@hasna/skills 0.10.34 → 0.10.36

package/dist/lib/agent-integration.d.ts

@@ -133,6 +133,33 @@ export declare function planAgentIntegration(options: {
     reviewedCacheAlias?: string;
     codexNativeCatalog?: CodexNativeSkillCatalog;
 }): AgentIntegrationPlan;
+export interface ClaudeManagedHookProjection {
+    schema: "hasna.claude-managed-hook-projection.v1";
+    targetSha256: string;
+    sourceSha256: string;
+    replacements: Array<{
+        event: string;
+        groupIndex: number;
+        hookIndex: number;
+        beforeSha256: string;
+        command: string;
+    }>;
+}
+export interface ClaudeManagedHookProjectionOptions {
+    home?: string;
+    dataDir?: string;
+    projectDir?: string;
+    /** Exact caller-owned bytes, never a new native home or a path to be written. */
+    targetSettings: string;
+    expectedTargetSha256: string;
+    /** Supply the preceding plan's source witness when checking it before use. */
+    expectedSourceSha256?: string;
+}
+/** Read-only projection for a copied Claude configuration. This does not install
+ * hooks, adopt target discovery, change policy, or confer write/admission authority.
+ * The caller must preserve the full target, hold its owning writer lease, replan
+ * against both witnesses, CAS the full bytes and revalidate after application. */
+export declare function planClaudeManagedHookProjection(options: ClaudeManagedHookProjectionOptions): ClaudeManagedHookProjection;
 /** Plan an explicitly authorized Stop hook replacement without adopting drift.
  * The caller owns authorization of its exact Stop hook delta; Skills refuses
  * every other settings change and owns discovery witnesses and guarded writes.

package/dist/lib/codex-plugin-skill-controls.d.ts

@@ -28,7 +28,7 @@ export interface CodexPluginSourceInput {
 type Read = (path: string) => string;
 /** Capability controls remain bound even after every native Skill body disappears. */
 export declare function reviewedCodexPluginCapabilitiesUnchanged(cache: string, controls: CodexPluginSkillControl[], read: Read): boolean;
-export declare function reviewCodexPluginControls(catalog: CodexNativeSkillCatalog, documents: string[], cache: string, cwd: string, read: Read, rules: unknown, pluginSettings?: unknown): {
+export declare function reviewCodexPluginControls(catalog: CodexNativeSkillCatalog, documents: string[], cache: string, cwd: string, read: Read, rules: unknown, pluginSettings?: unknown, plannedRules?: unknown): {
     skills: CodexPluginSkillControl[];
     inactivePlugins: CodexInactivePluginControl[];
     sourceInputs: CodexPluginSourceInput[];

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.34",
+  version: "0.10.36",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -38659,7 +38659,7 @@ function reviewedCodexPluginCapabilitiesUnchanged(cache, controls, read) {
     return false;
   }
 }
-function reviewCodexPluginControls(catalog, documents, cache, cwd, read, rules, pluginSettings) {
+function reviewCodexPluginControls(catalog, documents, cache, cwd, read, rules, pluginSettings, plannedRules) {
   if (!supportsCodexNativeCapability(catalog?.version, "qualified-skill-catalog") || catalog.cwd !== cwd)
     refuse3();
   const skills = projectCodexNativeSkillCatalog({ data: [{ cwd, errors: [], skills: catalog.skills }] }, cwd);
@@ -38730,7 +38730,9 @@ function reviewCodexPluginControls(catalog, documents, cache, cwd, read, rules,
         remotePluginId = plugin.remotePluginId;
       }
       const exactPathDeny = Array.isArray(rules) && rules.some((rule) => rule?.path === document && rule?.enabled === false);
-      if (!exactPathDeny || !isCodexNativeSkillDisabled({ name: parsed.name, path: document, pluginId: expectedPluginId, enabled: true }, rules))
+      const nativeSkill = { name: parsed.name, path: document, pluginId: expectedPluginId, enabled: true };
+      const plannedPathDeny = catalog.version === "codex-cli 0.160.0" && remotePluginId !== undefined && Array.isArray(rules) && rules.some((rule) => typeof rule?.name === "string" && rule.name.trim() === parsed.name && rule.enabled === false) && !rules.some((rule) => (rule?.path === document || typeof rule?.name === "string" && rule.name.trim() === parsed.name) && rule.enabled !== false) && Array.isArray(plannedRules) && plannedRules.some((rule) => rule?.path === document && rule.enabled === false) && isCodexNativeSkillDisabled(nativeSkill, plannedRules);
+      if (!exactPathDeny && !plannedPathDeny || !isCodexNativeSkillDisabled(nativeSkill, rules))
         refuse3();
     }
     result.push({ ...parsed, pluginId: expectedPluginId, ...remotePluginId ? { remotePluginId } : {} });
@@ -42695,12 +42697,15 @@ function disableCodexBundledSkills(text2) {
 // src/lib/agent-integration.ts
 var sha4 = (data) => createHash18("sha256").update(data).digest("hex");
 var ROOTS = NATIVE_SKILL_ROOTS;
-function hasNoDarwinAcl(fd) {
+function hasTrustedDarwinAcl(fd, allowDenyOnly = false) {
   try {
-    const { dlopen, read: read3 } = __require("bun:ffi");
+    const { dlopen, read: read3, ptr } = __require("bun:ffi");
     const library = dlopen("/usr/lib/libSystem.B.dylib", {
       acl_get_fd: { args: ["i32"], returns: "ptr" },
       acl_free: { args: ["ptr"], returns: "i32" },
+      acl_valid: { args: ["ptr"], returns: "i32" },
+      acl_get_entry: { args: ["ptr", "i32", "ptr"], returns: "i32" },
+      acl_get_tag_type: { args: ["ptr", "ptr"], returns: "i32" },
       __error: { args: [], returns: "ptr" }
     });
     try {
@@ -42709,8 +42714,23 @@ function hasNoDarwinAcl(fd) {
         return false;
       const acl = library.symbols.acl_get_fd(fd);
       if (acl) {
-        library.symbols.acl_free(acl);
-        return false;
+        try {
+          if (!allowDenyOnly || library.symbols.acl_valid(acl) !== 0)
+            return false;
+          const entry = new BigUint64Array(1), tag = new Int32Array(1);
+          for (let count = 0;count <= 128; count++) {
+            const status = library.symbols.acl_get_entry(acl, count === 0 ? 0 : -1, ptr(entry));
+            if (status !== 0) {
+              return status === -1 && read3.i32(errno) === 22 && library.symbols.acl_valid(acl) === 0;
+            }
+            const value = read3.ptr(ptr(entry));
+            if (count === 128 || !value || library.symbols.acl_get_tag_type(value, ptr(tag)) !== 0 || tag[0] !== 2)
+              return false;
+          }
+          return false;
+        } finally {
+          library.symbols.acl_free(acl);
+        }
       }
       return (acl === null || acl === 0) && read3.i32(errno) === 2;
     } finally {
@@ -42740,7 +42760,7 @@ function isSystemRootAlias(path) {
         throw new Error("Unprotected system temporary directory");
       const fd = openSync16(directory, constants12.O_RDONLY | constants12.O_DIRECTORY | constants12.O_NOFOLLOW);
       try {
-        if (identity4(fstatSync16(fd, { bigint: true })) !== identity4(stat2) || !hasNoDarwinAcl(fd) || identity4(fstatSync16(fd, { bigint: true })) !== identity4(stat2))
+        if (identity4(fstatSync16(fd, { bigint: true })) !== identity4(stat2) || !hasTrustedDarwinAcl(fd) || identity4(fstatSync16(fd, { bigint: true })) !== identity4(stat2))
           throw new Error("Unverified system alias directory ACL");
       } finally {
         closeSync16(fd);
@@ -43269,15 +43289,21 @@ function planAgentIntegration(options) {
     }
     return resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, retainedReview, canonical: (path) => canonicalAgentPath(path, aliases) });
   });
-  const codexConfig = options.agents.includes("codex") ? Bun.TOML.parse(readOptional(canonicalAgentPath(join23(home, ".codex", "config.toml"), aliases)) ?? "") : {};
+  const codexConfigBefore = options.agents.includes("codex") ? readOptional(canonicalAgentPath(join23(home, ".codex", "config.toml"), aliases)) : null;
+  const codexConfig = Bun.TOML.parse(codexConfigBefore ?? "");
   const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases, reviewedCacheAlias: options.reviewedCacheAlias, disabledVendorPaths: disabledCodexSkillPaths(codexConfig, aliases) });
+  const codexPathConfig = options.agents.includes("codex") ? disableCodexSkills(codexConfigBefore ?? "", nativeSkills, aliases, canonicalAgentPath(join23(home, ".codex/skills", CLI_BRIDGE_NAME), aliases)) : undefined;
+  const plannedCodexRules = codexPathConfig === undefined ? undefined : Bun.TOML.parse(codexPathConfig).skills?.config ?? [];
   const observedNativeSources = [];
   const codexPluginControls = options.codexNativeCatalog ? reviewCodexPluginControls(options.codexNativeCatalog, nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor).map((entry) => join23(entry.path, "SKILL.md")), canonicalAgentPath(join23(home, ".codex/plugins/cache"), aliases), resolve16(options.projectDir ?? home), (path) => {
     const bytes = readNativeBytes(path, 1024 * 1024);
     observedNativeSources.push({ path, sha256: sha4(bytes) });
     return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-  }, codexConfig.skills?.config ?? [], codexConfig.plugins) : { skills: policy.bridge?.codexPluginSkills ?? [], inactivePlugins: policy.bridge?.codexInactivePlugins ?? [], sourceInputs: policy.bridge?.discovery?.codex?.codexInstallationInputs?.plugins ?? [] };
+  }, codexConfig.skills?.config ?? [], codexConfig.plugins, plannedCodexRules) : { skills: policy.bridge?.codexPluginSkills ?? [], inactivePlugins: policy.bridge?.codexInactivePlugins ?? [], sourceInputs: policy.bridge?.discovery?.codex?.codexInstallationInputs?.plugins ?? [] };
   const codexPluginSkills = codexPluginControls.skills;
+  if (options.agents.includes("codex") && !options.codexNativeCatalog && codexPluginSkills.length && !reviewedCodexPluginCapabilitiesUnchanged(canonicalAgentPath(join23(home, ".codex/plugins/cache"), aliases), codexPluginSkills, (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024)))) {
+    throw new Error("NATIVE_SKILL_DRIFT: reviewed native plugin capability controls changed; provide a fresh native catalog and discovery review");
+  }
   const codexInactivePlugins = codexPluginControls.inactivePlugins;
   const codexDiscovery = discoveries.find((binding) => binding.agent === "codex");
   const codexPluginSourceInputs = codexPluginControls.sourceInputs.filter((input) => codexDiscovery?.method === "reviewed" && codexDiscovery.roots.some((root2) => root2 === input.sourceRoot || root2.startsWith(input.sourceRoot + sep5) || input.sourceRoot.startsWith(root2 + sep5)) && codexDiscovery.sources.some((source) => source.path === join23(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined));
@@ -43352,7 +43378,9 @@ function planAgentIntegration(options) {
       changes.push({ path, before, after });
     if (agent === "codex") {
       const configPath = canonicalAgentPath(join23(home, ".codex", "config.toml"), aliases), previous = readOptional(configPath);
-      const next = disableReviewedCodexPluginNames(disableCodexSkills(previous ?? "", nativeSkills, aliases, bridgePath), codexPluginSkills);
+      if (previous !== codexConfigBefore)
+        throw new Error(`Configuration changed during planning: ${configPath}`);
+      const next = disableReviewedCodexPluginNames(codexPathConfig, codexPluginSkills);
       if (next !== (previous ?? ""))
         changes.push({ path: configPath, before: previous, after: next });
     }
@@ -43388,6 +43416,171 @@ function planAgentIntegration(options) {
   recheckRootAliases(aliases);
   return { dataDir: dataDir2, profileId, changes, nativeSkills, ...observedNativeSources.length ? { observedNativeSources } : {}, ...nextPolicy.bridge.codexPluginSkillReview ? { codexPluginSkillReview: nextPolicy.bridge.codexPluginSkillReview } : {}, observedPolicy: { path: policyPath, before: previousPolicy }, discoveryBefore: discoveries, discoveryAfter, ...aliases.length ? { rootAliases: aliases } : {}, ...retainedAgents.length ? { retainedReviewChecks: { home, projectDir: options.projectDir ?? home, agents: retainedAgents } } : {} };
 }
+function hookProjectionRefusal(reason) {
+  throw new Error(`CLAUDE_MANAGED_HOOK_${reason}`);
+}
+function projectedHookAcl(path, observed) {
+  if (process.platform !== "darwin")
+    return;
+  const identity4 = (stat2) => `${stat2.dev}:${stat2.ino}:${stat2.ctimeNs}:${stat2.uid}:${stat2.mode}:${stat2.nlink}:${stat2.size}:${stat2.mtimeNs}`;
+  const fd = openSync16(path, constants12.O_RDONLY | constants12.O_NOFOLLOW | constants12.O_NONBLOCK | (observed.isDirectory() ? constants12.O_DIRECTORY : 0));
+  try {
+    if (identity4(fstatSync16(fd, { bigint: true })) !== identity4(observed) || !hasTrustedDarwinAcl(fd, true) || identity4(fstatSync16(fd, { bigint: true })) !== identity4(observed) || identity4(lstatSync20(path, { bigint: true })) !== identity4(observed))
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+  } finally {
+    closeSync16(fd);
+  }
+}
+function projectedHookExecutable(command, expectedResolved) {
+  try {
+    if (!isAbsolute17(command) || /[\0\r\n]/.test(command) || resolve16(command) !== command)
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    command = canonicalSystemPath(command);
+    const parents3 = (file = command) => {
+      const result = [];
+      for (let path = dirname15(file);; path = dirname15(path)) {
+        const stat2 = lstatSync20(path, { bigint: true });
+        if (!stat2.isDirectory() || (stat2.mode & 0o022n) !== 0n && !(stat2.uid === 0n && (stat2.mode & 0o1000n) !== 0n))
+          hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+        projectedHookAcl(path, stat2);
+        result.push(`${path}:${stat2.dev}:${stat2.ino}:${stat2.uid}:${stat2.mode}`);
+        if (dirname15(path) === path)
+          break;
+      }
+      return result;
+    };
+    const parentIdentity = parents3(), link = lstatSync20(command, { bigint: true });
+    if (link.uid !== BigInt(process.getuid()) || !link.isFile() && !link.isSymbolicLink())
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    const linkIdentity = (stat2) => `${stat2.dev}:${stat2.ino}:${stat2.mode}:${stat2.uid}:${stat2.ctimeNs}`;
+    const resolved = realpathSync8(command);
+    if (expectedResolved !== undefined && resolved !== expectedResolved)
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    const resolvedParentIdentity = parents3(resolved);
+    const manifest = snapshot(join23(dirname15(dirname15(resolved)), "package.json"), false, { readOnlyPackage: true });
+    projectedHookAcl(manifest.file, manifest.stat);
+    const pkg = JSON.parse(manifest.text);
+    if (pkg.name !== "@hasna/skills" || !/^\d+\.\d+\.\d+$/.test(pkg.version) || pkg.bin?.skills !== "bin/index.js" || resolved !== join23(dirname15(manifest.file), "bin/index.js"))
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    const cli = snapshot(resolved, false, { readOnlyPackage: true });
+    projectedHookAcl(cli.file, cli.stat);
+    if ((cli.stat.mode & 0o100n) === 0n)
+      hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+    const recheck = () => {
+      try {
+        if (realpathSync8(command) !== resolved || linkIdentity(lstatSync20(command, { bigint: true })) !== linkIdentity(link) || !isDeepStrictEqual6(parents3(), parentIdentity) || !isDeepStrictEqual6(parents3(resolved), resolvedParentIdentity))
+          hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+        projectedHookAcl(cli.file, cli.stat);
+        projectedHookAcl(manifest.file, manifest.stat);
+        unchanged2(cli);
+        unchanged2(manifest);
+      } catch {
+        hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+      }
+    };
+    recheck();
+    return { resolved, sha256: cli.sha256, manifestSha256: manifest.sha256, recheck };
+  } catch {
+    hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+  }
+}
+function planClaudeManagedHookProjection(options) {
+  if (typeof options.targetSettings !== "string" || Buffer.byteLength(options.targetSettings) > 1024 * 1024)
+    hookProjectionRefusal("TARGET_INVALID");
+  const targetSha256 = sha4(options.targetSettings);
+  if (!/^[a-f0-9]{64}$/.test(options.expectedTargetSha256) || options.expectedTargetSha256 !== targetSha256)
+    hookProjectionRefusal("TARGET_CHANGED");
+  let target;
+  try {
+    target = jsonObject(options.targetSettings, "target");
+  } catch {
+    hookProjectionRefusal("TARGET_INVALID");
+  }
+  const home = resolve16(options.home ?? homedir3()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
+  const policyPath = join23(dataDir2, "agent-policy.json");
+  let policyBytes, settingsBytes, settingsPath, command, profile;
+  try {
+    policyBytes = readNativeBytes(policyPath, 1024 * 1024);
+    const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
+    if (!snapshot2 || snapshot2.text !== policyBytes.toString("utf8"))
+      hookProjectionRefusal("SOURCE_UNVERIFIED");
+    const binding = snapshot2.value.bridge;
+    settingsPath = canonicalAgentPath(join23(home, AGENT_ADAPTERS.claude.config), binding?.rootAliases ?? []);
+    settingsBytes = readNativeBytes(settingsPath, 1024 * 1024);
+    command = binding?.commands?.claude;
+    profile = binding?.profiles?.claude;
+    if (typeof command !== "string" || typeof profile !== "string")
+      hookProjectionRefusal("SOURCE_UNVERIFIED");
+    assertManagedAgentBridge("claude", { home, dataDir: dataDir2, projectDir: options.projectDir, profileId: profile });
+  } catch {
+    hookProjectionRefusal("SOURCE_UNVERIFIED");
+  }
+  const executable = projectedHookExecutable(command);
+  const sourceSha256 = sha4(JSON.stringify({
+    home,
+    policyPath,
+    policy: sha4(policyBytes),
+    settingsPath,
+    settings: sha4(settingsBytes),
+    executable: { path: executable.resolved, sha256: executable.sha256, manifestSha256: executable.manifestSha256 }
+  }));
+  if (options.expectedSourceSha256 !== undefined && options.expectedSourceSha256 !== sourceSha256)
+    hookProjectionRefusal("SOURCE_CHANGED");
+  const replacements = [];
+  const observed = [executable];
+  if (target.hooks !== undefined) {
+    if (!target.hooks || typeof target.hooks !== "object" || Array.isArray(target.hooks))
+      hookProjectionRefusal("TARGET_INVALID");
+    for (const event of [...AGENT_ADAPTERS.claude.events, "PreToolUse"]) {
+      const groups = target.hooks[event];
+      if (groups === undefined)
+        continue;
+      if (!Array.isArray(groups))
+        hookProjectionRefusal("TARGET_INVALID");
+      let recognized = 0;
+      for (const [groupIndex, group] of groups.entries()) {
+        if (!group || !Array.isArray(group.hooks))
+          hookProjectionRefusal("TARGET_INVALID");
+        for (const [hookIndex, hook] of group.hooks.entries()) {
+          if (hook?.type !== "command" || typeof hook.command !== "string")
+            continue;
+          if (!hook.command.includes("hook user-prompt --agent claude"))
+            continue;
+          const match = /^('(?:[^']|'\\'')*') hook user-prompt --agent claude --selection-profile ([A-Za-z0-9][A-Za-z0-9._-]{0,127}) --event ([A-Za-z]+)$/.exec(hook.command);
+          if (!match || match[3] !== event)
+            hookProjectionRefusal("UNRECOGNIZED");
+          const oldCommand = match[1].slice(1, -1).replaceAll("'\\''", "'");
+          let rendered;
+          try {
+            rendered = renderAgentHookCommand(oldCommand, "claude", match[2], event);
+          } catch {
+            hookProjectionRefusal("UNRECOGNIZED");
+          }
+          if (rendered !== hook.command)
+            hookProjectionRefusal("UNRECOGNIZED");
+          const legacy = projectedHookExecutable(oldCommand, executable.resolved);
+          if (legacy.resolved !== executable.resolved || legacy.sha256 !== executable.sha256 || legacy.manifestSha256 !== executable.manifestSha256)
+            hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
+          observed.push(legacy);
+          if (++recognized > 1)
+            hookProjectionRefusal("AMBIGUOUS");
+          const replacement = renderAgentHookCommand(command, "claude", profile, event);
+          if (replacement !== hook.command)
+            replacements.push({ event, groupIndex, hookIndex, beforeSha256: sha4(hook.command), command: replacement });
+        }
+      }
+    }
+  }
+  try {
+    if (!readNativeBytes(policyPath, 1024 * 1024).equals(policyBytes) || !readNativeBytes(settingsPath, 1024 * 1024).equals(settingsBytes))
+      hookProjectionRefusal("SOURCE_CHANGED");
+  } catch {
+    hookProjectionRefusal("SOURCE_CHANGED");
+  }
+  for (const item of observed)
+    item.recheck();
+  return { schema: "hasna.claude-managed-hook-projection.v1", targetSha256, sourceSha256, replacements };
+}
 function planClaudeStopHookUpdate(options) {
   return planClaudeHookEventsUpdate({ ...options, events: ["Stop"] });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.34",
+  "version": "0.10.36",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {