@hasna/skills 0.10.39 → 0.10.42

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.39",
+    version: "0.10.42",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -38343,8 +38343,8 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
-      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3")
+        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3", "codex-settings-v4"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4"))
         requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve2(source.path) === source.path && basename3(source.path) === "config.toml");
       if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve2(source.path) === source.path && basename3(source.path) === "settings.json");
@@ -48163,6 +48163,7 @@ var init_codex_mcp_discovery_projection = () => {};
 
 // src/lib/codex-settings-witness.ts
 import { createHash as createHash10 } from "crypto";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 function need4(value) {
   if (!value)
     throw new Error("Invalid Codex settings witness");
@@ -48268,7 +48269,7 @@ function disablesOneSkill(entry) {
   return selector.length === 1 && typeof entry[selector[0]] === "string" && entry[selector[0]].length > 0;
 }
 function inference(target, version2) {
-  const keys = version2 === 3 ? [...INFERENCE, "service_tier", "plan_mode_reasoning_effort", "personality"] : INFERENCE;
+  const keys = version2 >= 3 ? [...INFERENCE, "service_tier", "plan_mode_reasoning_effort", "personality"] : INFERENCE;
   for (const key of keys)
     if (Object.hasOwn(target, key)) {
       const value = target[key];
@@ -48276,7 +48277,7 @@ function inference(target, version2) {
         need4(typeof value === "string" && MODEL.test(value));
       else if (key === "personality")
         need4(typeof value === "string" && ["none", "friendly", "pragmatic"].includes(value));
-      else if (version2 === 3 && key !== "model_verbosity") {
+      else if (version2 >= 3 && key !== "model_verbosity") {
         need4(typeof value === "string" && value.length <= 128 && !/[\x00-\x1f\x7f]/.test(value));
         if (key !== "service_tier")
           need4(value.length > 0);
@@ -48285,6 +48286,115 @@ function inference(target, version2) {
       delete target[key];
     }
 }
+function projectModelAvailabilityNux(config2, text2) {
+  const tui = config2.tui, counts = isRecord3(tui) ? tui.model_availability_nux : undefined;
+  if (isRecord3(tui) && !Object.keys(tui).length) {
+    delete config2.tui;
+    return { config: config2, numericSource: text2 };
+  }
+  if (!isRecord3(counts) || Object.keys(counts).length > 256 || !Object.values(counts).every((value) => typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 4294967295))
+    return { config: config2, numericSource: text2 };
+  const expected = structuredClone(config2);
+  delete expected.tui.model_availability_nux;
+  const stripEmptyTui = (value) => {
+    if (isRecord3(value.tui) && !Object.keys(value.tui).length)
+      delete value.tui;
+  };
+  stripEmptyTui(expected);
+  const headers = [];
+  const spans = [];
+  const integer2 = /^(?:\+?(?:0|[1-9](?:_?\d)*)|0x[0-9a-fA-F](?:_?[0-9a-fA-F])*|0o[0-7](?:_?[0-7])*|0b[01](?:_?[01])*)$/;
+  const counterIntegers = (span) => {
+    let values = 0;
+    for (let at = 0;at < span.length; ) {
+      const char = span[at];
+      if (char === "#") {
+        while (at < span.length && span[at] !== `
+`)
+          at++;
+        continue;
+      }
+      if (char === '"' || char === "'") {
+        const quote = char;
+        at++;
+        while (at < span.length) {
+          if (quote === '"' && span[at] === "\\") {
+            at += 2;
+            continue;
+          }
+          if (span[at++] === quote)
+            break;
+        }
+        continue;
+      }
+      if (char !== "=") {
+        at++;
+        continue;
+      }
+      at++;
+      while (at < span.length && /\s/.test(span[at]))
+        at++;
+      if (span[at] === "{") {
+        at++;
+        continue;
+      }
+      const start = at;
+      while (at < span.length && !/[\s,\]{}#]/.test(span[at]))
+        at++;
+      if (!integer2.test(span.slice(start, at)))
+        return false;
+      values++;
+    }
+    return values === Object.keys(counts).length;
+  };
+  let attempts = 0;
+  const realPrefix = (end) => {
+    if (++attempts > 256)
+      return false;
+    try {
+      Bun.TOML.parse(text2.slice(0, end));
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  for (const match of text2.matchAll(/^[ \t]*\[[^\r\n]+\][ \t]*(?:#[^\r\n]*)?(?:\r?\n|$)/gm)) {
+    const start = match.index, end = start + match[0].length;
+    if (realPrefix(end))
+      headers.push({ start, end });
+  }
+  for (let at = 0;at < headers.length; at++) {
+    const header = headers[at];
+    let parsed;
+    try {
+      parsed = Bun.TOML.parse(text2.slice(header.start, header.end));
+    } catch {
+      continue;
+    }
+    if (isRecord3(parsed.tui) && isRecord3(parsed.tui.model_availability_nux) && !Object.keys(parsed.tui.model_availability_nux).length && Object.keys(parsed).length === 1 && Object.keys(parsed.tui).length === 1)
+      spans.push({ start: header.start, end: headers[at + 1]?.start ?? text2.length });
+  }
+  for (const match of text2.matchAll(/^[ \t]*(?:(?:tui|"tui"|'tui')[ \t]*\.[ \t]*)?(?:model_availability_nux|"model_availability_nux"|'model_availability_nux')[ \t]*=[ \t]*\{[^\r\n]*(?:\r?\n|$)/gm)) {
+    const start = match.index, end = start + match[0].length;
+    if (realPrefix(end))
+      spans.push({ start, end });
+  }
+  for (const { start, end } of spans) {
+    if (!counterIntegers(text2.slice(start, end)))
+      continue;
+    const remaining = text2.slice(0, start) + text2.slice(end);
+    let parsed;
+    try {
+      parsed = Bun.TOML.parse(remaining);
+    } catch {
+      continue;
+    }
+    stripEmptyTui(parsed);
+    if (isDeepStrictEqual3(parsed, expected))
+      return { config: expected, numericSource: remaining };
+  }
+  return { config: config2, numericSource: text2 };
+}
 function settingsDigest2(text2, version2 = 2) {
   let config2;
   try {
@@ -48293,7 +48403,8 @@ function settingsDigest2(text2, version2 = 2) {
     throw new Error("Invalid Codex settings witness");
   }
   need4(isRecord3(config2));
-  const projected = version2 === 3 ? projectRegularCodexMcp(config2, text2) : { config: config2, numericSource: text2 };
+  const mcp = version2 >= 3 ? projectRegularCodexMcp(config2, text2) : { config: config2, numericSource: text2 };
+  const projected = version2 === 4 ? projectModelAvailabilityNux(mcp.config, mcp.numericSource) : mcp;
   normalize2(projected.config, version2);
   return sha2(`hasna.skills.codex-settings.v${version2}\x00${JSON.stringify([canonical4(projected.config), numericTokens2(projected.numericSource)])}`);
 }
@@ -48314,6 +48425,14 @@ function hashCodexSettingsReplacementV3(text2, budget = { remaining: 256 * 1024
 function captureCodexSettingsV3(path, budget = { remaining: 256 * 1024 * 1024 }) {
   return { path, hashMode: "codex-settings-v3", sha256: settingsDigest2(readNativeSettingsWitnessFile(path, budget, "config.toml"), 3) };
 }
+function hashCodexSettingsReplacementV4(text2, budget = { remaining: 256 * 1024 * 1024 }) {
+  need4(Buffer.byteLength(text2) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text2));
+  budget.remaining -= Buffer.byteLength(text2);
+  return settingsDigest2(text2, 4);
+}
+function captureCodexSettingsV4(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "codex-settings-v4", sha256: settingsDigest2(readNativeSettingsWitnessFile(path, budget, "config.toml"), 4) };
+}
 var sha2 = (text2) => createHash10("sha256").update(text2).digest("hex"), EFFORT2, VERBOSITY2, MODEL, CODEX_DISCOVERY_PROJECTION_FIELDS, INFERENCE;
 var init_codex_settings_witness = __esm(() => {
   init_codex_settings_witness_v1();
@@ -50114,7 +50233,7 @@ var init_codex_hook_discovery_recovery = __esm(() => {
 import { createHash as createHash16 } from "crypto";
 import { lstatSync as lstatSync18, readFileSync as readFileSync15, readdirSync as readdirSync7, realpathSync as realpathSync5 } from "fs";
 import { basename as basename8, dirname as dirname15, isAbsolute as isAbsolute13, join as join25, resolve as resolve15, sep as sep5 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
 function parseConfig(text2, path, toml = false) {
   try {
     const value = toml ? Bun.TOML.parse(text2) : JSON.parse(text2);
@@ -50153,19 +50272,19 @@ function projectNativeDiscoveryFields(text2, format, fields2, path) {
   return digest(JSON.stringify(Object.fromEntries(fields2.map((field2) => [field2, object7[field2] ?? null]))));
 }
 function isSupersededCodexProjection(agent, configPath, source) {
-  return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual3(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
+  return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual4(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
 }
 function supersedesCodexProjection(sources, configPath) {
-  return sources.some((source) => source.path === configPath && (source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"));
+  return sources.some((source) => source.path === configPath && (source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")));
 }
 function projected(source, changes, budget = discoveryByteBudget()) {
-  if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3") {
+  if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")) {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Codex settings witnesses require exact typed metadata");
-    const current = (source.hashMode === "codex-settings-v3" ? captureCodexSettingsV3 : source.hashMode === "codex-settings-v2" ? captureCodexSettingsV2 : captureCodexSettings)(source.path, budget).sha256;
+    const current = (source.hashMode === "codex-settings-v4" ? captureCodexSettingsV4 : source.hashMode === "codex-settings-v3" ? captureCodexSettingsV3 : source.hashMode === "codex-settings-v2" ? captureCodexSettingsV2 : captureCodexSettings)(source.path, budget).sha256;
     if (current !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
-    return changes?.has(source.path) ? (source.hashMode === "codex-settings-v3" ? hashCodexSettingsReplacementV3 : source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget) : current;
+    return changes?.has(source.path) ? (source.hashMode === "codex-settings-v4" ? hashCodexSettingsReplacementV4 : source.hashMode === "codex-settings-v3" ? hashCodexSettingsReplacementV3 : source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget) : current;
   }
   if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
@@ -50321,7 +50440,7 @@ function verifyAgentDiscovery(binding, codexRecovery) {
         if (omitted.some((root) => !retiredRoots.includes(root)))
           throw new Error("Missing reviewed directory membership inventory; provide a fresh discovery review");
         const current = captureDiscoveryDirectoryProjection(ordinary.map((item) => item.path), retiredRoots).map(({ entries, ...item }) => item);
-        if (!isDeepStrictEqual3(current, projection))
+        if (!isDeepStrictEqual4(current, projection))
           throw new Error("Native discovery directory membership changed outside retired Codex roots");
       }
     } else
@@ -50380,7 +50499,7 @@ function codexInstallationRoots(binding) {
   });
 }
 function assertMarketplaceBinding(binding, source) {
-  if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3") && (binding.agent !== "codex" || binding.method !== "reviewed" || basename8(source.path) !== "config.toml"))
+  if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")) && (binding.agent !== "codex" || binding.method !== "reviewed" || basename8(source.path) !== "config.toml"))
     throw new Error("Codex settings witnesses require explicit reviewed Codex configuration");
   if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename8(source.path) !== "settings.json"))
     throw new Error("Claude settings witnesses require explicit reviewed Claude configuration");
@@ -50501,10 +50620,10 @@ function resolveAgentDiscovery(options) {
     verifyAgentDiscovery(retained);
     if (!retained.sources.some((source) => source.path === canonical6(configPath) && source.format === undefined && source.fields === undefined))
       unresolved("retained review is missing the full agent configuration source");
-    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"))) && source.path !== canonical6(configPath)))
+    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")))) && source.path !== canonical6(configPath)))
       unresolved("retained settings witness names another configuration source");
     const covered = supersedesCodexProjection(retained.sources, canonical6(configPath)) ? sources.filter((source) => !isSupersededCodexProjection(agent, canonical6(configPath), source)) : sources;
-    if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual3(saved, source))) || [...roots].some((root) => !retained.roots.includes(root)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
+    if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual4(saved, source))) || [...roots].some((root) => !retained.roots.includes(root)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
       unresolved("retained review is missing current runtime discovery coverage");
     return retained;
   }
@@ -50518,7 +50637,7 @@ function resolveAgentDiscovery(options) {
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
-    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"))) && source.path !== canonical6(configPath)))
+    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")))) && source.path !== canonical6(configPath)))
       throw new Error("Semantic settings witnesses must name the configured Claude configuration source");
     if (!review.sources.some((source) => source.path === canonical6(configPath)))
       throw new Error("Discovery review must include the agent configuration source");
@@ -58865,7 +58984,7 @@ var init_execution_grants = __esm(() => {
 });
 
 // src/lib/execution-grant-client.ts
-import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
 function id(value) {
   if (!grantIdentifier(value))
     throw new Error("Invalid execution grant profile or revision identifier.");
@@ -58908,7 +59027,7 @@ async function resolveExecutionGrant(input2) {
   if (!grantRecord(value) || Object.keys(value).length !== 3 || !grantIdentifier(value.policyRevision) || !grantIdentifier(value.grantId) || !grantRecord(value.bindings)) {
     throw new SkillSelectionError("INVALID_EXECUTION_GRANT", "The Skills API returned an invalid execution grant.");
   }
-  if (!isDeepStrictEqual4(value.bindings.selection, snapshot2.selection) || !isDeepStrictEqual4(value.bindings.consumer, snapshot2.consumer)) {
+  if (!isDeepStrictEqual5(value.bindings.selection, snapshot2.selection) || !isDeepStrictEqual5(value.bindings.consumer, snapshot2.consumer)) {
     throw new SkillSelectionError("EXECUTION_GRANT_SCOPE_MISMATCH", "The Skills API returned a grant for a different selection or consumer.");
   }
   return value;

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.39",
+  version: "0.10.42",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.39",
+  version: "0.10.42",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -24125,7 +24125,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.39",
+  version: "0.10.42",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/cli/commands/reviewed-runtime-lock.d.ts

@@ -0,0 +1,17 @@
+type Row = Record<string, unknown>;
+export interface ReviewedRuntimeLockContext {
+    version: string;
+    archiveIntegrity: string;
+    packageManifest: Row;
+    registryOrigin: string;
+    minReleaseAge: number;
+    minReleaseAgeExclude: string[];
+    fetcher?: typeof fetch;
+    now?: number;
+}
+/** Validate the immutable install input without resolving any version ranges.
+ * npm ci subsequently verifies archive bytes and package/root range agreement;
+ * npm sbom forceActual validates the installed required closure, including optional peers.
+ */
+export declare function validateReviewedRuntimeLock(bytes: Uint8Array, sha256: string, context: ReviewedRuntimeLockContext): Promise<void>;
+export {};

package/dist/cli/commands/runtime-copyfile.d.ts

@@ -28,6 +28,8 @@ export declare function updateCopyfileRuntime(version: string, options?: {
     fetcher?: typeof fetch;
     minReleaseAge?: number;
     minReleaseAgeExclude?: string[];
+    reviewedLock?: string;
+    reviewedLockSha256?: string;
     onLauncherSwitched?: (path: string) => void;
 }): Promise<JsonObject>;
 export declare function rollbackCopyfileRuntime(receiptId: string, options?: {

package/dist/index.d.ts

@@ -71,5 +71,5 @@ export { captureManagedPluginRegistry, type ManagedPluginRegistrationWitness } f
 export type { RemoteCreditCheckoutOptions, RemoteCreditCheckout, RemoteCreditCheckoutErrorCode } from "./lib/remote-credit-checkout.js";
 export { assertPortableAuthoringPath, type PortableAuthoringPathOptions } from "./lib/authoring-path.js";
 export { CLAUDE_COORDINATED_HOOK_EVENTS, type ClaudeCoordinatedHookEvent } from "./lib/claude-settings-witness.js";
-export { captureCodexSettings, captureCodexSettingsV2, captureCodexSettingsV3, upgradeCodexSettingsWitness, upgradeCodexSettingsWitnessV3 } from "./lib/codex-settings-witness.js";
+export { captureCodexSettings, captureCodexSettingsV2, captureCodexSettingsV3, captureCodexSettingsV4, upgradeCodexSettingsWitness, upgradeCodexSettingsWitnessV3, upgradeCodexSettingsWitnessV4 } from "./lib/codex-settings-witness.js";
 export { projectCodexNativeSkillCatalog, projectCodexInstalledPlugins, projectCodexInstalledPluginEntries, captureCodexNativeSkillCatalog, isCodexNativeSkillDisabled, type CodexNativeSkillCatalog, type CodexNativeSkill, type CodexInstalledPlugin } from "./lib/codex-native-skill-catalog.js";