@hasna/skills 0.10.16 → 0.10.19

package/README.md

@@ -466,8 +466,18 @@ preserves and reads back the original policy before writing. Claude upgrades to
 verbosity preferences. Provider mappings, environment, hooks, plugins, skill rules
 and all unknown settings stay bound. Runtime hooks never silently upgrade a witness.
 
-A reviewed Codex 0.159.2 native `skills/list` receipt can be passed to `hook install`
-with `--codex-native-catalog <file>`. Its safe shape is `{version,cwd,skills}`;
+A Codex 0.159.2 native `skills/list` receipt can be captured through the
+package-owned client into a new private file, then reviewed and passed to
+`hook install` with `--codex-native-catalog <file>`:
+
+```bash
+skills hook native-catalog --cwd /absolute/project --output /private/catalog.json --json
+skills hook install --agent codex --codex-native-catalog /private/catalog.json --json
+```
+
+The capture refuses an existing output file, writes mode `0600`, verifies the
+exact bytes, and reports only version, directory, count, file path and SHA-256.
+Its safe catalog shape is `{version,cwd,skills}`;
 each skill has `{name,path,enabled,pluginId}`. The installer matches the native
 qualified name against a bounded explicit frontmatter name and owning plugin
 manifest. It preserves path disables and adds exact qualified name disables.
@@ -480,8 +490,9 @@ Only manifest version metadata may vary. Reviewed app declarations use the impli
 file and its presence stay bound; it preserves existing connector availability and
 native capability hints. Changed or unknown app fields, custom references, native
 hooks, commands and MCP controls refuse. Name controls suppress Skills, not every
-plugin capability. No prompt hook starts an app server to obtain this receipt: native
-startup can maintain caches. Capture it through an authorized isolated consumer.
+plugin capability. No prompt hook starts an app server to obtain this receipt:
+native startup can maintain caches. The explicit capture starts and closes only its
+own bounded native client; it does not reload an existing agent session.
 Neither a receipt nor a config write proves an existing session adopted new rules;
 use the actual native session's supported acceptance path separately.
 

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.16",
+    version: "0.10.19",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -51052,6 +51052,24 @@ function projectCodexNativeSkillCatalog(response, cwd2) {
     return { name: value.name, path: value.path, enabled: value.enabled, pluginId: value.pluginId ?? null };
   });
 }
+async function captureCodexNativeSkillCatalog(options, connect = connectCodexHookRpc) {
+  if (!absolutePath2(options.cwd) || !absolutePath2(options.home))
+    refuse();
+  const rpc = await connect({
+    command: options.command,
+    home: options.home,
+    ...options.codexHome === undefined ? {} : { codexHome: options.codexHome },
+    ...options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }
+  });
+  try {
+    if (!SUPPORTED_NAME_CONTROL_VERSIONS.has(rpc.version))
+      throw new Error("CODEX_NATIVE_SKILL_CATALOG_UNSUPPORTED_VERSION");
+    const response = await rpc.request("skills/list", { cwds: [options.cwd], forceReload: true });
+    return { version: rpc.version, cwd: options.cwd, skills: projectCodexNativeSkillCatalog(response, options.cwd) };
+  } finally {
+    await rpc.close();
+  }
+}
 function canonicalPath(path) {
   try {
     return realpathSync4(path);
@@ -108698,13 +108716,13 @@ function comparePackageTrees(expectedRoot, installedRoot) {
     throw new Error("INSTALLED_PACKAGE_BYTES_MISMATCH");
   return expected.digest;
 }
-function replaceLink(path, target, backupPath, oldLinkTarget) {
+function replaceLink(path, target, backupPath, oldLinkTarget, oldTarget = resolve23(dirname30(path), oldLinkTarget)) {
   const stat3 = lstatSync28(path);
   if (!stat3.isSymbolicLink() || entryExists(backupPath))
     throw new Error("LAUNCHER_PREIMAGE_DRIFT");
   const temp = `${path}.skills-next-${randomUUID9()}`;
   symlinkSync(oldLinkTarget, backupPath);
-  if (readlinkSync5(backupPath) !== oldLinkTarget || realpathSync14(backupPath) !== resolve23(dirname30(path), oldLinkTarget))
+  if (readlinkSync5(backupPath) !== oldLinkTarget || realpathSync14(backupPath) !== oldTarget)
     throw new Error("LAUNCHER_BACKUP_READBACK_MISMATCH");
   symlinkSync(target, temp);
   if (realpathSync14(temp) !== target)
@@ -108745,6 +108763,324 @@ function persistReceipt(path, value) {
   }
   atomicJson(path, value);
 }
+function persistAliasReceipt(path, value) {
+  if (entryExists(path)) {
+    const priorBytes = readFileSync37(path);
+    const prior = object9(JSON.parse(priorBytes.toString("utf8")), "ALIAS_RECEIPT_INVALID");
+    if (prior.schema !== value.schema || prior.id !== value.id || typeof prior.state !== "string")
+      throw new Error("ALIAS_RECEIPT_DRIFT");
+    const nextBytes = Buffer.from(`${JSON.stringify(value, null, 2)}
+`);
+    if (priorBytes.equals(nextBytes))
+      return;
+    const history = join55(dirname30(path), "history");
+    if (!entryExists(history))
+      mkdirSync24(history, { mode: 448 });
+    const historyStat = lstatSync28(history);
+    if (!historyStat.isDirectory() || historyStat.isSymbolicLink() || (historyStat.mode & 63) !== 0)
+      throw new Error("ALIAS_RECEIPT_HISTORY_UNSAFE");
+    const saved = join55(history, `${value.id}-${String(prior.state)}-${randomUUID9()}.json`);
+    writeFileSync23(saved, priorBytes, { flag: "wx", mode: 256 });
+    chmodSync4(saved, 256);
+    if (!readFileSync37(saved).equals(priorBytes))
+      throw new Error("ALIAS_RECEIPT_HISTORY_READBACK_MISMATCH");
+  }
+  atomicJson(path, value);
+}
+function assertOwnedSafePath(path, home, requireWritable = false) {
+  assertNoSymlinkAncestors(path);
+  for (let current = path;; current = dirname30(current)) {
+    const stat3 = lstatSync28(current);
+    if (!stat3.isDirectory() || ![0, process.getuid?.() ?? -1].includes(stat3.uid) || stat3.mode & 18)
+      throw new Error("ALIAS_PATH_UNSAFE");
+    if (current === path && requireWritable && (stat3.uid !== (process.getuid?.() ?? -1) || (stat3.mode & 128) === 0))
+      throw new Error("ALIAS_DIRECTORY_NOT_OWNED");
+    if (current === dirname30(current) || current === home)
+      break;
+  }
+}
+function activeAliasRuntime(home, pathValue) {
+  const layout = resolveRuntimeLayout(home, pathValue);
+  const runtimePath = dirname30(dirname30(dirname30(layout.currentPackageRoot)));
+  const receiptPath = join55(runtimePath, "rollout-receipt.json");
+  const rollout = object9(JSON.parse(readFileSync37(receiptPath, "utf8")), "ROLLOUT_RECEIPT_INVALID");
+  if (rollout.schema !== "skills.copyfile-runtime-receipt.v1" || rollout.state !== "switched" || rollout.targetPackageRoot !== layout.currentPackageRoot || rollout.targetVersion !== layout.currentVersion || rollout.runtimeRoot !== layout.runtimeRoot || rollout.package !== PACKAGE_NAME || hash5(readFileSync37(join55(runtimePath, "verified-package.tgz"))) !== rollout.tarballSha256 || readTree(join55(runtimePath, "node_modules"), true).digest !== rollout.runtimeTreeSha256) {
+    throw new Error("ACTIVE_RUNTIME_RECEIPT_DRIFT");
+  }
+  verifyPreimageManifest(runtimePath, rollout, home);
+  return { layout, rollout };
+}
+function aliasDirs(home) {
+  return [join55(home, ".local", "bin"), join55(home, ".bun", "bin"), "/opt/homebrew/bin", "/usr/local/bin"];
+}
+function aliasPackageLink(home, aliasPath) {
+  const dir = dirname30(aliasPath);
+  if (dir === join55(home, ".local", "bin"))
+    return join55(home, ".local", "lib", "node_modules", "@hasna", "skills");
+  if (dir === "/opt/homebrew/bin")
+    return "/opt/homebrew/lib/node_modules/@hasna/skills";
+  if (dir === "/usr/local/bin")
+    return "/usr/local/lib/node_modules/@hasna/skills";
+  return null;
+}
+function inspectAliasPackageChain(home, aliasPath, oldLinkTarget, oldTarget, bin, expected, verify = false) {
+  const immediate = resolve23(dirname30(aliasPath), oldLinkTarget);
+  if (immediate === oldTarget) {
+    if (expected !== undefined)
+      throw new Error("ALIAS_LINK_CHAIN_DRIFT");
+    return;
+  }
+  const packageLinkPath = aliasPackageLink(home, aliasPath);
+  const physicalPackage = dirname30(dirname30(oldTarget));
+  if (!packageLinkPath || immediate !== join55(packageLinkPath, bin) || !isWithin(join55(home, ".hasna", "skills", "runtime"), physicalPackage)) {
+    throw new Error("ALIAS_LINK_CHAIN_UNSUPPORTED");
+  }
+  assertOwnedSafePath(dirname30(packageLinkPath), home);
+  let stat3, packageLinkTarget, resolved;
+  try {
+    stat3 = lstatSync28(packageLinkPath);
+    packageLinkTarget = readlinkSync5(packageLinkPath);
+    resolved = realpathSync14(packageLinkPath);
+  } catch {
+    throw new Error("ALIAS_LINK_CHAIN_UNSUPPORTED");
+  }
+  if (expected !== undefined && (expected.packageLinkPath !== packageLinkPath || expected.packageLinkTarget !== packageLinkTarget))
+    throw new Error("ALIAS_LINK_CHAIN_DRIFT");
+  if (!stat3.isSymbolicLink() || stat3.uid !== (process.getuid?.() ?? -1) || resolve23(dirname30(packageLinkPath), packageLinkTarget) !== physicalPackage || resolved !== physicalPackage)
+    throw new Error("ALIAS_LINK_CHAIN_UNSUPPORTED");
+  const chain = { packageLinkPath, packageLinkTarget };
+  if (verify && expected === undefined)
+    throw new Error("ALIAS_LINK_CHAIN_DRIFT");
+  return chain;
+}
+function validateAliasSource(home, name, actual) {
+  const packageRoot = dirname30(dirname30(actual));
+  const roots = [join55(home, ".hasna", "skills", "runtime"), join55(home, ".bun", "install"), join55(home, ".local", "lib", "node_modules")];
+  if (basename13(packageRoot) !== "skills" || basename13(dirname30(packageRoot)) !== "@hasna" || !roots.some((root2) => isWithin(root2, packageRoot))) {
+    throw new Error("ALIAS_SOURCE_ROOT_UNSUPPORTED");
+  }
+  assertOwnedSafePath(packageRoot, home);
+  const manifestPath = join55(packageRoot, "package.json");
+  const manifestStat = lstatSync28(manifestPath), binaryStat = lstatSync28(actual);
+  if (!manifestStat.isFile() || manifestStat.isSymbolicLink() || !binaryStat.isFile() || binaryStat.isSymbolicLink() || ![0, process.getuid?.() ?? -1].includes(manifestStat.uid) || ![0, process.getuid?.() ?? -1].includes(binaryStat.uid) || manifestStat.mode & 18)
+    throw new Error("ALIAS_SOURCE_UNSAFE");
+  const pkg = readPackage(manifestPath);
+  if (!pkg.bins[name] || actual !== join55(packageRoot, pkg.bins[name]))
+    throw new Error("ALIAS_SOURCE_BIN_MISMATCH");
+  return { version: pkg.version, packageRoot, binarySha256: hash5(readFileSync37(actual)) };
+}
+function adoptCopyfileAliases(options = {}) {
+  const home = realpathSync14(resolve23(options.homeDir ?? process.env.HOME ?? ""));
+  const pathValue = options.pathValue ?? process.env.PATH ?? "";
+  const { layout, rollout } = activeAliasRuntime(home, pathValue);
+  const releaseLock = acquireRuntimeLock(layout.runtimeRoot);
+  const id2 = randomUUID9();
+  const aliases = [];
+  const currentRuntime = dirname30(dirname30(dirname30(layout.currentPackageRoot)));
+  const receiptDir = join55(currentRuntime, "alias-adoptions");
+  const receiptPath = join55(receiptDir, `${id2}.json`);
+  let receipt;
+  try {
+    const locked2 = activeAliasRuntime(home, pathValue);
+    if (locked2.layout.currentPackageRoot !== layout.currentPackageRoot || locked2.rollout.id !== rollout.id)
+      throw new Error("ACTIVE_RUNTIME_CHANGED_BEFORE_ALIAS_ADOPTION");
+    for (const dir of aliasDirs(home)) {
+      if (!entryExists(dir))
+        continue;
+      for (const [name, target] of Object.entries(layout.bin)) {
+        const path = join55(dir, name);
+        if (!entryExists(path))
+          continue;
+        assertOwnedSafePath(dir, home, true);
+        const stat3 = lstatSync28(path);
+        if (!stat3.isSymbolicLink() || stat3.uid !== (process.getuid?.() ?? -1))
+          throw new Error("ALIAS_LINK_NOT_OWNED");
+        const oldLinkTarget = readlinkSync5(path);
+        let actual;
+        try {
+          actual = realpathSync14(path);
+        } catch {
+          throw new Error("ALIAS_LINK_CHAIN_UNSUPPORTED");
+        }
+        const newTarget = join55(layout.currentPackageRoot, target);
+        if (actual === newTarget)
+          continue;
+        const chain = inspectAliasPackageChain(home, path, oldLinkTarget, actual, target);
+        const source = validateAliasSource(home, name, actual);
+        const backupPath = `${path}.skills-alias-prev-${id2}`;
+        if (entryExists(backupPath))
+          throw new Error("ALIAS_BACKUP_COLLISION");
+        aliases.push({ path, oldTarget: actual, oldLinkTarget, oldVersion: source.version, oldBinarySha256: source.binarySha256, newTarget, backupPath, ...chain ? { chain } : {} });
+      }
+    }
+    if (!aliases.length)
+      return { adopted: true, version: layout.currentVersion, aliasCount: 0 };
+    mkdirSync24(receiptDir, { recursive: true, mode: 448 });
+    const receiptDirStat = lstatSync28(receiptDir);
+    if (!receiptDirStat.isDirectory() || receiptDirStat.isSymbolicLink() || receiptDirStat.mode & 63)
+      throw new Error("ALIAS_RECEIPT_DIRECTORY_UNSAFE");
+    receipt = {
+      schema: "skills.copyfile-alias-adoption.v1",
+      id: id2,
+      state: "prepared",
+      targetVersion: layout.currentVersion,
+      targetPackageRoot: layout.currentPackageRoot,
+      rolloutReceiptId: rollout.id,
+      aliases,
+      switchedAliases: [],
+      rollbackCompletedAliases: []
+    };
+    writeJsonPrivate(receiptPath, receipt);
+    for (const item of aliases) {
+      if (readlinkSync5(item.path) !== item.oldLinkTarget || realpathSync14(item.path) !== item.oldTarget)
+        throw new Error("ALIAS_CHANGED_BEFORE_SWITCH");
+      inspectAliasPackageChain(home, item.path, item.oldLinkTarget, item.oldTarget, layout.bin[basename13(item.path)], item.chain, true);
+      const source = validateAliasSource(home, basename13(item.path), item.oldTarget);
+      if (source.version !== item.oldVersion || source.binarySha256 !== item.oldBinarySha256)
+        throw new Error("ALIAS_SOURCE_DRIFT");
+      receipt.state = "switching";
+      receipt.switchedAliases = [...receipt.switchedAliases, item.path];
+      persistAliasReceipt(receiptPath, receipt);
+      replaceLink(item.path, item.newTarget, item.backupPath, item.oldLinkTarget, item.oldTarget);
+      if (realpathSync14(item.path) !== item.newTarget || realpathSync14(item.backupPath) !== item.oldTarget)
+        throw new Error("ALIAS_SWITCH_READBACK_MISMATCH");
+      inspectAliasPackageChain(home, item.path, item.oldLinkTarget, item.oldTarget, layout.bin[basename13(item.path)], item.chain, true);
+      options.onAliasSwitched?.(item.path);
+    }
+    for (const item of aliases) {
+      inspectAliasPackageChain(home, item.path, item.oldLinkTarget, item.oldTarget, layout.bin[basename13(item.path)], item.chain, true);
+      if (readlinkSync5(item.backupPath) !== item.oldLinkTarget || realpathSync14(item.backupPath) !== item.oldTarget)
+        throw new Error("ALIAS_BACKUP_DRIFT");
+    }
+    receipt.state = "switched";
+    persistAliasReceipt(receiptPath, receipt);
+    return { adopted: true, version: layout.currentVersion, receiptId: id2, aliasCount: aliases.length };
+  } catch (error61) {
+    if (receipt) {
+      let failed = false;
+      for (const item of [...aliases].reverse()) {
+        try {
+          if (!entryExists(item.backupPath)) {
+            inspectAliasPackageChain(home, item.path, item.oldLinkTarget, item.oldTarget, layout.bin[basename13(item.path)], item.chain, true);
+            const source2 = validateAliasSource(home, basename13(item.path), item.oldTarget);
+            if (!entryExists(item.path) || readlinkSync5(item.path) !== item.oldLinkTarget || realpathSync14(item.path) !== item.oldTarget || source2.version !== item.oldVersion || source2.binarySha256 !== item.oldBinarySha256)
+              failed = true;
+            continue;
+          }
+          if (readlinkSync5(item.backupPath) !== item.oldLinkTarget || realpathSync14(item.backupPath) !== item.oldTarget)
+            throw new Error("ALIAS_BACKUP_DRIFT");
+          inspectAliasPackageChain(home, item.path, item.oldLinkTarget, item.oldTarget, layout.bin[basename13(item.path)], item.chain, true);
+          const source = validateAliasSource(home, basename13(item.path), item.oldTarget);
+          if (source.version !== item.oldVersion || source.binarySha256 !== item.oldBinarySha256)
+            throw new Error("ALIAS_SOURCE_DRIFT");
+          if (realpathSync14(item.path) === item.oldTarget && readlinkSync5(item.path) === item.oldLinkTarget)
+            continue;
+          if (realpathSync14(item.path) !== item.newTarget)
+            throw new Error("ALIAS_CHANGED_DURING_ROLLBACK");
+          const after2 = `${item.path}.skills-alias-after-${id2}`;
+          if (entryExists(after2))
+            throw new Error("ALIAS_AFTER_COLLISION");
+          symlinkSync(item.newTarget, after2);
+          const temp = `${item.path}.skills-alias-rollback-${randomUUID9()}`;
+          symlinkSync(item.oldLinkTarget, temp);
+          renameSync13(temp, item.path);
+          if (readlinkSync5(item.path) !== item.oldLinkTarget)
+            throw new Error("ALIAS_ROLLBACK_READBACK_MISMATCH");
+          receipt.rollbackCompletedAliases = [...receipt.rollbackCompletedAliases, item.path];
+          persistAliasReceipt(receiptPath, receipt);
+        } catch {
+          failed = true;
+        }
+      }
+      receipt.state = failed ? "rollback-required" : "rolled-back";
+      try {
+        persistAliasReceipt(receiptPath, receipt);
+      } catch {
+        failed = true;
+      }
+      throw new Error(failed ? "ALIAS_ADOPTION_ROLLBACK_REQUIRED" : "ALIAS_ADOPTION_ROLLED_BACK");
+    }
+    throw error61 instanceof Error ? error61 : new Error("ALIAS_ADOPTION_FAILED");
+  } finally {
+    releaseLock();
+  }
+}
+function rollbackCopyfileAliases(receiptId, options = {}) {
+  if (!/^[0-9a-f-]{36}$/.test(receiptId))
+    throw new Error("ALIAS_RECEIPT_ID_INVALID");
+  const home = realpathSync14(resolve23(options.homeDir ?? process.env.HOME ?? ""));
+  const pathValue = options.pathValue ?? process.env.PATH ?? "";
+  const { layout, rollout } = activeAliasRuntime(home, pathValue);
+  const runtimePath = dirname30(dirname30(dirname30(layout.currentPackageRoot)));
+  const receiptPath = join55(runtimePath, "alias-adoptions", `${receiptId}.json`);
+  const releaseLock = acquireRuntimeLock(layout.runtimeRoot);
+  try {
+    const locked2 = activeAliasRuntime(home, pathValue);
+    if (locked2.layout.currentPackageRoot !== layout.currentPackageRoot || locked2.rollout.id !== rollout.id)
+      throw new Error("ACTIVE_RUNTIME_CHANGED_BEFORE_ALIAS_ROLLBACK");
+    const receipt = object9(JSON.parse(readFileSync37(receiptPath, "utf8")), "ALIAS_RECEIPT_INVALID");
+    if (receipt.schema !== "skills.copyfile-alias-adoption.v1" || receipt.id !== receiptId || !["switched", "switching", "rollback-required"].includes(receipt.state) || receipt.targetPackageRoot !== layout.currentPackageRoot || receipt.targetVersion !== layout.currentVersion || receipt.rolloutReceiptId !== rollout.id || !Array.isArray(receipt.aliases))
+      throw new Error("ALIAS_RECEIPT_BINDING_INVALID");
+    const seen = new Set;
+    for (const item of receipt.aliases) {
+      const name = basename13(item.path), target = layout.bin[name];
+      if (!target || seen.has(item.path) || !aliasDirs(home).includes(dirname30(item.path)) || item.newTarget !== join55(layout.currentPackageRoot, target) || item.backupPath !== `${item.path}.skills-alias-prev-${receiptId}` || item.chain !== undefined && (!item.chain || typeof item.chain !== "object" || typeof item.chain.packageLinkPath !== "string" || typeof item.chain.packageLinkTarget !== "string")) {
+        throw new Error("ALIAS_RECEIPT_LAUNCHER_INVALID");
+      }
+      inspectAliasPackageChain(home, item.path, item.oldLinkTarget, item.oldTarget, target, item.chain, true);
+      seen.add(item.path);
+      assertOwnedSafePath(dirname30(item.path), home, true);
+      const source = validateAliasSource(home, name, item.oldTarget);
+      if (source.version !== item.oldVersion || source.binarySha256 !== item.oldBinarySha256)
+        throw new Error("ALIAS_PREIMAGE_DRIFT");
+      const stat3 = lstatSync28(item.path);
+      if (!stat3.isSymbolicLink() || stat3.uid !== (process.getuid?.() ?? -1))
+        throw new Error("ALIAS_LINK_DRIFT");
+      const current = realpathSync14(item.path);
+      if (current !== item.newTarget && (current !== item.oldTarget || readlinkSync5(item.path) !== item.oldLinkTarget))
+        throw new Error("ALIAS_TARGET_DRIFT");
+      if (entryExists(item.backupPath)) {
+        const backup = lstatSync28(item.backupPath);
+        if (!backup.isSymbolicLink() || readlinkSync5(item.backupPath) !== item.oldLinkTarget || realpathSync14(item.backupPath) !== item.oldTarget)
+          throw new Error("ALIAS_PREIMAGE_DRIFT");
+      } else if (current !== item.oldTarget) {
+        throw new Error("ALIAS_BACKUP_MISSING_FOR_SWITCH");
+      }
+    }
+    let restored = 0;
+    for (const item of [...receipt.aliases].reverse()) {
+      if (realpathSync14(item.path) === item.oldTarget && readlinkSync5(item.path) === item.oldLinkTarget)
+        continue;
+      receipt.state = "rollback-required";
+      persistAliasReceipt(receiptPath, receipt);
+      const after2 = `${item.path}.skills-alias-after-${receiptId}`;
+      if (!entryExists(after2)) {
+        symlinkSync(item.newTarget, after2);
+        if (realpathSync14(after2) !== item.newTarget)
+          throw new Error("ALIAS_AFTER_READBACK_MISMATCH");
+      } else if (realpathSync14(after2) !== item.newTarget)
+        throw new Error("ALIAS_AFTER_DRIFT");
+      if (realpathSync14(item.path) !== item.newTarget)
+        throw new Error("ALIAS_TARGET_DRIFT");
+      const temp = `${item.path}.skills-alias-rollback-${randomUUID9()}`;
+      symlinkSync(item.oldLinkTarget, temp);
+      renameSync13(temp, item.path);
+      if (readlinkSync5(item.path) !== item.oldLinkTarget || realpathSync14(item.path) !== item.oldTarget)
+        throw new Error("ALIAS_ROLLBACK_READBACK_MISMATCH");
+      receipt.rollbackCompletedAliases = [...new Set([...receipt.rollbackCompletedAliases, item.path])];
+      persistAliasReceipt(receiptPath, receipt);
+      restored++;
+    }
+    for (const item of receipt.aliases) {
+      inspectAliasPackageChain(home, item.path, item.oldLinkTarget, item.oldTarget, layout.bin[basename13(item.path)], item.chain, true);
+    }
+    receipt.state = "rolled-back";
+    persistAliasReceipt(receiptPath, receipt);
+    return { rolledBack: true, receiptId, restoredAliasCount: restored };
+  } finally {
+    releaseLock();
+  }
+}
 async function updateCopyfileRuntime(version2, options = {}) {
   if (!new RegExp(SEMVER_PATTERN).test(version2))
     throw new Error("EXACT_VERSION_REQUIRED");
@@ -109091,12 +109427,40 @@ function registerRuntime(parent) {
   });
   const setup = parent.command("setup").description("Point this CLI at a Skills API server, or register agent integrations").option("--api-url <url>", "Skills API origin to send remote work to").option("--global", "Accepted for compatibility; the API origin is always per-user", false).option("--json", "Output setup result as JSON", false).action(async (options) => handleSetup(options));
   setup.command("agents").option("--json", "Output registration result as JSON", false).description("Register the Skills MCP server with all supported agents").action(async (options) => handleMcp({ register: "all", json: options.json }));
-  parent.command("self-update").description("Update @hasna/skills to the latest version").option("--json", "Output result as JSON", false).option("--version <version>", "Install this exact @hasna/skills version as a staged copyfile runtime").option("--rollback <receipt-id>", "Restore launcher links from an exact copyfile rollout receipt").action(async (options) => {
-    if (options.version && options.rollback) {
-      console.error(JSON.stringify({ error: "UPDATE_AND_ROLLBACK_ARE_MUTUALLY_EXCLUSIVE" }));
+  parent.command("self-update").description("Update @hasna/skills to the latest version").option("--json", "Output result as JSON", false).option("--version <version>", "Install this exact @hasna/skills version as a staged copyfile runtime").option("--rollback <receipt-id>", "Restore launcher links from an exact copyfile rollout receipt").option("--adopt-aliases", "Switch verified legacy @hasna/skills aliases to the active copyfile runtime").option("--rollback-aliases <receipt-id>", "Restore aliases from an exact adoption receipt").action(async (options) => {
+    if ([options.version, options.rollback, options.adoptAliases, options.rollbackAliases].filter(Boolean).length > 1) {
+      console.error(JSON.stringify({ error: "SELF_UPDATE_OPERATIONS_ARE_MUTUALLY_EXCLUSIVE" }));
       process.exitCode = 1;
       return;
     }
+    if (options.adoptAliases) {
+      try {
+        const result2 = adoptCopyfileAliases();
+        if (options.json)
+          console.log(JSON.stringify(result2));
+        else
+          console.log(source_default.green(`Adopted ${String(result2.aliasCount)} verified Skills aliases into the active copyfile runtime.`));
+      } catch (error61) {
+        const message = error61 instanceof Error && /^[A-Z0-9_]+$/.test(error61.message) ? error61.message : "ALIAS_ADOPTION_FAILED";
+        console.error(JSON.stringify({ adopted: false, error: message }));
+        process.exitCode = 1;
+      }
+      return;
+    }
+    if (options.rollbackAliases) {
+      try {
+        const result2 = rollbackCopyfileAliases(options.rollbackAliases);
+        if (options.json)
+          console.log(JSON.stringify(result2));
+        else
+          console.log(source_default.green(`Restored ${String(result2.restoredAliasCount)} Skills aliases from the adoption receipt.`));
+      } catch (error61) {
+        const message = error61 instanceof Error && /^[A-Z0-9_]+$/.test(error61.message) ? error61.message : "ALIAS_ROLLBACK_FAILED";
+        console.error(JSON.stringify({ rolledBack: false, error: message }));
+        process.exitCode = 1;
+      }
+      return;
+    }
     if (options.version) {
       try {
         const result2 = await updateCopyfileRuntime(options.version);
@@ -111848,7 +112212,9 @@ var exports_agent_integration = {};
 __export(exports_agent_integration, {
   registerAgentIntegration: () => registerAgentIntegration
 });
-import { readFileSync as readFileSync41 } from "fs";
+import { existsSync as existsSync35, lstatSync as lstatSync32, readFileSync as readFileSync41, writeFileSync as writeFileSync26 } from "fs";
+import { createHash as createHash31 } from "crypto";
+import { homedir as homedir13 } from "os";
 import { isAbsolute as isAbsolute29 } from "path";
 function pinnedHookProfile(input3, configuredProfile) {
   try {
@@ -111915,6 +112281,45 @@ function agents(value) {
 }
 function registerAgentIntegration(parent) {
   const hook = parent.command("hook").description("Load selected Skills context through agent lifecycle hooks");
+  hook.command("native-catalog").requiredOption("--cwd <path>", "Absolute project directory observed by native Codex skills/list").requiredOption("--output <file>", "New private file for the projected native catalog").option("--codex-command <path>", "Installed Codex executable used by the native client", "codex").option("--json", "Output bounded capture metadata as JSON", false).description("Capture a reviewed Codex native skill catalog for exact hook enrollment").action(async (options) => {
+    try {
+      if (!isAbsolute29(options.cwd) || !isAbsolute29(options.output))
+        throw new Error("CODEX_NATIVE_SKILL_CATALOG_ABSOLUTE_PATH_REQUIRED");
+      if (existsSync35(options.output))
+        throw new Error("CODEX_NATIVE_SKILL_CATALOG_OUTPUT_EXISTS");
+      const catalog = await captureCodexNativeSkillCatalog({
+        command: options.codexCommand,
+        home: homedir13(),
+        ...process.env.CODEX_HOME === undefined ? {} : { codexHome: process.env.CODEX_HOME },
+        cwd: options.cwd
+      });
+      const bytes = JSON.stringify(catalog, null, 2) + `
+`;
+      try {
+        writeFileSync26(options.output, bytes, { flag: "wx", mode: 384 });
+      } catch (error61) {
+        if (error61 && typeof error61 === "object" && "code" in error61 && error61.code === "EEXIST")
+          throw new Error("CODEX_NATIVE_SKILL_CATALOG_OUTPUT_EXISTS");
+        throw error61;
+      }
+      const written = lstatSync32(options.output);
+      if (!written.isFile() || written.isSymbolicLink() || (written.mode & 63) !== 0 || readFileSync41(options.output, "utf8") !== bytes)
+        throw new Error("CODEX_NATIVE_SKILL_CATALOG_READBACK_FAILED");
+      const receipt = {
+        version: catalog.version,
+        cwd: catalog.cwd,
+        skillCount: catalog.skills.length,
+        output: options.output,
+        bytes: Buffer.byteLength(bytes),
+        sha256: createHash31("sha256").update(bytes).digest("hex")
+      };
+      await writeCliOutput(options.json ? JSON.stringify(receipt) : `Captured ${receipt.skillCount} native Codex skill(s) in ${receipt.output}.`);
+    } catch (error61) {
+      const message = error61 instanceof Error && /^[A-Z][A-Z0-9_]{2,120}$/.test(error61.message) ? error61.message : "CODEX_NATIVE_SKILL_CATALOG_CAPTURE_FAILED";
+      console.error(message);
+      process.exitCode = 1;
+    }
+  });
   hook.command("witness").requiredOption("--kind <kind>", "claude-settings-v3, claude-settings-v2, codex-settings-v1 or claude-marketplace-registry-v2").requiredOption("--path <path>", "Canonical absolute path to the reviewed settings or registry file").option("--json", "Output the discovery witness as JSON", false).description("Capture an explicit versioned review witness without installing it").action(async (options) => {
     const capture2 = options.kind === "codex-settings-v1" ? captureCodexSettings : options.kind === "claude-settings-v3" ? captureClaudeSettingsV3 : options.kind === "claude-settings-v2" ? captureClaudeSettingsV2 : options.kind === "claude-marketplace-registry-v2" ? captureClaudeMarketplaceRegistryV2 : null;
     if (!capture2)
@@ -112146,6 +112551,7 @@ var init_agent_integration2 = __esm(() => {
   init_claude_settings_witness();
   init_codex_settings_witness();
   init_claude_marketplace_registry();
+  init_codex_native_skill_catalog();
   RECOVERABLE_CONTEXT_CACHE_ERRORS = new Set(["CACHED_PROFILE_EXPIRED", "CACHED_PROFILE_MISSING", "CACHED_BUNDLE_MISSING"]);
 });
 
@@ -112284,7 +112690,7 @@ var exports_profiles = {};
 __export(exports_profiles, {
   registerProfiles: () => registerProfiles
 });
-import { closeSync as closeSync21, constants as constants20, fstatSync as fstatSync21, openSync as openSync21, readSync as readSync17, writeFileSync as writeFileSync26 } from "fs";
+import { closeSync as closeSync21, constants as constants20, fstatSync as fstatSync21, openSync as openSync21, readSync as readSync17, writeFileSync as writeFileSync27 } from "fs";
 function readProfileInput(path) {
   const fd = openSync21(path, constants20.O_RDONLY | constants20.O_NONBLOCK);
   try {
@@ -112312,7 +112718,7 @@ function registerProfiles(parent) {
     try {
       const profile = await readSkillProfile(id3), text4 = JSON.stringify(profile, null, 2);
       if (options.save)
-        writeFileSync26(options.save, JSON.stringify(profile), { mode: 384, flag: "wx" });
+        writeFileSync27(options.save, JSON.stringify(profile), { mode: 384, flag: "wx" });
       await writeCliOutput(options.json ? text4 : `${profile.id} at ${profile.revision}: ${profile.selections.map((skill) => `${skill.slug}@${skill.version}`).join(", ")}`);
     } catch (error61) {
       console.error(error61.message);
@@ -112359,7 +112765,7 @@ import {
   fstatSync as fstatSync23,
   openSync as openSync23,
   readSync as readSync18,
-  writeFileSync as writeFileSync27
+  writeFileSync as writeFileSync28
 } from "fs";
 function readInput(path) {
   const fd = openSync23(path, constants21.O_RDONLY | constants21.O_NONBLOCK);
@@ -112392,7 +112798,7 @@ function registerGrants(parent) {
     try {
       const policy = await readExecutionGrantPolicy(profile, options.revision);
       if (options.save)
-        writeFileSync27(options.save, JSON.stringify(policy, null, 2), {
+        writeFileSync28(options.save, JSON.stringify(policy, null, 2), {
           mode: 384,
           flag: "wx"
         });
@@ -112419,14 +112825,14 @@ var init_grants = __esm(() => {
 });
 
 // src/lib/station-hydrate.ts
-import { createHash as createHash31 } from "crypto";
+import { createHash as createHash32 } from "crypto";
 import {
   copyFileSync as copyFileSync3,
   mkdirSync as mkdirSync28,
   readdirSync as readdirSync24,
   readFileSync as readFileSync42,
   statSync as statSync22,
-  writeFileSync as writeFileSync28
+  writeFileSync as writeFileSync29
 } from "fs";
 import { dirname as dirname35, join as join61, resolve as resolve26, sep as sep13 } from "path";
 function fail5(code2, message, detail = []) {
@@ -112622,7 +113028,7 @@ function skillSha256(skill) {
     return sha256File(skill.files[0].winner.fullPath);
   }
   const joined = skill.files.map((file2) => sha256File(file2.winner.fullPath));
-  return createHash31("sha256").update(joined.sort().join(`
+  return createHash32("sha256").update(joined.sort().join(`
 `)).digest("hex");
 }
 function writeStationHydration(options) {
@@ -112704,7 +113110,7 @@ function writeStationHydration(options) {
   };
   const hydrationManifestPath = join61(dirname35(cacheRoot), `hydration-${options.stationId}.json`);
   mkdirSync28(dirname35(hydrationManifestPath), { recursive: true });
-  writeFileSync28(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
+  writeFileSync29(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
 `);
   return {
     ...base3,
@@ -112779,8 +113185,8 @@ var init_hydrate = __esm(() => {
 });
 
 // src/lib/prepare-skill.ts
-import { createHash as createHash32, randomUUID as randomUUID12 } from "crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync35, lstatSync as lstatSync32, mkdirSync as mkdirSync29, mkdtempSync as mkdtempSync6, readFileSync as readFileSync43, readdirSync as readdirSync25, renameSync as renameSync14, rmSync as rmSync9, writeFileSync as writeFileSync29 } from "fs";
+import { createHash as createHash33, randomUUID as randomUUID12 } from "crypto";
+import { chmodSync as chmodSync5, existsSync as existsSync36, lstatSync as lstatSync33, mkdirSync as mkdirSync29, mkdtempSync as mkdtempSync6, readFileSync as readFileSync43, readdirSync as readdirSync25, renameSync as renameSync14, rmSync as rmSync9, writeFileSync as writeFileSync30 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { dirname as dirname36, isAbsolute as isAbsolute30, join as join62, relative as relative10, resolve as resolve27, sep as sep14 } from "path";
 function prepareSkill(name, options) {
@@ -112829,10 +113235,10 @@ function prepareSkill(name, options) {
     for (const file2 of before2.files) {
       const destination = join62(staging, file2.path);
       mkdirSync29(dirname36(destination), { recursive: true });
-      writeFileSync29(destination, file2.bytes, { mode: file2.mode });
+      writeFileSync30(destination, file2.bytes, { mode: file2.mode });
     }
     const stagedManifest = join62(staging, "skill.json");
-    writeFileSync29(stagedManifest, `${JSON.stringify(candidate2, null, 2)}
+    writeFileSync30(stagedManifest, `${JSON.stringify(candidate2, null, 2)}
 `);
     const contentHash = computeContentHash(staging);
     const changed3 = options.version !== previousVersion || kind !== manifest.kind || contentHash !== provenance?.content_hash;
@@ -112842,7 +113248,7 @@ function prepareSkill(name, options) {
     candidate2.provenance.content_hash = contentHash;
     const candidateBytes = `${JSON.stringify(candidate2, null, 2)}
 `;
-    writeFileSync29(stagedManifest, candidateBytes);
+    writeFileSync30(stagedManifest, candidateBytes);
     validateRawCandidate(candidate2);
     validateRuntimeEntrypoint(candidate2, staging);
     const validation = validatePortableSkillDirectory(normalized, staging);
@@ -112856,7 +113262,7 @@ ${validation.issues.map((issue2) => `${issue2.code}: ${issue2.message}`).join(`
     if (changed3 && !options.dryRun) {
       const temporary = join62(path, `.skill-prepare-${randomUUID12()}.tmp`);
       try {
-        writeFileSync29(temporary, candidateBytes, { flag: "wx", mode: manifestFile.mode });
+        writeFileSync30(temporary, candidateBytes, { flag: "wx", mode: manifestFile.mode });
         chmodSync5(temporary, manifestFile.mode);
         renameSync14(temporary, join62(path, "skill.json"));
       } finally {
@@ -112889,7 +113295,7 @@ function validateRuntimeEntrypoint(candidate2, root2) {
   if (typeof entry !== "string")
     return;
   const target = resolve27(root2, entry), rel = relative10(root2, target);
-  if (isAbsolute30(entry) || /^[a-zA-Z]:/.test(entry) || entry.includes("\\") || !rel || rel === ".." || rel.startsWith(`..${sep14}`) || isAbsolute30(rel) || !existsSync35(target) || !lstatSync32(target).isFile()) {
+  if (isAbsolute30(entry) || /^[a-zA-Z]:/.test(entry) || entry.includes("\\") || !rel || rel === ".." || rel.startsWith(`..${sep14}`) || isAbsolute30(rel) || !existsSync36(target) || !lstatSync33(target).isFile()) {
     throw new Error("Executable runtime.entrypoint must name an existing regular file inside the skill directory.");
   }
 }
@@ -112974,11 +113380,11 @@ function compareVersions(left, right) {
   return 0;
 }
 function snapshot2(root2) {
-  const rootStat = lstatSync32(root2);
+  const rootStat = lstatSync33(root2);
   if (rootStat.isSymbolicLink() || !rootStat.isDirectory())
     throw new Error("Skill root must be a real directory, not a symlink.");
   const files = [], directories = [];
-  const hash6 = createHash32("sha256").update(`${rootStat.dev}:${rootStat.ino}\x00`);
+  const hash6 = createHash33("sha256").update(`${rootStat.dev}:${rootStat.ino}\x00`);
   let count = 0, bytes = 0;
   const walk2 = (relative11) => {
     for (const name of readdirSync25(join62(root2, relative11)).sort()) {
@@ -112987,7 +113393,7 @@ function snapshot2(root2) {
       const path = relative11 ? `${relative11}/${name}` : name;
       if (++count > 20000)
         throw new Error("Skill exceeds the preparation entry limit (20000).");
-      const absolute = join62(root2, path), stat3 = lstatSync32(absolute);
+      const absolute = join62(root2, path), stat3 = lstatSync33(absolute);
       if (stat3.isSymbolicLink())
         throw new Error(`Skill contains a symlink: ${path}. No files were changed.`);
       if (stat3.isDirectory() && name === "node_modules")
@@ -113402,7 +113808,7 @@ var init_schedule = __esm(() => {
 });
 
 // src/lib/registry-sync.ts
-import { mkdirSync as mkdirSync30, writeFileSync as writeFileSync30 } from "fs";
+import { mkdirSync as mkdirSync30, writeFileSync as writeFileSync31 } from "fs";
 import { dirname as dirname37, relative as relative11 } from "path";
 function createRegistrySyncArtifact(options = {}) {
   const profile = options.profile ?? "all";
@@ -113461,7 +113867,7 @@ function createRegistrySyncArtifact(options = {}) {
 }
 function writeRegistrySyncArtifact(path, artifact) {
   mkdirSync30(dirname37(path), { recursive: true });
-  writeFileSync30(path, `${JSON.stringify(artifact, null, 2)}
+  writeFileSync31(path, `${JSON.stringify(artifact, null, 2)}
 `);
 }
 function buildDocs(name) {
@@ -113480,7 +113886,7 @@ var init_registry_sync = __esm(() => {
 });
 
 // src/lib/review-export.ts
-import { constants as constants22, closeSync as closeSync25, existsSync as existsSync36, fstatSync as fstatSync25, fsyncSync as fsyncSync7, lstatSync as lstatSync33, openSync as openSync25, realpathSync as realpathSync18, statSync as statSync23, writeFileSync as writeFileSync31 } from "fs";
+import { constants as constants22, closeSync as closeSync25, existsSync as existsSync37, fstatSync as fstatSync25, fsyncSync as fsyncSync7, lstatSync as lstatSync34, openSync as openSync25, realpathSync as realpathSync18, statSync as statSync23, writeFileSync as writeFileSync32 } from "fs";
 import { basename as basename15, dirname as dirname38, isAbsolute as isAbsolute31, join as join63, parse as parse12, resolve as resolve28, sep as sep15 } from "path";
 function exactVersion(spec) {
   const at2 = spec.indexOf("@");
@@ -113496,7 +113902,7 @@ function assertPrivateDestination(output2) {
     throw new Error("Review output must be an absolute, normalized .tar.gz path.");
   }
   const parent = dirname38(output2);
-  if (realpathSync18(parent) !== parent || lstatSync33(parent).isSymbolicLink()) {
+  if (realpathSync18(parent) !== parent || lstatSync34(parent).isSymbolicLink()) {
     throw new Error("Review output parent must be a real directory, not a symlink.");
   }
   const parentStat = statSync23(parent);
@@ -113508,7 +113914,7 @@ function assertPrivateDestination(output2) {
     throw new Error("Review output cannot be placed in agent-native discovery or Skills installation paths.");
   }
   for (let current = parent;; current = dirname38(current)) {
-    if (existsSync36(join63(current, ".git"))) {
+    if (existsSync37(join63(current, ".git"))) {
       throw new Error("Review output cannot be placed inside a Git worktree.");
     }
     if (current === parse12(current).root)
@@ -113519,7 +113925,7 @@ function assertPrivateDestination(output2) {
 async function exportSkillVersionForReview(spec, output2, client2) {
   const { slug: slug2, version: version2 } = exactVersion(spec);
   const target = assertPrivateDestination(output2);
-  if (existsSync36(target))
+  if (existsSync37(target))
     throw new Error("Review output already exists; choose a new filename.");
   const metadata = await client2.getSkillVersion(slug2, version2);
   if (!metadata)
@@ -113546,7 +113952,7 @@ async function exportSkillVersionForReview(spec, output2, client2) {
   }
   const fd = openSync25(target, constants22.O_WRONLY | constants22.O_CREAT | constants22.O_EXCL | constants22.O_NOFOLLOW, 384);
   try {
-    writeFileSync31(fd, bytes);
+    writeFileSync32(fd, bytes);
     fsyncSync7(fd);
     if (fstatSync25(fd).size !== bytes.byteLength)
       throw new Error("Incomplete review output write.");
@@ -113793,7 +114199,7 @@ __export(exports_publish, {
   PushSkillError: () => PushSkillError
 });
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync37, readFileSync as readFileSync44 } from "fs";
+import { existsSync as existsSync38, readFileSync as readFileSync44 } from "fs";
 import { hostname as hostname5 } from "os";
 import { join as join64 } from "path";
 function registerPublish(parent) {
@@ -113848,7 +114254,7 @@ async function pushSkill(name, options = {}) {
   await verifyPackedCanonicalHash(skill.name, packed);
   const versionManifest = buildVersionManifest(skill.path, packed);
   const skillMdPath = join64(skill.path, "SKILL.md");
-  const skillMd = existsSync37(skillMdPath) ? readFileSync44(skillMdPath, "utf-8") : undefined;
+  const skillMd = existsSync38(skillMdPath) ? readFileSync44(skillMdPath, "utf-8") : undefined;
   const base3 = {
     slug: skill.name,
     path: skill.path,
@@ -115567,7 +115973,7 @@ var init_storage2 = __esm(() => {
 });
 
 // src/lib/registry-reconcile.ts
-import { existsSync as existsSync38, readFileSync as readFileSync45, statSync as statSync24, writeFileSync as writeFileSync32 } from "fs";
+import { existsSync as existsSync39, readFileSync as readFileSync45, statSync as statSync24, writeFileSync as writeFileSync33 } from "fs";
 import { join as join65 } from "path";
 function isDirectory2(path) {
   try {
@@ -115584,7 +115990,7 @@ function migrationNeeded(options) {
 }
 function readBaseline(skillDir) {
   const markerPath = join65(skillDir, PULL_MARKER_FILE);
-  if (!existsSync38(markerPath))
+  if (!existsSync39(markerPath))
     return;
   try {
     const marker = JSON.parse(readFileSync45(markerPath, "utf-8"));
@@ -115600,7 +116006,7 @@ function readBaseline(skillDir) {
 }
 function readCursor(root2) {
   const path = join65(root2, SYNC_CURSOR_FILE);
-  if (!existsSync38(path))
+  if (!existsSync39(path))
     return { runCount: 0 };
   try {
     const cursor2 = JSON.parse(readFileSync45(path, "utf-8"));
@@ -115631,7 +116037,7 @@ function remoteRowToSkill(record11) {
 }
 function recheckLocalSide(plannedLocal, localDir, ops = {
   pack: (dir) => packSkillBundle(dir).sha256,
-  exists: existsSync38
+  exists: existsSync39
 }) {
   let localNow;
   try {
@@ -115882,7 +116288,7 @@ async function reconcileRegistry(options = {}) {
         runCount: readCursor(root2).runCount + 1,
         summary
       };
-      writeFileSync32(join65(root2, SYNC_CURSOR_FILE), `${JSON.stringify(cursor2, null, 2)}
+      writeFileSync33(join65(root2, SYNC_CURSOR_FILE), `${JSON.stringify(cursor2, null, 2)}
 `);
       return {
         corpusRoot: root2,

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.16",
+    version: "0.10.19",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.16",
+  version: "0.10.19",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.16",
+  version: "0.10.19",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -24125,7 +24125,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.16",
+  version: "0.10.19",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/cli/commands/runtime-copyfile.d.ts

@@ -12,6 +12,15 @@ export declare function preflightTarball(bytes: Uint8Array, limits?: {
     expandedBytes: number;
 }>;
 export declare function readBodyCapped(response: Response, limit: number, errorCode: string): Promise<Uint8Array>;
+export declare function adoptCopyfileAliases(options?: {
+    homeDir?: string;
+    pathValue?: string;
+    onAliasSwitched?: (path: string) => void;
+}): JsonObject;
+export declare function rollbackCopyfileAliases(receiptId: string, options?: {
+    homeDir?: string;
+    pathValue?: string;
+}): JsonObject;
 export declare function updateCopyfileRuntime(version: string, options?: {
     homeDir?: string;
     pathValue?: string;

package/dist/index.js

@@ -10877,7 +10877,7 @@ function replaceSkillSession(expected, replacement, plan, options = {}, beforeCo
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.16",
+  version: "0.10.19",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.16",
+  version: "0.10.19",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.16",
+  "version": "0.10.19",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {