@hasna/skills 0.10.19 → 0.10.22

package/dist/lib/agent-discovery.d.ts

@@ -6,7 +6,7 @@ export { captureDiscoveryDirectories, type DiscoveryDirectory } from "./agent-di
 export interface DiscoverySource {
     path: string;
     sha256: string | null;
-    hashMode?: "bytes" | "path-bytes" | "claude-plugin-registry" | "claude-marketplace-registry" | "claude-settings-v1" | "claude-settings-v2" | "claude-settings-v3" | "claude-marketplace-registry-v2" | "codex-settings-v1";
+    hashMode?: "bytes" | "path-bytes" | "claude-plugin-registry" | "claude-marketplace-registry" | "claude-settings-v1" | "claude-settings-v2" | "claude-settings-v3" | "claude-marketplace-registry-v2" | "codex-settings-v1" | "codex-settings-v2";
     managedPlugins?: ManagedPluginRegistrationWitness[];
     format?: "json" | "toml" | "yaml";
     fields?: string[];
@@ -29,6 +29,9 @@ export interface ReviewedDiscoveryInputs {
         pluginHooks: "reviewed-no-skill-injection";
     }>;
 }
+/** Project one native configuration's witnessed fields, exactly as discovery
+ * binds them. Used for both the current file and a preserved reviewed preimage. */
+export declare function projectNativeDiscoveryFields(text: string, format: "json" | "toml" | "yaml", fields: readonly string[], path: string): string;
 export declare function verifyAgentDiscovery(binding: AgentDiscoveryBinding, codexRecovery?: CodexHookDiscoveryRecovery): void;
 export declare function rebindAgentDiscovery(binding: AgentDiscoveryBinding, changes: Map<string, string>): AgentDiscoveryBinding;
 /** Capture full byte witnesses for reviewed source or executable files; never import or execute them. */

package/dist/lib/agent-integration.d.ts

@@ -66,6 +66,10 @@ export interface AgentIntegrationPlan {
         toSha256: string;
         reviewedPreimage: string;
         currentSettingsSha256: string;
+        replacedWitnesses: Array<{
+            hashMode: string;
+            sha256: string;
+        }>;
     };
     dataDir: string;
     profileId: string;

package/dist/lib/codex-hook-rpc.d.ts

@@ -1,4 +1,4 @@
-export declare const SUPPORTED_CODEX_HOOK_VERSIONS: readonly ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1", "codex-cli 0.158.0", "codex-cli 0.159.0", "codex-cli 0.159.2"];
+export { SUPPORTED_CODEX_HOOK_VERSIONS } from "./codex-native-compatibility.js";
 export interface CodexHookRpc {
     version: string;
     processId?: number;

package/dist/lib/codex-native-compatibility.d.ts

@@ -0,0 +1,3 @@
+export type CodexNativeCapability = "hooks" | "qualified-skill-catalog";
+export declare function supportsCodexNativeCapability(version: unknown, capability: CodexNativeCapability): boolean;
+export declare const SUPPORTED_CODEX_HOOK_VERSIONS: readonly string[];

package/dist/lib/codex-native-skill-catalog.d.ts

@@ -10,10 +10,30 @@ export interface CodexNativeSkillCatalog {
     version: string;
     cwd: string;
     skills: CodexNativeSkill[];
+    /** Added in 0.10.20; older reviewed skills/list receipts remain valid for listed skills. */
+    plugins?: CodexInstalledPlugin[];
 }
+/** Safe installed-plugin identity needed when Codex hides a path-disabled skill. */
+export interface CodexInstalledPlugin {
+    id: string;
+    name: string;
+    installed: boolean;
+    enabled: boolean;
+    localVersion: string | null;
+    /** Native remote identity; never a guessed installed cache version. */
+    remotePluginId?: string;
+    sourceType?: "remote";
+}
+export declare const remotePluginIdentifier: (value: unknown) => value is string;
 /** Project the measured native skills/list contract without retaining descriptions,
  * links, interfaces, errors, or any other untrusted native text. */
 export declare function projectCodexNativeSkillCatalog(response: unknown, cwd: string): CodexNativeSkill[];
+/** Project only the installed plugin identity needed to bind cache inventory.
+ * Marketplace errors fail closed because an incomplete inventory cannot prove
+ * that an absent skill belongs to the one measured installed plugin. */
+export declare function projectCodexInstalledPlugins(response: unknown): CodexInstalledPlugin[];
+/** Validate the bounded stored projection when it is consumed by a review. */
+export declare function projectCodexInstalledPluginEntries(value: unknown): CodexInstalledPlugin[];
 /** Read one consumer's catalog through an owned, bounded native client. The RPC
  * transport owns request deadlines and child shutdown. Native discovery can
  * maintain its own caches; callers must constrain writes when requiring isolation. */

package/dist/lib/codex-plugin-skill-controls.d.ts

@@ -6,11 +6,12 @@ export interface CodexPluginSkillControl {
     pluginParent: string;
     manifestSha256: string;
     appSha256?: string;
+    remotePluginId?: string;
 }
 type Read = (path: string) => string;
 /** Capability controls remain bound even after every native Skill body disappears. */
 export declare function reviewedCodexPluginCapabilitiesUnchanged(cache: string, controls: CodexPluginSkillControl[], read: Read): boolean;
-export declare function reviewCodexPluginSkillControls(catalog: CodexNativeSkillCatalog, documents: string[], cache: string, cwd: string, read: Read): CodexPluginSkillControl[];
+export declare function reviewCodexPluginSkillControls(catalog: CodexNativeSkillCatalog, documents: string[], cache: string, cwd: string, read: Read, rules: unknown): CodexPluginSkillControl[];
 export declare function isReviewedCodexPluginSkillDisabled(document: string, cache: string, controls: CodexPluginSkillControl[], rules: unknown, read: Read): boolean;
 export declare function disableReviewedCodexPluginNames(text: string, controls: CodexPluginSkillControl[]): string;
 export {};

package/dist/lib/codex-settings-witness-v1.d.ts

@@ -0,0 +1,12 @@
+import { type ClaudeSettingsWitnessBudget } from "./claude-settings-witness.js";
+export declare function hashCodexSettingsReplacement(text: string, budget?: ClaudeSettingsWitnessBudget): string;
+export declare function captureCodexSettings(path: string, budget?: ClaudeSettingsWitnessBudget): {
+    path: string;
+    hashMode: "codex-settings-v1";
+    sha256: string;
+};
+export declare function upgradeCodexSettingsWitness(previous: {
+    path: string;
+    hashMode?: "bytes";
+    sha256: string;
+}, reviewedSettingsPath: string): ReturnType<typeof captureCodexSettings>;

package/dist/lib/codex-settings-witness.d.ts

@@ -1,12 +1,20 @@
+export { captureCodexSettings, hashCodexSettingsReplacement } from "./codex-settings-witness-v1.js";
 import { type ClaudeSettingsWitnessBudget } from "./claude-settings-witness.js";
-export declare function hashCodexSettingsReplacement(text: string, budget?: ClaudeSettingsWitnessBudget): string;
-export declare function captureCodexSettings(path: string, budget?: ClaudeSettingsWitnessBudget): {
+/** The Codex discovery fields the automatic TOML projection witnesses. A typed
+ * `codex-settings-v2` witness binds strictly more of the same file, so it
+ * supersedes this projection instead of coexisting with it. */
+export declare const CODEX_DISCOVERY_PROJECTION_FIELDS: readonly ["plugins", "marketplaces", "skills"];
+export declare function hashCodexSettingsReplacementV2(text: string, budget?: ClaudeSettingsWitnessBudget): string;
+export declare function captureCodexSettingsV2(path: string, budget?: ClaudeSettingsWitnessBudget): {
     path: string;
-    hashMode: "codex-settings-v1";
+    hashMode: "codex-settings-v2";
     sha256: string;
 };
+/** Read one preserved review preimage under the exact witness file rules, so a
+ * caller can prove additional legacy witnesses against the same bytes. */
+export declare function readCodexSettingsPreimage(path: string, budget?: ClaudeSettingsWitnessBudget): string;
 export declare function upgradeCodexSettingsWitness(previous: {
     path: string;
-    hashMode?: "bytes";
+    hashMode?: "bytes" | "codex-settings-v1";
     sha256: string;
-}, reviewedSettingsPath: string): ReturnType<typeof captureCodexSettings>;
+}, reviewedSettingsPath: string): ReturnType<typeof captureCodexSettingsV2>;