@hasna/skills 0.10.62 → 0.10.63

package/dist/lib/agent-discovery.d.ts

@@ -3,8 +3,10 @@ import { type DiscoveryDirectory } from "./agent-discovery-directories.js";
 import { type ManagedPluginRegistrationWitness } from "./plugin-discovery.js";
 import { type CodexHookDiscoveryRecovery } from "./codex-hook-discovery-recovery.js";
 import { type CodexPluginSkillControl, type CodexPluginSourceInput } from "./codex-plugin-skill-controls.js";
+import { type RetainedReviewArtifact, type ReviewedArtifact } from "./retained-review-artifacts.js";
 export { captureDiscoveryDirectories, type DiscoveryDirectory } from "./agent-discovery-directories.js";
 export interface DiscoverySource {
+    reviewArtifact?: RetainedReviewArtifact;
     path: string;
     sha256: string | null;
     hashMode?: "bytes" | "path-bytes" | "claude-plugin-manifest-v1" | "claude-plugin-registry" | "claude-marketplace-registry" | "claude-settings-v1" | "claude-settings-v2" | "claude-settings-v3" | "claude-settings-v4" | "claude-marketplace-registry-v2" | "codex-settings-v1" | "codex-settings-v2" | "codex-settings-v3" | "codex-settings-v4" | "sumi-settings-v1" | "claude-marketplace-entry-v1";
@@ -63,6 +65,7 @@ export interface ReviewedDiscoveryInputs {
         agent: IntegrationAgent;
         roots: string[];
         sources: DiscoverySource[];
+        reviewArtifacts?: ReviewedArtifact[];
         directories?: DiscoveryDirectory[];
         pluginHooks: "reviewed-no-skill-injection";
     }>;

package/dist/lib/agent-integration.d.ts

@@ -6,6 +6,7 @@ import { type DiscoveryExecutable, type AgentDiscoveryBinding, type ReviewedDisc
 import { type IntegrationAgent } from "./agent-adapters.js";
 import type { CodexHookDiscoveryRecovery } from "./codex-hook-discovery-recovery.js";
 import { type ClaudeCoordinatedHookEvent } from "./claude-settings-witness.js";
+import { type ReviewArtifactChange } from "./retained-review-artifacts.js";
 export type { IntegrationAgent } from "./agent-adapters.js";
 export type ContextHookEvent = "UserPromptSubmit" | "SessionStart" | "SubagentStart";
 export interface AgentRootAlias {
@@ -47,6 +48,12 @@ export interface AgentConfigChange {
     after: string;
 }
 export interface AgentIntegrationPlan {
+    reviewArtifactSources?: Array<{
+        path: string;
+        sha256: string;
+    }>;
+    retainedReviewArtifacts?: ReviewArtifactChange[];
+    reviewArtifactMigration?: ReviewArtifactMigration;
     observedNativeSources?: Array<{
         path: string;
         sha256: string | null;
@@ -89,6 +96,7 @@ export interface AgentIntegrationPlan {
     rootAliases?: AgentRootAlias[];
     managedAgentChecks?: {
         home: string;
+        projectDir?: string;
         agents: IntegrationAgent[];
     };
     retainedReviewChecks?: {
@@ -203,6 +211,17 @@ export declare function planAgentSettingsWitnessUpgrade(options: {
     expectedPolicySha256: string;
     expectedSettingsSha256: string;
 }): AgentIntegrationPlan;
+export interface ReviewArtifactMigration {
+    kind: "codex-native-catalog";
+    sourcePath: string;
+    expectedPolicySha256: string;
+    expectedSourceSha256: string;
+    home?: string;
+    dataDir?: string;
+    projectDir?: string;
+}
+/** Explicit exact-proof migration. Never captures a new catalog or refreshes live inputs. */
+export declare function planReviewedArtifactMigration(options: ReviewArtifactMigration): AgentIntegrationPlan;
 export declare function applyAgentIntegration(plan: AgentIntegrationPlan, options?: CodexCorpusWriteOptions): {
     changed: string[];
     backups: string[];

package/dist/lib/retained-review-artifacts.d.ts

@@ -0,0 +1,35 @@
+import type { AgentDiscoveryBinding, DiscoverySource } from "./agent-discovery.js";
+export interface ReviewedArtifact {
+    kind: "codex-native-catalog";
+    path: string;
+    sha256: string;
+}
+export interface RetainedReviewArtifact {
+    version: 1;
+    kind: "codex-native-catalog";
+    storeRoot: string;
+    originalPath: string;
+    sha256: string;
+    catalogSha256: string;
+}
+export interface ReviewArtifactChange {
+    path: string;
+    before: null;
+    after: string;
+    artifact: RetainedReviewArtifact;
+}
+export declare function verifyReviewArtifactOriginal(path: string, expectedSha256: string): void;
+export declare function retainedArtifactPath(metadata: RetainedReviewArtifact): string;
+export declare function validRetainedArtifact(value: unknown): value is RetainedReviewArtifact;
+export declare function verifyRetainedReviewArtifact(source: DiscoverySource, storeRoot?: string): void;
+/** Planning only: preserve source bytes and lineage, but create no storage. */
+export declare function planReviewArtifactRetention(binding: AgentDiscoveryBinding, artifacts: ReviewedArtifact[] | undefined, dataDir: string, home: string): {
+    binding: AgentDiscoveryBinding;
+    changes: ReviewArtifactChange[];
+    observed: Array<{
+        path: string;
+        sha256: string;
+    }>;
+};
+/** Publish only an absent exact-byte artifact; existing immutable bytes are never replaced. */
+export declare function writeReviewArtifactExclusive(change: ReviewArtifactChange): void;

package/dist/runtime-prerequisites.js

@@ -49,7 +49,7 @@ var __require = import.meta.require;
 // src/runtime-prerequisites.ts
 import { isAbsolute as isAbsolute5 } from "path";
 // package.json
-var version = "0.10.62";
+var version = "0.10.63";
 var package_default = {
   name: "@hasna/skills",
   version,
@@ -2673,6 +2673,15 @@ function assertAgentPolicyCollections(policy) {
         }
       } else
         requireBound(source.managedPlugins === undefined);
+      if (source.reviewArtifact !== undefined) {
+        const artifact = source.reviewArtifact;
+        requireBound(agent === "codex" && value.method === "reviewed" && source.hashMode === "bytes" && object(artifact) && Object.keys(artifact).length === 6 && Object.keys(artifact).every((key) => ["version", "kind", "storeRoot", "originalPath", "sha256", "catalogSha256"].includes(key)) && artifact.version === 1 && artifact.kind === "codex-native-catalog" && artifact.sha256 === source.sha256 && /^[a-f0-9]{64}$/.test(artifact.catalogSha256));
+        for (const path of [artifact.storeRoot, artifact.originalPath]) {
+          text(path);
+          requireBound(isAbsolute3(path) && resolve5(path) === path);
+        }
+        requireBound(source.path === join5(artifact.storeRoot, "agent-discovery", "artifacts", artifact.sha256, "catalog.json"));
+      }
       if (source.format !== undefined)
         requireBound(["json", "toml", "yaml"].includes(source.format));
       if (source.fields !== undefined)