@hasna/skills 0.10.34 → 0.10.35

package/dist/lib/agent-integration.d.ts

@@ -133,6 +133,33 @@ export declare function planAgentIntegration(options: {
     reviewedCacheAlias?: string;
     codexNativeCatalog?: CodexNativeSkillCatalog;
 }): AgentIntegrationPlan;
+export interface ClaudeManagedHookProjection {
+    schema: "hasna.claude-managed-hook-projection.v1";
+    targetSha256: string;
+    sourceSha256: string;
+    replacements: Array<{
+        event: string;
+        groupIndex: number;
+        hookIndex: number;
+        beforeSha256: string;
+        command: string;
+    }>;
+}
+export interface ClaudeManagedHookProjectionOptions {
+    home?: string;
+    dataDir?: string;
+    projectDir?: string;
+    /** Exact caller-owned bytes, never a new native home or a path to be written. */
+    targetSettings: string;
+    expectedTargetSha256: string;
+    /** Supply the preceding plan's source witness when checking it before use. */
+    expectedSourceSha256?: string;
+}
+/** Read-only projection for a copied Claude configuration. This does not install
+ * hooks, adopt target discovery, change policy, or confer write/admission authority.
+ * The caller must preserve the full target, hold its owning writer lease, replan
+ * against both witnesses, CAS the full bytes and revalidate after application. */
+export declare function planClaudeManagedHookProjection(options: ClaudeManagedHookProjectionOptions): ClaudeManagedHookProjection;
 /** Plan an explicitly authorized Stop hook replacement without adopting drift.
  * The caller owns authorization of its exact Stop hook delta; Skills refuses
  * every other settings change and owns discovery witnesses and guarded writes.

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.34",
+  version: "0.10.35",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -42695,12 +42695,15 @@ function disableCodexBundledSkills(text2) {
 // src/lib/agent-integration.ts
 var sha4 = (data) => createHash18("sha256").update(data).digest("hex");
 var ROOTS = NATIVE_SKILL_ROOTS;
-function hasNoDarwinAcl(fd) {
+function hasTrustedDarwinAcl(fd, allowDenyOnly = false) {
   try {
-    const { dlopen, read: read3 } = __require("bun:ffi");
+    const { dlopen, read: read3, ptr } = __require("bun:ffi");
     const library = dlopen("/usr/lib/libSystem.B.dylib", {
       acl_get_fd: { args: ["i32"], returns: "ptr" },
       acl_free: { args: ["ptr"], returns: "i32" },
+      acl_valid: { args: ["ptr"], returns: "i32" },
+      acl_get_entry: { args: ["ptr", "i32", "ptr"], returns: "i32" },
+      acl_get_tag_type: { args: ["ptr", "ptr"], returns: "i32" },
       __error: { args: [], returns: "ptr" }
     });
     try {
@@ -42709,8 +42712,23 @@ function hasNoDarwinAcl(fd) {
         return false;
       const acl = library.symbols.acl_get_fd(fd);
       if (acl) {
-        library.symbols.acl_free(acl);
-        return false;
+        try {
+          if (!allowDenyOnly || library.symbols.acl_valid(acl) !== 0)
+            return false;
+          const entry = new BigUint64Array(1), tag = new Int32Array(1);
+          for (let count = 0;count <= 128; count++) {
+            const status = library.symbols.acl_get_entry(acl, count === 0 ? 0 : -1, ptr(entry));
+            if (status !== 0) {
+              return status === -1 && read3.i32(errno) === 22 && library.symbols.acl_valid(acl) === 0;
+            }
+            const value = read3.ptr(ptr(entry));
+            if (count === 128 || !value || library.symbols.acl_get_tag_type(value, ptr(tag)) !== 0 || tag[0] !== 2)
+              return false;
+          }
+          return false;
+        } finally {
+          library.symbols.acl_free(acl);
+        }
       }
       return (acl === null || acl === 0) && read3.i32(errno) === 2;
     } finally {
@@ -42740,7 +42758,7 @@ function isSystemRootAlias(path) {
         throw new Error("Unprotected system temporary directory");
       const fd = openSync16(directory, constants12.O_RDONLY | constants12.O_DIRECTORY | constants12.O_NOFOLLOW);
       try {
-        if (identity4(fstatSync16(fd, { bigint: true })) !== identity4(stat2) || !hasNoDarwinAcl(fd) || identity4(fstatSync16(fd, { bigint: true })) !== identity4(stat2))
+        if (identity4(fstatSync16(fd, { bigint: true })) !== identity4(stat2) || !hasTrustedDarwinAcl(fd) || identity4(fstatSync16(fd, { bigint: true })) !== identity4(stat2))
           throw new Error("Unverified system alias directory ACL");
       } finally {
         closeSync16(fd);
@@ -43388,6 +43406,171 @@ function planAgentIntegration(options) {
   recheckRootAliases(aliases);
   return { dataDir: dataDir2, profileId, changes, nativeSkills, ...observedNativeSources.length ? { observedNativeSources } : {}, ...nextPolicy.bridge.codexPluginSkillReview ? { codexPluginSkillReview: nextPolicy.bridge.codexPluginSkillReview } : {}, observedPolicy: { path: policyPath, before: previousPolicy }, discoveryBefore: discoveries, discoveryAfter, ...aliases.length ? { rootAliases: aliases } : {}, ...retainedAgents.length ? { retainedReviewChecks: { home, projectDir: options.projectDir ?? home, agents: retainedAgents } } : {} };
 }
+function hookProjectionRefusal(reason) {
+  throw new Error(`CLAUDE_MANAGED_HOOK_${reason}`);
+}
+function projectedHookAcl(path, observed) {
+  if (process.platform !== "darwin")
+    return;
+  const identity4 = (stat2) => `${stat2.dev}:${stat2.ino}:${stat2.ctimeNs}:${stat2.uid}:${stat2.mode}:${stat2.nlink}:${stat2.size}:${stat2.mtimeNs}`;
+  const fd = openSync16(path, constants12.O_RDONLY | constants12.O_NOFOLLOW | constants12.O_NONBLOCK | (observed.isDirectory() ? constants12.O_DIRECTORY : 0));
+  try {
+    if (identity4(fstatSync16(fd, { bigint: true })) !== identity4(observed) || !hasTrustedDarwinAcl(fd, true) || identity4(fstatSync16(fd, { bigint: true })) !== identity4(observed) || identity4(lstatSync20(path, { bigint: true })) !== identity4(observed))
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+  } finally {
+    closeSync16(fd);
+  }
+}
+function projectedHookExecutable(command, expectedResolved) {
+  try {
+    if (!isAbsolute17(command) || /[\0\r\n]/.test(command) || resolve16(command) !== command)
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    command = canonicalSystemPath(command);
+    const parents3 = (file = command) => {
+      const result = [];
+      for (let path = dirname15(file);; path = dirname15(path)) {
+        const stat2 = lstatSync20(path, { bigint: true });
+        if (!stat2.isDirectory() || (stat2.mode & 0o022n) !== 0n && !(stat2.uid === 0n && (stat2.mode & 0o1000n) !== 0n))
+          hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+        projectedHookAcl(path, stat2);
+        result.push(`${path}:${stat2.dev}:${stat2.ino}:${stat2.uid}:${stat2.mode}`);
+        if (dirname15(path) === path)
+          break;
+      }
+      return result;
+    };
+    const parentIdentity = parents3(), link = lstatSync20(command, { bigint: true });
+    if (link.uid !== BigInt(process.getuid()) || !link.isFile() && !link.isSymbolicLink())
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    const linkIdentity = (stat2) => `${stat2.dev}:${stat2.ino}:${stat2.mode}:${stat2.uid}:${stat2.ctimeNs}`;
+    const resolved = realpathSync8(command);
+    if (expectedResolved !== undefined && resolved !== expectedResolved)
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    const resolvedParentIdentity = parents3(resolved);
+    const manifest = snapshot(join23(dirname15(dirname15(resolved)), "package.json"), false, { readOnlyPackage: true });
+    projectedHookAcl(manifest.file, manifest.stat);
+    const pkg = JSON.parse(manifest.text);
+    if (pkg.name !== "@hasna/skills" || !/^\d+\.\d+\.\d+$/.test(pkg.version) || pkg.bin?.skills !== "bin/index.js" || resolved !== join23(dirname15(manifest.file), "bin/index.js"))
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    const cli = snapshot(resolved, false, { readOnlyPackage: true });
+    projectedHookAcl(cli.file, cli.stat);
+    if ((cli.stat.mode & 0o100n) === 0n)
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    const recheck = () => {
+      try {
+        if (realpathSync8(command) !== resolved || linkIdentity(lstatSync20(command, { bigint: true })) !== linkIdentity(link) || !isDeepStrictEqual6(parents3(), parentIdentity) || !isDeepStrictEqual6(parents3(resolved), resolvedParentIdentity))
+          hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+        projectedHookAcl(cli.file, cli.stat);
+        projectedHookAcl(manifest.file, manifest.stat);
+        unchanged2(cli);
+        unchanged2(manifest);
+      } catch {
+        hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+      }
+    };
+    recheck();
+    return { resolved, sha256: cli.sha256, manifestSha256: manifest.sha256, recheck };
+  } catch {
+    hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+  }
+}
+function planClaudeManagedHookProjection(options) {
+  if (typeof options.targetSettings !== "string" || Buffer.byteLength(options.targetSettings) > 1024 * 1024)
+    hookProjectionRefusal("TARGET_INVALID");
+  const targetSha256 = sha4(options.targetSettings);
+  if (!/^[a-f0-9]{64}$/.test(options.expectedTargetSha256) || options.expectedTargetSha256 !== targetSha256)
+    hookProjectionRefusal("TARGET_CHANGED");
+  let target;
+  try {
+    target = jsonObject(options.targetSettings, "target");
+  } catch {
+    hookProjectionRefusal("TARGET_INVALID");
+  }
+  const home = resolve16(options.home ?? homedir3()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
+  const policyPath = join23(dataDir2, "agent-policy.json");
+  let policyBytes, settingsBytes, settingsPath, command, profile;
+  try {
+    policyBytes = readNativeBytes(policyPath, 1024 * 1024);
+    const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
+    if (!snapshot2 || snapshot2.text !== policyBytes.toString("utf8"))
+      hookProjectionRefusal("SOURCE_UNVERIFIED");
+    const binding = snapshot2.value.bridge;
+    settingsPath = canonicalAgentPath(join23(home, AGENT_ADAPTERS.claude.config), binding?.rootAliases ?? []);
+    settingsBytes = readNativeBytes(settingsPath, 1024 * 1024);
+    command = binding?.commands?.claude;
+    profile = binding?.profiles?.claude;
+    if (typeof command !== "string" || typeof profile !== "string")
+      hookProjectionRefusal("SOURCE_UNVERIFIED");
+    assertManagedAgentBridge("claude", { home, dataDir: dataDir2, projectDir: options.projectDir, profileId: profile });
+  } catch {
+    hookProjectionRefusal("SOURCE_UNVERIFIED");
+  }
+  const executable = projectedHookExecutable(command);
+  const sourceSha256 = sha4(JSON.stringify({
+    home,
+    policyPath,
+    policy: sha4(policyBytes),
+    settingsPath,
+    settings: sha4(settingsBytes),
+    executable: { path: executable.resolved, sha256: executable.sha256, manifestSha256: executable.manifestSha256 }
+  }));
+  if (options.expectedSourceSha256 !== undefined && options.expectedSourceSha256 !== sourceSha256)
+    hookProjectionRefusal("SOURCE_CHANGED");
+  const replacements = [];
+  const observed = [executable];
+  if (target.hooks !== undefined) {
+    if (!target.hooks || typeof target.hooks !== "object" || Array.isArray(target.hooks))
+      hookProjectionRefusal("TARGET_INVALID");
+    for (const event of [...AGENT_ADAPTERS.claude.events, "PreToolUse"]) {
+      const groups = target.hooks[event];
+      if (groups === undefined)
+        continue;
+      if (!Array.isArray(groups))
+        hookProjectionRefusal("TARGET_INVALID");
+      let recognized = 0;
+      for (const [groupIndex, group] of groups.entries()) {
+        if (!group || !Array.isArray(group.hooks))
+          hookProjectionRefusal("TARGET_INVALID");
+        for (const [hookIndex, hook] of group.hooks.entries()) {
+          if (hook?.type !== "command" || typeof hook.command !== "string")
+            continue;
+          if (!hook.command.includes("hook user-prompt --agent claude"))
+            continue;
+          const match = /^('(?:[^']|'\\'')*') hook user-prompt --agent claude --selection-profile ([A-Za-z0-9][A-Za-z0-9._-]{0,127}) --event ([A-Za-z]+)$/.exec(hook.command);
+          if (!match || match[3] !== event)
+            hookProjectionRefusal("UNRECOGNIZED");
+          const oldCommand = match[1].slice(1, -1).replaceAll("'\\''", "'");
+          let rendered;
+          try {
+            rendered = renderAgentHookCommand(oldCommand, "claude", match[2], event);
+          } catch {
+            hookProjectionRefusal("UNRECOGNIZED");
+          }
+          if (rendered !== hook.command)
+            hookProjectionRefusal("UNRECOGNIZED");
+          const legacy = projectedHookExecutable(oldCommand, executable.resolved);
+          if (legacy.resolved !== executable.resolved || legacy.sha256 !== executable.sha256 || legacy.manifestSha256 !== executable.manifestSha256)
+            hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+          observed.push(legacy);
+          if (++recognized > 1)
+            hookProjectionRefusal("AMBIGUOUS");
+          const replacement = renderAgentHookCommand(command, "claude", profile, event);
+          if (replacement !== hook.command)
+            replacements.push({ event, groupIndex, hookIndex, beforeSha256: sha4(hook.command), command: replacement });
+        }
+      }
+    }
+  }
+  try {
+    if (!readNativeBytes(policyPath, 1024 * 1024).equals(policyBytes) || !readNativeBytes(settingsPath, 1024 * 1024).equals(settingsBytes))
+      hookProjectionRefusal("SOURCE_CHANGED");
+  } catch {
+    hookProjectionRefusal("SOURCE_CHANGED");
+  }
+  for (const item of observed)
+    item.recheck();
+  return { schema: "hasna.claude-managed-hook-projection.v1", targetSha256, sourceSha256, replacements };
+}
 function planClaudeStopHookUpdate(options) {
   return planClaudeHookEventsUpdate({ ...options, events: ["Stop"] });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.34",
+  "version": "0.10.35",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {