@hasna/skills 0.10.23 → 0.10.25

package/README.md

@@ -431,6 +431,12 @@ directory within your home, add `--allow-root-aliases` to hook installation and
 native migration. The plan records and rechecks the exact link and target;
 links inside skill contents or configuration files remain refused.
 
+On macOS, the OS-owned `/var`, `/tmp` and `/etc` aliases into `/private` are
+accepted only while their exact targets and protected parent directories verify.
+The protection check refuses extended ACLs and unavailable native ACL inspection.
+Inventory reports canonical paths and deduplicates their alias spellings. This
+does not permit other root-owned links or user-controlled ancestor links.
+
 Cooperating installers can use the root package's
 `planClaudeStopHookUpdate({ expectedSettingsSha256, replacement })`, then
 `applyAgentIntegration(plan)`, to write an explicitly authorized Claude settings
@@ -519,8 +525,23 @@ Only manifest version metadata may vary. Reviewed app declarations use the impli
 `id`, optional `category`, and optional boolean `required`. The entire canonical app
 file and its presence stay bound; it preserves existing connector availability and
 native capability hints. Changed or unknown app fields, custom references, native
-hooks, commands and MCP controls refuse. Name controls suppress Skills, not every
-plugin capability. No prompt hook starts an app server to obtain this receipt:
+hooks, commands and unsupported MCP controls refuse. Referenced own-root
+`./.mcp.json` declarations may preserve local stdio servers with Codex's typed
+tool, approval, timeout and environment metadata. Their complete fingerprints
+and presence remain bound; review never executes commands or resolves environment
+values. Name controls suppress Skills, not every plugin capability.
+A Codex 0.160 catalog may also prove a nonremote plugin is installed but disabled.
+With an exact current path deny and explicit witnessed plugin disable, its cache
+can remain inert across versions; re-enable, ambiguous identity, conflicting
+controls and unsafe paths refuse. This does not approve its hook declarations.
+Remote-controlled, missing or unknown source identities do not qualify.
+
+The catalog retains local source paths separately from installed cache identities.
+When a reviewed discovery witness binds a positively mapped installation input,
+runtime checks omit that input from plugin skill loading. Default home/project
+roots and installed caches are still checked, and migration inventory remains
+complete. Overlapping, linked, missing or contradictory mappings refuse.
+No prompt hook starts an app server to obtain this receipt:
 native startup can maintain caches. The explicit capture starts and closes only its
 own bounded native client; it does not reload an existing agent session.
 Neither a receipt nor a config write proves an existing session adopted new rules;