@hasna/skills 0.10.22 → 0.10.24

package/README.md

@@ -431,6 +431,12 @@ directory within your home, add `--allow-root-aliases` to hook installation and
 native migration. The plan records and rechecks the exact link and target;
 links inside skill contents or configuration files remain refused.
 
+On macOS, the OS-owned `/var`, `/tmp` and `/etc` aliases into `/private` are
+accepted only while their exact targets and protected parent directories verify.
+The protection check refuses extended ACLs and unavailable native ACL inspection.
+Inventory reports canonical paths and deduplicates their alias spellings. This
+does not permit other root-owned links or user-controlled ancestor links.
+
 Cooperating installers can use the root package's
 `planClaudeStopHookUpdate({ expectedSettingsSha256, replacement })`, then
 `applyAgentIntegration(plan)`, to write an explicitly authorized Claude settings
@@ -519,8 +525,12 @@ Only manifest version metadata may vary. Reviewed app declarations use the impli
 `id`, optional `category`, and optional boolean `required`. The entire canonical app
 file and its presence stay bound; it preserves existing connector availability and
 native capability hints. Changed or unknown app fields, custom references, native
-hooks, commands and MCP controls refuse. Name controls suppress Skills, not every
-plugin capability. No prompt hook starts an app server to obtain this receipt:
+hooks, commands and unsupported MCP controls refuse. Referenced own-root
+`./.mcp.json` declarations may preserve local stdio servers with Codex's typed
+tool, approval, timeout and environment metadata. Their complete fingerprints
+and presence remain bound; review never executes commands or resolves environment
+values. Name controls suppress Skills, not every plugin capability.
+No prompt hook starts an app server to obtain this receipt:
 native startup can maintain caches. The explicit capture starts and closes only its
 own bounded native client; it does not reload an existing agent session.
 Neither a receipt nor a config write proves an existing session adopted new rules;

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.22",
+    version: "0.10.24",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -39931,7 +39931,7 @@ function assertAgentPolicyCollections(policy) {
     }
   if (bridge.codexPluginSkills !== undefined)
     for (const control of array(bridge.codexPluginSkills, 4096)) {
-      requireBound(object(control) && Object.keys(control).every((key) => ["name", "pluginId", "namespace", "pluginParent", "manifestSha256", "appSha256", "remotePluginId"].includes(key)));
+      requireBound(object(control) && Object.keys(control).every((key) => ["name", "pluginId", "namespace", "pluginParent", "manifestSha256", "appSha256", "mcpSha256", "remotePluginId"].includes(key)));
       text(control.name, 129);
       text(control.pluginId, 1024);
       text(control.namespace, 64);
@@ -39939,6 +39939,8 @@ function assertAgentPolicyCollections(policy) {
       requireBound(isAbsolute2(control.pluginParent) && resolve3(control.pluginParent) === control.pluginParent && /^[a-f0-9]{64}$/.test(control.manifestSha256));
       if (control.remotePluginId !== undefined)
         requireBound(typeof control.remotePluginId === "string" && /^[A-Za-z0-9_~-]{1,1024}$/.test(control.remotePluginId));
+      if (control.mcpSha256 !== undefined)
+        requireBound(typeof control.mcpSha256 === "string" && /^[a-f0-9]{64}$/.test(control.mcpSha256));
       if (control.appSha256 !== undefined)
         requireBound(typeof control.appSha256 === "string" && /^[a-f0-9]{64}$/.test(control.appSha256));
     }
@@ -51226,6 +51228,77 @@ function appControls(path, read2) {
   }
   return sha2562;
 }
+function mcpControls(path, read2) {
+  const text2 = read2(path);
+  let value, sha2562;
+  try {
+    sha2562 = hashNativeJsonControls(text2);
+    value = JSON.parse(text2);
+  } catch {
+    refuse2();
+  }
+  const object5 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v));
+  const textField = (v, empty = false) => typeof v === "string" && (empty || Boolean(v.trim())) && Buffer.byteLength(v) <= 16384 && !/[\x00-\x1f\x7f]/.test(v);
+  const envName = (v) => typeof v === "string" && /^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(v);
+  const optional = (v, valid) => v === undefined || v === null || valid(v);
+  const stringList = (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => textField(item));
+  const approval = (v) => ["auto", "prompt", "writes", "approve"].includes(v);
+  const duration = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+  const positiveInteger = (v) => Number.isSafeInteger(v) && v > 0;
+  const fields = [
+    "command",
+    "args",
+    "cwd",
+    "env",
+    "env_vars",
+    "enabled",
+    "required",
+    "environment_id",
+    "startup_readiness",
+    "supports_parallel_tool_calls",
+    "tool_input_schema_max_bytes",
+    "startup_timeout_sec",
+    "startup_timeout_ms",
+    "tool_timeout_sec",
+    "default_tools_approval_mode",
+    "enabled_tools",
+    "disabled_tools",
+    "omit_tools_from",
+    "tools",
+    "name"
+  ];
+  if (!object5(value) || Object.keys(value).length !== 1 || !object5(value.mcpServers))
+    refuse2();
+  const servers = Object.entries(value.mcpServers);
+  if (!servers.length || servers.length > 256)
+    refuse2();
+  for (const [name, server] of servers) {
+    if (!identifier2(name) || !object5(server) || !Object.keys(server).every((key) => fields.includes(key)) || !textField(server.command) || !optional(server.args, (v) => Array.isArray(v) && v.length <= 256 && v.every((arg) => textField(arg, true))) || !optional(server.cwd, textField) || !optional(server.env, (v) => object5(v) && Object.keys(v).length <= 256 && Object.entries(v).every(([key, value2]) => envName(key) && textField(value2, true))) || !["enabled", "required", "supports_parallel_tool_calls"].every((key) => optional(server[key], (v) => typeof v === "boolean")) || !optional(server.environment_id, (v) => v === "local") || !optional(server.startup_readiness, (v) => ["connection", "catalog"].includes(v)) || !optional(server.tool_input_schema_max_bytes, positiveInteger) || !["startup_timeout_sec", "tool_timeout_sec"].every((key) => optional(server[key], duration)) || !optional(server.startup_timeout_ms, (v) => Number.isSafeInteger(v) && v >= 0) || !optional(server.default_tools_approval_mode, approval) || !["enabled_tools", "disabled_tools"].every((key) => optional(server[key], stringList)) || !optional(server.omit_tools_from, (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => ["code_mode", "deferred", "direct"].includes(item))) || !optional(server.name, textField))
+      refuse2();
+    if (server.env_vars !== undefined && server.env_vars !== null) {
+      if (!Array.isArray(server.env_vars) || server.env_vars.length > 256)
+        refuse2();
+      const names = server.env_vars.map((entry) => {
+        if (envName(entry))
+          return entry;
+        if (!object5(entry) || !Object.keys(entry).every((key) => ["name", "source"].includes(key)) || !envName(entry.name) || !optional(entry.source, (v) => v === "local"))
+          refuse2();
+        return entry.name;
+      });
+      if (new Set(names).size !== names.length)
+        refuse2();
+    }
+    if (server.tools !== undefined && server.tools !== null) {
+      if (!object5(server.tools) || Object.keys(server.tools).length > 256)
+        refuse2();
+      for (const [tool, config] of Object.entries(server.tools)) {
+        if (!textField(tool) || !object5(config) || !Object.keys(config).every((key) => ["approval_mode", "output_token_limit"].includes(key)) || !optional(config.approval_mode, approval) || !optional(config.output_token_limit, positiveInteger))
+          refuse2();
+      }
+    }
+  }
+  return sha2562;
+}
 function rootControls(root, read2) {
   const manifestPath = join18(root, ".codex-plugin/plugin.json"), manifestFile = lstatSync12(manifestPath, { throwIfNoEntry: false });
   if (!lstatSync12(join18(root, ".codex-plugin"), { throwIfNoEntry: false })?.isDirectory() || !manifestFile?.isFile() || manifestFile.size > 1024 * 1024)
@@ -51243,15 +51316,21 @@ function rootControls(root, read2) {
   const cacheVersion = basename5(root), declaredVersion = manifest.version === undefined ? "" : typeof manifest.version === "string" ? manifest.version.trim() : null;
   if (declaredVersion === null || (declaredVersion ? declaredVersion !== cacheVersion : cacheVersion !== CODEX_DEFAULT_AGENT_PLUGIN_VERSION))
     refuse2();
-  if (manifest.hooks !== undefined || manifest.mcpServers !== undefined || manifest.commands !== undefined || manifest.apps !== undefined && manifest.apps !== "./.app.json" || ["hooks", ".mcp.json"].some((path) => lstatSync12(join18(root, path), { throwIfNoEntry: false })))
+  if (manifest.hooks !== undefined || manifest.commands !== undefined || manifest.mcpServers !== undefined && manifest.mcpServers !== "./.mcp.json" || manifest.apps !== undefined && manifest.apps !== "./.app.json" || lstatSync12(join18(root, "hooks"), { throwIfNoEntry: false }))
+    refuse2();
+  const mcp = join18(root, ".mcp.json"), mcpPresent = lstatSync12(mcp, { throwIfNoEntry: false });
+  if (mcpPresent && (!mcpPresent.isFile() || mcpPresent.isSymbolicLink() || mcpPresent.size > 1024 * 1024 || realpathSync5(mcp) !== mcp))
+    refuse2();
+  if (Boolean(mcpPresent) !== (manifest.mcpServers !== undefined))
     refuse2();
+  const mcpSha256 = mcpPresent ? mcpControls(mcp, read2) : undefined;
   const app = join18(root, ".app.json"), present = lstatSync12(app, { throwIfNoEntry: false });
   if (present && (!present.isFile() || present.isSymbolicLink() || present.size > 1024 * 1024))
     refuse2();
   if (manifest.apps !== undefined && !present)
     refuse2();
   const appSha256 = present ? appControls(app, read2) : undefined;
-  return { namespace: manifest.name, manifestSha256, ...appSha256 ? { appSha256 } : {} };
+  return { namespace: manifest.name, manifestSha256, ...appSha256 ? { appSha256 } : {}, ...mcpSha256 ? { mcpSha256 } : {} };
 }
 function identity4(document3, cache3, read2) {
   if (!document3.startsWith(cache3 + sep4) || !document3.endsWith(sep4 + "SKILL.md"))
@@ -51314,7 +51393,7 @@ function reviewedCodexPluginCapabilitiesUnchanged(cache3, controls, read2) {
         if (!stat.isDirectory() || ![".codex-plugin/plugin.json", ".app.json", "hooks", ".mcp.json"].some((path) => lstatSync12(join18(root, path), { throwIfNoEntry: false })))
           continue;
         const parsed = rootControls(root, read2);
-        if (!controls.some((control) => control.pluginParent === parent && control.namespace === parsed.namespace && control.manifestSha256 === parsed.manifestSha256 && control.appSha256 === parsed.appSha256))
+        if (!controls.some((control) => control.pluginParent === parent && control.namespace === parsed.namespace && control.manifestSha256 === parsed.manifestSha256 && control.appSha256 === parsed.appSha256 && control.mcpSha256 === parsed.mcpSha256))
           return false;
       }
     }
@@ -51374,7 +51453,7 @@ function reviewCodexPluginSkillControls(catalog, documents, cache3, cwd2, read2,
     }
     result2.push({ ...parsed, pluginId: expectedPluginId, ...remotePluginId ? { remotePluginId } : {} });
   }
-  if (!result2.length || new Set(result2.map((item) => item.name)).size !== result2.length)
+  if (!result2.length && documents.some((document3) => document3.startsWith(cache3 + sep4)) || new Set(result2.map((item) => item.name)).size !== result2.length)
     refuse2();
   return result2;
 }
@@ -51387,7 +51466,7 @@ function isReviewedCodexPluginSkillDisabled(document3, cache3, controls, rules,
   } catch {
     return false;
   }
-  const reviewed = controls.find((item) => item.name === parsed.name && item.namespace === parsed.namespace && item.pluginParent === parsed.pluginParent && item.manifestSha256 === parsed.manifestSha256 && item.appSha256 === parsed.appSha256);
+  const reviewed = controls.find((item) => item.name === parsed.name && item.namespace === parsed.namespace && item.pluginParent === parsed.pluginParent && item.manifestSha256 === parsed.manifestSha256 && item.appSha256 === parsed.appSha256 && item.mcpSha256 === parsed.mcpSha256);
   if (!reviewed || reviewed.remotePluginId !== undefined && !remoteInstallationMatches(reviewed.pluginParent, reviewed.remotePluginId, read2))
     return false;
   return isCodexNativeSkillDisabled({ name: parsed.name, path: document3, pluginId: reviewed.pluginId, enabled: true }, rules);
@@ -52077,10 +52156,75 @@ import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
 import { existsSync as existsSync12, lstatSync as lstatSync15, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync13, readdirSync as readdirSync8, opendirSync as opendirSync3, readlinkSync as readlinkSync4, realpathSync as realpathSync6, renameSync as renameSync2, rmdirSync as rmdirSync2, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3, chmodSync, openSync as openSync8, closeSync as closeSync8, fsyncSync as fsyncSync2, fstatSync as fstatSync8, readSync as readSync6, constants as constants8, linkSync } from "fs";
 import { dirname as dirname11, join as join21, resolve as resolve11, relative as relative5, isAbsolute as isAbsolute11, sep as sep5 } from "path";
 import { homedir as homedir3 } from "os";
+function hasNoDarwinAcl(fd) {
+  try {
+    const { dlopen, read: read2 } = __require("bun:ffi");
+    const library = dlopen("/usr/lib/libSystem.B.dylib", {
+      acl_get_fd: { args: ["i32"], returns: "ptr" },
+      acl_free: { args: ["ptr"], returns: "i32" },
+      __error: { args: [], returns: "ptr" }
+    });
+    try {
+      const errno = library.symbols.__error();
+      if (!errno)
+        return false;
+      const acl = library.symbols.acl_get_fd(fd);
+      if (acl) {
+        library.symbols.acl_free(acl);
+        return false;
+      }
+      return (acl === null || acl === 0) && read2.i32(errno) === 2;
+    } finally {
+      library.close();
+    }
+  } catch {
+    return false;
+  }
+}
+function isSystemRootAlias(path) {
+  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(path))
+    return false;
+  const target = `/private${path}`, link2 = `private${path}`;
+  const identity5 = (stat) => `${stat.dev}:${stat.ino}:${stat.ctimeNs}:${stat.uid}:${stat.mode}`;
+  try {
+    const before2 = lstatSync15(path, { bigint: true });
+    if (!before2.isSymbolicLink() || before2.uid !== 0n || readlinkSync4(path) !== link2)
+      return false;
+    const directories = ["/", "/private", target].map((directory) => {
+      const stat = lstatSync15(directory, { bigint: true });
+      if (!stat.isDirectory() || stat.uid !== 0n)
+        throw new Error("Untrusted system alias directory");
+      if (directory !== "/private/tmp") {
+        if ((stat.mode & 0o022n) !== 0n)
+          throw new Error("Writable system alias directory");
+      } else if ((stat.mode & 0o1000n) === 0n)
+        throw new Error("Unprotected system temporary directory");
+      const fd = openSync8(directory, constants8.O_RDONLY | constants8.O_DIRECTORY | constants8.O_NOFOLLOW);
+      try {
+        if (identity5(fstatSync8(fd, { bigint: true })) !== identity5(stat) || !hasNoDarwinAcl(fd) || identity5(fstatSync8(fd, { bigint: true })) !== identity5(stat))
+          throw new Error("Unverified system alias directory ACL");
+      } finally {
+        closeSync8(fd);
+      }
+      return { directory, identity: identity5(stat) };
+    });
+    return realpathSync6(path) === target && readlinkSync4(path) === link2 && identity5(lstatSync15(path, { bigint: true })) === identity5(before2) && directories.every((item) => identity5(lstatSync15(item.directory, { bigint: true })) === item.identity);
+  } catch {
+    return false;
+  }
+}
+function canonicalSystemPath(path) {
+  const absolute = resolve11(path), root = `/${absolute.split(sep5)[1]}`;
+  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(root) || !lstatSync15(root, { throwIfNoEntry: false })?.isSymbolicLink())
+    return absolute;
+  if (!isSystemRootAlias(root))
+    throw new Error(`Refusing symlink path: ${root}`);
+  return `/private${absolute}`;
+}
 function assertSafePath(path) {
   let cursor = resolve11(path);
   while (true) {
-    if (lstatSync15(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync15(cursor, { throwIfNoEntry: false })?.isSymbolicLink() && !isSystemRootAlias(cursor))
       throw new Error(`Refusing symlink path: ${cursor}`);
     const parent = dirname11(cursor);
     if (parent === cursor)
@@ -52116,7 +52260,7 @@ function rootAliases(home, allowed = false) {
   return result2;
 }
 function canonicalAgentPath(path, aliases) {
-  const absolute = resolve11(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep5));
+  const absolute = canonicalSystemPath(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep5));
   return binding ? join21(binding.target, relative5(binding.alias, absolute)) : absolute;
 }
 function disabledCodexSkillPaths(config, aliases) {
@@ -52233,8 +52377,10 @@ function parseNativeMigrationTargetManifest(input) {
       throw new Error("Invalid native migration target fields");
     if (!ROOTS.some(([agent]) => agent === item.agent))
       throw new Error(`Unsupported native migration target agent: ${item.agent}`);
-    const projectRoot = resolve11(item.projectRoot);
-    if (!isAbsolute11(item.projectRoot) || projectRoot !== item.projectRoot || !existsSync12(projectRoot) || !lstatSync15(projectRoot).isDirectory())
+    if (!isAbsolute11(item.projectRoot) || resolve11(item.projectRoot) !== item.projectRoot)
+      throw new Error(`Native migration target project root must be an existing absolute directory: ${item.projectRoot}`);
+    const projectRoot = canonicalSystemPath(item.projectRoot);
+    if (!existsSync12(projectRoot) || !lstatSync15(projectRoot).isDirectory())
       throw new Error(`Native migration target project root must be an existing absolute directory: ${item.projectRoot}`);
     assertSafePath(projectRoot);
     if (isAbsolute11(item.path) || item.path.includes("\\") || item.path.length === 0 || item.path.includes("\x00"))
@@ -52244,7 +52390,7 @@ function parseNativeMigrationTargetManifest(input) {
       throw new Error(`Native migration target path escapes or is not normalized: ${item.path}`);
     if (!/^[0-9a-f]{64}$/.test(item.treeSha256))
       throw new Error(`Invalid native migration tree digest for ${item.path}`);
-    const identity5 = `${item.agent}\x00${projectRoot}\x00${normalized}`;
+    const identity5 = `${item.agent}\x00${canonicalSystemPath(projectRoot)}\x00${normalized}`;
     if (identities.has(identity5))
       throw new Error(`Duplicate native migration target: ${item.path}`);
     identities.add(identity5);
@@ -52261,17 +52407,19 @@ function selectNativeMigrationTargets(inventory, manifest) {
   const identities = new Set;
   const selected = [];
   for (const target of manifest.targets) {
-    const projectRoot = resolve11(target.projectRoot), normalized = relative5(projectRoot, resolve11(projectRoot, target.path));
-    if (!isAbsolute11(target.projectRoot) || projectRoot !== target.projectRoot || !existsSync12(projectRoot) || !lstatSync15(projectRoot).isDirectory())
+    if (!isAbsolute11(target.projectRoot) || resolve11(target.projectRoot) !== target.projectRoot)
+      throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
+    const projectRoot = canonicalSystemPath(target.projectRoot), normalized = relative5(projectRoot, resolve11(projectRoot, target.path));
+    if (!existsSync12(projectRoot) || !lstatSync15(projectRoot).isDirectory())
       throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
     assertSafePath(projectRoot);
     if (isAbsolute11(target.path) || target.path.includes("\\") || target.path.includes("\x00") || !normalized || normalized === ".." || normalized.startsWith(`..${sep5}`) || normalized !== target.path || !/^[0-9a-f]{64}$/.test(target.treeSha256))
       throw new Error(`Invalid native migration target: ${target.path}`);
-    const identity5 = `${target.agent}\x00${projectRoot}\x00${normalized}`;
+    const identity5 = `${target.agent}\x00${canonicalSystemPath(projectRoot)}\x00${normalized}`;
     if (identities.has(identity5))
       throw new Error(`Duplicate native migration target: ${target.path}`);
     identities.add(identity5);
-    const expected = resolve11(target.projectRoot, target.path);
+    const expected = canonicalSystemPath(resolve11(target.projectRoot, target.path));
     const matches2 = inventory.filter((entry2) => entry2.agent === target.agent && resolve11(entry2.path) === expected);
     if (matches2.length !== 1)
       throw new Error(`Native migration target was not found exactly once: ${target.agent} ${target.projectRoot}/${target.path}`);
@@ -52287,7 +52435,7 @@ function selectNativeMigrationTargets(inventory, manifest) {
 function projectAncestorDirectories(projects) {
   const directories = new Set;
   for (const project of projects) {
-    for (let path = resolve11(project), depth = 0;; depth++) {
+    for (let path = canonicalSystemPath(project), depth = 0;; depth++) {
       if (depth >= 100)
         throw new Error("NATIVE_SKILL_DRIFT: project ancestor discovery limit exceeded");
       directories.add(path);
@@ -52300,11 +52448,13 @@ function projectAncestorDirectories(projects) {
   return [...directories];
 }
 function inventoryNativeSkills(home = homedir3(), options = {}) {
+  home = canonicalSystemPath(home);
   if (options.reviewedCacheAlias !== undefined && (!options.includeVendor || !isAbsolute11(options.reviewedCacheAlias) || resolve11(options.reviewedCacheAlias) !== options.reviewedCacheAlias))
     throw new Error("A reviewed cache alias requires vendor inventory and an exact absolute path");
   if (options.disabledVendorPaths?.some((path) => !isAbsolute11(path) || resolve11(path) !== path))
     throw new Error("Disabled vendor paths must be exact absolute paths");
-  const disabledVendorPaths = new Set(options.disabledVendorPaths ?? []);
+  const reviewedCacheAlias = options.reviewedCacheAlias === undefined ? undefined : canonicalSystemPath(options.reviewedCacheAlias);
+  const disabledVendorPaths = new Set((options.disabledVendorPaths ?? []).map(canonicalSystemPath));
   const aliases = rootAliases(home, options.allowRootAliases);
   const selectedAgents = options.agents ? new Set(options.agents) : undefined;
   const includesAgent = (agent) => !selectedAgents || selectedAgents.has(agent);
@@ -52327,8 +52477,11 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
   }
   let reviewedCacheAliasFound = false;
   function verifiedSiblingCacheAlias(agent, path, parent) {
-    const link2 = readlinkSync4(path), target = resolve11(parent, link2);
-    if (dirname11(target) !== parent || (isAbsolute11(link2) ? link2 !== target : dirname11(link2) !== "."))
+    const link2 = readlinkSync4(path), lexicalTarget = resolve11(parent, link2);
+    if (isAbsolute11(link2) ? link2 !== lexicalTarget : dirname11(link2) !== ".")
+      return false;
+    const target = canonicalSystemPath(lexicalTarget);
+    if (dirname11(target) !== parent)
       return false;
     if (!lstatSync15(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
@@ -52337,11 +52490,11 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       return false;
     if (scan.hasSkills) {
       const targetSkills = entries.filter((entry) => entry.agent === agent && entry.vendor && (entry.path === target || entry.path.startsWith(target + sep5)));
-      if (path === options.reviewedCacheAlias && targetSkills.length > 0)
+      if (path === reviewedCacheAlias && targetSkills.length > 0)
         reviewedCacheAliasFound = true;
       if (agent === "codex" && targetSkills.length > 0 && targetSkills.every((entry) => disabledVendorPaths.has(entry.path) || options.disabledVendorSkill?.(entry) === true))
         return true;
-      if (path !== options.reviewedCacheAlias)
+      if (path !== reviewedCacheAlias)
         return false;
     }
     return true;

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.22",
+    version: "0.10.24",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -38253,7 +38253,7 @@ function assertAgentPolicyCollections(policy) {
     }
   if (bridge.codexPluginSkills !== undefined)
     for (const control of array3(bridge.codexPluginSkills, 4096)) {
-      requireBound(object4(control) && Object.keys(control).every((key) => ["name", "pluginId", "namespace", "pluginParent", "manifestSha256", "appSha256", "remotePluginId"].includes(key)));
+      requireBound(object4(control) && Object.keys(control).every((key) => ["name", "pluginId", "namespace", "pluginParent", "manifestSha256", "appSha256", "mcpSha256", "remotePluginId"].includes(key)));
       text(control.name, 129);
       text(control.pluginId, 1024);
       text(control.namespace, 64);
@@ -38261,6 +38261,8 @@ function assertAgentPolicyCollections(policy) {
       requireBound(isAbsolute3(control.pluginParent) && resolve2(control.pluginParent) === control.pluginParent && /^[a-f0-9]{64}$/.test(control.manifestSha256));
       if (control.remotePluginId !== undefined)
         requireBound(typeof control.remotePluginId === "string" && /^[A-Za-z0-9_~-]{1,1024}$/.test(control.remotePluginId));
+      if (control.mcpSha256 !== undefined)
+        requireBound(typeof control.mcpSha256 === "string" && /^[a-f0-9]{64}$/.test(control.mcpSha256));
       if (control.appSha256 !== undefined)
         requireBound(typeof control.appSha256 === "string" && /^[a-f0-9]{64}$/.test(control.appSha256));
     }

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.22",
+  version: "0.10.24",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.22",
+  version: "0.10.24",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -24125,7 +24125,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.22",
+  version: "0.10.24",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/index.js

@@ -9038,7 +9038,7 @@ function assertAgentPolicyCollections(policy) {
     }
   if (bridge.codexPluginSkills !== undefined)
     for (const control of array(bridge.codexPluginSkills, 4096)) {
-      requireBound(object(control) && Object.keys(control).every((key) => ["name", "pluginId", "namespace", "pluginParent", "manifestSha256", "appSha256", "remotePluginId"].includes(key)));
+      requireBound(object(control) && Object.keys(control).every((key) => ["name", "pluginId", "namespace", "pluginParent", "manifestSha256", "appSha256", "mcpSha256", "remotePluginId"].includes(key)));
       text(control.name, 129);
       text(control.pluginId, 1024);
       text(control.namespace, 64);
@@ -9046,6 +9046,8 @@ function assertAgentPolicyCollections(policy) {
       requireBound(isAbsolute2(control.pluginParent) && resolve2(control.pluginParent) === control.pluginParent && /^[a-f0-9]{64}$/.test(control.manifestSha256));
       if (control.remotePluginId !== undefined)
         requireBound(typeof control.remotePluginId === "string" && /^[A-Za-z0-9_~-]{1,1024}$/.test(control.remotePluginId));
+      if (control.mcpSha256 !== undefined)
+        requireBound(typeof control.mcpSha256 === "string" && /^[a-f0-9]{64}$/.test(control.mcpSha256));
       if (control.appSha256 !== undefined)
         requireBound(typeof control.appSha256 === "string" && /^[a-f0-9]{64}$/.test(control.appSha256));
     }
@@ -10879,7 +10881,7 @@ function replaceSkillSession(expected, replacement, plan, options = {}, beforeCo
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.22",
+  version: "0.10.24",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -13367,6 +13369,77 @@ function appControls(path, read2) {
   }
   return sha2562;
 }
+function mcpControls(path, read2) {
+  const text2 = read2(path);
+  let value, sha2562;
+  try {
+    sha2562 = hashNativeJsonControls(text2);
+    value = JSON.parse(text2);
+  } catch {
+    refuse2();
+  }
+  const object5 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v));
+  const textField = (v, empty = false) => typeof v === "string" && (empty || Boolean(v.trim())) && Buffer.byteLength(v) <= 16384 && !/[\x00-\x1f\x7f]/.test(v);
+  const envName = (v) => typeof v === "string" && /^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(v);
+  const optional = (v, valid) => v === undefined || v === null || valid(v);
+  const stringList = (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => textField(item));
+  const approval = (v) => ["auto", "prompt", "writes", "approve"].includes(v);
+  const duration = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+  const positiveInteger = (v) => Number.isSafeInteger(v) && v > 0;
+  const fields = [
+    "command",
+    "args",
+    "cwd",
+    "env",
+    "env_vars",
+    "enabled",
+    "required",
+    "environment_id",
+    "startup_readiness",
+    "supports_parallel_tool_calls",
+    "tool_input_schema_max_bytes",
+    "startup_timeout_sec",
+    "startup_timeout_ms",
+    "tool_timeout_sec",
+    "default_tools_approval_mode",
+    "enabled_tools",
+    "disabled_tools",
+    "omit_tools_from",
+    "tools",
+    "name"
+  ];
+  if (!object5(value) || Object.keys(value).length !== 1 || !object5(value.mcpServers))
+    refuse2();
+  const servers = Object.entries(value.mcpServers);
+  if (!servers.length || servers.length > 256)
+    refuse2();
+  for (const [name, server] of servers) {
+    if (!identifier2(name) || !object5(server) || !Object.keys(server).every((key) => fields.includes(key)) || !textField(server.command) || !optional(server.args, (v) => Array.isArray(v) && v.length <= 256 && v.every((arg) => textField(arg, true))) || !optional(server.cwd, textField) || !optional(server.env, (v) => object5(v) && Object.keys(v).length <= 256 && Object.entries(v).every(([key, value2]) => envName(key) && textField(value2, true))) || !["enabled", "required", "supports_parallel_tool_calls"].every((key) => optional(server[key], (v) => typeof v === "boolean")) || !optional(server.environment_id, (v) => v === "local") || !optional(server.startup_readiness, (v) => ["connection", "catalog"].includes(v)) || !optional(server.tool_input_schema_max_bytes, positiveInteger) || !["startup_timeout_sec", "tool_timeout_sec"].every((key) => optional(server[key], duration)) || !optional(server.startup_timeout_ms, (v) => Number.isSafeInteger(v) && v >= 0) || !optional(server.default_tools_approval_mode, approval) || !["enabled_tools", "disabled_tools"].every((key) => optional(server[key], stringList)) || !optional(server.omit_tools_from, (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => ["code_mode", "deferred", "direct"].includes(item))) || !optional(server.name, textField))
+      refuse2();
+    if (server.env_vars !== undefined && server.env_vars !== null) {
+      if (!Array.isArray(server.env_vars) || server.env_vars.length > 256)
+        refuse2();
+      const names = server.env_vars.map((entry) => {
+        if (envName(entry))
+          return entry;
+        if (!object5(entry) || !Object.keys(entry).every((key) => ["name", "source"].includes(key)) || !envName(entry.name) || !optional(entry.source, (v) => v === "local"))
+          refuse2();
+        return entry.name;
+      });
+      if (new Set(names).size !== names.length)
+        refuse2();
+    }
+    if (server.tools !== undefined && server.tools !== null) {
+      if (!object5(server.tools) || Object.keys(server.tools).length > 256)
+        refuse2();
+      for (const [tool, config] of Object.entries(server.tools)) {
+        if (!textField(tool) || !object5(config) || !Object.keys(config).every((key) => ["approval_mode", "output_token_limit"].includes(key)) || !optional(config.approval_mode, approval) || !optional(config.output_token_limit, positiveInteger))
+          refuse2();
+      }
+    }
+  }
+  return sha2562;
+}
 function rootControls(root, read2) {
   const manifestPath = join14(root, ".codex-plugin/plugin.json"), manifestFile = lstatSync12(manifestPath, { throwIfNoEntry: false });
   if (!lstatSync12(join14(root, ".codex-plugin"), { throwIfNoEntry: false })?.isDirectory() || !manifestFile?.isFile() || manifestFile.size > 1024 * 1024)
@@ -13384,15 +13457,21 @@ function rootControls(root, read2) {
   const cacheVersion = basename5(root), declaredVersion = manifest.version === undefined ? "" : typeof manifest.version === "string" ? manifest.version.trim() : null;
   if (declaredVersion === null || (declaredVersion ? declaredVersion !== cacheVersion : cacheVersion !== CODEX_DEFAULT_AGENT_PLUGIN_VERSION))
     refuse2();
-  if (manifest.hooks !== undefined || manifest.mcpServers !== undefined || manifest.commands !== undefined || manifest.apps !== undefined && manifest.apps !== "./.app.json" || ["hooks", ".mcp.json"].some((path) => lstatSync12(join14(root, path), { throwIfNoEntry: false })))
+  if (manifest.hooks !== undefined || manifest.commands !== undefined || manifest.mcpServers !== undefined && manifest.mcpServers !== "./.mcp.json" || manifest.apps !== undefined && manifest.apps !== "./.app.json" || lstatSync12(join14(root, "hooks"), { throwIfNoEntry: false }))
+    refuse2();
+  const mcp = join14(root, ".mcp.json"), mcpPresent = lstatSync12(mcp, { throwIfNoEntry: false });
+  if (mcpPresent && (!mcpPresent.isFile() || mcpPresent.isSymbolicLink() || mcpPresent.size > 1024 * 1024 || realpathSync5(mcp) !== mcp))
+    refuse2();
+  if (Boolean(mcpPresent) !== (manifest.mcpServers !== undefined))
     refuse2();
+  const mcpSha256 = mcpPresent ? mcpControls(mcp, read2) : undefined;
   const app = join14(root, ".app.json"), present = lstatSync12(app, { throwIfNoEntry: false });
   if (present && (!present.isFile() || present.isSymbolicLink() || present.size > 1024 * 1024))
     refuse2();
   if (manifest.apps !== undefined && !present)
     refuse2();
   const appSha256 = present ? appControls(app, read2) : undefined;
-  return { namespace: manifest.name, manifestSha256, ...appSha256 ? { appSha256 } : {} };
+  return { namespace: manifest.name, manifestSha256, ...appSha256 ? { appSha256 } : {}, ...mcpSha256 ? { mcpSha256 } : {} };
 }
 function identity3(document2, cache, read2) {
   if (!document2.startsWith(cache + sep4) || !document2.endsWith(sep4 + "SKILL.md"))
@@ -13455,7 +13534,7 @@ function reviewedCodexPluginCapabilitiesUnchanged(cache, controls, read2) {
         if (!stat.isDirectory() || ![".codex-plugin/plugin.json", ".app.json", "hooks", ".mcp.json"].some((path) => lstatSync12(join14(root, path), { throwIfNoEntry: false })))
           continue;
         const parsed = rootControls(root, read2);
-        if (!controls.some((control) => control.pluginParent === parent && control.namespace === parsed.namespace && control.manifestSha256 === parsed.manifestSha256 && control.appSha256 === parsed.appSha256))
+        if (!controls.some((control) => control.pluginParent === parent && control.namespace === parsed.namespace && control.manifestSha256 === parsed.manifestSha256 && control.appSha256 === parsed.appSha256 && control.mcpSha256 === parsed.mcpSha256))
           return false;
       }
     }
@@ -13515,7 +13594,7 @@ function reviewCodexPluginSkillControls(catalog, documents, cache, cwd, read2, r
     }
     result.push({ ...parsed, pluginId: expectedPluginId, ...remotePluginId ? { remotePluginId } : {} });
   }
-  if (!result.length || new Set(result.map((item) => item.name)).size !== result.length)
+  if (!result.length && documents.some((document2) => document2.startsWith(cache + sep4)) || new Set(result.map((item) => item.name)).size !== result.length)
     refuse2();
   return result;
 }
@@ -13528,7 +13607,7 @@ function isReviewedCodexPluginSkillDisabled(document2, cache, controls, rules, r
   } catch {
     return false;
   }
-  const reviewed = controls.find((item) => item.name === parsed.name && item.namespace === parsed.namespace && item.pluginParent === parsed.pluginParent && item.manifestSha256 === parsed.manifestSha256 && item.appSha256 === parsed.appSha256);
+  const reviewed = controls.find((item) => item.name === parsed.name && item.namespace === parsed.namespace && item.pluginParent === parsed.pluginParent && item.manifestSha256 === parsed.manifestSha256 && item.appSha256 === parsed.appSha256 && item.mcpSha256 === parsed.mcpSha256);
   if (!reviewed || reviewed.remotePluginId !== undefined && !remoteInstallationMatches(reviewed.pluginParent, reviewed.remotePluginId, read2))
     return false;
   return isCodexNativeSkillDisabled({ name: parsed.name, path: document2, pluginId: reviewed.pluginId, enabled: true }, rules);
@@ -14201,10 +14280,75 @@ function disableCodexBundledSkills(text2) {
 // src/lib/agent-integration.ts
 var sha3 = (data) => createHash12("sha256").update(data).digest("hex");
 var ROOTS = NATIVE_SKILL_ROOTS;
+function hasNoDarwinAcl(fd) {
+  try {
+    const { dlopen, read: read2 } = __require("bun:ffi");
+    const library = dlopen("/usr/lib/libSystem.B.dylib", {
+      acl_get_fd: { args: ["i32"], returns: "ptr" },
+      acl_free: { args: ["ptr"], returns: "i32" },
+      __error: { args: [], returns: "ptr" }
+    });
+    try {
+      const errno = library.symbols.__error();
+      if (!errno)
+        return false;
+      const acl = library.symbols.acl_get_fd(fd);
+      if (acl) {
+        library.symbols.acl_free(acl);
+        return false;
+      }
+      return (acl === null || acl === 0) && read2.i32(errno) === 2;
+    } finally {
+      library.close();
+    }
+  } catch {
+    return false;
+  }
+}
+function isSystemRootAlias(path) {
+  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(path))
+    return false;
+  const target = `/private${path}`, link = `private${path}`;
+  const identity4 = (stat) => `${stat.dev}:${stat.ino}:${stat.ctimeNs}:${stat.uid}:${stat.mode}`;
+  try {
+    const before = lstatSync15(path, { bigint: true });
+    if (!before.isSymbolicLink() || before.uid !== 0n || readlinkSync4(path) !== link)
+      return false;
+    const directories = ["/", "/private", target].map((directory) => {
+      const stat = lstatSync15(directory, { bigint: true });
+      if (!stat.isDirectory() || stat.uid !== 0n)
+        throw new Error("Untrusted system alias directory");
+      if (directory !== "/private/tmp") {
+        if ((stat.mode & 0o022n) !== 0n)
+          throw new Error("Writable system alias directory");
+      } else if ((stat.mode & 0o1000n) === 0n)
+        throw new Error("Unprotected system temporary directory");
+      const fd = openSync8(directory, constants7.O_RDONLY | constants7.O_DIRECTORY | constants7.O_NOFOLLOW);
+      try {
+        if (identity4(fstatSync8(fd, { bigint: true })) !== identity4(stat) || !hasNoDarwinAcl(fd) || identity4(fstatSync8(fd, { bigint: true })) !== identity4(stat))
+          throw new Error("Unverified system alias directory ACL");
+      } finally {
+        closeSync8(fd);
+      }
+      return { directory, identity: identity4(stat) };
+    });
+    return realpathSync6(path) === target && readlinkSync4(path) === link && identity4(lstatSync15(path, { bigint: true })) === identity4(before) && directories.every((item) => identity4(lstatSync15(item.directory, { bigint: true })) === item.identity);
+  } catch {
+    return false;
+  }
+}
+function canonicalSystemPath(path) {
+  const absolute = resolve10(path), root = `/${absolute.split(sep5)[1]}`;
+  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(root) || !lstatSync15(root, { throwIfNoEntry: false })?.isSymbolicLink())
+    return absolute;
+  if (!isSystemRootAlias(root))
+    throw new Error(`Refusing symlink path: ${root}`);
+  return `/private${absolute}`;
+}
 function assertSafePath(path) {
   let cursor = resolve10(path);
   while (true) {
-    if (lstatSync15(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync15(cursor, { throwIfNoEntry: false })?.isSymbolicLink() && !isSystemRootAlias(cursor))
       throw new Error(`Refusing symlink path: ${cursor}`);
     const parent = dirname11(cursor);
     if (parent === cursor)
@@ -14240,7 +14384,7 @@ function rootAliases(home, allowed = false) {
   return result;
 }
 function canonicalAgentPath(path, aliases) {
-  const absolute = resolve10(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep5));
+  const absolute = canonicalSystemPath(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep5));
   return binding ? join17(binding.target, relative5(binding.alias, absolute)) : absolute;
 }
 function disabledCodexSkillPaths(config, aliases) {
@@ -14338,17 +14482,19 @@ function selectNativeMigrationTargets(inventory, manifest) {
   const identities = new Set;
   const selected = [];
   for (const target of manifest.targets) {
-    const projectRoot = resolve10(target.projectRoot), normalized = relative5(projectRoot, resolve10(projectRoot, target.path));
-    if (!isAbsolute11(target.projectRoot) || projectRoot !== target.projectRoot || !existsSync8(projectRoot) || !lstatSync15(projectRoot).isDirectory())
+    if (!isAbsolute11(target.projectRoot) || resolve10(target.projectRoot) !== target.projectRoot)
+      throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
+    const projectRoot = canonicalSystemPath(target.projectRoot), normalized = relative5(projectRoot, resolve10(projectRoot, target.path));
+    if (!existsSync8(projectRoot) || !lstatSync15(projectRoot).isDirectory())
       throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
     assertSafePath(projectRoot);
     if (isAbsolute11(target.path) || target.path.includes("\\") || target.path.includes("\x00") || !normalized || normalized === ".." || normalized.startsWith(`..${sep5}`) || normalized !== target.path || !/^[0-9a-f]{64}$/.test(target.treeSha256))
       throw new Error(`Invalid native migration target: ${target.path}`);
-    const identity4 = `${target.agent}\x00${projectRoot}\x00${normalized}`;
+    const identity4 = `${target.agent}\x00${canonicalSystemPath(projectRoot)}\x00${normalized}`;
     if (identities.has(identity4))
       throw new Error(`Duplicate native migration target: ${target.path}`);
     identities.add(identity4);
-    const expected = resolve10(target.projectRoot, target.path);
+    const expected = canonicalSystemPath(resolve10(target.projectRoot, target.path));
     const matches = inventory.filter((entry2) => entry2.agent === target.agent && resolve10(entry2.path) === expected);
     if (matches.length !== 1)
       throw new Error(`Native migration target was not found exactly once: ${target.agent} ${target.projectRoot}/${target.path}`);
@@ -14364,7 +14510,7 @@ function selectNativeMigrationTargets(inventory, manifest) {
 function projectAncestorDirectories(projects) {
   const directories = new Set;
   for (const project of projects) {
-    for (let path = resolve10(project), depth = 0;; depth++) {
+    for (let path = canonicalSystemPath(project), depth = 0;; depth++) {
       if (depth >= 100)
         throw new Error("NATIVE_SKILL_DRIFT: project ancestor discovery limit exceeded");
       directories.add(path);
@@ -14377,11 +14523,13 @@ function projectAncestorDirectories(projects) {
   return [...directories];
 }
 function inventoryNativeSkills(home = homedir2(), options = {}) {
+  home = canonicalSystemPath(home);
   if (options.reviewedCacheAlias !== undefined && (!options.includeVendor || !isAbsolute11(options.reviewedCacheAlias) || resolve10(options.reviewedCacheAlias) !== options.reviewedCacheAlias))
     throw new Error("A reviewed cache alias requires vendor inventory and an exact absolute path");
   if (options.disabledVendorPaths?.some((path) => !isAbsolute11(path) || resolve10(path) !== path))
     throw new Error("Disabled vendor paths must be exact absolute paths");
-  const disabledVendorPaths = new Set(options.disabledVendorPaths ?? []);
+  const reviewedCacheAlias = options.reviewedCacheAlias === undefined ? undefined : canonicalSystemPath(options.reviewedCacheAlias);
+  const disabledVendorPaths = new Set((options.disabledVendorPaths ?? []).map(canonicalSystemPath));
   const aliases = rootAliases(home, options.allowRootAliases);
   const selectedAgents = options.agents ? new Set(options.agents) : undefined;
   const includesAgent = (agent) => !selectedAgents || selectedAgents.has(agent);
@@ -14404,8 +14552,11 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
   }
   let reviewedCacheAliasFound = false;
   function verifiedSiblingCacheAlias(agent, path, parent) {
-    const link = readlinkSync4(path), target = resolve10(parent, link);
-    if (dirname11(target) !== parent || (isAbsolute11(link) ? link !== target : dirname11(link) !== "."))
+    const link = readlinkSync4(path), lexicalTarget = resolve10(parent, link);
+    if (isAbsolute11(link) ? link !== lexicalTarget : dirname11(link) !== ".")
+      return false;
+    const target = canonicalSystemPath(lexicalTarget);
+    if (dirname11(target) !== parent)
       return false;
     if (!lstatSync15(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
@@ -14414,11 +14565,11 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
       return false;
     if (scan.hasSkills) {
       const targetSkills = entries.filter((entry) => entry.agent === agent && entry.vendor && (entry.path === target || entry.path.startsWith(target + sep5)));
-      if (path === options.reviewedCacheAlias && targetSkills.length > 0)
+      if (path === reviewedCacheAlias && targetSkills.length > 0)
         reviewedCacheAliasFound = true;
       if (agent === "codex" && targetSkills.length > 0 && targetSkills.every((entry) => disabledVendorPaths.has(entry.path) || options.disabledVendorSkill?.(entry) === true))
         return true;
-      if (path !== options.reviewedCacheAlias)
+      if (path !== reviewedCacheAlias)
         return false;
     }
     return true;

package/dist/lib/codex-plugin-skill-controls.d.ts

@@ -6,6 +6,7 @@ export interface CodexPluginSkillControl {
     pluginParent: string;
     manifestSha256: string;
     appSha256?: string;
+    mcpSha256?: string;
     remotePluginId?: string;
 }
 type Read = (path: string) => string;

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.22",
+  version: "0.10.24",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -38347,6 +38347,77 @@ function appControls(path, read) {
   }
   return sha2562;
 }
+function mcpControls(path, read) {
+  const text = read(path);
+  let value, sha2562;
+  try {
+    sha2562 = hashNativeJsonControls(text);
+    value = JSON.parse(text);
+  } catch {
+    refuse3();
+  }
+  const object3 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v));
+  const textField = (v, empty = false) => typeof v === "string" && (empty || Boolean(v.trim())) && Buffer.byteLength(v) <= 16384 && !/[\x00-\x1f\x7f]/.test(v);
+  const envName = (v) => typeof v === "string" && /^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(v);
+  const optional = (v, valid) => v === undefined || v === null || valid(v);
+  const stringList = (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => textField(item));
+  const approval = (v) => ["auto", "prompt", "writes", "approve"].includes(v);
+  const duration = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+  const positiveInteger = (v) => Number.isSafeInteger(v) && v > 0;
+  const fields = [
+    "command",
+    "args",
+    "cwd",
+    "env",
+    "env_vars",
+    "enabled",
+    "required",
+    "environment_id",
+    "startup_readiness",
+    "supports_parallel_tool_calls",
+    "tool_input_schema_max_bytes",
+    "startup_timeout_sec",
+    "startup_timeout_ms",
+    "tool_timeout_sec",
+    "default_tools_approval_mode",
+    "enabled_tools",
+    "disabled_tools",
+    "omit_tools_from",
+    "tools",
+    "name"
+  ];
+  if (!object3(value) || Object.keys(value).length !== 1 || !object3(value.mcpServers))
+    refuse3();
+  const servers = Object.entries(value.mcpServers);
+  if (!servers.length || servers.length > 256)
+    refuse3();
+  for (const [name, server] of servers) {
+    if (!identifier3(name) || !object3(server) || !Object.keys(server).every((key) => fields.includes(key)) || !textField(server.command) || !optional(server.args, (v) => Array.isArray(v) && v.length <= 256 && v.every((arg) => textField(arg, true))) || !optional(server.cwd, textField) || !optional(server.env, (v) => object3(v) && Object.keys(v).length <= 256 && Object.entries(v).every(([key, value2]) => envName(key) && textField(value2, true))) || !["enabled", "required", "supports_parallel_tool_calls"].every((key) => optional(server[key], (v) => typeof v === "boolean")) || !optional(server.environment_id, (v) => v === "local") || !optional(server.startup_readiness, (v) => ["connection", "catalog"].includes(v)) || !optional(server.tool_input_schema_max_bytes, positiveInteger) || !["startup_timeout_sec", "tool_timeout_sec"].every((key) => optional(server[key], duration)) || !optional(server.startup_timeout_ms, (v) => Number.isSafeInteger(v) && v >= 0) || !optional(server.default_tools_approval_mode, approval) || !["enabled_tools", "disabled_tools"].every((key) => optional(server[key], stringList)) || !optional(server.omit_tools_from, (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => ["code_mode", "deferred", "direct"].includes(item))) || !optional(server.name, textField))
+      refuse3();
+    if (server.env_vars !== undefined && server.env_vars !== null) {
+      if (!Array.isArray(server.env_vars) || server.env_vars.length > 256)
+        refuse3();
+      const names = server.env_vars.map((entry) => {
+        if (envName(entry))
+          return entry;
+        if (!object3(entry) || !Object.keys(entry).every((key) => ["name", "source"].includes(key)) || !envName(entry.name) || !optional(entry.source, (v) => v === "local"))
+          refuse3();
+        return entry.name;
+      });
+      if (new Set(names).size !== names.length)
+        refuse3();
+    }
+    if (server.tools !== undefined && server.tools !== null) {
+      if (!object3(server.tools) || Object.keys(server.tools).length > 256)
+        refuse3();
+      for (const [tool, config] of Object.entries(server.tools)) {
+        if (!textField(tool) || !object3(config) || !Object.keys(config).every((key) => ["approval_mode", "output_token_limit"].includes(key)) || !optional(config.approval_mode, approval) || !optional(config.output_token_limit, positiveInteger))
+          refuse3();
+      }
+    }
+  }
+  return sha2562;
+}
 function rootControls(root, read) {
   const manifestPath = join10(root, ".codex-plugin/plugin.json"), manifestFile = lstatSync6(manifestPath, { throwIfNoEntry: false });
   if (!lstatSync6(join10(root, ".codex-plugin"), { throwIfNoEntry: false })?.isDirectory() || !manifestFile?.isFile() || manifestFile.size > 1024 * 1024)
@@ -38364,15 +38435,21 @@ function rootControls(root, read) {
   const cacheVersion = basename3(root), declaredVersion = manifest.version === undefined ? "" : typeof manifest.version === "string" ? manifest.version.trim() : null;
   if (declaredVersion === null || (declaredVersion ? declaredVersion !== cacheVersion : cacheVersion !== CODEX_DEFAULT_AGENT_PLUGIN_VERSION))
     refuse3();
-  if (manifest.hooks !== undefined || manifest.mcpServers !== undefined || manifest.commands !== undefined || manifest.apps !== undefined && manifest.apps !== "./.app.json" || ["hooks", ".mcp.json"].some((path) => lstatSync6(join10(root, path), { throwIfNoEntry: false })))
+  if (manifest.hooks !== undefined || manifest.commands !== undefined || manifest.mcpServers !== undefined && manifest.mcpServers !== "./.mcp.json" || manifest.apps !== undefined && manifest.apps !== "./.app.json" || lstatSync6(join10(root, "hooks"), { throwIfNoEntry: false }))
+    refuse3();
+  const mcp = join10(root, ".mcp.json"), mcpPresent = lstatSync6(mcp, { throwIfNoEntry: false });
+  if (mcpPresent && (!mcpPresent.isFile() || mcpPresent.isSymbolicLink() || mcpPresent.size > 1024 * 1024 || realpathSync5(mcp) !== mcp))
+    refuse3();
+  if (Boolean(mcpPresent) !== (manifest.mcpServers !== undefined))
     refuse3();
+  const mcpSha256 = mcpPresent ? mcpControls(mcp, read) : undefined;
   const app = join10(root, ".app.json"), present = lstatSync6(app, { throwIfNoEntry: false });
   if (present && (!present.isFile() || present.isSymbolicLink() || present.size > 1024 * 1024))
     refuse3();
   if (manifest.apps !== undefined && !present)
     refuse3();
   const appSha256 = present ? appControls(app, read) : undefined;
-  return { namespace: manifest.name, manifestSha256, ...appSha256 ? { appSha256 } : {} };
+  return { namespace: manifest.name, manifestSha256, ...appSha256 ? { appSha256 } : {}, ...mcpSha256 ? { mcpSha256 } : {} };
 }
 function identity(document, cache, read) {
   if (!document.startsWith(cache + sep2) || !document.endsWith(sep2 + "SKILL.md"))
@@ -38435,7 +38512,7 @@ function reviewedCodexPluginCapabilitiesUnchanged(cache, controls, read) {
         if (!stat.isDirectory() || ![".codex-plugin/plugin.json", ".app.json", "hooks", ".mcp.json"].some((path) => lstatSync6(join10(root, path), { throwIfNoEntry: false })))
           continue;
         const parsed = rootControls(root, read);
-        if (!controls.some((control) => control.pluginParent === parent && control.namespace === parsed.namespace && control.manifestSha256 === parsed.manifestSha256 && control.appSha256 === parsed.appSha256))
+        if (!controls.some((control) => control.pluginParent === parent && control.namespace === parsed.namespace && control.manifestSha256 === parsed.manifestSha256 && control.appSha256 === parsed.appSha256 && control.mcpSha256 === parsed.mcpSha256))
           return false;
       }
     }
@@ -38495,7 +38572,7 @@ function reviewCodexPluginSkillControls(catalog, documents, cache, cwd, read, ru
     }
     result.push({ ...parsed, pluginId: expectedPluginId, ...remotePluginId ? { remotePluginId } : {} });
   }
-  if (!result.length || new Set(result.map((item) => item.name)).size !== result.length)
+  if (!result.length && documents.some((document) => document.startsWith(cache + sep2)) || new Set(result.map((item) => item.name)).size !== result.length)
     refuse3();
   return result;
 }
@@ -38508,7 +38585,7 @@ function isReviewedCodexPluginSkillDisabled(document, cache, controls, rules, re
   } catch {
     return false;
   }
-  const reviewed = controls.find((item) => item.name === parsed.name && item.namespace === parsed.namespace && item.pluginParent === parsed.pluginParent && item.manifestSha256 === parsed.manifestSha256 && item.appSha256 === parsed.appSha256);
+  const reviewed = controls.find((item) => item.name === parsed.name && item.namespace === parsed.namespace && item.pluginParent === parsed.pluginParent && item.manifestSha256 === parsed.manifestSha256 && item.appSha256 === parsed.appSha256 && item.mcpSha256 === parsed.mcpSha256);
   if (!reviewed || reviewed.remotePluginId !== undefined && !remoteInstallationMatches(reviewed.pluginParent, reviewed.remotePluginId, read))
     return false;
   return isCodexNativeSkillDisabled({ name: parsed.name, path: document, pluginId: reviewed.pluginId, enabled: true }, rules);
@@ -38860,7 +38937,7 @@ function assertAgentPolicyCollections(policy) {
     }
   if (bridge.codexPluginSkills !== undefined)
     for (const control of array(bridge.codexPluginSkills, 4096)) {
-      requireBound(object3(control) && Object.keys(control).every((key) => ["name", "pluginId", "namespace", "pluginParent", "manifestSha256", "appSha256", "remotePluginId"].includes(key)));
+      requireBound(object3(control) && Object.keys(control).every((key) => ["name", "pluginId", "namespace", "pluginParent", "manifestSha256", "appSha256", "mcpSha256", "remotePluginId"].includes(key)));
       text(control.name, 129);
       text(control.pluginId, 1024);
       text(control.namespace, 64);
@@ -38868,6 +38945,8 @@ function assertAgentPolicyCollections(policy) {
       requireBound(isAbsolute6(control.pluginParent) && resolve5(control.pluginParent) === control.pluginParent && /^[a-f0-9]{64}$/.test(control.manifestSha256));
       if (control.remotePluginId !== undefined)
         requireBound(typeof control.remotePluginId === "string" && /^[A-Za-z0-9_~-]{1,1024}$/.test(control.remotePluginId));
+      if (control.mcpSha256 !== undefined)
+        requireBound(typeof control.mcpSha256 === "string" && /^[a-f0-9]{64}$/.test(control.mcpSha256));
       if (control.appSha256 !== undefined)
         requireBound(typeof control.appSha256 === "string" && /^[a-f0-9]{64}$/.test(control.appSha256));
     }
@@ -42096,10 +42175,75 @@ function disableCodexBundledSkills(text2) {
 // src/lib/agent-integration.ts
 var sha4 = (data) => createHash18("sha256").update(data).digest("hex");
 var ROOTS = NATIVE_SKILL_ROOTS;
+function hasNoDarwinAcl(fd) {
+  try {
+    const { dlopen, read: read3 } = __require("bun:ffi");
+    const library = dlopen("/usr/lib/libSystem.B.dylib", {
+      acl_get_fd: { args: ["i32"], returns: "ptr" },
+      acl_free: { args: ["ptr"], returns: "i32" },
+      __error: { args: [], returns: "ptr" }
+    });
+    try {
+      const errno = library.symbols.__error();
+      if (!errno)
+        return false;
+      const acl = library.symbols.acl_get_fd(fd);
+      if (acl) {
+        library.symbols.acl_free(acl);
+        return false;
+      }
+      return (acl === null || acl === 0) && read3.i32(errno) === 2;
+    } finally {
+      library.close();
+    }
+  } catch {
+    return false;
+  }
+}
+function isSystemRootAlias(path) {
+  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(path))
+    return false;
+  const target = `/private${path}`, link = `private${path}`;
+  const identity4 = (stat2) => `${stat2.dev}:${stat2.ino}:${stat2.ctimeNs}:${stat2.uid}:${stat2.mode}`;
+  try {
+    const before = lstatSync19(path, { bigint: true });
+    if (!before.isSymbolicLink() || before.uid !== 0n || readlinkSync4(path) !== link)
+      return false;
+    const directories = ["/", "/private", target].map((directory) => {
+      const stat2 = lstatSync19(directory, { bigint: true });
+      if (!stat2.isDirectory() || stat2.uid !== 0n)
+        throw new Error("Untrusted system alias directory");
+      if (directory !== "/private/tmp") {
+        if ((stat2.mode & 0o022n) !== 0n)
+          throw new Error("Writable system alias directory");
+      } else if ((stat2.mode & 0o1000n) === 0n)
+        throw new Error("Unprotected system temporary directory");
+      const fd = openSync16(directory, constants12.O_RDONLY | constants12.O_DIRECTORY | constants12.O_NOFOLLOW);
+      try {
+        if (identity4(fstatSync16(fd, { bigint: true })) !== identity4(stat2) || !hasNoDarwinAcl(fd) || identity4(fstatSync16(fd, { bigint: true })) !== identity4(stat2))
+          throw new Error("Unverified system alias directory ACL");
+      } finally {
+        closeSync16(fd);
+      }
+      return { directory, identity: identity4(stat2) };
+    });
+    return realpathSync7(path) === target && readlinkSync4(path) === link && identity4(lstatSync19(path, { bigint: true })) === identity4(before) && directories.every((item) => identity4(lstatSync19(item.directory, { bigint: true })) === item.identity);
+  } catch {
+    return false;
+  }
+}
+function canonicalSystemPath(path) {
+  const absolute = resolve15(path), root2 = `/${absolute.split(sep5)[1]}`;
+  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(root2) || !lstatSync19(root2, { throwIfNoEntry: false })?.isSymbolicLink())
+    return absolute;
+  if (!isSystemRootAlias(root2))
+    throw new Error(`Refusing symlink path: ${root2}`);
+  return `/private${absolute}`;
+}
 function assertSafePath(path) {
   let cursor = resolve15(path);
   while (true) {
-    if (lstatSync19(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync19(cursor, { throwIfNoEntry: false })?.isSymbolicLink() && !isSystemRootAlias(cursor))
       throw new Error(`Refusing symlink path: ${cursor}`);
     const parent = dirname15(cursor);
     if (parent === cursor)
@@ -42135,7 +42279,7 @@ function rootAliases(home, allowed = false) {
   return result;
 }
 function canonicalAgentPath(path, aliases) {
-  const absolute = resolve15(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep5));
+  const absolute = canonicalSystemPath(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep5));
   return binding ? join22(binding.target, relative4(binding.alias, absolute)) : absolute;
 }
 function disabledCodexSkillPaths(config, aliases) {
@@ -42233,17 +42377,19 @@ function selectNativeMigrationTargets(inventory, manifest) {
   const identities = new Set;
   const selected = [];
   for (const target of manifest.targets) {
-    const projectRoot = resolve15(target.projectRoot), normalized = relative4(projectRoot, resolve15(projectRoot, target.path));
-    if (!isAbsolute17(target.projectRoot) || projectRoot !== target.projectRoot || !existsSync6(projectRoot) || !lstatSync19(projectRoot).isDirectory())
+    if (!isAbsolute17(target.projectRoot) || resolve15(target.projectRoot) !== target.projectRoot)
+      throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
+    const projectRoot = canonicalSystemPath(target.projectRoot), normalized = relative4(projectRoot, resolve15(projectRoot, target.path));
+    if (!existsSync6(projectRoot) || !lstatSync19(projectRoot).isDirectory())
       throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
     assertSafePath(projectRoot);
     if (isAbsolute17(target.path) || target.path.includes("\\") || target.path.includes("\x00") || !normalized || normalized === ".." || normalized.startsWith(`..${sep5}`) || normalized !== target.path || !/^[0-9a-f]{64}$/.test(target.treeSha256))
       throw new Error(`Invalid native migration target: ${target.path}`);
-    const identity4 = `${target.agent}\x00${projectRoot}\x00${normalized}`;
+    const identity4 = `${target.agent}\x00${canonicalSystemPath(projectRoot)}\x00${normalized}`;
     if (identities.has(identity4))
       throw new Error(`Duplicate native migration target: ${target.path}`);
     identities.add(identity4);
-    const expected = resolve15(target.projectRoot, target.path);
+    const expected = canonicalSystemPath(resolve15(target.projectRoot, target.path));
     const matches = inventory.filter((entry2) => entry2.agent === target.agent && resolve15(entry2.path) === expected);
     if (matches.length !== 1)
       throw new Error(`Native migration target was not found exactly once: ${target.agent} ${target.projectRoot}/${target.path}`);
@@ -42259,7 +42405,7 @@ function selectNativeMigrationTargets(inventory, manifest) {
 function projectAncestorDirectories(projects) {
   const directories = new Set;
   for (const project of projects) {
-    for (let path = resolve15(project), depth = 0;; depth++) {
+    for (let path = canonicalSystemPath(project), depth = 0;; depth++) {
       if (depth >= 100)
         throw new Error("NATIVE_SKILL_DRIFT: project ancestor discovery limit exceeded");
       directories.add(path);
@@ -42272,11 +42418,13 @@ function projectAncestorDirectories(projects) {
   return [...directories];
 }
 function inventoryNativeSkills(home = homedir3(), options = {}) {
+  home = canonicalSystemPath(home);
   if (options.reviewedCacheAlias !== undefined && (!options.includeVendor || !isAbsolute17(options.reviewedCacheAlias) || resolve15(options.reviewedCacheAlias) !== options.reviewedCacheAlias))
     throw new Error("A reviewed cache alias requires vendor inventory and an exact absolute path");
   if (options.disabledVendorPaths?.some((path) => !isAbsolute17(path) || resolve15(path) !== path))
     throw new Error("Disabled vendor paths must be exact absolute paths");
-  const disabledVendorPaths = new Set(options.disabledVendorPaths ?? []);
+  const reviewedCacheAlias = options.reviewedCacheAlias === undefined ? undefined : canonicalSystemPath(options.reviewedCacheAlias);
+  const disabledVendorPaths = new Set((options.disabledVendorPaths ?? []).map(canonicalSystemPath));
   const aliases = rootAliases(home, options.allowRootAliases);
   const selectedAgents = options.agents ? new Set(options.agents) : undefined;
   const includesAgent = (agent) => !selectedAgents || selectedAgents.has(agent);
@@ -42299,8 +42447,11 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
   }
   let reviewedCacheAliasFound = false;
   function verifiedSiblingCacheAlias(agent, path, parent) {
-    const link = readlinkSync4(path), target = resolve15(parent, link);
-    if (dirname15(target) !== parent || (isAbsolute17(link) ? link !== target : dirname15(link) !== "."))
+    const link = readlinkSync4(path), lexicalTarget = resolve15(parent, link);
+    if (isAbsolute17(link) ? link !== lexicalTarget : dirname15(link) !== ".")
+      return false;
+    const target = canonicalSystemPath(lexicalTarget);
+    if (dirname15(target) !== parent)
       return false;
     if (!lstatSync19(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
@@ -42309,11 +42460,11 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       return false;
     if (scan.hasSkills) {
       const targetSkills = entries.filter((entry) => entry.agent === agent && entry.vendor && (entry.path === target || entry.path.startsWith(target + sep5)));
-      if (path === options.reviewedCacheAlias && targetSkills.length > 0)
+      if (path === reviewedCacheAlias && targetSkills.length > 0)
         reviewedCacheAliasFound = true;
       if (agent === "codex" && targetSkills.length > 0 && targetSkills.every((entry) => disabledVendorPaths.has(entry.path) || options.disabledVendorSkill?.(entry) === true))
         return true;
-      if (path !== options.reviewedCacheAlias)
+      if (path !== reviewedCacheAlias)
         return false;
     }
     return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.22",
+  "version": "0.10.24",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {