@hasna/skills 0.10.10 → 0.10.13

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.10",
+    version: "0.10.13",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.10",
+  version: "0.10.13",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.10",
+  version: "0.10.13",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -43384,9 +43384,9 @@ class PostgresSkillsStore {
   }
   backend = { kind: "postgres", durable: true, label: "postgres" };
   sql;
-  constructor(databaseUrl) {
+  constructor(databaseUrl, connectionOptions = {}) {
     const bunWithSql = Bun;
-    this.sql = new bunWithSql.SQL(databaseUrl, { max: resolvePoolMax() });
+    this.sql = new bunWithSql.SQL(databaseUrl, { max: resolvePoolMax(), ...connectionOptions });
   }
   async verifyConnectivity() {
     try {
@@ -43481,7 +43481,7 @@ class PostgresSkillsStore {
       }
       await tx`
         INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, metadata_json)
-        VALUES (${actor.orgId}, ${actor.userId}, ${actor.apiKeyId}, ${"api_key_scopes_added"}, ${"api_key"}, ${keyId}, ${JSON.stringify({ added: addScopes, scopes: parseJsonArray(updated[0].scopes_json) })}::jsonb)
+        VALUES (${actor.orgId}, ${actor.userId}, ${actor.apiKeyId}, ${"api_key_scopes_added"}, ${"api_key"}, ${keyId}, ${JSON.stringify({ added: addScopes, scopes: parseJsonArray(updated[0].scopes_json) })}::text::jsonb)
       `;
       return { kind: "updated", scopes: parseJsonArray(updated[0].scopes_json) };
     });
@@ -43490,9 +43490,9 @@ class PostgresSkillsStore {
     const current = expectedScopes;
     const scopes = [...current, ...addScopes.filter((scope2) => !current.includes(scope2))];
     return tx`
-      UPDATE api_keys SET scopes_json = ${JSON.stringify(scopes)}::jsonb
+      UPDATE api_keys SET scopes_json = ${JSON.stringify(scopes)}::text::jsonb
       WHERE id = ${keyId} AND org_id = ${orgId} AND revoked_at IS NULL
-        AND scopes_json = ${JSON.stringify(expectedScopes)}::jsonb
+        AND scopes_json = ${JSON.stringify(expectedScopes)}::text::jsonb
       RETURNING scopes_json
     `;
   }
@@ -43552,7 +43552,7 @@ class PostgresSkillsStore {
         operator_task_arn: input.operatorTaskArn,
         target_manifest_digest: input.manifestDigest,
         station_id: input.stationId
-      })}::jsonb)
+      })}::text::jsonb)
       `;
       return { kind: "updated", scopes };
     });

package/bin/worker.js

@@ -24125,7 +24125,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.10",
+  version: "0.10.13",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -36913,9 +36913,9 @@ class PostgresSkillsStore {
   }
   backend = { kind: "postgres", durable: true, label: "postgres" };
   sql;
-  constructor(databaseUrl) {
+  constructor(databaseUrl, connectionOptions = {}) {
     const bunWithSql = Bun;
-    this.sql = new bunWithSql.SQL(databaseUrl, { max: resolvePoolMax() });
+    this.sql = new bunWithSql.SQL(databaseUrl, { max: resolvePoolMax(), ...connectionOptions });
   }
   async verifyConnectivity() {
     try {
@@ -37010,7 +37010,7 @@ class PostgresSkillsStore {
       }
       await tx`
         INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, metadata_json)
-        VALUES (${actor.orgId}, ${actor.userId}, ${actor.apiKeyId}, ${"api_key_scopes_added"}, ${"api_key"}, ${keyId}, ${JSON.stringify({ added: addScopes, scopes: parseJsonArray(updated[0].scopes_json) })}::jsonb)
+        VALUES (${actor.orgId}, ${actor.userId}, ${actor.apiKeyId}, ${"api_key_scopes_added"}, ${"api_key"}, ${keyId}, ${JSON.stringify({ added: addScopes, scopes: parseJsonArray(updated[0].scopes_json) })}::text::jsonb)
       `;
       return { kind: "updated", scopes: parseJsonArray(updated[0].scopes_json) };
     });
@@ -37019,9 +37019,9 @@ class PostgresSkillsStore {
     const current = expectedScopes;
     const scopes = [...current, ...addScopes.filter((scope) => !current.includes(scope))];
     return tx`
-      UPDATE api_keys SET scopes_json = ${JSON.stringify(scopes)}::jsonb
+      UPDATE api_keys SET scopes_json = ${JSON.stringify(scopes)}::text::jsonb
       WHERE id = ${keyId} AND org_id = ${orgId} AND revoked_at IS NULL
-        AND scopes_json = ${JSON.stringify(expectedScopes)}::jsonb
+        AND scopes_json = ${JSON.stringify(expectedScopes)}::text::jsonb
       RETURNING scopes_json
     `;
   }
@@ -37081,7 +37081,7 @@ class PostgresSkillsStore {
         operator_task_arn: input.operatorTaskArn,
         target_manifest_digest: input.manifestDigest,
         station_id: input.stationId
-      })}::jsonb)
+      })}::text::jsonb)
       `;
       return { kind: "updated", scopes };
     });

package/dist/index.js

@@ -9611,7 +9611,7 @@ import { isAbsolute as isAbsolute11, join as join23, resolve as resolve11 } from
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.10",
+  version: "0.10.13",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -12812,6 +12812,196 @@ function isOwnedCliBridge(path, expectedPaths) {
 // src/lib/agent-codex.ts
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 var CODEX_SKILL_CONFIG_SECTIONS = /^\[\[skills\.config\]\][^\n]*(?:\n(?!\s*\[)[^\n]*)*/gm;
+var codexPathConfigRefusal = () => new Error("Codex skill path controls require ordinary [[skills.config]] TOML tables or a native single-line inline array; preserve and review unsupported inline, dotted, or malformed definitions before running skills hook install");
+function splitTopLevel(value, delimiter) {
+  const result = [];
+  let start = 0, square = 0, curly = 0, quote = null, escaped = false;
+  for (let index = 0;index < value.length; index++) {
+    const char = value[index];
+    if (quote === "double") {
+      if (escaped)
+        escaped = false;
+      else if (char === "\\")
+        escaped = true;
+      else if (char === '"')
+        quote = null;
+      continue;
+    }
+    if (quote === "literal") {
+      if (char === "'")
+        quote = null;
+      continue;
+    }
+    if (char === '"') {
+      quote = "double";
+      continue;
+    }
+    if (char === "'") {
+      quote = "literal";
+      continue;
+    }
+    if (char === "[")
+      square++;
+    else if (char === "]") {
+      if (--square < 0)
+        return null;
+    } else if (char === "{")
+      curly++;
+    else if (char === "}") {
+      if (--curly < 0)
+        return null;
+    } else if (char === delimiter && square === 0 && curly === 0) {
+      result.push(value.slice(start, index));
+      start = index + 1;
+    }
+  }
+  if (quote !== null || square !== 0 || curly !== 0)
+    return null;
+  result.push(value.slice(start));
+  return result;
+}
+function inlineArrayEnd(value) {
+  if (!value.startsWith("["))
+    return null;
+  let square = 0, curly = 0, quote = null, escaped = false;
+  for (let index = 0;index < value.length; index++) {
+    const char = value[index];
+    if (quote === "double") {
+      if (escaped)
+        escaped = false;
+      else if (char === "\\")
+        escaped = true;
+      else if (char === '"')
+        quote = null;
+      continue;
+    }
+    if (quote === "literal") {
+      if (char === "'")
+        quote = null;
+      continue;
+    }
+    if (char === '"') {
+      quote = "double";
+      continue;
+    }
+    if (char === "'") {
+      quote = "literal";
+      continue;
+    }
+    if (char === "[")
+      square++;
+    else if (char === "]") {
+      if (--square < 0)
+        return null;
+      if (square === 0 && curly === 0)
+        return index;
+    } else if (char === "{")
+      curly++;
+    else if (char === "}") {
+      if (--curly < 0)
+        return null;
+    }
+  }
+  return null;
+}
+function inlineRowsAsTables(value, newline) {
+  const end = inlineArrayEnd(value);
+  if (end === null || value.slice(end + 1).trim() !== "" || value.includes(`
+`) || value.includes("\r"))
+    return null;
+  const elements = splitTopLevel(value.slice(1, end), ",");
+  if (!elements)
+    return null;
+  const rows = elements.map((element) => element.trim()).filter(Boolean);
+  if (rows.length === 0)
+    return "";
+  const sections = [];
+  for (const row of rows) {
+    if (!row.startsWith("{") || !row.endsWith("}"))
+      return null;
+    const fields = splitTopLevel(row.slice(1, -1), ",");
+    if (!fields)
+      return null;
+    const lines = fields.map((field) => field.trim()).filter(Boolean);
+    if (lines.some((line) => !/^(?:path|name|enabled)\s*=/.test(line)))
+      return null;
+    const keys = lines.map((line) => line.slice(0, line.indexOf("=")).trim());
+    if (new Set(keys).size !== keys.length)
+      return null;
+    sections.push(`[[skills.config]]${newline}${lines.join(newline)}${newline}`);
+  }
+  return sections.join("");
+}
+function normalizeCodexInlinePathConfig(text2) {
+  const before = Bun.TOML.parse(text2);
+  if (!Array.isArray(before.skills?.config))
+    return text2;
+  if (before.skills.config.length === 0)
+    throw codexPathConfigRefusal();
+  const expectedWithoutConfig = structuredClone(before);
+  delete expectedWithoutConfig.skills.config;
+  try {
+    if (isDeepStrictEqual2(Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, "")), expectedWithoutConfig))
+      return text2;
+  } catch {}
+  const matches = [];
