@hasna/skills 0.10.11 → 0.10.14

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.11",
+    version: "0.10.14",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.11",
+  version: "0.10.14",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.11",
+  version: "0.10.14",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -43384,9 +43384,9 @@ class PostgresSkillsStore {
   }
   backend = { kind: "postgres", durable: true, label: "postgres" };
   sql;
-  constructor(databaseUrl) {
+  constructor(databaseUrl, connectionOptions = {}) {
     const bunWithSql = Bun;
-    this.sql = new bunWithSql.SQL(databaseUrl, { max: resolvePoolMax() });
+    this.sql = new bunWithSql.SQL(databaseUrl, { max: resolvePoolMax(), ...connectionOptions });
   }
   async verifyConnectivity() {
     try {
@@ -43481,7 +43481,7 @@ class PostgresSkillsStore {
       }
       await tx`
         INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, metadata_json)
-        VALUES (${actor.orgId}, ${actor.userId}, ${actor.apiKeyId}, ${"api_key_scopes_added"}, ${"api_key"}, ${keyId}, ${JSON.stringify({ added: addScopes, scopes: parseJsonArray(updated[0].scopes_json) })}::jsonb)
+        VALUES (${actor.orgId}, ${actor.userId}, ${actor.apiKeyId}, ${"api_key_scopes_added"}, ${"api_key"}, ${keyId}, ${JSON.stringify({ added: addScopes, scopes: parseJsonArray(updated[0].scopes_json) })}::text::jsonb)
       `;
       return { kind: "updated", scopes: parseJsonArray(updated[0].scopes_json) };
     });
@@ -43489,10 +43489,12 @@ class PostgresSkillsStore {
   async casUpdateApiKeyScopes(tx, keyId, orgId, expectedScopes, addScopes) {
     const current = expectedScopes;
     const scopes = [...current, ...addScopes.filter((scope2) => !current.includes(scope2))];
+    const expectedScopesJson = JSON.stringify(expectedScopes);
     return tx`
-      UPDATE api_keys SET scopes_json = ${JSON.stringify(scopes)}::jsonb
+      UPDATE api_keys SET scopes_json = ${JSON.stringify(scopes)}::text::jsonb
       WHERE id = ${keyId} AND org_id = ${orgId} AND revoked_at IS NULL
-        AND scopes_json = ${JSON.stringify(expectedScopes)}::jsonb
+        AND (scopes_json = ${expectedScopesJson}::text::jsonb
+          OR scopes_json = to_jsonb(${expectedScopesJson}::text))
       RETURNING scopes_json
     `;
   }
@@ -43552,7 +43554,7 @@ class PostgresSkillsStore {
         operator_task_arn: input.operatorTaskArn,
         target_manifest_digest: input.manifestDigest,
         station_id: input.stationId
-      })}::jsonb)
+      })}::text::jsonb)
       `;
       return { kind: "updated", scopes };
     });

package/bin/worker.js

@@ -24125,7 +24125,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.11",
+  version: "0.10.14",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -36913,9 +36913,9 @@ class PostgresSkillsStore {
   }
   backend = { kind: "postgres", durable: true, label: "postgres" };
   sql;
-  constructor(databaseUrl) {
+  constructor(databaseUrl, connectionOptions = {}) {
     const bunWithSql = Bun;
-    this.sql = new bunWithSql.SQL(databaseUrl, { max: resolvePoolMax() });
+    this.sql = new bunWithSql.SQL(databaseUrl, { max: resolvePoolMax(), ...connectionOptions });
   }
   async verifyConnectivity() {
     try {
@@ -37010,7 +37010,7 @@ class PostgresSkillsStore {
       }
       await tx`
         INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, metadata_json)
-        VALUES (${actor.orgId}, ${actor.userId}, ${actor.apiKeyId}, ${"api_key_scopes_added"}, ${"api_key"}, ${keyId}, ${JSON.stringify({ added: addScopes, scopes: parseJsonArray(updated[0].scopes_json) })}::jsonb)
+        VALUES (${actor.orgId}, ${actor.userId}, ${actor.apiKeyId}, ${"api_key_scopes_added"}, ${"api_key"}, ${keyId}, ${JSON.stringify({ added: addScopes, scopes: parseJsonArray(updated[0].scopes_json) })}::text::jsonb)
       `;
       return { kind: "updated", scopes: parseJsonArray(updated[0].scopes_json) };
     });
@@ -37018,10 +37018,12 @@ class PostgresSkillsStore {
   async casUpdateApiKeyScopes(tx, keyId, orgId, expectedScopes, addScopes) {
     const current = expectedScopes;
     const scopes = [...current, ...addScopes.filter((scope) => !current.includes(scope))];
+    const expectedScopesJson = JSON.stringify(expectedScopes);
     return tx`
-      UPDATE api_keys SET scopes_json = ${JSON.stringify(scopes)}::jsonb
+      UPDATE api_keys SET scopes_json = ${JSON.stringify(scopes)}::text::jsonb
       WHERE id = ${keyId} AND org_id = ${orgId} AND revoked_at IS NULL
-        AND scopes_json = ${JSON.stringify(expectedScopes)}::jsonb
+        AND (scopes_json = ${expectedScopesJson}::text::jsonb
+          OR scopes_json = to_jsonb(${expectedScopesJson}::text))
       RETURNING scopes_json
     `;
   }
@@ -37081,7 +37083,7 @@ class PostgresSkillsStore {
         operator_task_arn: input.operatorTaskArn,
         target_manifest_digest: input.manifestDigest,
         station_id: input.stationId
-      })}::jsonb)
+      })}::text::jsonb)
       `;
       return { kind: "updated", scopes };
     });

package/dist/index.js

@@ -9611,7 +9611,7 @@ import { isAbsolute as isAbsolute11, join as join23, resolve as resolve11 } from
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.11",
+  version: "0.10.14",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -12812,6 +12812,196 @@ function isOwnedCliBridge(path, expectedPaths) {
 // src/lib/agent-codex.ts
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 var CODEX_SKILL_CONFIG_SECTIONS = /^\[\[skills\.config\]\][^\n]*(?:\n(?!\s*\[)[^\n]*)*/gm;
+var codexPathConfigRefusal = () => new Error("Codex skill path controls require ordinary [[skills.config]] TOML tables or a native single-line inline array; preserve and review unsupported inline, dotted, or malformed definitions before running skills hook install");
+function splitTopLevel(value, delimiter) {
+  const result = [];
+  let start = 0, square = 0, curly = 0, quote = null, escaped = false;
+  for (let index = 0;index < value.length; index++) {
+    const char = value[index];
+    if (quote === "double") {
+      if (escaped)
+        escaped = false;
+      else if (char === "\\")
+        escaped = true;
+      else if (char === '"')
+        quote = null;
+      continue;
+    }
+    if (quote === "literal") {
+      if (char === "'")
+        quote = null;
+      continue;
+    }
+    if (char === '"') {
+      quote = "double";
+      continue;
+    }
+    if (char === "'") {
+      quote = "literal";
+      continue;
+    }
+    if (char === "[")
+      square++;
+    else if (char === "]") {
+      if (--square < 0)
+        return null;
+    } else if (char === "{")
+      curly++;
+    else if (char === "}") {
+      if (--curly < 0)
+        return null;
+    } else if (char === delimiter && square === 0 && curly === 0) {
+      result.push(value.slice(start, index));
+      start = index + 1;
+    }
+  }
+  if (quote !== null || square !== 0 || curly !== 0)
+    return null;
+  result.push(value.slice(start));
+  return result;
+}
+function inlineArrayEnd(value) {
+  if (!value.startsWith("["))
+    return null;
+  let square = 0, curly = 0, quote = null, escaped = false;
+  for (let index = 0;index < value.length; index++) {
+    const char = value[index];
+    if (quote === "double") {
+      if (escaped)
+        escaped = false;
+      else if (char === "\\")
+        escaped = true;
+      else if (char === '"')
+        quote = null;
+      continue;
+    }
+    if (quote === "literal") {
+      if (char === "'")
+        quote = null;
+      continue;
+    }
+    if (char === '"') {
+      quote = "double";
+      continue;
+    }
+    if (char === "'") {
+      quote = "literal";
+      continue;
+    }
+    if (char === "[")
+      square++;
+    else if (char === "]") {
+      if (--square < 0)
+        return null;
+      if (square === 0 && curly === 0)
+        return index;
+    } else if (char === "{")
+      curly++;
+    else if (char === "}") {
+      if (--curly < 0)
+        return null;
+    }
+  }
+  return null;
+}
+function inlineRowsAsTables(value, newline) {
+  const end = inlineArrayEnd(value);
+  if (end === null || value.slice(end + 1).trim() !== "" || value.includes(`
+`) || value.includes("\r"))
+    return null;
+  const elements = splitTopLevel(value.slice(1, end), ",");
+  if (!elements)
+    return null;
+  const rows = elements.map((element) => element.trim()).filter(Boolean);
+  if (rows.length === 0)
+    return "";
+  const sections = [];
+  for (const row of rows) {
+    if (!row.startsWith("{") || !row.endsWith("}"))
+      return null;
+    const fields = splitTopLevel(row.slice(1, -1), ",");
+    if (!fields)
+      return null;
+    const lines = fields.map((field) => field.trim()).filter(Boolean);
+    if (lines.some((line) => !/^(?:path|name|enabled)\s*=/.test(line)))
+      return null;
+    const keys = lines.map((line) => line.slice(0, line.indexOf("=")).trim());
+    if (new Set(keys).size !== keys.length)
+      return null;
+    sections.push(`[[skills.config]]${newline}${lines.join(newline)}${newline}`);
+  }
+  return sections.join("");
+}
+function normalizeCodexInlinePathConfig(text2) {
+  const before = Bun.TOML.parse(text2);
+  if (!Array.isArray(before.skills?.config))
+    return text2;
+  if (before.skills.config.length === 0)
+    throw codexPathConfigRefusal();
+  const expectedWithoutConfig = structuredClone(before);
+  delete expectedWithoutConfig.skills.config;
+  try {
+    if (isDeepStrictEqual2(Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, "")), expectedWithoutConfig))
+      return text2;
+  } catch {}
+  const matches = [];
+  for (const assignment of text2.matchAll(/^([ \t]*config[ \t]*=[ \t]*)(.*?)(\r?)$/gm)) {
+    const rawValue = assignment[2].trimEnd();
+    let quote = null, escaped = false, comment = "";
+    for (let index = 0;index < rawValue.length; index++) {
+      const char = rawValue[index];
+      if (quote === "double") {
+        if (escaped)
+          escaped = false;
+        else if (char === "\\")
+          escaped = true;
+        else if (char === '"')
+          quote = null;
+        continue;
+      }
+      if (quote === "literal") {
+        if (char === "'")
+          quote = null;
+        continue;
+      }
+      if (char === '"')
+        quote = "double";
+      else if (char === "'")
+        quote = "literal";
+      else if (char === "#") {
+        comment = rawValue.slice(index);
+        break;
+      }
+    }
+    const value = comment ? rawValue.slice(0, rawValue.length - comment.length).trimEnd() : rawValue;
+    const tableSections = inlineRowsAsTables(value, text2.includes(`\r
+`) ? `\r
+` : `
+`);
+    if (tableSections === null)
+      continue;
+    const start = assignment.index;
+    const end = start + assignment[0].length;
+    const withoutAssignment = text2.slice(0, start) + (comment ? comment : "") + assignment[3] + text2.slice(end);
+    const separator = withoutAssignment.endsWith(`
+`) ? withoutAssignment.endsWith(`
+
+`) ? "" : `
+` : `
+
+`;
+    const candidate = withoutAssignment + (tableSections ? separator + tableSections : "");
+    try {
+      const after = Bun.TOML.parse(candidate);
+      const expected = structuredClone(before);
+      if (isDeepStrictEqual2(after, expected))
+        matches.push(candidate);
+    } catch {}
+  }
+  if (matches.length !== 1)
+    throw codexPathConfigRefusal();
+  return matches[0];
+}
 function assertCodexPathConfigEditable(text2) {
   const before = Bun.TOML.parse(text2);
   if (before.skills?.config === undefined)
@@ -12822,8 +13012,12 @@ function assertCodexPathConfigEditable(text2) {
     const withoutSections = Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
     if (isDeepStrictEqual2(withoutSections, expected))
       return;
+    const normalized = normalizeCodexInlinePathConfig(text2);
+    const withoutNormalizedSections = Bun.TOML.parse(normalized.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
+    if (isDeepStrictEqual2(withoutNormalizedSections, expected))
+      return;
   } catch {}
-  throw new Error("Codex skill path controls require ordinary [[skills.config]] TOML tables; preserve and convert inline or dotted config arrays before running skills hook install");
+  throw codexPathConfigRefusal();
 }
 function disableCodexBundledSkills(text2) {
   const before = Bun.TOML.parse(text2);
@@ -13398,11 +13592,12 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
       return false;
     if (scan.hasSkills) {
       const targetSkills = entries.filter((entry) => entry.agent === agent && entry.vendor && (entry.path === target || entry.path.startsWith(target + sep4)));
+      if (path === options.reviewedCacheAlias && targetSkills.length > 0)
+        reviewedCacheAliasFound = true;
       if (agent === "codex" && targetSkills.length > 0 && targetSkills.every((entry) => disabledVendorPaths.has(entry.path)))
         return true;
       if (path !== options.reviewedCacheAlias)
         return false;
-      reviewedCacheAliasFound = true;
     }
     return true;
   }
@@ -13601,7 +13796,7 @@ function configureHooks(config, agent, command, profileId, nativeReady) {
 }
 function disableCodexSkills(text2, skills, aliases, bridgePath) {
   const bundled = disableCodexBundledSkills(text2);
-  let result = bundled;
+  let result = normalizeCodexInlinePathConfig(bundled);
   const bridgeSelector = (entry) => typeof entry.name === "string" && entry.name.trim() === CLI_BRIDGE_NAME || typeof entry.path === "string" && [resolve9(bridgePath), resolve9(join16(bridgePath, "SKILL.md"))].includes(canonicalAgentPath(entry.path, aliases));
   const previousConfig = Bun.TOML.parse(bundled).skills?.config;
   if (previousConfig !== undefined && (!Array.isArray(previousConfig) || previousConfig.some((entry) => !entry || typeof entry !== "object" || entry.path !== undefined && entry.name !== undefined)))
@@ -13670,7 +13865,7 @@ function planAgentIntegration(options) {
     return resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, retainedReview, canonical: (path) => canonicalAgentPath(path, aliases) });
   });
   const codexConfig = options.agents.includes("codex") ? Bun.TOML.parse(readOptional(canonicalAgentPath(join16(home, ".codex", "config.toml"), aliases)) ?? "") : {};
-  const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases, disabledVendorPaths: disabledCodexSkillPaths(codexConfig, aliases) });
+  const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases, reviewedCacheAlias: options.reviewedCacheAlias, disabledVendorPaths: disabledCodexSkillPaths(codexConfig, aliases) });
   const changes = [];
   for (const agent of [...new Set(options.agents)]) {
     if (!INTEGRATION_AGENTS.includes(agent))

