@hasna/skills 0.10.10 → 0.10.13

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.10",
+    version: "0.10.13",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -50694,6 +50694,195 @@ var init_agent_bridge = __esm(() => {
 
 // src/lib/agent-codex.ts
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
+function splitTopLevel(value, delimiter) {
+  const result2 = [];
+  let start = 0, square = 0, curly = 0, quote = null, escaped = false;
+  for (let index = 0;index < value.length; index++) {
+    const char = value[index];
+    if (quote === "double") {
+      if (escaped)
+        escaped = false;
+      else if (char === "\\")
+        escaped = true;
+      else if (char === '"')
+        quote = null;
+      continue;
+    }
+    if (quote === "literal") {
+      if (char === "'")
+        quote = null;
+      continue;
+    }
+    if (char === '"') {
+      quote = "double";
+      continue;
+    }
+    if (char === "'") {
+      quote = "literal";
+      continue;
+    }
+    if (char === "[")
+      square++;
+    else if (char === "]") {
+      if (--square < 0)
+        return null;
+    } else if (char === "{")
+      curly++;
+    else if (char === "}") {
+      if (--curly < 0)
+        return null;
+    } else if (char === delimiter && square === 0 && curly === 0) {
+      result2.push(value.slice(start, index));
+      start = index + 1;
+    }
+  }
+  if (quote !== null || square !== 0 || curly !== 0)
+    return null;
+  result2.push(value.slice(start));
+  return result2;
+}
+function inlineArrayEnd(value) {
+  if (!value.startsWith("["))
+    return null;
+  let square = 0, curly = 0, quote = null, escaped = false;
+  for (let index = 0;index < value.length; index++) {
+    const char = value[index];
+    if (quote === "double") {
+      if (escaped)
+        escaped = false;
+      else if (char === "\\")
+        escaped = true;
+      else if (char === '"')
+        quote = null;
+      continue;
+    }
+    if (quote === "literal") {
+      if (char === "'")
+        quote = null;
+      continue;
+    }
+    if (char === '"') {
+      quote = "double";
+      continue;
+    }
+    if (char === "'") {
+      quote = "literal";
+      continue;
+    }
+    if (char === "[")
+      square++;
+    else if (char === "]") {
+      if (--square < 0)
+        return null;
+      if (square === 0 && curly === 0)
+        return index;
+    } else if (char === "{")
+      curly++;
+    else if (char === "}") {
+      if (--curly < 0)
+        return null;
+    }
+  }
+  return null;
+}
+function inlineRowsAsTables(value, newline) {
+  const end = inlineArrayEnd(value);
+  if (end === null || value.slice(end + 1).trim() !== "" || value.includes(`
+`) || value.includes("\r"))
+    return null;
+  const elements = splitTopLevel(value.slice(1, end), ",");
+  if (!elements)
+    return null;
+  const rows = elements.map((element) => element.trim()).filter(Boolean);
+  if (rows.length === 0)
+    return "";
+  const sections = [];
+  for (const row of rows) {
+    if (!row.startsWith("{") || !row.endsWith("}"))
+      return null;
+    const fields = splitTopLevel(row.slice(1, -1), ",");
+    if (!fields)
+      return null;
+    const lines = fields.map((field) => field.trim()).filter(Boolean);
+    if (lines.some((line) => !/^(?:path|name|enabled)\s*=/.test(line)))
+      return null;
+    const keys2 = lines.map((line) => line.slice(0, line.indexOf("=")).trim());
+    if (new Set(keys2).size !== keys2.length)
+      return null;
+    sections.push(`[[skills.config]]${newline}${lines.join(newline)}${newline}`);
+  }
+  return sections.join("");
+}
+function normalizeCodexInlinePathConfig(text2) {
+  const before2 = Bun.TOML.parse(text2);
+  if (!Array.isArray(before2.skills?.config))
+    return text2;
+  if (before2.skills.config.length === 0)
+    throw codexPathConfigRefusal();
+  const expectedWithoutConfig = structuredClone(before2);
+  delete expectedWithoutConfig.skills.config;
+  try {
+    if (isDeepStrictEqual3(Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, "")), expectedWithoutConfig))
+      return text2;
+  } catch {}
+  const matches2 = [];
+  for (const assignment of text2.matchAll(/^([ \t]*config[ \t]*=[ \t]*)(.*?)(\r?)$/gm)) {
+    const rawValue = assignment[2].trimEnd();
+    let quote = null, escaped = false, comment = "";
+    for (let index = 0;index < rawValue.length; index++) {
+      const char = rawValue[index];
+      if (quote === "double") {
+        if (escaped)
+          escaped = false;
+        else if (char === "\\")
+          escaped = true;
+        else if (char === '"')
+          quote = null;
+        continue;
+      }
+      if (quote === "literal") {
+        if (char === "'")
+          quote = null;
+        continue;
+      }
+      if (char === '"')
+        quote = "double";
+      else if (char === "'")
+        quote = "literal";
+      else if (char === "#") {
+        comment = rawValue.slice(index);
+        break;
+      }
+    }
+    const value = comment ? rawValue.slice(0, rawValue.length - comment.length).trimEnd() : rawValue;
+    const tableSections = inlineRowsAsTables(value, text2.includes(`\r
+`) ? `\r
+` : `
+`);
+    if (tableSections === null)
+      continue;
+    const start = assignment.index;
+    const end = start + assignment[0].length;
+    const withoutAssignment = text2.slice(0, start) + (comment ? comment : "") + assignment[3] + text2.slice(end);
+    const separator = withoutAssignment.endsWith(`
+`) ? withoutAssignment.endsWith(`
+
+`) ? "" : `
+` : `
+
+`;
+    const candidate = withoutAssignment + (tableSections ? separator + tableSections : "");
+    try {
+      const after2 = Bun.TOML.parse(candidate);
+      const expected = structuredClone(before2);
+      if (isDeepStrictEqual3(after2, expected))
+        matches2.push(candidate);
+    } catch {}
+  }
+  if (matches2.length !== 1)
+    throw codexPathConfigRefusal();
+  return matches2[0];
+}
 function assertCodexPathConfigEditable(text2) {
   const before2 = Bun.TOML.parse(text2);
   if (before2.skills?.config === undefined)
@@ -50704,8 +50893,12 @@ function assertCodexPathConfigEditable(text2) {
     const withoutSections = Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
     if (isDeepStrictEqual3(withoutSections, expected))
       return;
+    const normalized = normalizeCodexInlinePathConfig(text2);
+    const withoutNormalizedSections = Bun.TOML.parse(normalized.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
+    if (isDeepStrictEqual3(withoutNormalizedSections, expected))
+      return;
   } catch {}
-  throw new Error("Codex skill path controls require ordinary [[skills.config]] TOML tables; preserve and convert inline or dotted config arrays before running skills hook install");
+  throw codexPathConfigRefusal();
 }
 function disableCodexBundledSkills(text2) {
   const before2 = Bun.TOML.parse(text2);
@@ -50764,7 +50957,7 @@ function disableCodexBundledSkills(text2) {
     throw refuse();
   return [...candidates][0];
 }
-var CODEX_SKILL_CONFIG_SECTIONS;
+var CODEX_SKILL_CONFIG_SECTIONS, codexPathConfigRefusal = () => new Error("Codex skill path controls require ordinary [[skills.config]] TOML tables or a native single-line inline array; preserve and review unsupported inline, dotted, or malformed definitions before running skills hook install");
 var init_agent_codex = __esm(() => {
   CODEX_SKILL_CONFIG_SECTIONS = /^\[\[skills\.config\]\][^\n]*(?:\n(?!\s*\[)[^\n]*)*/gm;
 });
@@ -51082,6 +51275,33 @@ function canonicalAgentPath(path, aliases) {
   const absolute = resolve10(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep4));
   return binding ? join20(binding.target, relative4(binding.alias, absolute)) : absolute;
 }
+function disabledCodexSkillPaths(config, aliases) {
+  const skills = config.skills;
+  if (!skills || typeof skills !== "object" || Array.isArray(skills))
+    return [];
+  const rows = skills.config;
+  if (!Array.isArray(rows))
+    return [];
+  if (rows.some((entry) => !entry || typeof entry !== "object" || Array.isArray(entry) || typeof entry.enabled !== "boolean" || entry.path !== undefined && (typeof entry.path !== "string" || !isAbsolute9(entry.path)) || entry.name !== undefined && typeof entry.name !== "string"))
+    return [];
+  if (rows.some((entry) => entry.name !== undefined))
+    return [];
+  const settings = new Map;
+  for (const entry of rows) {
+    if (typeof entry.path !== "string" || !isAbsolute9(entry.path))
+      continue;
+    let document3;
+    try {
+      document3 = realpathSync3(canonicalAgentPath(entry.path, aliases));
+    } catch {
+      continue;
+    }
+    if (!document3.endsWith(`${sep4}SKILL.md`))
+      continue;
+    settings.set(document3, [...settings.get(document3) ?? [], entry.enabled === false]);
+  }
+  return [...settings].filter(([, values2]) => values2.length === 1 && values2[0] === true).map(([document3]) => dirname10(document3));
+}
 function recheckRootAliases(aliases) {
   for (const binding of aliases) {
     if (!["claude", "codex"].includes(binding.agent) || binding.alias !== join20(binding.home, `.${binding.agent}`))
@@ -51238,6 +51458,9 @@ function projectAncestorDirectories(projects) {
 function inventoryNativeSkills(home = homedir3(), options = {}) {
   if (options.reviewedCacheAlias !== undefined && (!options.includeVendor || !isAbsolute9(options.reviewedCacheAlias) || resolve10(options.reviewedCacheAlias) !== options.reviewedCacheAlias))
     throw new Error("A reviewed cache alias requires vendor inventory and an exact absolute path");
+  if (options.disabledVendorPaths?.some((path) => !isAbsolute9(path) || resolve10(path) !== path))
+    throw new Error("Disabled vendor paths must be exact absolute paths");
+  const disabledVendorPaths = new Set(options.disabledVendorPaths ?? []);
   const aliases = rootAliases(home, options.allowRootAliases);
   const selectedAgents = options.agents ? new Set(options.agents) : undefined;
   const includesAgent = (agent) => !selectedAgents || selectedAgents.has(agent);
@@ -51259,7 +51482,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       throw new Error("Native skill discovery metadata limit exceeded");
   }
   let reviewedCacheAliasFound = false;
-  function verifiedSiblingCacheAlias(path, parent) {
+  function verifiedSiblingCacheAlias(agent, path, parent) {
     const link2 = readlinkSync3(path), target = resolve10(parent, link2);
     if (dirname10(target) !== parent || (isAbsolute9(link2) ? link2 !== target : dirname10(link2) !== "."))
       return false;
@@ -51269,9 +51492,13 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
     if (!scan?.complete || scan.entries > maxAliasProofEntries)
       return false;
     if (scan.hasSkills) {
+      const targetSkills = entries.filter((entry) => entry.agent === agent && entry.vendor && (entry.path === target || entry.path.startsWith(target + sep4)));
+      if (path === options.reviewedCacheAlias && targetSkills.length > 0)
+        reviewedCacheAliasFound = true;
+      if (agent === "codex" && targetSkills.length > 0 && targetSkills.every((entry) => disabledVendorPaths.has(entry.path)))
+        return true;
       if (path !== options.reviewedCacheAlias)
         return false;
-      reviewedCacheAliasFound = true;
     }
     return true;
   }
@@ -51330,7 +51557,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       const child = join20(path, name);
       if (isVendor && lstatSync14(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
         const target = statSync7(child, { throwIfNoEntry: false });
-        if (target?.isFile() || pluginCache && target?.isDirectory() && verifiedSiblingCacheAlias(child, path)) {
+        if (target?.isFile() || pluginCache && target?.isDirectory() && verifiedSiblingCacheAlias(agent, child, path)) {
           scan.entries++;
           continue;
         }
@@ -51470,7 +51697,7 @@ function configureHooks(config, agent, command, profileId, nativeReady) {
 }
 function disableCodexSkills(text2, skills, aliases, bridgePath) {
   const bundled = disableCodexBundledSkills(text2);
-  let result2 = bundled;
+  let result2 = normalizeCodexInlinePathConfig(bundled);
   const bridgeSelector = (entry) => typeof entry.name === "string" && entry.name.trim() === CLI_BRIDGE_NAME || typeof entry.path === "string" && [resolve10(bridgePath), resolve10(join20(bridgePath, "SKILL.md"))].includes(canonicalAgentPath(entry.path, aliases));
   const previousConfig = Bun.TOML.parse(bundled).skills?.config;
   if (previousConfig !== undefined && (!Array.isArray(previousConfig) || previousConfig.some((entry) => !entry || typeof entry !== "object" || entry.path !== undefined && entry.name !== undefined)))
@@ -51538,7 +51765,8 @@ function planAgentIntegration(options) {
     }
     return resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, retainedReview, canonical: (path) => canonicalAgentPath(path, aliases) });
   });
-  const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases });
+  const codexConfig = options.agents.includes("codex") ? Bun.TOML.parse(readOptional(canonicalAgentPath(join20(home, ".codex", "config.toml"), aliases)) ?? "") : {};
+  const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases, reviewedCacheAlias: options.reviewedCacheAlias, disabledVendorPaths: disabledCodexSkillPaths(codexConfig, aliases) });
   const changes = [];
   for (const agent of [...new Set(options.agents)]) {
     if (!INTEGRATION_AGENTS.includes(agent))
@@ -51979,7 +52207,7 @@ function assertManagedAgentBridge(agent, options = {}) {
   } catch (error) {
     throw new Error(`NATIVE_SKILL_DRIFT: ${error.message}`);
   }
-  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0 });
+  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0, disabledVendorPaths: agent === "codex" ? disabledCodexSkillPaths(codexConfig, aliases) : [] });
   const unexpected = inventory.filter((entry) => visible(entry) && !entry.bridge && !disabledVendorSkill(entry));
   if (unexpected.length) {
     const paths = unexpected.slice(0, 3).map((entry) => {
@@ -110588,7 +110816,7 @@ async function connectCodexHookRpc(options) {
 }
 var SUPPORTED_CODEX_HOOK_VERSIONS;
 var init_codex_hook_rpc = __esm(() => {
-  SUPPORTED_CODEX_HOOK_VERSIONS = ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1"];
+  SUPPORTED_CODEX_HOOK_VERSIONS = ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1", "codex-cli 0.158.0"];
 });
 
 // src/lib/codex-hook-trust-identity.ts
@@ -111179,10 +111407,10 @@ function registerAgentIntegration(parent) {
   hook.command("agents").option("--json", "Output the adapter capability inventory", false).description("Show maintained native adapters and explicit coverage limits").action(async () => {
     await writeCliOutput(JSON.stringify({ agents: INTEGRATION_AGENTS.map((agent) => ({ agent, bridge: true, ...AGENT_ADAPTERS[agent] })), inventoryOnly: ["codewith", "windsurf", "pi", "amp", "cline", "roo", "copilot"], limitations: ["Cursor prompt hooks gate submission; selected context is injected at session start only.", "Native discovery checks cover known home roots and current project ancestors. External plugin hook injection and arbitrary added directories require separate review.", "Hermes injects selected prompt context, but native pre_llm_call fails open. Exact native hook trust, bundled reseeding opt-out, native payload retirement and a supervised pre-tool guard are required. Child failures block explicitly; native host/supervisor death is not a universal fail-closed guarantee.", "Restart agents and use their normal hook trust controls after installation."] }, null, 2));
   });
-  hook.command("install").option("--agent <agent>", `Agent to configure: ${INTEGRATION_AGENTS.join(", ")}, all`, "all").option("--command <path>", "Skills executable used by the hook (preserves existing binding; new agents use skills)").option("--selection-profile <id>", "Selection profile (preserves existing binding; new agents use default)").option("--include-vendor", "Retained for compatibility; vendor system skills are always inventoried and disabled", false).option("--discovery-inputs <file>", "Advanced reviewed active plugin roots and source hashes for unsupported registrations").option("--allow-root-aliases", "Allow home .claude/.codex aliases to existing directories within this home", false).option("--apply", "Apply the plan, preserving prior configuration in private backups", false).option("--json", "Output a receipt as JSON", false).description("Plan or install one Skills CLI bridge plus native prompt hooks").action(async (options) => {
+  hook.command("install").option("--agent <agent>", `Agent to configure: ${INTEGRATION_AGENTS.join(", ")}, all`, "all").option("--command <path>", "Skills executable used by the hook (preserves existing binding; new agents use skills)").option("--selection-profile <id>", "Selection profile (preserves existing binding; new agents use default)").option("--include-vendor", "Retained for compatibility; vendor system skills are always inventoried and disabled", false).option("--discovery-inputs <file>", "Advanced reviewed active plugin roots and source hashes for unsupported registrations").option("--reviewed-cache-alias <path>", "Exact skill-containing vendor cache alias reviewed for this hook plan").option("--allow-root-aliases", "Allow home .claude/.codex aliases to existing directories within this home", false).option("--apply", "Apply the plan, preserving prior configuration in private backups", false).option("--json", "Output a receipt as JSON", false).description("Plan or install one Skills CLI bridge plus native prompt hooks").action(async (options) => {
     try {
       const discoveryInputs = options.discoveryInputs ? JSON.parse(readFileSync41(options.discoveryInputs, "utf8")) : undefined;
-      const plan = planAgentIntegration({ agents: agents(options.agent), command: options.command, profileId: options.selectionProfile, includeVendor: options.includeVendor, discoveryInputs, allowRootAliases: options.allowRootAliases });
+      const plan = planAgentIntegration({ agents: agents(options.agent), command: options.command, profileId: options.selectionProfile, includeVendor: options.includeVendor, discoveryInputs, allowRootAliases: options.allowRootAliases, reviewedCacheAlias: options.reviewedCacheAlias });
       const result2 = options.apply ? applyAgentIntegration(plan) : { changed: [], backups: [] };
       const receipt = { applied: options.apply, planned: plan.changes.map((change) => change.path), ...result2, rootAliases: plan.rootAliases ?? [], discovery: plan.discoveryAfter, nativeSkills: plan.nativeSkills.map((entry) => ({ agent: entry.agent, path: entry.path, managed: entry.managed, vendor: entry.vendor, system: entry.system === true, bridge: entry.bridge === true })), requiresNativeRetirement: plan.nativeSkills.some((entry) => !entry.bridge && !entry.system) };
       if (options.json)