@hasna/skills 0.10.30 → 0.10.33

package/README.md

@@ -623,6 +623,18 @@ on this same host. The exact lock bytes and a metadata record remain under
 by recovery. A live, recent, malformed or different-host lock still blocks the
 write. A recovery guard serializes competing recoverers.
 
+Writers gather identity before publishing the lock. A private, fully written and
+synced staging inode is linked into the live path atomically without replacing
+an existing lock; the staging name is then removed before the protected write.
+The writer keeps its descriptor open through lock release. An interruption at
+the brief two-link publication boundary leaves a complete marker and its exact
+operation-bound staging witness. Recovery accepts that pair only when both names
+identify the same private inode and the existing stale-owner checks pass.
+Readers from 0.10.31 and earlier refuse this interrupted two-link state; inspect
+and recover it with an updated installation. Ordinary held locks have one link.
+This prevents new empty locks; it does not recover historical empty or malformed
+locks, whose ownership remains unknown and which must stay protected.
+
 Older PID-only locks require a local review because they do not identify their
 host. On the host that created the lock, inspect the receipt and lock, verify
 the recorded PID belongs to no live writer, then apply the exact reviewed lock:

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.30",
+    version: "0.10.33",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -48139,7 +48139,7 @@ var init_profile_limits = __esm(() => {
 // src/lib/selection-cache.ts
 import { createHash as createHash6, randomUUID as randomUUID3 } from "crypto";
 import { spawnSync } from "child_process";
-import { closeSync as closeSync2, constants as constants3, fstatSync as fstatSync2, fsyncSync, lstatSync as lstatSync7, mkdirSync as mkdirSync3, openSync as openSync2, readFileSync as readFileSync9, readlinkSync as readlinkSync2, readSync as readSync2, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { closeSync as closeSync2, constants as constants3, fstatSync as fstatSync2, fsyncSync, linkSync, lstatSync as lstatSync7, mkdirSync as mkdirSync3, openSync as openSync2, readFileSync as readFileSync9, readlinkSync as readlinkSync2, readSync as readSync2, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
 import { hostname } from "os";
 import { dirname as dirname7, join as join15, parse as parse2, resolve as resolve8 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
@@ -48487,7 +48487,7 @@ function readSessionLock(sessionId, options) {
   const before2 = lstatSync7(path, { throwIfNoEntry: false });
   if (!before2)
     return null;
-  if (!before2.isFile() || before2.nlink !== 1 || (before2.mode & 63) !== 0 || process.getuid && before2.uid !== process.getuid()) {
+  if (!before2.isFile() || ![1, 2].includes(before2.nlink) || (before2.mode & 63) !== 0 || process.getuid && before2.uid !== process.getuid()) {
     throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock is not a private regular file; recovery requires review.");
   }
   const bytes = readRegularFile(path, SESSION_LOCK_MAX_BYTES);
@@ -48501,10 +48501,54 @@ function readSessionLock(sessionId, options) {
   } catch {
     throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock is unreadable; recovery requires review.");
   }
-  if (!marker || ![1, 2].includes(marker.schemaVersion) || marker.sessionId !== sessionId || !/^[a-f0-9-]{36}$/i.test(marker.operationId) || !Number.isSafeInteger(marker.pid) || marker.pid <= 0 || marker.schemaVersion === 2 && (!marker.host || !marker.bootId || !marker.processStart || process.platform === "linux" && !marker.pidNamespace)) {
+  if (!marker || ![1, 2].includes(marker.schemaVersion) || marker.sessionId !== sessionId || !/^[a-f0-9-]{36}$/i.test(marker.operationId) || !Number.isSafeInteger(marker.pid) || marker.pid <= 0 || marker.publication !== undefined && marker.publication !== "hard-link-v1" || marker.schemaVersion === 2 && (!marker.host || !marker.bootId || !marker.processStart || process.platform === "linux" && !marker.pidNamespace)) {
     throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock has invalid ownership metadata; recovery requires review.");
   }
-  return { path, bytes, marker, sha256: sha256Hex(bytes), dev: after2.dev, ino: after2.ino, mtimeMs: after2.mtimeMs };
+  let stagingPath;
+  if (after2.nlink === 2) {
+    stagingPath = `${path}.${marker.operationId}.prepared`;
+    assertRegularPath(stagingPath);
+    const staged = lstatSync7(stagingPath, { throwIfNoEntry: false });
+    if (marker.publication !== "hard-link-v1" || !staged?.isFile() || staged.dev !== after2.dev || staged.ino !== after2.ino || staged.nlink !== 2 || staged.mode !== after2.mode || staged.uid !== after2.uid || staged.gid !== after2.gid) {
+      throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock has an unbound publication link; recovery requires review.");
+    }
+  }
+  return { path, bytes, marker, sha256: sha256Hex(bytes), dev: after2.dev, ino: after2.ino, mtimeMs: after2.mtimeMs, stagingPath };
+}
+function publishSessionLock(path, marker) {
+  const stagingPath = `${path}.${marker.operationId}.prepared`;
+  const bytes = Buffer.from(`${JSON.stringify({ ...marker, publication: "hard-link-v1" })}
+`);
+  const fd = openSync2(stagingPath, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
+  const stat = fstatSync2(fd);
+  let published = false, handedOff = false;
+  try {
+    writeFileSync3(fd, bytes);
+    fsyncSync(fd);
+    linkSync(stagingPath, path);
+    published = true;
+    syncDirectory(dirname7(path));
+    const staged = lstatSync7(stagingPath);
+    if (!staged.isFile() || staged.dev !== stat.dev || staged.ino !== stat.ino) {
+      throw new SkillSelectionError("SESSION_WRITE_LOCK_CHANGED", "The initialized lock staging inode changed before publication completed.");
+    }
+    unlinkSync(stagingPath);
+    syncDirectory(dirname7(path));
+    handedOff = true;
+    return { path, stagingPath, fd, dev: stat.dev, ino: stat.ino };
+  } finally {
+    if (!handedOff) {
+      try {
+        for (const target of [...published ? [path] : [], stagingPath]) {
+          const current = lstatSync7(target, { throwIfNoEntry: false });
+          if (current?.isFile() && current.dev === stat.dev && current.ino === stat.ino)
+            unlinkSync(target);
+        }
+      } finally {
+        closeSync2(fd);
+      }
+    }
+  }
 }
 function writerIsGone(lock, explicitLocalHost) {
   if (Date.now() - lock.mtimeMs < SESSION_LOCK_MIN_AGE_MS)
@@ -48593,10 +48637,21 @@ function archiveSessionLock(lock, receipt, explicitLocalHost) {
     try {
       renameSync(lock.path, archivePath);
       moved = true;
+      const archivedPaths = [archivePath];
+      if (finalLock.stagingPath) {
+        const publicationPath = join15(directory, "publication.write-lock");
+        renameSync(finalLock.stagingPath, publicationPath);
+        archivedPaths.push(publicationPath);
+      }
       syncDirectory(directory);
       syncDirectory(dirname7(lock.path));
-      if (sha256Hex(readRegularFile(archivePath, SESSION_LOCK_MAX_BYTES)) !== lock.sha256) {
-        throw new Error("Archived lock bytes changed");
+      for (const path of archivedPaths) {
+        const before2 = lstatSync7(path, { throwIfNoEntry: false });
+        const bytes = readRegularFile(path, SESSION_LOCK_MAX_BYTES);
+        const after2 = lstatSync7(path, { throwIfNoEntry: false });
+        if (!before2?.isFile() || before2.dev !== lock.dev || before2.ino !== lock.ino || before2.nlink !== archivedPaths.length || before2.mtimeMs !== lock.mtimeMs || (before2.mode & 63) !== 0 || process.getuid && before2.uid !== process.getuid() || !bytes || sha256Hex(bytes) !== lock.sha256 || !after2?.isFile() || before2.dev !== after2.dev || before2.ino !== after2.ino || before2.mtimeMs !== after2.mtimeMs || before2.mode !== after2.mode || before2.uid !== after2.uid || before2.gid !== after2.gid || before2.nlink !== after2.nlink) {
+          throw new Error("Archived lock ownership or bytes changed");
+        }
       }
     } catch (error) {
       if (moved)
@@ -48623,6 +48678,7 @@ function recoverSessionWriteLock(sessionId, reviewDigest, options = {}) {
 }
 function withSessionWriteLocks(sessionIds, options, action) {
   const operationId = randomUUID3();
+  const identity4 = localLockIdentity();
   const locks = [...new Set(sessionIds)].map((sessionId) => ({ sessionId, path: `${sessionReceiptPath(sessionId, options)}.write-lock` })).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   const owned = [];
   const assertOwned = () => {
@@ -48636,9 +48692,10 @@ function withSessionWriteLocks(sessionIds, options, action) {
   try {
     for (const lock of locks) {
       assertRegularPath(lock.path, true);
-      let fd;
+      const marker = { schemaVersion: identity4 ? 2 : 1, operationId, sessionId: lock.sessionId, pid: process.pid, ...identity4 };
+      let acquired;
       try {
-        fd = openSync2(lock.path, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
+        acquired = publishSessionLock(lock.path, marker);
       } catch (error) {
         if (error.code !== "EEXIST")
           throw error;
@@ -48653,7 +48710,7 @@ function withSessionWriteLocks(sessionIds, options, action) {
             throw recoveryError;
         }
         try {
-          fd = openSync2(lock.path, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
+          acquired = publishSessionLock(lock.path, marker);
         } catch (retryError) {
           if (retryError.code === "EEXIST") {
             if (!readSessionLock(lock.sessionId, options))
@@ -48663,19 +48720,20 @@ function withSessionWriteLocks(sessionIds, options, action) {
           throw retryError;
         }
       }
-      const stat = fstatSync2(fd);
-      owned.push({ path: lock.path, fd, dev: stat.dev, ino: stat.ino });
-      const identity4 = localLockIdentity();
-      writeFileSync3(fd, `${JSON.stringify({ schemaVersion: identity4 ? 2 : 1, operationId, sessionId: lock.sessionId, pid: process.pid, ...identity4 })}
-`);
+      owned.push(acquired);
     }
     return action(assertOwned);
   } finally {
     for (const lock of owned.reverse()) {
-      closeSync2(lock.fd);
-      const current = lstatSync7(lock.path, { throwIfNoEntry: false });
-      if (current?.isFile() && current.dev === lock.dev && current.ino === lock.ino)
-        unlinkSync(lock.path);
+      try {
+        for (const path of [lock.path, lock.stagingPath]) {
+          const current = lstatSync7(path, { throwIfNoEntry: false });
+          if (current?.isFile() && current.dev === lock.dev && current.ino === lock.ino)
+            unlinkSync(path);
+        }
+      } finally {
+        closeSync2(lock.fd);
+      }
     }
   }
 }
@@ -51369,6 +51427,29 @@ function mcpControls(path, read2) {
       refuse2();
   return sha2562;
 }
+function isBundledCleanupHooks(root, namespace, value) {
+  const object5 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v));
+  const exactKeys = (v, keys2) => Object.keys(v).length === keys2.length && keys2.every((key) => Object.hasOwn(v, key));
+  if (basename5(dirname10(root)) !== namespace || basename5(dirname10(dirname10(root))) !== "openai-bundled")
+    return false;
+  const server = namespace === "unified-computer-use" ? "cua_repl" : ["browser", "chrome", "chrome-dev", "chrome-internal", "computer-use"].includes(namespace) ? "node_repl" : undefined;
+  if (!server || !object5(value) || !exactKeys(value, ["hooks"]) || !object5(value.hooks))
+    return false;
+  const events = Object.entries(value.hooks);
+  if (!events.length || events.length > 3)
+    return false;
+  for (const [event, groups] of events) {
+    if (!["Interrupt", "SubagentStop", "Stop"].includes(event) || !Array.isArray(groups) || groups.length !== 1)
+      return false;
+    const group = groups[0];
+    if (!object5(group) || !exactKeys(group, ["hooks"]) || !Array.isArray(group.hooks) || group.hooks.length !== 1)
+      return false;
+    const handler = group.hooks[0];
+    if (!object5(handler) || !exactKeys(handler, ["type", "server", "tool", "input"]) || handler.type !== "mcp_tool" || handler.server !== server || handler.tool !== "turn_ended" || !object5(handler.input) || !exactKeys(handler.input, ["hook_event_name", "session_id", "turn_id"]) || handler.input.hook_event_name !== "${hook_event_name}" || handler.input.turn_id !== "${turn_id}" || handler.input.session_id !== (event === "SubagentStop" ? "${agent_id}" : "${session_id}"))
+      return false;
+  }
+  return true;
+}
 function rootControls(root, read2) {
   const manifestPath = join18(root, ".codex-plugin/plugin.json"), manifestFile = lstatSync12(manifestPath, { throwIfNoEntry: false });
   if (!lstatSync12(join18(root, ".codex-plugin"), { throwIfNoEntry: false })?.isDirectory() || !manifestFile?.isFile() || manifestFile.size > 1024 * 1024)
@@ -51386,9 +51467,11 @@ function rootControls(root, read2) {
   const cacheVersion = basename5(root), declaredVersion = manifest.version === undefined ? "" : typeof manifest.version === "string" ? manifest.version.trim() : null;
   if (declaredVersion === null || (declaredVersion ? declaredVersion !== cacheVersion : cacheVersion !== CODEX_DEFAULT_AGENT_PLUGIN_VERSION))
     refuse2();
-  if (manifest.hooks !== undefined || manifest.commands !== undefined || manifest.mcpServers !== undefined && manifest.mcpServers !== "./.mcp.json" || manifest.apps !== undefined && manifest.apps !== "./.app.json" || lstatSync12(join18(root, "hooks"), { throwIfNoEntry: false }))
+  if (manifest.hooks !== undefined && !isBundledCleanupHooks(root, manifest.name, manifest.hooks) || manifest.commands !== undefined || manifest.mcpServers !== undefined && manifest.mcpServers !== "./.mcp.json" || manifest.apps !== undefined && manifest.apps !== "./.app.json" || lstatSync12(join18(root, "hooks"), { throwIfNoEntry: false }))
     refuse2();
   const mcp = join18(root, ".mcp.json"), mcpPresent = lstatSync12(mcp, { throwIfNoEntry: false });
+  if (manifest.hooks !== undefined && (manifest.mcpServers !== undefined || mcpPresent))
+    refuse2();
   if (mcpPresent && (!mcpPresent.isFile() || mcpPresent.isSymbolicLink() || mcpPresent.size > 1024 * 1024 || realpathSync5(mcp) !== mcp))
     refuse2();
   if (Boolean(mcpPresent) !== (manifest.mcpServers !== undefined))
@@ -52513,7 +52596,7 @@ var init_agent_sumi = __esm(() => {
 // src/lib/agent-integration.ts
 import { createHash as createHash12, randomUUID as randomUUID5 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
-import { existsSync as existsSync13, lstatSync as lstatSync16, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync13, readdirSync as readdirSync8, opendirSync as opendirSync3, readlinkSync as readlinkSync4, realpathSync as realpathSync7, renameSync as renameSync2, rmdirSync as rmdirSync2, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3, chmodSync, openSync as openSync8, closeSync as closeSync8, fsyncSync as fsyncSync2, fstatSync as fstatSync8, readSync as readSync6, constants as constants8, linkSync } from "fs";
+import { existsSync as existsSync13, lstatSync as lstatSync16, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync13, readdirSync as readdirSync8, opendirSync as opendirSync3, readlinkSync as readlinkSync4, realpathSync as realpathSync7, renameSync as renameSync2, rmdirSync as rmdirSync2, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3, chmodSync, openSync as openSync8, closeSync as closeSync8, fsyncSync as fsyncSync2, fstatSync as fstatSync8, readSync as readSync6, constants as constants8, linkSync as linkSync2 } from "fs";
 import { dirname as dirname11, join as join23, resolve as resolve12, relative as relative5, isAbsolute as isAbsolute11, sep as sep5 } from "path";
 import { homedir as homedir3 } from "os";
 function hasNoDarwinAcl(fd) {
@@ -53567,7 +53650,7 @@ function archiveNativeSkills(inventory, options) {
           continue;
         }
         if (entry.discoveryOnly) {
-          linkSync(entry.archive, entry.source);
+          linkSync2(entry.archive, entry.source);
           syncArchiveDirectory(dirname11(entry.source));
           unlinkSync3(entry.archive);
         } else {
@@ -55550,7 +55633,7 @@ var init_plugin_projection = __esm(() => {
 
 // src/lib/plugin-projection-store.ts
 import { createHash as createHash14, randomUUID as randomUUID6 } from "crypto";
-import { constants as constants9, closeSync as closeSync9, fchmodSync, fstatSync as fstatSync9, fsyncSync as fsyncSync3, linkSync as linkSync2, lstatSync as lstatSync18, mkdirSync as mkdirSync9, openSync as openSync9, opendirSync as opendirSync4, readSync as readSync7, renameSync as renameSync5, rmdirSync as rmdirSync3, rmSync as rmSync4, unlinkSync as unlinkSync4, writeSync as writeSync2 } from "fs";
+import { constants as constants9, closeSync as closeSync9, fchmodSync, fstatSync as fstatSync9, fsyncSync as fsyncSync3, linkSync as linkSync3, lstatSync as lstatSync18, mkdirSync as mkdirSync9, openSync as openSync9, opendirSync as opendirSync4, readSync as readSync7, renameSync as renameSync5, rmdirSync as rmdirSync3, rmSync as rmSync4, unlinkSync as unlinkSync4, writeSync as writeSync2 } from "fs";
 import { dirname as dirname13, isAbsolute as isAbsolute12, join as join30, parse as parse5, resolve as resolve13 } from "path";
 function stat(path) {
   try {
@@ -55862,7 +55945,7 @@ function writePluginJsonImmutable(path, value) {
     written = stat(temporary);
     verifyAncestors(chain, true);
     try {
-      linkSync2(temporary, path);
+      linkSync3(temporary, path);
     } catch (error) {
       if (!(error && typeof error === "object" && ("code" in error) && error.code === "EEXIST"))
         throw error;
@@ -57240,13 +57323,13 @@ function resolveAgentDiscovery(options) {
       unresolved("JSONC configuration requires a supported format adapter");
     for (const root2 of [directory, join33(home, ".claude"), join33(home, ".agents")])
       for (const name of ["skill", "skills"])
-        roots.add(join33(root2, name));
+        roots.add(canonical6(join33(root2, name)));
     if (config.skills !== undefined && (!Array.isArray(config.skills) || config.skills.some((path) => typeof path !== "string")))
       unresolved("skills must be a string array");
     for (const value of config.skills ?? []) {
       if (typeof value !== "string" || /[\0$]/.test(value) || !value || !(isAbsolute17(value) || value.startsWith("~/")))
         unresolved("remote or relative skill sources need a dedicated discovery adapter");
-      roots.add(value.startsWith("~/") ? join33(home, value.slice(2)) : value);
+      roots.add(canonical6(value.startsWith("~/") ? join33(home, value.slice(2)) : value));
     }
     for (const key of ["plugin", "plugins"])
       if (config[key] !== undefined && !Array.isArray(config[key]))

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.30",
+    version: "0.10.33",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -46227,7 +46227,7 @@ var init_profile_limits = __esm(() => {
 // src/lib/selection-cache.ts
 import { createHash as createHash6, randomUUID } from "crypto";
 import { spawnSync as spawnSync2 } from "child_process";
-import { closeSync as closeSync6, constants as constants3, fstatSync as fstatSync6, fsyncSync, lstatSync as lstatSync8, mkdirSync as mkdirSync3, openSync as openSync6, readFileSync as readFileSync10, readlinkSync as readlinkSync2, readSync as readSync3, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { closeSync as closeSync6, constants as constants3, fstatSync as fstatSync6, fsyncSync, linkSync, lstatSync as lstatSync8, mkdirSync as mkdirSync3, openSync as openSync6, readFileSync as readFileSync10, readlinkSync as readlinkSync2, readSync as readSync3, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
 import { hostname as hostname3 } from "os";
 import { dirname as dirname8, join as join14, parse as parse7, resolve as resolve7 } from "path";
 import { isDeepStrictEqual } from "util";
@@ -46563,7 +46563,7 @@ function readSessionLock(sessionId, options) {
   const before = lstatSync8(path, { throwIfNoEntry: false });
   if (!before)
     return null;
-  if (!before.isFile() || before.nlink !== 1 || (before.mode & 63) !== 0 || process.getuid && before.uid !== process.getuid()) {
+  if (!before.isFile() || ![1, 2].includes(before.nlink) || (before.mode & 63) !== 0 || process.getuid && before.uid !== process.getuid()) {
     throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock is not a private regular file; recovery requires review.");
   }
   const bytes = readRegularFile(path, SESSION_LOCK_MAX_BYTES);
@@ -46577,10 +46577,54 @@ function readSessionLock(sessionId, options) {
   } catch {
     throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock is unreadable; recovery requires review.");
   }
-  if (!marker || ![1, 2].includes(marker.schemaVersion) || marker.sessionId !== sessionId || !/^[a-f0-9-]{36}$/i.test(marker.operationId) || !Number.isSafeInteger(marker.pid) || marker.pid <= 0 || marker.schemaVersion === 2 && (!marker.host || !marker.bootId || !marker.processStart || process.platform === "linux" && !marker.pidNamespace)) {
+  if (!marker || ![1, 2].includes(marker.schemaVersion) || marker.sessionId !== sessionId || !/^[a-f0-9-]{36}$/i.test(marker.operationId) || !Number.isSafeInteger(marker.pid) || marker.pid <= 0 || marker.publication !== undefined && marker.publication !== "hard-link-v1" || marker.schemaVersion === 2 && (!marker.host || !marker.bootId || !marker.processStart || process.platform === "linux" && !marker.pidNamespace)) {
     throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock has invalid ownership metadata; recovery requires review.");
   }
-  return { path, bytes, marker, sha256: sha256Hex(bytes), dev: after.dev, ino: after.ino, mtimeMs: after.mtimeMs };
+  let stagingPath;
+  if (after.nlink === 2) {
+    stagingPath = `${path}.${marker.operationId}.prepared`;
+    assertRegularPath(stagingPath);
+    const staged = lstatSync8(stagingPath, { throwIfNoEntry: false });
+    if (marker.publication !== "hard-link-v1" || !staged?.isFile() || staged.dev !== after.dev || staged.ino !== after.ino || staged.nlink !== 2 || staged.mode !== after.mode || staged.uid !== after.uid || staged.gid !== after.gid) {
+      throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock has an unbound publication link; recovery requires review.");
+    }
+  }
+  return { path, bytes, marker, sha256: sha256Hex(bytes), dev: after.dev, ino: after.ino, mtimeMs: after.mtimeMs, stagingPath };
+}
+function publishSessionLock(path, marker) {
+  const stagingPath = `${path}.${marker.operationId}.prepared`;
+  const bytes = Buffer.from(`${JSON.stringify({ ...marker, publication: "hard-link-v1" })}
+`);
+  const fd = openSync6(stagingPath, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
+  const stat = fstatSync6(fd);
+  let published = false, handedOff = false;
+  try {
+    writeFileSync3(fd, bytes);
+    fsyncSync(fd);
+    linkSync(stagingPath, path);
+    published = true;
+    syncDirectory(dirname8(path));
+    const staged = lstatSync8(stagingPath);
+    if (!staged.isFile() || staged.dev !== stat.dev || staged.ino !== stat.ino) {
+      throw new SkillSelectionError("SESSION_WRITE_LOCK_CHANGED", "The initialized lock staging inode changed before publication completed.");
+    }
+    unlinkSync(stagingPath);
+    syncDirectory(dirname8(path));
+    handedOff = true;
+    return { path, stagingPath, fd, dev: stat.dev, ino: stat.ino };
+  } finally {
+    if (!handedOff) {
+      try {
+        for (const target of [...published ? [path] : [], stagingPath]) {
+          const current = lstatSync8(target, { throwIfNoEntry: false });
+          if (current?.isFile() && current.dev === stat.dev && current.ino === stat.ino)
+            unlinkSync(target);
+        }
+      } finally {
+        closeSync6(fd);
+      }
+    }
+  }
 }
 function writerIsGone(lock, explicitLocalHost) {
   if (Date.now() - lock.mtimeMs < SESSION_LOCK_MIN_AGE_MS)
@@ -46642,10 +46686,21 @@ function archiveSessionLock(lock, receipt, explicitLocalHost) {
     try {
       renameSync(lock.path, archivePath);
       moved = true;
+      const archivedPaths = [archivePath];
+      if (finalLock.stagingPath) {
+        const publicationPath = join14(directory, "publication.write-lock");
+        renameSync(finalLock.stagingPath, publicationPath);
+        archivedPaths.push(publicationPath);
+      }
       syncDirectory(directory);
       syncDirectory(dirname8(lock.path));
-      if (sha256Hex(readRegularFile(archivePath, SESSION_LOCK_MAX_BYTES)) !== lock.sha256) {
-        throw new Error("Archived lock bytes changed");
+      for (const path of archivedPaths) {
+        const before = lstatSync8(path, { throwIfNoEntry: false });
+        const bytes = readRegularFile(path, SESSION_LOCK_MAX_BYTES);
+        const after = lstatSync8(path, { throwIfNoEntry: false });
+        if (!before?.isFile() || before.dev !== lock.dev || before.ino !== lock.ino || before.nlink !== archivedPaths.length || before.mtimeMs !== lock.mtimeMs || (before.mode & 63) !== 0 || process.getuid && before.uid !== process.getuid() || !bytes || sha256Hex(bytes) !== lock.sha256 || !after?.isFile() || before.dev !== after.dev || before.ino !== after.ino || before.mtimeMs !== after.mtimeMs || before.mode !== after.mode || before.uid !== after.uid || before.gid !== after.gid || before.nlink !== after.nlink) {
+          throw new Error("Archived lock ownership or bytes changed");
+        }
       }
     } catch (error61) {
       if (moved)
@@ -46662,6 +46717,7 @@ function archiveSessionLock(lock, receipt, explicitLocalHost) {
 }
 function withSessionWriteLocks(sessionIds, options, action) {
   const operationId = randomUUID();
+  const identity3 = localLockIdentity();
   const locks = [...new Set(sessionIds)].map((sessionId) => ({ sessionId, path: `${sessionReceiptPath(sessionId, options)}.write-lock` })).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   const owned = [];
   const assertOwned = () => {
@@ -46675,9 +46731,10 @@ function withSessionWriteLocks(sessionIds, options, action) {
   try {
     for (const lock of locks) {
       assertRegularPath(lock.path, true);
-      let fd;
+      const marker = { schemaVersion: identity3 ? 2 : 1, operationId, sessionId: lock.sessionId, pid: process.pid, ...identity3 };
+      let acquired;
       try {
-        fd = openSync6(lock.path, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
+        acquired = publishSessionLock(lock.path, marker);
       } catch (error61) {
         if (error61.code !== "EEXIST")
           throw error61;
@@ -46692,7 +46749,7 @@ function withSessionWriteLocks(sessionIds, options, action) {
             throw recoveryError;
         }
         try {
-          fd = openSync6(lock.path, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
+          acquired = publishSessionLock(lock.path, marker);
         } catch (retryError) {
           if (retryError.code === "EEXIST") {
             if (!readSessionLock(lock.sessionId, options))
@@ -46702,19 +46759,20 @@ function withSessionWriteLocks(sessionIds, options, action) {
           throw retryError;
         }
       }
-      const stat = fstatSync6(fd);
-      owned.push({ path: lock.path, fd, dev: stat.dev, ino: stat.ino });
-      const identity3 = localLockIdentity();
-      writeFileSync3(fd, `${JSON.stringify({ schemaVersion: identity3 ? 2 : 1, operationId, sessionId: lock.sessionId, pid: process.pid, ...identity3 })}
-`);
+      owned.push(acquired);
     }
     return action(assertOwned);
   } finally {
     for (const lock of owned.reverse()) {
-      closeSync6(lock.fd);
-      const current = lstatSync8(lock.path, { throwIfNoEntry: false });
-      if (current?.isFile() && current.dev === lock.dev && current.ino === lock.ino)
-        unlinkSync(lock.path);
+      try {
+        for (const path of [lock.path, lock.stagingPath]) {
+          const current = lstatSync8(path, { throwIfNoEntry: false });
+          if (current?.isFile() && current.dev === lock.dev && current.ino === lock.ino)
+            unlinkSync(path);
+        }
+      } finally {
+        closeSync6(lock.fd);
+      }
     }
   }
 }
@@ -48897,7 +48955,7 @@ var init_plugin_projection = __esm(() => {
 });
 
 // src/lib/plugin-projection-store.ts
-import { constants as constants7, closeSync as closeSync10, fchmodSync, fstatSync as fstatSync10, fsyncSync as fsyncSync2, linkSync, lstatSync as lstatSync14, mkdirSync as mkdirSync6, openSync as openSync10, opendirSync as opendirSync2, readSync as readSync6, renameSync as renameSync2, rmdirSync as rmdirSync2, rmSync as rmSync2, unlinkSync as unlinkSync3, writeSync as writeSync2 } from "fs";
+import { constants as constants7, closeSync as closeSync10, fchmodSync, fstatSync as fstatSync10, fsyncSync as fsyncSync2, linkSync as linkSync2, lstatSync as lstatSync14, mkdirSync as mkdirSync6, openSync as openSync10, opendirSync as opendirSync2, readSync as readSync6, renameSync as renameSync2, rmdirSync as rmdirSync2, rmSync as rmSync2, unlinkSync as unlinkSync3, writeSync as writeSync2 } from "fs";
 import { dirname as dirname11, isAbsolute as isAbsolute9, join as join22, parse as parse9, resolve as resolve11 } from "path";
 function stat(path) {
   try {
@@ -49956,13 +50014,13 @@ function resolveAgentDiscovery(options) {
       unresolved("JSONC configuration requires a supported format adapter");
     for (const root of [directory, join25(home, ".claude"), join25(home, ".agents")])
       for (const name of ["skill", "skills"])
-        roots.add(join25(root, name));
+        roots.add(canonical6(join25(root, name)));
     if (config2.skills !== undefined && (!Array.isArray(config2.skills) || config2.skills.some((path) => typeof path !== "string")))
       unresolved("skills must be a string array");
     for (const value of config2.skills ?? []) {
       if (typeof value !== "string" || /[\0$]/.test(value) || !value || !(isAbsolute13(value) || value.startsWith("~/")))
         unresolved("remote or relative skill sources need a dedicated discovery adapter");
-      roots.add(value.startsWith("~/") ? join25(home, value.slice(2)) : value);
+      roots.add(canonical6(value.startsWith("~/") ? join25(home, value.slice(2)) : value));
     }
     for (const key of ["plugin", "plugins"])
       if (config2[key] !== undefined && !Array.isArray(config2[key]))

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.30",
+  version: "0.10.33",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.30",
+  version: "0.10.33",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -24125,7 +24125,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.30",
+  version: "0.10.33",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/index.js

@@ -9665,7 +9665,7 @@ import { isAbsolute as isAbsolute13, join as join26, resolve as resolve13 } from
 // src/lib/selection-cache.ts
 import { createHash as createHash6, randomUUID } from "crypto";
 import { spawnSync } from "child_process";
-import { closeSync as closeSync2, constants as constants2, fstatSync as fstatSync2, fsyncSync, lstatSync as lstatSync7, mkdirSync as mkdirSync3, openSync as openSync2, readFileSync as readFileSync8, readlinkSync as readlinkSync2, readSync as readSync2, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { closeSync as closeSync2, constants as constants2, fstatSync as fstatSync2, fsyncSync, linkSync, lstatSync as lstatSync7, mkdirSync as mkdirSync3, openSync as openSync2, readFileSync as readFileSync8, readlinkSync as readlinkSync2, readSync as readSync2, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
 import { hostname } from "os";
 import { dirname as dirname7, join as join11, parse as parse2, resolve as resolve7 } from "path";
 import { isDeepStrictEqual } from "util";
@@ -10655,7 +10655,7 @@ function readSessionLock(sessionId, options) {
   const before = lstatSync7(path, { throwIfNoEntry: false });
   if (!before)
     return null;
-  if (!before.isFile() || before.nlink !== 1 || (before.mode & 63) !== 0 || process.getuid && before.uid !== process.getuid()) {
+  if (!before.isFile() || ![1, 2].includes(before.nlink) || (before.mode & 63) !== 0 || process.getuid && before.uid !== process.getuid()) {
     throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock is not a private regular file; recovery requires review.");
   }
   const bytes = readRegularFile(path, SESSION_LOCK_MAX_BYTES);
@@ -10669,10 +10669,54 @@ function readSessionLock(sessionId, options) {
   } catch {
     throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock is unreadable; recovery requires review.");
   }
-  if (!marker || ![1, 2].includes(marker.schemaVersion) || marker.sessionId !== sessionId || !/^[a-f0-9-]{36}$/i.test(marker.operationId) || !Number.isSafeInteger(marker.pid) || marker.pid <= 0 || marker.schemaVersion === 2 && (!marker.host || !marker.bootId || !marker.processStart || process.platform === "linux" && !marker.pidNamespace)) {
+  if (!marker || ![1, 2].includes(marker.schemaVersion) || marker.sessionId !== sessionId || !/^[a-f0-9-]{36}$/i.test(marker.operationId) || !Number.isSafeInteger(marker.pid) || marker.pid <= 0 || marker.publication !== undefined && marker.publication !== "hard-link-v1" || marker.schemaVersion === 2 && (!marker.host || !marker.bootId || !marker.processStart || process.platform === "linux" && !marker.pidNamespace)) {
     throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock has invalid ownership metadata; recovery requires review.");
   }
-  return { path, bytes, marker, sha256: sha256Hex(bytes), dev: after.dev, ino: after.ino, mtimeMs: after.mtimeMs };
+  let stagingPath;
+  if (after.nlink === 2) {
+    stagingPath = `${path}.${marker.operationId}.prepared`;
+    assertRegularPath(stagingPath);
+    const staged = lstatSync7(stagingPath, { throwIfNoEntry: false });
+    if (marker.publication !== "hard-link-v1" || !staged?.isFile() || staged.dev !== after.dev || staged.ino !== after.ino || staged.nlink !== 2 || staged.mode !== after.mode || staged.uid !== after.uid || staged.gid !== after.gid) {
+      throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock has an unbound publication link; recovery requires review.");
+    }
+  }
+  return { path, bytes, marker, sha256: sha256Hex(bytes), dev: after.dev, ino: after.ino, mtimeMs: after.mtimeMs, stagingPath };
+}
+function publishSessionLock(path, marker) {
+  const stagingPath = `${path}.${marker.operationId}.prepared`;
+  const bytes = Buffer.from(`${JSON.stringify({ ...marker, publication: "hard-link-v1" })}
+`);
+  const fd = openSync2(stagingPath, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | constants2.O_NOFOLLOW, 384);
+  const stat = fstatSync2(fd);
+  let published = false, handedOff = false;
+  try {
+    writeFileSync3(fd, bytes);
+    fsyncSync(fd);
+    linkSync(stagingPath, path);
+    published = true;
+    syncDirectory(dirname7(path));
+    const staged = lstatSync7(stagingPath);
+    if (!staged.isFile() || staged.dev !== stat.dev || staged.ino !== stat.ino) {
+      throw new SkillSelectionError("SESSION_WRITE_LOCK_CHANGED", "The initialized lock staging inode changed before publication completed.");
+    }
+    unlinkSync(stagingPath);
+    syncDirectory(dirname7(path));
+    handedOff = true;
+    return { path, stagingPath, fd, dev: stat.dev, ino: stat.ino };
+  } finally {
+    if (!handedOff) {
+      try {
+        for (const target of [...published ? [path] : [], stagingPath]) {
+          const current = lstatSync7(target, { throwIfNoEntry: false });
+          if (current?.isFile() && current.dev === stat.dev && current.ino === stat.ino)
+            unlinkSync(target);
+        }
+      } finally {
+        closeSync2(fd);
+      }
+    }
+  }
 }
 function writerIsGone(lock, explicitLocalHost) {
   if (Date.now() - lock.mtimeMs < SESSION_LOCK_MIN_AGE_MS)
@@ -10734,10 +10778,21 @@ function archiveSessionLock(lock, receipt, explicitLocalHost) {
     try {
       renameSync(lock.path, archivePath);
       moved = true;
+      const archivedPaths = [archivePath];
+      if (finalLock.stagingPath) {
+        const publicationPath = join11(directory, "publication.write-lock");
+        renameSync(finalLock.stagingPath, publicationPath);
+        archivedPaths.push(publicationPath);
+      }
       syncDirectory(directory);
       syncDirectory(dirname7(lock.path));
-      if (sha256Hex(readRegularFile(archivePath, SESSION_LOCK_MAX_BYTES)) !== lock.sha256) {
-        throw new Error("Archived lock bytes changed");
+      for (const path of archivedPaths) {
+        const before = lstatSync7(path, { throwIfNoEntry: false });
+        const bytes = readRegularFile(path, SESSION_LOCK_MAX_BYTES);
+        const after = lstatSync7(path, { throwIfNoEntry: false });
+        if (!before?.isFile() || before.dev !== lock.dev || before.ino !== lock.ino || before.nlink !== archivedPaths.length || before.mtimeMs !== lock.mtimeMs || (before.mode & 63) !== 0 || process.getuid && before.uid !== process.getuid() || !bytes || sha256Hex(bytes) !== lock.sha256 || !after?.isFile() || before.dev !== after.dev || before.ino !== after.ino || before.mtimeMs !== after.mtimeMs || before.mode !== after.mode || before.uid !== after.uid || before.gid !== after.gid || before.nlink !== after.nlink) {
+          throw new Error("Archived lock ownership or bytes changed");
+        }
       }
     } catch (error) {
       if (moved)
@@ -10754,6 +10809,7 @@ function archiveSessionLock(lock, receipt, explicitLocalHost) {
 }
 function withSessionWriteLocks(sessionIds, options, action) {
   const operationId = randomUUID();
+  const identity3 = localLockIdentity();
   const locks = [...new Set(sessionIds)].map((sessionId) => ({ sessionId, path: `${sessionReceiptPath(sessionId, options)}.write-lock` })).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   const owned = [];
   const assertOwned = () => {
@@ -10767,9 +10823,10 @@ function withSessionWriteLocks(sessionIds, options, action) {
   try {
     for (const lock of locks) {
       assertRegularPath(lock.path, true);
-      let fd;
+      const marker = { schemaVersion: identity3 ? 2 : 1, operationId, sessionId: lock.sessionId, pid: process.pid, ...identity3 };
+      let acquired;
       try {
-        fd = openSync2(lock.path, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | constants2.O_NOFOLLOW, 384);
+        acquired = publishSessionLock(lock.path, marker);
       } catch (error) {
         if (error.code !== "EEXIST")
           throw error;
@@ -10784,7 +10841,7 @@ function withSessionWriteLocks(sessionIds, options, action) {
             throw recoveryError;
         }
         try {
-          fd = openSync2(lock.path, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | constants2.O_NOFOLLOW, 384);
+          acquired = publishSessionLock(lock.path, marker);
         } catch (retryError) {
           if (retryError.code === "EEXIST") {
             if (!readSessionLock(lock.sessionId, options))
@@ -10794,19 +10851,20 @@ function withSessionWriteLocks(sessionIds, options, action) {
           throw retryError;
         }
       }
-      const stat = fstatSync2(fd);
-      owned.push({ path: lock.path, fd, dev: stat.dev, ino: stat.ino });
-      const identity3 = localLockIdentity();
-      writeFileSync3(fd, `${JSON.stringify({ schemaVersion: identity3 ? 2 : 1, operationId, sessionId: lock.sessionId, pid: process.pid, ...identity3 })}
-`);
+      owned.push(acquired);
     }
     return action(assertOwned);
   } finally {
     for (const lock of owned.reverse()) {
-      closeSync2(lock.fd);
-      const current = lstatSync7(lock.path, { throwIfNoEntry: false });
-      if (current?.isFile() && current.dev === lock.dev && current.ino === lock.ino)
-        unlinkSync(lock.path);
+      try {
+        for (const path of [lock.path, lock.stagingPath]) {
+          const current = lstatSync7(path, { throwIfNoEntry: false });
+          if (current?.isFile() && current.dev === lock.dev && current.ino === lock.ino)
+            unlinkSync(path);
+        }
+      } finally {
+        closeSync2(lock.fd);
+      }
     }
   }
 }
@@ -10917,7 +10975,7 @@ function replaceSkillSession(expected, replacement, plan, options = {}, beforeCo
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.30",
+  version: "0.10.33",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -13509,6 +13567,29 @@ function mcpControls(path, read2) {
       refuse2();
   return sha2562;
 }
+function isBundledCleanupHooks(root, namespace, value) {
+  const object5 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v));
+  const exactKeys = (v, keys) => Object.keys(v).length === keys.length && keys.every((key) => Object.hasOwn(v, key));
+  if (basename5(dirname10(root)) !== namespace || basename5(dirname10(dirname10(root))) !== "openai-bundled")
+    return false;
+  const server = namespace === "unified-computer-use" ? "cua_repl" : ["browser", "chrome", "chrome-dev", "chrome-internal", "computer-use"].includes(namespace) ? "node_repl" : undefined;
+  if (!server || !object5(value) || !exactKeys(value, ["hooks"]) || !object5(value.hooks))
+    return false;
+  const events = Object.entries(value.hooks);
+  if (!events.length || events.length > 3)
+    return false;
+  for (const [event, groups] of events) {
+    if (!["Interrupt", "SubagentStop", "Stop"].includes(event) || !Array.isArray(groups) || groups.length !== 1)
+      return false;
+    const group = groups[0];
+    if (!object5(group) || !exactKeys(group, ["hooks"]) || !Array.isArray(group.hooks) || group.hooks.length !== 1)
+      return false;
+    const handler = group.hooks[0];
+    if (!object5(handler) || !exactKeys(handler, ["type", "server", "tool", "input"]) || handler.type !== "mcp_tool" || handler.server !== server || handler.tool !== "turn_ended" || !object5(handler.input) || !exactKeys(handler.input, ["hook_event_name", "session_id", "turn_id"]) || handler.input.hook_event_name !== "${hook_event_name}" || handler.input.turn_id !== "${turn_id}" || handler.input.session_id !== (event === "SubagentStop" ? "${agent_id}" : "${session_id}"))
+      return false;
+  }
+  return true;
+}
 function rootControls(root, read2) {
   const manifestPath = join14(root, ".codex-plugin/plugin.json"), manifestFile = lstatSync12(manifestPath, { throwIfNoEntry: false });
   if (!lstatSync12(join14(root, ".codex-plugin"), { throwIfNoEntry: false })?.isDirectory() || !manifestFile?.isFile() || manifestFile.size > 1024 * 1024)
@@ -13526,9 +13607,11 @@ function rootControls(root, read2) {
   const cacheVersion = basename5(root), declaredVersion = manifest.version === undefined ? "" : typeof manifest.version === "string" ? manifest.version.trim() : null;
   if (declaredVersion === null || (declaredVersion ? declaredVersion !== cacheVersion : cacheVersion !== CODEX_DEFAULT_AGENT_PLUGIN_VERSION))
     refuse2();
-  if (manifest.hooks !== undefined || manifest.commands !== undefined || manifest.mcpServers !== undefined && manifest.mcpServers !== "./.mcp.json" || manifest.apps !== undefined && manifest.apps !== "./.app.json" || lstatSync12(join14(root, "hooks"), { throwIfNoEntry: false }))
+  if (manifest.hooks !== undefined && !isBundledCleanupHooks(root, manifest.name, manifest.hooks) || manifest.commands !== undefined || manifest.mcpServers !== undefined && manifest.mcpServers !== "./.mcp.json" || manifest.apps !== undefined && manifest.apps !== "./.app.json" || lstatSync12(join14(root, "hooks"), { throwIfNoEntry: false }))
     refuse2();
   const mcp = join14(root, ".mcp.json"), mcpPresent = lstatSync12(mcp, { throwIfNoEntry: false });
+  if (manifest.hooks !== undefined && (manifest.mcpServers !== undefined || mcpPresent))
+    refuse2();
   if (mcpPresent && (!mcpPresent.isFile() || mcpPresent.isSymbolicLink() || mcpPresent.size > 1024 * 1024 || realpathSync5(mcp) !== mcp))
     refuse2();
   if (Boolean(mcpPresent) !== (manifest.mcpServers !== undefined))
@@ -14127,7 +14210,7 @@ function upgradeCodexSettingsWitnessV3(previous, reviewedSettingsPath) {
 // src/lib/agent-integration.ts
 import { createHash as createHash12, randomUUID as randomUUID2 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
-import { existsSync as existsSync9, lstatSync as lstatSync16, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync12, readdirSync as readdirSync8, opendirSync as opendirSync3, readlinkSync as readlinkSync4, realpathSync as realpathSync7, renameSync as renameSync2, rmdirSync as rmdirSync2, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3, chmodSync, openSync as openSync8, closeSync as closeSync8, fsyncSync as fsyncSync2, fstatSync as fstatSync8, readSync as readSync6, constants as constants7, linkSync } from "fs";
+import { existsSync as existsSync9, lstatSync as lstatSync16, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync12, readdirSync as readdirSync8, opendirSync as opendirSync3, readlinkSync as readlinkSync4, realpathSync as realpathSync7, renameSync as renameSync2, rmdirSync as rmdirSync2, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3, chmodSync, openSync as openSync8, closeSync as closeSync8, fsyncSync as fsyncSync2, fstatSync as fstatSync8, readSync as readSync6, constants as constants7, linkSync as linkSync2 } from "fs";
 import { dirname as dirname11, join as join18, resolve as resolve11, relative as relative5, isAbsolute as isAbsolute11, sep as sep5 } from "path";
 import { homedir as homedir2 } from "os";
 
@@ -15716,7 +15799,7 @@ function archiveNativeSkills(inventory, options) {
           continue;
         }
         if (entry.discoveryOnly) {
-          linkSync(entry.archive, entry.source);
+          linkSync2(entry.archive, entry.source);
           syncArchiveDirectory(dirname11(entry.source));
           unlinkSync3(entry.archive);
         } else {
@@ -17296,7 +17379,7 @@ function buildPluginProjection(entries) {
 
 // src/lib/plugin-projection-store.ts
 import { createHash as createHash14, randomUUID as randomUUID3 } from "crypto";
-import { constants as constants8, closeSync as closeSync9, fchmodSync, fstatSync as fstatSync9, fsyncSync as fsyncSync3, linkSync as linkSync2, lstatSync as lstatSync18, mkdirSync as mkdirSync8, openSync as openSync9, opendirSync as opendirSync4, readSync as readSync7, renameSync as renameSync4, rmdirSync as rmdirSync3, rmSync as rmSync3, unlinkSync as unlinkSync4, writeSync as writeSync2 } from "fs";
+import { constants as constants8, closeSync as closeSync9, fchmodSync, fstatSync as fstatSync9, fsyncSync as fsyncSync3, linkSync as linkSync3, lstatSync as lstatSync18, mkdirSync as mkdirSync8, openSync as openSync9, opendirSync as opendirSync4, readSync as readSync7, renameSync as renameSync4, rmdirSync as rmdirSync3, rmSync as rmSync3, unlinkSync as unlinkSync4, writeSync as writeSync2 } from "fs";
 import { dirname as dirname13, isAbsolute as isAbsolute12, join as join25, parse as parse5, resolve as resolve12 } from "path";
 var READ_FLAGS = constants8.O_RDONLY | constants8.O_NOFOLLOW | constants8.O_NONBLOCK;
 var WRITE_FLAGS = constants8.O_WRONLY | constants8.O_CREAT | constants8.O_EXCL | constants8.O_NOFOLLOW | constants8.O_NONBLOCK;
@@ -17612,7 +17695,7 @@ function writePluginJsonImmutable(path, value) {
     written = stat(temporary);
     verifyAncestors(chain, true);
     try {
-      linkSync2(temporary, path);
+      linkSync3(temporary, path);
     } catch (error) {
       if (!(error && typeof error === "object" && ("code" in error) && error.code === "EEXIST"))
         throw error;
@@ -18712,13 +18795,13 @@ function resolveAgentDiscovery(options) {
       unresolved("JSONC configuration requires a supported format adapter");
     for (const root2 of [directory, join28(home, ".claude"), join28(home, ".agents")])
       for (const name of ["skill", "skills"])
-        roots.add(join28(root2, name));
+        roots.add(canonical6(join28(root2, name)));
     if (config.skills !== undefined && (!Array.isArray(config.skills) || config.skills.some((path) => typeof path !== "string")))
       unresolved("skills must be a string array");
     for (const value of config.skills ?? []) {
       if (typeof value !== "string" || /[\0$]/.test(value) || !value || !(isAbsolute16(value) || value.startsWith("~/")))
         unresolved("remote or relative skill sources need a dedicated discovery adapter");
-      roots.add(value.startsWith("~/") ? join28(home, value.slice(2)) : value);
+      roots.add(canonical6(value.startsWith("~/") ? join28(home, value.slice(2)) : value));
     }
     for (const key of ["plugin", "plugins"])
       if (config[key] !== undefined && !Array.isArray(config[key]))

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.30",
+  version: "0.10.33",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -33976,7 +33976,7 @@ import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 // src/lib/selection-cache.ts
 import { createHash as createHash3, randomUUID } from "crypto";
 import { spawnSync as spawnSync2 } from "child_process";
-import { closeSync as closeSync5, constants as constants2, fstatSync as fstatSync5, fsyncSync, lstatSync as lstatSync3, mkdirSync as mkdirSync2, openSync as openSync5, readFileSync as readFileSync6, readlinkSync, readSync as readSync2, renameSync, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
+import { closeSync as closeSync5, constants as constants2, fstatSync as fstatSync5, fsyncSync, linkSync, lstatSync as lstatSync3, mkdirSync as mkdirSync2, openSync as openSync5, readFileSync as readFileSync6, readlinkSync, readSync as readSync2, renameSync, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
 import { hostname } from "os";
 import { dirname as dirname3, join as join7, parse, resolve as resolve2 } from "path";
 import { isDeepStrictEqual } from "util";
@@ -35259,7 +35259,7 @@ function readSessionLock(sessionId, options) {
   const before = lstatSync3(path, { throwIfNoEntry: false });
   if (!before)
     return null;
-  if (!before.isFile() || before.nlink !== 1 || (before.mode & 63) !== 0 || process.getuid && before.uid !== process.getuid()) {
+  if (!before.isFile() || ![1, 2].includes(before.nlink) || (before.mode & 63) !== 0 || process.getuid && before.uid !== process.getuid()) {
     throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock is not a private regular file; recovery requires review.");
   }
   const bytes = readRegularFile(path, SESSION_LOCK_MAX_BYTES);
@@ -35273,10 +35273,54 @@ function readSessionLock(sessionId, options) {
   } catch {
     throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock is unreadable; recovery requires review.");
   }
-  if (!marker || ![1, 2].includes(marker.schemaVersion) || marker.sessionId !== sessionId || !/^[a-f0-9-]{36}$/i.test(marker.operationId) || !Number.isSafeInteger(marker.pid) || marker.pid <= 0 || marker.schemaVersion === 2 && (!marker.host || !marker.bootId || !marker.processStart || process.platform === "linux" && !marker.pidNamespace)) {
+  if (!marker || ![1, 2].includes(marker.schemaVersion) || marker.sessionId !== sessionId || !/^[a-f0-9-]{36}$/i.test(marker.operationId) || !Number.isSafeInteger(marker.pid) || marker.pid <= 0 || marker.publication !== undefined && marker.publication !== "hard-link-v1" || marker.schemaVersion === 2 && (!marker.host || !marker.bootId || !marker.processStart || process.platform === "linux" && !marker.pidNamespace)) {
     throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock has invalid ownership metadata; recovery requires review.");
   }
-  return { path, bytes, marker, sha256: sha256Hex(bytes), dev: after.dev, ino: after.ino, mtimeMs: after.mtimeMs };
+  let stagingPath;
+  if (after.nlink === 2) {
+    stagingPath = `${path}.${marker.operationId}.prepared`;
+    assertRegularPath(stagingPath);
+    const staged = lstatSync3(stagingPath, { throwIfNoEntry: false });
+    if (marker.publication !== "hard-link-v1" || !staged?.isFile() || staged.dev !== after.dev || staged.ino !== after.ino || staged.nlink !== 2 || staged.mode !== after.mode || staged.uid !== after.uid || staged.gid !== after.gid) {
+      throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock has an unbound publication link; recovery requires review.");
+    }
+  }
+  return { path, bytes, marker, sha256: sha256Hex(bytes), dev: after.dev, ino: after.ino, mtimeMs: after.mtimeMs, stagingPath };
+}
+function publishSessionLock(path, marker) {
+  const stagingPath = `${path}.${marker.operationId}.prepared`;
+  const bytes = Buffer.from(`${JSON.stringify({ ...marker, publication: "hard-link-v1" })}
+`);
+  const fd = openSync5(stagingPath, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | constants2.O_NOFOLLOW, 384);
+  const stat = fstatSync5(fd);
+  let published = false, handedOff = false;
+  try {
+    writeFileSync2(fd, bytes);
+    fsyncSync(fd);
+    linkSync(stagingPath, path);
+    published = true;
+    syncDirectory(dirname3(path));
+    const staged = lstatSync3(stagingPath);
+    if (!staged.isFile() || staged.dev !== stat.dev || staged.ino !== stat.ino) {
+      throw new SkillSelectionError("SESSION_WRITE_LOCK_CHANGED", "The initialized lock staging inode changed before publication completed.");
+    }
+    unlinkSync(stagingPath);
+    syncDirectory(dirname3(path));
+    handedOff = true;
+    return { path, stagingPath, fd, dev: stat.dev, ino: stat.ino };
+  } finally {
+    if (!handedOff) {
+      try {
+        for (const target of [...published ? [path] : [], stagingPath]) {
+          const current = lstatSync3(target, { throwIfNoEntry: false });
+          if (current?.isFile() && current.dev === stat.dev && current.ino === stat.ino)
+            unlinkSync(target);
+        }
+      } finally {
+        closeSync5(fd);
+      }
+    }
+  }
 }
 function writerIsGone(lock, explicitLocalHost) {
   if (Date.now() - lock.mtimeMs < SESSION_LOCK_MIN_AGE_MS)
@@ -35338,10 +35382,21 @@ function archiveSessionLock(lock, receipt, explicitLocalHost) {
     try {
       renameSync(lock.path, archivePath);
       moved = true;
+      const archivedPaths = [archivePath];
+      if (finalLock.stagingPath) {
+        const publicationPath = join7(directory, "publication.write-lock");
+        renameSync(finalLock.stagingPath, publicationPath);
+        archivedPaths.push(publicationPath);
+      }
       syncDirectory(directory);
       syncDirectory(dirname3(lock.path));
-      if (sha256Hex(readRegularFile(archivePath, SESSION_LOCK_MAX_BYTES)) !== lock.sha256) {
-        throw new Error("Archived lock bytes changed");
+      for (const path of archivedPaths) {
+        const before = lstatSync3(path, { throwIfNoEntry: false });
+        const bytes = readRegularFile(path, SESSION_LOCK_MAX_BYTES);
+        const after = lstatSync3(path, { throwIfNoEntry: false });
+        if (!before?.isFile() || before.dev !== lock.dev || before.ino !== lock.ino || before.nlink !== archivedPaths.length || before.mtimeMs !== lock.mtimeMs || (before.mode & 63) !== 0 || process.getuid && before.uid !== process.getuid() || !bytes || sha256Hex(bytes) !== lock.sha256 || !after?.isFile() || before.dev !== after.dev || before.ino !== after.ino || before.mtimeMs !== after.mtimeMs || before.mode !== after.mode || before.uid !== after.uid || before.gid !== after.gid || before.nlink !== after.nlink) {
+          throw new Error("Archived lock ownership or bytes changed");
+        }
       }
     } catch (error) {
       if (moved)
@@ -35358,6 +35413,7 @@ function archiveSessionLock(lock, receipt, explicitLocalHost) {
 }
 function withSessionWriteLocks(sessionIds, options, action) {
   const operationId = randomUUID();
+  const identity = localLockIdentity();
   const locks = [...new Set(sessionIds)].map((sessionId) => ({ sessionId, path: `${sessionReceiptPath(sessionId, options)}.write-lock` })).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   const owned = [];
   const assertOwned = () => {
@@ -35371,9 +35427,10 @@ function withSessionWriteLocks(sessionIds, options, action) {
   try {
     for (const lock of locks) {
       assertRegularPath(lock.path, true);
-      let fd;
+      const marker = { schemaVersion: identity ? 2 : 1, operationId, sessionId: lock.sessionId, pid: process.pid, ...identity };
+      let acquired;
       try {
-        fd = openSync5(lock.path, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | constants2.O_NOFOLLOW, 384);
+        acquired = publishSessionLock(lock.path, marker);
       } catch (error) {
         if (error.code !== "EEXIST")
           throw error;
@@ -35388,7 +35445,7 @@ function withSessionWriteLocks(sessionIds, options, action) {
             throw recoveryError;
         }
         try {
-          fd = openSync5(lock.path, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | constants2.O_NOFOLLOW, 384);
+          acquired = publishSessionLock(lock.path, marker);
         } catch (retryError) {
           if (retryError.code === "EEXIST") {
             if (!readSessionLock(lock.sessionId, options))
@@ -35398,19 +35455,20 @@ function withSessionWriteLocks(sessionIds, options, action) {
           throw retryError;
         }
       }
-      const stat = fstatSync5(fd);
-      owned.push({ path: lock.path, fd, dev: stat.dev, ino: stat.ino });
-      const identity = localLockIdentity();
-      writeFileSync2(fd, `${JSON.stringify({ schemaVersion: identity ? 2 : 1, operationId, sessionId: lock.sessionId, pid: process.pid, ...identity })}
-`);
+      owned.push(acquired);
     }
     return action(assertOwned);
   } finally {
     for (const lock of owned.reverse()) {
-      closeSync5(lock.fd);
-      const current = lstatSync3(lock.path, { throwIfNoEntry: false });
-      if (current?.isFile() && current.dev === lock.dev && current.ino === lock.ino)
-        unlinkSync(lock.path);
+      try {
+        for (const path of [lock.path, lock.stagingPath]) {
+          const current = lstatSync3(path, { throwIfNoEntry: false });
+          if (current?.isFile() && current.dev === lock.dev && current.ino === lock.ino)
+            unlinkSync(path);
+        }
+      } finally {
+        closeSync5(lock.fd);
+      }
     }
   }
 }
@@ -38451,6 +38509,29 @@ function mcpControls(path, read) {
       refuse3();
   return sha2562;
 }
+function isBundledCleanupHooks(root, namespace, value) {
+  const object3 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v));
+  const exactKeys2 = (v, keys2) => Object.keys(v).length === keys2.length && keys2.every((key) => Object.hasOwn(v, key));
+  if (basename3(dirname5(root)) !== namespace || basename3(dirname5(dirname5(root))) !== "openai-bundled")
+    return false;
+  const server = namespace === "unified-computer-use" ? "cua_repl" : ["browser", "chrome", "chrome-dev", "chrome-internal", "computer-use"].includes(namespace) ? "node_repl" : undefined;
+  if (!server || !object3(value) || !exactKeys2(value, ["hooks"]) || !object3(value.hooks))
+    return false;
+  const events = Object.entries(value.hooks);
+  if (!events.length || events.length > 3)
+    return false;
+  for (const [event, groups] of events) {
+    if (!["Interrupt", "SubagentStop", "Stop"].includes(event) || !Array.isArray(groups) || groups.length !== 1)
+      return false;
+    const group = groups[0];
+    if (!object3(group) || !exactKeys2(group, ["hooks"]) || !Array.isArray(group.hooks) || group.hooks.length !== 1)
+      return false;
+    const handler = group.hooks[0];
+    if (!object3(handler) || !exactKeys2(handler, ["type", "server", "tool", "input"]) || handler.type !== "mcp_tool" || handler.server !== server || handler.tool !== "turn_ended" || !object3(handler.input) || !exactKeys2(handler.input, ["hook_event_name", "session_id", "turn_id"]) || handler.input.hook_event_name !== "${hook_event_name}" || handler.input.turn_id !== "${turn_id}" || handler.input.session_id !== (event === "SubagentStop" ? "${agent_id}" : "${session_id}"))
+      return false;
+  }
+  return true;
+}
 function rootControls(root, read) {
   const manifestPath = join10(root, ".codex-plugin/plugin.json"), manifestFile = lstatSync6(manifestPath, { throwIfNoEntry: false });
   if (!lstatSync6(join10(root, ".codex-plugin"), { throwIfNoEntry: false })?.isDirectory() || !manifestFile?.isFile() || manifestFile.size > 1024 * 1024)
@@ -38468,9 +38549,11 @@ function rootControls(root, read) {
   const cacheVersion = basename3(root), declaredVersion = manifest.version === undefined ? "" : typeof manifest.version === "string" ? manifest.version.trim() : null;
   if (declaredVersion === null || (declaredVersion ? declaredVersion !== cacheVersion : cacheVersion !== CODEX_DEFAULT_AGENT_PLUGIN_VERSION))
     refuse3();
-  if (manifest.hooks !== undefined || manifest.commands !== undefined || manifest.mcpServers !== undefined && manifest.mcpServers !== "./.mcp.json" || manifest.apps !== undefined && manifest.apps !== "./.app.json" || lstatSync6(join10(root, "hooks"), { throwIfNoEntry: false }))
+  if (manifest.hooks !== undefined && !isBundledCleanupHooks(root, manifest.name, manifest.hooks) || manifest.commands !== undefined || manifest.mcpServers !== undefined && manifest.mcpServers !== "./.mcp.json" || manifest.apps !== undefined && manifest.apps !== "./.app.json" || lstatSync6(join10(root, "hooks"), { throwIfNoEntry: false }))
     refuse3();
   const mcp = join10(root, ".mcp.json"), mcpPresent = lstatSync6(mcp, { throwIfNoEntry: false });
+  if (manifest.hooks !== undefined && (manifest.mcpServers !== undefined || mcpPresent))
+    refuse3();
   if (mcpPresent && (!mcpPresent.isFile() || mcpPresent.isSymbolicLink() || mcpPresent.size > 1024 * 1024 || realpathSync5(mcp) !== mcp))
     refuse3();
   if (Boolean(mcpPresent) !== (manifest.mcpServers !== undefined))
@@ -39090,7 +39173,7 @@ var NATIVE_SKILL_ROOTS = [
 // src/lib/agent-integration.ts
 import { createHash as createHash18, randomUUID as randomUUID3 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual6 } from "util";
-import { existsSync as existsSync7, lstatSync as lstatSync20, statSync as statSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync14, readdirSync as readdirSync8, opendirSync as opendirSync5, readlinkSync as readlinkSync4, realpathSync as realpathSync8, renameSync as renameSync3, rmdirSync as rmdirSync3, writeFileSync as writeFileSync4, unlinkSync as unlinkSync4, chmodSync, openSync as openSync16, closeSync as closeSync16, fsyncSync as fsyncSync4, fstatSync as fstatSync16, readSync as readSync11, constants as constants12, linkSync as linkSync2 } from "fs";
+import { existsSync as existsSync7, lstatSync as lstatSync20, statSync as statSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync14, readdirSync as readdirSync8, opendirSync as opendirSync5, readlinkSync as readlinkSync4, realpathSync as realpathSync8, renameSync as renameSync3, rmdirSync as rmdirSync3, writeFileSync as writeFileSync4, unlinkSync as unlinkSync4, chmodSync, openSync as openSync16, closeSync as closeSync16, fsyncSync as fsyncSync4, fstatSync as fstatSync16, readSync as readSync11, constants as constants12, linkSync as linkSync3 } from "fs";
 import { dirname as dirname15, join as join23, resolve as resolve16, relative as relative4, isAbsolute as isAbsolute17, sep as sep5 } from "path";
 import { homedir as homedir3 } from "os";
 
@@ -40091,7 +40174,7 @@ function buildPluginProjection(entries) {
 
 // src/lib/plugin-projection-store.ts
 import { createHash as createHash13, randomUUID as randomUUID2 } from "crypto";
-import { constants as constants8, closeSync as closeSync12, fchmodSync, fstatSync as fstatSync12, fsyncSync as fsyncSync2, linkSync, lstatSync as lstatSync13, mkdirSync as mkdirSync4, openSync as openSync12, opendirSync as opendirSync3, readSync as readSync7, renameSync as renameSync2, rmdirSync as rmdirSync2, rmSync, unlinkSync as unlinkSync3, writeSync as writeSync2 } from "fs";
+import { constants as constants8, closeSync as closeSync12, fchmodSync, fstatSync as fstatSync12, fsyncSync as fsyncSync2, linkSync as linkSync2, lstatSync as lstatSync13, mkdirSync as mkdirSync4, openSync as openSync12, opendirSync as opendirSync3, readSync as readSync7, renameSync as renameSync2, rmdirSync as rmdirSync2, rmSync, unlinkSync as unlinkSync3, writeSync as writeSync2 } from "fs";
 import { dirname as dirname10, isAbsolute as isAbsolute11, join as join16, parse as parse5, resolve as resolve10 } from "path";
 var READ_FLAGS = constants8.O_RDONLY | constants8.O_NOFOLLOW | constants8.O_NONBLOCK;
 var WRITE_FLAGS = constants8.O_WRONLY | constants8.O_CREAT | constants8.O_EXCL | constants8.O_NOFOLLOW | constants8.O_NONBLOCK;
@@ -40407,7 +40490,7 @@ function writePluginJsonImmutable(path, value) {
     written = stat(temporary);
     verifyAncestors(chain, true);
     try {
-      linkSync(temporary, path);
+      linkSync2(temporary, path);
     } catch (error) {
       if (!(error && typeof error === "object" && ("code" in error) && error.code === "EEXIST"))
         throw error;
@@ -42051,13 +42134,13 @@ function resolveAgentDiscovery(options) {
       unresolved("JSONC configuration requires a supported format adapter");
     for (const root2 of [directory, join22(home, ".claude"), join22(home, ".agents")])
       for (const name of ["skill", "skills"])
-        roots.add(join22(root2, name));
+        roots.add(canonical6(join22(root2, name)));
     if (config.skills !== undefined && (!Array.isArray(config.skills) || config.skills.some((path) => typeof path !== "string")))
       unresolved("skills must be a string array");
     for (const value of config.skills ?? []) {
       if (typeof value !== "string" || /[\0$]/.test(value) || !value || !(isAbsolute16(value) || value.startsWith("~/")))
         unresolved("remote or relative skill sources need a dedicated discovery adapter");
-      roots.add(value.startsWith("~/") ? join22(home, value.slice(2)) : value);
+      roots.add(canonical6(value.startsWith("~/") ? join22(home, value.slice(2)) : value));
     }
     for (const key of ["plugin", "plugins"])
       if (config[key] !== undefined && !Array.isArray(config[key]))
@@ -43695,7 +43778,7 @@ function archiveNativeSkills(inventory, options) {
           continue;
         }
         if (entry.discoveryOnly) {
-          linkSync2(entry.archive, entry.source);
+          linkSync3(entry.archive, entry.source);
           syncArchiveDirectory(dirname15(entry.source));
           unlinkSync4(entry.archive);
         } else {

package/docs/plugin-admission.md

@@ -364,3 +364,24 @@ their exact witnesses and trust state; they must still pass their own consumer
 checks before use. The plan's `managedAgentChecks.agents` and `nativeSkills`
 describe this scoped runtime check, not a fleet health result. A path-identity
 witness intersecting the write still refuses instead of adopting a new inode.
+
+## Codex bundled cleanup controls
+
+Qualified native skill review supports a narrow subset of Codex 0.159.2 and
+0.160.0's bundled cleanup hooks. The identities `browser`, `chrome`, `chrome-dev`,
+`chrome-internal` and `computer-use` in `openai-bundled` may call
+`node_repl.turn_ended`; `unified-computer-use` may call `cua_repl.turn_ended`.
+Only `Interrupt`, `SubagentStop` and `Stop` are accepted, with one group and one
+MCP handler per event. Inputs are the exact native event, turn and session
+placeholders; `SubagentStop` uses the child `agent_id` for its session value.
+Commands, matchers, other arguments, external hook files and a plugin MCP
+declaration alongside these hooks remain refused. Apps cleanup routing requires
+connector identity from a native tool catalog and is not admitted by this path.
+
+The complete inline hooks stay in the manifest fingerprint across cache versions,
+including after all native skill bodies disappear. A changed hook fails guarded
+apply and subsequent discovery checks. This review preserves native cleanup;
+it neither enables plugins nor grants hook trust, browser authority or signing.
+The upstream contracts are
+[0.159.2 bundled hooks](https://github.com/openai/codex/blob/ff6aec96948b70d94983af2641a6b67c94faeff5/codex-rs/plugin/src/bundled_hooks.rs)
+and [0.160.0 bundled hooks](https://github.com/openai/codex/blob/a956835d020762cb2b570053af06f643a11c0ecc/codex-rs/plugin/src/bundled_hooks.rs).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.30",
+  "version": "0.10.33",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {