@hasna/skills 0.10.51 → 0.10.52

package/dist/lib/agent-discovery.d.ts

@@ -7,10 +7,12 @@ export { captureDiscoveryDirectories, type DiscoveryDirectory } from "./agent-di
 export interface DiscoverySource {
     path: string;
     sha256: string | null;
-    hashMode?: "bytes" | "path-bytes" | "claude-plugin-manifest-v1" | "claude-plugin-registry" | "claude-marketplace-registry" | "claude-settings-v1" | "claude-settings-v2" | "claude-settings-v3" | "claude-settings-v4" | "claude-marketplace-registry-v2" | "codex-settings-v1" | "codex-settings-v2" | "codex-settings-v3" | "codex-settings-v4" | "sumi-settings-v1";
+    hashMode?: "bytes" | "path-bytes" | "claude-plugin-manifest-v1" | "claude-plugin-registry" | "claude-marketplace-registry" | "claude-settings-v1" | "claude-settings-v2" | "claude-settings-v3" | "claude-settings-v4" | "claude-marketplace-registry-v2" | "codex-settings-v1" | "codex-settings-v2" | "codex-settings-v3" | "codex-settings-v4" | "sumi-settings-v1" | "claude-marketplace-entry-v1";
     managedPlugins?: ManagedPluginRegistrationWitness[];
     format?: "json" | "toml" | "yaml";
     fields?: string[];
+    marketplace?: string;
+    plugin?: string;
 }
 export interface AgentDiscoveryBinding {
     agent: IntegrationAgent;
@@ -34,6 +36,27 @@ export interface AgentDiscoveryBinding {
         directories?: DiscoveryDirectory[];
     };
 }
+/** An environment gap, not drift: the runtime a review saw cannot be resolved
+ * from this process, so its discovery cannot be re-derived. Callers keep it
+ * blocking and must not report it as NATIVE_SKILL_DRIFT. */
+export declare const DISCOVERY_ROOT_UNRESOLVED = "DISCOVERY_ROOT_UNRESOLVED";
+export declare function discoveryRootUnresolved(agent: IntegrationAgent, command: string, detail: string): Error;
+export declare function isDiscoveryRootUnresolved(error: unknown): error is Error;
+/** The runtime executable a discovery review resolved through PATH, with the
+ * realpath its launcher led to. The policy stores it beside the binding
+ * (bridge.discoveryExecutables), not inside it, so a consumer that compares
+ * stored bindings keeps the shape it already knows. */
+export interface DiscoveryExecutable {
+    command: string;
+    path: string;
+    target: string;
+}
+/** Resolve the agent's runtime command through this process's PATH: the
+ * executable this process would actually run. */
+export declare function discoveryExecutable(agent: IntegrationAgent): DiscoveryExecutable | null;
+/** Check a recorded executable by its exact path, ignoring PATH. Null when the
+ * path no longer resolves (missing, dangling, ENOTDIR, EACCES). */
+export declare function recordedDiscoveryExecutable(agent: IntegrationAgent, recorded: DiscoveryExecutable): DiscoveryExecutable | null;
 export interface ReviewedDiscoveryInputs {
     version: 1;
     agents: Array<{
@@ -63,10 +86,23 @@ export declare function assertProjectDiscovery(agent: IntegrationAgent, director
 /** Resolve configured plugin discovery without starting an agent or loading a plugin.
  * Unknown runtime registrations require explicit reviewed inputs, never a cache guess. */
 export declare function agentDiscoveryConfigPath(home: string, agent: IntegrationAgent): string;
+/** Re-derive an automatic binding and compare it with the stored one. A
+ * mismatch is drift, except when the only difference is a runtime this process
+ * cannot resolve: then it is DISCOVERY_ROOT_UNRESOLVED, which stays blocking. */
+export declare function verifyAutomaticDiscoveryClosure(binding: AgentDiscoveryBinding, options: {
+    home: string;
+    canonical: (path: string) => string;
+    change: string;
+    executable?: DiscoveryExecutable;
+}): void;
+/** `executable` is the agent's runtime: omitted, it is resolved through PATH;
+ * a value (or null for none) is used as given, so verification never depends
+ * on the caller's PATH. */
 export declare function resolveAgentDiscovery(options: {
     home: string;
     agent: IntegrationAgent;
     reviewed?: ReviewedDiscoveryInputs;
     retainedReview?: AgentDiscoveryBinding;
     canonical?: (path: string) => string;
+    executable?: DiscoveryExecutable | null;
 }): AgentDiscoveryBinding;

package/dist/lib/agent-integration.d.ts

@@ -2,7 +2,7 @@ import { type CodexCorpusWriteOptions } from "./codex-corpus-write.js";
 import { type ReviewedCodexSkillDenial } from "./codex-plugin-skill-controls.js";
 import { type CodexNativeHookEnvelope, type ProcessInspector, type NativePolicyHelperRunner } from "./codex-native-skill-policy.js";
 import { type CodexNativeSkillCatalog } from "./codex-native-skill-catalog.js";
-import { type AgentDiscoveryBinding, type ReviewedDiscoveryInputs } from "./agent-discovery.js";
+import { type DiscoveryExecutable, type AgentDiscoveryBinding, type ReviewedDiscoveryInputs } from "./agent-discovery.js";
 import { type IntegrationAgent } from "./agent-adapters.js";
 import type { CodexHookDiscoveryRecovery } from "./codex-hook-discovery-recovery.js";
 import { type ClaudeCoordinatedHookEvent } from "./claude-settings-witness.js";
@@ -85,6 +85,7 @@ export interface AgentIntegrationPlan {
     };
     discoveryBefore?: AgentDiscoveryBinding[];
     discoveryAfter?: AgentDiscoveryBinding[];
+    discoveryExecutables?: Record<string, DiscoveryExecutable>;
     rootAliases?: AgentRootAlias[];
     managedAgentChecks?: {
         home: string;
@@ -96,6 +97,8 @@ export interface AgentIntegrationPlan {
         agents: IntegrationAgent[];
     };
 }
+/** Normalize only the verified OS prefix, never hide user-controlled links. */
+export declare function canonicalSystemPath(path: string): string;
 /** Parse the reviewed exact-target binding used by native migration. Paths are
  * deliberately project-relative so a manifest cannot silently select another
  * checkout when a project root changes. */

package/dist/lib/claude-marketplace-entry-witness.d.ts

@@ -0,0 +1,26 @@
+import { type ClaudeSettingsWitnessBudget } from "./claude-settings-witness.js";
+export declare const CLAUDE_MARKETPLACE_ENTRY_HASH_MODE: "claude-marketplace-entry-v1";
+export interface ClaudeMarketplaceEntrySelector {
+    marketplace: string;
+    plugin: string;
+}
+export interface ClaudeMarketplaceEntryWitness {
+    path: string;
+    hashMode: typeof CLAUDE_MARKETPLACE_ENTRY_HASH_MODE;
+    marketplace: string;
+    plugin: string;
+    sha256: string;
+}
+/** Selector and path checks shared by capture, discovery binding and the stored policy bounds. */
+export declare function claudeMarketplaceEntrySourceValid(source: {
+    path?: unknown;
+    marketplace?: unknown;
+    plugin?: unknown;
+}): boolean;
+/** Digest the reviewed entry from marketplace.json text. Refuses rather than
+ * guessing whenever the selected entry or its resolution context is ambiguous. */
+export declare function hashClaudeMarketplaceEntry(text: string, selector: ClaudeMarketplaceEntrySelector): string;
+/** Capture an explicit review witness from a stable regular marketplace.json.
+ * Symlinked ancestors, special files, oversized files and concurrent
+ * replacement refuse; capture writes nothing. */
+export declare function captureClaudeMarketplaceEntry(path: string, marketplace: string, plugin: string, budget?: ClaudeSettingsWitnessBudget): ClaudeMarketplaceEntryWitness;

package/dist/lib/claude-settings-witness.d.ts

@@ -9,7 +9,30 @@ export declare const CLAUDE_SETTINGS_WITNESS_LIMITS: Readonly<{
 export interface ClaudeSettingsWitnessBudget {
     remaining: number;
 }
-export declare function readNativeSettingsWitnessFile(path: string, budget: ClaudeSettingsWitnessBudget, filename?: "settings.json" | "config.toml" | "sumi.json"): string;
+export declare function readNativeSettingsWitnessFile(path: string, budget: ClaudeSettingsWitnessBudget, filename?: "settings.json" | "config.toml" | "sumi.json" | "marketplace.json"): string;
+export type NativeJsonObject = ObjectValue;
+export type NativeJsonValue = Value;
+type ObjectValue = {
+    kind: "object";
+    entries: Array<[string, Value]>;
+};
+type Value = ObjectValue | {
+    kind: "array";
+    items: Value[];
+} | {
+    kind: "string";
+    value: string;
+} | {
+    kind: "number";
+    value: string;
+} | {
+    kind: "literal";
+    value: "true" | "false" | "null";
+};
+/** The same strict syntax tree for other bounded native JSON witnesses:
+ * duplicate decoded keys refuse, numbers keep their spelling, and the byte,
+ * depth, node, string and top-level field limits above apply unchanged. */
+export declare function parseNativeJsonObject(text: string): NativeJsonObject;
 export declare const CLAUDE_BUILTIN_THEMES: readonly ["auto", "dark", "light", "dark-daltonized", "light-daltonized", "dark-ansi", "light-ansi"];
 /** Cooperating installers may replace only their explicitly selected event. Compare the strict syntax
  * trees, not JSON.parse values or the preference-tolerant witness digest: all
@@ -76,3 +99,4 @@ export declare function hashNativeJsonControls(text: string, excludedMetadata?:
  * tree. Unknown fields, permissions, routing and executable inputs stay bound.
  * Only schema/display strings and two presentation-only booleans may vary. */
 export declare function hashSumiNativeJsonControls(text: string): string;
+export {};

package/dist/lib/codex-hook-trust-files.d.ts

@@ -1,5 +1,22 @@
 import { type BigIntStats } from "node:fs";
 export declare function need(value: unknown, code: string): asserts value;
+/** The owner of a directory can rename or replace its entries whatever its
+ * mode, so an ancestor must belong to root or the current user. There is no
+ * allowlist: a prefix such as /opt/homebrew passes only when one of them owns it. */
+export declare function trustedAncestorOwner(uid: number | bigint): boolean;
+/** Every ancestor directory of `file`: a real directory, owned by root or the
+ * current user, and writable by neither group nor others unless it is a
+ * root-owned sticky directory. Throws CODEX_HOOK_TRUST_UNSAFE_PARENT. */
+export declare function safeParents(file: string): void;
+/** The path a symbolic link names, when that text cannot pass through another
+ * link: an absolute text of plain names, or a relative text that leaves the
+ * link's own directory only through leading `..` components and then names
+ * plain entries. Undefined for any other text. The caller has verified the
+ * link's directory chain as real directories, so the leading `..` steps stay
+ * on verified directories, and requires the result to equal realpath, which
+ * proves that no named component is itself a link: the command leaf is then
+ * the only alias in the chain. */
+export declare function directAliasTarget(link: string): string | undefined;
 export declare function snapshot(file: string, privateFile?: boolean, options?: {
     readOnlyPackage?: true;
 }): {

package/dist/lib/selection-cache.d.ts

@@ -2,7 +2,7 @@ import { type SkillBundleEntry } from "./skill-bundle.js";
 import type { ResolvedSkillProfile, ResolvedSkillSelection } from "../types/skill-selection.js";
 export declare class SkillSelectionError extends Error {
     readonly code: string;
-    constructor(code: string, message: string);
+    constructor(code: string, message: string, options?: ErrorOptions);
 }
 export interface SelectionCacheOptions {
     cacheDir?: string;
@@ -44,7 +44,7 @@ export declare function validateSelection(selection: ResolvedSkillSelection): vo
 export declare function validateResolvedProfile(profile: ResolvedSkillProfile, authority?: string): void;
 export declare function selectionBundlePath(selection: ResolvedSkillSelection, options?: SelectionCacheOptions): string;
 export declare function writeSelectionJson(path: string, value: unknown): void;
-export declare function readSelectionJson<T>(path: string): T | null;
+export declare function readSelectionJson<T>(path: string, maximumBytes?: number): T | null;
 export declare function readCachedSelection(selection: ResolvedSkillSelection, options?: SelectionCacheOptions): Promise<SkillBundleEntry[] | null>;
 /** Verify an authenticated exact-version response without changing any cache or receipt. */
 export declare function verifySelectionBundleResponse(selection: ResolvedSkillSelection, response: Response | null, signal?: AbortSignal, deadline?: number): Promise<{

package/dist/lib/session-reconciliation.d.ts

@@ -32,6 +32,15 @@ export declare function inspectSkillSession(sessionId: string, options?: Selecti
 };
 /** Fits inside the managed context child's 6.5-second ceiling, including CLI work. */
 export declare const SESSION_RENEWAL_TIMEOUT_MS = 4000;
+/**
+ * A definitive automatic renewal refusal is remembered briefly so the managed
+ * hook does not resolve the whole profile again on every prompt. The record
+ * only ever repeats that refusal: it never authorizes, renews or writes a pin.
+ * It binds the exact receipt bytes, profile, authority, workspace and the
+ * locally synced profile revision, and lapses after a fixed window that the
+ * file cannot extend. Anything unexpected is ignored and the authority is asked.
+ */
+export declare const SESSION_RENEWAL_REFUSAL_TTL_MS: number;
 /**
  * Renew authorization for the complete immutable pin; never manufacture a
  * profile combining historical loaded versions with current unloaded versions.