@hasna/skills 0.10.41 → 0.10.43

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.41",
+  version: "0.10.43",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -39217,6 +39217,7 @@ function projectRegularCodexMcp(config, source) {
 
 // src/lib/codex-settings-witness.ts
 import { createHash as createHash9 } from "crypto";
+import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
 var sha2 = (text) => createHash9("sha256").update(text).digest("hex");
 var EFFORT2 = new Set(["none", "minimal", "low", "medium", "high", "xhigh"]);
 var VERBOSITY2 = new Set(["low", "medium", "high"]);
@@ -39328,7 +39329,7 @@ function disablesOneSkill(entry) {
   return selector.length === 1 && typeof entry[selector[0]] === "string" && entry[selector[0]].length > 0;
 }
 function inference(target, version) {
-  const keys2 = version === 3 ? [...INFERENCE, "service_tier", "plan_mode_reasoning_effort", "personality"] : INFERENCE;
+  const keys2 = version >= 3 ? [...INFERENCE, "service_tier", "plan_mode_reasoning_effort", "personality"] : INFERENCE;
   for (const key of keys2)
     if (Object.hasOwn(target, key)) {
       const value = target[key];
@@ -39336,7 +39337,7 @@ function inference(target, version) {
         need3(typeof value === "string" && MODEL.test(value));
       else if (key === "personality")
         need3(typeof value === "string" && ["none", "friendly", "pragmatic"].includes(value));
-      else if (version === 3 && key !== "model_verbosity") {
+      else if (version >= 3 && key !== "model_verbosity") {
         need3(typeof value === "string" && value.length <= 128 && !/[\x00-\x1f\x7f]/.test(value));
         if (key !== "service_tier")
           need3(value.length > 0);
@@ -39345,6 +39346,115 @@ function inference(target, version) {
       delete target[key];
     }
 }
+function projectModelAvailabilityNux(config, text) {
+  const tui = config.tui, counts = isRecord(tui) ? tui.model_availability_nux : undefined;
+  if (isRecord(tui) && !Object.keys(tui).length) {
+    delete config.tui;
+    return { config, numericSource: text };
+  }
+  if (!isRecord(counts) || Object.keys(counts).length > 256 || !Object.values(counts).every((value) => typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 4294967295))
+    return { config, numericSource: text };
+  const expected = structuredClone(config);
+  delete expected.tui.model_availability_nux;
+  const stripEmptyTui = (value) => {
+    if (isRecord(value.tui) && !Object.keys(value.tui).length)
+      delete value.tui;
+  };
+  stripEmptyTui(expected);
+  const headers = [];
+  const spans = [];
+  const integer = /^(?:\+?(?:0|[1-9](?:_?\d)*)|0x[0-9a-fA-F](?:_?[0-9a-fA-F])*|0o[0-7](?:_?[0-7])*|0b[01](?:_?[01])*)$/;
+  const counterIntegers = (span) => {
+    let values = 0;
+    for (let at = 0;at < span.length; ) {
+      const char = span[at];
+      if (char === "#") {
+        while (at < span.length && span[at] !== `
+`)
+          at++;
+        continue;
+      }
+      if (char === '"' || char === "'") {
+        const quote = char;
+        at++;
+        while (at < span.length) {
+          if (quote === '"' && span[at] === "\\") {
+            at += 2;
+            continue;
+          }
+          if (span[at++] === quote)
+            break;
+        }
+        continue;
+      }
+      if (char !== "=") {
+        at++;
+        continue;
+      }
+      at++;
+      while (at < span.length && /\s/.test(span[at]))
+        at++;
+      if (span[at] === "{") {
+        at++;
+        continue;
+      }
+      const start = at;
+      while (at < span.length && !/[\s,\]{}#]/.test(span[at]))
+        at++;
+      if (!integer.test(span.slice(start, at)))
+        return false;
+      values++;
+    }
+    return values === Object.keys(counts).length;
+  };
+  let attempts = 0;
+  const realPrefix = (end) => {
+    if (++attempts > 256)
+      return false;
+    try {
+      Bun.TOML.parse(text.slice(0, end));
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  for (const match of text.matchAll(/^[ \t]*\[[^\r\n]+\][ \t]*(?:#[^\r\n]*)?(?:\r?\n|$)/gm)) {
+    const start = match.index, end = start + match[0].length;
+    if (realPrefix(end))
+      headers.push({ start, end });
+  }
+  for (let at = 0;at < headers.length; at++) {
+    const header = headers[at];
+    let parsed;
+    try {
+      parsed = Bun.TOML.parse(text.slice(header.start, header.end));
+    } catch {
+      continue;
+    }
+    if (isRecord(parsed.tui) && isRecord(parsed.tui.model_availability_nux) && !Object.keys(parsed.tui.model_availability_nux).length && Object.keys(parsed).length === 1 && Object.keys(parsed.tui).length === 1)
+      spans.push({ start: header.start, end: headers[at + 1]?.start ?? text.length });
+  }
+  for (const match of text.matchAll(/^[ \t]*(?:(?:tui|"tui"|'tui')[ \t]*\.[ \t]*)?(?:model_availability_nux|"model_availability_nux"|'model_availability_nux')[ \t]*=[ \t]*\{[^\r\n]*(?:\r?\n|$)/gm)) {
+    const start = match.index, end = start + match[0].length;
+    if (realPrefix(end))
+      spans.push({ start, end });
+  }
+  for (const { start, end } of spans) {
+    if (!counterIntegers(text.slice(start, end)))
+      continue;
+    const remaining = text.slice(0, start) + text.slice(end);
+    let parsed;
+    try {
+      parsed = Bun.TOML.parse(remaining);
+    } catch {
+      continue;
+    }
+    stripEmptyTui(parsed);
+    if (isDeepStrictEqual4(parsed, expected))
+      return { config: expected, numericSource: remaining };
+  }
+  return { config, numericSource: text };
+}
 function settingsDigest2(text, version = 2) {
   let config;
   try {
@@ -39353,7 +39463,8 @@ function settingsDigest2(text, version = 2) {
     throw new Error("Invalid Codex settings witness");
   }
   need3(isRecord(config));
-  const projected = version === 3 ? projectRegularCodexMcp(config, text) : { config, numericSource: text };
+  const mcp = version >= 3 ? projectRegularCodexMcp(config, text) : { config, numericSource: text };
+  const projected = version === 4 ? projectModelAvailabilityNux(mcp.config, mcp.numericSource) : mcp;
   normalize2(projected.config, version);
   return sha2(`hasna.skills.codex-settings.v${version}\x00${JSON.stringify([canonical3(projected.config), numericTokens2(projected.numericSource)])}`);
 }
@@ -39398,6 +39509,25 @@ function upgradeCodexSettingsWitnessV3(previous, reviewedSettingsPath) {
     throw new Error("Codex settings outside the reviewed V3 contract changed; explicit discovery review required");
   return { path: previous.path, hashMode: "codex-settings-v3", sha256: sha2562 };
 }
+function hashCodexSettingsReplacementV4(text, budget = { remaining: 256 * 1024 * 1024 }) {
+  need3(Buffer.byteLength(text) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text));
+  budget.remaining -= Buffer.byteLength(text);
+  return settingsDigest2(text, 4);
+}
+function captureCodexSettingsV4(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "codex-settings-v4", sha256: settingsDigest2(readNativeSettingsWitnessFile(path, budget, "config.toml"), 4) };
+}
+function upgradeCodexSettingsWitnessV4(previous, reviewedSettingsPath) {
+  need3(previous && Object.keys(previous).every((key) => ["path", "hashMode", "sha256"].includes(key)) && (previous.hashMode === undefined || ["bytes", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3"].includes(previous.hashMode)) && /^[a-f0-9]{64}$/.test(previous.sha256));
+  const budget = { remaining: 2 * 1024 * 1024 };
+  const before = readNativeSettingsWitnessFile(reviewedSettingsPath, budget, "config.toml"), current = readNativeSettingsWitnessFile(previous.path, budget, "config.toml");
+  const original = previous.hashMode === "codex-settings-v3" ? settingsDigest2(before, 3) : previous.hashMode === "codex-settings-v2" ? settingsDigest2(before, 2) : previous.hashMode === "codex-settings-v1" ? hashCodexSettingsReplacement(before) : sha2(before);
+  need3(original === previous.sha256);
+  const sha2562 = settingsDigest2(current, 4);
+  if (settingsDigest2(before, 4) !== sha2562)
+    throw new Error("Codex settings outside the reviewed V4 contract changed; explicit discovery review required");
+  return { path: previous.path, hashMode: "codex-settings-v4", sha256: sha2562 };
+}
 
 // src/lib/native-discovery-roots.ts
 var NATIVE_SKILL_ROOTS = [
@@ -39422,7 +39552,7 @@ var NATIVE_SKILL_ROOTS = [
 
 // src/lib/agent-integration.ts
