@hasna/skills 0.10.58 → 0.10.59

package/bin/index.js

@@ -36888,7 +36888,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.58",
+    version: "0.10.59",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -116856,7 +116856,7 @@ function reviewClaudeProspectiveCandidate(request2, requestFileSha256) {
   const pluginRootStat = lstatSync37(pluginRoot, { throwIfNoEntry: false });
   if (pluginRootStat && (!pluginRootStat.isDirectory() || pluginRootStat.isSymbolicLink()))
     refuse6("Claude plugin root is not a regular directory");
-  keys3(request2.candidate, ["marketplace", "root", "catalogPath", "catalogSha256", "closureSha256", "plugins", ...hasOwn2(request2.candidate, "releaseManifest") ? ["releaseManifest"] : [], ...hasOwn2(request2.candidate, "functionHooksEnv") ? ["functionHooksEnv"] : []], "candidate");
+  keys3(request2.candidate, ["marketplace", "root", "catalogPath", "catalogSha256", "closureSha256", "plugins", ...hasOwn2(request2.candidate, "releaseManifest") ? ["releaseManifest"] : [], ...hasOwn2(request2.candidate, "functionHooksEnv") ? ["functionHooksEnv"] : [], ...hasOwn2(request2.candidate, "settingsMarketplaceSource") ? ["settingsMarketplaceSource"] : []], "candidate");
   const candidate2 = request2.candidate;
   canonicalDir(candidate2.root, "candidate root");
   if (typeof candidate2.marketplace !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(candidate2.marketplace))
@@ -116865,6 +116865,8 @@ function reviewClaudeProspectiveCandidate(request2, requestFileSha256) {
     refuse6("candidate must select between one and 32 plugins from one marketplace");
   if (candidate2.functionHooksEnv !== undefined && candidate2.functionHooksEnv !== "1")
     refuse6("function-hook environment mutation only supports the explicit value 1");
+  if (hasOwn2(candidate2, "settingsMarketplaceSource") && (candidate2.settingsMarketplaceSource !== "directory" || request2.scope.kind !== "user" || !["2.1.293", "2.1.293 (Claude Code)"].includes(request2.native.executable.version)))
+    refuse6("settings marketplace source operation requires directory source and the measured Claude 2.1.293 user scope");
   abs(candidate2.catalogPath, "catalog path");
   if (!candidate2.catalogPath.startsWith(candidate2.root + sep15))
     refuse6("catalog must be inside the frozen candidate root");
@@ -117011,6 +117013,30 @@ function reviewClaudeProspectiveCandidate(request2, requestFileSha256) {
   const registrations = jsonFile(expectedPaths.installedPlugins, "Claude installed plugins");
   if (registrations && (registrations.version !== 2 || !object11(registrations.plugins)))
     refuse6("current installed plugin registry has an unsupported shape");
+  if (candidate2.settingsMarketplaceSource === "directory" && registrations) {
+    keys3(registrations, ["version", "plugins"], "current complete installed plugin registry");
+    for (const rows of Object.values(registrations.plugins)) {
+      if (!Array.isArray(rows))
+        refuse6("current installed plugin rows are not an array");
+      for (const row2 of rows) {
+        if (!object11(row2))
+          refuse6("current installed plugin row is not an object");
+        keys3(row2, ["scope", "installPath", "version", "installedAt", "lastUpdated", ...Object.hasOwn(row2, "projectPath") ? ["projectPath"] : [], ...Object.hasOwn(row2, "gitCommitSha") ? ["gitCommitSha"] : []], "current complete installed plugin row");
+        if (!["user", "project", "local"].includes(row2.scope) || typeof row2.version !== "string" || !row2.version)
+          refuse6("current installed plugin scope or version is invalid");
+        abs(row2.installPath, "current installed plugin path");
+        if (row2.scope === "user") {
+          if (Object.hasOwn(row2, "projectPath"))
+            refuse6("current user plugin row has a project path");
+        } else
+          abs(row2.projectPath, "current installed plugin project path");
+        if (!validUtcTimestamp(row2.installedAt) || !validUtcTimestamp(row2.lastUpdated))
+          refuse6("current installed plugin timestamps are invalid");
+        if (Object.hasOwn(row2, "gitCommitSha") && (typeof row2.gitCommitSha !== "string" || !/^[a-f0-9]{40}$/.test(row2.gitCommitSha)))
+          refuse6("current installed plugin Git commit is outside the measured preservation contract");
+      }
+    }
+  }
   const settingsAfter = settings ? structuredClone(settings) : {};
   if (settingsAfter.enabledPlugins === undefined)
     settingsAfter.enabledPlugins = {};
@@ -117088,8 +117114,48 @@ function reviewClaudeProspectiveCandidate(request2, requestFileSha256) {
       refuse6("target settings env is not an object");
     settingsAfter.env = { ...env3, CLAUDE_CODE_ENABLE_FUNCTION_HOOKS: "1" };
   }
+  if (candidate2.settingsMarketplaceSource === "directory") {
+    const extra = settingsAfter.extraKnownMarketplaces === undefined ? {} : settingsAfter.extraKnownMarketplaces;
+    if (!object11(extra))
+      refuse6("current extraKnownMarketplaces is not an object");
+    for (const [name, row2] of Object.entries(extra)) {
+      if (!object11(row2))
+        refuse6("current settings marketplace row is not an object");
+      const allowed = name === candidate2.marketplace ? ["source"] : ["source", "autoUpdate"];
+      if (Object.keys(row2).some((key) => !allowed.includes(key)) || !Object.hasOwn(row2, "source"))
+        refuse6("current settings marketplace metadata cannot be preserved by the measured native operation");
+      if (Object.hasOwn(row2, "autoUpdate") && typeof row2.autoUpdate !== "boolean")
+        refuse6("current settings marketplace autoUpdate is not a boolean");
+      keys3(row2.source, ["source", "path"], "current settings marketplace directory source");
+      if (row2.source.source !== "directory")
+        refuse6("current settings marketplace source is outside the measured directory contract");
+      abs(row2.source.path, "current settings marketplace directory path");
+    }
+    settingsAfter.extraKnownMarketplaces = { ...extra, [candidate2.marketplace]: { source: { source: "directory", path: candidate2.root } } };
+    for (const row2 of Object.values(marketplaces ?? {})) {
+      if (!object11(row2))
+        refuse6("current known marketplace row is not an object");
+      keys3(row2, ["source", "installLocation", "lastUpdated", ...Object.hasOwn(row2, "autoUpdate") ? ["autoUpdate"] : []], "current known marketplace row");
+      if (!object11(row2.source))
+        refuse6("current known marketplace source is not an object");
+      if (row2.source.source === "directory") {
+        keys3(row2.source, ["source", "path"], "current known marketplace directory source");
+        abs(row2.source.path, "current known marketplace directory path");
+      } else if (row2.source.source === "github") {
+        keys3(row2.source, ["source", "repo"], "current known marketplace GitHub source");
+        if (typeof row2.source.repo !== "string" || row2.source.repo.length > 512 || !/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(row2.source.repo))
+          refuse6("current known marketplace GitHub repository is not an owner/repository identifier");
+      } else
+        refuse6("current known marketplace source is outside the measured preservation contract");
+      abs(row2.installLocation, "current known marketplace install location");
+      if (!validUtcTimestamp(row2.lastUpdated))
+        refuse6("current known marketplace timestamp is invalid");
+      if (Object.hasOwn(row2, "autoUpdate") && typeof row2.autoUpdate !== "boolean")
+        refuse6("current known marketplace autoUpdate is not a boolean");
+    }
+  }
   if (!isDeepStrictEqual18(delta.settingsAfter, settingsAfter))
-    refuse6("complete settings document differs from the exact selected plugin/options/environment operations");
+    refuse6("complete settings document differs from the exact selected plugin/options/environment/marketplace operations");
   const marketplaceRowBefore = marketplaces?.[candidate2.marketplace];
   if (marketplaceRowBefore !== undefined && !object11(marketplaceRowBefore))
     refuse6("current marketplace row has an unsupported shape");

