@hasna/skills 0.10.49 → 0.10.51

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.49",
+  version: "0.10.51",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -38140,6 +38140,8 @@ var BUILTIN_MODEL_SELECTIONS = new Set([
   "claude-opus-4-6[1m]",
   "claude-sonnet-4-6[1m]"
 ]);
+var CLAUDE_BUILTIN_THEMES = Object.freeze(["auto", "dark", "light", "dark-daltonized", "light-daltonized", "dark-ansi", "light-ansi"]);
+var BUILTIN_THEMES = new Set(CLAUDE_BUILTIN_THEMES);
 function canonical(value) {
   if (value.kind === "object")
     return { kind: "object", entries: value.entries.map(([key, child]) => [key, canonical(child)]).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0) };
@@ -38198,7 +38200,9 @@ function inferencePreference(key, child, version) {
 function settingsDigest(text, version = 1) {
   const value = parse2(text);
   value.entries = value.entries.filter(([key, child]) => {
-    if (version !== 1 && inferencePreference(key, child, version))
+    if (version === 4 && key === "theme" && child.kind === "string" && BUILTIN_THEMES.has(child.value))
+      return false;
+    if (version !== 1 && inferencePreference(key, child, version === 4 ? 3 : version))
       return false;
     if (key === "model") {
       need(child.kind === "string", "contains an invalid model selection");
@@ -38256,6 +38260,26 @@ function upgradeClaudeSettingsWitness(previous, reviewedSettingsPath) {
   need(settingsDigest(before, 3) === sha2562, "non-preference settings changed; explicit discovery review required");
   return { path: previous.path, hashMode: "claude-settings-v3", sha256: sha2562 };
 }
+function captureClaudeSettingsV4(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "claude-settings-v4", sha256: settingsDigest(readNativeSettingsWitnessFile(path, budget), 4) };
+}
+function hashClaudeSettingsReplacementV4(text, budget) {
+  need(typeof text === "string", "requires settings text");
+  const bytes = Buffer.byteLength(text);
+  need(bytes <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes && Number.isSafeInteger(budget.remaining) && budget.remaining >= bytes, "exceeds its byte limit");
+  budget.remaining -= bytes;
+  return settingsDigest(text, 4);
+}
+function upgradeClaudeSettingsWitnessV4(previous, reviewedSettingsPath) {
+  need(previous && Object.keys(previous).every((key) => ["path", "hashMode", "sha256"].includes(key)) && (previous.hashMode === undefined || previous.hashMode === "bytes" || previous.hashMode === "claude-settings-v1" || previous.hashMode === "claude-settings-v2" || previous.hashMode === "claude-settings-v3") && typeof previous.sha256 === "string" && /^[a-f0-9]{64}$/.test(previous.sha256), "requires an exact prior settings witness");
+  const budget = { remaining: 2 * CLAUDE_SETTINGS_WITNESS_LIMITS.bytes };
+  const before = readNativeSettingsWitnessFile(reviewedSettingsPath, budget), current = readNativeSettingsWitnessFile(previous.path, budget);
+  const beforeDigest = previous.hashMode === undefined || previous.hashMode === "bytes" ? createHash6("sha256").update(before).digest("hex") : settingsDigest(before, previous.hashMode === "claude-settings-v1" ? 1 : previous.hashMode === "claude-settings-v2" ? 2 : 3);
+  need(beforeDigest === previous.sha256, "reviewed preimage does not match the prior witness");
+  const sha2562 = settingsDigest(current, 4);
+  need(settingsDigest(before, 4) === sha2562, "non-preference settings changed; explicit discovery review required");
+  return { path: previous.path, hashMode: "claude-settings-v4", sha256: sha2562 };
+}
 function hashNativeJsonControls(text, excludedMetadata) {
   need(Buffer.byteLength(text) <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes, "exceeds its byte limit");
   const value = parse2(text);
@@ -38402,7 +38426,8 @@ var MEASURED_CODEX_CAPABILITIES = {
   "codex-cli 0.158.0": ["hooks"],
   "codex-cli 0.159.0": ["hooks"],
   "codex-cli 0.159.2": ["hooks", "qualified-skill-catalog"],
-  "codex-cli 0.160.0": ["hooks", "qualified-skill-catalog"]
+  "codex-cli 0.160.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
+  "codex-cli 0.160.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
 };
 function supportsCodexNativeCapability(version, capability) {
   return typeof version === "string" && Object.hasOwn(MEASURED_CODEX_CAPABILITIES, version) && MEASURED_CODEX_CAPABILITIES[version].includes(capability);
@@ -39003,6 +39028,7 @@ function reviewedCodexPluginCapabilitiesUnchanged(cache, controls, read, rules)
 function reviewCodexPluginControls(catalog, documents, cache, cwd, read, rules, pluginSettings, plannedRules, denials = []) {
   if (!supportsCodexNativeCapability(catalog?.version, "qualified-skill-catalog") || catalog.cwd !== cwd)
     refuse3();
+  const installedPluginReview = supportsCodexNativeCapability(catalog.version, "installed-plugin-review");
   if (!Array.isArray(denials) || denials.length > 4096 || new Set(denials.map((item) => item?.path)).size !== denials.length || denials.some((item) => !item || Object.keys(item).sort().join(",") !== "name,path,sha256" || typeof item.name !== "string" || typeof item.path !== "string" || !/^[a-f0-9]{64}$/.test(item.sha256)))
     refuse3();
   const usedDenials = new Set;
@@ -39034,7 +39060,7 @@ function reviewCodexPluginControls(catalog, documents, cache, cwd, read, rules,
     if (listed.length > 1)
       refuse3();
     const installed = installedPlugins.filter((plugin) => plugin.id === expectedPluginId && plugin.name === pluginName);
-    if (catalog.version === "codex-cli 0.160.0" && installed.length === 1 && installed[0].installed && installed[0].localVersion === basename4(located.root) && installed[0].sourceType === "local" && codexPluginSourceIsConfigControlled(installed[0])) {
+    if (installedPluginReview && installed.length === 1 && installed[0].installed && installed[0].localVersion === basename4(located.root) && installed[0].sourceType === "local" && codexPluginSourceIsConfigControlled(installed[0])) {
       const plugin = installed[0], input = { pluginId: expectedPluginId, namespace: located.namespace, pluginParent: located.pluginParent, sourceRoot: plugin.sourcePath, sourceSha256: plugin.sourceSha256 };
       if (input.sourceRoot !== located.root && !input.sourceRoot.startsWith(cache + sep3) && (lstatSync7(input.sourceRoot, { throwIfNoEntry: false }) || documents.some((path) => path.startsWith(input.sourceRoot + sep3)))) {
         if (skills.some((skill) => skill.path === input.sourceRoot || skill.path.startsWith(input.sourceRoot + sep3)) || !sourceInputUnchanged(input, cache, read))
@@ -39043,7 +39069,7 @@ function reviewCodexPluginControls(catalog, documents, cache, cwd, read, rules,
       }
     }
     const settings = pluginSettings && typeof pluginSettings === "object" && !Array.isArray(pluginSettings) ? pluginSettings : undefined;
-    if (catalog.version === "codex-cli 0.160.0" && !listed.length && !skills.some((skill) => skill.pluginId === expectedPluginId) && installed.length === 1 && installed[0].installed && !installed[0].enabled && codexPluginSourceIsConfigControlled(installed[0]) && settings && Object.hasOwn(settings, expectedPluginId) && settings[expectedPluginId]?.enabled === false) {
+    if (installedPluginReview && !listed.length && !skills.some((skill) => skill.pluginId === expectedPluginId) && installed.length === 1 && installed[0].installed && !installed[0].enabled && codexPluginSourceIsConfigControlled(installed[0]) && settings && Object.hasOwn(settings, expectedPluginId) && settings[expectedPluginId]?.enabled === false) {
       if (!Array.isArray(rules))
         refuse3();
       const exactPathDeny = rules.some((rule) => rule?.path === document && rule?.enabled === false);
@@ -39076,12 +39102,12 @@ function reviewCodexPluginControls(catalog, documents, cache, cwd, read, rules,
       const exactPathDeny = Array.isArray(rules) && rules.some((rule) => rule?.path === document && rule?.enabled === false);
       const nativeSkill = { name: parsed.name, path: document, pluginId: expectedPluginId, enabled: true };
       const denial = denials.find((item) => item.path === document);
-      const explicitDeny = denial !== undefined && remotePluginId !== undefined && catalog.version === "codex-cli 0.160.0" && denial.name === parsed.name && denial.sha256 === createHash8("sha256").update(read(document)).digest("hex") && Array.isArray(rules) && !rules.some((rule) => (rule?.path === document || typeof rule?.name === "string" && rule.name.trim() === parsed.name) && rule.enabled !== false) && Array.isArray(plannedRules) && plannedRules.some((rule) => rule?.path === document && rule.enabled === false);
+      const explicitDeny = denial !== undefined && remotePluginId !== undefined && installedPluginReview && denial.name === parsed.name && denial.sha256 === createHash8("sha256").update(read(document)).digest("hex") && Array.isArray(rules) && !rules.some((rule) => (rule?.path === document || typeof rule?.name === "string" && rule.name.trim() === parsed.name) && rule.enabled !== false) && Array.isArray(plannedRules) && plannedRules.some((rule) => rule?.path === document && rule.enabled === false);
       if (denial && !explicitDeny)
         refuse3();
       if (explicitDeny)
         usedDenials.add(document);
-      const plannedPathDeny = catalog.version === "codex-cli 0.160.0" && remotePluginId !== undefined && Array.isArray(rules) && rules.some((rule) => typeof rule?.name === "string" && rule.name.trim() === parsed.name && rule.enabled === false) && !rules.some((rule) => (rule?.path === document || typeof rule?.name === "string" && rule.name.trim() === parsed.name) && rule.enabled !== false) && Array.isArray(plannedRules) && plannedRules.some((rule) => rule?.path === document && rule.enabled === false) && isCodexNativeSkillDisabled(nativeSkill, plannedRules);
+      const plannedPathDeny = installedPluginReview && remotePluginId !== undefined && Array.isArray(rules) && rules.some((rule) => typeof rule?.name === "string" && rule.name.trim() === parsed.name && rule.enabled === false) && !rules.some((rule) => (rule?.path === document || typeof rule?.name === "string" && rule.name.trim() === parsed.name) && rule.enabled !== false) && Array.isArray(plannedRules) && plannedRules.some((rule) => rule?.path === document && rule.enabled === false) && isCodexNativeSkillDisabled(nativeSkill, plannedRules);
       if (!explicitDeny && (!exactPathDeny && !plannedPathDeny || !isCodexNativeSkillDisabled(nativeSkill, rules)))
         refuse3();
     }
@@ -40329,7 +40355,7 @@ function assertAgentPolicyCollections(policy) {
     }
   if (bridge.codexInactivePlugins !== undefined) {
     const controls = array(bridge.codexInactivePlugins, 4096), ids = new Set;
-    requireBound(controls.length === 0 || object4(bridge.codexPluginSkillReview) && bridge.codexPluginSkillReview.version === "codex-cli 0.160.0" && typeof bridge.codexPluginSkillReview.catalogSha256 === "string" && /^[a-f0-9]{64}$/.test(bridge.codexPluginSkillReview.catalogSha256));
+    requireBound(controls.length === 0 || object4(bridge.codexPluginSkillReview) && supportsCodexNativeCapability(bridge.codexPluginSkillReview.version, "installed-plugin-review") && typeof bridge.codexPluginSkillReview.catalogSha256 === "string" && /^[a-f0-9]{64}$/.test(bridge.codexPluginSkillReview.catalogSha256));
     for (const control of controls) {
       requireBound(object4(control) && Object.keys(control).every((key) => ["pluginId", "namespace", "pluginParent", "sourceType", "sourceSha256"].includes(key)));
       text(control.pluginId, 1024);
@@ -40381,7 +40407,7 @@ function assertAgentPolicyCollections(policy) {
     }
     if (value.codexInstallationInputs !== undefined) {
       const proof = record3(value.codexInstallationInputs, 4), inputs = array(proof.plugins, 4096), ids = new Set;
-      requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && proof.version === "codex-cli 0.160.0" && typeof proof.catalogSha256 === "string" && /^[a-f0-9]{64}$/.test(proof.catalogSha256) && inputs.length > 0 && object4(bridge.codexPluginSkillReview) && bridge.codexPluginSkillReview.version === proof.version && bridge.codexPluginSkillReview.catalogSha256 === proof.catalogSha256);
+      requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && supportsCodexNativeCapability(proof.version, "installed-plugin-review") && typeof proof.catalogSha256 === "string" && /^[a-f0-9]{64}$/.test(proof.catalogSha256) && inputs.length > 0 && object4(bridge.codexPluginSkillReview) && bridge.codexPluginSkillReview.version === proof.version && bridge.codexPluginSkillReview.catalogSha256 === proof.catalogSha256);
       for (const input of inputs) {
         requireBound(object4(input) && Object.keys(input).every((key) => ["pluginId", "namespace", "pluginParent", "sourceRoot", "sourceSha256"].includes(key)));
         text(input.pluginId, 1024);
@@ -40405,14 +40431,14 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-manifest-v1", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3", "codex-settings-v4", "sumi-settings-v1"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+        requireBound(["bytes", "path-bytes", "claude-plugin-manifest-v1", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-settings-v4", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3", "codex-settings-v4", "sumi-settings-v1"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
       if (source.hashMode === "claude-plugin-manifest-v1")
         requireBound(agent === "claude" && value.agent === "claude" && ["automatic", "reviewed"].includes(value.method) && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute8(source.path) && resolve7(source.path) === source.path && source.path.endsWith(join14(sep4, ".claude-plugin", "plugin.json")) && source.managedPlugins === undefined);
       if (source.hashMode === "sumi-settings-v1")
         requireBound(agent === "sumi" && value.agent === "sumi" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute8(source.path) && resolve7(source.path) === source.path && basename5(source.path) === "sumi.json");
       if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4"))
         requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute8(source.path) && resolve7(source.path) === source.path && basename5(source.path) === "config.toml");
-      if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3")
+      if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || source.hashMode === "claude-settings-v4"))
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute8(source.path) && resolve7(source.path) === source.path && basename5(source.path) === "settings.json");
       if (source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute8(source.path) && resolve7(source.path) === source.path && basename5(source.path) === "known_marketplaces.json");
@@ -43246,13 +43272,13 @@ function projected(source, changes, budget2 = discoveryByteBudget()) {
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
     return changes?.has(source.path) ? (source.hashMode === "codex-settings-v4" ? hashCodexSettingsReplacementV4 : source.hashMode === "codex-settings-v3" ? hashCodexSettingsReplacementV3 : source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget2) : current;
   }
-  if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") {
+  if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || source.hashMode === "claude-settings-v4")) {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Claude settings witnesses require exact typed metadata");
-    const current = (source.hashMode === "claude-settings-v3" ? captureClaudeSettingsV3 : source.hashMode === "claude-settings-v2" ? captureClaudeSettingsV2 : captureClaudeSettings)(source.path, budget2).sha256;
+    const current = (source.hashMode === "claude-settings-v4" ? captureClaudeSettingsV4 : source.hashMode === "claude-settings-v3" ? captureClaudeSettingsV3 : source.hashMode === "claude-settings-v2" ? captureClaudeSettingsV2 : captureClaudeSettings)(source.path, budget2).sha256;
     if (current !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
-    return changes?.has(source.path) ? (source.hashMode === "claude-settings-v3" ? hashClaudeSettingsReplacementV3 : source.hashMode === "claude-settings-v2" ? hashClaudeSettingsReplacementV2 : hashClaudeSettingsReplacement)(changes.get(source.path), budget2) : current;
+    return changes?.has(source.path) ? (source.hashMode === "claude-settings-v4" ? hashClaudeSettingsReplacementV4 : source.hashMode === "claude-settings-v3" ? hashClaudeSettingsReplacementV3 : source.hashMode === "claude-settings-v2" ? hashClaudeSettingsReplacementV2 : hashClaudeSettingsReplacement)(changes.get(source.path), budget2) : current;
   }
   if (source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256) || changes?.has(source.path))
@@ -43463,7 +43489,7 @@ function codexInstallationRoots(binding) {
   const proof = binding.codexInstallationInputs;
   if (proof === undefined)
     return [];
-  if (binding.agent !== "codex" || binding.method !== "reviewed" || proof.version !== "codex-cli 0.160.0" || !/^[a-f0-9]{64}$/.test(proof.catalogSha256) || !Array.isArray(proof.plugins) || !proof.plugins.length)
+  if (binding.agent !== "codex" || binding.method !== "reviewed" || !supportsCodexNativeCapability(proof.version, "installed-plugin-review") || !/^[a-f0-9]{64}$/.test(proof.catalogSha256) || !Array.isArray(proof.plugins) || !proof.plugins.length)
     throw new Error("Invalid native installation input proof");
   const cache = dirname16(dirname16(proof.plugins[0].pluginParent));
   const config = join26(dirname16(dirname16(cache)), "config.toml"), home = dirname16(dirname16(dirname16(cache)));
@@ -43487,7 +43513,7 @@ function assertMarketplaceBinding(binding, source) {
     throw new Error("Sumi settings witnesses require explicit reviewed Sumi configuration");
   if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")) && (binding.agent !== "codex" || binding.method !== "reviewed" || basename8(source.path) !== "config.toml"))
     throw new Error("Codex settings witnesses require explicit reviewed Codex configuration");
-  if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename8(source.path) !== "settings.json"))
+  if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || source.hashMode === "claude-settings-v4")) && (binding.agent !== "claude" || binding.method !== "reviewed" || basename8(source.path) !== "settings.json"))
     throw new Error("Claude settings witnesses require explicit reviewed Claude configuration");
   if ((source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2") && (binding.agent !== "claude" || binding.method !== "reviewed"))
     throw new Error("Claude marketplace witnesses require explicit reviewed Claude discovery");
@@ -43689,7 +43715,7 @@ function resolveAgentDiscovery(options) {
     verifyAgentDiscovery(retained);
     if (!retained.sources.some((source) => source.path === canonical7(configPath) && source.format === undefined && source.fields === undefined))
       unresolved("retained review is missing the full agent configuration source");
-    if (retained.sources.some((source) => (source.hashMode === "sumi-settings-v1" || source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")))) && source.path !== canonical7(configPath)))
+    if (retained.sources.some((source) => (source.hashMode === "sumi-settings-v1" || source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || source.hashMode === "claude-settings-v4" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")))) && source.path !== canonical7(configPath)))
       unresolved("retained settings witness names another configuration source");
     const covered = supersedesSettingsProjection(agent, retained.sources, canonical7(configPath)) ? sources.filter((source) => !isSupersededSettingsProjection(agent, canonical7(configPath), source)) : sources;
     if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual6(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
@@ -43703,7 +43729,7 @@ function resolveAgentDiscovery(options) {
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
-    if (review.sources.some((source) => (source.hashMode === "sumi-settings-v1" || source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")))) && source.path !== canonical7(configPath)))
+    if (review.sources.some((source) => (source.hashMode === "sumi-settings-v1" || source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || source.hashMode === "claude-settings-v4" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4")))) && source.path !== canonical7(configPath)))
       throw new Error("Semantic settings witnesses must name the configured agent configuration source");
     if (!review.sources.some((source) => source.path === canonical7(configPath)))
       throw new Error("Discovery review must include the agent configuration source");
@@ -45059,7 +45085,7 @@ function planAgentIntegration(options) {
     const { codexInstallationInputs: previousInputs, ...current } = rebound;
     const inputs = codexPluginSourceInputs.map((input) => input.sourceRoot);
     const directories = options.codexNativeCatalog || !previousInputs ? captureDiscoveryDirectories((binding.directories ?? []).filter((directory) => inputs.some((root2) => root2.startsWith(directory.path + sep7))).map((directory) => directory.path), inputs) : previousInputs.directories;
-    const installed = codexPluginSourceInputs.length ? { ...current, codexInstallationInputs: { version: "codex-cli 0.160.0", catalogSha256: codexPluginSkillReview.catalogSha256, plugins: codexPluginSourceInputs, ...directories?.length ? { directories } : {} } } : current;
+    const installed = codexPluginSourceInputs.length ? { ...current, codexInstallationInputs: { version: codexPluginSkillReview.version, catalogSha256: codexPluginSkillReview.catalogSha256, plugins: codexPluginSourceInputs, ...directories?.length ? { directories } : {} } } : current;
     return captureRetiredCodexDiscovery(installed, codexPluginSkills, Bun.TOML.parse(changes.find((change) => change.path === canonicalAgentPath(join27(home, ".codex/config.toml"), aliases))?.after ?? codexConfigBefore ?? "").skills?.config ?? []);
   });
   const nextPolicy = { ...policy, version: 1, loading: "cli", profileId, bridge: {
@@ -45374,6 +45400,8 @@ function atomicWrite2(path, content) {
 function planAgentSettingsWitnessUpgrade(options) {
   if (options.targetCodexVersion !== undefined && (options.agent !== "codex" || ![2, 3, 4].includes(options.targetCodexVersion)))
     throw new Error("Invalid Codex witness target version");
+  if (options.targetClaudeVersion !== undefined && (options.agent !== "claude" || ![3, 4].includes(options.targetClaudeVersion)))
+    throw new Error("Invalid Claude witness target version");
   const home = resolve18(options.home ?? homedir3()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
   const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
   if (!snapshot2 || sha4(snapshot2.text) !== options.expectedPolicySha256)
@@ -45421,7 +45449,7 @@ function planAgentSettingsWitnessUpgrade(options) {
       replaced.push(source);
     }
   }
-  const next = options.agent === "sumi" ? upgradeSumiSettingsWitness(previous, options.reviewedPreimage) : options.agent === "claude" ? upgradeClaudeSettingsWitness(previous, options.reviewedPreimage) : options.targetCodexVersion === 4 ? upgradeCodexSettingsWitnessV4(previous, options.reviewedPreimage) : options.targetCodexVersion === 3 ? upgradeCodexSettingsWitnessV3(previous, options.reviewedPreimage) : upgradeCodexSettingsWitness(previous, options.reviewedPreimage);
+  const next = options.agent === "sumi" ? upgradeSumiSettingsWitness(previous, options.reviewedPreimage) : options.agent === "claude" ? options.targetClaudeVersion === 4 ? upgradeClaudeSettingsWitnessV4(previous, options.reviewedPreimage) : upgradeClaudeSettingsWitness(previous, options.reviewedPreimage) : options.targetCodexVersion === 4 ? upgradeCodexSettingsWitnessV4(previous, options.reviewedPreimage) : options.targetCodexVersion === 3 ? upgradeCodexSettingsWitnessV3(previous, options.reviewedPreimage) : upgradeCodexSettingsWitness(previous, options.reviewedPreimage);
   const rebound = [];
   for (const source of binding.sources) {
     if (!replaced.includes(source)) {
@@ -45467,7 +45495,7 @@ function applyAgentIntegrationUnlocked(plan, options = {}, assertCurrent) {
     const upgrade = plan.settingsWitnessUpgrade;
     if (!plan.managedAgentChecks || !plan.observedPolicy?.before)
       throw new Error("Invalid settings witness upgrade plan");
-    const verified = planAgentSettingsWitnessUpgrade({ agent: upgrade.agent, ...upgrade.agent === "codex" ? { targetCodexVersion: upgrade.toHashMode === "codex-settings-v4" ? 4 : upgrade.toHashMode === "codex-settings-v3" ? 3 : 2 } : {}, reviewedPreimage: upgrade.reviewedPreimage, home: plan.managedAgentChecks.home, dataDir: plan.dataDir, expectedPolicySha256: sha4(plan.observedPolicy.before), expectedSettingsSha256: upgrade.currentSettingsSha256 });
+    const verified = planAgentSettingsWitnessUpgrade({ agent: upgrade.agent, ...upgrade.agent === "codex" ? { targetCodexVersion: upgrade.toHashMode === "codex-settings-v4" ? 4 : upgrade.toHashMode === "codex-settings-v3" ? 3 : 2 } : {}, ...upgrade.agent === "claude" && upgrade.toHashMode === "claude-settings-v4" ? { targetClaudeVersion: 4 } : {}, reviewedPreimage: upgrade.reviewedPreimage, home: plan.managedAgentChecks.home, dataDir: plan.dataDir, expectedPolicySha256: sha4(plan.observedPolicy.before), expectedSettingsSha256: upgrade.currentSettingsSha256 });
     if (JSON.stringify(verified.changes) !== JSON.stringify(plan.changes) || JSON.stringify(verified.settingsWitnessUpgrade) !== JSON.stringify(upgrade))
       throw new Error("Settings witness upgrade plan changed");
     provenDiscovery = verified.discoveryBefore[0];

package/dist/server/maintenance-entry.d.ts

@@ -9,7 +9,21 @@ type InspectionManifest = EnrollmentInspectionInput & {
     expiresAt: string;
     manifestDigest: string;
 };
+/** The schema census has its own authorization; no enrollment or inspection manifest can authorize it. */
+type SchemaCensusManifest = {
+    app: "skills";
+    operation: "inspect-schema";
+    manifestVersion: 1;
+    operationId: string;
+    stationId: string;
+    keyId: string;
+    orgId: string;
+    expiresAt: string;
+    manifestDigest: string;
+};
 /** Inspection has its own authorization; a failed enrollment manifest cannot authorize it. */
 export declare function readInspectionManifest(path: string, receiptPath: string): InspectionManifest;
+/** The census has its own authorization; a failed enrollment or inspection manifest cannot authorize it. */
+export declare function readSchemaCensusManifest(path: string, receiptPath: string): SchemaCensusManifest;
 export declare function registerMaintenance(parent: Command): void;
 export {};

package/dist/server/schema-census.d.ts

@@ -0,0 +1,77 @@
+/**
+ * One fixed, closed census of the Skills database maintenance surface.
+ *
+ * Why it exists (I6-00024): a production migration is held until the exact
+ * current registry, version ledger and migration ledger are read from the live
+ * database. The enrollment inspection answers a different question (one
+ * operator key), and no existing reader returns the fixed aggregate + ledger
+ * census. This module is that reader, and it is deliberately shaped so it
+ * cannot become a general SQL console:
+ *
+ *   - No target, query, schema or table input exists. The only argument is the
+ *     database URL, and the operation refuses to run unless the connection
+ *     resolves to the fixed public schema the Skills store uses.
+ *   - Every owned-table read is schema-qualified to `public`. A connection whose
+ *     search path falls through to a later schema cannot substitute another
+ *     schema's tables: a missing public table refuses (CENSUS_SCHEMA_UNAVAILABLE)
+ *     instead of counting rows that do not belong to the fixed target.
+ *   - The transaction is READ ONLY, REPEATABLE READ, with a five-second
+ *     statement timeout and a one-second lock timeout, asserted from inside the
+ *     read path rather than assumed.
+ *   - The output is a closed shape with per-field size bounds, a bounded
+ *     migration ledger and a total serialized-size gate. Nothing is truncated
+ *     silently: a census that would exceed a bound refuses instead.
+ *   - Nothing imports the application store: no initialization, migrations,
+ *     backfills or writes happen on this path.
+ */
+export interface SchemaCensusResult {
+    status: "inspected";
+    database: string;
+    role: string;
+    serverVersion: string;
+    schema: "public";
+    transaction: {
+        readOnly: true;
+        isolation: "repeatable read";
+        statementTimeoutMs: number;
+        lockTimeoutMs: number;
+    };
+    migrations: {
+        count: number;
+        versions: string[];
+    };
+    registry: {
+        rows: number;
+    };
+    versions: {
+        rows: number;
+    };
+    lifecycle: {
+        active: {
+            live: number;
+            tombstoned: number;
+        };
+        archived: {
+            live: number;
+            tombstoned: number;
+        };
+    };
+    authorizationEpoch: {
+        exists: false;
+    } | {
+        exists: true;
+        nullCount: number;
+    };
+}
+type CensusCode = "CENSUS_POSTGRES_REQUIRED" | "CENSUS_SCHEMA_UNAVAILABLE" | "CENSUS_ACCESS_DENIED" | "CENSUS_WRITE_REFUSED" | "CENSUS_TIMEOUT" | "CENSUS_CONNECTION_FAILED" | "CENSUS_TARGET_MISMATCH" | "CENSUS_INVALID_RESULT" | "CENSUS_OUTPUT_UNBOUNDED" | "CENSUS_FAILED";
+export declare class SchemaCensusError extends Error {
+    readonly code: CensusCode;
+    constructor(code: CensusCode);
+}
+/**
+ * Census metadata only. Deliberately does not import or initialize the application store.
+ *
+ * @param databaseUrl explicit PostgreSQL URL; there is no implicit localhost fallback.
+ */
+export declare function inspectSchemaCensus(databaseUrl: string): Promise<SchemaCensusResult>;
+export {};

package/docs/plugin-admission.md

@@ -239,8 +239,8 @@ Invalid values for the display preferences refuse capture and verification. Ever
 other field remains bound, including unknown future fields, hooks and their
 exact commands, permissions, native skill suppression and synchronization,
 plugin roots, marketplaces, environment and configuration precedence. Language,
-output style, theme, and command-bearing status or file suggestion settings are
-intentionally retained. These are narrow preference and inference-selection
+output style, theme (v4 alone permits the built-in theme values), and
+command-bearing status or file suggestion settings are intentionally retained. These are narrow preference and inference-selection
 exceptions, not general permission to change Claude configuration. The native
 bridge guard continues to check its exact commands and native Skill policy.
 
@@ -263,6 +263,43 @@ or guarantee when a running native client adopts a settings edit.
 Those complementary checks retain their existing exact registration and hook
 entry comparisons; this mode does not relax them for property-order changes.
 
+### Explicit v4 built-in theme reviews
+
+`claude-settings-v4` is an explicit successor to v3. It binds everything v3
+binds, with one more omission: the top-level `theme` key, and only when its
+value is exactly one of the built-in values `auto`, `dark`, `light`,
+`dark-daltonized`, `light-daltonized`, `dark-ansi` or `light-ansi`. The list is
+pinned in code (`CLAUDE_BUILTIN_THEMES`) from the
+[`theme` setting reference](https://code.claude.com/docs/en/settings-reference#theme)
+and the [built-in presets](https://code.claude.com/docs/en/terminal-config#match-the-color-theme),
+read on 2026-10-07. Custom and plugin themes (`custom:<slug>`,
+`custom:<plugin-name>:<slug>`) load theme files, so they stay bound, as does any
+other value, type, spelling or letter case, and any `theme` key nested inside
+another setting. `skipDangerousModePermissionPrompt`, permissions, hooks,
+environment, `apiKeyHelper` and other helpers, plugins, marketplaces, custom
+model values and unknown settings stay bound exactly as in v3. The digest is
+domain-separated from v3.
+
+Existing v1, v2 and v3 witnesses keep their meaning; nothing selects v4
+implicitly, and a stored witness is never rewritten. A policy opts in through
+either explicit path:
+
+- a fresh review: `skills hook witness --kind claude-settings-v4 --path
+  <settings.json> --json` (or `captureClaudeSettingsV4(path)`), placed in the
+  reviewed discovery inputs and applied with the normal `skills hook install
+  --discovery-inputs <file>` plan/apply flow;
+- a preserved-preimage upgrade: `skills hook rebind-settings --agent claude
+  --claude-witness-version 4 --reviewed-preimage <preserved-settings.json>
+  --expected-policy-sha256 <policy-hash> --expected-settings-sha256
+  <settings-hash>` (or `upgradeClaudeSettingsWitnessV4`). It accepts a raw, v1,
+  v2 or v3 witness, proves the preimage matches it in its original mode, and
+  refuses unless the current settings equal the preimage under v4. Without
+  `--claude-witness-version` the rebind target remains v3.
+
+Install a runtime that recognizes `claude-settings-v4`, including any bundled
+copy of the verifier, before a policy carries it; an older runtime refuses the
+unknown hash mode.
+
 ## Verification and limits
 
 Unit tests cover provenance and mapping failures, offline/revoked authorities,
@@ -367,8 +404,8 @@ witness intersecting the write still refuses instead of adopting a new inode.
 
 ## Codex bundled cleanup controls
 
-Qualified native skill review supports a narrow subset of Codex 0.159.2 and
-0.160.0's bundled cleanup hooks. The identities `browser`, `chrome`, `chrome-dev`,
+Qualified native skill review supports a narrow subset of Codex 0.159.2,
+0.160.0 and 0.160.1's bundled cleanup hooks. The identities `browser`, `chrome`, `chrome-dev`,
 `chrome-internal` and `computer-use` in `openai-bundled` may call
 `node_repl.turn_ended`; `unified-computer-use` may call `cua_repl.turn_ended`.
 Only `Interrupt`, `SubagentStop` and `Stop` are accepted, with one group and one
@@ -384,4 +421,6 @@ apply and subsequent discovery checks. This review preserves native cleanup;
 it neither enables plugins nor grants hook trust, browser authority or signing.
 The upstream contracts are
 [0.159.2 bundled hooks](https://github.com/openai/codex/blob/ff6aec96948b70d94983af2641a6b67c94faeff5/codex-rs/plugin/src/bundled_hooks.rs)
-and [0.160.0 bundled hooks](https://github.com/openai/codex/blob/a956835d020762cb2b570053af06f643a11c0ecc/codex-rs/plugin/src/bundled_hooks.rs).
+and [0.160.0 bundled hooks](https://github.com/openai/codex/blob/a956835d020762cb2b570053af06f643a11c0ecc/codex-rs/plugin/src/bundled_hooks.rs);
+0.160.1 carries the identical file
+([0.160.1 bundled hooks](https://github.com/openai/codex/blob/d27764b82f7118f674371e6d6e76271d9d606edb/codex-rs/plugin/src/bundled_hooks.rs)).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.49",
+  "version": "0.10.51",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {