@hasna/skills 0.10.47 → 0.10.49

package/bin/maintenance.js

@@ -1872,6 +1872,24 @@ var require_commander = __commonJS((exports) => {
   exports.InvalidOptionArgumentError = InvalidArgumentError;
 });
 
+// src/lib/launch-cwd.ts
+var LAUNCH_CWD_VARIABLE = "HASNA_SKILLS_LAUNCH_CWD";
+function restoreLaunchCwd(env = process.env) {
+  const requested = env[LAUNCH_CWD_VARIABLE];
+  delete env[LAUNCH_CWD_VARIABLE];
+  if (!requested || !requested.startsWith("/"))
+    return { restored: false, cwd: process.cwd() };
+  try {
+    process.chdir(requested);
+    return { restored: true, cwd: process.cwd() };
+  } catch {
+    return { restored: false, cwd: process.cwd() };
+  }
+}
+
+// src/lib/launch-cwd-apply.ts
+restoreLaunchCwd();
+
 // node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
 var {

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.47",
+    version: "0.10.49",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -48869,6 +48869,50 @@ function unchanged2(before) {
 var sameStat = (a, b) => ["dev", "ino", "uid", "nlink", "mode", "size", "mtimeNs", "ctimeNs"].every((key) => a[key] === b[key]);
 var init_codex_hook_trust_files = () => {};
 
+// src/cli/commands/runtime-launcher.ts
+var PINNED_LAUNCHER_BUN_FLAGS, PINNED_LAUNCHER_ENV_NAMES, PINNED_LAUNCHER_ENV_PREFIXES, ENV_PREFIX, ENV_EXACT, COMMAND_LINE, PINNED_LAUNCHER_MAX_BYTES;
+var init_runtime_launcher = __esm(() => {
+  PINNED_LAUNCHER_BUN_FLAGS = ["--config=/dev/null", "--no-env-file", "--no-macros", "--no-install"];
+  PINNED_LAUNCHER_ENV_NAMES = [
+    "HOME",
+    "PATH",
+    "TMPDIR",
+    "TERM",
+    "TERM_PROGRAM",
+    "TERM_PROGRAM_VERSION",
+    "COLORTERM",
+    "LANG",
+    "USER",
+    "LOGNAME",
+    "SHELL",
+    "TZ",
+    "NO_COLOR",
+    "FORCE_COLOR",
+    "CI",
+    "COLUMNS",
+    "LINES",
+    "EDITOR",
+    "VISUAL",
+    "PAGER",
+    "SSH_AUTH_SOCK",
+    "DATABASE_URL",
+    "TERMINAL_CWD",
+    "CODEX_HOME",
+    "HERMES_HOME",
+    "HERMES_ENABLE_PROJECT_PLUGINS",
+    "HOST",
+    "PORT",
+    "NODE_ENV",
+    "AGENT_ID",
+    "ECS_CONTAINER_METADATA_URI_V4"
+  ];
+  PINNED_LAUNCHER_ENV_PREFIXES = ["HASNA", "SKILLS", "SKILL", "MCP", "XDG", "LC", "AWS"];
+  ENV_PREFIX = new RegExp(`^(${PINNED_LAUNCHER_ENV_PREFIXES.join("|")})_`);
+  ENV_EXACT = new Set(PINNED_LAUNCHER_ENV_NAMES);
+  COMMAND_LINE = new RegExp(`^set -- '([^']+)' ${PINNED_LAUNCHER_BUN_FLAGS.join(" ")} '--cwd=([^']+)' '([^']+)' "\\$@"$`, "m");
+  PINNED_LAUNCHER_MAX_BYTES = 16 * 1024;
+});
+
 // src/lib/agent-integration.ts
 var init_agent_integration = __esm(() => {
   init_sumi_settings_witness();
@@ -48889,6 +48933,7 @@ var init_agent_integration = __esm(() => {
   init_agent_hermes();
   init_claude_settings_witness();
   init_codex_hook_trust_files();
+  init_runtime_launcher();
 });
 
 // src/lib/home-migration.ts
@@ -50902,7 +50947,7 @@ function resolveAgentDiscovery(options) {
       throw new Error("Discovery review must include the agent configuration source");
     const reviewedSources = supersedesSettingsProjection(agent, review.sources, canonical7(configPath)) ? sources.filter((source) => !isSupersededSettingsProjection(agent, canonical7(configPath), source)) : sources;
     const reviewedSourcesWithManifestProjection = review.sources.map((source) => {
-      if (agent !== "claude" || source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || source.hashMode !== undefined && source.hashMode !== "bytes" || basename8(source.path) !== "plugin.json" || !source.path.endsWith(join26(sep6, ".claude-plugin", "plugin.json")))
+      if (agent !== "claude" || source.sha256 === null || source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || source.hashMode !== undefined && source.hashMode !== "bytes" || basename8(source.path) !== "plugin.json" || !source.path.endsWith(join26(sep6, ".claude-plugin", "plugin.json")))
         return source;
       const pluginRoot = dirname15(dirname15(source.path)), hooksPath = join26(pluginRoot, "hooks/hooks.json");
       const hookStat = lstatSync18(hooksPath, { throwIfNoEntry: false });
@@ -63996,6 +64041,24 @@ var init_http = __esm(() => {
   init_server3();
 });
 
+// src/lib/launch-cwd.ts
+var LAUNCH_CWD_VARIABLE = "HASNA_SKILLS_LAUNCH_CWD";
+function restoreLaunchCwd(env = process.env) {
+  const requested = env[LAUNCH_CWD_VARIABLE];
+  delete env[LAUNCH_CWD_VARIABLE];
+  if (!requested || !requested.startsWith("/"))
+    return { restored: false, cwd: process.cwd() };
+  try {
+    process.chdir(requested);
+    return { restored: true, cwd: process.cwd() };
+  } catch {
+    return { restored: false, cwd: process.cwd() };
+  }
+}
+
+// src/lib/launch-cwd-apply.ts
+restoreLaunchCwd();
+
 // src/mcp/index.ts
 init_stdio2();
 init_package();

package/bin/migrate.js

@@ -1,13 +1,31 @@
 #!/usr/bin/env bun
 // @bun
 
+// src/lib/launch-cwd.ts
+var LAUNCH_CWD_VARIABLE = "HASNA_SKILLS_LAUNCH_CWD";
+function restoreLaunchCwd(env = process.env) {
+  const requested = env[LAUNCH_CWD_VARIABLE];
+  delete env[LAUNCH_CWD_VARIABLE];
+  if (!requested || !requested.startsWith("/"))
+    return { restored: false, cwd: process.cwd() };
+  try {
+    process.chdir(requested);
+    return { restored: true, cwd: process.cwd() };
+  } catch {
+    return { restored: false, cwd: process.cwd() };
+  }
+}
+
+// src/lib/launch-cwd-apply.ts
+restoreLaunchCwd();
+
 // src/server/migrate.ts
 import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
 import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.47",
+  version: "0.10.49",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24119,10 +24119,28 @@ __export(exports_dist_es8, {
 var init_dist_es9 = __esm(() => {
   init_fromIni();
 });
+
+// src/lib/launch-cwd.ts
+var LAUNCH_CWD_VARIABLE = "HASNA_SKILLS_LAUNCH_CWD";
+function restoreLaunchCwd(env = process.env) {
+  const requested = env[LAUNCH_CWD_VARIABLE];
+  delete env[LAUNCH_CWD_VARIABLE];
+  if (!requested || !requested.startsWith("/"))
+    return { restored: false, cwd: process.cwd() };
+  try {
+    process.chdir(requested);
+    return { restored: true, cwd: process.cwd() };
+  } catch {
+    return { restored: false, cwd: process.cwd() };
+  }
+}
+
+// src/lib/launch-cwd-apply.ts
+restoreLaunchCwd();
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.47",
+  version: "0.10.49",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -24120,12 +24120,30 @@ var init_dist_es9 = __esm(() => {
   init_fromIni();
 });
 
+// src/lib/launch-cwd.ts
+var LAUNCH_CWD_VARIABLE = "HASNA_SKILLS_LAUNCH_CWD";
+function restoreLaunchCwd(env = process.env) {
+  const requested = env[LAUNCH_CWD_VARIABLE];
+  delete env[LAUNCH_CWD_VARIABLE];
+  if (!requested || !requested.startsWith("/"))
+    return { restored: false, cwd: process.cwd() };
+  try {
+    process.chdir(requested);
+    return { restored: true, cwd: process.cwd() };
+  } catch {
+    return { restored: false, cwd: process.cwd() };
+  }
+}
+
+// src/lib/launch-cwd-apply.ts
+restoreLaunchCwd();
+
 // src/server/worker.ts
 import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.47",
+  version: "0.10.49",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/cli/commands/runtime-launcher.d.ts

@@ -0,0 +1,102 @@
+export declare const PINNED_LAUNCHER_SCHEMA = "hasna-skills-pinned-launcher-v1";
+/** The variable the launcher uses to hand the caller's directory to the CLI. */
+export declare const LAUNCH_CWD_VARIABLE = "HASNA_SKILLS_LAUNCH_CWD";
+/** Bun runtime flags that remove every working-directory configuration source. */
+export declare const PINNED_LAUNCHER_BUN_FLAGS: readonly ["--config=/dev/null", "--no-env-file", "--no-macros", "--no-install"];
+/**
+ * Environment names passed through `env -i`, by exact name. Everything else,
+ * including `BUN_*`, `NODE_OPTIONS`, `DYLD_*`, `LD_*` and proxy settings, is
+ * dropped. The handling is total on purpose: a name is either listed here,
+ * matches a prefix below, or never reaches the runtime.
+ */
+export declare const PINNED_LAUNCHER_ENV_NAMES: readonly ["HOME", "PATH", "TMPDIR", "TERM", "TERM_PROGRAM", "TERM_PROGRAM_VERSION", "COLORTERM", "LANG", "USER", "LOGNAME", "SHELL", "TZ", "NO_COLOR", "FORCE_COLOR", "CI", "COLUMNS", "LINES", "EDITOR", "VISUAL", "PAGER", "SSH_AUTH_SOCK", "DATABASE_URL", "TERMINAL_CWD", "CODEX_HOME", "HERMES_HOME", "HERMES_ENABLE_PROJECT_PLUGINS", "HOST", "PORT", "NODE_ENV", "AGENT_ID", "ECS_CONTAINER_METADATA_URI_V4"];
+/** Environment name prefixes passed through, for the app's own documented overrides. */
+export declare const PINNED_LAUNCHER_ENV_PREFIXES: readonly ["HASNA", "SKILLS", "SKILL", "MCP", "XDG", "LC", "AWS"];
+/** The allowlisted subset of an environment, by the same rule the launcher applies. */
+export declare function pinnedLauncherEnvironment(env: Record<string, string | undefined>): Record<string, string>;
+export type LauncherShape = "symlink" | "pinned";
+export interface PinnedLauncherBinding {
+    runtime: string;
+    cwd: string;
+    entry: string;
+}
+export type LauncherState = {
+    shape: "symlink";
+    linkTarget: string;
+    target: string;
+} | {
+    shape: "pinned";
+    runtime: string;
+    cwd: string;
+    target: string;
+    sha256: string;
+};
+export type InspectedLauncher = {
+    kind: "symlink";
+    linkTarget: string;
+    target: string;
+} | {
+    kind: "pinned";
+    runtime: string;
+    cwd: string;
+    target: string;
+    sha256: string;
+    text: string;
+} | {
+    kind: "foreign";
+};
+/** The exact launcher text for one Bun binary, trusted directory and entry. Deterministic. */
+export declare function renderPinnedLauncher(binding: PinnedLauncherBinding): string;
+/** Parse launcher text; only the exact rendered shape is accepted. */
+export declare function parsePinnedLauncher(text: string): PinnedLauncherBinding | null;
+/**
+ * Resolve a command path the way the symlink checks used to: the physical file
+ * it reaches and, when that file is a managed pinned launcher (its exact
+ * rendered text), the entry the launcher runs. `entry` equals `physical` for a
+ * symlink or a plain executable. A pinned entry must itself be a physical path.
+ */
+export declare function resolveLauncherCommand(path: string): {
+    physical: string;
+    entry: string;
+    pinned: (PinnedLauncherBinding & {
+        sha256: string;
+    }) | null;
+};
+/** Classify the launcher at `path` without following anything but its own symlink. */
+export declare function inspectLauncher(path: string): InspectedLauncher;
+/** The entry a managed launcher runs, whichever shape it has. */
+export declare function launcherTarget(path: string): string;
+/** The "link text" of a managed launcher: the symlink text, or the pinned entry path. */
+export declare function launcherLinkText(path: string): string;
+/** Whether the launcher at `path` is exactly `state`: same shape, text and target. */
+export declare function launcherIs(path: string, state: LauncherState): boolean;
+/** The pinned launcher text for a state, verified against the recorded digest. */
+export declare function pinnedLauncherText(state: {
+    runtime: string;
+    cwd: string;
+    target: string;
+    sha256: string;
+}): string;
+/** Build the pinned state for an entry under the given Bun binary and trusted directory. */
+export declare function pinnedLauncherState(runtime: string, cwd: string, target: string): Extract<LauncherState, {
+    shape: "pinned";
+}>;
+/**
+ * Create a launcher in `state` at a path that must not exist yet, and read it
+ * back. Symlinks are created as-is; pinned launchers are regular 0755 files.
+ */
+export declare function materializeLauncher(path: string, state: LauncherState): void;
+/**
+ * The Bun binary launchers are pinned to: the exact runtime running the
+ * updater, resolved physically and required to be owned by root or the
+ * current user, executable, and not writable by group or others.
+ */
+export declare function pinnedLauncherRuntime(): string;
+/** A pinned runtime is a physical, executable regular file owned by root or the current user and not group/world-writable. */
+export declare function assertPinnedLauncherRuntimeSafe(runtime: string): void;
+/**
+ * The launcher depends on `/bin/sh -p`, `/usr/bin/awk` and `/usr/bin/env`.
+ * Refuse before any launcher is written when this station's shell rejects
+ * `-p` (for example dash before 0.5.11), so no launcher is left unusable.
+ */
+export declare function assertPinnedLauncherShell(): void;

package/dist/cli/commands/runtime.d.ts

@@ -1,2 +1,9 @@
 import type { Command } from "commander";
 export declare function registerRuntime(parent: Command): void;
+/**
+ * The command to run for the Skills selected on PATH, after checking that it
+ * runs the installed entry. A symlink is compared by its physical target, as
+ * before; a managed pinned launcher by the exact entry it runs, and it is run
+ * through the launcher so the caller's directory configures nothing.
+ */
+export declare function selectedSkillsCommand(selected: string, installed: string): string;

package/dist/cli/index.d.ts

@@ -1,2 +1,2 @@
 #!/usr/bin/env bun
-export {};
+import "../lib/launch-cwd-apply.js";