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.58",
+    version: "0.10.59",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {

package/bin/migrate.js

@@ -25,7 +25,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.58",
+  version: "0.10.59",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24140,7 +24140,7 @@ restoreLaunchCwd();
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.58",
+  version: "0.10.59",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -24143,7 +24143,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.58",
+  version: "0.10.59",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/index.js

@@ -11834,7 +11834,7 @@ function replaceSkillSession(expected, replacement, plan, options = {}, beforeCo
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.58",
+  version: "0.10.59",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/lib/claude-prospective-review.d.ts

@@ -40,6 +40,7 @@ export interface ClaudeProspectiveReviewRequest {
             sha256: string;
         };
         functionHooksEnv?: "1";
+        settingsMarketplaceSource?: "directory";
     };
     preimages: {
         settings: {

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.58",
+  version: "0.10.59",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/docs/plugin-admission.md

@@ -194,7 +194,32 @@ closure. Nontrivial `metadata.pluginRoot` values and native catalog or selected
 plugin dependency declarations refuse because this validator does not resolve
 or review unselected external plugins.
 The request may declare `functionHooksEnv: "1"`; without that declaration the
-environment document is preserved unchanged. The validator shallow-merges
+environment document is preserved unchanged. For a measured Claude 2.1.293
+user-scoped install, `candidate.settingsMarketplaceSource: "directory"`
+explicitly declares the native settings registration. Skills derives
+`extraKnownMarketplaces[candidate.marketplace].source` from the exact frozen
+candidate root. The measured operation accepts existing directory sources
+only. Foreign entries may also carry a boolean `autoUpdate`; other metadata
+refuses before writing because the native parser drops unknown fields.
+Selected-entry metadata, including `autoUpdate`, also refuses because this
+Claude release replaces that entire entry. The complete supplied settings
+document must match the derived projection, preserving all foreign entries.
+The same declared operation preflights every authoritative
+`known_marketplaces.json` row: exact `source`, `installLocation`, `lastUpdated`
+and optional boolean `autoUpdate`. Sources are either `{source: "directory",
+path: <normalized absolute path>}` or `{source: "github", repo: "owner/repository"}`.
+Other source keys and row metadata refuse before the native parser can drop them.
+The complete `installed_plugins.json` document must contain only `version` and
+`plugins`. Every existing row, including untouched plugins and other scopes,
+must have `scope`, `installPath`, `version`, `installedAt` and `lastUpdated`,
+with a project path for project/local scope and an optional 40-character
+lowercase hexadecimal `gitCommitSha`. Unsupported metadata or malformed fields
+refuse before installation; supported foreign rows remain exact in the required
+after-document. Existing selected-row restrictions still apply.
+Omission preserves the settings field unchanged; other values, versions and project scope
+refuse. The installer must still verify the actual native executable and
+poststate; a supplied version string does not establish consumer identity.
+The validator shallow-merges
 each declared options patch into the selected plugin's existing `options`;
 the patch must explicitly bind `enabled: true`, and the validator enforces that
 value after merging. This preserves all other selected options and unrelated

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.58",
+  "version": "0.10.59",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {