@hasna/skills 0.10.33 → 0.10.34

package/README.md

@@ -1148,6 +1148,32 @@ semantic version. If discovery or verification fails, it exits nonzero and
 explains that installation may already have completed. It does not automatically
 reinstall or change your PATH.
 
+### Exact-version runtime updates
+
+`skills self-update --version 0.10.34` installs a verified package into a retained
+copyfile runtime, preserves configuration and launcher preimages, and keeps the
+previous runtime available for receipt-bound rollback.
+
+To require a minimum dependency age, pass a positive integer number of days and
+repeat the exclusion option for package names or package globs:
+
+```bash
+skills self-update --version 0.10.34 --min-release-age 7 \
+  --min-release-age-exclude '@hasna/*' \
+  --min-release-age-exclude '@hasna-internal/*' \
+  --min-release-age-exclude '@openai/*' \
+  --min-release-age-exclude '@anthropic-ai/*' \
+  --min-release-age-exclude openai
+```
+
+The policy reaches both dependency lock resolution and `npm ci` through private
+npm configuration. Exemptions match each dependency's own package identity;
+unrelated transitive dependencies retain the minimum age. These options require
+an exact version and npm 11.19.0 or newer with both age capabilities. They are
+refused for rollback, alias adoption or the no-argument updater. Existing ambient
+npm settings and credentials are not forwarded. Omitting the policy preserves
+existing exact-version update behavior.
+
 ### Local environment assignments
 
 `skills env-check --set 'KEY=value'` writes one literal value to the current

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.33",
+    version: "0.10.34",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -109753,16 +109753,47 @@ function assertConfigUnchanged(configs) {
     }
   }
 }
-async function runNpm(args2, cwd2, home, staging) {
+function releaseAgePolicy(options) {
+  if (options.minReleaseAgeExclude !== undefined && !Array.isArray(options.minReleaseAgeExclude))
+    throw new Error("MIN_RELEASE_AGE_EXCLUDE_INVALID");
+  if (options.minReleaseAge === undefined) {
+    if (options.minReleaseAgeExclude?.length)
+      throw new Error("MIN_RELEASE_AGE_REQUIRED_FOR_EXCLUSIONS");
+    return;
+  }
+  if (!Number.isSafeInteger(options.minReleaseAge) || options.minReleaseAge < 1)
+    throw new Error("MIN_RELEASE_AGE_INVALID");
+  const exclusions = options.minReleaseAgeExclude ?? [];
+  if (!Array.isArray(exclusions) || exclusions.some((pattern) => typeof pattern !== "string" || pattern.length > 214 || !/^(?:@[a-z0-9*?][a-z0-9._*?-]*\/)?[a-z0-9*?][a-z0-9._*?-]*$/.test(pattern))) {
+    throw new Error("MIN_RELEASE_AGE_EXCLUDE_INVALID");
+  }
+  return { minReleaseAge: options.minReleaseAge, minReleaseAgeExclude: [...new Set(exclusions)] };
+}
+async function npmReleaseAgeCapability(cwd2, env3) {
+  try {
+    const versionProbe = Bun.spawn(["npm", "--version"], { cwd: cwd2, env: env3, stdin: "ignore", stdout: "pipe", stderr: "ignore" });
+    const [versionText, versionStatus] = await Promise.all([new Response(versionProbe.stdout).text(), versionProbe.exited]);
+    const version2 = versionText.trim();
+    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version2);
+    if (versionStatus !== 0 || !match || Number(match[1]) < 11 || Number(match[1]) === 11 && Number(match[2]) < 19)
+      throw new Error("NPM_RELEASE_AGE_UNSUPPORTED");
+    const configProbe = Bun.spawn(["npm", "config", "list", "--json"], { cwd: cwd2, env: env3, stdin: "ignore", stdout: "pipe", stderr: "ignore" });
+    const [configText, configStatus] = await Promise.all([new Response(configProbe.stdout).text(), configProbe.exited]);
+    const config2 = object9(JSON.parse(configText), "NPM_RELEASE_AGE_UNSUPPORTED");
+    if (configStatus !== 0 || !Object.hasOwn(config2, "min-release-age") || !Object.hasOwn(config2, "min-release-age-exclude") || !Array.isArray(config2["min-release-age-exclude"]))
+      throw new Error("NPM_RELEASE_AGE_UNSUPPORTED");
+    return version2;
+  } catch {
+    throw new Error("NPM_RELEASE_AGE_UNSUPPORTED");
+  }
+}
+async function runNpm(args2, cwd2, home, staging, policy) {
   const userNpmrc = join56(staging, "npm-user.npmrc"), globalNpmrc = join56(staging, "npm-global.npmrc");
-  if (!existsSync34(userNpmrc))
-    writeFileSync23(userNpmrc, `registry=${REGISTRY_ORIGIN}/
+  const baseConfig = `registry=${REGISTRY_ORIGIN}/
 ignore-scripts=true
-`, { mode: 384, flag: "wx" });
+`;
   if (!existsSync34(globalNpmrc))
-    writeFileSync23(globalNpmrc, `registry=${REGISTRY_ORIGIN}/
-ignore-scripts=true
-`, { mode: 384, flag: "wx" });
+    writeFileSync23(globalNpmrc, baseConfig, { mode: 384, flag: "wx" });
   const env3 = {
     PATH: process.env.PATH ?? "",
     HOME: home,
@@ -109776,6 +109807,19 @@ ignore-scripts=true
     NPM_CONFIG_REGISTRY: `${REGISTRY_ORIGIN}/`,
     NPM_CONFIG_IGNORE_SCRIPTS: "true"
   };
+  const capabilityNpmrc = join56(staging, "npm-capability.npmrc");
+  if (policy && !existsSync34(capabilityNpmrc))
+    writeFileSync23(capabilityNpmrc, baseConfig, { mode: 384, flag: "wx" });
+  if (policy && readFileSync37(capabilityNpmrc, "utf8") !== baseConfig)
+    throw new Error("NPM_ISOLATED_CONFIG_DRIFT");
+  const npmVersion = policy ? await npmReleaseAgeCapability(cwd2, { ...env3, NPM_CONFIG_USERCONFIG: capabilityNpmrc }) : undefined;
+  const config2 = baseConfig + (policy ? `min-release-age=${policy.minReleaseAge}
+${policy.minReleaseAgeExclude.map((pattern) => `min-release-age-exclude[]=${pattern}
+`).join("")}` : "");
+  if (!existsSync34(userNpmrc))
+    writeFileSync23(userNpmrc, config2, { mode: 384, flag: "wx" });
+  if (readFileSync37(userNpmrc, "utf8") !== config2 || readFileSync37(globalNpmrc, "utf8") !== baseConfig)
+    throw new Error("NPM_ISOLATED_CONFIG_DRIFT");
   const proc = Bun.spawn(["npm", ...args2, "--registry", `${REGISTRY_ORIGIN}/`, "--ignore-scripts", "--no-audit", "--no-fund"], {
     cwd: cwd2,
     env: env3,
@@ -109786,6 +109830,7 @@ ignore-scripts=true
   const exitCode = await proc.exited;
   if (exitCode !== 0)
     throw new Error("DEPENDENCY_GRAPH_INSTALL_FAILED");
+  return npmVersion;
 }
 function comparePackageTrees(expectedRoot, installedRoot) {
   const expected = readTree(expectedRoot, false);
@@ -110164,6 +110209,7 @@ async function updateCopyfileRuntime(version2, options = {}) {
     throw new Error("EXACT_VERSION_REQUIRED");
   if (!STABLE_SEMVER_PATTERN.test(version2))
     throw new Error("EXACT_STABLE_VERSION_REQUIRED");
+  const policy = releaseAgePolicy(options);
   const home = resolve24(options.homeDir ?? process.env.HOME ?? "");
   if (!home || !existsSync34(home))
     throw new Error("HOME_NOT_FOUND");
@@ -110201,8 +110247,10 @@ async function updateCopyfileRuntime(version2, options = {}) {
     mkdirSync24(stagePackage, { mode: 448 });
     copyFileSync(artifact.tarballPath, join56(stagePackage, "verified.tgz"));
     writeFileSync23(join56(stagePackage, "package.json"), JSON.stringify({ private: true, dependencies: { [PACKAGE_NAME]: "file:./verified.tgz" } }, null, 2), { mode: 384, flag: "wx" });
-    await runNpm(["install", "--package-lock-only", "--prefix", stagePackage], stagePackage, home, stagePath);
-    await runNpm(["ci", "--prefix", stagePackage], stagePackage, home, stagePath);
+    const npmVersion = await runNpm(["install", "--package-lock-only", "--prefix", stagePackage], stagePackage, home, stagePath, policy);
+    const ciNpmVersion = await runNpm(["ci", "--prefix", stagePackage], stagePackage, home, stagePath, policy);
+    if (npmVersion !== ciNpmVersion)
+      throw new Error("NPM_VERSION_DRIFT_DURING_UPDATE");
     const lockBytes = readFileSync37(join56(stagePackage, "package-lock.json"));
     const installedPackage = join56(stagePackage, "node_modules", "@hasna", "skills");
     const installed = readPackage(join56(installedPackage, "package.json"));
@@ -110243,6 +110291,7 @@ async function updateCopyfileRuntime(version2, options = {}) {
       targetPackageRoot,
       configs: configPreimages,
       preimageSha256,
+      ...policy ? { dependencyPolicy: { ...policy, npmVersion } } : {},
       launchers,
       switchedLaunchers: [],
       rollbackCompletedLaunchers: []
@@ -110281,7 +110330,7 @@ async function updateCopyfileRuntime(version2, options = {}) {
     }
     receipt.state = "switched";
     persistReceipt(join56(finalPath, "rollout-receipt.json"), receipt);
-    return { updated: true, version: version2, currentVersion: layout.currentVersion, receiptId: id2, runtimeRoot: finalPath, tarballSha256: artifact.sha256, tarballIntegrity: artifact.integrity, runtimeTreeSha256: stagedTree.digest, launcherCount: launchers.length, configCount: configPreimages.length };
+    return { updated: true, version: version2, currentVersion: layout.currentVersion, receiptId: id2, runtimeRoot: finalPath, tarballSha256: artifact.sha256, tarballIntegrity: artifact.integrity, runtimeTreeSha256: stagedTree.digest, launcherCount: launchers.length, configCount: configPreimages.length, ...policy ? { dependencyPolicy: { ...policy, npmVersion } } : {} };
   } catch (error61) {
     if (switched.length > 0 || moved) {
       let rollbackFailed = false;
@@ -110505,7 +110554,12 @@ function registerRuntime(parent) {
   });
   const setup = parent.command("setup").description("Point this CLI at a Skills API server, or register agent integrations").option("--api-url <url>", "Skills API origin to send remote work to").option("--global", "Accepted for compatibility; the API origin is always per-user", false).option("--json", "Output setup result as JSON", false).action(async (options) => handleSetup(options));
   setup.command("agents").option("--json", "Output registration result as JSON", false).description("Register the Skills MCP server with all supported agents").action(async (options) => handleMcp({ register: "all", json: options.json }));
-  parent.command("self-update").description("Update @hasna/skills to the latest version").option("--json", "Output result as JSON", false).option("--version <version>", "Install this exact @hasna/skills version as a staged copyfile runtime").option("--rollback <receipt-id>", "Restore launcher links from an exact copyfile rollout receipt").option("--adopt-aliases", "Switch verified legacy @hasna/skills aliases to the active copyfile runtime").option("--rollback-aliases <receipt-id>", "Restore aliases from an exact adoption receipt").action(async (options) => {
+  parent.command("self-update").description("Update @hasna/skills to the latest version").option("--json", "Output result as JSON", false).option("--version <version>", "Install this exact @hasna/skills version as a staged copyfile runtime").option("--min-release-age <days>", "Require a positive integer dependency release age in days for an exact-version update").option("--min-release-age-exclude <pattern>", "Exclude matching package identities from the release-age policy (repeatable)", (pattern, prior) => [...prior, pattern], []).option("--rollback <receipt-id>", "Restore launcher links from an exact copyfile rollout receipt").option("--adopt-aliases", "Switch verified legacy @hasna/skills aliases to the active copyfile runtime").option("--rollback-aliases <receipt-id>", "Restore aliases from an exact adoption receipt").action(async (options) => {
+    if ((options.minReleaseAge !== undefined || options.minReleaseAgeExclude.length > 0) && (!options.version || options.rollback || options.adoptAliases || options.rollbackAliases)) {
+      console.error(JSON.stringify({ error: "RELEASE_AGE_POLICY_REQUIRES_EXACT_VERSION" }));
+      process.exitCode = 1;
+      return;
+    }
     if ([options.version, options.rollback, options.adoptAliases, options.rollbackAliases].filter(Boolean).length > 1) {
       console.error(JSON.stringify({ error: "SELF_UPDATE_OPERATIONS_ARE_MUTUALLY_EXCLUSIVE" }));
       process.exitCode = 1;
@@ -110541,7 +110595,8 @@ function registerRuntime(parent) {
     }
     if (options.version) {
       try {
-        const result2 = await updateCopyfileRuntime(options.version);
+        const minReleaseAge = options.minReleaseAge === undefined ? undefined : /^\d+$/.test(options.minReleaseAge) ? Number(options.minReleaseAge) : NaN;
+        const result2 = await updateCopyfileRuntime(options.version, { minReleaseAge, minReleaseAgeExclude: options.minReleaseAgeExclude });
         if (options.json)
           console.log(JSON.stringify(result2));
         else

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.33",
+    version: "0.10.34",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.33",
+  version: "0.10.34",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.33",
+  version: "0.10.34",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -24125,7 +24125,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.33",
+  version: "0.10.34",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/cli/commands/runtime-copyfile.d.ts

@@ -26,6 +26,8 @@ export declare function updateCopyfileRuntime(version: string, options?: {
     pathValue?: string;
     registryOrigin?: string;
     fetcher?: typeof fetch;
+    minReleaseAge?: number;
+    minReleaseAgeExclude?: string[];
     onLauncherSwitched?: (path: string) => void;
 }): Promise<JsonObject>;
 export declare function rollbackCopyfileRuntime(receiptId: string, options?: {

package/dist/index.js

@@ -10975,7 +10975,7 @@ function replaceSkillSession(expected, replacement, plan, options = {}, beforeCo
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.33",
+  version: "0.10.34",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.33",
+  version: "0.10.34",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.33",
+  "version": "0.10.34",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {