@hasna/skills 0.10.59 → 0.10.61

package/dist/server/launcher-environment-policy.d.ts

@@ -0,0 +1,11 @@
+export declare const LEGACY_PINNED_LAUNCHER_SCHEMA = "hasna-skills-pinned-launcher-v1";
+export declare function renderLegacyPinnedLauncher(binding: {
+    runtime: string;
+    cwd: string;
+    entry: string;
+}): string;
+export declare const SERVER_LAUNCHER_ENV_NAMES: readonly ["DATABASE_URL"];
+export declare const STORAGE_LOCATOR_ENV_NAMES: readonly ["DATABASE_URL", "HASNA_SKILLS_DATABASE_URL", "SKILLS_DATABASE_URL"];
+export declare function isStorageLocatorEnvironmentName(name: string): boolean;
+/** The same deny rule used in V2 client's JS projection and shell projection. */
+export declare const CLIENT_LAUNCHER_STORAGE_DENY_AWK = "    if (name == \"DATABASE_URL\" || name == \"HASNA_SKILLS_DATABASE_URL\" || name == \"SKILLS_DATABASE_URL\") continue";

package/docs/plugin-admission.md

@@ -257,6 +257,32 @@ Installed consumers can use the public `captureClaudeProspectiveCandidateClosure
 and `hashClaudePluginManifest` exports to prepare the exact digests without
 copying the package's hashing algorithms.
 
+### Claude installer witness CLI
+
+The installed Skills command exposes a fixed read-only bridge for installer
+evidence:
+
+```text
+skills hook capture-claude-installer --request /absolute/request.json --json
+```
+
+The UTF-8 request is a bounded JSON object with schema
+`skills.claude-installer-capture/v1`, the exact configured `commandPath`, one
+fixed `operation` (`settings`, `marketplace-registry`, `managed-plugin-registry`,
+`path-bytes`, `discovery-directories`, `plugin-manifest`, or `candidate`), and
+only that operation's documented inputs. The result uses
+`skills.claude-installer-capture-result/v1` and contains a Skills producer
+receipt plus the selected existing witness result. Candidate manifests include
+their plugin name, canonical path, `hashMode: "claude-plugin-manifest-v1"`, and
+SHA-256; the closure and discovery digests use the existing Skills algorithms.
+The command verifies the configured command resolves to this installed
+`@hasna/skills` producer and rechecks producer identity around capture.
+
+This command only captures and validates source witnesses. It does not invoke
+Claude, install plugins, mutate settings or policy, authorize a candidate, or
+establish installer atomicity or crash recovery. Input refusals identify the
+fixed field or operation and its accepted form without echoing request contents.
+
 ## Reviewed plugin-hook attestation scope
 
 A reviewed discovery input carries `pluginHooks: "reviewed-no-skill-injection"`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.59",
+  "version": "0.10.61",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {
@@ -37,6 +37,7 @@
     "!dist/test-preload.d.ts",
     "!dist/platform",
     "bin/",
+    "native/kernel-lock-acl-darwin",
     "migrations/",
     "docs/skill-standard.md",
     "docs/plugin-admission.md",
@@ -50,8 +51,8 @@
   "types": "./dist/index.d.ts",
   "scripts": {
     "clean": "rm -rf bin/ dist/",
-    "build": "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @hasna/contracts/kernel-lock ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
-    "build:js": "rm -rf dist && bun build --external @hasna/contracts/kernel-lock ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    "build": "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @modelcontextprotocol/sdk ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
+    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
     "test": "bun test --timeout 30000",
     "dev": "bun run ./src/cli/index.tsx",
     "dev:watch": "bun --watch run ./src/cli/index.tsx",