+  for (const assignment of text2.matchAll(/^([ \t]*config[ \t]*=[ \t]*)(.*?)(\r?)$/gm)) {
+    const rawValue = assignment[2].trimEnd();
+    let quote = null, escaped = false, comment = "";
+    for (let index = 0;index < rawValue.length; index++) {
+      const char = rawValue[index];
+      if (quote === "double") {
+        if (escaped)
+          escaped = false;
+        else if (char === "\\")
+          escaped = true;
+        else if (char === '"')
+          quote = null;
+        continue;
+      }
+      if (quote === "literal") {
+        if (char === "'")
+          quote = null;
+        continue;
+      }
+      if (char === '"')
+        quote = "double";
+      else if (char === "'")
+        quote = "literal";
+      else if (char === "#") {
+        comment = rawValue.slice(index);
+        break;
+      }
+    }
+    const value = comment ? rawValue.slice(0, rawValue.length - comment.length).trimEnd() : rawValue;
+    const tableSections = inlineRowsAsTables(value, text2.includes(`\r
+`) ? `\r
+` : `
+`);
+    if (tableSections === null)
+      continue;
+    const start = assignment.index;
+    const end = start + assignment[0].length;
+    const withoutAssignment = text2.slice(0, start) + (comment ? comment : "") + assignment[3] + text2.slice(end);
+    const separator = withoutAssignment.endsWith(`
+`) ? withoutAssignment.endsWith(`
+
+`) ? "" : `
+` : `
+
+`;
+    const candidate = withoutAssignment + (tableSections ? separator + tableSections : "");
+    try {
+      const after = Bun.TOML.parse(candidate);
+      const expected = structuredClone(before);
+      if (isDeepStrictEqual2(after, expected))
+        matches.push(candidate);
+    } catch {}
+  }
+  if (matches.length !== 1)
+    throw codexPathConfigRefusal();
+  return matches[0];
+}
 function assertCodexPathConfigEditable(text2) {
   const before = Bun.TOML.parse(text2);
   if (before.skills?.config === undefined)
@@ -12822,8 +13012,12 @@ function assertCodexPathConfigEditable(text2) {
     const withoutSections = Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
     if (isDeepStrictEqual2(withoutSections, expected))
       return;
+    const normalized = normalizeCodexInlinePathConfig(text2);
+    const withoutNormalizedSections = Bun.TOML.parse(normalized.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
+    if (isDeepStrictEqual2(withoutNormalizedSections, expected))
+      return;
   } catch {}
-  throw new Error("Codex skill path controls require ordinary [[skills.config]] TOML tables; preserve and convert inline or dotted config arrays before running skills hook install");
+  throw codexPathConfigRefusal();
 }
 function disableCodexBundledSkills(text2) {
   const before = Bun.TOML.parse(text2);
@@ -13227,6 +13421,33 @@ function canonicalAgentPath(path, aliases) {
   const absolute = resolve9(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep4));
   return binding ? join16(binding.target, relative4(binding.alias, absolute)) : absolute;
 }
+function disabledCodexSkillPaths(config, aliases) {
+  const skills = config.skills;
+  if (!skills || typeof skills !== "object" || Array.isArray(skills))
+    return [];
+  const rows = skills.config;
+  if (!Array.isArray(rows))
+    return [];
+  if (rows.some((entry) => !entry || typeof entry !== "object" || Array.isArray(entry) || typeof entry.enabled !== "boolean" || entry.path !== undefined && (typeof entry.path !== "string" || !isAbsolute9(entry.path)) || entry.name !== undefined && typeof entry.name !== "string"))
+    return [];
+  if (rows.some((entry) => entry.name !== undefined))
+    return [];
+  const settings = new Map;
+  for (const entry of rows) {
+    if (typeof entry.path !== "string" || !isAbsolute9(entry.path))
+      continue;
+    let document2;
+    try {
+      document2 = realpathSync3(canonicalAgentPath(entry.path, aliases));
+    } catch {
+      continue;
+    }
+    if (!document2.endsWith(`${sep4}SKILL.md`))
+      continue;
+    settings.set(document2, [...settings.get(document2) ?? [], entry.enabled === false]);
+  }
+  return [...settings].filter(([, values]) => values.length === 1 && values[0] === true).map(([document2]) => dirname10(document2));
+}
 function recheckRootAliases(aliases) {
   for (const binding of aliases) {
     if (!["claude", "codex"].includes(binding.agent) || binding.alias !== join16(binding.home, `.${binding.agent}`))
@@ -13336,6 +13557,9 @@ function projectAncestorDirectories(projects) {
 function inventoryNativeSkills(home = homedir2(), options = {}) {
   if (options.reviewedCacheAlias !== undefined && (!options.includeVendor || !isAbsolute9(options.reviewedCacheAlias) || resolve9(options.reviewedCacheAlias) !== options.reviewedCacheAlias))
     throw new Error("A reviewed cache alias requires vendor inventory and an exact absolute path");
+  if (options.disabledVendorPaths?.some((path) => !isAbsolute9(path) || resolve9(path) !== path))
+    throw new Error("Disabled vendor paths must be exact absolute paths");
+  const disabledVendorPaths = new Set(options.disabledVendorPaths ?? []);
   const aliases = rootAliases(home, options.allowRootAliases);
   const selectedAgents = options.agents ? new Set(options.agents) : undefined;
   const includesAgent = (agent) => !selectedAgents || selectedAgents.has(agent);
@@ -13357,7 +13581,7 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
       throw new Error("Native skill discovery metadata limit exceeded");
   }
   let reviewedCacheAliasFound = false;
-  function verifiedSiblingCacheAlias(path, parent) {
+  function verifiedSiblingCacheAlias(agent, path, parent) {
     const link = readlinkSync3(path), target = resolve9(parent, link);
     if (dirname10(target) !== parent || (isAbsolute9(link) ? link !== target : dirname10(link) !== "."))
       return false;
@@ -13367,9 +13591,13 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
     if (!scan?.complete || scan.entries > maxAliasProofEntries)
       return false;
     if (scan.hasSkills) {
+      const targetSkills = entries.filter((entry) => entry.agent === agent && entry.vendor && (entry.path === target || entry.path.startsWith(target + sep4)));
+      if (path === options.reviewedCacheAlias && targetSkills.length > 0)
+        reviewedCacheAliasFound = true;
+      if (agent === "codex" && targetSkills.length > 0 && targetSkills.every((entry) => disabledVendorPaths.has(entry.path)))
+        return true;
       if (path !== options.reviewedCacheAlias)
         return false;
-      reviewedCacheAliasFound = true;
     }
     return true;
   }
@@ -13428,7 +13656,7 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
       const child = join16(path, name);
       if (isVendor && lstatSync14(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
         const target = statSync7(child, { throwIfNoEntry: false });
-        if (target?.isFile() || pluginCache && target?.isDirectory() && verifiedSiblingCacheAlias(child, path)) {
+        if (target?.isFile() || pluginCache && target?.isDirectory() && verifiedSiblingCacheAlias(agent, child, path)) {
           scan.entries++;
           continue;
         }
@@ -13568,7 +13796,7 @@ function configureHooks(config, agent, command, profileId, nativeReady) {
 }
 function disableCodexSkills(text2, skills, aliases, bridgePath) {
   const bundled = disableCodexBundledSkills(text2);
-  let result = bundled;
+  let result = normalizeCodexInlinePathConfig(bundled);
   const bridgeSelector = (entry) => typeof entry.name === "string" && entry.name.trim() === CLI_BRIDGE_NAME || typeof entry.path === "string" && [resolve9(bridgePath), resolve9(join16(bridgePath, "SKILL.md"))].includes(canonicalAgentPath(entry.path, aliases));
   const previousConfig = Bun.TOML.parse(bundled).skills?.config;
   if (previousConfig !== undefined && (!Array.isArray(previousConfig) || previousConfig.some((entry) => !entry || typeof entry !== "object" || entry.path !== undefined && entry.name !== undefined)))
@@ -13636,7 +13864,8 @@ function planAgentIntegration(options) {
     }
     return resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, retainedReview, canonical: (path) => canonicalAgentPath(path, aliases) });
   });
-  const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases });
+  const codexConfig = options.agents.includes("codex") ? Bun.TOML.parse(readOptional(canonicalAgentPath(join16(home, ".codex", "config.toml"), aliases)) ?? "") : {};
+  const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases, reviewedCacheAlias: options.reviewedCacheAlias, disabledVendorPaths: disabledCodexSkillPaths(codexConfig, aliases) });
   const changes = [];
   for (const agent of [...new Set(options.agents)]) {
     if (!INTEGRATION_AGENTS.includes(agent))
@@ -14158,7 +14387,7 @@ function assertManagedAgentBridge(agent, options = {}) {
   } catch (error) {
     throw new Error(`NATIVE_SKILL_DRIFT: ${error.message}`);
   }
-  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0 });
+  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0, disabledVendorPaths: agent === "codex" ? disabledCodexSkillPaths(codexConfig, aliases) : [] });
   const unexpected = inventory.filter((entry) => visible(entry) && !entry.bridge && !disabledVendorSkill(entry));
   if (unexpected.length) {
     const paths = unexpected.slice(0, 3).map((entry) => {

package/dist/lib/agent-codex.d.ts

@@ -1,7 +1,11 @@
 export declare const CODEX_SKILL_CONFIG_SECTIONS: RegExp;
-/** The path editor supports ordinary array-of-table sections only. Removing
- * those sections must remove exactly the parsed path array, with all other
- * values unchanged. This also excludes header-like text inside user strings. */
+/** Convert only Codex's native, single-line inline array representation into
+ * equivalent array-of-table sections. The replacement is accepted only when
+ * the complete parsed TOML value is deeply identical before and after. */
+export declare function normalizeCodexInlinePathConfig(text: string): string;
+/** Removing supported path sections must remove exactly the parsed skill path
+ * array while preserving every other TOML value. Native app-server inline
+ * arrays are first normalized by a targeted, semantically verified edit. */
 export declare function assertCodexPathConfigEditable(text: string): void;
 /** Preserve user TOML verbatim except for the supported bundled-skill control.
  * Bun's parser accepts some illegal table reopenings, so never append a table

package/dist/lib/agent-integration.d.ts

@@ -86,6 +86,7 @@ export declare function inventoryNativeSkills(home?: string, options?: {
     discoveryInputs?: ReviewedDiscoveryInputs;
     allowRootAliases?: boolean;
     reviewedCacheAlias?: string;
+    disabledVendorPaths?: readonly string[];
 }): NativeSkillEntry[];
 /** Planning is read-only; credentials and unrelated settings never appear in CLI output. */
 export declare function planAgentIntegration(options: {
@@ -98,6 +99,7 @@ export declare function planAgentIntegration(options: {
     projectDir?: string;
     discoveryInputs?: ReviewedDiscoveryInputs;
     allowRootAliases?: boolean;
+    reviewedCacheAlias?: string;
 }): AgentIntegrationPlan;
 /** Plan an explicitly authorized Stop hook replacement without adopting drift.
  * The caller owns authorization of its exact Stop hook delta; Skills refuses

package/dist/lib/codex-hook-rpc.d.ts

@@ -1,4 +1,4 @@
-export declare const SUPPORTED_CODEX_HOOK_VERSIONS: readonly ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1"];
+export declare const SUPPORTED_CODEX_HOOK_VERSIONS: readonly ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1", "codex-cli 0.158.0"];
 export interface CodexHookRpc {
     version: string;
     processId?: number;