 import { createHash as createHash20, randomUUID as randomUUID3 } from "crypto";
-import { isDeepStrictEqual as isDeepStrictEqual6 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual7 } from "util";
 import { existsSync as existsSync7, lstatSync as lstatSync21, statSync as statSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync15, readdirSync as readdirSync8, opendirSync as opendirSync5, readlinkSync as readlinkSync4, realpathSync as realpathSync9, renameSync as renameSync3, rmdirSync as rmdirSync3, writeFileSync as writeFileSync4, unlinkSync as unlinkSync4, chmodSync, openSync as openSync16, closeSync as closeSync16, fsyncSync as fsyncSync4, fstatSync as fstatSync16, readSync as readSync11, constants as constants13, linkSync as linkSync3 } from "fs";
 import { dirname as dirname16, join as join25, resolve as resolve17, relative as relative5, isAbsolute as isAbsolute18, sep as sep6 } from "path";
 import { homedir as homedir3 } from "os";
@@ -39566,8 +39696,8 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
-      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3")
+        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3", "codex-settings-v4"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4"))
         requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute7(source.path) && resolve6(source.path) === source.path && basename5(source.path) === "config.toml");
       if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute7(source.path) && resolve6(source.path) === source.path && basename5(source.path) === "settings.json");
@@ -39727,7 +39857,7 @@ function isOwnedCliBridge(path, expectedPaths) {
 import { createHash as createHash19 } from "crypto";
 import { lstatSync as lstatSync20, readFileSync as readFileSync14, readdirSync as readdirSync7, realpathSync as realpathSync8 } from "fs";
 import { basename as basename8, dirname as dirname15, isAbsolute as isAbsolute17, join as join24, resolve as resolve16, sep as sep5 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
 
 // node_modules/yaml/dist/index.js
 var composer = require_composer();
@@ -42228,19 +42358,19 @@ function projectNativeDiscoveryFields(text2, format, fields2, path) {
   return digest2(JSON.stringify(Object.fromEntries(fields2.map((field2) => [field2, object5[field2] ?? null]))));
 }
 function isSupersededCodexProjection(agent, configPath, source) {
-  return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual4(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
+  return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual5(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
 }
 function supersedesCodexProjection(sources, configPath) {
-  return sources.some((source) => source.path === configPath && (source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"));
+  return sources.some((source) => source.path === configPath && (source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")));
 }
 function projected(source, changes, budget = discoveryByteBudget()) {
-  if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3") {
+  if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")) {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Codex settings witnesses require exact typed metadata");
-    const current = (source.hashMode === "codex-settings-v3" ? captureCodexSettingsV3 : source.hashMode === "codex-settings-v2" ? captureCodexSettingsV2 : captureCodexSettings)(source.path, budget).sha256;
+    const current = (source.hashMode === "codex-settings-v4" ? captureCodexSettingsV4 : source.hashMode === "codex-settings-v3" ? captureCodexSettingsV3 : source.hashMode === "codex-settings-v2" ? captureCodexSettingsV2 : captureCodexSettings)(source.path, budget).sha256;
     if (current !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
-    return changes?.has(source.path) ? (source.hashMode === "codex-settings-v3" ? hashCodexSettingsReplacementV3 : source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget) : current;
+    return changes?.has(source.path) ? (source.hashMode === "codex-settings-v4" ? hashCodexSettingsReplacementV4 : source.hashMode === "codex-settings-v3" ? hashCodexSettingsReplacementV3 : source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget) : current;
   }
   if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
@@ -42336,7 +42466,7 @@ function captureRetiredCodexDiscovery(binding, controls, rules) {
     return current;
   const installation = codexInstallationRoots(binding);
   const directories = (binding.directories ?? []).filter((directory) => !installation.some((root2) => directory.path === root2 || directory.path.startsWith(root2 + sep5) || root2.startsWith(directory.path + sep5)));
-  if (previous && isDeepStrictEqual4(previous.roots, roots) && isDeepStrictEqual4(previous.parents, parents3) && isDeepStrictEqual4(previous.directories.map((item) => item.path), directories.map((item) => item.path)))
+  if (previous && isDeepStrictEqual5(previous.roots, roots) && isDeepStrictEqual5(previous.parents, parents3) && isDeepStrictEqual5(previous.directories.map((item) => item.path), directories.map((item) => item.path)))
     return { ...current, codexRetiredMaterializations: previous };
   return { ...current, codexRetiredMaterializations: { roots, parents: parents3, directories: captureDiscoveryDirectoryProjection(directories.map((item) => item.path), roots) } };
 }
@@ -42412,7 +42542,7 @@ function verifyAgentDiscovery(binding, codexRecovery) {
         if (omitted.some((root2) => !retiredRoots.includes(root2)))
           throw new Error("Missing reviewed directory membership inventory; provide a fresh discovery review");
         const current = captureDiscoveryDirectoryProjection(ordinary.map((item) => item.path), retiredRoots).map(({ entries, ...item }) => item);
-        if (!isDeepStrictEqual4(current, projection))
+        if (!isDeepStrictEqual5(current, projection))
           throw new Error("Native discovery directory membership changed outside retired Codex roots");
       }
     } else
@@ -42471,7 +42601,7 @@ function codexInstallationRoots(binding) {
   });
 }
 function assertMarketplaceBinding(binding, source) {
-  if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3") && (binding.agent !== "codex" || binding.method !== "reviewed" || basename8(source.path) !== "config.toml"))
+  if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")) && (binding.agent !== "codex" || binding.method !== "reviewed" || basename8(source.path) !== "config.toml"))
     throw new Error("Codex settings witnesses require explicit reviewed Codex configuration");
   if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename8(source.path) !== "settings.json"))
     throw new Error("Claude settings witnesses require explicit reviewed Claude configuration");
@@ -42672,10 +42802,10 @@ function resolveAgentDiscovery(options) {
     verifyAgentDiscovery(retained);
     if (!retained.sources.some((source) => source.path === canonical6(configPath) && source.format === undefined && source.fields === undefined))
       unresolved("retained review is missing the full agent configuration source");
-    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"))) && source.path !== canonical6(configPath)))
+    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")))) && source.path !== canonical6(configPath)))
       unresolved("retained settings witness names another configuration source");
     const covered = supersedesCodexProjection(retained.sources, canonical6(configPath)) ? sources.filter((source) => !isSupersededCodexProjection(agent, canonical6(configPath), source)) : sources;
-    if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual4(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
+    if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual5(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
       unresolved("retained review is missing current runtime discovery coverage");
     return retained;
   }
@@ -42689,7 +42819,7 @@ function resolveAgentDiscovery(options) {
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
-    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"))) && source.path !== canonical6(configPath)))
+    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")))) && source.path !== canonical6(configPath)))
       throw new Error("Semantic settings witnesses must name the configured Claude configuration source");
     if (!review.sources.some((source) => source.path === canonical6(configPath)))
       throw new Error("Discovery review must include the agent configuration source");
@@ -42877,7 +43007,7 @@ export default async ({ directory }) => {
 }
 
 // src/lib/agent-codex.ts
-import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual6 } from "util";
 var CODEX_SKILL_CONFIG_SECTIONS = /^\[\[skills\.config\]\][^\n]*(?:\n(?!\s*\[)[^\n]*)*/gm;
 var codexPathConfigRefusal = () => new Error("Codex skill path controls require ordinary [[skills.config]] TOML tables or a native single-line inline array; preserve and review unsupported inline, dotted, or malformed definitions before running skills hook install");
 function splitTopLevel(value, delimiter2) {
@@ -43008,7 +43138,7 @@ function normalizeCodexInlinePathConfig(text2) {
   const expectedWithoutConfig = structuredClone(before);
   delete expectedWithoutConfig.skills.config;
   try {
-    if (isDeepStrictEqual5(Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, "")), expectedWithoutConfig))
+    if (isDeepStrictEqual6(Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, "")), expectedWithoutConfig))
       return text2;
   } catch {}
   const matches = [];
@@ -43061,7 +43191,7 @@ function normalizeCodexInlinePathConfig(text2) {
     try {
       const after = Bun.TOML.parse(candidate2);
       const expected = structuredClone(before);
-      if (isDeepStrictEqual5(after, expected))
+      if (isDeepStrictEqual6(after, expected))
         matches.push(candidate2);
     } catch {}
   }
@@ -43077,11 +43207,11 @@ function assertCodexPathConfigEditable(text2) {
   delete expected.skills.config;
   try {
     const withoutSections = Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
-    if (isDeepStrictEqual5(withoutSections, expected))
+    if (isDeepStrictEqual6(withoutSections, expected))
       return;
     const normalized = normalizeCodexInlinePathConfig(text2);
     const withoutNormalizedSections = Bun.TOML.parse(normalized.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
-    if (isDeepStrictEqual5(withoutNormalizedSections, expected))
+    if (isDeepStrictEqual6(withoutNormalizedSections, expected))
       return;
   } catch {}
   throw codexPathConfigRefusal();
@@ -43119,7 +43249,7 @@ function disableCodexBundledSkills(text2) {
   const candidates = new Set;
   const consider = (candidate2) => {
     try {
-      if (isDeepStrictEqual5(Bun.TOML.parse(candidate2), expected))
+      if (isDeepStrictEqual6(Bun.TOML.parse(candidate2), expected))
         candidates.add(candidate2);
     } catch {}
   };
@@ -43950,7 +44080,7 @@ function projectedHookExecutable(command, expectedResolved) {
       hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
     const recheck = () => {
       try {
-        if (realpathSync9(command) !== resolved || linkIdentity(lstatSync21(command, { bigint: true })) !== linkIdentity(link) || !isDeepStrictEqual6(parents3(), parentIdentity) || !isDeepStrictEqual6(parents3(resolved), resolvedParentIdentity))
+        if (realpathSync9(command) !== resolved || linkIdentity(lstatSync21(command, { bigint: true })) !== linkIdentity(link) || !isDeepStrictEqual7(parents3(), parentIdentity) || !isDeepStrictEqual7(parents3(resolved), resolvedParentIdentity))
           hookProjectionRefusal("EXECUTABLE_UNVERIFIED");
         projectedHookAcl(cli.file, cli.stat);
         projectedHookAcl(manifest.file, manifest.stat);
@@ -44171,7 +44301,7 @@ function atomicWrite2(path, content) {
   }
 }
 function planAgentSettingsWitnessUpgrade(options) {
-  if (options.targetCodexVersion !== undefined && (options.agent !== "codex" || ![2, 3].includes(options.targetCodexVersion)))
+  if (options.targetCodexVersion !== undefined && (options.agent !== "codex" || ![2, 3, 4].includes(options.targetCodexVersion)))
     throw new Error("Invalid Codex witness target version");
   const home = resolve17(options.home ?? homedir3()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
   const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
@@ -44194,21 +44324,21 @@ function planAgentSettingsWitnessUpgrade(options) {
     throw new Error("Settings witness upgrade requires a preserved settings preimage");
   const replaced = [previous];
   if (options.agent === "codex") {
-    if (previous.hashMode !== undefined && previous.hashMode !== "bytes" && previous.hashMode !== "codex-settings-v1" && !(options.targetCodexVersion === 3 && previous.hashMode === "codex-settings-v2"))
+    if (previous.hashMode !== undefined && previous.hashMode !== "bytes" && previous.hashMode !== "codex-settings-v1" && !((options.targetCodexVersion === 3 || options.targetCodexVersion === 4) && previous.hashMode === "codex-settings-v2") && !(options.targetCodexVersion === 4 && previous.hashMode === "codex-settings-v3"))
       throw new Error("Codex settings witness upgrade requires an eligible preserved configuration witness");
     const preimage = readCodexSettingsPreimage(options.reviewedPreimage);
     for (const source of binding.sources) {
       if (source === previous || source.path !== configPath)
         continue;
       const fields2 = source.fields;
-      if (source.hashMode !== undefined || source.format !== "toml" || !Array.isArray(fields2) || !isDeepStrictEqual6(fields2, [...CODEX_DISCOVERY_PROJECTION_FIELDS]) || typeof source.sha256 !== "string")
+      if (source.hashMode !== undefined || source.format !== "toml" || !Array.isArray(fields2) || !isDeepStrictEqual7(fields2, [...CODEX_DISCOVERY_PROJECTION_FIELDS]) || typeof source.sha256 !== "string")
         throw new Error("Codex settings witness upgrade found an unrecognized configuration witness");
       if (projectNativeDiscoveryFields(preimage, "toml", fields2, configPath) !== source.sha256)
         throw new Error("Reviewed preimage does not explain the Codex discovery projection witness");
       replaced.push(source);
     }
   }
-  const next = options.agent === "claude" ? upgradeClaudeSettingsWitness(previous, options.reviewedPreimage) : options.targetCodexVersion === 3 ? upgradeCodexSettingsWitnessV3(previous, options.reviewedPreimage) : upgradeCodexSettingsWitness(previous, options.reviewedPreimage);
+  const next = options.agent === "claude" ? upgradeClaudeSettingsWitness(previous, options.reviewedPreimage) : options.targetCodexVersion === 4 ? upgradeCodexSettingsWitnessV4(previous, options.reviewedPreimage) : options.targetCodexVersion === 3 ? upgradeCodexSettingsWitnessV3(previous, options.reviewedPreimage) : upgradeCodexSettingsWitness(previous, options.reviewedPreimage);
   const rebound = [];
   for (const source of binding.sources) {
     if (!replaced.includes(source)) {
@@ -44254,7 +44384,7 @@ function applyAgentIntegrationUnlocked(plan, options = {}, assertCurrent) {
     const upgrade = plan.settingsWitnessUpgrade;
     if (!plan.managedAgentChecks || !plan.observedPolicy?.before)
       throw new Error("Invalid settings witness upgrade plan");
-    const verified = planAgentSettingsWitnessUpgrade({ agent: upgrade.agent, ...upgrade.agent === "codex" ? { targetCodexVersion: upgrade.toHashMode === "codex-settings-v3" ? 3 : 2 } : {}, reviewedPreimage: upgrade.reviewedPreimage, home: plan.managedAgentChecks.home, dataDir: plan.dataDir, expectedPolicySha256: sha4(plan.observedPolicy.before), expectedSettingsSha256: upgrade.currentSettingsSha256 });
+    const verified = planAgentSettingsWitnessUpgrade({ agent: upgrade.agent, ...upgrade.agent === "codex" ? { targetCodexVersion: upgrade.toHashMode === "codex-settings-v4" ? 4 : upgrade.toHashMode === "codex-settings-v3" ? 3 : 2 } : {}, reviewedPreimage: upgrade.reviewedPreimage, home: plan.managedAgentChecks.home, dataDir: plan.dataDir, expectedPolicySha256: sha4(plan.observedPolicy.before), expectedSettingsSha256: upgrade.currentSettingsSha256 });
     if (JSON.stringify(verified.changes) !== JSON.stringify(plan.changes) || JSON.stringify(verified.settingsWitnessUpgrade) !== JSON.stringify(upgrade))
       throw new Error("Settings witness upgrade plan changed");
     provenDiscovery = verified.discoveryBefore[0];

package/dist/server/maintenance.d.ts

@@ -1 +1,2 @@
+#!/usr/bin/env bun
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.41",
+  "version": "0.10.43",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {