@hasna/skills 0.10.5 → 0.10.8

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.5",
+    version: "0.10.8",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -36930,6 +36930,7 @@ var init_package = __esm(() => {
       migrate: "bun run ./src/server/migrate.ts",
       typecheck: "tsc --noEmit",
       "verify:release": "bun run scripts/release-guard.ts",
+      "verify:release-review": "bun run scripts/verify-release-review.ts",
       "verify:consumer-types": "bun run scripts/consumer-types.ts",
       prepack: "bun run verify:generated && bun run verify:release && bun run verify:consumer-types",
       prepublishOnly: "bun run verify:producer && bun run typecheck && bun run test",
@@ -51957,6 +51958,9 @@ function assertManagedAgentBridge(agent, options = {}) {
     const runtimeCache = canonicalAgentPath(join20(home, ".cache", "codex-runtimes"), aliases);
     if (entry.path.startsWith(runtimeCache + sep4) && discovery?.method === "automatic" && discovery.roots.some((root) => entry.path.startsWith(root + sep4)))
       return true;
+    const bundledMarketplaces = canonicalAgentPath(join20(home, ".codex", ".tmp", "bundled-marketplaces"), aliases);
+    if (entry.path.startsWith(bundledMarketplaces + sep4) && discovery?.method === "automatic" && discovery.roots.some((root) => entry.path.startsWith(root + sep4)))
+      return true;
     if (!entry.path.startsWith(canonicalAgentPath(join20(home, ".codex", "skills", ".system"), aliases) + sep4))
       return false;
     return Array.isArray(binding.disabledBuiltins) && binding.disabledBuiltins.some((item) => item.path === entry.path && item.hash === entry.hash);
@@ -55360,6 +55364,7 @@ function rebindAgentDiscovery(binding, changes) {
   }) };
 }
 function assertProjectDiscovery(agent, directories, home, canonical4 = resolve15, reviewed) {
+  const homeConfigPath = canonical4(agentDiscoveryConfigPath(home, agent));
   for (const directory of directories) {
     const isHome = resolve15(directory) === resolve15(home);
     if (agent === "hermes") {
@@ -55373,7 +55378,8 @@ function assertProjectDiscovery(agent, directories, home, canonical4 = resolve15
       const path = canonical4(join31(directory, suffix)), raw = read2(path);
       if (raw === null)
         continue;
-      if (agent === "claude" && suffix === ".claude/settings.json" && path === canonical4(join31(home, suffix)))
+      const isRootAliasedHomeConfig = agent === "claude" && suffix === ".claude/settings.json" || agent === "codex" && suffix === ".codex/config.toml";
+      if (isRootAliasedHomeConfig && path === homeConfigPath)
         continue;
       if (suffix.endsWith(".jsonc"))
         throw new Error(`NATIVE_SKILL_DRIFT: project JSONC discovery configuration requires review: ${path}`);
@@ -109698,7 +109704,7 @@ async function connectCodexHookRpc(options) {
 }
 var SUPPORTED_CODEX_HOOK_VERSIONS;
 var init_codex_hook_rpc = __esm(() => {
-  SUPPORTED_CODEX_HOOK_VERSIONS = ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1"];
+  SUPPORTED_CODEX_HOOK_VERSIONS = ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1"];
 });
 
 // src/lib/codex-hook-trust-identity.ts

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.5",
+    version: "0.10.8",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -20081,6 +20081,7 @@ var init_package = __esm(() => {
       migrate: "bun run ./src/server/migrate.ts",
       typecheck: "tsc --noEmit",
       "verify:release": "bun run scripts/release-guard.ts",
+      "verify:release-review": "bun run scripts/verify-release-review.ts",
       "verify:consumer-types": "bun run scripts/consumer-types.ts",
       prepack: "bun run verify:generated && bun run verify:release && bun run verify:consumer-types",
       prepublishOnly: "bun run verify:producer && bun run typecheck && bun run test",

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.5",
+  version: "0.10.8",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -69,6 +69,7 @@ var package_default = {
     migrate: "bun run ./src/server/migrate.ts",
     typecheck: "tsc --noEmit",
     "verify:release": "bun run scripts/release-guard.ts",
+    "verify:release-review": "bun run scripts/verify-release-review.ts",
     "verify:consumer-types": "bun run scripts/consumer-types.ts",
     prepack: "bun run verify:generated && bun run verify:release && bun run verify:consumer-types",
     prepublishOnly: "bun run verify:producer && bun run typecheck && bun run test",

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.5",
+  version: "0.10.8",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -24184,6 +24184,7 @@ var package_default = {
     migrate: "bun run ./src/server/migrate.ts",
     typecheck: "tsc --noEmit",
     "verify:release": "bun run scripts/release-guard.ts",
+    "verify:release-review": "bun run scripts/verify-release-review.ts",
     "verify:consumer-types": "bun run scripts/consumer-types.ts",
     prepack: "bun run verify:generated && bun run verify:release && bun run verify:consumer-types",
     prepublishOnly: "bun run verify:producer && bun run typecheck && bun run test",

package/bin/worker.js

@@ -24125,7 +24125,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.5",
+  version: "0.10.8",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -24187,6 +24187,7 @@ var package_default = {
     migrate: "bun run ./src/server/migrate.ts",
     typecheck: "tsc --noEmit",
     "verify:release": "bun run scripts/release-guard.ts",
+    "verify:release-review": "bun run scripts/verify-release-review.ts",
     "verify:consumer-types": "bun run scripts/consumer-types.ts",
     prepack: "bun run verify:generated && bun run verify:release && bun run verify:consumer-types",
     prepublishOnly: "bun run verify:producer && bun run typecheck && bun run test",

package/dist/index.js

@@ -9611,7 +9611,7 @@ import { isAbsolute as isAbsolute11, join as join23, resolve as resolve11 } from
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.5",
+  version: "0.10.8",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -9673,6 +9673,7 @@ var package_default = {
     migrate: "bun run ./src/server/migrate.ts",
     typecheck: "tsc --noEmit",
     "verify:release": "bun run scripts/release-guard.ts",
+    "verify:release-review": "bun run scripts/verify-release-review.ts",
     "verify:consumer-types": "bun run scripts/consumer-types.ts",
     prepack: "bun run verify:generated && bun run verify:release && bun run verify:consumer-types",
     prepublishOnly: "bun run verify:producer && bun run typecheck && bun run test",
@@ -14136,6 +14137,9 @@ function assertManagedAgentBridge(agent, options = {}) {
     const runtimeCache = canonicalAgentPath(join16(home, ".cache", "codex-runtimes"), aliases);
     if (entry.path.startsWith(runtimeCache + sep4) && discovery?.method === "automatic" && discovery.roots.some((root) => entry.path.startsWith(root + sep4)))
       return true;
+    const bundledMarketplaces = canonicalAgentPath(join16(home, ".codex", ".tmp", "bundled-marketplaces"), aliases);
+    if (entry.path.startsWith(bundledMarketplaces + sep4) && discovery?.method === "automatic" && discovery.roots.some((root) => entry.path.startsWith(root + sep4)))
+      return true;
     if (!entry.path.startsWith(canonicalAgentPath(join16(home, ".codex", "skills", ".system"), aliases) + sep4))
       return false;
     return Array.isArray(binding.disabledBuiltins) && binding.disabledBuiltins.some((item) => item.path === entry.path && item.hash === entry.hash);
@@ -16867,6 +16871,7 @@ function captureDiscoveryPathSources(paths) {
   return paths.map((path) => ({ path, hashMode: "path-bytes", sha256: hashDiscoveryPathFile(path, budget) }));
 }
 function assertProjectDiscovery(agent, directories, home, canonical4 = resolve14, reviewed) {
+  const homeConfigPath = canonical4(agentDiscoveryConfigPath(home, agent));
   for (const directory of directories) {
     const isHome = resolve14(directory) === resolve14(home);
     if (agent === "hermes") {
@@ -16880,7 +16885,8 @@ function assertProjectDiscovery(agent, directories, home, canonical4 = resolve14
       const path = canonical4(join26(directory, suffix)), raw = read2(path);
       if (raw === null)
         continue;
-      if (agent === "claude" && suffix === ".claude/settings.json" && path === canonical4(join26(home, suffix)))
+      const isRootAliasedHomeConfig = agent === "claude" && suffix === ".claude/settings.json" || agent === "codex" && suffix === ".codex/config.toml";
+      if (isRootAliasedHomeConfig && path === homeConfigPath)
         continue;
       if (suffix.endsWith(".jsonc"))
         throw new Error(`NATIVE_SKILL_DRIFT: project JSONC discovery configuration requires review: ${path}`);

package/dist/lib/codex-hook-rpc.d.ts

@@ -1,4 +1,4 @@
-export declare const SUPPORTED_CODEX_HOOK_VERSIONS: readonly ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1"];
+export declare const SUPPORTED_CODEX_HOOK_VERSIONS: readonly ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1"];
 export interface CodexHookRpc {
     version: string;
     processId?: number;

package/dist/lib/release-review-linkage.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Release review linkage for @hasna/skills npm releases.
+ *
+ * WHY THIS EXISTS
+ *
+ * @hasna/skills 0.10.5 and 0.10.6 reached npm without the release authority's
+ * required pre-upload linkage: an independent reviewer's GO in git-prs and the
+ * git-publishing intent thread, bound to the exact candidate AND to the packed
+ * tarball that was uploaded. A published version cannot be unpublished, so the only
+ * place a release can refuse is BEFORE the upload.
+ *
+ * The binding lives in the annotated release tag message, which is created
+ * before the tag is pushed and is covered by the same protected-main ancestry
+ * the release workflow already requires:
+ *
+ *   @hasna/skills 0.10.7
+ *
+ *   <release notes>
+ *
+ *   Release-Review-Agent: <registered reviewer coding-agent identity>
+ *   Git-Publishing-Thread: <release intent thread id>
+ *   Git-Prs-GO: <message id of the independent GO in git-prs for this candidate>
+ *   Packed-SHA256: <64 lowercase hex>
+ *
+ * "EXACTLY" is enforced, not implied: each of the four linkage keys must appear
+ * exactly once, the linkage namespace is closed (a fifth Release-Review-* /
+ * Git-Publishing-* / Git-Prs-* / Packed-* key is a failure, so a field can never be silently
+ * swapped for a look-alike), values are strictly shaped, and the recorded
+ * Packed-SHA256 must equal the SHA-256 of the tarball this checkout actually
+ * packs. There is no fallback: a missing, duplicated, malformed or mismatched
+ * field refuses the release.
+ *
+ * The reviewer's digest must be produced with the release toolchain at the exact
+ * commit (see scripts/RELEASE.md): `npm pack --ignore-scripts` in apps/skills
+ * after `bun run build`, hashed with SHA-256. A digest taken from a different
+ * toolchain, a different commit or a differently-built tree does not match by
+ * design, and the mismatch is the gate doing its job.
+ *
+ * This module is pure: git and npm I/O stay in scripts/verify-release-review.ts,
+ * and the release workflow runs `bun run verify:release-review` before it is
+ * allowed to publish.
+ */
+export declare const SKILLS_RELEASE_REPOSITORY = "hasna/apps";
+export declare const SKILLS_RELEASE_REPOSITORY_URL = "https://github.com/hasna/apps.git";
+export declare const SKILLS_RELEASE_PACKAGE_PATH = "apps/skills";
+export declare const SKILLS_RELEASE_MANIFEST_PATH = "apps/skills/package.json";
+export declare const SKILLS_RELEASE_PACKAGE_NAME = "@hasna/skills";
+export declare const SKILLS_RELEASE_REGISTRY = "https://registry.npmjs.org";
+export declare const SKILLS_RELEASE_TAG_PREFIX = "npm/skills/v";
+/** Field names carried by the annotated release tag message, in required order. */
+export declare const RELEASE_REVIEW_LINKAGE_FIELDS: {
+    readonly reviewerAgent: "Release-Review-Agent";
+    readonly goThreadId: "Git-Publishing-Thread";
+    readonly goMessageId: "Git-Prs-GO";
+    readonly packedSha256: "Packed-SHA256";
+};
+export type ReleaseReviewLinkageFailure = {
+    check: string;
+    message: string;
+};
+export type ReleaseReviewLinkage = {
+    /** The registered coding-agent identity that performed the independent review. */
+    reviewerAgent: string;
+    /** Release intent thread in the git-publishing lane. */
+    goThreadId: string;
+    /** Message id of the independent GO in git-prs bound to this exact candidate. */
+    goMessageId: string;
+    /** SHA-256 of the packed release tarball, lowercase hex. */
+    packedSha256: string;
+};
+export type ReleaseReviewLinkageInput = {
+    tagMessage: string;
+    tag: string;
+    /** `git cat-file -t refs/tags/<tag>`; must be `tag` for an annotated tag. */
+    tagType: string;
+    /** `git rev-parse refs/tags/<tag>^{commit}`. */
+    tagCommit: string;
+    /** The exact checkout being released. */
+    releaseCommit: string;
+    packageName: string;
+    packageVersion: string;
+    repositoryUrl: string | undefined;
+    repositoryDirectory: string | undefined;
+    registry: string | undefined;
+    access: string | undefined;
+    /** SHA-256 computed from the tarball this checkout packs, when packing ran. */
+    packedSha256: string | undefined;
+};
+/** Resolve the semver a release tag carries, or undefined for any other tag. */
+export declare function parseSkillsReleaseTagVersion(tag: string): string | undefined;
+/**
+ * Parse the four linkage fields out of the annotated release tag message.
+ * Prose (subject and release notes) is allowed; the linkage namespace is not.
+ */
+export declare function parseReleaseReviewLinkage(tagMessage: string): {
+    linkage: Partial<ReleaseReviewLinkage>;
+    failures: ReleaseReviewLinkageFailure[];
+};
+/**
+ * The complete preflight: tagged candidate identity, package binding and the
+ * packed digest recorded in the tag. Returns every failure it finds so one run
+ * names all of them; any failure refuses the release.
+ */
+export declare function validateReleaseReviewLinkage(input: ReleaseReviewLinkageInput): ReleaseReviewLinkageFailure[];

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.5",
+  version: "0.10.8",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -32435,6 +32435,7 @@ var package_default = {
     migrate: "bun run ./src/server/migrate.ts",
     typecheck: "tsc --noEmit",
     "verify:release": "bun run scripts/release-guard.ts",
+    "verify:release-review": "bun run scripts/verify-release-review.ts",
     "verify:consumer-types": "bun run scripts/consumer-types.ts",
     prepack: "bun run verify:generated && bun run verify:release && bun run verify:consumer-types",
     prepublishOnly: "bun run verify:producer && bun run typecheck && bun run test",
@@ -40665,6 +40666,7 @@ function captureDiscoveryPathSources(paths) {
   return paths.map((path) => ({ path, hashMode: "path-bytes", sha256: hashDiscoveryPathFile(path, budget) }));
 }
 function assertProjectDiscovery(agent, directories, home, canonical4 = resolve13, reviewed) {
+  const homeConfigPath = canonical4(agentDiscoveryConfigPath(home, agent));
   for (const directory of directories) {
     const isHome = resolve13(directory) === resolve13(home);
     if (agent === "hermes") {
@@ -40678,7 +40680,8 @@ function assertProjectDiscovery(agent, directories, home, canonical4 = resolve13
       const path = canonical4(join20(directory, suffix)), raw = read2(path);
       if (raw === null)
         continue;
-      if (agent === "claude" && suffix === ".claude/settings.json" && path === canonical4(join20(home, suffix)))
+      const isRootAliasedHomeConfig = agent === "claude" && suffix === ".claude/settings.json" || agent === "codex" && suffix === ".codex/config.toml";
+      if (isRootAliasedHomeConfig && path === homeConfigPath)
         continue;
       if (suffix.endsWith(".jsonc"))
         throw new Error(`NATIVE_SKILL_DRIFT: project JSONC discovery configuration requires review: ${path}`);
@@ -42007,6 +42010,9 @@ function assertManagedAgentBridge(agent, options = {}) {
     const runtimeCache = canonicalAgentPath(join21(home, ".cache", "codex-runtimes"), aliases);
     if (entry.path.startsWith(runtimeCache + sep4) && discovery?.method === "automatic" && discovery.roots.some((root2) => entry.path.startsWith(root2 + sep4)))
       return true;
+    const bundledMarketplaces = canonicalAgentPath(join21(home, ".codex", ".tmp", "bundled-marketplaces"), aliases);
+    if (entry.path.startsWith(bundledMarketplaces + sep4) && discovery?.method === "automatic" && discovery.roots.some((root2) => entry.path.startsWith(root2 + sep4)))
+      return true;
     if (!entry.path.startsWith(canonicalAgentPath(join21(home, ".codex", "skills", ".system"), aliases) + sep4))
       return false;
     return Array.isArray(binding.disabledBuiltins) && binding.disabledBuiltins.some((item) => item.path === entry.path && item.hash === entry.hash);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.5",
+  "version": "0.10.8",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {
@@ -62,6 +62,7 @@
     "migrate": "bun run ./src/server/migrate.ts",
     "typecheck": "tsc --noEmit",
     "verify:release": "bun run scripts/release-guard.ts",
+    "verify:release-review": "bun run scripts/verify-release-review.ts",
     "verify:consumer-types": "bun run scripts/consumer-types.ts",
     "prepack": "bun run verify:generated && bun run verify:release && bun run verify:consumer-types",
     "prepublishOnly": "bun run verify:producer && bun run typecheck && bun run test",