@hasna/skills 0.10.39 → 0.10.42

package/dist/index.js

@@ -9126,8 +9126,8 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
-      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3")
+        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3", "codex-settings-v4"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4"))
         requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute2(source.path) && resolve2(source.path) === source.path && basename2(source.path) === "config.toml");
       if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute2(source.path) && resolve2(source.path) === source.path && basename2(source.path) === "settings.json");
@@ -9166,7 +9166,7 @@ function assertAgentPolicyCollections(policy) {
 import { createHash as createHash20 } from "crypto";
 import { lstatSync as lstatSync23, readFileSync as readFileSync18, readdirSync as readdirSync10, realpathSync as realpathSync9 } from "fs";
 import { basename as basename10, dirname as dirname18, isAbsolute as isAbsolute17, join as join30, resolve as resolve17, sep as sep7 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual6 } from "util";
 
 // node_modules/yaml/dist/index.js
 var composer = require_composer();
@@ -11040,7 +11040,7 @@ function replaceSkillSession(expected, replacement, plan, options = {}, beforeCo
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.39",
+  version: "0.10.42",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -14340,6 +14340,7 @@ function projectRegularCodexMcp(config, source) {
 
 // src/lib/codex-settings-witness.ts
 import { createHash as createHash12 } from "crypto";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 var sha2 = (text2) => createHash12("sha256").update(text2).digest("hex");
 var EFFORT2 = new Set(["none", "minimal", "low", "medium", "high", "xhigh"]);
 var VERBOSITY2 = new Set(["low", "medium", "high"]);
@@ -14451,7 +14452,7 @@ function disablesOneSkill(entry) {
   return selector.length === 1 && typeof entry[selector[0]] === "string" && entry[selector[0]].length > 0;
 }
 function inference(target, version) {
-  const keys = version === 3 ? [...INFERENCE, "service_tier", "plan_mode_reasoning_effort", "personality"] : INFERENCE;
+  const keys = version >= 3 ? [...INFERENCE, "service_tier", "plan_mode_reasoning_effort", "personality"] : INFERENCE;
   for (const key of keys)
     if (Object.hasOwn(target, key)) {
       const value = target[key];
@@ -14459,7 +14460,7 @@ function inference(target, version) {
         need4(typeof value === "string" && MODEL.test(value));
       else if (key === "personality")
         need4(typeof value === "string" && ["none", "friendly", "pragmatic"].includes(value));
-      else if (version === 3 && key !== "model_verbosity") {
+      else if (version >= 3 && key !== "model_verbosity") {
         need4(typeof value === "string" && value.length <= 128 && !/[\x00-\x1f\x7f]/.test(value));
         if (key !== "service_tier")
           need4(value.length > 0);
@@ -14468,6 +14469,115 @@ function inference(target, version) {
       delete target[key];
     }
 }
+function projectModelAvailabilityNux(config, text2) {
+  const tui = config.tui, counts = isRecord3(tui) ? tui.model_availability_nux : undefined;
+  if (isRecord3(tui) && !Object.keys(tui).length) {
+    delete config.tui;
+    return { config, numericSource: text2 };
+  }
+  if (!isRecord3(counts) || Object.keys(counts).length > 256 || !Object.values(counts).every((value) => typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 4294967295))
+    return { config, numericSource: text2 };
+  const expected = structuredClone(config);
+  delete expected.tui.model_availability_nux;
+  const stripEmptyTui = (value) => {
+    if (isRecord3(value.tui) && !Object.keys(value.tui).length)
+      delete value.tui;
+  };
+  stripEmptyTui(expected);
+  const headers = [];
+  const spans = [];
+  const integer = /^(?:\+?(?:0|[1-9](?:_?\d)*)|0x[0-9a-fA-F](?:_?[0-9a-fA-F])*|0o[0-7](?:_?[0-7])*|0b[01](?:_?[01])*)$/;
+  const counterIntegers = (span) => {
+    let values = 0;
+    for (let at = 0;at < span.length; ) {
+      const char = span[at];
+      if (char === "#") {
+        while (at < span.length && span[at] !== `
+`)
+          at++;
+        continue;
+      }
+      if (char === '"' || char === "'") {
+        const quote = char;
+        at++;
+        while (at < span.length) {
+          if (quote === '"' && span[at] === "\\") {
+            at += 2;
+            continue;
+          }
+          if (span[at++] === quote)
+            break;
+        }
+        continue;
+      }
+      if (char !== "=") {
+        at++;
+        continue;
+      }
+      at++;
+      while (at < span.length && /\s/.test(span[at]))
+        at++;
+      if (span[at] === "{") {
+        at++;
+        continue;
+      }
+      const start = at;
+      while (at < span.length && !/[\s,\]{}#]/.test(span[at]))
+        at++;
+      if (!integer.test(span.slice(start, at)))
+        return false;
+      values++;
+    }
+    return values === Object.keys(counts).length;
+  };
+  let attempts = 0;
+  const realPrefix = (end) => {
+    if (++attempts > 256)
+      return false;
+    try {
+      Bun.TOML.parse(text2.slice(0, end));
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  for (const match of text2.matchAll(/^[ \t]*\[[^\r\n]+\][ \t]*(?:#[^\r\n]*)?(?:\r?\n|$)/gm)) {
+    const start = match.index, end = start + match[0].length;
+    if (realPrefix(end))
+      headers.push({ start, end });
+  }
+  for (let at = 0;at < headers.length; at++) {
+    const header = headers[at];
+    let parsed;
+    try {
+      parsed = Bun.TOML.parse(text2.slice(header.start, header.end));
+    } catch {
+      continue;
+    }
+    if (isRecord3(parsed.tui) && isRecord3(parsed.tui.model_availability_nux) && !Object.keys(parsed.tui.model_availability_nux).length && Object.keys(parsed).length === 1 && Object.keys(parsed.tui).length === 1)
+      spans.push({ start: header.start, end: headers[at + 1]?.start ?? text2.length });
+  }
+  for (const match of text2.matchAll(/^[ \t]*(?:(?:tui|"tui"|'tui')[ \t]*\.[ \t]*)?(?:model_availability_nux|"model_availability_nux"|'model_availability_nux')[ \t]*=[ \t]*\{[^\r\n]*(?:\r?\n|$)/gm)) {
+    const start = match.index, end = start + match[0].length;
+    if (realPrefix(end))
+      spans.push({ start, end });
+  }
+  for (const { start, end } of spans) {
+    if (!counterIntegers(text2.slice(start, end)))
+      continue;
+    const remaining = text2.slice(0, start) + text2.slice(end);
+    let parsed;
+    try {
+      parsed = Bun.TOML.parse(remaining);
+    } catch {
+      continue;
+    }
+    stripEmptyTui(parsed);
+    if (isDeepStrictEqual3(parsed, expected))
+      return { config: expected, numericSource: remaining };
+  }
+  return { config, numericSource: text2 };
+}
 function settingsDigest2(text2, version = 2) {
   let config;
   try {
@@ -14476,7 +14586,8 @@ function settingsDigest2(text2, version = 2) {
     throw new Error("Invalid Codex settings witness");
   }
   need4(isRecord3(config));
-  const projected = version === 3 ? projectRegularCodexMcp(config, text2) : { config, numericSource: text2 };
+  const mcp = version >= 3 ? projectRegularCodexMcp(config, text2) : { config, numericSource: text2 };
+  const projected = version === 4 ? projectModelAvailabilityNux(mcp.config, mcp.numericSource) : mcp;
   normalize3(projected.config, version);
   return sha2(`hasna.skills.codex-settings.v${version}\x00${JSON.stringify([canonical4(projected.config), numericTokens2(projected.numericSource)])}`);
 }
@@ -14521,10 +14632,29 @@ function upgradeCodexSettingsWitnessV3(previous, reviewedSettingsPath) {
     throw new Error("Codex settings outside the reviewed V3 contract changed; explicit discovery review required");
   return { path: previous.path, hashMode: "codex-settings-v3", sha256: sha2562 };
 }
+function hashCodexSettingsReplacementV4(text2, budget = { remaining: 256 * 1024 * 1024 }) {
+  need4(Buffer.byteLength(text2) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text2));
+  budget.remaining -= Buffer.byteLength(text2);
+  return settingsDigest2(text2, 4);
+}
+function captureCodexSettingsV4(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "codex-settings-v4", sha256: settingsDigest2(readNativeSettingsWitnessFile(path, budget, "config.toml"), 4) };
+}
+function upgradeCodexSettingsWitnessV4(previous, reviewedSettingsPath) {
+  need4(previous && Object.keys(previous).every((key) => ["path", "hashMode", "sha256"].includes(key)) && (previous.hashMode === undefined || ["bytes", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3"].includes(previous.hashMode)) && /^[a-f0-9]{64}$/.test(previous.sha256));
+  const budget = { remaining: 2 * 1024 * 1024 };
+  const before = readNativeSettingsWitnessFile(reviewedSettingsPath, budget, "config.toml"), current = readNativeSettingsWitnessFile(previous.path, budget, "config.toml");
+  const original = previous.hashMode === "codex-settings-v3" ? settingsDigest2(before, 3) : previous.hashMode === "codex-settings-v2" ? settingsDigest2(before, 2) : previous.hashMode === "codex-settings-v1" ? hashCodexSettingsReplacement(before) : sha2(before);
+  need4(original === previous.sha256);
+  const sha2562 = settingsDigest2(current, 4);
+  if (settingsDigest2(before, 4) !== sha2562)
+    throw new Error("Codex settings outside the reviewed V4 contract changed; explicit discovery review required");
+  return { path: previous.path, hashMode: "codex-settings-v4", sha256: sha2562 };
+}
 
 // src/lib/agent-integration.ts
 import { createHash as createHash15, randomUUID as randomUUID2 } from "crypto";
-import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
 import { existsSync as existsSync9, lstatSync as lstatSync18, statSync as statSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync13, readdirSync as readdirSync8, opendirSync as opendirSync3, readlinkSync as readlinkSync4, realpathSync as realpathSync8, renameSync as renameSync2, rmdirSync as rmdirSync2, writeFileSync as writeFileSync5, unlinkSync as unlinkSync3, chmodSync, openSync as openSync9, closeSync as closeSync9, fsyncSync as fsyncSync3, fstatSync as fstatSync9, readSync as readSync7, constants as constants9, linkSync as linkSync2 } from "fs";
 import { dirname as dirname13, join as join20, resolve as resolve12, relative as relative6, isAbsolute as isAbsolute12, sep as sep6 } from "path";
 import { homedir as homedir2 } from "os";
@@ -14653,7 +14783,7 @@ function isOwnedCliBridge(path, expectedPaths) {
 }
 
 // src/lib/agent-codex.ts
-import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
 var CODEX_SKILL_CONFIG_SECTIONS = /^\[\[skills\.config\]\][^\n]*(?:\n(?!\s*\[)[^\n]*)*/gm;
 var codexPathConfigRefusal = () => new Error("Codex skill path controls require ordinary [[skills.config]] TOML tables or a native single-line inline array; preserve and review unsupported inline, dotted, or malformed definitions before running skills hook install");
 function splitTopLevel(value, delimiter2) {
@@ -14784,7 +14914,7 @@ function normalizeCodexInlinePathConfig(text2) {
   const expectedWithoutConfig = structuredClone(before);
   delete expectedWithoutConfig.skills.config;
   try {
-    if (isDeepStrictEqual3(Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, "")), expectedWithoutConfig))
+    if (isDeepStrictEqual4(Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, "")), expectedWithoutConfig))
       return text2;
   } catch {}
   const matches = [];
@@ -14837,7 +14967,7 @@ function normalizeCodexInlinePathConfig(text2) {
     try {
       const after = Bun.TOML.parse(candidate);
       const expected = structuredClone(before);
-      if (isDeepStrictEqual3(after, expected))
+      if (isDeepStrictEqual4(after, expected))
         matches.push(candidate);
     } catch {}
   }
@@ -14853,11 +14983,11 @@ function assertCodexPathConfigEditable(text2) {
   delete expected.skills.config;
   try {
     const withoutSections = Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
-    if (isDeepStrictEqual3(withoutSections, expected))
+    if (isDeepStrictEqual4(withoutSections, expected))
       return;
     const normalized = normalizeCodexInlinePathConfig(text2);
     const withoutNormalizedSections = Bun.TOML.parse(normalized.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
-    if (isDeepStrictEqual3(withoutNormalizedSections, expected))
+    if (isDeepStrictEqual4(withoutNormalizedSections, expected))
       return;
   } catch {}
   throw codexPathConfigRefusal();
@@ -14895,7 +15025,7 @@ function disableCodexBundledSkills(text2) {
   const candidates = new Set;
   const consider = (candidate) => {
     try {
-      if (isDeepStrictEqual3(Bun.TOML.parse(candidate), expected))
+      if (isDeepStrictEqual4(Bun.TOML.parse(candidate), expected))
         candidates.add(candidate);
     } catch {}
   };
@@ -15882,7 +16012,7 @@ function projectedHookExecutable(command, expectedResolved) {
       hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
     const recheck = () => {
       try {
-        if (realpathSync8(command) !== resolved || linkIdentity(lstatSync18(command, { bigint: true })) !== linkIdentity(link) || !isDeepStrictEqual4(parents2(), parentIdentity) || !isDeepStrictEqual4(parents2(resolved), resolvedParentIdentity))
+        if (realpathSync8(command) !== resolved || linkIdentity(lstatSync18(command, { bigint: true })) !== linkIdentity(link) || !isDeepStrictEqual5(parents2(), parentIdentity) || !isDeepStrictEqual5(parents2(resolved), resolvedParentIdentity))
           hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
         projectedHookAcl(cli.file, cli.stat);
         projectedHookAcl(manifest.file, manifest.stat);
@@ -16103,7 +16233,7 @@ function atomicWrite2(path, content) {
   }
 }
 function planAgentSettingsWitnessUpgrade(options) {
-  if (options.targetCodexVersion !== undefined && (options.agent !== "codex" || ![2, 3].includes(options.targetCodexVersion)))
+  if (options.targetCodexVersion !== undefined && (options.agent !== "codex" || ![2, 3, 4].includes(options.targetCodexVersion)))
     throw new Error("Invalid Codex witness target version");
   const home = resolve12(options.home ?? homedir2()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
   const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
@@ -16126,21 +16256,21 @@ function planAgentSettingsWitnessUpgrade(options) {
     throw new Error("Settings witness upgrade requires a preserved settings preimage");
   const replaced = [previous];
   if (options.agent === "codex") {
-    if (previous.hashMode !== undefined && previous.hashMode !== "bytes" && previous.hashMode !== "codex-settings-v1" && !(options.targetCodexVersion === 3 && previous.hashMode === "codex-settings-v2"))
+    if (previous.hashMode !== undefined && previous.hashMode !== "bytes" && previous.hashMode !== "codex-settings-v1" && !((options.targetCodexVersion === 3 || options.targetCodexVersion === 4) && previous.hashMode === "codex-settings-v2") && !(options.targetCodexVersion === 4 && previous.hashMode === "codex-settings-v3"))
       throw new Error("Codex settings witness upgrade requires an eligible preserved configuration witness");
     const preimage = readCodexSettingsPreimage(options.reviewedPreimage);
     for (const source of binding.sources) {
       if (source === previous || source.path !== configPath)
         continue;
       const fields = source.fields;
-      if (source.hashMode !== undefined || source.format !== "toml" || !Array.isArray(fields) || !isDeepStrictEqual4(fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]) || typeof source.sha256 !== "string")
+      if (source.hashMode !== undefined || source.format !== "toml" || !Array.isArray(fields) || !isDeepStrictEqual5(fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]) || typeof source.sha256 !== "string")
         throw new Error("Codex settings witness upgrade found an unrecognized configuration witness");
       if (projectNativeDiscoveryFields(preimage, "toml", fields, configPath) !== source.sha256)
         throw new Error("Reviewed preimage does not explain the Codex discovery projection witness");
       replaced.push(source);
     }
   }
-  const next = options.agent === "claude" ? upgradeClaudeSettingsWitness(previous, options.reviewedPreimage) : options.targetCodexVersion === 3 ? upgradeCodexSettingsWitnessV3(previous, options.reviewedPreimage) : upgradeCodexSettingsWitness(previous, options.reviewedPreimage);
+  const next = options.agent === "claude" ? upgradeClaudeSettingsWitness(previous, options.reviewedPreimage) : options.targetCodexVersion === 4 ? upgradeCodexSettingsWitnessV4(previous, options.reviewedPreimage) : options.targetCodexVersion === 3 ? upgradeCodexSettingsWitnessV3(previous, options.reviewedPreimage) : upgradeCodexSettingsWitness(previous, options.reviewedPreimage);
   const rebound = [];
   for (const source of binding.sources) {
     if (!replaced.includes(source)) {
@@ -16186,7 +16316,7 @@ function applyAgentIntegrationUnlocked(plan, options = {}, assertCurrent) {
     const upgrade = plan.settingsWitnessUpgrade;
     if (!plan.managedAgentChecks || !plan.observedPolicy?.before)
       throw new Error("Invalid settings witness upgrade plan");
-    const verified = planAgentSettingsWitnessUpgrade({ agent: upgrade.agent, ...upgrade.agent === "codex" ? { targetCodexVersion: upgrade.toHashMode === "codex-settings-v3" ? 3 : 2 } : {}, reviewedPreimage: upgrade.reviewedPreimage, home: plan.managedAgentChecks.home, dataDir: plan.dataDir, expectedPolicySha256: sha3(plan.observedPolicy.before), expectedSettingsSha256: upgrade.currentSettingsSha256 });
+    const verified = planAgentSettingsWitnessUpgrade({ agent: upgrade.agent, ...upgrade.agent === "codex" ? { targetCodexVersion: upgrade.toHashMode === "codex-settings-v4" ? 4 : upgrade.toHashMode === "codex-settings-v3" ? 3 : 2 } : {}, reviewedPreimage: upgrade.reviewedPreimage, home: plan.managedAgentChecks.home, dataDir: plan.dataDir, expectedPolicySha256: sha3(plan.observedPolicy.before), expectedSettingsSha256: upgrade.currentSettingsSha256 });
     if (JSON.stringify(verified.changes) !== JSON.stringify(plan.changes) || JSON.stringify(verified.settingsWitnessUpgrade) !== JSON.stringify(upgrade))
       throw new Error("Settings witness upgrade plan changed");
     provenDiscovery = verified.discoveryBefore[0];
@@ -19169,19 +19299,19 @@ function projectNativeDiscoveryFields(text2, format, fields2, path) {
   return digest(JSON.stringify(Object.fromEntries(fields2.map((field2) => [field2, object5[field2] ?? null]))));
 }
 function isSupersededCodexProjection(agent, configPath, source) {
-  return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual5(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
+  return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual6(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
 }
 function supersedesCodexProjection(sources, configPath) {
-  return sources.some((source) => source.path === configPath && (source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"));
+  return sources.some((source) => source.path === configPath && (source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")));
 }
 function projected(source, changes, budget = discoveryByteBudget()) {
-  if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3") {
+  if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")) {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Codex settings witnesses require exact typed metadata");
-    const current = (source.hashMode === "codex-settings-v3" ? captureCodexSettingsV3 : source.hashMode === "codex-settings-v2" ? captureCodexSettingsV2 : captureCodexSettings)(source.path, budget).sha256;
+    const current = (source.hashMode === "codex-settings-v4" ? captureCodexSettingsV4 : source.hashMode === "codex-settings-v3" ? captureCodexSettingsV3 : source.hashMode === "codex-settings-v2" ? captureCodexSettingsV2 : captureCodexSettings)(source.path, budget).sha256;
     if (current !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
-    return changes?.has(source.path) ? (source.hashMode === "codex-settings-v3" ? hashCodexSettingsReplacementV3 : source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget) : current;
+    return changes?.has(source.path) ? (source.hashMode === "codex-settings-v4" ? hashCodexSettingsReplacementV4 : source.hashMode === "codex-settings-v3" ? hashCodexSettingsReplacementV3 : source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget) : current;
   }
   if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
@@ -19277,7 +19407,7 @@ function captureRetiredCodexDiscovery(binding, controls, rules) {
     return current;
   const installation = codexInstallationRoots(binding);
   const directories = (binding.directories ?? []).filter((directory) => !installation.some((root2) => directory.path === root2 || directory.path.startsWith(root2 + sep7) || root2.startsWith(directory.path + sep7)));
-  if (previous && isDeepStrictEqual5(previous.roots, roots) && isDeepStrictEqual5(previous.parents, parents3) && isDeepStrictEqual5(previous.directories.map((item) => item.path), directories.map((item) => item.path)))
+  if (previous && isDeepStrictEqual6(previous.roots, roots) && isDeepStrictEqual6(previous.parents, parents3) && isDeepStrictEqual6(previous.directories.map((item) => item.path), directories.map((item) => item.path)))
     return { ...current, codexRetiredMaterializations: previous };
   return { ...current, codexRetiredMaterializations: { roots, parents: parents3, directories: captureDiscoveryDirectoryProjection(directories.map((item) => item.path), roots) } };
 }
@@ -19353,7 +19483,7 @@ function verifyAgentDiscovery(binding, codexRecovery) {
         if (omitted.some((root2) => !retiredRoots.includes(root2)))
           throw new Error("Missing reviewed directory membership inventory; provide a fresh discovery review");
         const current = captureDiscoveryDirectoryProjection(ordinary.map((item) => item.path), retiredRoots).map(({ entries, ...item }) => item);
-        if (!isDeepStrictEqual5(current, projection))
+        if (!isDeepStrictEqual6(current, projection))
           throw new Error("Native discovery directory membership changed outside retired Codex roots");
       }
     } else
@@ -19412,7 +19542,7 @@ function codexInstallationRoots(binding) {
   });
 }
 function assertMarketplaceBinding(binding, source) {
-  if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3") && (binding.agent !== "codex" || binding.method !== "reviewed" || basename10(source.path) !== "config.toml"))
+  if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")) && (binding.agent !== "codex" || binding.method !== "reviewed" || basename10(source.path) !== "config.toml"))
     throw new Error("Codex settings witnesses require explicit reviewed Codex configuration");
   if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename10(source.path) !== "settings.json"))
     throw new Error("Claude settings witnesses require explicit reviewed Claude configuration");
@@ -19613,10 +19743,10 @@ function resolveAgentDiscovery(options) {
     verifyAgentDiscovery(retained);
     if (!retained.sources.some((source) => source.path === canonical6(configPath) && source.format === undefined && source.fields === undefined))
       unresolved("retained review is missing the full agent configuration source");
-    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"))) && source.path !== canonical6(configPath)))
+    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")))) && source.path !== canonical6(configPath)))
       unresolved("retained settings witness names another configuration source");
     const covered = supersedesCodexProjection(retained.sources, canonical6(configPath)) ? sources.filter((source) => !isSupersededCodexProjection(agent, canonical6(configPath), source)) : sources;
-    if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual5(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
+    if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual6(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
       unresolved("retained review is missing current runtime discovery coverage");
     return retained;
   }
@@ -19630,7 +19760,7 @@ function resolveAgentDiscovery(options) {
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
-    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"))) && source.path !== canonical6(configPath)))
+    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")))) && source.path !== canonical6(configPath)))
       throw new Error("Semantic settings witnesses must name the configured Claude configuration source");
     if (!review.sources.some((source) => source.path === canonical6(configPath)))
       throw new Error("Discovery review must include the agent configuration source");
@@ -46599,6 +46729,7 @@ export {
   validateCron,
   validateBlogArticleRunOptions,
   uploadSkillsSnapshotFilesToS3,
+  upgradeCodexSettingsWitnessV4,
   upgradeCodexSettingsWitnessV3,
   upgradeCodexSettingsWitness,
   upgradeClaudeSettingsWitness,
@@ -46786,6 +46917,7 @@ export {
   captureDiscoveryPathSources,
   captureDiscoveryDirectories,
   captureDiscoveryByteSources,
+  captureCodexSettingsV4,
   captureCodexSettingsV3,
   captureCodexSettingsV2,
   captureCodexSettings,

package/dist/lib/agent-discovery.d.ts

@@ -7,7 +7,7 @@ export { captureDiscoveryDirectories, type DiscoveryDirectory } from "./agent-di
 export interface DiscoverySource {
     path: string;
     sha256: string | null;
-    hashMode?: "bytes" | "path-bytes" | "claude-plugin-registry" | "claude-marketplace-registry" | "claude-settings-v1" | "claude-settings-v2" | "claude-settings-v3" | "claude-marketplace-registry-v2" | "codex-settings-v1" | "codex-settings-v2" | "codex-settings-v3";
+    hashMode?: "bytes" | "path-bytes" | "claude-plugin-registry" | "claude-marketplace-registry" | "claude-settings-v1" | "claude-settings-v2" | "claude-settings-v3" | "claude-marketplace-registry-v2" | "codex-settings-v1" | "codex-settings-v2" | "codex-settings-v3" | "codex-settings-v4";
     managedPlugins?: ManagedPluginRegistrationWitness[];
     format?: "json" | "toml" | "yaml";
     fields?: string[];

package/dist/lib/agent-integration.d.ts

@@ -188,7 +188,7 @@ export declare function planClaudeHookEventsUpdate(options: ClaudeHookUpdateOpti
  */
 export declare function planAgentSettingsWitnessUpgrade(options: {
     agent: "claude" | "codex";
-    targetCodexVersion?: 2 | 3;
+    targetCodexVersion?: 2 | 3 | 4;
     reviewedPreimage: string;
     home?: string;
     dataDir?: string;

package/dist/lib/codex-settings-witness.d.ts

@@ -33,3 +33,16 @@ export declare function upgradeCodexSettingsWitnessV3(previous: {
     hashMode?: "bytes" | "codex-settings-v1" | "codex-settings-v2";
     sha256: string;
 }, reviewedSettingsPath: string): ReturnType<typeof captureCodexSettingsV3>;
+/** Explicit V4 adds only schema-valid native model-availability UI counts. */
+export declare function hashCodexSettingsReplacementV4(text: string, budget?: ClaudeSettingsWitnessBudget): string;
+export declare function captureCodexSettingsV4(path: string, budget?: ClaudeSettingsWitnessBudget): {
+    path: string;
+    hashMode: "codex-settings-v4";
+    sha256: string;
+};
+/** Prove the original V1/V2/V3/byte digest first; a V4 hash never verifies an old pin. */
+export declare function upgradeCodexSettingsWitnessV4(previous: {
+    path: string;
+    hashMode?: "bytes" | "codex-settings-v1" | "codex-settings-v2" | "codex-settings-v3";
+    sha256: string;
+}, reviewedSettingsPath: string): ReturnType<typeof captureCodexSettingsV4>;