package/dist/lib/agent-codex.d.ts

@@ -1,7 +1,11 @@
 export declare const CODEX_SKILL_CONFIG_SECTIONS: RegExp;
-/** The path editor supports ordinary array-of-table sections only. Removing
- * those sections must remove exactly the parsed path array, with all other
- * values unchanged. This also excludes header-like text inside user strings. */
+/** Convert only Codex's native, single-line inline array representation into
+ * equivalent array-of-table sections. The replacement is accepted only when
+ * the complete parsed TOML value is deeply identical before and after. */
+export declare function normalizeCodexInlinePathConfig(text: string): string;
+/** Removing supported path sections must remove exactly the parsed skill path
+ * array while preserving every other TOML value. Native app-server inline
+ * arrays are first normalized by a targeted, semantically verified edit. */
 export declare function assertCodexPathConfigEditable(text: string): void;
 /** Preserve user TOML verbatim except for the supported bundled-skill control.
  * Bun's parser accepts some illegal table reopenings, so never append a table

package/dist/lib/agent-integration.d.ts

@@ -99,6 +99,7 @@ export declare function planAgentIntegration(options: {
     projectDir?: string;
     discoveryInputs?: ReviewedDiscoveryInputs;
     allowRootAliases?: boolean;
+    reviewedCacheAlias?: string;
 }): AgentIntegrationPlan;
 /** Plan an explicitly authorized Stop hook replacement without adopting drift.
  * The caller owns authorization of its exact Stop hook delta; Skills refuses

package/dist/lib/codex-hook-rpc.d.ts

@@ -1,4 +1,4 @@
-export declare const SUPPORTED_CODEX_HOOK_VERSIONS: readonly ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1"];
+export declare const SUPPORTED_CODEX_HOOK_VERSIONS: readonly ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1", "codex-cli 0.158.0", "codex-cli 0.159.0"];
 export interface CodexHookRpc {
     version: string;
     processId?: number;