", { skip: !posix && "the stub tools are POSIX shell scripts" },
   });
 });
 
+describe("probe option gate", { skip: !posix && "the stub tools are POSIX shell scripts" }, () => {
+  const input = () => JSON.stringify({ session_id: "g1" });
+  const root = plugin([entry({ for: ["hook:a.sh"] })], "gated");
+  const run = (value) =>
+    runMain(["probe", root, "--run-if-unset-or-true", "GATED_ENABLED"], {
+      env: value === undefined ? { PATH: "" } : { PATH: "", CLAUDE_PLUGIN_OPTION_GATED_ENABLED: value },
+      stdin: input,
+    });
+
+  test("probes when the option is unset, empty or true", () => {
+    for (const value of [undefined, "", "true"]) assert.notEqual(run(value).out, "", String(value));
+  });
+
+  test("stays silent and exits 0 when the option is set to anything else", () => {
+    for (const value of ["false", "0", "no"]) {
+      const r = run(value);
+      assert.equal(r.code, 0, value);
+      assert.equal(r.out, "", value);
+    }
+  });
+
+  test("rejects a gate name that is not an option name", () => {
+    for (const argv of [
+      ["probe", root, "--run-if-unset-or-true"],
+      ["probe", root, "--run-if-unset-or-true", "lower"],
+      ["check", root, "--run-if-unset-or-true", "GATED_ENABLED"],
+    ]) {
+      assert.equal(runMain(argv).code, 2, argv.join(" "));
+    }
+  });
+});
+
+describe("report with no plugin roots", () => {
+  test("prints an empty table and exits 0", () => {
+    const lines = [];
+    const ctx = { env: {}, platform: process.platform, cwd: work };
+    const code = report([], ctx, { stdout: (s) => lines.push(s), stderr() {} });
+    assert.equal(code, 0);
+    assert.deepEqual(lines, ["plugin\tid\tkind\tneed\tstatus\tcheck\tinstall", "missing=0 present=0"]);
+  });
+});
+
+// Every plugin's own prerequisites.json, read as the shipped checker reads it.
+describe("shipped plugin manifests", { skip: !posix && "the stub tools are POSIX shell scripts" }, () => {
+  const pluginsDir = path.join(here, "..", "plugins");
+  const roots = readdirSync(pluginsDir)
+    .map((name) => path.join(pluginsDir, name))
+    .filter((root) => existsSync(path.join(root, "prerequisites.json")));
+  const emptyBin = bin({});
+  const input = () => JSON.stringify({ session_id: "m1" });
+
+  test("at least one plugin declares prerequisites", () => {
+    assert.ok(roots.length > 0);
+  });
+
+  for (const root of roots) {
+    const name = path.basename(root);
+    const { manifest, errors } = loadManifest(root);
+
+    test(`${name}: prerequisites.json passes the schema and carries the checker copies`, () => {
+      assert.deepEqual(errors, []);
+      for (const file of ["prerequisites.mjs", "prerequisites.sh", "prerequisites.ps1"]) {
+        assert.ok(existsSync(path.join(root, "lib", file)), `lib/${file}`);
+      }
+    });
+
+    if (errors.length) continue;
+    const hookEntries = manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")));
+
+    test(`${name}: probe names each missing hook dependency's id, check and install hints`, () => {
+      const data = path.join(work, `data-manifest-${name}`);
+      const r = runMain(["probe", root], { env: { PATH: emptyBin, CLAUDE_PLUGIN_DATA: data }, stdin: input });
+      assert.equal(r.code, 0);
+      if (hookEntries.length === 0) {
+        assert.equal(r.out, "");
+        return;
+      }
+      assert.equal(r.out.split("\n").length, 1, "one hook document");
+      const message = JSON.parse(r.out).systemMessage;
+      for (const entry of hookEntries) {
+        assert.ok(message.includes(`Hooks that need ${entry.id} skip`), `${entry.id} is reported`);
+        assert.ok(message.includes(entry.check), `${entry.id}: ${entry.check}`);
+        for (const hint of Object.values(entry.install)) assert.ok(message.includes(hint), `${entry.id}: ${hint}`);
+      }
+    });
+
+    test(`${name}: probe is silent when every declared binary is on PATH`, () => {
+      const names = manifest.requires.flatMap((e) => e.detect.any ?? []);
+      const stubs = bin(Object.fromEntries(names.map((n) => [n, "exit 0"])));
+      const r = runMain(["probe", root], {
+        env: { PATH: stubs, CLAUDE_PLUGIN_DATA: path.join(work, `data-silent-${name}`) },
+        stdin: input,
+      });
+      assert.equal(r.out, "");
+    });
+  }
+});
+
 describe("command line", () => {
   test("the process exit code follows main()", () => {
     const root = plugin([entry({ id: "definitely-absent-tool", detect: { any: ["definitely-absent-tool-x9"] } })]);
diff --git a/plugins/actionlint/.claude-plugin/plugin.json b/plugins/actionlint/.claude-plugin/plugin.json
index c7f2261b45..77a96d9531 100644
--- a/plugins/actionlint/.claude-plugin/plugin.json
+++ b/plugins/actionlint/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "actionlint",
-  "version": "0.11.12",
+  "version": "0.11.13",
   "description": "Lint GitHub Actions workflow files on edit via actionlint, surfacing findings as advisory context.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/actionlint/CHANGELOG.md b/plugins/actionlint/CHANGELOG.md
index 1b327507a1..931b551c12 100644
--- a/plugins/actionlint/CHANGELOG.md
+++ b/plugins/actionlint/CHANGELOG.md
@@ -3,6 +3,13 @@
 All notable changes to the `actionlint` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.11.13] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list, with a `degrade` line per entry ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+- The `SessionStart` row runs `lib/prerequisites.mjs probe` behind the same `--run-if-unset-or-true` kill-switch gate, and `hooks/probe-prerequisite.sh` is deleted. The notice text, its once-per-session latch shared with the per-edit hook, and its silence when the kill switch is off are unchanged; the hook test suite asserts each.
+
 ## [0.11.12] - 2026-10-02
 
 ### Changed
diff --git a/plugins/actionlint/hooks/actionlint-check.test.sh b/plugins/actionlint/hooks/actionlint-check.test.sh
index b7234904c6..b0a8694879 100755
--- a/plugins/actionlint/hooks/actionlint-check.test.sh
+++ b/plugins/actionlint/hooks/actionlint-check.test.sh
@@ -360,7 +360,7 @@ run_absent_as() {
   )
 }
 MANIFEST="${HOOK_DIR%/*}/prerequisites.json"
-IFS=$'\t' read -r MF_NAME MF_CHECK MF_INSTALL < <(jq -r '.tools[0] | [.name, .check, .install] | @tsv' "$MANIFEST")
+IFS=$'\t' read -r MF_NAME MF_CHECK MF_INSTALL < <(jq -r '.requires[0] | [.id, .check, (.install | to_entries[0].value)] | @tsv' "$MANIFEST")
 if jq -e --arg check "$MF_CHECK" --arg install "$MF_INSTALL" '.systemMessage | contains($check) and contains($install)' <<<"$OUT_ABS" >/dev/null 2>&1; then
   ok "actionlint-absent -> first notice names /actionlint:check and the install route"
 else
@@ -613,7 +613,7 @@ fi
 # path), so this case is the binding: the manifest lists actionlint, jq and node,
 # and the hook's missing-binary notice call states the actionlint tool's name,
 # check and install, verbatim.
-if jq -e '(.tools | map(.name)) == ["actionlint", "jq", "node"]' "$MANIFEST" >/dev/null 2>&1; then
+if jq -e '(.requires | map(.id)) == ["actionlint", "jq", "node"]' "$MANIFEST" >/dev/null 2>&1; then
   ok "manifest: declares exactly actionlint, jq and node"
 else
   fail "manifest: expected tools actionlint, jq and node: $(cat "$MANIFEST")"
diff --git a/plugins/actionlint/hooks/hooks.json b/plugins/actionlint/hooks/hooks.json
index ae4f2f67d9..8f44a79b88 100644
--- a/plugins/actionlint/hooks/hooks.json
+++ b/plugins/actionlint/hooks/hooks.json
@@ -37,10 +37,11 @@
             "type": "command",
             "command": "node",
             "args": [
-              "${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs",
+              "probe",
+              "${CLAUDE_PLUGIN_ROOT}",
               "--run-if-unset-or-true",
-              "ACTIONLINT_ENABLED",
-              "${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh"
+              "ACTIONLINT_ENABLED"
             ],
             "timeout": 10,
             "statusMessage": "Checking actionlint..."
diff --git a/plugins/actionlint/hooks/probe-prerequisite.sh b/plugins/actionlint/hooks/probe-prerequisite.sh
deleted file mode 100755
index 41eb7efa95..0000000000
--- a/plugins/actionlint/hooks/probe-prerequisite.sh
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-# SessionStart probe for the binaries this plugin's prerequisites.json declares.
-# Every name, local_bin, check, and install string comes from that manifest.
-# Reports a missing binary once per session; never installs.
-set -uo pipefail
-
-SCRIPT_DIR="$(cd "${BASH_SOURCE[0]%/*}" && pwd)"
-ROOT="${SCRIPT_DIR%/*}"
-MANIFEST="$ROOT/prerequisites.json"
-[[ -f "$MANIFEST" ]] || exit 0
-
-field() {
-  local re="\"$1\"[[:space:]]*:[[:space:]]*\"([^\"]*)\""
-  [[ "$2" =~ $re ]] && printf '%s' "${BASH_REMATCH[1]}"
-}
-
-have() {
-  command -v "$1" >/dev/null 2>&1 && return 0
-  [[ -n "$2" ]] || return 1
-  local dir="$PWD" i
-  for ((i = 0; i < 8; i++)); do
-    [[ -x "$dir/$2" ]] && return 0
-    [[ "$dir" == "/" ]] && break
-    dir="$(dirname "$dir")"
-  done
-  return 1
-}
-
-plugin="$(field name "$(cat "$ROOT/.claude-plugin/plugin.json" 2>/dev/null)")"
-plugin="${plugin:-${ROOT##*/}}"
-tools="$(tr -d '\r\n' <"$MANIFEST")"
-tools="${tools#*\"tools\"}"
-
-INPUT=""
-loaded=0
-while [[ "$tools" == *"{"* ]]; do
-  tools="${tools#*\{}"
-  entry="${tools%%\}*}"
-  tools="${tools#*\}}"
-  name="$(field name "$entry")"
-  [[ -n "$name" ]] || continue
-  local_bin="$(field local_bin "$entry")"
-  have "$name" "$local_bin" && continue
-  if [[ "$loaded" -eq 0 ]]; then
-    # shellcheck source=hook-utils.sh
-    source "$SCRIPT_DIR/hook-utils.sh"
-    INPUT="$(cat || true)"
-    loaded=1
-  fi
-  where="on PATH"
-  [[ -n "$local_bin" ]] && where="on PATH or as $local_bin"
-  if hook::notice_once "$plugin-$name" "$INPUT" prerequisite; then
-    msg="$plugin: $name was not found $where. Hooks that need it will skip until it is installed. Run $(field check "$entry"). It does not install. Install: $(field install "$entry")"
-    notice="${notice:+$notice$'\n'}$msg"
-  fi
-done
-[[ -n "${notice:-}" ]] && hook::emit_skip_notice SessionStart "$notice"
-exit 0
diff --git a/plugins/actionlint/lib/prerequisites.mjs b/plugins/actionlint/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/actionlint/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/actionlint/lib/prerequisites.ps1 b/plugins/actionlint/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/actionlint/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/actionlint/lib/prerequisites.sh b/plugins/actionlint/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/actionlint/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/actionlint/prerequisites.json b/plugins/actionlint/prerequisites.json
index 582f85fd49..5b2b1aa562 100644
--- a/plugins/actionlint/prerequisites.json
+++ b/plugins/actionlint/prerequisites.json
@@ -1,19 +1,58 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "actionlint",
-      "check": "/actionlint:check",
-      "install": "https://github.com/rhysd/actionlint/blob/main/docs/install.md"
+      "id": "actionlint",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:actionlint-check.sh"
+      ],
+      "detect": {
+        "any": [
+          "actionlint"
+        ]
+      },
+      "degrade": "Without actionlint, the hook cannot lint edited GitHub Actions workflows; edits still go through.",
+      "install": {
+        "docs": "https://github.com/rhysd/actionlint/blob/main/docs/install.md"
+      },
+      "check": "/actionlint:check"
     },
     {
-      "name": "jq",
-      "check": "/actionlint:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:actionlint-check.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the actionlint hooks skip their work for the session and say so once.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/actionlint:check"
     },
     {
-      "name": "node",
-      "check": "/actionlint:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the actionlint hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/actionlint:check"
     }
   ]
 }
diff --git a/plugins/autonomy/.claude-plugin/plugin.json b/plugins/autonomy/.claude-plugin/plugin.json
index cd54fc1a0a..cb71255cdc 100644
--- a/plugins/autonomy/.claude-plugin/plugin.json
+++ b/plugins/autonomy/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "autonomy",
-  "version": "0.25.7",
+  "version": "0.25.8",
   "description": "Governed autonomous agent operation: role-topology, binding-seam, wiring-vs-advisor, telemetry, return-accounting, trigger-dispatch, per-work-class guardrail-matrix, standing-routine-catalog, and design-only runner-charter contracts for climbing the AI-adoption ladder, plus a guided-setup skill that discovers an adopting org's state, writes its schema-versioned binding, wires standards-pinned OTLP emission with a zero-cost file-artifact default, wires human-attested return capture at the task boundary, wires signal adapters with one governed dispatch entrypoint, binds the five-class guardrail matrix to an org's isolation substrates with an in-boundary live-validation probe before recording each fail-closed binding, and stands up standing-routine-catalog classes as scheduled temporal signal adapters behind the one governed queue with free scheduling defaults wired as reviewable changes and each routine's work-class mapping homed on the security surface.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/autonomy/CHANGELOG.md b/plugins/autonomy/CHANGELOG.md
index 01f8988528..af6a90cfbb 100644
--- a/plugins/autonomy/CHANGELOG.md
+++ b/plugins/autonomy/CHANGELOG.md
@@ -3,6 +3,12 @@
 All notable changes to the `autonomy` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.25.8] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list (#5840). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+
 ## [0.25.7] - 2026-10-02
 
 ### Changed
diff --git a/plugins/autonomy/lib/prerequisites.mjs b/plugins/autonomy/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/autonomy/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/autonomy/lib/prerequisites.ps1 b/plugins/autonomy/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/autonomy/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/autonomy/lib/prerequisites.sh b/plugins/autonomy/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/autonomy/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/autonomy/prerequisites.json b/plugins/autonomy/prerequisites.json
index 64d09a511c..6e83a47230 100644
--- a/plugins/autonomy/prerequisites.json
+++ b/plugins/autonomy/prerequisites.json
@@ -1,14 +1,40 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "node",
-      "check": "/autonomy:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the autonomy hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/autonomy:check"
     },
     {
-      "name": "jq",
-      "check": "/autonomy:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:lane-stop-gate.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the autonomy hooks skip their work for the session and say so once.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/autonomy:check"
     }
   ]
 }
diff --git a/plugins/bash-format/.claude-plugin/plugin.json b/plugins/bash-format/.claude-plugin/plugin.json
index 3f6d80ce7b..fca809a30f 100644
--- a/plugins/bash-format/.claude-plugin/plugin.json
+++ b/plugins/bash-format/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "bash-format",
-  "version": "0.9.11",
+  "version": "0.9.12",
   "description": "Auto-format and lint shell scripts on edit via shfmt + ShellCheck, using the consuming repo's own .editorconfig and .shellcheckrc.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/bash-format/CHANGELOG.md b/plugins/bash-format/CHANGELOG.md
index 350c7111e4..d78b5b4f80 100644
--- a/plugins/bash-format/CHANGELOG.md
+++ b/plugins/bash-format/CHANGELOG.md
@@ -3,6 +3,13 @@
 All notable changes to the `bash-format` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.9.12] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list, with a `degrade` line per entry ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+- The `SessionStart` row runs `lib/prerequisites.mjs probe` behind the same `--run-if-unset-or-true` kill-switch gate, and `hooks/probe-prerequisite.sh` is deleted. The notice text, its once-per-session latch shared with the per-edit hook, and its silence when the kill switch is off are unchanged; the hook test suite asserts each.
+
 ## [0.9.11] - 2026-10-02
 
 ### Changed
diff --git a/plugins/bash-format/hooks/bash-format.test.sh b/plugins/bash-format/hooks/bash-format.test.sh
index 9332a270a3..ea5453980c 100755
--- a/plugins/bash-format/hooks/bash-format.test.sh
+++ b/plugins/bash-format/hooks/bash-format.test.sh
@@ -731,12 +731,12 @@ if command -v jq >/dev/null 2>&1 && [[ -f "$HOOKS_JSON" && -n "$BEGIN_LINE" && "
   # form behind the bash_format_enabled launcher gate, which is asserted on its
   # own here.
   ALL_HANDLERS="$(jq -c '[.hooks | to_entries[] | .key as $ev | .value[]? | .matcher as $m | .hooks[]? | . + {event: $ev, matcher: ($m // "(none)")}]' "$HOOKS_JSON")"
-  PROBE_COUNT="$(jq -c --arg launcher '${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs' --arg probe '${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh' '[.[] | select(.event == "SessionStart" and .command == "node" and .args == [$launcher, "--run-if-unset-or-true", "BASH_FORMAT_ENABLED", $probe])] | length' <<<"$ALL_HANDLERS")"
-  HANDLERS="$(jq -c --arg launcher '${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs' --arg probe '${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh' '[.[] | select((.event == "SessionStart" and .command == "node" and .args == [$launcher, "--run-if-unset-or-true", "BASH_FORMAT_ENABLED", $probe]) | not)]' <<<"$ALL_HANDLERS")"
+  PROBE_COUNT="$(jq -c --arg checker '${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs' --arg root '${CLAUDE_PLUGIN_ROOT}' '[.[] | select(.event == "SessionStart" and .command == "node" and .args == [$checker, "probe", $root, "--run-if-unset-or-true", "BASH_FORMAT_ENABLED"])] | length' <<<"$ALL_HANDLERS")"
+  HANDLERS="$(jq -c --arg checker '${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs' --arg root '${CLAUDE_PLUGIN_ROOT}' '[.[] | select((.event == "SessionStart" and .command == "node" and .args == [$checker, "probe", $root, "--run-if-unset-or-true", "BASH_FORMAT_ENABLED"]) | not)]' <<<"$ALL_HANDLERS")"
   if [[ "$PROBE_COUNT" == "1" ]]; then
-    ok "hooks.json: one exec-form SessionStart row runs probe-prerequisite.sh behind --run-if-unset-or-true BASH_FORMAT_ENABLED"
+    ok "hooks.json: one exec-form SessionStart row runs the prerequisites checker's probe behind --run-if-unset-or-true BASH_FORMAT_ENABLED"
   else
-    fail "hooks.json: expected one exec-form SessionStart probe-prerequisite.sh row behind --run-if-unset-or-true BASH_FORMAT_ENABLED, found $PROBE_COUNT"
+    fail "hooks.json: expected one exec-form SessionStart prerequisites probe row behind --run-if-unset-or-true BASH_FORMAT_ENABLED, found $PROBE_COUNT"
   fi
   HANDLER_COUNT="$(jq 'length' <<<"$HANDLERS")"
   HANDLER_GROUPS="$(jq -r '[.[] | "\(.event):\(.matcher)"] | unique | join(",")' <<<"$HANDLERS")"
@@ -797,7 +797,7 @@ PLUGIN_ROOT="${HOOK_DIR%/*}"
 MANIFEST="$PLUGIN_ROOT/prerequisites.json"
 HOOKS_JSON="$HOOK_DIR/hooks.json"
 if command -v jq >/dev/null 2>&1 && [[ -f "$MANIFEST" ]]; then
-  if jq -e '(.tools | map(.name) | sort) == ["jq", "node", "shellcheck", "shfmt"]' "$MANIFEST" >/dev/null 2>&1; then
+  if jq -e '(.requires | map(.id) | sort) == ["jq", "node", "shellcheck", "shfmt"]' "$MANIFEST" >/dev/null 2>&1; then
     ok "manifest: declares exactly shfmt, shellcheck, jq and node"
   else
     fail "manifest: expected tools shfmt, shellcheck, jq and node: $(cat "$MANIFEST")"
@@ -815,7 +815,7 @@ if command -v jq >/dev/null 2>&1 && [[ -f "$MANIFEST" ]]; then
     shfmt) NOTICE_VAR=SHFMT_NOTICE ;;
     *) NOTICE_VAR=SC_NOTICE ;;
     esac
-    IFS=$'\t' read -r MF_CHECK MF_INSTALL < <(jq -r --arg n "$MF_TOOL" '.tools[] | select(.name == $n) | [.check, .install] | @tsv' "$MANIFEST")
+    IFS=$'\t' read -r MF_CHECK MF_INSTALL < <(jq -r --arg n "$MF_TOOL" '.requires[] | select(.id == $n) | [.check, (.install | to_entries[0].value)] | @tsv' "$MANIFEST")
     NOTICE_CALL="$(sed -n "/hook::tool_missing_notice_to $NOTICE_VAR/,/[^\\\\]\$/p" "$HOOK")"
     assert_hook_states "$MF_TOOL" name "'$MF_TOOL'" "$NOTICE_CALL"
     assert_hook_states "$MF_TOOL" check "$MF_CHECK" "$NOTICE_CALL"
@@ -876,7 +876,7 @@ else
     pg_ok=1
     while IFS=$'\t' read -r PG_NAME PG_CHECK PG_INSTALL; do
       [[ "$OUT_PG" == *"$PG_NAME"* && "$OUT_PG" == *"$PG_CHECK"* && "$OUT_PG" == *"$PG_INSTALL"* ]] || pg_ok=0
-    done < <(jq -r '.tools[] | select(.name != "node") | [.name, .check, .install] | @tsv' "$MANIFEST")
+    done < <(jq -r '.requires[] | select(.id != "node") | [.id, .check, (.install | to_entries[0].value)] | @tsv' "$MANIFEST")
     if [[ $RC_PG -eq 0 && $pg_ok -eq 1 ]]; then
       ok "probe-gate: $label -> notices name each tool, its check and the install line"
     else
diff --git a/plugins/bash-format/hooks/hooks.json b/plugins/bash-format/hooks/hooks.json
index 70c2e19532..0f568439c4 100644
--- a/plugins/bash-format/hooks/hooks.json
+++ b/plugins/bash-format/hooks/hooks.json
@@ -37,10 +37,11 @@
             "type": "command",
             "command": "node",
             "args": [
-              "${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs",
+              "probe",
+              "${CLAUDE_PLUGIN_ROOT}",
               "--run-if-unset-or-true",
-              "BASH_FORMAT_ENABLED",
-              "${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh"
+              "BASH_FORMAT_ENABLED"
             ],
             "timeout": 10,
             "statusMessage": "Checking shfmt and shellcheck..."
diff --git a/plugins/bash-format/hooks/probe-prerequisite.sh b/plugins/bash-format/hooks/probe-prerequisite.sh
deleted file mode 100755
index 41eb7efa95..0000000000
--- a/plugins/bash-format/hooks/probe-prerequisite.sh
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-# SessionStart probe for the binaries this plugin's prerequisites.json declares.
-# Every name, local_bin, check, and install string comes from that manifest.
-# Reports a missing binary once per session; never installs.
-set -uo pipefail
-
-SCRIPT_DIR="$(cd "${BASH_SOURCE[0]%/*}" && pwd)"
-ROOT="${SCRIPT_DIR%/*}"
-MANIFEST="$ROOT/prerequisites.json"
-[[ -f "$MANIFEST" ]] || exit 0
-
-field() {
-  local re="\"$1\"[[:space:]]*:[[:space:]]*\"([^\"]*)\""
-  [[ "$2" =~ $re ]] && printf '%s' "${BASH_REMATCH[1]}"
-}
-
-have() {
-  command -v "$1" >/dev/null 2>&1 && return 0
-  [[ -n "$2" ]] || return 1
-  local dir="$PWD" i
-  for ((i = 0; i < 8; i++)); do
-    [[ -x "$dir/$2" ]] && return 0
-    [[ "$dir" == "/" ]] && break
-    dir="$(dirname "$dir")"
-  done
-  return 1
-}
-
-plugin="$(field name "$(cat "$ROOT/.claude-plugin/plugin.json" 2>/dev/null)")"
-plugin="${plugin:-${ROOT##*/}}"
-tools="$(tr -d '\r\n' <"$MANIFEST")"
-tools="${tools#*\"tools\"}"
-
-INPUT=""
-loaded=0
-while [[ "$tools" == *"{"* ]]; do
-  tools="${tools#*\{}"
-  entry="${tools%%\}*}"
-  tools="${tools#*\}}"
-  name="$(field name "$entry")"
-  [[ -n "$name" ]] || continue
-  local_bin="$(field local_bin "$entry")"
-  have "$name" "$local_bin" && continue
-  if [[ "$loaded" -eq 0 ]]; then
-    # shellcheck source=hook-utils.sh
-    source "$SCRIPT_DIR/hook-utils.sh"
-    INPUT="$(cat || true)"
-    loaded=1
-  fi
-  where="on PATH"
-  [[ -n "$local_bin" ]] && where="on PATH or as $local_bin"
-  if hook::notice_once "$plugin-$name" "$INPUT" prerequisite; then
-    msg="$plugin: $name was not found $where. Hooks that need it will skip until it is installed. Run $(field check "$entry"). It does not install. Install: $(field install "$entry")"
-    notice="${notice:+$notice$'\n'}$msg"
-  fi
-done
-[[ -n "${notice:-}" ]] && hook::emit_skip_notice SessionStart "$notice"
-exit 0
diff --git a/plugins/bash-format/lib/prerequisites.mjs b/plugins/bash-format/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/bash-format/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/bash-format/lib/prerequisites.ps1 b/plugins/bash-format/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/bash-format/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/bash-format/lib/prerequisites.sh b/plugins/bash-format/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/bash-format/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/bash-format/prerequisites.json b/plugins/bash-format/prerequisites.json
index d110644b82..fcffa72862 100644
--- a/plugins/bash-format/prerequisites.json
+++ b/plugins/bash-format/prerequisites.json
@@ -1,24 +1,76 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "shfmt",
-      "check": "/bash-format:check",
-      "install": "host package or release binary, https://github.com/mvdan/sh#shfmt"
+      "id": "shfmt",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:bash-format.sh"
+      ],
+      "detect": {
+        "any": [
+          "shfmt"
+        ]
+      },
+      "degrade": "Without shfmt, the hook cannot format edited shell scripts; edits still go through.",
+      "install": {
+        "docs": "https://github.com/mvdan/sh#shfmt"
+      },
+      "check": "/bash-format:check"
     },
     {
-      "name": "shellcheck",
-      "check": "/bash-format:check",
-      "install": "host package or release binary, https://github.com/koalaman/shellcheck#installing"
+      "id": "shellcheck",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:bash-format.sh"
+      ],
+      "detect": {
+        "any": [
+          "shellcheck"
+        ]
+      },
+      "degrade": "Without shellcheck, the hook cannot lint edited shell scripts; edits still go through.",
+      "install": {
+        "docs": "https://github.com/koalaman/shellcheck#installing"
+      },
+      "check": "/bash-format:check"
     },
     {
-      "name": "jq",
-      "check": "/bash-format:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:bash-format.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the bash-format hooks skip their work for the session and say so once.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/bash-format:check"
     },
     {
-      "name": "node",
-      "check": "/bash-format:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the bash-format hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/bash-format:check"
     }
   ]
 }
diff --git a/plugins/biome-format/.claude-plugin/plugin.json b/plugins/biome-format/.claude-plugin/plugin.json
index b3c014415a..298e4035aa 100644
--- a/plugins/biome-format/.claude-plugin/plugin.json
+++ b/plugins/biome-format/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "biome-format",
-  "version": "0.7.20",
+  "version": "0.7.21",
   "description": "Auto-format and lint JS/TS/JSX/JSON on edit via Biome, only when a biome.json governs the repo, using the consuming repo's own Biome config.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/biome-format/CHANGELOG.md b/plugins/biome-format/CHANGELOG.md
index 305e819727..c4307f0025 100644
--- a/plugins/biome-format/CHANGELOG.md
+++ b/plugins/biome-format/CHANGELOG.md
@@ -3,6 +3,13 @@
 All notable changes to the `biome-format` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.7.21] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list, with a `degrade` line per entry ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+- The `SessionStart` row runs `lib/prerequisites.mjs probe` behind the same `--run-if-unset-or-true` kill-switch gate, and `hooks/probe-prerequisite.sh` is deleted. The notice text, its once-per-session latch shared with the per-edit hook, and its silence when the kill switch is off are unchanged; the hook test suite asserts each.
+
 ## [0.7.20] - 2026-10-02
 
 ### Changed
diff --git a/plugins/biome-format/README.md b/plugins/biome-format/README.md
index c77529d520..ca2ae3d6b8 100644
--- a/plugins/biome-format/README.md
+++ b/plugins/biome-format/README.md
@@ -65,7 +65,7 @@ Skip notices repeat by class:
   route every eighth skip.
 
 A `SessionStart` probe reports a missing Biome binary before the first edit. It reads the tool's
-name, check and install strings from `prerequisites.json`, resolves `biome` on `PATH` or as
+id, check and install hints from `prerequisites.json`, resolves `biome` on `PATH` or as
 `node_modules/.bin/biome` walking up at most eight directories from the session cwd, does not run
 when `biome_format_enabled` is `false`, and installs nothing. It does not look for a `biome.json`, so it
 reports a missing Biome in every repository where the plugin is enabled, including one that never opted in.
diff --git a/plugins/biome-format/hooks/biome-format.test.sh b/plugins/biome-format/hooks/biome-format.test.sh
index 2177912452..cb76b7a234 100755
--- a/plugins/biome-format/hooks/biome-format.test.sh
+++ b/plugins/biome-format/hooks/biome-format.test.sh
@@ -85,12 +85,12 @@ rm -rf "$NB_WORK"
 # name, check, install and local_bin, verbatim.
 MANIFEST="${HOOK_DIR%/*}/prerequisites.json"
 if command -v jq >/dev/null 2>&1 && [[ -f "$MANIFEST" ]]; then
-  if jq -e '(.tools | map(.name)) == ["biome", "jq", "node"] and .tools[0].local_bin == "node_modules/.bin/biome"' "$MANIFEST" >/dev/null 2>&1; then
+  if jq -e '(.requires | map(.id)) == ["biome", "jq", "node"] and .requires[0].detect.local_bin == ["node_modules/.bin/biome"]' "$MANIFEST" >/dev/null 2>&1; then
     ok "manifest: declares exactly biome (at node_modules/.bin/biome), jq and node"
   else
     fail "manifest: expected tools biome, jq and node with local_bin node_modules/.bin/biome: $(cat "$MANIFEST")"
   fi
-  IFS=$'\t' read -r MF_NAME MF_LOCAL MF_CHECK MF_INSTALL < <(jq -r '.tools[0] | [.name, .local_bin, .check, .install] | @tsv' "$MANIFEST")
+  IFS=$'\t' read -r MF_NAME MF_LOCAL MF_CHECK MF_INSTALL < <(jq -r '.requires[0] | [.id, .detect.local_bin[0], .check, (.install | to_entries[0].value)] | @tsv' "$MANIFEST")
   NOTICE_CALL="$(sed -n '/hook::tool_missing_notice_to BIOME_NOTICE/,/[^\\]$/p' "$HOOK")"
   WALK_FN="$(sed -n '/^biome_local_bin_here()/,/^}/p' "$HOOK")"
   # assert_hook_states <field> <needle> <haystack>
@@ -135,7 +135,7 @@ else
     # shellcheck disable=SC2016  # the placeholder is matched literally, as Claude Code substitutes it
     PG_ARGS+=("${pg_arg//\$\{CLAUDE_PLUGIN_ROOT\}/$PLUGIN_ROOT}")
   done < <(jq -r '.hooks.SessionStart[0].hooks[0].args[]' "$HOOKS_JSON")
-  IFS=$'\t' read -r PG_NAME PG_CHECK PG_INSTALL < <(jq -r '.tools[0] | [.name, .check, .install] | @tsv' "$PLUGIN_ROOT/prerequisites.json")
+  IFS=$'\t' read -r PG_NAME PG_CHECK PG_INSTALL < <(jq -r '.requires[0] | [.id, .check, (.install | to_entries[0].value)] | @tsv' "$PLUGIN_ROOT/prerequisites.json")
 
   # run_probe <value|__unset__> -> run the row with biome_format_enabled set to <value> (or unset).
   run_probe() {
@@ -541,12 +541,12 @@ if command -v jq >/dev/null 2>&1 && [[ -f "$HOOKS_JSON" && -n "$BEGIN_LINE" && "
   # form behind the biome_format_enabled launcher gate, which is asserted on its
   # own here.
   ALL_HANDLERS="$(jq -c '[.hooks | to_entries[] | .key as $ev | .value[]? | .matcher as $m | .hooks[]? | . + {event: $ev, matcher: ($m // "(none)")}]' "$HOOKS_JSON")"
-  PROBE_COUNT="$(jq -c --arg launcher '${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs' --arg probe '${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh' '[.[] | select(.event == "SessionStart" and .command == "node" and .args == [$launcher, "--run-if-unset-or-true", "BIOME_FORMAT_ENABLED", $probe])] | length' <<<"$ALL_HANDLERS")"
-  HANDLERS="$(jq -c --arg launcher '${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs' --arg probe '${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh' '[.[] | select((.event == "SessionStart" and .command == "node" and .args == [$launcher, "--run-if-unset-or-true", "BIOME_FORMAT_ENABLED", $probe]) | not)]' <<<"$ALL_HANDLERS")"
+  PROBE_COUNT="$(jq -c --arg checker '${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs' --arg root '${CLAUDE_PLUGIN_ROOT}' '[.[] | select(.event == "SessionStart" and .command == "node" and .args == [$checker, "probe", $root, "--run-if-unset-or-true", "BIOME_FORMAT_ENABLED"])] | length' <<<"$ALL_HANDLERS")"
+  HANDLERS="$(jq -c --arg checker '${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs' --arg root '${CLAUDE_PLUGIN_ROOT}' '[.[] | select((.event == "SessionStart" and .command == "node" and .args == [$checker, "probe", $root, "--run-if-unset-or-true", "BIOME_FORMAT_ENABLED"]) | not)]' <<<"$ALL_HANDLERS")"
   if [[ "$PROBE_COUNT" == "1" ]]; then
-    ok "hooks.json: one exec-form SessionStart row runs probe-prerequisite.sh behind --run-if-unset-or-true BIOME_FORMAT_ENABLED"
+    ok "hooks.json: one exec-form SessionStart row runs the prerequisites checker's probe behind --run-if-unset-or-true BIOME_FORMAT_ENABLED"
   else
-    fail "hooks.json: expected one exec-form SessionStart probe-prerequisite.sh row behind --run-if-unset-or-true BIOME_FORMAT_ENABLED, found $PROBE_COUNT"
+    fail "hooks.json: expected one exec-form SessionStart prerequisites probe row behind --run-if-unset-or-true BIOME_FORMAT_ENABLED, found $PROBE_COUNT"
   fi
   HANDLER_COUNT="$(jq 'length' <<<"$HANDLERS")"
   HANDLER_GROUPS="$(jq -r '[.[] | "\(.event):\(.matcher)"] | unique | join(",")' <<<"$HANDLERS")"
diff --git a/plugins/biome-format/hooks/hooks.json b/plugins/biome-format/hooks/hooks.json
index c4015dad1b..47022ac56e 100644
--- a/plugins/biome-format/hooks/hooks.json
+++ b/plugins/biome-format/hooks/hooks.json
@@ -125,10 +125,11 @@
             "type": "command",
             "command": "node",
             "args": [
-              "${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs",
+              "probe",
+              "${CLAUDE_PLUGIN_ROOT}",
               "--run-if-unset-or-true",
-              "BIOME_FORMAT_ENABLED",
-              "${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh"
+              "BIOME_FORMAT_ENABLED"
             ],
             "timeout": 10,
             "statusMessage": "Checking biome..."
diff --git a/plugins/biome-format/hooks/probe-prerequisite.sh b/plugins/biome-format/hooks/probe-prerequisite.sh
deleted file mode 100755
index 41eb7efa95..0000000000
--- a/plugins/biome-format/hooks/probe-prerequisite.sh
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-# SessionStart probe for the binaries this plugin's prerequisites.json declares.
-# Every name, local_bin, check, and install string comes from that manifest.
-# Reports a missing binary once per session; never installs.
-set -uo pipefail
-
-SCRIPT_DIR="$(cd "${BASH_SOURCE[0]%/*}" && pwd)"
-ROOT="${SCRIPT_DIR%/*}"
-MANIFEST="$ROOT/prerequisites.json"
-[[ -f "$MANIFEST" ]] || exit 0
-
-field() {
-  local re="\"$1\"[[:space:]]*:[[:space:]]*\"([^\"]*)\""
-  [[ "$2" =~ $re ]] && printf '%s' "${BASH_REMATCH[1]}"
-}
-
-have() {
-  command -v "$1" >/dev/null 2>&1 && return 0
-  [[ -n "$2" ]] || return 1
-  local dir="$PWD" i
-  for ((i = 0; i < 8; i++)); do
-    [[ -x "$dir/$2" ]] && return 0
-    [[ "$dir" == "/" ]] && break
-    dir="$(dirname "$dir")"
-  done
-  return 1
-}
-
-plugin="$(field name "$(cat "$ROOT/.claude-plugin/plugin.json" 2>/dev/null)")"
-plugin="${plugin:-${ROOT##*/}}"
-tools="$(tr -d '\r\n' <"$MANIFEST")"
-tools="${tools#*\"tools\"}"
-
-INPUT=""
-loaded=0
-while [[ "$tools" == *"{"* ]]; do
-  tools="${tools#*\{}"
-  entry="${tools%%\}*}"
-  tools="${tools#*\}}"
-  name="$(field name "$entry")"
-  [[ -n "$name" ]] || continue
-  local_bin="$(field local_bin "$entry")"
-  have "$name" "$local_bin" && continue
-  if [[ "$loaded" -eq 0 ]]; then
-    # shellcheck source=hook-utils.sh
-    source "$SCRIPT_DIR/hook-utils.sh"
-    INPUT="$(cat || true)"
-    loaded=1
-  fi
-  where="on PATH"
-  [[ -n "$local_bin" ]] && where="on PATH or as $local_bin"
-  if hook::notice_once "$plugin-$name" "$INPUT" prerequisite; then
-    msg="$plugin: $name was not found $where. Hooks that need it will skip until it is installed. Run $(field check "$entry"). It does not install. Install: $(field install "$entry")"
-    notice="${notice:+$notice$'\n'}$msg"
-  fi
-done
-[[ -n "${notice:-}" ]] && hook::emit_skip_notice SessionStart "$notice"
-exit 0
diff --git a/plugins/biome-format/lib/prerequisites.mjs b/plugins/biome-format/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/biome-format/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/biome-format/lib/prerequisites.ps1 b/plugins/biome-format/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/biome-format/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/biome-format/lib/prerequisites.sh b/plugins/biome-format/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/biome-format/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/biome-format/prerequisites.json b/plugins/biome-format/prerequisites.json
index 916110c16b..b3f82e01cc 100644
--- a/plugins/biome-format/prerequisites.json
+++ b/plugins/biome-format/prerequisites.json
@@ -1,20 +1,61 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "biome",
-      "local_bin": "node_modules/.bin/biome",
-      "check": "/biome-format:check",
-      "install": "npm i -D @biomejs/biome"
+      "id": "biome",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:biome-format.sh"
+      ],
+      "detect": {
+        "any": [
+          "biome"
+        ],
+        "local_bin": [
+          "node_modules/.bin/biome"
+        ]
+      },
+      "degrade": "Without biome, the hook cannot format or lint edited JavaScript, TypeScript, JSON and CSS files; edits still go through.",
+      "install": {
+        "npm": "npm i -D @biomejs/biome"
+      },
+      "check": "/biome-format:check"
     },
     {
-      "name": "jq",
-      "check": "/biome-format:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:biome-format.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the biome-format hooks skip their work for the session and say so once.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/biome-format:check"
     },
     {
-      "name": "node",
-      "check": "/biome-format:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the biome-format hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/biome-format:check"
     }
   ]
 }
diff --git a/plugins/biome-format/skills/setup/SKILL.md b/plugins/biome-format/skills/setup/SKILL.md
index b9dcb73ee3..e8952ad4e3 100644
--- a/plugins/biome-format/skills/setup/SKILL.md
+++ b/plugins/biome-format/skills/setup/SKILL.md
@@ -56,7 +56,8 @@ when disabled: the runner must start `node` before `exec-bash.mjs` can evaluate
    resolve is present while a Biome config governs the repo; the hook then emits a visible
    skip notice instead of formatting (README Requirements states how often it repeats). The
    `SessionStart` probe resolves biome separately: read
-   `${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh` for its walk limit and file tests
+   `local_bin` in `${CLAUDE_PLUGIN_ROOT}/prerequisites.json` and `findLocalBin` in
+   `${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs` for its walk limit and file tests
    and compare them with the hook's, instead of assuming they match. The probe does not check
    for a Biome config, so it reports a missing biome in repositories with no `biome.json` too;
    only the per-edit hook's skip notice is opt-in gated. A PASS here means the hook resolves it.
diff --git a/plugins/biome-format/skills/setup/evals/evals.json b/plugins/biome-format/skills/setup/evals/evals.json
index 851e91e336..7dcd84b57a 100644
--- a/plugins/biome-format/skills/setup/evals/evals.json
+++ b/plugins/biome-format/skills/setup/evals/evals.json
@@ -89,7 +89,7 @@
       "expectations": [
         "Runs `command -v node` via Bash and reports FAIL when it is absent, not INFO or a skip-notice case",
         "States the reason: every hook launch goes through node hooks/exec-bash.mjs, so a missing node is a hook launch error rather than a skip notice",
-        "Says the SessionStart probe resolves biome separately from the hook's walk, reads probe-prerequisite.sh for the probe's walk limit and file tests instead of reciting them, and that a PASS on the hook's resolution means the hook resolves it",
+        "Says the SessionStart probe resolves biome separately from the hook's walk, reads prerequisites.json and lib/prerequisites.mjs for the probe's walk limit and file tests instead of reciting them, and that a PASS on the hook's resolution means the hook resolves it",
         "Points at the README Requirements sentence for how often skip notices repeat instead of restating a latch wording of its own"
       ]
     },
diff --git a/plugins/context-budget/.claude-plugin/plugin.json b/plugins/context-budget/.claude-plugin/plugin.json
index 2cea6365b1..1053d7e12b 100644
--- a/plugins/context-budget/.claude-plugin/plugin.json
+++ b/plugins/context-budget/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "context-budget",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Measure a Claude Code session's fixed startup context payload per item, on the consumer's machine at a pinned, version-stamped binary, including per-tool attribution of the built-in tool pools that /context reports only as lump sums, derived live by A/B bare-name-deny differencing with enforced comparability rules (skill-listing signature, one mode, one binary), an SDK-primary exact meter degrading to a version-aware headless /context parser and then to an honest structured error (never a wrong number), and a per-project measure-toggle-remeasure ledger under the plugin data directory recording every lever's real before/after delta. Report-only by default; `fix` applies one approved project-scope trim.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/context-budget/CHANGELOG.md b/plugins/context-budget/CHANGELOG.md
index d43aefb3c0..6e87b4311c 100644
--- a/plugins/context-budget/CHANGELOG.md
+++ b/plugins/context-budget/CHANGELOG.md
@@ -7,6 +7,12 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 Versions 0.6.38 and 0.6.40 were reserved by parallel changes and never published.
 
+## [0.8.1] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+
 ## [0.8.0] - 2026-10-02
 
 ### Added
diff --git a/plugins/context-budget/lib/prerequisites.mjs b/plugins/context-budget/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/context-budget/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/context-budget/lib/prerequisites.ps1 b/plugins/context-budget/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/context-budget/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/context-budget/lib/prerequisites.sh b/plugins/context-budget/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/context-budget/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/context-budget/prerequisites.json b/plugins/context-budget/prerequisites.json
index 4dda719ad1..18316a26eb 100644
--- a/plugins/context-budget/prerequisites.json
+++ b/plugins/context-budget/prerequisites.json
@@ -1,9 +1,22 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "node",
-      "check": "/context-budget:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the context-budget hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/context-budget:check"
     }
   ]
 }
diff --git a/plugins/context-guard/.claude-plugin/plugin.json b/plugins/context-guard/.claude-plugin/plugin.json
index 6696f2bae4..f548e2b0c0 100644
--- a/plugins/context-guard/.claude-plugin/plugin.json
+++ b/plugins/context-guard/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "context-guard",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Per-session context-window observability plus the first shipped consumer: a statusline wrapper tees each session's context_window fields to a per-session snapshot file, a zone resolver classifies usage into smart/acceptable/dumb bands (percentage bands plus window-class token bands, conservative-min combination, zones.json SSOT with shipped defaults), a reader contract fixes how consuming sessions interpret the snapshots, and zone-crossing hooks report once per transition into a worse zone across two channels: the continuation menu to the operator, who owns that choice, and to the model only the zone determination plus the counter-steer that a zone word is not a decay signal (advisory by default; an optional blocking mode gates new mutating work on a fresh dumb-zone snapshot with handoff-writing exempt), with a PostCompact hook persisting an evidence-degraded marker.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/context-guard/CHANGELOG.md b/plugins/context-guard/CHANGELOG.md
index 09e7b4fc27..f8f0360d3e 100644
--- a/plugins/context-guard/CHANGELOG.md
+++ b/plugins/context-guard/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to the `context-guard` plugin.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.2] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+
 ## [0.9.1] - 2026-10-02
 
 ### Changed
diff --git a/plugins/context-guard/lib/prerequisites.mjs b/plugins/context-guard/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/context-guard/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/context-guard/lib/prerequisites.ps1 b/plugins/context-guard/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/context-guard/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/context-guard/lib/prerequisites.sh b/plugins/context-guard/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/context-guard/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/context-guard/prerequisites.json b/plugins/context-guard/prerequisites.json
index b449b30e00..c2c52a8bbb 100644
--- a/plugins/context-guard/prerequisites.json
+++ b/plugins/context-guard/prerequisites.json
@@ -1,14 +1,42 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "node",
-      "check": "/context-guard:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the context-guard hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/context-guard:check"
     },
     {
-      "name": "jq",
-      "check": "/context-guard:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:post-compact-mark.sh",
+        "hook:zone-crossing-inject.sh",
+        "hook:zone-gate.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the context-guard hooks skip their work for the session and say so once.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/context-guard:check"
     }
   ]
 }
diff --git a/plugins/context7/.claude-plugin/plugin.json b/plugins/context7/.claude-plugin/plugin.json
index cab2a05f99..6a1c3f569f 100644
--- a/plugins/context7/.claude-plugin/plugin.json
+++ b/plugins/context7/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "context7",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "description": "Looks up current library documentation, API references, and code examples via Context7 (ctx7 CLI or the Context7 MCP server) with a two-step resolve-then-query workflow: a lookup skill (default lookup plus an upstream drift-check action) and a setup skill for CLI install, auth, and MCP configuration.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/context7/CHANGELOG.md b/plugins/context7/CHANGELOG.md
index 9816e6337b..ba9a8f2293 100644
--- a/plugins/context7/CHANGELOG.md
+++ b/plugins/context7/CHANGELOG.md
@@ -3,6 +3,12 @@
 All notable changes to the `context7` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.6.4] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list, and now declares `node`, which the shared checker needs ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+
 ## [0.6.3] - 2026-10-02
 
 ### Fixed
diff --git a/plugins/context7/lib/prerequisites.mjs b/plugins/context7/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/context7/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/context7/lib/prerequisites.ps1 b/plugins/context7/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/context7/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/context7/lib/prerequisites.sh b/plugins/context7/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/context7/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/context7/prerequisites.json b/plugins/context7/prerequisites.json
index 8440f952bd..05b6afdab9 100644
--- a/plugins/context7/prerequisites.json
+++ b/plugins/context7/prerequisites.json
@@ -1,9 +1,41 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "ctx7",
-      "check": "/context7:check",
-      "install": "npm install -g ctx7@latest"
+      "id": "ctx7",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "skill:lookup",
+        "skill:update"
+      ],
+      "detect": {
+        "any": [
+          "ctx7"
+        ]
+      },
+      "degrade": "Without ctx7, /context7:lookup falls back to the Context7 MCP server when one is configured and otherwise cannot look anything up.",
+      "install": {
+        "npm": "npm install -g ctx7@latest"
+      },
+      "check": "/context7:check"
+    },
+    {
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the ctx7 CLI (an npm package) cannot run and the bundled prerequisites checker only reports that node is missing; the Context7 MCP server still answers when it is configured.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/context7:check"
     }
   ]
 }
diff --git a/plugins/desktop-notification/.claude-plugin/plugin.json b/plugins/desktop-notification/.claude-plugin/plugin.json
index b891b57a40..ca8d71480c 100644
--- a/plugins/desktop-notification/.claude-plugin/plugin.json
+++ b/plugins/desktop-notification/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "desktop-notification",
-  "version": "0.7.6",
+  "version": "0.7.7",
   "description": "Alert you when Claude Code needs input: an audible terminal bell, an OSC 9 terminal notification, and an OS-native toast (macOS/Linux) on permission and idle prompts.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/desktop-notification/CHANGELOG.md b/plugins/desktop-notification/CHANGELOG.md
index bac1a56b11..1cd5ad43d2 100644
--- a/plugins/desktop-notification/CHANGELOG.md
+++ b/plugins/desktop-notification/CHANGELOG.md
@@ -3,6 +3,12 @@
 All notable changes to the `desktop-notification` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.7.7] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+
 ## [0.7.6] - 2026-10-02
 
 ### Changed
diff --git a/plugins/desktop-notification/lib/prerequisites.mjs b/plugins/desktop-notification/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/desktop-notification/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/desktop-notification/lib/prerequisites.ps1 b/plugins/desktop-notification/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/desktop-notification/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/desktop-notification/lib/prerequisites.sh b/plugins/desktop-notification/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/desktop-notification/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/desktop-notification/prerequisites.json b/plugins/desktop-notification/prerequisites.json
index a2266ecf42..477b2807d5 100644
--- a/plugins/desktop-notification/prerequisites.json
+++ b/plugins/desktop-notification/prerequisites.json
@@ -1,14 +1,40 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "node",
-      "check": "/desktop-notification:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the desktop-notification hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/desktop-notification:check"
     },
     {
-      "name": "jq",
-      "check": "/desktop-notification:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:desktop-notification.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the desktop-notification hooks skip their work for the session and say so once.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/desktop-notification:check"
     }
   ]
 }
diff --git a/plugins/disk-hygiene/.claude-plugin/plugin.json b/plugins/disk-hygiene/.claude-plugin/plugin.json
index fd49616963..4b9d702163 100644
--- a/plugins/disk-hygiene/.claude-plugin/plugin.json
+++ b/plugins/disk-hygiene/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "disk-hygiene",
-  "version": "0.42.9",
+  "version": "0.42.10",
   "description": "Context-aware disk hygiene for arbitrary directory trees: inventories orphaned and temporary artifacts, classifies evidence into review tiers, and offers exact-path cleanup only after a fresh safety preview and explicit per-tier approval. The target is read-only by default; OS-managed paths, links and mount points, VCS-tracked content without the complete checkout evidence bundle, changed entries, and live-handle uncertainty fail closed.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/disk-hygiene/CHANGELOG.md b/plugins/disk-hygiene/CHANGELOG.md
index 45d66b254a..1e1d4e230f 100644
--- a/plugins/disk-hygiene/CHANGELOG.md
+++ b/plugins/disk-hygiene/CHANGELOG.md
@@ -3,6 +3,12 @@
 All notable changes to the `disk-hygiene` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.42.10] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+
 ## [0.42.9] - 2026-10-02
 
 ### Changed
diff --git a/plugins/disk-hygiene/lib/prerequisites.mjs b/plugins/disk-hygiene/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/disk-hygiene/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/disk-hygiene/lib/prerequisites.ps1 b/plugins/disk-hygiene/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/disk-hygiene/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/disk-hygiene/lib/prerequisites.sh b/plugins/disk-hygiene/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/disk-hygiene/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/disk-hygiene/prerequisites.json b/plugins/disk-hygiene/prerequisites.json
index 64818ce5f2..baf487d29d 100644
--- a/plugins/disk-hygiene/prerequisites.json
+++ b/plugins/disk-hygiene/prerequisites.json
@@ -1,9 +1,22 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "node",
-      "check": "/disk-hygiene:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the disk-hygiene hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/disk-hygiene:check"
     }
   ]
 }
diff --git a/plugins/eol-normalizer/.claude-plugin/plugin.json b/plugins/eol-normalizer/.claude-plugin/plugin.json
index d83e6fd666..d019ff7d2e 100644
--- a/plugins/eol-normalizer/.claude-plugin/plugin.json
+++ b/plugins/eol-normalizer/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "eol-normalizer",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "description": "Normalize a written file's working-tree line endings to its .gitattributes eol value on edit: symmetric CRLF/LF driven by git check-attr, advisory and never blocking.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/eol-normalizer/CHANGELOG.md b/plugins/eol-normalizer/CHANGELOG.md
index a866a56fc6..7c3921cd27 100644
--- a/plugins/eol-normalizer/CHANGELOG.md
+++ b/plugins/eol-normalizer/CHANGELOG.md
@@ -3,6 +3,12 @@
 All notable changes to the `eol-normalizer` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.8.7] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+
 ## [0.8.6] - 2026-10-02
 
 ### Changed
diff --git a/plugins/eol-normalizer/lib/prerequisites.mjs b/plugins/eol-normalizer/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/eol-normalizer/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/eol-normalizer/lib/prerequisites.ps1 b/plugins/eol-normalizer/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/eol-normalizer/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/eol-normalizer/lib/prerequisites.sh b/plugins/eol-normalizer/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/eol-normalizer/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/eol-normalizer/prerequisites.json b/plugins/eol-normalizer/prerequisites.json
index 537fab63dc..8bdaee93e7 100644
--- a/plugins/eol-normalizer/prerequisites.json
+++ b/plugins/eol-normalizer/prerequisites.json
@@ -1,14 +1,40 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "node",
-      "check": "/eol-normalizer:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the eol-normalizer hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/eol-normalizer:check"
     },
     {
-      "name": "jq",
-      "check": "/eol-normalizer:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:eol-normalizer.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the eol-normalizer hooks skip their work for the session and say so once.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/eol-normalizer:check"
     }
   ]
 }
diff --git a/plugins/go-format/.claude-plugin/plugin.json b/plugins/go-format/.claude-plugin/plugin.json
index 49fa73f9fb..8dc23b7055 100644
--- a/plugins/go-format/.claude-plugin/plugin.json
+++ b/plugins/go-format/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "go-format",
-  "version": "0.4.23",
+  "version": "0.4.24",
   "description": "Auto-fix Go formatting and import management on edit via goimports. Runs unconditionally (no consumer-config gate), skipping generated files.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/go-format/CHANGELOG.md b/plugins/go-format/CHANGELOG.md
index c855278641..4ce85ecc85 100644
--- a/plugins/go-format/CHANGELOG.md
+++ b/plugins/go-format/CHANGELOG.md
@@ -3,6 +3,13 @@
 All notable changes to the `go-format` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.4.24] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list, with a `degrade` line per entry ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+- The `SessionStart` row runs `lib/prerequisites.mjs probe` behind the same `--run-if-unset-or-true` kill-switch gate, and `hooks/probe-prerequisite.sh` is deleted. The notice text, its once-per-session latch shared with the per-edit hook, and its silence when the kill switch is off are unchanged; the hook test suite asserts each.
+
 ## [0.4.23] - 2026-10-02
 
 ### Changed
diff --git a/plugins/go-format/hooks/go-format.test.sh b/plugins/go-format/hooks/go-format.test.sh
index 0e62a008b4..5255343f04 100755
--- a/plugins/go-format/hooks/go-format.test.sh
+++ b/plugins/go-format/hooks/go-format.test.sh
@@ -529,12 +529,12 @@ if command -v jq >/dev/null 2>&1 && [[ -f "$HOOKS_JSON" && -n "$BEGIN_LINE" && "
   # The one row outside this gate is the SessionStart prerequisite probe, exec
   # form, which is asserted on its own here.
   ALL_HANDLERS="$(jq -c '[.hooks | to_entries[] | .key as $ev | .value[]? | .matcher as $m | .hooks[]? | . + {event: $ev, matcher: ($m // "(none)")}]' "$HOOKS_JSON")"
-  PROBE_COUNT="$(jq -c --arg launcher '${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs' --arg probe '${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh' '[.[] | select(.event == "SessionStart" and .command == "node" and .args == [$launcher, "--run-if-unset-or-true", "GO_FORMAT_ENABLED", $probe])] | length' <<<"$ALL_HANDLERS")"
-  HANDLERS="$(jq -c --arg launcher '${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs' --arg probe '${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh' '[.[] | select((.event == "SessionStart" and .command == "node" and .args == [$launcher, "--run-if-unset-or-true", "GO_FORMAT_ENABLED", $probe]) | not)]' <<<"$ALL_HANDLERS")"
+  PROBE_COUNT="$(jq -c --arg checker '${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs' --arg root '${CLAUDE_PLUGIN_ROOT}' '[.[] | select(.event == "SessionStart" and .command == "node" and .args == [$checker, "probe", $root, "--run-if-unset-or-true", "GO_FORMAT_ENABLED"])] | length' <<<"$ALL_HANDLERS")"
+  HANDLERS="$(jq -c --arg checker '${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs' --arg root '${CLAUDE_PLUGIN_ROOT}' '[.[] | select((.event == "SessionStart" and .command == "node" and .args == [$checker, "probe", $root, "--run-if-unset-or-true", "GO_FORMAT_ENABLED"]) | not)]' <<<"$ALL_HANDLERS")"
   if [[ "$PROBE_COUNT" == "1" ]]; then
-    ok "hooks.json: one exec-form SessionStart row runs probe-prerequisite.sh behind the go_format_enabled gate"
+    ok "hooks.json: one exec-form SessionStart row runs the prerequisites checker's probe behind the go_format_enabled gate"
   else
-    fail "hooks.json: expected one exec-form SessionStart probe-prerequisite.sh row gated on GO_FORMAT_ENABLED, found $PROBE_COUNT"
+    fail "hooks.json: expected one exec-form SessionStart prerequisites probe row gated on GO_FORMAT_ENABLED, found $PROBE_COUNT"
   fi
   HANDLER_COUNT="$(jq 'length' <<<"$HANDLERS")"
   HANDLER_GROUPS="$(jq -r '[.[] | "\(.event):\(.matcher)"] | unique | join(",")' <<<"$HANDLERS")"
diff --git a/plugins/go-format/hooks/hooks.json b/plugins/go-format/hooks/hooks.json
index 0bc34cac92..aaad46ee4c 100644
--- a/plugins/go-format/hooks/hooks.json
+++ b/plugins/go-format/hooks/hooks.json
@@ -26,10 +26,11 @@
             "type": "command",
             "command": "node",
             "args": [
-              "${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs",
+              "probe",
+              "${CLAUDE_PLUGIN_ROOT}",
               "--run-if-unset-or-true",
-              "GO_FORMAT_ENABLED",
-              "${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh"
+              "GO_FORMAT_ENABLED"
             ],
             "timeout": 10,
             "statusMessage": "Checking goimports..."
diff --git a/plugins/go-format/hooks/probe-prerequisite.sh b/plugins/go-format/hooks/probe-prerequisite.sh
deleted file mode 100755
index 41eb7efa95..0000000000
--- a/plugins/go-format/hooks/probe-prerequisite.sh
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-# SessionStart probe for the binaries this plugin's prerequisites.json declares.
-# Every name, local_bin, check, and install string comes from that manifest.
-# Reports a missing binary once per session; never installs.
-set -uo pipefail
-
-SCRIPT_DIR="$(cd "${BASH_SOURCE[0]%/*}" && pwd)"
-ROOT="${SCRIPT_DIR%/*}"
-MANIFEST="$ROOT/prerequisites.json"
-[[ -f "$MANIFEST" ]] || exit 0
-
-field() {
-  local re="\"$1\"[[:space:]]*:[[:space:]]*\"([^\"]*)\""
-  [[ "$2" =~ $re ]] && printf '%s' "${BASH_REMATCH[1]}"
-}
-
-have() {
-  command -v "$1" >/dev/null 2>&1 && return 0
-  [[ -n "$2" ]] || return 1
-  local dir="$PWD" i
-  for ((i = 0; i < 8; i++)); do
-    [[ -x "$dir/$2" ]] && return 0
-    [[ "$dir" == "/" ]] && break
-    dir="$(dirname "$dir")"
-  done
-  return 1
-}
-
-plugin="$(field name "$(cat "$ROOT/.claude-plugin/plugin.json" 2>/dev/null)")"
-plugin="${plugin:-${ROOT##*/}}"
-tools="$(tr -d '\r\n' <"$MANIFEST")"
-tools="${tools#*\"tools\"}"
-
-INPUT=""
-loaded=0
-while [[ "$tools" == *"{"* ]]; do
-  tools="${tools#*\{}"
-  entry="${tools%%\}*}"
-  tools="${tools#*\}}"
-  name="$(field name "$entry")"
-  [[ -n "$name" ]] || continue
-  local_bin="$(field local_bin "$entry")"
-  have "$name" "$local_bin" && continue
-  if [[ "$loaded" -eq 0 ]]; then
-    # shellcheck source=hook-utils.sh
-    source "$SCRIPT_DIR/hook-utils.sh"
-    INPUT="$(cat || true)"
-    loaded=1
-  fi
-  where="on PATH"
-  [[ -n "$local_bin" ]] && where="on PATH or as $local_bin"
-  if hook::notice_once "$plugin-$name" "$INPUT" prerequisite; then
-    msg="$plugin: $name was not found $where. Hooks that need it will skip until it is installed. Run $(field check "$entry"). It does not install. Install: $(field install "$entry")"
-    notice="${notice:+$notice$'\n'}$msg"
-  fi
-done
-[[ -n "${notice:-}" ]] && hook::emit_skip_notice SessionStart "$notice"
-exit 0
diff --git a/plugins/go-format/lib/prerequisites.mjs b/plugins/go-format/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/go-format/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/go-format/lib/prerequisites.ps1 b/plugins/go-format/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/go-format/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/go-format/lib/prerequisites.sh b/plugins/go-format/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/go-format/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/go-format/prerequisites.json b/plugins/go-format/prerequisites.json
index 4c3f79a554..133eeb6a68 100644
--- a/plugins/go-format/prerequisites.json
+++ b/plugins/go-format/prerequisites.json
@@ -1,19 +1,58 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "goimports",
-      "check": "/go-format:check",
-      "install": "go install golang.org/x/tools/cmd/goimports@latest"
+      "id": "goimports",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:go-format.sh"
+      ],
+      "detect": {
+        "any": [
+          "goimports"
+        ]
+      },
+      "degrade": "Without goimports, the hook cannot format edited Go files; edits still go through.",
+      "install": {
+        "go": "go install golang.org/x/tools/cmd/goimports@latest"
+      },
+      "check": "/go-format:check"
     },
     {
-      "name": "jq",
-      "check": "/go-format:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:go-format.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the go-format hooks skip their work for the session and say so once.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/go-format:check"
     },
     {
-      "name": "node",
-      "check": "/go-format:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the go-format hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/go-format:check"
     }
   ]
 }
diff --git a/plugins/guardrails/.claude-plugin/plugin.json b/plugins/guardrails/.claude-plugin/plugin.json
index 0bc9ee275e..c4e4f08962 100644
--- a/plugins/guardrails/.claude-plugin/plugin.json
+++ b/plugins/guardrails/.claude-plugin/plugin.json
@@ -171,5 +171,5 @@
       "min": 1
     }
   },
-  "version": "0.46.9"
+  "version": "0.46.10"
 }
diff --git a/plugins/guardrails/CHANGELOG.md b/plugins/guardrails/CHANGELOG.md
index 7a5baa310a..3643acfb38 100644
--- a/plugins/guardrails/CHANGELOG.md
+++ b/plugins/guardrails/CHANGELOG.md
@@ -3,6 +3,12 @@
 All notable changes to the `guardrails` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.46.10] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+
 ## [0.46.9] - 2026-10-02
 
 ### Changed
diff --git a/plugins/guardrails/lib/prerequisites.mjs b/plugins/guardrails/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/guardrails/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/guardrails/lib/prerequisites.ps1 b/plugins/guardrails/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/guardrails/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/guardrails/lib/prerequisites.sh b/plugins/guardrails/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/guardrails/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/guardrails/prerequisites.json b/plugins/guardrails/prerequisites.json
index bfccbcda79..0b4863d14c 100644
--- a/plugins/guardrails/prerequisites.json
+++ b/plugins/guardrails/prerequisites.json
@@ -1,14 +1,41 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "node",
-      "check": "/guardrails:check",
-      "install": "Install Node.js from https://nodejs.org and put node on PATH"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the guardrails hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/guardrails:check"
     },
     {
-      "name": "jq",
-      "check": "/guardrails:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:run-guards.sh",
+        "hook:workflow-resilience-check.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the guards that block irreversible operations deny the call, and the other guards skip their work for the session.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/guardrails:check"
     }
   ]
 }
diff --git a/plugins/harness-ops/.claude-plugin/plugin.json b/plugins/harness-ops/.claude-plugin/plugin.json
index b1ccb21eba..15066ba527 100644
--- a/plugins/harness-ops/.claude-plugin/plugin.json
+++ b/plugins/harness-ops/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "harness-ops",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "description": "Claude Code operations toolkit. Fifteen skills: audit-skill-visibility (audit whether each installed skill is actually VISIBLE to the model, and diagnose why most of a fleet never gets used: a skill is invisible when its description is dropped by Claude Code's skill-listing context budget, which sheds descriptions lowest-score-first so an unused skill loses the keywords that would let it be matched, from skills genuinely not wanted, from skills the run cannot observe at all; computes whether the listing overflows from documented settings, and withholds every cold verdict the data cannot support rather than reporting absence of data as absence of use), inventory (read-only enumeration of the complete invocable surface: every built-in CLI command with aliases and hidden/gated status, every bundled skill, every built-in subagent and tool, every built-in plugin with its components, and every component of every installed plugin across all marketplaces; reads the shipped binary because upstream publishes no built-in command list, and carries an integrity verdict so a drifted build reports counts as floors rather than silently short totals), audit-install-state (read-only audit of the machine-scope ~/.claude installation directory and ~/.claude.json: full inventory split into an authored surface and rolled-up bulk trees, product-managed retention vs genuinely unmanaged state, filename-scheme resolution before any process-liveness check, and deliberate/mid-experiment detection; reports, never deletes), audit-performance (read-only slowness-diagnostic capture run at the moment the machine or a session feels slow: CLI version, retention-sweep health including the unparsable-settings pause, which warns in /status, a timed census walk of the install tree as a sweep-cost proxy, active-session and plugin-fleet counts, a process census, and the fan-out layer, which covers a load-labeled no-op spawn baseline, every hook that will fire bucketed per-tool-call versus per-turn with its invocation shape, the configured statusline, subagent concurrency and spawn-depth ceilings against documented defaults, whether running sessions predate the settings file they are judged by, and orphan attribution by parent liveness rather than age, plus on Windows a kernel-object census (Token objects against uptime, paged pool) that names a host-level leak beneath all four suspects; read against a bundled known-performance-issues reference that also records the causes tested and cleared; separates the four documented suspects of accumulated state, version regression, component bloat, and per-spawn fan-out cost, and routes remediation out; reports, never mutates, and never executes a discovered hook or statusline command), audit-native-overlap (map native Claude Code surfaces, namely built-in CLI commands, bundled skills, plugin-backed built-ins, and session-provided skills, against the current repo's plugin skills and agents, so a custom component never silently duplicates what Claude Code itself ships; bare invocation is a read-only overlap report carrying the extraction's integrity floors and a shared-listing-budget exposure section, verdicts are human-gated in a committed store rendered into a generated registry whose every row carries an observable recheck trigger, and only an explicit apply step bakes presence-gated native references into descriptions and Boundary sections), observability (read locally captured telemetry from the OTEL store, the collector, the per-session hook event log and hook-event JSONL, and ccusage, with trend reports, a per-session report of what fired, what was blocked and the event timeline, and store pruning), known-issues (search known Claude product GitHub bugs, check service health, maintain a persistent tracked-issue registry), changelog (ingest Claude Code changelog entries and turn them into decisions: apply executes those in scope one PR per owner plugin and hands larger ones off as work items, then re-extract the native surface and file its drift as work items), prerequisites (read-only table of external binaries declared by enabled plugins; never installs), check (read-only check that node and jq resolve for the harness-ops hooks; never installs), machine-profile (discover this machine's facts and per-tree identity domains, store them as a re-runnable profile with the observation behind every value, and diff the stored profile against the host now; read-only unless the operator confirms a write, never installs and never reapplies a stored value on its own), plugins (bring a machine's plugin fleet current on demand: marketplace refresh, effective-scope updates including in-repo project/local installs, new-plugin install per policy, scope-divergence detection and explicit convergence), morning-brief (read-only gh-based operator morning view: queue-label counts, merge-ready PRs, parked decisions with their RECOMMENDED lines, and loop-lane telemetry freshness), lanes (start/restart/stop/status loop lanes as named background Claude Code sessions seeded from canonical prompt files, with per-lane model/effort, a repo-pull + marketplace-refresh launch step, and a consume-restarts action, an OS-schedulable reader that relaunches stopped lanes whose telemetry carries a restart_request), and a re-runnable setup action that settles where the known-issues registry, the skill-usage log and the hook log root live, places the root's self-ignoring guard, and detects retired conventions. Plus an opt-in, default-off per-session hook event log (one JSON line per hook event on every event the generated registry marks observable, written to <root>/sessions/<session_id>.jsonl, with SessionEnd retention by session count or age and an optional detached pre-prune command), a family of eight advisory *-audit hooks (API errors, config changes, instruction loads, permission denials, pre-compaction, skill usage, tool failures, and unsurfaced hook failures. The last also warns the user via systemMessage, since a hook that fails to launch enforces nothing and Claude Code surfaces the failure to nobody) that emit the shared hook-telemetry envelope, and a reference sink that routes envelopes under the same root: per session when the envelope carries a session id, else into the shared hook-events.jsonl the observability skill reads.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/harness-ops/CHANGELOG.md b/plugins/harness-ops/CHANGELOG.md
index 278f8874bb..e39856d7a0 100644
--- a/plugins/harness-ops/CHANGELOG.md
+++ b/plugins/harness-ops/CHANGELOG.md
@@ -3,6 +3,13 @@
 All notable changes to the `harness-ops` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [3.2.0] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list in place of the retired `tools` list, with a `degrade` line per entry ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)).
+- **`/harness-ops:prerequisites` runs the Node checker and no longer needs `python3`.** `scripts/check-prerequisites.mjs` keeps the enabled-set resolution (`claude plugin list --json`, then the settings files and `installed_plugins.json`, then a repository scan) and hands the roots to the shared checker's report mode. The table is now `plugin id kind need status check install`, a `present`/`missing`/`outdated`/`unverified`/`agent-check` status replaces present/missing, and exit 1 means a required entry is missing or below its version floor. `scripts/check-prerequisites.sh` is deleted, and its test assertions moved to `scripts/check-prerequisites.test.sh`.
+
 ## [3.1.0] - 2026-10-02
 
 ### Added
diff --git a/plugins/harness-ops/lib/prerequisites.mjs b/plugins/harness-ops/lib/prerequisites.mjs
index a41e958e00..57f65a79b5 100755
--- a/plugins/harness-ops/lib/prerequisites.mjs
+++ b/plugins/harness-ops/lib/prerequisites.mjs
@@ -6,7 +6,7 @@
 //
 //   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
 //   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
-//   prerequisites.mjs probe <plugin-root>
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
 //
 // report  One TSV table across plugins, then a missing/present summary line.
 // check   One line per entry with the remediation, for setup and check skills.
@@ -16,6 +16,9 @@
 // probe   A SessionStart hook. Notifies once per session for each missing entry a
 //         hook needs, on both hook channels. Always exits 0 on a valid manifest,
 //         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
 //
 // Exit 0: every required entry resolves. Exit 1: a required entry is missing or
 // below its version floor. Exit 2: a usage error or a manifest that fails the schema.
@@ -54,6 +57,7 @@ const MIN_RE = /^\d+(\.\d+)*$/;
 const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
 const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
 const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
 const SERVER_RE = /^[A-Za-z0-9._-]+$/;
 const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
 const PROBE_TIMEOUT_MS = 5000;
@@ -386,7 +390,7 @@ function inScope(entry, scope) {
 const USAGE = [
   "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
   "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
-  "       prerequisites.mjs probe <plugin-root>",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
 ].join("\n");
 
 class UsageError extends Error {}
@@ -395,7 +399,7 @@ function parseArgs(argv) {
   const [mode, ...rest] = argv;
   if (!["report", "check", "probe"].includes(mode))
     throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
-  const opts = { mode, roots: [], scope: null, dataDir: null };
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
   for (let i = 0; i < rest.length; i++) {
     const arg = rest[i];
     if (arg === "--plugin-root" && mode === "report") {
@@ -407,6 +411,11 @@ function parseArgs(argv) {
     } else if (arg === "--data-dir" && mode === "check") {
       if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
       opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
     } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
       opts.roots.push(arg);
     } else {
@@ -482,13 +491,15 @@ function cmdCheck(opts, ctx, out) {
   return counts.failed ? 1 : 0;
 }
 
-function cmdReport(opts, ctx, out) {
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
   out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
   let missing = 0;
   let present = 0;
   let requiredMissing = false;
   let invalid = false;
-  for (const root of opts.roots) {
+  for (const root of roots) {
     const { plugin, manifest, errors, absent } = loadManifest(root);
     if (absent) continue;
     if (errors.length) {
@@ -512,7 +523,15 @@ function cmdReport(opts, ctx, out) {
   return requiredMissing ? 1 : 0;
 }
 
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
 function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
   const root = opts.roots[0];
   const { plugin, manifest, errors, absent } = loadManifest(root);
   if (absent) return 0;
diff --git a/plugins/harness-ops/prerequisites.json b/plugins/harness-ops/prerequisites.json
index 2cc21c0956..5636987985 100644
--- a/plugins/harness-ops/prerequisites.json
+++ b/plugins/harness-ops/prerequisites.json
@@ -1,14 +1,44 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "node",
-      "check": "/harness-ops:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the harness-ops hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/harness-ops:check"
     },
     {
-      "name": "jq",
-      "check": "/harness-ops:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:audit-event-emitter.sh",
+        "hook:hook-failure-audit.sh",
+        "hook:session-event-log.sh",
+        "hook:session-retention.sh",
+        "hook:skill-usage-audit.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the harness-ops hooks skip their work for the session and say so once.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/harness-ops:check"
     }
   ]
 }
diff --git a/plugins/harness-ops/skills/prerequisites/SKILL.md b/plugins/harness-ops/skills/prerequisites/SKILL.md
index 2288332e6a..5d0c7f0930 100644
--- a/plugins/harness-ops/skills/prerequisites/SKILL.md
+++ b/plugins/harness-ops/skills/prerequisites/SKILL.md
@@ -10,17 +10,17 @@ metadata:
 
 ## Purpose
 
-Answer "does this host have what the enabled plugins need?" Read `prerequisites.json` in each enabled plugin, probe each declared binary, and print one table. Do not install, download, or run `npx`.
+Answer "does this host have what the enabled plugins need?" Read `prerequisites.json` in each enabled plugin, resolve each declared dependency with the shared Node checker, and print one table. Do not install, download, or run `npx`.
 
-**Claim:** the fleet check lives here, not as a `deps` action on `plugins` and not as a machine-health category. `plugins` brings marketplace versions current and is `disable-model-invocation: true`. This question is read-only and model-invocable. Each plugin that needs a binary declares it in `prerequisites.json` at the plugin root (`name`, optional `local_bin`, `check`, `install`), which this skill and the per-plugin check both read. **Basis:** [skills](https://code.claude.com/docs/en/skills), `disable-model-invocation` ("Set to `true` to prevent Claude from automatically loading this skill. ... Default: `false`."), fetched 2026-09-28. **As of:** 2026-09-28. **Recheck:** a Claude Code release adds a manifest field for external binaries, or `plugins` becomes model-invocable for a read-only action.
+**Claim:** the fleet check lives here, not as a `deps` action on `plugins` and not as a machine-health category. `plugins` brings marketplace versions current and is `disable-model-invocation: true`. This question is read-only and model-invocable. Each plugin that needs an external dependency declares it in `prerequisites.json` at the plugin root, in the schema `docs/conventions/prerequisites/` owns, which this skill and the per-plugin check both read. **Basis:** [skills](https://code.claude.com/docs/en/skills), `disable-model-invocation` ("Set to `true` to prevent Claude from automatically loading this skill. ... Default: `false`."), fetched 2026-09-28. **As of:** 2026-09-28. **Recheck:** a Claude Code release adds a manifest field for external binaries, or `plugins` becomes model-invocable for a read-only action.
 
 ## Run
 
 ```bash
-bash "${CLAUDE_SKILL_DIR}/scripts/check-prerequisites.sh"
+node "${CLAUDE_SKILL_DIR}/scripts/check-prerequisites.mjs"
 ```
 
-The table columns are tool, plugin, present or missing, the check skill, and the documented install command. `missing=N present=M` is the last line. Exit 1 means at least one tool is missing. Exit 2 means no plugin roots could be read.
+The table columns are plugin, id, kind, need, status, the check skill, and the install hints. `missing=N present=M` is the last line. The status is `present`, `missing`, `outdated` (below its version floor), `unverified` (the version could not be read) or `agent-check` (an MCP server only the agent can see). Exit 1 means a required entry is missing or below its floor, and a missing optional entry leaves exit 0. Exit 2 means no plugin roots could be read, the listing was not JSON, or a `prerequisites.json` fails the schema.
 
 With no arguments and a `claude` executable on PATH, the script reads the enabled set and each `installPath` from `claude plugin list --json`. That output lists installs across every project, so it keeps user and managed rows, and project or local rows only when their `projectPath` is the current project (`CLAUDE_PROJECT_DIR`, else the git toplevel); an id resolves by its most specific scope, so user-enabled and project-disabled is disabled. When `claude` is absent or prints nothing, it merges `enabledPlugins` from the settings files instead: the user settings in `~/.claude` (`CLAUDE_CONFIG_DIR` overrides that directory) and the project's `.claude/settings.json` and `settings.local.json`. A file holding any non-Boolean `enabledPlugins` value contributes none of its keys, and the managed scope is not read there. Output that is not a JSON list stops the run with exit 2 instead. Only when none of that state exists does it scan `plugins/*/prerequisites.json` in the current repository; a state with nothing enabled prints an empty table.
 
@@ -34,6 +34,8 @@ With no arguments and a `claude` executable on PATH, the script reads the enable
 
 ## Gotchas
 
+Node is the only runtime this skill needs; the checker is `lib/prerequisites.mjs`, generated from the repository's canonical copy. A plugin whose `prerequisites.json` is still in the retired `tools` shape fails the schema and exits 2.
+
 A missing row is a report, not an install. Do not run `npx`, `npm install`, or `go install` from this skill.
 
 The table's `check` column names the skill for that row. When that skill is model-invocable, run it. When it is a setup skill (a `:setup check` command), it is human-only, so the model cannot invoke it and can only relay the command: tell the user to type it and show the row's install command. Install nothing unless the user asked.
diff --git a/plugins/harness-ops/skills/prerequisites/evals/evals.json b/plugins/harness-ops/skills/prerequisites/evals/evals.json
index e543dc7653..4f40e96e03 100644
--- a/plugins/harness-ops/skills/prerequisites/evals/evals.json
+++ b/plugins/harness-ops/skills/prerequisites/evals/evals.json
@@ -5,12 +5,12 @@
       "id": 1,
       "name": "fleet-table-from-the-script",
       "prompt": "Does this machine have the external tools my enabled plugins need?",
-      "expected_output": "Runs scripts/check-prerequisites.sh and relays its table (tool, plugin, present or missing, check skill, install command) and the closing missing=N present=M line, reading exit 1 as at least one tool missing.",
+      "expected_output": "Runs scripts/check-prerequisites.mjs with node and relays its table (plugin, id, kind, need, status, check skill, install hints) and the closing missing=N present=M line, reading exit 1 as a required entry missing.",
       "files": [],
       "expectations": [
-        "Runs `bash \"${CLAUDE_SKILL_DIR}/scripts/check-prerequisites.sh\"` rather than probing binaries by hand",
-        "Reports the table with the tool, plugin, present/missing status, check skill, and install command columns, plus the missing=N present=M line",
-        "Reads exit 1 as at least one missing tool and exit 2 as no plugin roots readable, not as a script crash",
+        "Runs `node \"${CLAUDE_SKILL_DIR}/scripts/check-prerequisites.mjs\"` rather than probing binaries by hand",
+        "Reports the table with the plugin, id, kind, need, status, check skill, and install columns, plus the missing=N present=M line",
+        "Reads exit 1 as at least one missing required entry and exit 2 as no plugin roots readable or a manifest failing the schema, not as a script crash",
         "Installs nothing"
       ]
     },
diff --git a/plugins/harness-ops/skills/prerequisites/scripts/check-prerequisites.mjs b/plugins/harness-ops/skills/prerequisites/scripts/check-prerequisites.mjs
new file mode 100644
index 0000000000..9d8bf15150
--- /dev/null
+++ b/plugins/harness-ops/skills/prerequisites/scripts/check-prerequisites.mjs
@@ -0,0 +1,219 @@
+#!/usr/bin/env node
+// Read-only fleet prerequisite table. Never installs.
+//
+//   check-prerequisites.mjs --plugin-root <dir> [--plugin-root <dir>...]
+//   check-prerequisites.mjs
+//
+// With no roots and a claude executable on PATH, read the enabled set and each
+// install path from `claude plugin list --json`: user and managed rows, plus
+// project and local rows whose projectPath is the current project
+// ($CLAUDE_PROJECT_DIR, else the git toplevel); the most specific scope wins per
+// id. When claude is absent or prints nothing, merge enabledPlugins from
+// settings.json and settings.local.json in ~/.claude (or $CLAUDE_CONFIG_DIR) and
+// the project's .claude directory instead, skipping a whole file whose
+// enabledPlugins holds a non-Boolean value (Claude Code ignores that file's
+// keys); that fallback does not read the managed scope. Output that is not a
+// JSON list is an error (exit 2), never a fallback. Only when none of that state
+// exists and this repo has plugins/*/prerequisites.json, scan those.
+//
+// The table is lib/prerequisites.mjs report mode:
+//   plugin id kind need status check install
+// then `missing=N present=M`. Exit 0 when no required entry is missing, 1 when
+// one is, 2 on a usage error, an unreadable listing or a manifest that fails
+// the schema.
+import { spawnSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+import { report, which } from "../../../lib/prerequisites.mjs";
+
+const RANK = { user: 0, project: 1, local: 2, managed: 3 };
+const LISTING_TIMEOUT_MS = 30_000;
+const LISTING_MAX_BYTES = 256 * 1024 * 1024;
+
+const USAGE = [
+  "usage: check-prerequisites.mjs --plugin-root <dir> [--plugin-root <dir>...]",
+  "       check-prerequisites.mjs",
+  "exit 0 when no required entry is missing, 1 when one is, 2 on a usage error",
+].join("\n");
+
+class UsageError extends Error {}
+
+const realOr = (p) => {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+};
+const sameDir = (a, b) => Boolean(a && b) && realOr(a) === realOr(b);
+
+function readJson(file) {
+  try {
+    return JSON.parse(readFileSync(file, "utf8"));
+  } catch {
+    return undefined;
+  }
+}
+
+function gitToplevel(cwd) {
+  const r = spawnSync("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8" });
+  return r.status === 0 ? r.stdout.trim() : "";
+}
+
+// The text of `claude plugin list --json`, or "" when claude is absent or fails.
+function claudeListing(env, platform) {
+  const claude = which("claude", env, platform);
+  if (!claude) return "";
+  const r = spawnSync(claude, ["plugin", "list", "--json"], {
+    encoding: "utf8",
+    timeout: LISTING_TIMEOUT_MS,
+    maxBuffer: LISTING_MAX_BYTES,
+    stdio: ["ignore", "pipe", "ignore"],
+    shell: /\.(cmd|bat)$/i.test(claude),
+  });
+  return r.stdout ?? "";
+}
+
+// Install paths of the enabled rows; the most specific scope wins per id.
+export function rootsFromListing(rows, project) {
+  const best = new Map();
+  for (const row of rows) {
+    if (!row || typeof row !== "object" || !row.id || !(row.scope in RANK)) continue;
+    if ((row.scope === "project" || row.scope === "local") && !sameDir(row.projectPath ?? "", project)) continue;
+    const held = best.get(row.id);
+    if (!held || RANK[row.scope] >= RANK[held.scope]) best.set(row.id, row);
+  }
+  return [...best.keys()]
+    .sort()
+    .map((id) => best.get(id))
+    .filter((row) => row.enabled === true && row.installPath)
+    .map((row) => row.installPath);
+}
+
+// { read, roots } from enabledPlugins in the settings files and installed_plugins.json.
+export function rootsFromSettings(config, project) {
+  // User, then project, then local: a later scope's true/false wins.
+  const files = [path.join(config, "settings.json"), path.join(config, "settings.local.json")];
+  if (project) {
+    files.push(path.join(project, ".claude", "settings.json"), path.join(project, ".claude", "settings.local.json"));
+  }
+  const state = {};
+  let read = false;
+  for (const file of files) {
+    if (!existsSync(file) || !statSync(file).isFile()) continue;
+    const doc = readJson(file);
+    if (doc === undefined) continue;
+    read = true;
+    const plugins = doc?.enabledPlugins;
+    if (!plugins || typeof plugins !== "object" || Array.isArray(plugins)) continue;
+    if (!Object.values(plugins).every((v) => typeof v === "boolean")) continue;
+    Object.assign(state, plugins);
+  }
+  const enabled = Object.keys(state).filter((key) => state[key]);
+  const installedFile = path.join(config, "plugins", "installed_plugins.json");
+  const hasInstalled = existsSync(installedFile) && statSync(installedFile).isFile();
+  if (hasInstalled) read = true;
+  const roots = [];
+  if (enabled.length && hasInstalled) {
+    const installed = readJson(installedFile)?.plugins ?? {};
+    for (const key of enabled.sort()) {
+      let records = installed[key] ?? [];
+      if (!Array.isArray(records)) records = [records];
+      let installPath = "";
+      for (const record of records) {
+        if (record && typeof record === "object" && record.installPath) {
+          installPath = record.installPath;
+          if (record.scope === "user") break;
+        }
+      }
+      if (installPath) roots.push(installPath);
+    }
+  }
+  return { read, roots };
+}
+
+function parseArgs(argv) {
+  const roots = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--help" || arg === "-h") return { help: true, roots };
+    if (arg === "--plugin-root") {
+      if (!argv[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      roots.push(argv[++i]);
+    } else {
+      throw new UsageError(`unknown argument ${arg} (see --help)`);
+    }
+  }
+  return { help: false, roots };
+}
+
+// run(argv, ctx, io) -> exit code. ctx and io are injectable.
+export function run(argv, ctx = {}, io = {}) {
+  const env = ctx.env ?? process.env;
+  const platform = ctx.platform ?? process.platform;
+  const cwd = ctx.cwd ?? process.cwd();
+  const out = io.stdout ?? ((s) => console.log(s));
+  const err = io.stderr ?? ((s) => console.error(s));
+  let args;
+  try {
+    args = parseArgs(argv);
+  } catch (e) {
+    if (!(e instanceof UsageError)) throw e;
+    err(`check-prerequisites.mjs: ${e.message}`);
+    return 2;
+  }
+  if (args.help) {
+    out(USAGE);
+    return 0;
+  }
+  let roots = args.roots;
+  let stateRead = false;
+  if (roots.length === 0) {
+    const config = env.CLAUDE_CONFIG_DIR || path.join(env.HOME || homedir(), ".claude");
+    const project = env.CLAUDE_PROJECT_DIR || gitToplevel(cwd);
+    const listing = claudeListing(env, platform);
+    if (listing.trim()) {
+      let rows;
+      let detail = "not a JSON list";
+      try {
+        rows = JSON.parse(listing);
+      } catch (e) {
+        detail = e.message;
+      }
+      if (!Array.isArray(rows)) {
+        err(`check-prerequisites.mjs: claude plugin list --json: ${detail}`);
+        return 2;
+      }
+      stateRead = true;
+      roots = rootsFromListing(rows, project);
+    } else {
+      const found = rootsFromSettings(config, project);
+      stateRead = found.read;
+      roots = found.roots;
+    }
+    // The repository scan stands in only when no settings or install state exists;
+    // a read state with nothing enabled is an empty fleet, not a reason to scan.
+    if (roots.length === 0 && !stateRead) {
+      const repo = gitToplevel(cwd);
+      const pluginsDir = path.join(repo, "plugins");
+      if (repo && existsSync(pluginsDir)) {
+        roots = readdirSync(pluginsDir)
+          .sort()
+          .map((name) => path.join(pluginsDir, name))
+          .filter((dir) => existsSync(path.join(dir, "prerequisites.json")));
+      }
+    }
+    if (roots.length === 0 && !stateRead) {
+      err("check-prerequisites.mjs: no plugin roots to read");
+      return 2;
+    }
+  }
+  return report(roots, { env, platform, cwd }, { stdout: out, stderr: err });
+}
+
+if (process.argv[1] && realOr(process.argv[1]) === realOr(fileURLToPath(import.meta.url))) {
+  process.exitCode = run(process.argv.slice(2));
+}
diff --git a/plugins/harness-ops/skills/prerequisites/scripts/check-prerequisites.sh b/plugins/harness-ops/skills/prerequisites/scripts/check-prerequisites.sh
deleted file mode 100755
index f8371a7dec..0000000000
--- a/plugins/harness-ops/skills/prerequisites/scripts/check-prerequisites.sh
+++ /dev/null
@@ -1,238 +0,0 @@
-#!/usr/bin/env bash
-# Read-only fleet prerequisite table. Never installs.
-#
-#   check-prerequisites.sh --plugin-root <dir> [--plugin-root <dir>...]
-#   check-prerequisites.sh
-#
-# With no roots and a claude executable on PATH, read the enabled set and each
-# install path from `claude plugin list --json`: user and managed rows, plus
-# project and local rows whose projectPath is the current project
-# ($CLAUDE_PROJECT_DIR, else the git toplevel); the most specific scope wins per
-# id. When claude is absent or prints nothing, merge enabledPlugins
-# from settings.json and settings.local.json in ~/.claude (or $CLAUDE_CONFIG_DIR)
-# and the project's .claude directory instead, skipping a whole file whose
-# enabledPlugins holds a non-Boolean value (Claude Code ignores that file's
-# keys); that fallback does not read the managed scope. Output that is not a
-# JSON list is an error (exit 2), never a fallback. Only when none of that
-# state exists and this repo has plugins/*/prerequisites.json, scan those.
-#
-# Prints one TSV header and one row per declared tool:
-#   tool plugin status check install
-# Then `missing=N present=M`. Exit 0 when every tool is present, 1 when any
-# is missing, 2 on a usage error.
-set -uo pipefail
-
-ROOTS=()
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-  --plugin-root)
-    [[ $# -ge 2 ]] || { echo "check-prerequisites.sh: --plugin-root needs a directory" >&2; exit 2; }
-    ROOTS+=("$2")
-    shift 2
-    ;;
-  --help | -h)
-    awk 'NR == 1 { next } /^#/ { sub(/^# ?/, ""); print; next } { exit }' "${BASH_SOURCE[0]}"
-    exit 0
-    ;;
-  *)
-    echo "check-prerequisites.sh: unknown argument $1 (see --help)" >&2
-    exit 2
-    ;;
-  esac
-done
-
-command -v python3 >/dev/null 2>&1 || {
-  echo "check-prerequisites.sh: python3 is required to read the plugin listing and declarations" >&2
-  exit 2
-}
-
-STATE_READ=0
-if [[ ${#ROOTS[@]} -eq 0 ]]; then
-  config="${CLAUDE_CONFIG_DIR:-${HOME:-}/.claude}"
-  project="${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || true)}"
-  project="${project%$'\r'}"
-  listing_file="$(mktemp)"
-  found_file="$(mktemp)"
-  trap 'rm -f "$listing_file" "$found_file"' EXIT
-  if command -v claude >/dev/null 2>&1; then
-    if command -v timeout >/dev/null 2>&1; then
-      timeout 30 claude plugin list --json >"$listing_file" 2>/dev/null || true
-    else
-      claude plugin list --json >"$listing_file" 2>/dev/null || true
-    fi
-  fi
-  if ! python3 - "$config" "$project" "$listing_file" >"$found_file" <<'PY'
-import json, os, sys
-config, project, listing_path = sys.argv[1], sys.argv[2], sys.argv[3]
-RANK = {"user": 0, "project": 1, "local": 2, "managed": 3}
-
-def same_dir(a, b):
-    return bool(a and b) and os.path.realpath(a) == os.path.realpath(b)
-
-def from_cli(rows):
-    best = {}
-    for row in rows:
-        if not isinstance(row, dict) or not row.get("id"):
-            continue
-        scope = row.get("scope")
-        if scope not in RANK:
-            continue
-        if scope in ("project", "local") and not same_dir(row.get("projectPath") or "", project):
-            continue
-        key = row["id"]
-        if key not in best or RANK[scope] >= RANK[best[key]["scope"]]:
-            best[key] = row
-    return [row["installPath"] for _, row in sorted(best.items())
-            if row.get("enabled") is True and row.get("installPath")]
-
-def from_settings():
-    # User, then project, then local: a later scope's true/false wins.
-    scopes = [os.path.join(config, "settings.json"), os.path.join(config, "settings.local.json")]
-    if project:
-        scopes += [os.path.join(project, ".claude", "settings.json"),
-                   os.path.join(project, ".claude", "settings.local.json")]
-    state = {}
-    read = False
-    for path in scopes:
-        if not os.path.isfile(path):
-            continue
-        try:
-            doc = json.load(open(path, encoding="utf-8"))
-        except (OSError, json.JSONDecodeError):
-            continue
-        read = True
-        plugins = doc.get("enabledPlugins") if isinstance(doc, dict) else None
-        if not isinstance(plugins, dict) or not all(isinstance(v, bool) for v in plugins.values()):
-            continue
-        state.update(plugins)
-    enabled = {key for key, value in state.items() if value}
-    installed = os.path.join(config, "plugins", "installed_plugins.json")
-    if os.path.isfile(installed):
-        read = True
-    found = []
-    if enabled and os.path.isfile(installed):
-        try:
-            doc = json.load(open(installed, encoding="utf-8"))
-        except (OSError, json.JSONDecodeError):
-            doc = {}
-        plugins = doc.get("plugins") or {}
-        for key in sorted(enabled):
-            records = plugins.get(key) or []
-            if isinstance(records, dict):
-                records = [records]
-            path = ""
-            for record in records:
-                if isinstance(record, dict) and record.get("installPath"):
-                    path = record["installPath"]
-                    if record.get("scope") == "user":
-                        break
-            if path:
-                found.append(path)
-    return read, found
-
-with open(listing_path, encoding="utf-8") as handle:
-    text = handle.read()
-if text.strip():
-    try:
-        rows = json.loads(text)
-        detail = "not a JSON list"
-    except json.JSONDecodeError as exc:
-        rows, detail = None, exc
-    if not isinstance(rows, list):
-        print(f"check-prerequisites.sh: claude plugin list --json: {detail}", file=sys.stderr)
-        sys.exit(2)
-    read, found = True, from_cli(rows)
-else:
-    read, found = from_settings()
-if read:
-    print("STATE_READ")
-if found:
-    print("\n".join(found))
-PY
-  then
-    echo "check-prerequisites.sh: could not read the plugin listing" >&2
-    exit 2
-  fi
-  mapfile -t found <"$found_file"
-  for line in "${found[@]}"; do
-    if [[ "$line" == "STATE_READ" ]]; then STATE_READ=1; else ROOTS+=("$line"); fi
-  done
-fi
-
-# The repository scan stands in only when no settings or install state exists;
-# a read state with nothing enabled is an empty fleet, not a reason to scan.
-if [[ ${#ROOTS[@]} -eq 0 && "$STATE_READ" -eq 0 ]]; then
-  repo="$(git rev-parse --show-toplevel 2>/dev/null || true)"
-  repo="${repo%$'\r'}"
-  if [[ -n "$repo" && -d "$repo/plugins" ]]; then
-    while IFS= read -r decl; do
-      ROOTS+=("$(dirname "$decl")")
-    done < <(find "$repo/plugins" -mindepth 2 -maxdepth 2 -name prerequisites.json | sort)
-  fi
-fi
-
-if [[ ${#ROOTS[@]} -eq 0 && "$STATE_READ" -eq 0 ]]; then
-  echo "check-prerequisites.sh: no plugin roots to read" >&2
-  exit 2
-fi
-
-export PREREQ_ROOTS
-PREREQ_ROOTS="$(printf '%s\n' "${ROOTS[@]}")"
-python3 - <<'PY'
-import json, os, shutil, sys
-
-roots = [line for line in os.environ["PREREQ_ROOTS"].splitlines() if line]
-rows = []
-
-def present(name, local_bin):
-    if shutil.which(name):
-        return True
-    if not local_bin:
-        return False
-    directory = os.getcwd()
-    for _ in range(8):
-        candidate = os.path.join(directory, local_bin)
-        if os.path.isfile(candidate) and os.access(candidate, os.X_OK):
-            return True
-        parent = os.path.dirname(directory)
-        if parent == directory:
-            break
-        directory = parent
-    return False
-
-for root in roots:
-    manifest = os.path.join(root, ".claude-plugin", "plugin.json")
-    plugin = os.path.basename(root.rstrip("/"))
-    if os.path.isfile(manifest):
-        try:
-            plugin = json.load(open(manifest, encoding="utf-8")).get("name") or plugin
-        except (OSError, json.JSONDecodeError):
-            pass
-    decl_path = os.path.join(root, "prerequisites.json")
-    if not os.path.isfile(decl_path):
-        continue
-    try:
-        declared = json.load(open(decl_path, encoding="utf-8"))
-    except (OSError, json.JSONDecodeError) as exc:
-        print(f"check-prerequisites.sh: {decl_path}: {exc}", file=sys.stderr)
-        sys.exit(2)
-    for tool in declared.get("tools") or []:
-        name = str(tool.get("name") or "")
-        if not name:
-            continue
-        status = "present" if present(name, tool.get("local_bin") or "") else "missing"
-        rows.append((name, plugin, status, tool.get("check") or "", tool.get("install") or ""))
-
-def cell(value):
-    return str(value).replace("\t", " ").replace("\n", " ")
-
-print("tool\tplugin\tstatus\tcheck\tinstall")
-missing = 0
-for row in rows:
-    if row[2] == "missing":
-        missing += 1
-    print("\t".join(cell(part) for part in row))
-present_count = len(rows) - missing
-print(f"missing={missing} present={present_count}")
-sys.exit(1 if missing else 0)
-PY
diff --git a/plugins/harness-ops/skills/prerequisites/scripts/check-prerequisites.test.sh b/plugins/harness-ops/skills/prerequisites/scripts/check-prerequisites.test.sh
index e9a126d655..7ac2accedf 100755
--- a/plugins/harness-ops/skills/prerequisites/scripts/check-prerequisites.test.sh
+++ b/plugins/harness-ops/skills/prerequisites/scripts/check-prerequisites.test.sh
@@ -1,10 +1,14 @@
 #!/usr/bin/env bash
-# The fleet table reports a declared tool present or missing and never installs.
+# The fleet table reports a declared dependency present or missing and never installs.
 set -uo pipefail
 unset GIT_DIR GIT_WORK_TREE GIT_CONFIG
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-SCRIPT="$SCRIPT_DIR/check-prerequisites.sh"
+SCRIPT="$SCRIPT_DIR/check-prerequisites.mjs"
+NODE="$(command -v node)" || {
+  echo "FAIL: node is not on PATH" >&2
+  exit 1
+}
 FAILED=0
 CASE_NUM=0
 pass() { CASE_NUM=$((CASE_NUM + 1)); printf 'PASS: %s\n' "$1"; }
@@ -12,29 +16,39 @@ fail() { CASE_NUM=$((CASE_NUM + 1)); FAILED=$((FAILED + 1)); printf 'FAIL: %s\n
 expect_eq() { if [[ "$3" == "$2" ]]; then pass "$1"; else fail "$1" "$2" "$3"; fi; }
 expect_has() { if [[ "$3" == *"$2"* ]]; then pass "$1"; else fail "$1" "$2" "$3"; fi; }
 
+# entry <id> <need> [local_bin]: one schema-valid cli entry for plugin <id>'s check skill.
+entry() {
+  local lb=""
+  [[ -n "${3:-}" ]] && lb=", \"local_bin\": [\"$3\"]"
+  printf '{"id": "%s", "kind": "cli", "need": "%s", "for": ["plugin"], "detect": {"any": ["%s"]%s}, "degrade": "Without %s, the plugin does less.", "install": {"docs": "install %s"}, "check": "/plugin-x:check"}' \
+    "$1" "$2" "$1" "$lb" "$1" "$1"
+}
+# manifest <dir> <plugin-name> <entry>...: write prerequisites.json and plugin.json.
+manifest() {
+  local dir="$1" name="$2" joined="" e
+  shift 2
+  for e in "$@"; do joined="${joined:+$joined,}$e"; done
+  mkdir -p "$dir/.claude-plugin"
+  printf '{"name":"%s"}\n' "$name" >"$dir/.claude-plugin/plugin.json"
+  printf '{"requires":[%s]}\n' "$joined" >"$dir/prerequisites.json"
+}
+
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
-mkdir -p "$WORK/plugin-a/.claude-plugin" "$WORK/bin" "$WORK/node_modules/.bin"
-printf '%s\n' '{"name":"plugin-a"}' >"$WORK/plugin-a/.claude-plugin/plugin.json"
-cat >"$WORK/plugin-a/prerequisites.json" <<'EOF'
-{
-  "tools": [
-    {"name": "present-tool", "check": "/plugin-a:check", "install": "install present-tool"},
-    {"name": "missing-tool", "local_bin": "node_modules/.bin/missing-tool", "check": "/plugin-a:check", "install": "install missing-tool"}
-  ]
-}
-EOF
+mkdir -p "$WORK/bin" "$WORK/node_modules/.bin"
+manifest "$WORK/plugin-a" plugin-a "$(entry present-tool required)" "$(entry missing-tool required node_modules/.bin/missing-tool)"
 cat >"$WORK/bin/present-tool" <<'EOF'
 #!/bin/sh
 exit 0
 EOF
 chmod +x "$WORK/bin/present-tool"
 
-out="$(cd "$WORK" && PATH="$WORK/bin:$PATH" bash "$SCRIPT" --plugin-root "$WORK/plugin-a")"
+out="$(cd "$WORK" && PATH="$WORK/bin:$PATH" "$NODE" "$SCRIPT" --plugin-root "$WORK/plugin-a")"
 rc=$?
-expect_eq "exit 1 when a declared tool is missing" 1 "$rc"
-expect_has "present tool row" $'present-tool\tplugin-a\tpresent\t/plugin-a:check\tinstall present-tool' "$out"
-expect_has "missing tool row" $'missing-tool\tplugin-a\tmissing' "$out"
+expect_eq "exit 1 when a required entry is missing" 1 "$rc"
+expect_has "table header" $'plugin\tid\tkind\tneed\tstatus\tcheck\tinstall' "$out"
+expect_has "present entry row" $'plugin-a\tpresent-tool\tcli\trequired\tpresent\t/plugin-x:check\tdocs: install present-tool' "$out"
+expect_has "missing entry row" $'plugin-a\tmissing-tool\tcli\trequired\tmissing' "$out"
 expect_has "summary counts" 'missing=1 present=1' "$out"
 
 cat >"$WORK/node_modules/.bin/missing-tool" <<'EOF'
@@ -42,53 +56,74 @@ cat >"$WORK/node_modules/.bin/missing-tool" <<'EOF'
 exit 0
 EOF
 chmod +x "$WORK/node_modules/.bin/missing-tool"
-out="$(cd "$WORK" && PATH="$WORK/bin:$PATH" bash "$SCRIPT" --plugin-root "$WORK/plugin-a")"
+out="$(cd "$WORK" && PATH="$WORK/bin:$PATH" "$NODE" "$SCRIPT" --plugin-root "$WORK/plugin-a")"
 rc=$?
 expect_eq "exit 0 when the local bin is executable" 0 "$rc"
 expect_has "local bin counts as present" 'missing=0 present=2' "$out"
 
+manifest "$WORK/plugin-o" plugin-o "$(entry absent-optional optional)"
+out="$("$NODE" "$SCRIPT" --plugin-root "$WORK/plugin-o")"
+rc=$?
+expect_eq "exit 0 when only an optional entry is missing" 0 "$rc"
+expect_has "an optional entry is still listed as missing" $'plugin-o\tabsent-optional\tcli\toptional\tmissing' "$out"
+
+mkdir -p "$WORK/plugin-bad/.claude-plugin"
+printf '{"tools":[{"name":"x"}]}\n' >"$WORK/plugin-bad/prerequisites.json"
+out="$("$NODE" "$SCRIPT" --plugin-root "$WORK/plugin-bad" 2>&1)"
+rc=$?
+expect_eq "a manifest in the retired shape exits 2" 2 "$rc"
+expect_has "the schema failure names the plugin" 'plugin-bad: prerequisites.json fails the schema' "$out"
+
 # Discovery with no roots. A plugin enabled only in the project's
 # settings.local.json is read; a read state with nothing enabled is an empty
 # fleet and never falls back to scanning a repository.
 CONFIG="$WORK/config"
 PROJECT="$WORK/project"
-mkdir -p "$CONFIG/plugins" "$PROJECT/.claude" "$WORK/plugin-b/.claude-plugin"
-printf '%s\n' '{"name":"plugin-b"}' >"$WORK/plugin-b/.claude-plugin/plugin.json"
-printf '%s\n' '{"tools":[{"name":"absent-b","check":"/plugin-b:check","install":"install absent-b"}]}' >"$WORK/plugin-b/prerequisites.json"
+mkdir -p "$CONFIG/plugins" "$PROJECT/.claude"
+manifest "$WORK/plugin-b" plugin-b "$(entry absent-b required)"
 printf '{"plugins":{"plugin-b@m":[{"scope":"local","installPath":"%s"}]}}\n' "$WORK/plugin-b" >"$CONFIG/plugins/installed_plugins.json"
 printf '%s\n' '{"enabledPlugins":{"plugin-b@m":false}}' >"$CONFIG/settings.json"
 printf '%s\n' '{"enabledPlugins":{"plugin-b@m":true}}' >"$PROJECT/.claude/settings.local.json"
-# NOCLAUDE_PATH holds only the tools the script needs, so no claude resolves and
-# the settings fallback runs; STUB_PATH puts a stub claude ahead of them.
+# NOCLAUDE_PATH holds only git, so no claude resolves and the settings fallback
+# runs; STUB_PATH puts a stub claude ahead of it.
 mkdir -p "$WORK/tools" "$WORK/stub"
-for tool in bash git python3 dirname find sort timeout mktemp rm; do
-  ln -s "$(command -v "$tool")" "$WORK/tools/$tool"
-done
+ln -s "$(command -v git)" "$WORK/tools/git"
 NOCLAUDE_PATH="$WORK/tools"
 STUB_PATH="$WORK/stub:$WORK/tools"
-export NOCLAUDE_PATH
 
-out="$(cd "$PROJECT" && PATH="$NOCLAUDE_PATH" CLAUDE_CONFIG_DIR="$CONFIG" CLAUDE_PROJECT_DIR="$PROJECT" bash "$SCRIPT")"
+out="$(cd "$PROJECT" && PATH="$NOCLAUDE_PATH" CLAUDE_CONFIG_DIR="$CONFIG" CLAUDE_PROJECT_DIR="$PROJECT" "$NODE" "$SCRIPT")"
 rc=$?
 expect_eq "project-local enablement is read" 1 "$rc"
-expect_has "project-local plugin row" $'absent-b\tplugin-b\tmissing' "$out"
+expect_has "project-local plugin row" $'plugin-b\tabsent-b\tcli\trequired\tmissing' "$out"
 
 rm "$PROJECT/.claude/settings.local.json"
-mkdir -p "$WORK/repo/plugins/plugin-c"
-printf '%s\n' '{"tools":[{"name":"absent-c","check":"/plugin-c:check","install":"x"}]}' >"$WORK/repo/plugins/plugin-c/prerequisites.json"
+manifest "$WORK/repo/plugins/plugin-c" plugin-c "$(entry absent-c required)"
 git -C "$WORK/repo" init -q
-out="$(cd "$WORK/repo" && PATH="$NOCLAUDE_PATH" CLAUDE_CONFIG_DIR="$CONFIG" CLAUDE_PROJECT_DIR="$PROJECT" bash "$SCRIPT")"
+out="$(cd "$WORK/repo" && PATH="$NOCLAUDE_PATH" CLAUDE_CONFIG_DIR="$CONFIG" CLAUDE_PROJECT_DIR="$PROJECT" "$NODE" "$SCRIPT")"
 rc=$?
 expect_eq "empty enabled fleet exits 0" 0 "$rc"
 expect_has "empty enabled fleet prints an empty table" 'missing=0 present=0' "$out"
 
+# With no settings or install state at all, the repository's plugins/ are scanned.
+mkdir -p "$WORK/emptyconfig"
+out="$(cd "$WORK/repo" && PATH="$NOCLAUDE_PATH" CLAUDE_CONFIG_DIR="$WORK/emptyconfig" CLAUDE_PROJECT_DIR="" "$NODE" "$SCRIPT")"
+rc=$?
+expect_eq "no state falls back to the repository scan" 1 "$rc"
+expect_has "repository scan row" $'plugin-c\tabsent-c\tcli\trequired\tmissing' "$out"
+
+mkdir -p "$WORK/notarepo"
+out="$(cd "$WORK/notarepo" && PATH="$NOCLAUDE_PATH" CLAUDE_CONFIG_DIR="$WORK/emptyconfig" CLAUDE_PROJECT_DIR="" "$NODE" "$SCRIPT" 2>&1)"
+rc=$?
+expect_eq "no state and no repository exits 2" 2 "$rc"
+expect_has "no state and no repository says so" 'no plugin roots to read' "$out"
+
 # A settings file holding any non-Boolean enabledPlugins value contributes none
 # of its keys, as Claude Code reads it: the string "false" never enables.
 printf '%s\n' '{"enabledPlugins":{"plugin-b@m":"false"}}' >"$PROJECT/.claude/settings.local.json"
-out="$(cd "$PROJECT" && PATH="$NOCLAUDE_PATH" CLAUDE_CONFIG_DIR="$CONFIG" CLAUDE_PROJECT_DIR="$PROJECT" bash "$SCRIPT")"
+out="$(cd "$PROJECT" && PATH="$NOCLAUDE_PATH" CLAUDE_CONFIG_DIR="$CONFIG" CLAUDE_PROJECT_DIR="$PROJECT" "$NODE" "$SCRIPT")"
 expect_has "fallback ignores a non-Boolean value" 'missing=0 present=0' "$out"
 printf '%s\n' '{"enabledPlugins":{"plugin-b@m":true,"other@m":"yes"}}' >"$PROJECT/.claude/settings.local.json"
-out="$(cd "$PROJECT" && PATH="$NOCLAUDE_PATH" CLAUDE_CONFIG_DIR="$CONFIG" CLAUDE_PROJECT_DIR="$PROJECT" bash "$SCRIPT")"
+out="$(cd "$PROJECT" && PATH="$NOCLAUDE_PATH" CLAUDE_CONFIG_DIR="$CONFIG" CLAUDE_PROJECT_DIR="$PROJECT" "$NODE" "$SCRIPT")"
 expect_has "fallback skips the whole file when any value is non-Boolean" 'missing=0 present=0' "$out"
 rm "$PROJECT/.claude/settings.local.json"
 
@@ -100,23 +135,21 @@ cat >"$WORK/stub/claude" <<'EOF'
 printf '%s' "$STUB_LIST"
 EOF
 chmod +x "$WORK/stub/claude"
-mkdir -p "$WORK/plugin-d/.claude-plugin" "$WORK/plugin-e/.claude-plugin" "$WORK/plugin-f/.claude-plugin"
 for n in d e f; do
-  printf '{"name":"plugin-%s"}\n' "$n" >"$WORK/plugin-$n/.claude-plugin/plugin.json"
-  printf '{"tools":[{"name":"absent-%s","check":"/plugin-%s:check","install":"x"}]}\n' "$n" "$n" >"$WORK/plugin-$n/prerequisites.json"
+  manifest "$WORK/plugin-$n" "plugin-$n" "$(entry "absent-$n" required)"
 done
-run_stub() { (cd "$PROJECT" && PATH="$STUB_PATH" STUB_LIST="$1" CLAUDE_CONFIG_DIR="$CONFIG" CLAUDE_PROJECT_DIR="$PROJECT" bash "$SCRIPT"); }
+run_stub() { (cd "$PROJECT" && PATH="$STUB_PATH" STUB_LIST="$1" CLAUDE_CONFIG_DIR="$CONFIG" CLAUDE_PROJECT_DIR="$PROJECT" "$NODE" "$SCRIPT"); }
 
 out="$(run_stub "[{\"id\":\"d@m\",\"scope\":\"user\",\"enabled\":true,\"installPath\":\"$WORK/plugin-d\"},
  {\"id\":\"e@m\",\"scope\":\"user\",\"enabled\":false,\"installPath\":\"$WORK/plugin-e\"}]")"
-expect_has "cli: enabled user row is read" $'absent-d\tplugin-d\tmissing' "$out"
+expect_has "cli: enabled user row is read" $'plugin-d\tabsent-d\tcli\trequired\tmissing' "$out"
 expect_has "cli: disabled user row is not read" 'missing=1 present=0' "$out"
 
 out="$(run_stub "[{\"id\":\"d@m\",\"scope\":\"project\",\"enabled\":true,\"installPath\":\"$WORK/plugin-d\",\"projectPath\":\"$PROJECT\"},
  {\"id\":\"e@m\",\"scope\":\"project\",\"enabled\":true,\"installPath\":\"$WORK/plugin-e\",\"projectPath\":\"$WORK/elsewhere\"},
  {\"id\":\"f@m\",\"scope\":\"local\",\"enabled\":true,\"installPath\":\"$WORK/plugin-f\",\"projectPath\":\"$PROJECT\"}]")"
-expect_has "cli: project row for this project is read" $'absent-d\tplugin-d\tmissing' "$out"
-expect_has "cli: local row for this project is read" $'absent-f\tplugin-f\tmissing' "$out"
+expect_has "cli: project row for this project is read" $'plugin-d\tabsent-d\tcli\trequired\tmissing' "$out"
+expect_has "cli: local row for this project is read" $'plugin-f\tabsent-f\tcli\trequired\tmissing' "$out"
 expect_has "cli: a project row with a foreign projectPath is ignored" 'missing=2 present=0' "$out"
 
 out="$(run_stub "[{\"id\":\"d@m\",\"scope\":\"user\",\"enabled\":true,\"installPath\":\"$WORK/plugin-d\"},
@@ -139,10 +172,9 @@ expect_eq "unparsable claude output exits 2" 2 "$rc"
 expect_has "unparsable claude output names the listing" 'claude plugin list --json' "$out"
 rm "$PROJECT/.claude/settings.local.json"
 
-# A listing past the 131072-byte single-argument limit must be read in full,
-# and a listing that is not JSON must stop the run with no table. The stub
-# reads its output from a file, since an environment variable that large would
-# hit the same limit.
+# A listing larger than 200000 bytes must be read in full, and a listing that
+# is not JSON must stop the run with no table. The stub reads its output from a
+# file, since an environment variable that large would hit the argument limit.
 mkdir -p "$WORK/stubfile"
 cat >"$WORK/stubfile/claude" <<'EOF'
 #!/bin/sh
@@ -151,22 +183,22 @@ cat "$STUB_FILE"
 EOF
 chmod +x "$WORK/stubfile/claude"
 ln -sf "$(command -v cat)" "$WORK/tools/cat"
-run_stub_file() { (cd "$PROJECT" && PATH="$WORK/stubfile:$WORK/tools" STUB_FILE="$1" CLAUDE_CONFIG_DIR="$CONFIG" CLAUDE_PROJECT_DIR="$PROJECT" bash "$SCRIPT" 2>"$WORK/stderr"); }
-
-python3 - "$WORK/big.json" "$WORK/plugin-d" <<'PY'
-import json, sys
-rows = [{"id": "pad%d@m" % i, "scope": "user", "enabled": False, "installPath": "/nonexistent/%d" % i, "note": "x" * 100} for i in range(2500)]
-rows.append({"id": "d@m", "scope": "user", "enabled": True, "installPath": sys.argv[2]})
-json.dump(rows, open(sys.argv[1], "w"))
-PY
+run_stub_file() { (cd "$PROJECT" && PATH="$WORK/stubfile:$WORK/tools" STUB_FILE="$1" CLAUDE_CONFIG_DIR="$CONFIG" CLAUDE_PROJECT_DIR="$PROJECT" "$NODE" "$SCRIPT" 2>"$WORK/stderr"); }
+
+# shellcheck disable=SC2016 # the JavaScript is single-quoted on purpose
+"$NODE" -e '
+const rows = Array.from({ length: 2500 }, (_, i) => ({ id: `pad${i}@m`, scope: "user", enabled: false, installPath: `/nonexistent/${i}`, note: "x".repeat(100) }));
+rows.push({ id: "d@m", scope: "user", enabled: true, installPath: process.argv[2] });
+require("node:fs").writeFileSync(process.argv[1], JSON.stringify(rows));
+' "$WORK/big.json" "$WORK/plugin-d"
 big_bytes="$(wc -c <"$WORK/big.json")"
 expect_eq "oversized listing fixture exceeds 200000 bytes" 1 "$((big_bytes > 200000))"
 out="$(run_stub_file "$WORK/big.json")"
 rc=$?
 expect_eq "oversized listing exits 1" 1 "$rc"
-expect_has "oversized listing: the enabled row's tool is reported" $'absent-d\tplugin-d\tmissing' "$out"
+expect_has "oversized listing: the enabled row's entry is reported" $'plugin-d\tabsent-d\tcli\trequired\tmissing' "$out"
 expect_has "oversized listing: summary counts it" 'missing=1 present=0' "$out"
-expect_eq "oversized listing: no argument-length error" 0 "$(grep -c 'Argument list too long' "$WORK/stderr")"
+expect_eq "oversized listing: nothing on stderr" "" "$(cat "$WORK/stderr")"
 
 printf '%s\n' 'Error: something went wrong, not json' >"$WORK/bad.txt"
 out="$(run_stub_file "$WORK/bad.txt")"
@@ -175,23 +207,27 @@ expect_eq "non-JSON listing exits 2" 2 "$rc"
 expect_eq "non-JSON listing prints no table" "" "$out"
 expect_has "non-JSON listing writes an error to stderr" 'claude plugin list --json' "$(cat "$WORK/stderr")"
 
-out="$(bash "$SCRIPT" --help 2>"$WORK/stderr")"
+out="$("$NODE" "$SCRIPT" --help 2>"$WORK/stderr")"
 rc=$?
 expect_eq "--help exits 0" 0 "$rc"
-expect_has "--help prints the usage on stdout" 'check-prerequisites.sh --plugin-root' "$out"
+expect_has "--help prints the usage on stdout" 'check-prerequisites.mjs --plugin-root' "$out"
 expect_has "--help lists the exit codes" '2 on a usage error' "$out"
 expect_eq "--help writes nothing to stderr" "" "$(cat "$WORK/stderr")"
 
-out="$(bash "$SCRIPT" --bogus 2>&1)"
+out="$("$NODE" "$SCRIPT" --bogus 2>&1)"
 rc=$?
 expect_eq "unknown argument exits 2" 2 "$rc"
 expect_has "unknown argument names --help" '(see --help)' "$out"
 
-mkdir -p "$WORK/nopython"
-out="$(PATH="$WORK/nopython" "$BASH" "$SCRIPT" --plugin-root "$WORK/plugin-a" 2>&1)"
+out="$("$NODE" "$SCRIPT" --plugin-root 2>&1)"
 rc=$?
-expect_eq "python3 missing exits 2" 2 "$rc"
-expect_has "python3 missing is named" 'python3 is required' "$out"
+expect_eq "--plugin-root without a directory exits 2" 2 "$rc"
+
+# The reader depends on node alone: no python in the script, and a PATH without
+# python still produces the table.
+expect_eq "the script names no python" 0 "$(grep -ci python "$SCRIPT")"
+out="$(PATH="$WORK/tools" "$NODE" "$SCRIPT" --plugin-root "$WORK/plugin-o")"
+expect_has "the table prints with only node and git available" 'plugin-o' "$out"
 
 printf '%d cases, %d failed\n' "$CASE_NUM" "$FAILED"
 exit $((FAILED > 0 ? 1 : 0))
diff --git a/plugins/markdown-format/.claude-plugin/plugin.json b/plugins/markdown-format/.claude-plugin/plugin.json
index 9f90dcf78d..3f85033d37 100644
--- a/plugins/markdown-format/.claude-plugin/plugin.json
+++ b/plugins/markdown-format/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "markdown-format",
-  "version": "0.11.94",
+  "version": "0.11.95",
   "description": "Auto-format and lint Markdown on edit via markdownlint-cli2, only in repos that carry their own markdownlint config.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/markdown-format/CHANGELOG.md b/plugins/markdown-format/CHANGELOG.md
index cd0c163e73..0501e471b3 100644
--- a/plugins/markdown-format/CHANGELOG.md
+++ b/plugins/markdown-format/CHANGELOG.md
@@ -3,6 +3,14 @@
 All notable changes to the `markdown-format` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.11.95] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list, with a `degrade` line per entry ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+- The `SessionStart` row runs `lib/prerequisites.mjs probe` behind the same `--run-if-unset-or-true` kill-switch gate, and `hooks/probe-prerequisite.sh` is deleted. The notice text, its once-per-session latch shared with the per-edit hook, and its silence when the kill switch is off are unchanged; the hook test suite asserts each.
+- The README no longer says `jq` is absent from `prerequisites.json`; it is declared, and the probe reports it.
+
 ## [0.11.94] - 2026-10-02
 
 ### Changed
diff --git a/plugins/markdown-format/README.md b/plugins/markdown-format/README.md
index e60be3dd80..6257286537 100644
--- a/plugins/markdown-format/README.md
+++ b/plugins/markdown-format/README.md
@@ -161,18 +161,12 @@ directory already on that PATH instead of recommending a repo-local
 `npm i -D`. The hook never falls back to `npx`, installs a package, or
 performs a network request during a hook run.
 
-`hooks/hooks.json` also registers a `SessionStart` probe. It reads
-`prerequisites.json` and reports a missing `markdownlint-cli2` at session start,
+`hooks/hooks.json` also registers a `SessionStart` probe, `lib/prerequisites.mjs probe`. It reads
+`prerequisites.json` and reports a missing `markdownlint-cli2` or `jq` at session start,
 and it honors `markdown_format_enabled`. `/markdown-format:check` is the
 read-only check that notice names. The probe does not look for a markdownlint
 config, so it can report in a repository that has none.
 
-`jq` is deliberately absent from `prerequisites.json`. That manifest drives the
-session-start probe, which does not consult the per-repo config opt-in, while the
-missing-`jq` notice comes only from the per-edit hook after its opt-in pre-check
-(`markdown-format.sh`, `hook::require_jq` after the config walk). Listing `jq`
-would announce it in repositories that never opted in.
-
 Telemetry timing uses `EPOCHREALTIME` (Bash 5.0+); on older Bash the telemetry
 envelope is skipped while formatting still runs.
 
@@ -217,8 +211,8 @@ Markdown edit is the figure that counts. Measured on Windows 11 under Git Bash,
 trials against an interleaved `bash -c :` floor (2026-09-02). These figures predate the `node`
 launcher (`hooks/exec-bash.mjs`) and the `SessionStart` probe: each fire now adds one `node`
 process before `bash`, and the figures have not been re-measured. The `SessionStart` probe is
-exec form, so its k is 1 (the launcher); it then runs `bash` and `probe-prerequisite.sh` once
-per session start. It is not measured here:
+one `node` process running `lib/prerequisites.mjs`, once per session start, with no `bash`. It is not
+measured here:
 
 | Event | Fires | Spawn-equivalents | What changed |
 | --- | --- | --- | --- |
diff --git a/plugins/markdown-format/hooks/hooks.json b/plugins/markdown-format/hooks/hooks.json
index a61d399842..f2547a1a0d 100644
--- a/plugins/markdown-format/hooks/hooks.json
+++ b/plugins/markdown-format/hooks/hooks.json
@@ -37,10 +37,11 @@
             "type": "command",
             "command": "node",
             "args": [
-              "${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs",
+              "probe",
+              "${CLAUDE_PLUGIN_ROOT}",
               "--run-if-unset-or-true",
-              "MARKDOWN_FORMAT_ENABLED",
-              "${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh"
+              "MARKDOWN_FORMAT_ENABLED"
             ],
             "timeout": 10,
             "statusMessage": "Checking markdownlint-cli2..."
diff --git a/plugins/markdown-format/hooks/markdown-format.sh b/plugins/markdown-format/hooks/markdown-format.sh
index ee0ecbce45..f693bc4ace 100755
--- a/plugins/markdown-format/hooks/markdown-format.sh
+++ b/plugins/markdown-format/hooks/markdown-format.sh
@@ -60,7 +60,7 @@ emit_skipped() {
 # line-length class on a repo that never picked a line length). Like
 # bash-format's shfmt gate this is policy, not a degraded capability, so the
 # visible-skip doctrine for missing tools does not apply: no config, no rewrite,
-# no findings, no jq notice. The SessionStart probe (probe-prerequisite.sh,
+# no findings, no jq notice. The SessionStart probe (lib/prerequisites.mjs probe,
 # gated only by the markdown_format_enabled kill switch) still reports a
 # missing markdownlint-cli2 in a repo that never opted in; only this per-edit
 # hook is opt-in gated. The pre-check below keeps a repo without a config from
diff --git a/plugins/markdown-format/hooks/markdown-format.test.sh b/plugins/markdown-format/hooks/markdown-format.test.sh
index 728080cf3d..488015b2ec 100755
--- a/plugins/markdown-format/hooks/markdown-format.test.sh
+++ b/plugins/markdown-format/hooks/markdown-format.test.sh
@@ -1935,10 +1935,9 @@ fi
 # --- SessionStart probe: the kill switch closes the launcher gate ------------
 # markdown_format_enabled=false must silence the prerequisite probe as well as
 # the format hook. The gate sits in the launcher (exec-bash.mjs
-# --run-if-unset-or-true), so probe-prerequisite.sh stays the shared,
-# byte-identical manifest reader and a closed gate never resolves bash.
+# --run-if-unset-or-true), so the closed gate never reads the manifest.
 # shellcheck disable=SC2016 # the ${CLAUDE_PLUGIN_ROOT} placeholders are literal manifest text
-PROBE_ARGS_WANT='[["${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs","--run-if-unset-or-true","MARKDOWN_FORMAT_ENABLED","${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh"]]'
+PROBE_ARGS_WANT='[["${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs","probe","${CLAUDE_PLUGIN_ROOT}","--run-if-unset-or-true","MARKDOWN_FORMAT_ENABLED"]]'
 if command -v jq >/dev/null 2>&1 && [[ -f "$HOOKS_JSON" ]]; then
   PROBE_ARGS_GOT="$(jq -c '[.hooks.SessionStart[]?.hooks[]?.args]' "$HOOKS_JSON")"
   if [[ "$PROBE_ARGS_GOT" == "$PROBE_ARGS_WANT" ]]; then
@@ -1967,8 +1966,8 @@ if command -v node >/dev/null 2>&1; then
     local data
     data="$(mktemp -d "$WORK/pd.XXXXXX")"
     (cd "$UNRELATED" && env -i PATH="$PROBE_BIN" CLAUDE_PLUGIN_DATA="$data" "$@" \
-      node "$HOOK_DIR/exec-bash.mjs" --run-if-unset-or-true MARKDOWN_FORMAT_ENABLED \
-      "$HOOK_DIR/probe-prerequisite.sh" <<<'{"session_id":"s1"}')
+      node "$HOOK_DIR/../lib/prerequisites.mjs" probe "$HOOK_DIR/.." --run-if-unset-or-true MARKDOWN_FORMAT_ENABLED \
+      <<<'{"session_id":"s1"}')
   }
   OUT_PROBE_OFF="$(run_probe_launcher CLAUDE_PLUGIN_OPTION_MARKDOWN_FORMAT_ENABLED=false)"
   RC_PROBE_OFF=$?
diff --git a/plugins/markdown-format/hooks/probe-prerequisite.sh b/plugins/markdown-format/hooks/probe-prerequisite.sh
deleted file mode 100755
index 41eb7efa95..0000000000
--- a/plugins/markdown-format/hooks/probe-prerequisite.sh
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-# SessionStart probe for the binaries this plugin's prerequisites.json declares.
-# Every name, local_bin, check, and install string comes from that manifest.
-# Reports a missing binary once per session; never installs.
-set -uo pipefail
-
-SCRIPT_DIR="$(cd "${BASH_SOURCE[0]%/*}" && pwd)"
-ROOT="${SCRIPT_DIR%/*}"
-MANIFEST="$ROOT/prerequisites.json"
-[[ -f "$MANIFEST" ]] || exit 0
-
-field() {
-  local re="\"$1\"[[:space:]]*:[[:space:]]*\"([^\"]*)\""
-  [[ "$2" =~ $re ]] && printf '%s' "${BASH_REMATCH[1]}"
-}
-
-have() {
-  command -v "$1" >/dev/null 2>&1 && return 0
-  [[ -n "$2" ]] || return 1
-  local dir="$PWD" i
-  for ((i = 0; i < 8; i++)); do
-    [[ -x "$dir/$2" ]] && return 0
-    [[ "$dir" == "/" ]] && break
-    dir="$(dirname "$dir")"
-  done
-  return 1
-}
-
-plugin="$(field name "$(cat "$ROOT/.claude-plugin/plugin.json" 2>/dev/null)")"
-plugin="${plugin:-${ROOT##*/}}"
-tools="$(tr -d '\r\n' <"$MANIFEST")"
-tools="${tools#*\"tools\"}"
-
-INPUT=""
-loaded=0
-while [[ "$tools" == *"{"* ]]; do
-  tools="${tools#*\{}"
-  entry="${tools%%\}*}"
-  tools="${tools#*\}}"
-  name="$(field name "$entry")"
-  [[ -n "$name" ]] || continue
-  local_bin="$(field local_bin "$entry")"
-  have "$name" "$local_bin" && continue
-  if [[ "$loaded" -eq 0 ]]; then
-    # shellcheck source=hook-utils.sh
-    source "$SCRIPT_DIR/hook-utils.sh"
-    INPUT="$(cat || true)"
-    loaded=1
-  fi
-  where="on PATH"
-  [[ -n "$local_bin" ]] && where="on PATH or as $local_bin"
-  if hook::notice_once "$plugin-$name" "$INPUT" prerequisite; then
-    msg="$plugin: $name was not found $where. Hooks that need it will skip until it is installed. Run $(field check "$entry"). It does not install. Install: $(field install "$entry")"
-    notice="${notice:+$notice$'\n'}$msg"
-  fi
-done
-[[ -n "${notice:-}" ]] && hook::emit_skip_notice SessionStart "$notice"
-exit 0
diff --git a/plugins/markdown-format/lib/prerequisites.mjs b/plugins/markdown-format/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/markdown-format/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/markdown-format/lib/prerequisites.ps1 b/plugins/markdown-format/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/markdown-format/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/markdown-format/lib/prerequisites.sh b/plugins/markdown-format/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/markdown-format/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/markdown-format/prerequisites.json b/plugins/markdown-format/prerequisites.json
index ef83d7aa9c..b2d4fb91d4 100644
--- a/plugins/markdown-format/prerequisites.json
+++ b/plugins/markdown-format/prerequisites.json
@@ -1,20 +1,61 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "markdownlint-cli2",
-      "local_bin": "node_modules/.bin/markdownlint-cli2",
-      "check": "/markdown-format:check",
-      "install": "npm i -D markdownlint-cli2"
+      "id": "markdownlint-cli2",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:markdown-format.sh"
+      ],
+      "detect": {
+        "any": [
+          "markdownlint-cli2"
+        ],
+        "local_bin": [
+          "node_modules/.bin/markdownlint-cli2"
+        ]
+      },
+      "degrade": "Without markdownlint-cli2, the hook cannot format edited Markdown files; edits still go through.",
+      "install": {
+        "npm": "npm i -D markdownlint-cli2"
+      },
+      "check": "/markdown-format:check"
     },
     {
-      "name": "jq",
-      "check": "/markdown-format:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:markdown-format.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the markdown-format hooks skip their work for the session and say so once.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/markdown-format:check"
     },
     {
-      "name": "node",
-      "check": "/markdown-format:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the markdown-format hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/markdown-format:check"
     }
   ]
 }
diff --git a/plugins/multi-agent/.claude-plugin/plugin.json b/plugins/multi-agent/.claude-plugin/plugin.json
index c1475810ad..a8e8b61a78 100644
--- a/plugins/multi-agent/.claude-plugin/plugin.json
+++ b/plugins/multi-agent/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "multi-agent",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Workflow and model-routing guidance for multi-agent work: assess (workflow, subagent, or single context for a task, with a Workflow availability check), route (the role map a workflow script reads from args, resolved through a config cascade, with a guard that keeps fan-out stages off a frontier model), audit-defaults (rechecks each bundled default against its upstream pointer, or sweeps the repository's model and workflow guidance, through a read-only drift-audit workflow, and proposes changes), check (reports whether node resolves and the drift-checker fetch gate is registered, without installing anything), and setup (checks the resolved map and writes a user, team or local layer after a preview and an explicit yes).",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/multi-agent/CHANGELOG.md b/plugins/multi-agent/CHANGELOG.md
index f7b56f5867..cefac772b5 100644
--- a/plugins/multi-agent/CHANGELOG.md
+++ b/plugins/multi-agent/CHANGELOG.md
@@ -3,6 +3,12 @@
 All notable changes to the `multi-agent` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.3.1] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+
 ## [0.3.0] - 2026-10-02
 
 ### Added
diff --git a/plugins/multi-agent/lib/prerequisites.mjs b/plugins/multi-agent/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/multi-agent/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/multi-agent/lib/prerequisites.ps1 b/plugins/multi-agent/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/multi-agent/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/multi-agent/lib/prerequisites.sh b/plugins/multi-agent/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/multi-agent/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/multi-agent/prerequisites.json b/plugins/multi-agent/prerequisites.json
index 6af39d5b54..ed26ee0488 100644
--- a/plugins/multi-agent/prerequisites.json
+++ b/plugins/multi-agent/prerequisites.json
@@ -1,9 +1,22 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "node",
-      "check": "/multi-agent:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the multi-agent hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/multi-agent:check"
     }
   ]
 }
diff --git a/plugins/playwright/.claude-plugin/plugin.json b/plugins/playwright/.claude-plugin/plugin.json
index 906d942169..7d8cbdee8e 100644
--- a/plugins/playwright/.claude-plugin/plugin.json
+++ b/plugins/playwright/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "playwright",
-  "version": "0.8.3",
+  "version": "0.8.4",
   "description": "Live E2E browser automation via Microsoft's @playwright/cli: named sessions, accessibility-ref snapshots, click/fill by ref, screenshots, console and network capture, mocking, tracing, video, and auth state, with artifacts written to disk so only paths enter context, plus a vendored upstream baseline and maintainer drift-check update flow.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/playwright/CHANGELOG.md b/plugins/playwright/CHANGELOG.md
index e107fee4a1..b0198b5812 100644
--- a/plugins/playwright/CHANGELOG.md
+++ b/plugins/playwright/CHANGELOG.md
@@ -3,6 +3,12 @@
 All notable changes to the `playwright` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.8.4] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list, and now declares `node`, which the shared checker needs ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+
 ## [0.8.3] - 2026-10-02
 
 ### Fixed
diff --git a/plugins/playwright/lib/prerequisites.mjs b/plugins/playwright/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/playwright/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/playwright/lib/prerequisites.ps1 b/plugins/playwright/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/playwright/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/playwright/lib/prerequisites.sh b/plugins/playwright/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/playwright/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/playwright/prerequisites.json b/plugins/playwright/prerequisites.json
index 1c5c8d4168..a12a1f6123 100644
--- a/plugins/playwright/prerequisites.json
+++ b/plugins/playwright/prerequisites.json
@@ -1,9 +1,40 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "playwright-cli",
-      "check": "/playwright:check",
-      "install": "npm install -g @playwright/cli"
+      "id": "playwright-cli",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "skill:playwright"
+      ],
+      "detect": {
+        "any": [
+          "playwright-cli"
+        ]
+      },
+      "degrade": "Without playwright-cli, /playwright:playwright cannot drive a browser; it stops and asks for the install instead of substituting another surface.",
+      "install": {
+        "npm": "npm install -g @playwright/cli"
+      },
+      "check": "/playwright:check"
+    },
+    {
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, playwright-cli (an npm package) cannot run and the bundled prerequisites checker only reports that node is missing, so /playwright:playwright cannot drive a browser.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/playwright:check"
     }
   ]
 }
diff --git a/plugins/powershell-format/.claude-plugin/plugin.json b/plugins/powershell-format/.claude-plugin/plugin.json
index 8f4e8036b5..6b7cf69888 100644
--- a/plugins/powershell-format/.claude-plugin/plugin.json
+++ b/plugins/powershell-format/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "powershell-format",
-  "version": "0.9.11",
+  "version": "0.9.12",
   "description": "Auto-format and lint PowerShell on edit via PSScriptAnalyzer, only when a PSScriptAnalyzerSettings.psd1 governs the repo, using the consuming repo's own analyzer settings.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/powershell-format/CHANGELOG.md b/plugins/powershell-format/CHANGELOG.md
index 113d8d717c..de0f935153 100644
--- a/plugins/powershell-format/CHANGELOG.md
+++ b/plugins/powershell-format/CHANGELOG.md
@@ -3,6 +3,13 @@
 All notable changes to the `powershell-format` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.9.12] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list, with a `degrade` line per entry ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+- The `SessionStart` row runs `lib/prerequisites.mjs probe` behind the same `--run-if-unset-or-true` kill-switch gate, and `hooks/probe-prerequisite.sh` is deleted. The notice text, its once-per-session latch shared with the per-edit hook, and its silence when the kill switch is off are unchanged; the hook test suite asserts each.
+
 ## [0.9.11] - 2026-10-02
 
 ### Changed
diff --git a/plugins/powershell-format/hooks/hooks.json b/plugins/powershell-format/hooks/hooks.json
index cfa0f76aec..f07c4a2ac2 100644
--- a/plugins/powershell-format/hooks/hooks.json
+++ b/plugins/powershell-format/hooks/hooks.json
@@ -48,10 +48,11 @@
             "type": "command",
             "command": "node",
             "args": [
-              "${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs",
+              "probe",
+              "${CLAUDE_PLUGIN_ROOT}",
               "--run-if-unset-or-true",
-              "POWERSHELL_FORMAT_ENABLED",
-              "${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh"
+              "POWERSHELL_FORMAT_ENABLED"
             ],
             "timeout": 10,
             "statusMessage": "Checking pwsh..."
diff --git a/plugins/powershell-format/hooks/powershell-format.test.sh b/plugins/powershell-format/hooks/powershell-format.test.sh
index 9a9ce42c94..fd953fc5ac 100755
--- a/plugins/powershell-format/hooks/powershell-format.test.sh
+++ b/plugins/powershell-format/hooks/powershell-format.test.sh
@@ -348,17 +348,17 @@ if [[ "$(cat "$REPO_CEIL/proj/sub/c.ps1")" == "$BEFORE_CEIL" ]]; then ok "ceilin
 HOOKS_JSON="$HOOK_DIR/hooks.json"
 PLUGIN_ROOT="${HOOK_DIR%/*}"
 MANIFEST="$PLUGIN_ROOT/prerequisites.json"
-if jq -e '(.tools | map(.name)) == ["pwsh", "jq", "node"]' "$MANIFEST" >/dev/null 2>&1; then
+if jq -e '(.requires | map(.id)) == ["pwsh", "jq", "node"]' "$MANIFEST" >/dev/null 2>&1; then
   ok "manifest: declares exactly pwsh, jq and node"
 else
   fail "manifest: expected tools pwsh, jq and node: $(cat "$MANIFEST" 2>&1)"
 fi
-IFS=$'\t' read -r MF_NAME MF_CHECK MF_INSTALL < <(jq -r '.tools[0] | [.name, .check, .install] | @tsv' "$MANIFEST")
-if jq -e --arg launcher '${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs' --arg probe '${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh' \
-  '[.hooks.SessionStart[].hooks[] | select(.command == "node" and .args == [$launcher, "--run-if-unset-or-true", "POWERSHELL_FORMAT_ENABLED", $probe])] | length == 1' "$HOOKS_JSON" >/dev/null; then
-  ok "hooks.json: one exec-form SessionStart row runs probe-prerequisite.sh behind --run-if-unset-or-true POWERSHELL_FORMAT_ENABLED"
+IFS=$'\t' read -r MF_NAME MF_CHECK MF_INSTALL < <(jq -r '.requires[0] | [.id, .check, (.install | to_entries[0].value)] | @tsv' "$MANIFEST")
+if jq -e --arg checker '${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs' --arg root '${CLAUDE_PLUGIN_ROOT}' \
+  '[.hooks.SessionStart[].hooks[] | select(.command == "node" and .args == [$checker, "probe", $root, "--run-if-unset-or-true", "POWERSHELL_FORMAT_ENABLED"])] | length == 1' "$HOOKS_JSON" >/dev/null; then
+  ok "hooks.json: one exec-form SessionStart row runs the prerequisites checker's probe behind --run-if-unset-or-true POWERSHELL_FORMAT_ENABLED"
 else
-  fail "hooks.json: expected one exec-form SessionStart probe-prerequisite.sh row behind --run-if-unset-or-true POWERSHELL_FORMAT_ENABLED"
+  fail "hooks.json: expected one exec-form SessionStart prerequisites probe row behind --run-if-unset-or-true POWERSHELL_FORMAT_ENABLED"
 fi
 NODE_BIN="$(command -v node 2>/dev/null)"
 if [[ -z "$NODE_BIN" ]]; then
diff --git a/plugins/powershell-format/hooks/probe-prerequisite.sh b/plugins/powershell-format/hooks/probe-prerequisite.sh
deleted file mode 100755
index 41eb7efa95..0000000000
--- a/plugins/powershell-format/hooks/probe-prerequisite.sh
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-# SessionStart probe for the binaries this plugin's prerequisites.json declares.
-# Every name, local_bin, check, and install string comes from that manifest.
-# Reports a missing binary once per session; never installs.
-set -uo pipefail
-
-SCRIPT_DIR="$(cd "${BASH_SOURCE[0]%/*}" && pwd)"
-ROOT="${SCRIPT_DIR%/*}"
-MANIFEST="$ROOT/prerequisites.json"
-[[ -f "$MANIFEST" ]] || exit 0
-
-field() {
-  local re="\"$1\"[[:space:]]*:[[:space:]]*\"([^\"]*)\""
-  [[ "$2" =~ $re ]] && printf '%s' "${BASH_REMATCH[1]}"
-}
-
-have() {
-  command -v "$1" >/dev/null 2>&1 && return 0
-  [[ -n "$2" ]] || return 1
-  local dir="$PWD" i
-  for ((i = 0; i < 8; i++)); do
-    [[ -x "$dir/$2" ]] && return 0
-    [[ "$dir" == "/" ]] && break
-    dir="$(dirname "$dir")"
-  done
-  return 1
-}
-
-plugin="$(field name "$(cat "$ROOT/.claude-plugin/plugin.json" 2>/dev/null)")"
-plugin="${plugin:-${ROOT##*/}}"
-tools="$(tr -d '\r\n' <"$MANIFEST")"
-tools="${tools#*\"tools\"}"
-
-INPUT=""
-loaded=0
-while [[ "$tools" == *"{"* ]]; do
-  tools="${tools#*\{}"
-  entry="${tools%%\}*}"
-  tools="${tools#*\}}"
-  name="$(field name "$entry")"
-  [[ -n "$name" ]] || continue
-  local_bin="$(field local_bin "$entry")"
-  have "$name" "$local_bin" && continue
-  if [[ "$loaded" -eq 0 ]]; then
-    # shellcheck source=hook-utils.sh
-    source "$SCRIPT_DIR/hook-utils.sh"
-    INPUT="$(cat || true)"
-    loaded=1
-  fi
-  where="on PATH"
-  [[ -n "$local_bin" ]] && where="on PATH or as $local_bin"
-  if hook::notice_once "$plugin-$name" "$INPUT" prerequisite; then
-    msg="$plugin: $name was not found $where. Hooks that need it will skip until it is installed. Run $(field check "$entry"). It does not install. Install: $(field install "$entry")"
-    notice="${notice:+$notice$'\n'}$msg"
-  fi
-done
-[[ -n "${notice:-}" ]] && hook::emit_skip_notice SessionStart "$notice"
-exit 0
diff --git a/plugins/powershell-format/lib/prerequisites.mjs b/plugins/powershell-format/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/powershell-format/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/powershell-format/lib/prerequisites.ps1 b/plugins/powershell-format/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/powershell-format/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/powershell-format/lib/prerequisites.sh b/plugins/powershell-format/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/powershell-format/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/powershell-format/prerequisites.json b/plugins/powershell-format/prerequisites.json
index f421642bc6..0efb2d02b6 100644
--- a/plugins/powershell-format/prerequisites.json
+++ b/plugins/powershell-format/prerequisites.json
@@ -1,19 +1,58 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "pwsh",
-      "check": "/powershell-format:check",
-      "install": "a host package or release build of PowerShell 7+, https://learn.microsoft.com/powershell/scripting/install/installing-powershell"
+      "id": "pwsh",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:powershell-format.sh"
+      ],
+      "detect": {
+        "any": [
+          "pwsh"
+        ]
+      },
+      "degrade": "Without pwsh, the hook cannot format or lint edited PowerShell scripts; edits still go through.",
+      "install": {
+        "docs": "https://learn.microsoft.com/powershell/scripting/install/installing-powershell"
+      },
+      "check": "/powershell-format:check"
     },
     {
-      "name": "jq",
-      "check": "/powershell-format:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:powershell-format.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the powershell-format hooks skip their work for the session and say so once.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/powershell-format:check"
     },
     {
-      "name": "node",
-      "check": "/powershell-format:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the powershell-format hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/powershell-format:check"
     }
   ]
 }
diff --git a/plugins/rate-limit-guard/.claude-plugin/plugin.json b/plugins/rate-limit-guard/.claude-plugin/plugin.json
index 6bed051a4b..0fb017076f 100644
--- a/plugins/rate-limit-guard/.claude-plugin/plugin.json
+++ b/plugins/rate-limit-guard/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "rate-limit-guard",
-  "version": "0.10.6",
+  "version": "0.10.7",
   "description": "Shared rate-limit guard for loop lanes: a statusline wrapper tees the subscription rate-limit windows to a fixed machine-scope file, a StopFailure hook records rate-limit stops reactively, and a reader contract fixes how consuming sessions pause and resume.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/rate-limit-guard/CHANGELOG.md b/plugins/rate-limit-guard/CHANGELOG.md
index 1f40603aae..99c0bfbafc 100644
--- a/plugins/rate-limit-guard/CHANGELOG.md
+++ b/plugins/rate-limit-guard/CHANGELOG.md
@@ -3,6 +3,12 @@
 All notable changes to the `rate-limit-guard` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.10.7] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+
 ## [0.10.6] - 2026-10-02
 
 ### Changed
diff --git a/plugins/rate-limit-guard/lib/prerequisites.mjs b/plugins/rate-limit-guard/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/rate-limit-guard/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/rate-limit-guard/lib/prerequisites.ps1 b/plugins/rate-limit-guard/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/rate-limit-guard/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/rate-limit-guard/lib/prerequisites.sh b/plugins/rate-limit-guard/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/rate-limit-guard/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/rate-limit-guard/prerequisites.json b/plugins/rate-limit-guard/prerequisites.json
index 379f8d6da0..15eb480b76 100644
--- a/plugins/rate-limit-guard/prerequisites.json
+++ b/plugins/rate-limit-guard/prerequisites.json
@@ -1,14 +1,40 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "node",
-      "check": "/rate-limit-guard:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the rate-limit-guard hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/rate-limit-guard:check"
     },
     {
-      "name": "jq",
-      "check": "/rate-limit-guard:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:record-rate-limit-stop.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the rate-limit-guard hooks skip their work for the session and say so once.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/rate-limit-guard:check"
     }
   ]
 }
diff --git a/plugins/ruff-format/.claude-plugin/plugin.json b/plugins/ruff-format/.claude-plugin/plugin.json
index 6e50867d00..4221cd75fb 100644
--- a/plugins/ruff-format/.claude-plugin/plugin.json
+++ b/plugins/ruff-format/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "ruff-format",
-  "version": "0.8.11",
+  "version": "0.8.12",
   "description": "Auto-format and lint Python on edit via Ruff, only when a Ruff config governs the repo, using the consuming repo's own Ruff config.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/ruff-format/CHANGELOG.md b/plugins/ruff-format/CHANGELOG.md
index fec27a4ff2..7adc1d93e7 100644
--- a/plugins/ruff-format/CHANGELOG.md
+++ b/plugins/ruff-format/CHANGELOG.md
@@ -3,6 +3,13 @@
 All notable changes to the `ruff-format` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.8.12] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list, with a `degrade` line per entry ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+- The `SessionStart` row runs `lib/prerequisites.mjs probe` behind the same `--run-if-unset-or-true` kill-switch gate, and `hooks/probe-prerequisite.sh` is deleted. The notice text, its once-per-session latch shared with the per-edit hook, and its silence when the kill switch is off are unchanged; the hook test suite asserts each.
+
 ## [0.8.11] - 2026-10-02
 
 ### Changed
diff --git a/plugins/ruff-format/hooks/hooks.json b/plugins/ruff-format/hooks/hooks.json
index 74ac1ba5cd..0f8d7b0e9f 100644
--- a/plugins/ruff-format/hooks/hooks.json
+++ b/plugins/ruff-format/hooks/hooks.json
@@ -37,10 +37,11 @@
             "type": "command",
             "command": "node",
             "args": [
-              "${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs",
+              "probe",
+              "${CLAUDE_PLUGIN_ROOT}",
               "--run-if-unset-or-true",
-              "RUFF_FORMAT_ENABLED",
-              "${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh"
+              "RUFF_FORMAT_ENABLED"
             ],
             "timeout": 10,
             "statusMessage": "Checking ruff..."
diff --git a/plugins/ruff-format/hooks/probe-prerequisite.sh b/plugins/ruff-format/hooks/probe-prerequisite.sh
deleted file mode 100755
index 41eb7efa95..0000000000
--- a/plugins/ruff-format/hooks/probe-prerequisite.sh
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-# SessionStart probe for the binaries this plugin's prerequisites.json declares.
-# Every name, local_bin, check, and install string comes from that manifest.
-# Reports a missing binary once per session; never installs.
-set -uo pipefail
-
-SCRIPT_DIR="$(cd "${BASH_SOURCE[0]%/*}" && pwd)"
-ROOT="${SCRIPT_DIR%/*}"
-MANIFEST="$ROOT/prerequisites.json"
-[[ -f "$MANIFEST" ]] || exit 0
-
-field() {
-  local re="\"$1\"[[:space:]]*:[[:space:]]*\"([^\"]*)\""
-  [[ "$2" =~ $re ]] && printf '%s' "${BASH_REMATCH[1]}"
-}
-
-have() {
-  command -v "$1" >/dev/null 2>&1 && return 0
-  [[ -n "$2" ]] || return 1
-  local dir="$PWD" i
-  for ((i = 0; i < 8; i++)); do
-    [[ -x "$dir/$2" ]] && return 0
-    [[ "$dir" == "/" ]] && break
-    dir="$(dirname "$dir")"
-  done
-  return 1
-}
-
-plugin="$(field name "$(cat "$ROOT/.claude-plugin/plugin.json" 2>/dev/null)")"
-plugin="${plugin:-${ROOT##*/}}"
-tools="$(tr -d '\r\n' <"$MANIFEST")"
-tools="${tools#*\"tools\"}"
-
-INPUT=""
-loaded=0
-while [[ "$tools" == *"{"* ]]; do
-  tools="${tools#*\{}"
-  entry="${tools%%\}*}"
-  tools="${tools#*\}}"
-  name="$(field name "$entry")"
-  [[ -n "$name" ]] || continue
-  local_bin="$(field local_bin "$entry")"
-  have "$name" "$local_bin" && continue
-  if [[ "$loaded" -eq 0 ]]; then
-    # shellcheck source=hook-utils.sh
-    source "$SCRIPT_DIR/hook-utils.sh"
-    INPUT="$(cat || true)"
-    loaded=1
-  fi
-  where="on PATH"
-  [[ -n "$local_bin" ]] && where="on PATH or as $local_bin"
-  if hook::notice_once "$plugin-$name" "$INPUT" prerequisite; then
-    msg="$plugin: $name was not found $where. Hooks that need it will skip until it is installed. Run $(field check "$entry"). It does not install. Install: $(field install "$entry")"
-    notice="${notice:+$notice$'\n'}$msg"
-  fi
-done
-[[ -n "${notice:-}" ]] && hook::emit_skip_notice SessionStart "$notice"
-exit 0
diff --git a/plugins/ruff-format/hooks/ruff-format.test.sh b/plugins/ruff-format/hooks/ruff-format.test.sh
index ec40ab9bf2..454a255e35 100755
--- a/plugins/ruff-format/hooks/ruff-format.test.sh
+++ b/plugins/ruff-format/hooks/ruff-format.test.sh
@@ -46,12 +46,12 @@ ok() {
 # name, check, install and local_bin, verbatim.
 MANIFEST="${HOOK_DIR%/*}/prerequisites.json"
 if command -v jq >/dev/null 2>&1 && [[ -f "$MANIFEST" ]]; then
-  if jq -e '(.tools | map(.name)) == ["ruff", "jq", "node"] and .tools[0].local_bin == ".venv/bin/ruff"' "$MANIFEST" >/dev/null 2>&1; then
+  if jq -e '(.requires | map(.id)) == ["ruff", "jq", "node"] and .requires[0].detect.local_bin == [".venv/bin/ruff"]' "$MANIFEST" >/dev/null 2>&1; then
     ok "manifest: declares exactly ruff (at .venv/bin/ruff), jq and node"
   else
     fail "manifest: expected tools ruff, jq and node with local_bin .venv/bin/ruff: $(cat "$MANIFEST")"
   fi
-  IFS=$'\t' read -r MF_NAME MF_LOCAL MF_CHECK MF_INSTALL < <(jq -r '.tools[0] | [.name, .local_bin, .check, .install] | @tsv' "$MANIFEST")
+  IFS=$'\t' read -r MF_NAME MF_LOCAL MF_CHECK MF_INSTALL < <(jq -r '.requires[0] | [.id, .detect.local_bin[0], .check, (.install | to_entries[0].value)] | @tsv' "$MANIFEST")
   NOTICE_CALL="$(sed -n '/hook::tool_missing_notice_to RUFF_NOTICE/,/[^\\]$/p' "$HOOK")"
   WALK_FN="$(sed -n '/^ruff_venv_bin_here()/,/^}/p' "$HOOK")"
   # assert_hook_states <field> <needle> <haystack>
@@ -97,7 +97,7 @@ else
     # shellcheck disable=SC2016  # the placeholder is matched literally, as Claude Code substitutes it
     PG_ARGS+=("${pg_arg//\$\{CLAUDE_PLUGIN_ROOT\}/$PLUGIN_ROOT}")
   done < <(jq -r '.hooks.SessionStart[0].hooks[0].args[]' "$HOOKS_JSON")
-  IFS=$'\t' read -r PG_NAME PG_CHECK PG_INSTALL < <(jq -r '.tools[0] | [.name, .check, .install] | @tsv' "$PLUGIN_ROOT/prerequisites.json")
+  IFS=$'\t' read -r PG_NAME PG_CHECK PG_INSTALL < <(jq -r '.requires[0] | [.id, .check, (.install | to_entries[0].value)] | @tsv' "$PLUGIN_ROOT/prerequisites.json")
 
   # run_probe <value|__unset__> -> run the row with ruff_format_enabled set to <value> (or unset).
   run_probe() {
@@ -667,12 +667,12 @@ if command -v jq >/dev/null 2>&1 && [[ -f "$HOOKS_JSON" && -n "$BEGIN_LINE" && "
   # form behind the ruff_format_enabled launcher gate, which is asserted on its
   # own here.
   ALL_HANDLERS="$(jq -c '[.hooks | to_entries[] | .key as $ev | .value[]? | .matcher as $m | .hooks[]? | . + {event: $ev, matcher: ($m // "(none)")}]' "$HOOKS_JSON")"
-  PROBE_COUNT="$(jq -c --arg launcher '${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs' --arg probe '${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh' '[.[] | select(.event == "SessionStart" and .command == "node" and .args == [$launcher, "--run-if-unset-or-true", "RUFF_FORMAT_ENABLED", $probe])] | length' <<<"$ALL_HANDLERS")"
-  HANDLERS="$(jq -c --arg launcher '${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs' --arg probe '${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh' '[.[] | select((.event == "SessionStart" and .command == "node" and .args == [$launcher, "--run-if-unset-or-true", "RUFF_FORMAT_ENABLED", $probe]) | not)]' <<<"$ALL_HANDLERS")"
+  PROBE_COUNT="$(jq -c --arg checker '${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs' --arg root '${CLAUDE_PLUGIN_ROOT}' '[.[] | select(.event == "SessionStart" and .command == "node" and .args == [$checker, "probe", $root, "--run-if-unset-or-true", "RUFF_FORMAT_ENABLED"])] | length' <<<"$ALL_HANDLERS")"
+  HANDLERS="$(jq -c --arg checker '${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs' --arg root '${CLAUDE_PLUGIN_ROOT}' '[.[] | select((.event == "SessionStart" and .command == "node" and .args == [$checker, "probe", $root, "--run-if-unset-or-true", "RUFF_FORMAT_ENABLED"]) | not)]' <<<"$ALL_HANDLERS")"
   if [[ "$PROBE_COUNT" == "1" ]]; then
-    ok "hooks.json: one exec-form SessionStart row runs probe-prerequisite.sh behind --run-if-unset-or-true RUFF_FORMAT_ENABLED"
+    ok "hooks.json: one exec-form SessionStart row runs the prerequisites checker's probe behind --run-if-unset-or-true RUFF_FORMAT_ENABLED"
   else
-    fail "hooks.json: expected one exec-form SessionStart probe-prerequisite.sh row behind --run-if-unset-or-true RUFF_FORMAT_ENABLED, found $PROBE_COUNT"
+    fail "hooks.json: expected one exec-form SessionStart prerequisites probe row behind --run-if-unset-or-true RUFF_FORMAT_ENABLED, found $PROBE_COUNT"
   fi
   HANDLER_COUNT="$(jq 'length' <<<"$HANDLERS")"
   HANDLER_GROUPS="$(jq -r '[.[] | "\(.event):\(.matcher)"] | unique | join(",")' <<<"$HANDLERS")"
diff --git a/plugins/ruff-format/lib/prerequisites.mjs b/plugins/ruff-format/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/ruff-format/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/ruff-format/lib/prerequisites.ps1 b/plugins/ruff-format/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/ruff-format/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/ruff-format/lib/prerequisites.sh b/plugins/ruff-format/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/ruff-format/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/ruff-format/prerequisites.json b/plugins/ruff-format/prerequisites.json
index 4b7cd13585..f634926224 100644
--- a/plugins/ruff-format/prerequisites.json
+++ b/plugins/ruff-format/prerequisites.json
@@ -1,20 +1,62 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "ruff",
-      "local_bin": ".venv/bin/ruff",
-      "check": "/ruff-format:check",
-      "install": "pip install ruff in the project .venv, https://docs.astral.sh/ruff/installation/"
+      "id": "ruff",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:ruff-format.sh"
+      ],
+      "detect": {
+        "any": [
+          "ruff"
+        ],
+        "local_bin": [
+          ".venv/bin/ruff"
+        ]
+      },
+      "degrade": "Without ruff, the hook cannot format or lint edited Python files; edits still go through.",
+      "install": {
+        "pip": "pip install ruff",
+        "docs": "https://docs.astral.sh/ruff/installation/"
+      },
+      "check": "/ruff-format:check"
     },
     {
-      "name": "jq",
-      "check": "/ruff-format:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:ruff-format.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the ruff-format hooks skip their work for the session and say so once.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/ruff-format:check"
     },
     {
-      "name": "node",
-      "check": "/ruff-format:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the ruff-format hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/ruff-format:check"
     }
   ]
 }
diff --git a/plugins/session-flow/.claude-plugin/plugin.json b/plugins/session-flow/.claude-plugin/plugin.json
index 73daac5aaf..1dc00b919b 100644
--- a/plugins/session-flow/.claude-plugin/plugin.json
+++ b/plugins/session-flow/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "session-flow",
-  "version": "0.45.0",
+  "version": "0.45.1",
   "description": "Session-lifecycle toolkit of sixteen skills: workflow (navigate a staged dev workflow and suggest the next stage), handoff (write a save-point and resume prompt for /clear-and-resume), continue-in-background (delegate the task to a fresh background agent that continues it now, using the same save-point engine as handoff, delivered by launching a detached claude --bg session seeded with the resume prompt; launches only on explicit user request), keep-going (recover and continue after any interruption OR when live off-thread work looks stalled: inventory off-thread work, inspect its real output, act only on evidence, then continue; after a usage limit lifts it continues rather than summarizing-and-stalling), find-handoff (recover a lost handoff after /clear, when the resume prompt was written but never copied, via a read-only detection ladder: known-location glob of the handoffs dir, then a bounded, recency-ranked transcript scan for the handoff directive and dashed-rail markers, then a confirm-before-resume gate; surfaces only the resume prompt + metadata, never raw transcript content), clean-stop (get to a durable, linked stopping point before the machine may go away: sweep every repo/worktree for uncommitted, unpushed, or PR-less work, push it durable, put breadcrumbs in PR/issue bodies, then give a free-and-clear verdict), retro (structured end-of-session retrospective with transcript metrics and learning codification), running-retro (in-flight retrospective checkpoints that spawn a subagent to analyze the transcript so far and append classified findings to a cumulative running ledger, which captures and routes only, the live counterpart to retro; also owns a detached-observer substrate that can watch a session out-of-band and run the checkpoint autonomously after the session ends), orient (read-only session orientation: synthesize where the session stands, what it is doing, and why, from durable + off-thread state the built-in /recap never sees: ledgers, handoffs, workflow checklists, running-retro ledgers, open PRs and work-items, and git), orchestrate (arm a session or worker with proactive-orchestration imperatives), reanchor (verify a session's working assumptions are still true against live reality, checking referenced PRs/issues/branches, base-branch drift, renamed/version-drifted surfaces, stale memory-tier files, and the goal a handoff records, compared across the chain so a re-derived goal reports as drift, before building on them), reconcile (retire finished off-thread work and reconcile this session's task ledger with reality, the prune-and-reconcile counterpart to keep-going's resume: inventory the work this session spawned, inspect its real state, retire the finished and close proven-done tasks, auto-settling the finished and gating any kill of still-running work; sibling sessions in the project are reported read-only), check (read-only check that node and jq resolve for the observer hook), setup (check-centric verification of the observer's runtime prerequisites and configuration), show-options (lay out which skills fit this moment as a ranked, nothing-hidden menu: a shortlist per bucket plus the complete remainder by name, resolved from the full installed catalog rather than the truncated in-context listing, so the human decides and no option is withheld for looking already-done), and tidy-work (opt-in inventory of the gitignored .work memory tiers: report age, size, kind, and in-flight status, normalize misplaced handoffs and retros, and remove stale known items behind one confirmation; unknown and in-flight items are always kept).",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/session-flow/CHANGELOG.md b/plugins/session-flow/CHANGELOG.md
index 42eee94090..724384e902 100644
--- a/plugins/session-flow/CHANGELOG.md
+++ b/plugins/session-flow/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog: session-flow plugin
 
+## [0.45.1] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+
 ## [0.45.0] - 2026-10-02
 
 ### Added
diff --git a/plugins/session-flow/lib/prerequisites.mjs b/plugins/session-flow/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/session-flow/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/session-flow/lib/prerequisites.ps1 b/plugins/session-flow/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/session-flow/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/session-flow/lib/prerequisites.sh b/plugins/session-flow/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/session-flow/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/session-flow/prerequisites.json b/plugins/session-flow/prerequisites.json
index cc86e8f27e..3d17d3975d 100644
--- a/plugins/session-flow/prerequisites.json
+++ b/plugins/session-flow/prerequisites.json
@@ -1,14 +1,40 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "node",
-      "check": "/session-flow:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the session-flow hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/session-flow:check"
     },
     {
-      "name": "jq",
-      "check": "/session-flow:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:observer-arm.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the session-flow hooks skip their work for the session and say so once.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/session-flow:check"
     }
   ]
 }
diff --git a/plugins/source-control/.claude-plugin/plugin.json b/plugins/source-control/.claude-plugin/plugin.json
index e58435bd0c..8119b2420c 100644
--- a/plugins/source-control/.claude-plugin/plugin.json
+++ b/plugins/source-control/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "source-control",
-  "version": "0.75.0",
+  "version": "0.75.1",
   "description": "Git and GitHub delivery workflow: /commit (Conventional Commits + Co-authored-by trailer via safe heredoc mechanics), /pull-request (prep, create, CI monitoring, review-comment triage, merge, CI-log fetch), /babysit-prs (self-pacing fleet loop, safe by default; opt-in worker/autopilot tiers add gate-checked merge and thread resolution behind a deterministic Python engine), /babysit-loop (the loop-lane merge lane: a standing or drain loop that invokes babysit-prs per cycle, configured through repo-scoped babysit_loop_* keys on the layered source-control.md seam, with merge authority human-only until the target repo's tracked config adopts the lane, a gate-proven C2-mechanical baseline once adopted, and standing merge-rung raises binding from the team-tracked layer only, with one named exception, where an invocation line explicitly typing both the autopilot tier keyword and the dedicated raise argument --merge c3-this-run widens that single invocation's merge authority up to C3 behind a fresh independent frontier-tier resolver, while C4-structural and C5-untrusted-provenance stay unconditionally human-merge), /worktree (create, status, cleanup, audit for parallel-session isolation), /setup (check the effective commit-subject / PR-title convention merged across its config layers and the babysit-prs config, or apply, which interviews the repo and writes the convention config to a chosen layer), and /resolve-conflicts (intent-first merge/rebase conflict resolution with a semantic-conflict sweep, never --abort). The commit-subject / PR-title convention is configurable via a source-control.md config written by a re-runnable setup skill, layered across a ~/.claude user-global file, the tracked team file, and a gitignored .claude/source-control.local.md personal overlay merged per key; Conventional Commits is the default when no convention is declared.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/source-control/CHANGELOG.md b/plugins/source-control/CHANGELOG.md
index 305cca8258..052ecf43d1 100644
--- a/plugins/source-control/CHANGELOG.md
+++ b/plugins/source-control/CHANGELOG.md
@@ -3,6 +3,12 @@
 All notable changes to the `source-control` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.75.1] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+
 ## [0.75.0] - 2026-10-02
 
 ### Added
diff --git a/plugins/source-control/lib/prerequisites.mjs b/plugins/source-control/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/source-control/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/source-control/lib/prerequisites.ps1 b/plugins/source-control/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/source-control/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/source-control/lib/prerequisites.sh b/plugins/source-control/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/source-control/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/source-control/prerequisites.json b/plugins/source-control/prerequisites.json
index 6d58da3980..3470aba7ba 100644
--- a/plugins/source-control/prerequisites.json
+++ b/plugins/source-control/prerequisites.json
@@ -1,14 +1,44 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "node",
-      "check": "/source-control:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the source-control hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/source-control:check"
     },
     {
-      "name": "jq",
-      "check": "/source-control:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:pr-body-linkage-gate.sh",
+        "hook:pr-linkage-mcp-gate.sh",
+        "hook:worktree-add-claim-gate.sh",
+        "hook:worktree-add-containment-gate.sh",
+        "hook:worktree-create-gate.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the source-control hooks skip their work for the session and say so once.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/source-control:check"
     }
   ]
 }
diff --git a/plugins/testing/.claude-plugin/plugin.json b/plugins/testing/.claude-plugin/plugin.json
index 56fbbd3a08..f79fc00013 100644
--- a/plugins/testing/.claude-plugin/plugin.json
+++ b/plugins/testing/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "testing",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "description": "Test-stage discipline across all ecosystems: coverage-gap analysis and test planning (`/testing:plan`), TDD test authoring and placement (`/testing:write`), live E2E plus non-UI smoke verification (`/testing:run-e2e`), failing-test root-cause diagnosis with the reproduce → isolate → fix → retest loop (`/testing:diagnose`), which offers a fix-until-green workflow when several tests fail across files, a deterministic can't-fail test audit with a fail-closed gate mode and opt-in findings persistence (`/testing:audit`), a cleanup that rewrites, quarantines or, on approval, deletes low-value tests in one folder behind a mutation gate (`/testing:cleanup`), its configuration (`/testing:setup`), and opt-in hooks that scan each test file Claude writes and question edits that weaken tests.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/testing/CHANGELOG.md b/plugins/testing/CHANGELOG.md
index 8fe83e5a3f..b3ab138e73 100644
--- a/plugins/testing/CHANGELOG.md
+++ b/plugins/testing/CHANGELOG.md
@@ -3,6 +3,12 @@
 All notable changes to the `testing` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.21.1] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+
 ## [0.21.0] - 2026-10-02
 
 ### Added
diff --git a/plugins/testing/lib/prerequisites.mjs b/plugins/testing/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/testing/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/testing/lib/prerequisites.ps1 b/plugins/testing/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/testing/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/testing/lib/prerequisites.sh b/plugins/testing/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/testing/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/testing/prerequisites.json b/plugins/testing/prerequisites.json
index e305d3ed65..62bc5982da 100644
--- a/plugins/testing/prerequisites.json
+++ b/plugins/testing/prerequisites.json
@@ -1,14 +1,45 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "node",
-      "check": "/testing:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the testing hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/testing:check"
     },
     {
-      "name": "jq",
-      "check": "/testing:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:test-judge-bg.sh",
+        "hook:test-judge-start.sh",
+        "hook:test-judge.sh",
+        "hook:test-scan-bash.sh",
+        "hook:test-scan.sh",
+        "hook:test-weaken.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the testing hooks skip their work for the session and say so once.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/testing:check"
     }
   ]
 }
diff --git a/plugins/typos-format/.claude-plugin/plugin.json b/plugins/typos-format/.claude-plugin/plugin.json
index c28e0ddbe3..acf7d8fe28 100644
--- a/plugins/typos-format/.claude-plugin/plugin.json
+++ b/plugins/typos-format/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "typos-format",
-  "version": "0.8.12",
+  "version": "0.8.13",
   "description": "Spell-check on edit via typos-cli, unconditionally. Report-only by default, honoring the consuming repo's own typos configuration when one is present.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/typos-format/CHANGELOG.md b/plugins/typos-format/CHANGELOG.md
index d2e791eaa0..60ea92890c 100644
--- a/plugins/typos-format/CHANGELOG.md
+++ b/plugins/typos-format/CHANGELOG.md
@@ -3,6 +3,13 @@
 All notable changes to the `typos-format` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.8.13] - 2026-10-02
+
+### Changed
+
+- `prerequisites.json` is converted to the schema `docs/conventions/prerequisites/` owns: a `requires` list whose entries carry `id`, `kind`, `need`, `for`, `detect`, `degrade`, `install` and `check`, in place of the retired `tools` list, with a `degrade` line per entry ([#5840](https://github.com/melodic-software/claude-code-plugins/issues/5840)). The plugin now ships the shared checker, `lib/prerequisites.mjs` with its `lib/prerequisites.sh` and `lib/prerequisites.ps1` stubs, generated from the repository's canonical copy.
+- The `SessionStart` row runs `lib/prerequisites.mjs probe` behind the same `--run-if-unset-or-true` kill-switch gate, and `hooks/probe-prerequisite.sh` is deleted. The notice text, its once-per-session latch shared with the per-edit hook, and its silence when the kill switch is off are unchanged; the hook test suite asserts each.
+
 ## [0.8.12] - 2026-10-02
 
 ### Changed
diff --git a/plugins/typos-format/hooks/hooks.json b/plugins/typos-format/hooks/hooks.json
index 7e95c25637..1f2958af38 100644
--- a/plugins/typos-format/hooks/hooks.json
+++ b/plugins/typos-format/hooks/hooks.json
@@ -27,10 +27,11 @@
             "type": "command",
             "command": "node",
             "args": [
-              "${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs",
+              "probe",
+              "${CLAUDE_PLUGIN_ROOT}",
               "--run-if-unset-or-true",
-              "TYPOS_FORMAT_ENABLED",
-              "${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh"
+              "TYPOS_FORMAT_ENABLED"
             ],
             "timeout": 10,
             "statusMessage": "Checking typos..."
diff --git a/plugins/typos-format/hooks/probe-prerequisite.sh b/plugins/typos-format/hooks/probe-prerequisite.sh
deleted file mode 100755
index 41eb7efa95..0000000000
--- a/plugins/typos-format/hooks/probe-prerequisite.sh
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-# SessionStart probe for the binaries this plugin's prerequisites.json declares.
-# Every name, local_bin, check, and install string comes from that manifest.
-# Reports a missing binary once per session; never installs.
-set -uo pipefail
-
-SCRIPT_DIR="$(cd "${BASH_SOURCE[0]%/*}" && pwd)"
-ROOT="${SCRIPT_DIR%/*}"
-MANIFEST="$ROOT/prerequisites.json"
-[[ -f "$MANIFEST" ]] || exit 0
-
-field() {
-  local re="\"$1\"[[:space:]]*:[[:space:]]*\"([^\"]*)\""
-  [[ "$2" =~ $re ]] && printf '%s' "${BASH_REMATCH[1]}"
-}
-
-have() {
-  command -v "$1" >/dev/null 2>&1 && return 0
-  [[ -n "$2" ]] || return 1
-  local dir="$PWD" i
-  for ((i = 0; i < 8; i++)); do
-    [[ -x "$dir/$2" ]] && return 0
-    [[ "$dir" == "/" ]] && break
-    dir="$(dirname "$dir")"
-  done
-  return 1
-}
-
-plugin="$(field name "$(cat "$ROOT/.claude-plugin/plugin.json" 2>/dev/null)")"
-plugin="${plugin:-${ROOT##*/}}"
-tools="$(tr -d '\r\n' <"$MANIFEST")"
-tools="${tools#*\"tools\"}"
-
-INPUT=""
-loaded=0
-while [[ "$tools" == *"{"* ]]; do
-  tools="${tools#*\{}"
-  entry="${tools%%\}*}"
-  tools="${tools#*\}}"
-  name="$(field name "$entry")"
-  [[ -n "$name" ]] || continue
-  local_bin="$(field local_bin "$entry")"
-  have "$name" "$local_bin" && continue
-  if [[ "$loaded" -eq 0 ]]; then
-    # shellcheck source=hook-utils.sh
-    source "$SCRIPT_DIR/hook-utils.sh"
-    INPUT="$(cat || true)"
-    loaded=1
-  fi
-  where="on PATH"
-  [[ -n "$local_bin" ]] && where="on PATH or as $local_bin"
-  if hook::notice_once "$plugin-$name" "$INPUT" prerequisite; then
-    msg="$plugin: $name was not found $where. Hooks that need it will skip until it is installed. Run $(field check "$entry"). It does not install. Install: $(field install "$entry")"
-    notice="${notice:+$notice$'\n'}$msg"
-  fi
-done
-[[ -n "${notice:-}" ]] && hook::emit_skip_notice SessionStart "$notice"
-exit 0
diff --git a/plugins/typos-format/hooks/typos-format.test.sh b/plugins/typos-format/hooks/typos-format.test.sh
index 2a13feb520..7022f907ee 100755
--- a/plugins/typos-format/hooks/typos-format.test.sh
+++ b/plugins/typos-format/hooks/typos-format.test.sh
@@ -982,11 +982,11 @@ else
 fi
 # The one other row is the SessionStart prerequisite probe, exec form behind the
 # same launcher gate.
-if jq -e --arg launcher '${CLAUDE_PLUGIN_ROOT}/hooks/exec-bash.mjs' --arg probe '${CLAUDE_PLUGIN_ROOT}/hooks/probe-prerequisite.sh' \
-  '([.hooks[][].hooks[]] | length == 2) and ([.hooks.SessionStart[].hooks[] | select(.command == "node" and .args == [$launcher, "--run-if-unset-or-true", "TYPOS_FORMAT_ENABLED", $probe])] | length == 1)' "$HOOKS_JSON" >/dev/null; then
-  ok "hooks.json: one exec-form SessionStart row runs probe-prerequisite.sh behind --run-if-unset-or-true TYPOS_FORMAT_ENABLED"
+if jq -e --arg checker '${CLAUDE_PLUGIN_ROOT}/lib/prerequisites.mjs' --arg root '${CLAUDE_PLUGIN_ROOT}' \
+  '([.hooks[][].hooks[]] | length == 2) and ([.hooks.SessionStart[].hooks[] | select(.command == "node" and .args == [$checker, "probe", $root, "--run-if-unset-or-true", "TYPOS_FORMAT_ENABLED"])] | length == 1)' "$HOOKS_JSON" >/dev/null; then
+  ok "hooks.json: one exec-form SessionStart row runs the prerequisites checker's probe behind --run-if-unset-or-true TYPOS_FORMAT_ENABLED"
 else
-  fail "hooks.json: expected one exec-form SessionStart probe-prerequisite.sh row behind --run-if-unset-or-true TYPOS_FORMAT_ENABLED and no other extra row"
+  fail "hooks.json: expected one exec-form SessionStart prerequisites probe row behind --run-if-unset-or-true TYPOS_FORMAT_ENABLED and no other extra row"
 fi
 
 # --- Notice text is bound to prerequisites.json --------------------------------
@@ -996,12 +996,12 @@ fi
 # install, verbatim.
 MANIFEST="$PLUGIN_ROOT/prerequisites.json"
 if [[ -f "$MANIFEST" ]]; then
-  if jq -e '(.tools | map(.name)) == ["typos", "jq", "node"]' "$MANIFEST" >/dev/null 2>&1; then
+  if jq -e '(.requires | map(.id)) == ["typos", "jq", "node"]' "$MANIFEST" >/dev/null 2>&1; then
     ok "manifest: declares exactly typos, jq and node"
   else
     fail "manifest: expected tools typos, jq and node: $(cat "$MANIFEST")"
   fi
-  IFS=$'\t' read -r MF_NAME MF_CHECK MF_INSTALL < <(jq -r '.tools[0] | [.name, .check, .install] | @tsv' "$MANIFEST")
+  IFS=$'\t' read -r MF_NAME MF_CHECK MF_INSTALL < <(jq -r '.requires[0] | [.id, .check, (.install | to_entries[0].value)] | @tsv' "$MANIFEST")
   NOTICE_CALL="$(sed -n '/hook::notice_once "typos-format-typos"/,/^  fi$/p' "$HOOK")"
   # assert_hook_states <field> <needle>
   assert_hook_states() {
diff --git a/plugins/typos-format/lib/prerequisites.mjs b/plugins/typos-format/lib/prerequisites.mjs
new file mode 100755
index 0000000000..57f65a79b5
--- /dev/null
+++ b/plugins/typos-format/lib/prerequisites.mjs
@@ -0,0 +1,597 @@
+#!/usr/bin/env node
+// GENERATED from lib/prerequisites.mjs by scripts/sync-shared-copies.sh. Do not edit this copy:
+// edit the canonical source, then rerun the script.
+// Read a plugin's prerequisites.json and report which declared dependencies resolve.
+// The contract is docs/conventions/prerequisites/README.md; the schema sits beside it.
+//
+//   prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]
+//   prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]
+//   prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]
+//
+// report  One TSV table across plugins, then a missing/present summary line.
+// check   One line per entry with the remediation, for setup and check skills.
+//         --for keeps the entries scoped to that skill, hook or MCP server, plus
+//         the plugin-wide ones. --data-dir is the plugin data directory, which a
+//         command run through the Bash tool does not get in its environment.
+// probe   A SessionStart hook. Notifies once per session for each missing entry a
+//         hook needs, on both hook channels. Always exits 0 on a valid manifest,
+//         because Claude Code reads hook JSON only from a zero exit.
+//         --run-if-unset-or-true is the plugin option gate exec-bash.mjs offers: the
+//         probe stays silent when CLAUDE_PLUGIN_OPTION_<OPTION> is set to anything
+//         but true, so a plugin's kill switch silences its probe.
+//
+// Exit 0: every required entry resolves. Exit 1: a required entry is missing or
+// below its version floor. Exit 2: a usage error or a manifest that fails the schema.
+// Standard library only. It never installs anything and never prints an env value.
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+export const KINDS = ["cli", "runtime", "system-lib", "python-pkg", "node-pkg", "env", "mcp"];
+export const NEEDS = ["required", "optional"];
+const ENTRY_KEYS = ["id", "kind", "need", "for", "detect", "degrade", "install", "check"];
+const DETECT_KEYS = {
+  cli: { required: ["any"], optional: ["local_bin", "version"] },
+  runtime: { required: ["any"], optional: ["local_bin", "version"] },
+  "system-lib": { required: ["probe"], optional: [] },
+  "python-pkg": { required: ["any", "import"], optional: [] },
+  "node-pkg": { required: ["module", "paths"], optional: [] },
+  env: { required: ["name"], optional: [] },
+  mcp: { required: ["server"], optional: [] },
+};
+const ID_RE = /^[a-z0-9][a-z0-9._+-]*$/;
+const FOR_RE = /^(plugin|(skill|hook|mcp):[A-Za-z0-9._/-]+)$/;
+const CHECK_RE = /^\/[a-z0-9-]+:[a-z0-9-]+( [^\n]+)?$/;
+const MIN_RE = /^\d+(\.\d+)*$/;
+const MODULE_RE = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/;
+const NPM_RE = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const ENV_RE = /^[A-Za-z_]\w*$/;
+const OPTION_RE = /^[A-Z0-9_]+$/;
+const SERVER_RE = /^[A-Za-z0-9._-]+$/;
+const MANAGER_RE = /^[a-z][a-z0-9-]*$/;
+const PROBE_TIMEOUT_MS = 5000;
+const LOCAL_BIN_DEPTH = 8;
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const isText = (v) => typeof v === "string" && v.trim() !== "";
+const isTextList = (v) => Array.isArray(v) && v.length > 0 && v.every(isText);
+
+function keysErrors(obj, allowed, where) {
+  return Object.keys(obj)
+    .filter((k) => !allowed.includes(k))
+    .map((k) => `${where}: unknown key "${k}"`);
+}
+
+function patternErrors(pattern, where, needsGroup) {
+  if (!isText(pattern)) return [`${where}.pattern must be a non-empty string`];
+  try {
+    const groups = new RegExp(`${pattern}|`).exec("").length - 1;
+    if (needsGroup && groups < 1) return [`${where}.pattern needs a capture group for the version`];
+  } catch (err) {
+    return [`${where}.pattern is not a valid regular expression: ${err.message}`];
+  }
+  return [];
+}
+
+function relativePathErrors(list, where) {
+  if (!isTextList(list)) return [`${where} must be a non-empty list of paths`];
+  return list
+    .filter((p) => path.isAbsolute(p) || p.split(/[\\/]/).includes(".."))
+    .map((p) => `${where}: "${p}" must be relative and stay inside its base`);
+}
+
+function detectErrors(kind, detect, where) {
+  if (!isObject(detect)) return [`${where} must be an object`];
+  const shape = DETECT_KEYS[kind];
+  const errors = keysErrors(detect, [...shape.required, ...shape.optional], where);
+  for (const key of shape.required) {
+    if (!(key in detect)) errors.push(`${where}.${key} is required for kind ${kind}`);
+  }
+  if ("any" in detect && !isTextList(detect.any)) errors.push(`${where}.any must be a non-empty list of names`);
+  if ("local_bin" in detect) errors.push(...relativePathErrors(detect.local_bin, `${where}.local_bin`));
+  if ("version" in detect) {
+    const v = detect.version;
+    const vw = `${where}.version`;
+    if (!isObject(v)) {
+      errors.push(`${vw} must be an object`);
+    } else {
+      errors.push(...keysErrors(v, ["args", "pattern", "min"], vw));
+      if (!Array.isArray(v.args) || !v.args.every((a) => typeof a === "string")) {
+        errors.push(`${vw}.args must be a list of strings`);
+      }
+      errors.push(...patternErrors(v.pattern, vw, true));
+      if (typeof v.min !== "string" || !MIN_RE.test(v.min))
+        errors.push(`${vw}.min must be a dotted number such as 2.94.0`);
+    }
+  }
+  if ("probe" in detect) {
+    const p = detect.probe;
+    const pw = `${where}.probe`;
+    if (!isObject(p)) {
+      errors.push(`${pw} must be an object`);
+    } else {
+      errors.push(...keysErrors(p, ["args", "pattern"], pw));
+      if (!isTextList(p.args)) errors.push(`${pw}.args must be a non-empty list; the first item is the binary`);
+      errors.push(...patternErrors(p.pattern, pw, false));
+    }
+  }
+  if ("import" in detect && !(typeof detect.import === "string" && MODULE_RE.test(detect.import))) {
+    errors.push(`${where}.import must be a Python module name`);
+  }
+  if ("module" in detect && !(typeof detect.module === "string" && NPM_RE.test(detect.module))) {
+    errors.push(`${where}.module must be an npm package name`);
+  }
+  if ("paths" in detect) {
+    // A path is relative to the plugin root, or starts with ${CLAUDE_PLUGIN_ROOT} or ${CLAUDE_PLUGIN_DATA}.
+    const strip = (p) => (typeof p === "string" ? p.replace(/^\$\{CLAUDE_PLUGIN_(DATA|ROOT)\}\/?/, "") || "." : p);
+    errors.push(
+      ...relativePathErrors(Array.isArray(detect.paths) ? detect.paths.map(strip) : detect.paths, `${where}.paths`),
+    );
+  }
+  if ("name" in detect && !(typeof detect.name === "string" && ENV_RE.test(detect.name))) {
+    errors.push(`${where}.name must be an environment variable name`);
+  }
+  if ("server" in detect && !(typeof detect.server === "string" && SERVER_RE.test(detect.server))) {
+    errors.push(`${where}.server must be an MCP server name`);
+  }
+  return errors;
+}
+
+function entryErrors(entry, where) {
+  if (!isObject(entry)) return [`${where} must be an object`];
+  const errors = keysErrors(entry, ENTRY_KEYS, where);
+  for (const key of ENTRY_KEYS) {
+    if (!(key in entry)) errors.push(`${where}.${key} is required`);
+  }
+  if ("id" in entry && !(typeof entry.id === "string" && ID_RE.test(entry.id))) {
+    errors.push(`${where}.id must match ${ID_RE.source}`);
+  }
+  if ("kind" in entry && !KINDS.includes(entry.kind)) errors.push(`${where}.kind must be one of ${KINDS.join(", ")}`);
+  if ("need" in entry && !NEEDS.includes(entry.need)) errors.push(`${where}.need must be one of ${NEEDS.join(", ")}`);
+  if ("for" in entry) {
+    const scopes = entry.for;
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      errors.push(`${where}.for must be a non-empty list`);
+    } else {
+      for (const s of scopes) {
+        if (typeof s !== "string" || !FOR_RE.test(s)) {
+          errors.push(`${where}.for: "${s}" must be plugin, skill:<name>, hook:<script> or mcp:<server>`);
+        }
+      }
+      if (new Set(scopes).size !== scopes.length) errors.push(`${where}.for repeats a scope`);
+    }
+  }
+  if ("detect" in entry && KINDS.includes(entry.kind))
+    errors.push(...detectErrors(entry.kind, entry.detect, `${where}.detect`));
+  if ("degrade" in entry && !isText(entry.degrade)) errors.push(`${where}.degrade must say what stops working`);
+  if ("install" in entry) {
+    const inst = entry.install;
+    if (!isObject(inst) || Object.keys(inst).length === 0) {
+      errors.push(`${where}.install must be an object with at least one hint`);
+    } else {
+      for (const [k, v] of Object.entries(inst)) {
+        if (!MANAGER_RE.test(k)) errors.push(`${where}.install: "${k}" is not a package-manager key`);
+        if (!isText(v)) errors.push(`${where}.install.${k} must be a non-empty string`);
+      }
+    }
+  }
+  if ("check" in entry && !(typeof entry.check === "string" && CHECK_RE.test(entry.check))) {
+    errors.push(`${where}.check must name a skill, such as /<plugin>:check`);
+  }
+  return errors;
+}
+
+// validateManifest(value) -> list of schema errors; empty means valid.
+export function validateManifest(manifest) {
+  if (!isObject(manifest)) return ["the manifest must be a JSON object"];
+  const errors = keysErrors(manifest, ["$schema", "requires"], "manifest");
+  if ("$schema" in manifest && typeof manifest.$schema !== "string") errors.push("manifest.$schema must be a string");
+  if (!Array.isArray(manifest.requires) || manifest.requires.length === 0) {
+    errors.push("manifest.requires must be a non-empty list");
+    return errors;
+  }
+  const seen = new Set();
+  manifest.requires.forEach((entry, i) => {
+    errors.push(...entryErrors(entry, `requires[${i}]`));
+    if (isObject(entry) && typeof entry.id === "string") {
+      if (seen.has(entry.id)) errors.push(`requires[${i}].id "${entry.id}" is declared twice`);
+      seen.add(entry.id);
+    }
+  });
+  return errors;
+}
+
+// loadManifest(root) -> { plugin, manifest, errors, absent }
+export function loadManifest(root) {
+  let plugin = path.basename(path.resolve(root));
+  try {
+    const name = JSON.parse(readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8")).name;
+    if (isText(name)) plugin = name;
+  } catch {
+    // The directory name stands in when plugin.json is absent or unreadable.
+  }
+  const file = path.join(root, "prerequisites.json");
+  if (!existsSync(file)) return { plugin, manifest: null, errors: [], absent: true };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    return { plugin, manifest: null, errors: [`prerequisites.json is not valid JSON: ${err.message}`], absent: false };
+  }
+  return { plugin, manifest, errors: validateManifest(manifest), absent: false };
+}
+
+// compareVersions("2.10", "2.9") -> 1. Missing parts count as 0.
+export function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+function isExecutable(file, platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// which(name) -> absolute path of the first PATH match, or null.
+export function which(name, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
+  for (const dir of pathVar.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (isExecutable(candidate, platform)) return candidate;
+    }
+  }
+  return null;
+}
+
+function findLocalBin(rels, cwd, platform) {
+  for (const rel of rels ?? []) {
+    let dir = path.resolve(cwd);
+    for (let i = 0; i < LOCAL_BIN_DEPTH; i++) {
+      const candidate = path.join(dir, rel);
+      if (isExecutable(candidate, platform)) return candidate;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+function run(file, args) {
+  const r = spawnSync(file, args, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !r.error && r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function firstOnPath(names, ctx) {
+  for (const name of names) {
+    const found = which(name, ctx.env, ctx.platform);
+    if (found) return found;
+  }
+  return null;
+}
+
+// The data directory comes from --data-dir, else the environment. Hooks get
+// CLAUDE_PLUGIN_DATA in their environment; a command run through the Bash tool
+// does not, so a skill passes --data-dir "${CLAUDE_PLUGIN_DATA}" instead.
+function expandPluginPath(p, ctx) {
+  if (p.startsWith("${CLAUDE_PLUGIN_DATA}")) {
+    const data = ctx.dataDir ?? ctx.env.CLAUDE_PLUGIN_DATA;
+    if (!data) return null;
+    return path.join(data, p.slice("${CLAUDE_PLUGIN_DATA}".length));
+  }
+  return path.join(ctx.root, p.replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, ""));
+}
+
+// detectEntry(entry, ctx) -> { status, detail }. status is present, missing,
+// outdated (below the version floor), unverified (the version could not be
+// read) or agent-check (an MCP server only the agent can see).
+export function detectEntry(entry, ctx) {
+  const d = entry.detect;
+  switch (entry.kind) {
+    case "cli":
+    case "runtime": {
+      const found = firstOnPath(d.any, ctx) ?? findLocalBin(d.local_bin, ctx.cwd, ctx.platform);
+      if (!found) {
+        const where = d.local_bin ? `on PATH or as ${d.local_bin.join(", ")}` : "on PATH";
+        return { status: "missing", detail: `${d.any.join(" or ")} was not found ${where}` };
+      }
+      if (!d.version) return { status: "present", detail: found };
+      const match = new RegExp(d.version.pattern).exec(run(found, d.version.args).out);
+      if (!match?.[1] || !MIN_RE.test(match[1])) {
+        return { status: "unverified", detail: `${found}: could not read a version to compare with ${d.version.min}` };
+      }
+      if (compareVersions(match[1], d.version.min) < 0) {
+        return { status: "outdated", detail: `${found} is ${match[1]}; ${d.version.min} or newer is needed` };
+      }
+      return { status: "present", detail: `${found} ${match[1]}` };
+    }
+    case "system-lib": {
+      const [bin, ...args] = d.probe.args;
+      const found = which(bin, ctx.env, ctx.platform);
+      if (!found) return { status: "missing", detail: `${bin} was not found on PATH to probe` };
+      if (new RegExp(d.probe.pattern).test(run(found, args).out)) return { status: "present", detail: found };
+      return { status: "missing", detail: `${bin} ${args.join(" ")} did not report ${d.probe.pattern}` };
+    }
+    case "python-pkg": {
+      const found = firstOnPath(d.any, ctx);
+      if (!found) return { status: "missing", detail: `no Python interpreter (${d.any.join(", ")}) on PATH` };
+      if (run(found, ["-c", `import ${d.import}`]).ok)
+        return { status: "present", detail: `${found} imports ${d.import}` };
+      return { status: "missing", detail: `${found} cannot import ${d.import}` };
+    }
+    case "node-pkg": {
+      let unresolved = false;
+      for (const p of d.paths) {
+        const dir = expandPluginPath(p, ctx);
+        unresolved ||= dir === null;
+        if (dir && existsSync(path.join(dir, d.module, "package.json"))) {
+          return { status: "present", detail: path.join(dir, d.module) };
+        }
+      }
+      if (unresolved) {
+        return {
+          status: "unverified",
+          detail: `${d.module}: the plugin data directory is unknown here; pass --data-dir`,
+        };
+      }
+      return { status: "missing", detail: `${d.module} is not installed under ${d.paths.join(", ")}` };
+    }
+    case "env":
+      return ctx.env[d.name]
+        ? { status: "present", detail: `${d.name} is set` }
+        : { status: "missing", detail: `${d.name} is not set` };
+    case "mcp":
+      return { status: "agent-check", detail: `only the agent can see whether MCP server ${d.server} is connected` };
+    default:
+      return { status: "missing", detail: `unknown kind ${entry.kind}` };
+  }
+}
+
+const isFailure = (status) => status === "missing" || status === "outdated";
+
+function installText(entry) {
+  return Object.entries(entry.install)
+    .map(([k, v]) => `${k}: ${v}`)
+    .join("; ");
+}
+
+function remediation(entry) {
+  return `${entry.degrade} Install (${installText(entry)}). Then run ${entry.check}.`;
+}
+
+function inScope(entry, scope) {
+  return !scope || entry.for.includes("plugin") || entry.for.includes(scope);
+}
+
+const USAGE = [
+  "usage: prerequisites.mjs report --plugin-root <dir> [--plugin-root <dir>...]",
+  "       prerequisites.mjs check <plugin-root> [--for <scope>] [--data-dir <dir>]",
+  "       prerequisites.mjs probe <plugin-root> [--run-if-unset-or-true <OPTION>]",
+].join("\n");
+
+class UsageError extends Error {}
+
+function parseArgs(argv) {
+  const [mode, ...rest] = argv;
+  if (!["report", "check", "probe"].includes(mode))
+    throw new UsageError(mode ? `unknown mode: ${mode}` : "no mode given");
+  const opts = { mode, roots: [], scope: null, dataDir: null, gate: null };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--plugin-root" && mode === "report") {
+      if (!rest[i + 1]) throw new UsageError("--plugin-root needs a directory");
+      opts.roots.push(rest[++i]);
+    } else if (arg === "--for" && mode === "check") {
+      if (!rest[i + 1] || !FOR_RE.test(rest[i + 1])) throw new UsageError("--for needs a scope such as skill:<name>");
+      opts.scope = rest[++i];
+    } else if (arg === "--data-dir" && mode === "check") {
+      if (!rest[i + 1]) throw new UsageError("--data-dir needs a directory");
+      opts.dataDir = rest[++i];
+    } else if (arg === "--run-if-unset-or-true" && mode === "probe") {
+      if (!rest[i + 1] || !OPTION_RE.test(rest[i + 1])) {
+        throw new UsageError("--run-if-unset-or-true needs the option name in capitals, such as BIOME_FORMAT_ENABLED");
+      }
+      opts.gate = rest[++i];
+    } else if (!arg.startsWith("--") && mode !== "report" && opts.roots.length === 0) {
+      opts.roots.push(arg);
+    } else {
+      throw new UsageError(`unexpected argument: ${arg}`);
+    }
+  }
+  if (opts.roots.length === 0) throw new UsageError(`${mode} needs a plugin root`);
+  for (const root of opts.roots) {
+    if (!existsSync(root) || !statSync(root).isDirectory()) throw new UsageError(`not a directory: ${root}`);
+  }
+  return opts;
+}
+
+function readHookInput(stdin) {
+  try {
+    const raw = stdin();
+    const id = JSON.parse(raw || "{}").session_id;
+    return typeof id === "string" && id ? id.replace(/[^A-Za-z0-9_-]/g, "-") : "no-session";
+  } catch {
+    return "no-session";
+  }
+}
+
+// Once per session per entry, with the marker name hook::notice_once uses for
+// its prerequisite class, so a bash probe and this one share a latch.
+function firstNoticeThisSession(plugin, id, session, env) {
+  if (!env.CLAUDE_PLUGIN_DATA) return true;
+  const dir = path.join(env.CLAUDE_PLUGIN_DATA, "skip-notices");
+  const marker = path.join(dir, `${plugin}-${id}.${session}.session`);
+  try {
+    if (existsSync(marker)) return false;
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(marker, "1\n");
+  } catch {
+    // An unwritable data directory still gets the notice.
+  }
+  return true;
+}
+
+function cmdCheck(opts, ctx, out) {
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) {
+    out.stdout(`${plugin}: no prerequisites.json; this plugin declares no external dependency.`);
+    return 0;
+  }
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const local = { ...ctx, root, dataDir: opts.dataDir };
+  const counts = { failed: 0, warned: 0, passed: 0 };
+  for (const entry of manifest.requires.filter((e) => inScope(e, opts.scope))) {
+    const { status, detail } = detectEntry(entry, local);
+    const label = `${entry.id} (${entry.kind}, ${entry.need})`;
+    if (status === "present") {
+      counts.passed++;
+      out.stdout(`PASS  ${label}: ${detail}`);
+    } else if (status === "agent-check") {
+      out.stdout(`INFO  ${label}: ${detail}. Check the session's tool list; if it is absent: ${remediation(entry)}`);
+    } else if (status === "unverified") {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}`);
+    } else if (entry.need === "required") {
+      counts.failed++;
+      out.stdout(`FAIL  ${label}: ${detail}. ${remediation(entry)}`);
+    } else {
+      counts.warned++;
+      out.stdout(`WARN  ${label}: ${detail}. ${remediation(entry)}`);
+    }
+  }
+  out.stdout(`${plugin}: failed=${counts.failed} warned=${counts.warned} passed=${counts.passed}`);
+  return counts.failed ? 1 : 0;
+}
+
+// report(roots, ctx, out) -> exit code. The fleet table for any number of plugin roots,
+// none included; ctx needs env, platform and cwd.
+export function report(roots, ctx, out) {
+  out.stdout(["plugin", "id", "kind", "need", "status", "check", "install"].join("\t"));
+  let missing = 0;
+  let present = 0;
+  let requiredMissing = false;
+  let invalid = false;
+  for (const root of roots) {
+    const { plugin, manifest, errors, absent } = loadManifest(root);
+    if (absent) continue;
+    if (errors.length) {
+      invalid = true;
+      out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+      continue;
+    }
+    for (const entry of manifest.requires) {
+      const { status } = detectEntry(entry, { ...ctx, root });
+      if (isFailure(status)) {
+        missing++;
+        if (entry.need === "required") requiredMissing = true;
+      } else if (status === "present") {
+        present++;
+      }
+      out.stdout([plugin, entry.id, entry.kind, entry.need, status, entry.check, installText(entry)].join("\t"));
+    }
+  }
+  out.stdout(`missing=${missing} present=${present}`);
+  if (invalid) return 2;
+  return requiredMissing ? 1 : 0;
+}
+
+function cmdReport(opts, ctx, out) {
+  return report(opts.roots, ctx, out);
+}
+
+function cmdProbe(opts, ctx, out) {
+  if (opts.gate) {
+    const value = ctx.env[`CLAUDE_PLUGIN_OPTION_${opts.gate}`];
+    if (value !== undefined && value !== "" && value !== "true") return 0;
+  }
+  const root = opts.roots[0];
+  const { plugin, manifest, errors, absent } = loadManifest(root);
+  if (absent) return 0;
+  if (errors.length) {
+    out.stderr(`${plugin}: prerequisites.json fails the schema:\n  ${errors.join("\n  ")}`);
+    return 2;
+  }
+  const session = readHookInput(ctx.stdin);
+  const notices = [];
+  for (const entry of manifest.requires.filter((e) => e.for.some((s) => s.startsWith("hook:")))) {
+    const { status, detail } = detectEntry(entry, { ...ctx, root });
+    if (!isFailure(status) || !firstNoticeThisSession(plugin, entry.id, session, ctx.env)) continue;
+    notices.push(
+      `${plugin}: ${detail}. Hooks that need ${entry.id} skip until it is installed. ${remediation(entry)} It does not install.`,
+    );
+  }
+  if (notices.length) {
+    const msg = notices.join("\n");
+    out.stdout(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: msg },
+        systemMessage: msg,
+      }),
+    );
+  }
+  return 0;
+}
+
+// main(argv, ctx, out) -> exit code. ctx and out are injectable for tests.
+export function main(argv, ctx = {}, out = {}) {
+  const context = {
+    env: ctx.env ?? process.env,
+    platform: ctx.platform ?? process.platform,
+    cwd: ctx.cwd ?? process.cwd(),
+    stdin: ctx.stdin ?? (() => (process.stdin.isTTY ? "" : readFileSync(0, "utf8"))),
+  };
+  const io = { stdout: out.stdout ?? ((s) => console.log(s)), stderr: out.stderr ?? ((s) => console.error(s)) };
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    io.stderr(`prerequisites.mjs: ${err.message}\n${USAGE}`);
+    return 2;
+  }
+  if (opts.mode === "report") return cmdReport(opts, context, io);
+  if (opts.mode === "check") return cmdCheck(opts, context, io);
+  return cmdProbe(opts, context, io);
+}
+
+// Node realpaths the main entry, so compare real paths: a launch through a
+// symlinked checkout path must still reach main().
+function realPath(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+if (process.argv[1] && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
+  process.exitCode = main(process.argv.slice(2));
+}
diff --git a/plugins/typos-format/lib/prerequisites.ps1 b/plugins/typos-format/lib/prerequisites.ps1
new file mode 100644
index 0000000000..008c281646
--- /dev/null
+++ b/plugins/typos-format/lib/prerequisites.ps1
@@ -0,0 +1,14 @@
+# GENERATED from lib/prerequisites.ps1 by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   pwsh -NoProfile -File prerequisites.ps1 check <plugin-root> [--for <scope>]
+$node = Get-Command -Name node -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($null -eq $node) {
+    [Console]::Out.WriteLine('prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again.')
+    exit 1
+}
+& $node.Source (Join-Path -Path $PSScriptRoot -ChildPath 'prerequisites.mjs') @args
+exit $LASTEXITCODE
diff --git a/plugins/typos-format/lib/prerequisites.sh b/plugins/typos-format/lib/prerequisites.sh
new file mode 100755
index 0000000000..007f00d6c7
--- /dev/null
+++ b/plugins/typos-format/lib/prerequisites.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# GENERATED from lib/prerequisites.sh by scripts/sync-shared-copies.sh. Do not edit this copy:
+# edit the canonical source, then rerun the script.
+# Run prerequisites.mjs from this directory with the same arguments and exit code.
+# Without node on PATH, print one fixed line and exit 1, because the checker
+# cannot run and node is itself a missing required dependency.
+#
+#   sh prerequisites.sh check <plugin-root> [--for <scope>]
+if command -v node >/dev/null 2>&1; then
+  case "$0" in
+  */*) here="${0%/*}" ;;
+  *) here=. ;;
+  esac
+  exec node "$here/prerequisites.mjs" "$@"
+fi
+echo "prerequisites: node was not found on PATH, so no prerequisite was checked. Install Node.js from https://nodejs.org/en/download, then run this check again."
+exit 1
diff --git a/plugins/typos-format/prerequisites.json b/plugins/typos-format/prerequisites.json
index 7b57bb6703..be057073f5 100644
--- a/plugins/typos-format/prerequisites.json
+++ b/plugins/typos-format/prerequisites.json
@@ -1,19 +1,59 @@
 {
-  "tools": [
+  "requires": [
     {
-      "name": "typos",
-      "check": "/typos-format:check",
-      "install": "cargo install typos-cli, a host package or a release binary, https://github.com/crate-ci/typos#install"
+      "id": "typos",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:typos-format.sh"
+      ],
+      "detect": {
+        "any": [
+          "typos"
+        ]
+      },
+      "degrade": "Without typos, the hook cannot spell-check edited files; edits still go through.",
+      "install": {
+        "cargo": "cargo install typos-cli",
+        "docs": "https://github.com/crate-ci/typos#install"
+      },
+      "check": "/typos-format:check"
     },
     {
-      "name": "jq",
-      "check": "/typos-format:check",
-      "install": "install jq from https://jqlang.org/download/"
+      "id": "jq",
+      "kind": "cli",
+      "need": "required",
+      "for": [
+        "hook:typos-format.sh"
+      ],
+      "detect": {
+        "any": [
+          "jq"
+        ]
+      },
+      "degrade": "Without jq, the typos-format hooks skip their work for the session and say so once.",
+      "install": {
+        "docs": "https://jqlang.org/download/"
+      },
+      "check": "/typos-format:check"
     },
     {
-      "name": "node",
-      "check": "/typos-format:check",
-      "install": "install Node.js from https://nodejs.org/en/download"
+      "id": "node",
+      "kind": "runtime",
+      "need": "required",
+      "for": [
+        "plugin"
+      ],
+      "detect": {
+        "any": [
+          "node"
+        ]
+      },
+      "degrade": "Without node, the typos-format hooks cannot launch, so they do nothing.",
+      "install": {
+        "docs": "https://nodejs.org/en/download"
+      },
+      "check": "/typos-format:check"
     }
   ]
 }
diff --git a/scripts/check-prerequisite-probes.test.sh b/scripts/check-prerequisite-probes.test.sh
deleted file mode 100755
index b8d543f8d9..0000000000
--- a/scripts/check-prerequisite-probes.test.sh
+++ /dev/null
@@ -1,86 +0,0 @@
-#!/usr/bin/env bash
-# Every plugins/*/hooks/probe-prerequisite.sh must agree with its plugin's
-# prerequisites.json: the probe hardcodes no tool name or install text, reports
-# each declared tool (name, check, install) when it is missing, stays silent
-# when it is present, and installs nothing.
-set -uo pipefail
-
-REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-FAILED=0
-CASES=0
-pass() { CASES=$((CASES + 1)); printf 'PASS: %s\n' "$1"; }
-fail() { CASES=$((CASES + 1)); FAILED=$((FAILED + 1)); printf 'FAIL: %s\n' "$1" >&2; }
-
-WORK="$(mktemp -d)"
-trap 'rm -rf "$WORK"' EXIT
-
-# A PATH holding the system tools but none of the declared binaries.
-mapfile -t DECLARED < <(jq -r '.tools[].name' "$REPO"/plugins/*/prerequisites.json | sort -u)
-declare -A IS_DECLARED=()
-for name in "${DECLARED[@]}"; do IS_DECLARED[$name]=1; done
-mkdir -p "$WORK/sysbin" "$WORK/stubs" "$WORK/cwd"
-for dir in /usr/local/bin /usr/bin /bin; do
-  for exe in "$dir"/*; do
-    base="${exe##*/}"
-    [[ -x "$exe" && ! -e "$WORK/sysbin/$base" ]] || continue
-    [[ -n "${IS_DECLARED[$base]:-}" ]] && continue
-    ln -s "$exe" "$WORK/sysbin/$base"
-  done
-done
-for name in "${DECLARED[@]}"; do
-  printf '#!/bin/sh\nexit 0\n' >"$WORK/stubs/$name"
-  chmod +x "$WORK/stubs/$name"
-done
-
-probes=("$REPO"/plugins/*/hooks/probe-prerequisite.sh)
-[[ -e "${probes[0]}" ]] || { echo "no probes found" >&2; exit 1; }
-first="${probes[0]}"
-
-for probe in "${probes[@]}"; do
-  root="${probe%/hooks/*}"
-  plugin="${root##*/}"
-  manifest="$root/prerequisites.json"
-  if [[ ! -f "$manifest" ]]; then
-    fail "$plugin: probe has no prerequisites.json"
-    continue
-  fi
-  if cmp -s "$probe" "$first"; then
-    pass "$plugin: probe is the shared manifest reader"
-  else
-    fail "$plugin: probe differs from ${first#"$REPO"/}"
-  fi
-  if grep -qE '(npm|pnpm|yarn|go|pip|brew|winget)[[:space:]]+(i|install|add|get)([[:space:]]|$)|npx ' "$probe"; then
-    fail "$plugin: probe contains an install command"
-  else
-    pass "$plugin: probe contains no install command"
-  fi
-
-  data="$WORK/data-$plugin"
-  out="$(cd "$WORK/cwd" && PATH="$WORK/sysbin" CLAUDE_PLUGIN_DATA="$data" \
-    bash "$probe" <<<'{"session_id":"s1"}' 2>&1)"
-  while IFS=$'\t' read -r name check install; do
-    for want in "$name" "$check" "$install"; do
-      if [[ "$out" == *"$want"* ]]; then
-        pass "$plugin: missing $name notice names '$want'"
-      else
-        fail "$plugin: missing $name notice lacks '$want' (got: $out)"
-      fi
-    done
-  done < <(jq -r '.tools[] | [.name, .check, .install] | @tsv' "$manifest")
-  if [[ "$(printf '%s\n' "$out" | jq -s 'length' 2>/dev/null)" == 1 ]]; then
-    pass "$plugin: every missing tool is reported in one hook document"
-  else
-    fail "$plugin: expected exactly one JSON document on stdout, got: $out"
-  fi
-
-  out="$(cd "$WORK/cwd" && PATH="$WORK/stubs:$WORK/sysbin" CLAUDE_PLUGIN_DATA="$WORK/data2-$plugin" \
-    bash "$probe" <<<'{"session_id":"s1"}' 2>&1)"
-  if [[ -z "$out" ]]; then
-    pass "$plugin: silent when every declared tool is present"
-  else
-    fail "$plugin: expected no output with tools present, got: $out"
-  fi
-done
-
-printf '%d cases, %d failed\n' "$CASES" "$FAILED"
-exit $((FAILED > 0 ? 1 : 0))
diff --git a/scripts/cross-plugin-source-registry.txt b/scripts/cross-plugin-source-registry.txt
index ed23cc2efc..c703f38c16 100644
--- a/scripts/cross-plugin-source-registry.txt
+++ b/scripts/cross-plugin-source-registry.txt
@@ -68,11 +68,6 @@ lib/parse-concern-value.sh -> plugins/*/skills/*/scripts/parse-concern-value.sh
 # plugins' context/ to fix a drift failure.
 context/recommendation-basis.md
 
-# Dedicated check: scripts/check-prerequisite-probes.test.sh fails when a copy
-# differs. It reads the plugin's prerequisites.json, so the copies stay
-# identical; copy any one of them over the others to fix a drift failure.
-hooks/probe-prerequisite.sh
-
 # No dedicated check: the telemetry-sink test helper each carrying plugin
 # ships, because only the plugin directory installs. Canonical copy:
 # lib/hook-test-sink.sh; copy it into the other plugins to fix a drift failure.
diff --git a/scripts/prerequisites-baseline.txt b/scripts/prerequisites-baseline.txt
index b3c0b2f517..30a68095f7 100644
--- a/scripts/prerequisites-baseline.txt
+++ b/scripts/prerequisites-baseline.txt
@@ -3,10 +3,6 @@
 # any other gap is a tool its files run that the plugin does not declare.
 # Generated by `node scripts/check-declared-prerequisites.mjs --write-baseline`.
 # Remove a row by declaring the tool; the gate fails on a row with no gap behind it.
-actionlint actionlint
-actionlint jq
-actionlint node
-actionlint schema
 ai-briefing node
 ai-briefing npm
 ai-slop jq
@@ -17,16 +13,6 @@ animation node
 animation python3
 architecture npx
 attribution jq
-autonomy jq
-autonomy schema
-bash-format jq
-bash-format node
-bash-format schema
-bash-format shellcheck
-bash-format shfmt
-biome-format biome
-biome-format jq
-biome-format schema
 code-metrics go
 code-metrics node
 code-metrics py
@@ -36,29 +22,15 @@ code-tidying gh
 code-tidying pwsh
 code-tidying python3
 context-budget claude
-context-budget node
 context-budget npm
-context-budget schema
-context-guard jq
-context-guard node
-context-guard schema
-context7 ctx7
 context7 npm
 context7 npx
-context7 schema
-desktop-notification jq
-desktop-notification node
-desktop-notification schema
 disk-hygiene gh
-disk-hygiene schema
 docs-hygiene claude
 docs-hygiene jq
 docs-naming jq
 dometrain claude
 dometrain curl
-eol-normalizer jq
-eol-normalizer node
-eol-normalizer schema
 evals claude
 evals python3
 firecrawl curl
@@ -67,14 +39,7 @@ firecrawl jq
 firecrawl npm
 gaming pwsh
 go-format go
-go-format goimports
-go-format jq
-go-format node
-go-format schema
 guardrails gh
-guardrails jq
-guardrails node
-guardrails schema
 harness-config claude
 harness-config curl
 harness-config jq
@@ -83,12 +48,9 @@ harness-ops claude
 harness-ops curl
 harness-ops duckdb
 harness-ops gh
-harness-ops jq
-harness-ops node
 harness-ops npm
 harness-ops npx
 harness-ops python3
-harness-ops schema
 instruction-placement curl
 instruction-placement jq
 kindle-dedrm curl
@@ -104,9 +66,6 @@ machine-health dotnet
 machine-health node
 machine-health python
 machine-health python3
-markdown-format jq
-markdown-format markdownlint-cli2
-markdown-format schema
 mcp-tools jq
 miro claude
 miro npm
@@ -123,17 +82,9 @@ playbooks yarn
 playwright jq
 playwright npm
 playwright npx
-playwright playwright-cli
-playwright schema
 plugin-quality curl
 plugin-quality gh
 plugin-quality jq
-powershell-format jq
-powershell-format pwsh
-powershell-format schema
-rate-limit-guard jq
-rate-limit-guard node
-rate-limit-guard schema
 repo-fleet-hygiene gh
 repo-fleet-hygiene jq
 repo-fleet-hygiene python3
@@ -142,30 +93,18 @@ repo-hygiene jq
 retro-audio python3
 review gh
 review python3
-ruff-format jq
-ruff-format ruff
-ruff-format schema
 session-flow claude
 session-flow gh
-session-flow jq
 session-flow python3
-session-flow schema
 skill-quality jq
 skill-quality npx
 songwriting curl
 songwriting jq
 source-control claude
 source-control gh
-source-control jq
 source-control py
 source-control python
 source-control python3
-source-control schema
-testing jq
-testing schema
-typos-format jq
-typos-format schema
-typos-format typos
 wizard gh
 work-items curl
 work-items gh
diff --git a/scripts/shared-copies.txt b/scripts/shared-copies.txt
index 53940d159e..de28b23cd1 100644
--- a/scripts/shared-copies.txt
+++ b/scripts/shared-copies.txt
@@ -7,6 +7,72 @@ lib/html-escape.mjs plugins/event-storming/lib/html-escape.mjs
 lib/html-escape.mjs plugins/harness-ops/lib/html-escape.mjs
 lib/html-escape.mjs plugins/knowledge/lib/html-escape.mjs
 lib/html-escape.mjs plugins/review/lib/html-escape.mjs
+lib/prerequisites.mjs plugins/actionlint/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/actionlint/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/actionlint/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/autonomy/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/autonomy/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/autonomy/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/bash-format/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/bash-format/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/bash-format/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/biome-format/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/biome-format/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/biome-format/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/context-budget/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/context-budget/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/context-budget/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/context-guard/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/context-guard/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/context-guard/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/context7/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/context7/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/context7/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/desktop-notification/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/desktop-notification/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/desktop-notification/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/disk-hygiene/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/disk-hygiene/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/disk-hygiene/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/eol-normalizer/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/eol-normalizer/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/eol-normalizer/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/go-format/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/go-format/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/go-format/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/guardrails/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/guardrails/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/guardrails/lib/prerequisites.ps1
 lib/prerequisites.mjs plugins/harness-ops/lib/prerequisites.mjs
 lib/prerequisites.sh plugins/harness-ops/lib/prerequisites.sh
 lib/prerequisites.ps1 plugins/harness-ops/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/markdown-format/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/markdown-format/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/markdown-format/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/multi-agent/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/multi-agent/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/multi-agent/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/playwright/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/playwright/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/playwright/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/powershell-format/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/powershell-format/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/powershell-format/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/rate-limit-guard/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/rate-limit-guard/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/rate-limit-guard/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/ruff-format/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/ruff-format/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/ruff-format/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/session-flow/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/session-flow/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/session-flow/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/source-control/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/source-control/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/source-control/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/testing/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/testing/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/testing/lib/prerequisites.ps1
+lib/prerequisites.mjs plugins/typos-format/lib/prerequisites.mjs
+lib/prerequisites.sh plugins/typos-format/lib/prerequisites.sh
+lib/prerequisites.ps1 plugins/typos-format/lib/prerequisites.ps1

From 61c82aa6fd6fd2f03fcf78af26938987720731d4 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Fri, 2 Oct 2026 23:30:21 -0400
Subject: [PATCH 2/3] fix(harness-ops): mark check-prerequisites.mjs executable
 so the exec-bit check passes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../skills/prerequisites/scripts/check-prerequisites.mjs          | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 mode change 100644 => 100755 plugins/harness-ops/skills/prerequisites/scripts/check-prerequisites.mjs

diff --git a/plugins/harness-ops/skills/prerequisites/scripts/check-prerequisites.mjs b/plugins/harness-ops/skills/prerequisites/scripts/check-prerequisites.mjs
old mode 100644
new mode 100755

From ce0efdf5857f4393e8e4f0820f2f0a93c9ba2b90 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sat, 3 Oct 2026 00:55:53 -0400
Subject: [PATCH 3/3] test(disk-hygiene): allow the shared prerequisites
 checker's one process spawn

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../disk-hygiene/skills/clean/scripts/test_owner_registry.py  | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/plugins/disk-hygiene/skills/clean/scripts/test_owner_registry.py b/plugins/disk-hygiene/skills/clean/scripts/test_owner_registry.py
index 2d1d06af7a..068d179399 100755
--- a/plugins/disk-hygiene/skills/clean/scripts/test_owner_registry.py
+++ b/plugins/disk-hygiene/skills/clean/scripts/test_owner_registry.py
@@ -397,10 +397,12 @@ def spy(self: Path, *args: Any, **kwargs: Any) -> str:
     r"\b(?:rm|rmdir|unlink|rimraf|rmSync|unlinkSync|Remove-Item|child_process)\b"
     r"|\s-delete\b"
 )
-# What the launchers already do: remove a cache temp file, spawn bash.
+# What the launchers already do: remove a cache temp file, spawn bash. The
+# shared prerequisites checker spawns each declared detect command.
 LAUNCHER_ACTIONS = {
     PLUGIN / "hooks" / "run-python-hook.sh": 2,
     PLUGIN / "hooks" / "exec-bash.mjs": 1,
+    PLUGIN / "lib" / "prerequisites.mjs": 1,
 }
 SHIPPED = sorted(
     path