@hasna/skills 0.10.10 → 0.10.13

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.10",
+  version: "0.10.13",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -40984,6 +40984,196 @@ export default async ({ directory }) => {
 // src/lib/agent-codex.ts
 import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
 var CODEX_SKILL_CONFIG_SECTIONS = /^\[\[skills\.config\]\][^\n]*(?:\n(?!\s*\[)[^\n]*)*/gm;
+var codexPathConfigRefusal = () => new Error("Codex skill path controls require ordinary [[skills.config]] TOML tables or a native single-line inline array; preserve and review unsupported inline, dotted, or malformed definitions before running skills hook install");
+function splitTopLevel(value, delimiter) {
+  const result = [];
+  let start = 0, square = 0, curly = 0, quote2 = null, escaped = false;
+  for (let index = 0;index < value.length; index++) {
+    const char = value[index];
+    if (quote2 === "double") {
+      if (escaped)
+        escaped = false;
+      else if (char === "\\")
+        escaped = true;
+      else if (char === '"')
+        quote2 = null;
+      continue;
+    }
+    if (quote2 === "literal") {
+      if (char === "'")
+        quote2 = null;
+      continue;
+    }
+    if (char === '"') {
+      quote2 = "double";
+      continue;
+    }
+    if (char === "'") {
+      quote2 = "literal";
+      continue;
+    }
+    if (char === "[")
+      square++;
+    else if (char === "]") {
+      if (--square < 0)
+        return null;
+    } else if (char === "{")
+      curly++;
+    else if (char === "}") {
+      if (--curly < 0)
+        return null;
+    } else if (char === delimiter && square === 0 && curly === 0) {
+      result.push(value.slice(start, index));
+      start = index + 1;
+    }
+  }
+  if (quote2 !== null || square !== 0 || curly !== 0)
+    return null;
+  result.push(value.slice(start));
+  return result;
+}
+function inlineArrayEnd(value) {
+  if (!value.startsWith("["))
+    return null;
+  let square = 0, curly = 0, quote2 = null, escaped = false;
+  for (let index = 0;index < value.length; index++) {
+    const char = value[index];
+    if (quote2 === "double") {
+      if (escaped)
+        escaped = false;
+      else if (char === "\\")
+        escaped = true;
+      else if (char === '"')
+        quote2 = null;
+      continue;
+    }
+    if (quote2 === "literal") {
+      if (char === "'")
+        quote2 = null;
+      continue;
+    }
+    if (char === '"') {
+      quote2 = "double";
+      continue;
+    }
+    if (char === "'") {
+      quote2 = "literal";
+      continue;
+    }
+    if (char === "[")
+      square++;
+    else if (char === "]") {
+      if (--square < 0)
+        return null;
+      if (square === 0 && curly === 0)
+        return index;
+    } else if (char === "{")
+      curly++;
+    else if (char === "}") {
+      if (--curly < 0)
+        return null;
+    }
+  }
+  return null;
+}
+function inlineRowsAsTables(value, newline) {
+  const end = inlineArrayEnd(value);
+  if (end === null || value.slice(end + 1).trim() !== "" || value.includes(`
+`) || value.includes("\r"))
+    return null;
+  const elements = splitTopLevel(value.slice(1, end), ",");
+  if (!elements)
+    return null;
+  const rows = elements.map((element) => element.trim()).filter(Boolean);
+  if (rows.length === 0)
+    return "";
+  const sections = [];
+  for (const row of rows) {
+    if (!row.startsWith("{") || !row.endsWith("}"))
+      return null;
+    const fields = splitTopLevel(row.slice(1, -1), ",");
+    if (!fields)
+      return null;
+    const lines = fields.map((field2) => field2.trim()).filter(Boolean);
+    if (lines.some((line) => !/^(?:path|name|enabled)\s*=/.test(line)))
+      return null;
+    const keys2 = lines.map((line) => line.slice(0, line.indexOf("=")).trim());
+    if (new Set(keys2).size !== keys2.length)
+      return null;
+    sections.push(`[[skills.config]]${newline}${lines.join(newline)}${newline}`);
+  }
+  return sections.join("");
+}
+function normalizeCodexInlinePathConfig(text2) {
+  const before = Bun.TOML.parse(text2);
+  if (!Array.isArray(before.skills?.config))
+    return text2;
+  if (before.skills.config.length === 0)
+    throw codexPathConfigRefusal();
+  const expectedWithoutConfig = structuredClone(before);
+  delete expectedWithoutConfig.skills.config;
+  try {
+    if (isDeepStrictEqual4(Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, "")), expectedWithoutConfig))
+      return text2;
+  } catch {}
+  const matches = [];
+  for (const assignment of text2.matchAll(/^([ \t]*config[ \t]*=[ \t]*)(.*?)(\r?)$/gm)) {
+    const rawValue = assignment[2].trimEnd();
+    let quote2 = null, escaped = false, comment = "";
+    for (let index = 0;index < rawValue.length; index++) {
+      const char = rawValue[index];
+      if (quote2 === "double") {
+        if (escaped)
+          escaped = false;
+        else if (char === "\\")
+          escaped = true;
+        else if (char === '"')
+          quote2 = null;
+        continue;
+      }
+      if (quote2 === "literal") {
+        if (char === "'")
+          quote2 = null;
+        continue;
+      }
+      if (char === '"')
+        quote2 = "double";
+      else if (char === "'")
+        quote2 = "literal";
+      else if (char === "#") {
+        comment = rawValue.slice(index);
+        break;
+      }
+    }
+    const value = comment ? rawValue.slice(0, rawValue.length - comment.length).trimEnd() : rawValue;
+    const tableSections = inlineRowsAsTables(value, text2.includes(`\r
+`) ? `\r
+` : `
+`);
+    if (tableSections === null)
+      continue;
+    const start = assignment.index;
+    const end = start + assignment[0].length;
+    const withoutAssignment = text2.slice(0, start) + (comment ? comment : "") + assignment[3] + text2.slice(end);
+    const separator = withoutAssignment.endsWith(`
+`) ? withoutAssignment.endsWith(`
+
+`) ? "" : `
+` : `
+
+`;
+    const candidate2 = withoutAssignment + (tableSections ? separator + tableSections : "");
+    try {
+      const after = Bun.TOML.parse(candidate2);
+      const expected = structuredClone(before);
+      if (isDeepStrictEqual4(after, expected))
+        matches.push(candidate2);
+    } catch {}
+  }
+  if (matches.length !== 1)
+    throw codexPathConfigRefusal();
+  return matches[0];
+}
 function assertCodexPathConfigEditable(text2) {
   const before = Bun.TOML.parse(text2);
   if (before.skills?.config === undefined)
@@ -40994,8 +41184,12 @@ function assertCodexPathConfigEditable(text2) {
     const withoutSections = Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
     if (isDeepStrictEqual4(withoutSections, expected))
       return;
+    const normalized = normalizeCodexInlinePathConfig(text2);
+    const withoutNormalizedSections = Bun.TOML.parse(normalized.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
+    if (isDeepStrictEqual4(withoutNormalizedSections, expected))
+      return;
   } catch {}
-  throw new Error("Codex skill path controls require ordinary [[skills.config]] TOML tables; preserve and convert inline or dotted config arrays before running skills hook install");
+  throw codexPathConfigRefusal();
 }
 function disableCodexBundledSkills(text2) {
   const before = Bun.TOML.parse(text2);
@@ -41100,6 +41294,33 @@ function canonicalAgentPath(path, aliases) {
   const absolute = resolve14(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep4));
   return binding ? join21(binding.target, relative3(binding.alias, absolute)) : absolute;
 }
+function disabledCodexSkillPaths(config, aliases) {
+  const skills = config.skills;
+  if (!skills || typeof skills !== "object" || Array.isArray(skills))
+    return [];
+  const rows = skills.config;
+  if (!Array.isArray(rows))
+    return [];
+  if (rows.some((entry) => !entry || typeof entry !== "object" || Array.isArray(entry) || typeof entry.enabled !== "boolean" || entry.path !== undefined && (typeof entry.path !== "string" || !isAbsolute15(entry.path)) || entry.name !== undefined && typeof entry.name !== "string"))
+    return [];
+  if (rows.some((entry) => entry.name !== undefined))
+    return [];
+  const settings = new Map;
+  for (const entry of rows) {
+    if (typeof entry.path !== "string" || !isAbsolute15(entry.path))
+      continue;
+    let document2;
+    try {
+      document2 = realpathSync4(canonicalAgentPath(entry.path, aliases));
+    } catch {
+      continue;
+    }
+    if (!document2.endsWith(`${sep4}SKILL.md`))
+      continue;
+    settings.set(document2, [...settings.get(document2) ?? [], entry.enabled === false]);
+  }
+  return [...settings].filter(([, values]) => values.length === 1 && values[0] === true).map(([document2]) => dirname14(document2));
+}
 function recheckRootAliases(aliases) {
   for (const binding of aliases) {
     if (!["claude", "codex"].includes(binding.agent) || binding.alias !== join21(binding.home, `.${binding.agent}`))
@@ -41209,6 +41430,9 @@ function projectAncestorDirectories(projects) {
 function inventoryNativeSkills(home = homedir3(), options = {}) {
   if (options.reviewedCacheAlias !== undefined && (!options.includeVendor || !isAbsolute15(options.reviewedCacheAlias) || resolve14(options.reviewedCacheAlias) !== options.reviewedCacheAlias))
     throw new Error("A reviewed cache alias requires vendor inventory and an exact absolute path");
+  if (options.disabledVendorPaths?.some((path) => !isAbsolute15(path) || resolve14(path) !== path))
+    throw new Error("Disabled vendor paths must be exact absolute paths");
+  const disabledVendorPaths = new Set(options.disabledVendorPaths ?? []);
   const aliases = rootAliases(home, options.allowRootAliases);
   const selectedAgents = options.agents ? new Set(options.agents) : undefined;
   const includesAgent = (agent) => !selectedAgents || selectedAgents.has(agent);
@@ -41230,7 +41454,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       throw new Error("Native skill discovery metadata limit exceeded");
   }
   let reviewedCacheAliasFound = false;
-  function verifiedSiblingCacheAlias(path, parent) {
+  function verifiedSiblingCacheAlias(agent, path, parent) {
     const link = readlinkSync3(path), target = resolve14(parent, link);
     if (dirname14(target) !== parent || (isAbsolute15(link) ? link !== target : dirname14(link) !== "."))
       return false;
@@ -41240,9 +41464,13 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
     if (!scan?.complete || scan.entries > maxAliasProofEntries)
       return false;
     if (scan.hasSkills) {
+      const targetSkills = entries.filter((entry) => entry.agent === agent && entry.vendor && (entry.path === target || entry.path.startsWith(target + sep4)));
+      if (path === options.reviewedCacheAlias && targetSkills.length > 0)
+        reviewedCacheAliasFound = true;
+      if (agent === "codex" && targetSkills.length > 0 && targetSkills.every((entry) => disabledVendorPaths.has(entry.path)))
+        return true;
       if (path !== options.reviewedCacheAlias)
         return false;
-      reviewedCacheAliasFound = true;
     }
     return true;
   }
@@ -41301,7 +41529,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       const child = join21(path, name);
       if (isVendor && lstatSync18(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
         const target = statSync5(child, { throwIfNoEntry: false });
-        if (target?.isFile() || pluginCache && target?.isDirectory() && verifiedSiblingCacheAlias(child, path)) {
+        if (target?.isFile() || pluginCache && target?.isDirectory() && verifiedSiblingCacheAlias(agent, child, path)) {
           scan.entries++;
           continue;
         }
@@ -41441,7 +41669,7 @@ function configureHooks(config, agent, command, profileId, nativeReady) {
 }
 function disableCodexSkills(text2, skills, aliases, bridgePath) {
   const bundled = disableCodexBundledSkills(text2);
-  let result = bundled;
+  let result = normalizeCodexInlinePathConfig(bundled);
   const bridgeSelector = (entry) => typeof entry.name === "string" && entry.name.trim() === CLI_BRIDGE_NAME || typeof entry.path === "string" && [resolve14(bridgePath), resolve14(join21(bridgePath, "SKILL.md"))].includes(canonicalAgentPath(entry.path, aliases));
   const previousConfig = Bun.TOML.parse(bundled).skills?.config;
   if (previousConfig !== undefined && (!Array.isArray(previousConfig) || previousConfig.some((entry) => !entry || typeof entry !== "object" || entry.path !== undefined && entry.name !== undefined)))
@@ -41509,7 +41737,8 @@ function planAgentIntegration(options) {
     }
     return resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, retainedReview, canonical: (path) => canonicalAgentPath(path, aliases) });
   });
-  const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases });
+  const codexConfig = options.agents.includes("codex") ? Bun.TOML.parse(readOptional(canonicalAgentPath(join21(home, ".codex", "config.toml"), aliases)) ?? "") : {};
+  const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases, reviewedCacheAlias: options.reviewedCacheAlias, disabledVendorPaths: disabledCodexSkillPaths(codexConfig, aliases) });
   const changes = [];
   for (const agent of [...new Set(options.agents)]) {
     if (!INTEGRATION_AGENTS.includes(agent))
@@ -42031,7 +42260,7 @@ function assertManagedAgentBridge(agent, options = {}) {
   } catch (error) {
     throw new Error(`NATIVE_SKILL_DRIFT: ${error.message}`);
   }
-  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0 });
+  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0, disabledVendorPaths: agent === "codex" ? disabledCodexSkillPaths(codexConfig, aliases) : [] });
   const unexpected = inventory.filter((entry) => visible(entry) && !entry.bridge && !disabledVendorSkill(entry));
   if (unexpected.length) {
     const paths = unexpected.slice(0, 3).map((entry) => {
@@ -63971,9 +64200,9 @@ class PostgresSkillsStore {
   }
   backend = { kind: "postgres", durable: true, label: "postgres" };
   sql;
-  constructor(databaseUrl) {
+  constructor(databaseUrl, connectionOptions = {}) {
     const bunWithSql = Bun;
-    this.sql = new bunWithSql.SQL(databaseUrl, { max: resolvePoolMax() });
+    this.sql = new bunWithSql.SQL(databaseUrl, { max: resolvePoolMax(), ...connectionOptions });
   }
   async verifyConnectivity() {
     try {
@@ -64068,7 +64297,7 @@ class PostgresSkillsStore {
       }
       await tx`
         INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, metadata_json)
-        VALUES (${actor.orgId}, ${actor.userId}, ${actor.apiKeyId}, ${"api_key_scopes_added"}, ${"api_key"}, ${keyId}, ${JSON.stringify({ added: addScopes, scopes: parseJsonArray(updated[0].scopes_json) })}::jsonb)
+        VALUES (${actor.orgId}, ${actor.userId}, ${actor.apiKeyId}, ${"api_key_scopes_added"}, ${"api_key"}, ${keyId}, ${JSON.stringify({ added: addScopes, scopes: parseJsonArray(updated[0].scopes_json) })}::text::jsonb)
       `;
       return { kind: "updated", scopes: parseJsonArray(updated[0].scopes_json) };
     });
@@ -64077,9 +64306,9 @@ class PostgresSkillsStore {
     const current = expectedScopes;
     const scopes = [...current, ...addScopes.filter((scope2) => !current.includes(scope2))];
     return tx`
-      UPDATE api_keys SET scopes_json = ${JSON.stringify(scopes)}::jsonb
+      UPDATE api_keys SET scopes_json = ${JSON.stringify(scopes)}::text::jsonb
       WHERE id = ${keyId} AND org_id = ${orgId} AND revoked_at IS NULL
-        AND scopes_json = ${JSON.stringify(expectedScopes)}::jsonb
+        AND scopes_json = ${JSON.stringify(expectedScopes)}::text::jsonb
       RETURNING scopes_json
     `;
   }
@@ -64139,7 +64368,7 @@ class PostgresSkillsStore {
         operator_task_arn: input.operatorTaskArn,
         target_manifest_digest: input.manifestDigest,
         station_id: input.stationId
-      })}::jsonb)
+      })}::text::jsonb)
       `;
       return { kind: "updated", scopes };
     });

package/dist/server/enrollment-inspection.d.ts

@@ -0,0 +1,26 @@
+export interface EnrollmentInspectionInput {
+    keyId: string;
+    orgId: string;
+    enrollmentOperationId: string;
+    enrollmentManifestDigest: string;
+}
+export interface EnrollmentInspectionResult {
+    status: "inspected";
+    target: {
+        state: "found";
+        scopes: string[];
+    } | {
+        state: "absent" | "revoked" | "mismatched" | "ambiguous";
+    };
+    audit: {
+        state: "absent" | "matching" | "mismatched" | "ambiguous";
+    };
+}
+type InspectionCode = "INVALID_INSPECTION_INPUT" | "POSTGRES_REQUIRED" | "INVALID_INSPECTION_RESULT" | "INSPECTION_FAILED" | "INSPECTION_SCHEMA_UNAVAILABLE" | "INSPECTION_ACCESS_DENIED" | "INSPECTION_WRITE_REFUSED" | "INSPECTION_TIMEOUT" | "INSPECTION_CONNECTION_FAILED";
+export declare class EnrollmentInspectionError extends Error {
+    readonly code: InspectionCode;
+    constructor(code: InspectionCode);
+}
+/** Inspect metadata only. Deliberately does not import or initialize the application store. */
+export declare function inspectEnrollment(databaseUrl: string, input: EnrollmentInspectionInput): Promise<EnrollmentInspectionResult>;
+export {};

package/dist/server/maintenance-entry.d.ts

@@ -1,2 +1,15 @@
 import { Command } from "commander";
+import { type EnrollmentInspectionInput } from "./enrollment-inspection.js";
+type InspectionManifest = EnrollmentInspectionInput & {
+    app: "skills";
+    operation: "inspect-enrollment";
+    manifestVersion: 1;
+    operationId: string;
+    stationId: string;
+    expiresAt: string;
+    manifestDigest: string;
+};
+/** Inspection has its own authorization; a failed enrollment manifest cannot authorize it. */
+export declare function readInspectionManifest(path: string, receiptPath: string): InspectionManifest;
 export declare function registerMaintenance(parent: Command): void;
+export {};

package/dist/server/store.d.ts

@@ -25,6 +25,9 @@ export interface StoreOptions {
  *   - anything else             -> throws, naming what is supported
  */
 export declare function createStore(options?: StoreOptions): Promise<SkillsProductStore>;
+export type OperatorScopeMaintenanceStore = Required<Pick<SkillsProductStore, "inspectOperatorScopeTarget" | "enrollPublishScopeByOperator" | "close">>;
+/** Open only the existing scope-maintenance surface; never initialize or backfill the application store. */
+export declare function openOperatorScopeMaintenance(databaseUrl: string): OperatorScopeMaintenanceStore;
 export declare class MemorySkillsStore implements SkillsProductStore {
     readonly selectionStore: MemorySkillSelectionStore;
     readonly executionGrantStore: MemoryExecutionGrantStore;
@@ -102,7 +105,12 @@ export declare class PostgresSkillsStore implements SkillsProductStore {
     get executionGrantStore(): PostgresExecutionGrantStore;
     readonly backend: StoreBackendInfo;
     private sql;
-    constructor(databaseUrl: string);
+    constructor(databaseUrl: string, connectionOptions?: {
+        max?: number;
+        connectionTimeout?: number;
+        idleTimeout?: number;
+        connection?: Record<string, string>;
+    });
     /**
      * Bun's SQL client connects lazily, so constructing this store proves nothing about
      * the database being there. Without an explicit probe, a wrong host or a down

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.10",
+  "version": "0.10.13",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {