@hasna/skills 0.10.68 → 0.10.70

package/dist/lib/agent-discovery.d.ts

@@ -1,5 +1,6 @@
 import type { IntegrationAgent } from "./agent-adapters.js";
 import { type DiscoveryDirectory } from "./agent-discovery-directories.js";
+import { type CodexReviewedHookSource } from "./codex-hook-mcp-dependencies.js";
 import { type ManagedPluginRegistrationWitness } from "./plugin-discovery.js";
 import { type CodexHookDiscoveryRecovery } from "./codex-hook-discovery-recovery.js";
 import { type CodexPluginSkillControl, type CodexPluginSourceInput } from "./codex-plugin-skill-controls.js";
@@ -10,7 +11,8 @@ export interface DiscoverySource {
     reviewArtifact?: RetainedReviewArtifact;
     path: string;
     sha256: string | null;
-    hashMode?: "bytes" | "path-bytes" | "claude-plugin-manifest-v1" | "claude-plugin-registry" | "claude-marketplace-registry" | "claude-settings-v1" | "claude-settings-v2" | "claude-settings-v3" | "claude-settings-v4" | "claude-marketplace-registry-v2" | "codex-settings-v1" | "codex-settings-v2" | "codex-settings-v3" | "codex-settings-v4" | "codex-settings-v5" | "sumi-settings-v1" | "claude-marketplace-entry-v1";
+    hashMode?: "bytes" | "path-bytes" | "claude-plugin-manifest-v1" | "claude-plugin-registry" | "claude-marketplace-registry" | "claude-settings-v1" | "claude-settings-v2" | "claude-settings-v3" | "claude-settings-v4" | "claude-marketplace-registry-v2" | "codex-settings-v1" | "codex-settings-v2" | "codex-settings-v3" | "codex-settings-v4" | "codex-settings-v5" | "codex-settings-v6" | "executable-v1" | "sumi-settings-v1" | "claude-marketplace-entry-v1";
+    hookSources?: CodexReviewedHookSource[];
     managedPlugins?: ManagedPluginRegistrationWitness[];
     format?: "json" | "toml" | "yaml";
     fields?: string[];
@@ -103,6 +105,8 @@ export declare function verifyAgentDiscovery(binding: AgentDiscoveryBinding, cod
     target: string;
 }[]): void;
 export declare function rebindAgentDiscovery(binding: AgentDiscoveryBinding, changes: Map<string, string>): AgentDiscoveryBinding;
+/** Explicit streaming integrity witness. Never read an executable as text or execute it. */
+export declare function captureDiscoveryExecutableSources(paths: string[]): DiscoverySource[];
 /** Capture full byte witnesses for reviewed source or executable files; never import or execute them. */
 export declare function captureDiscoveryByteSources(paths: string[]): DiscoverySource[];
 /** Capture executable/source path identity, including links and absent targets. */

package/dist/lib/codex-hook-mcp-dependencies.d.ts

@@ -0,0 +1,16 @@
+export interface CodexReviewedHookSource {
+    path: string;
+    sha256: string | null;
+}
+export interface CodexHookMcpDependencies {
+    sources: CodexReviewedHookSource[];
+    servers: string[];
+}
+/** Exact Codex installed.rs selector contract, using its locked semver1.0.27
+ * Version::cmp (including BuildMetadata::cmp), not loose npm precedence.
+ * Mixed semver/lexical comparisons can cycle. Validate the complete resulting
+ * order so selection cannot depend on native read_dir/sort enumeration. */
+export declare function selectCodexPluginVersion(versions: readonly string[], budget?: {
+    remaining: number;
+}): string;
+export declare function captureCodexHookMcpDependencies(configPath: string, reviewed: readonly CodexReviewedHookSource[], configText?: string, changes?: Map<string, string>, budget?: import("./agent-discovery-bytes.js").DiscoveryByteBudget): CodexHookMcpDependencies;

package/dist/lib/codex-numeric-provenance-v6.d.ts

@@ -0,0 +1,14 @@
+type Path = Array<string | number>;
+export interface CodexNumericToken {
+    path: Path;
+    kind: "integer" | "float" | "date";
+    value: string;
+}
+export declare class CodexNumericValue {
+    readonly token: CodexNumericToken;
+    constructor(token: CodexNumericToken);
+}
+export declare function codexNumericProvenance(text: string, original: unknown): Map<string, CodexNumericToken>;
+export declare function codexIntegerToken(tokens: Map<string, CodexNumericToken>, path: Path): boolean;
+export declare function embedCodexNumericTokens(value: any, tokens: Map<string, CodexNumericToken>, path?: Path): any;
+export {};

package/dist/lib/codex-settings-witness.d.ts

@@ -1,4 +1,5 @@
 export { captureCodexSettings, hashCodexSettingsReplacement } from "./codex-settings-witness-v1.js";
+import { type CodexReviewedHookSource } from "./codex-hook-mcp-dependencies.js";
 import { type ClaudeSettingsWitnessBudget } from "./claude-settings-witness.js";
 /** The Codex discovery fields the automatic TOML projection witnesses. A typed
  * `codex-settings-v2` witness binds strictly more of the same file, so it
@@ -60,3 +61,11 @@ export declare function upgradeCodexSettingsWitnessV5(previous: {
     hashMode?: "bytes" | "codex-settings-v1" | "codex-settings-v2" | "codex-settings-v3" | "codex-settings-v4";
     sha256: string;
 }, reviewedSettingsPath: string): ReturnType<typeof captureCodexSettingsV5>;
+/** V6 keeps V5 display tolerances and binds routes referenced by the complete
+ * independently reviewed native hook source population. No legacy migration. */
+export declare function captureCodexSettingsV6(path: string, reviewedSources: readonly CodexReviewedHookSource[], budget?: ClaudeSettingsWitnessBudget, changes?: Map<string, string>): {
+    path: string;
+    hashMode: "codex-settings-v6";
+    sha256: string;
+    hookSources: CodexReviewedHookSource[];
+};

package/dist/mcp/invitation-recovery.d.ts

@@ -1,2 +1,8 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { RemoteSkillsAuthClient } from "../lib/remote-auth.js";
 /** Dedicated anonymous proof surface. Ordinary tools and credential resolution are not initialized. */
 export declare function startInvitationRecoveryMcp(args: string[], env?: Record<string, string | undefined>): Promise<void>;
+/** Register the two anonymous invitation recovery tools on `server`. */
+export declare function registerInvitationRecoveryTools(server: McpServer, client: RemoteSkillsAuthClient, target: {
+    unchanged(): void;
+}): void;

package/dist/mcp/package-tool-list.d.ts

@@ -0,0 +1,19 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/**
+ * Serve tools/list with JSON Schema converted by this package's own zod.
+ *
+ * bin/mcp.js bundles zod but loads the MCP SDK from the consumer's
+ * node_modules, and the SDK may resolve a different zod. The SDK's own
+ * tools/list converts each input schema with its zod; when that zod is older
+ * than the one that built the schema it fails (`ctx.deferred.push`) or
+ * advertises degraded schemas. This records the schemas each tool is
+ * registered with and converts them exactly as the SDK does (draft-7, `io`
+ * input/output, raw shapes as objects), but with the zod that built them.
+ * Argument validation for tools/call stays with the SDK.
+ *
+ * Call it right after constructing the server and before registering tools.
+ * Both `registerTool` and the positional `tool()` form are covered.
+ */
+export declare function servePackageZodToolList(server: McpServer): void;
+/** The input schema the SDK's positional `tool()` form takes from its arguments. */
+export declare function legacyInputSchema(rest: readonly unknown[]): unknown;

package/dist/mcp/server.d.ts

@@ -1,4 +1,6 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/** Register every Skills tool and resource on `server`. */
+export declare function registerSkillsTools(server: McpServer): void;
 export declare function buildServer(): McpServer;
 /** @deprecated Use buildServer() — kept for internal imports during migration */
 export declare const server: McpServer;

package/dist/runtime-prerequisites.js

@@ -49,7 +49,7 @@ var __require = import.meta.require;
 // src/runtime-prerequisites.ts
 import { isAbsolute as isAbsolute5 } from "path";
 // package.json
-var version = "0.10.68";
+var version = "0.10.70";
 var package_default = {
   name: "@hasna/skills",
   version,
@@ -118,6 +118,7 @@ var package_default = {
     "verify:release": "bun run scripts/release-guard.ts",
     "verify:release-review": "bun run scripts/verify-release-review.ts",
     "verify:consumer-types": "bun run scripts/consumer-types.ts",
+    "verify:consumer-mcp": "bun run scripts/consumer-mcp.ts",
     prepack: "bun run verify:generated && bun run verify:release && bun run verify:consumer-types",
     prepublishOnly: "bun run verify:producer && bun run typecheck && bun run test",
     "verify:producer": "bun run scripts/release-dependencies.ts",
@@ -2731,12 +2732,26 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-manifest-v1", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-settings-v4", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3", "codex-settings-v4", "codex-settings-v5", "sumi-settings-v1", "claude-marketplace-entry-v1"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+        requireBound(["bytes", "path-bytes", "claude-plugin-manifest-v1", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-settings-v4", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3", "codex-settings-v4", "codex-settings-v5", "codex-settings-v6", "executable-v1", "sumi-settings-v1", "claude-marketplace-entry-v1"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "executable-v1")
+        requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && value.sources.some((row) => row.hashMode === "codex-settings-v6") && isAbsolute3(source.path) && resolve5(source.path) === source.path);
+      if (source.hashMode === "codex-settings-v6") {
+        const seen = new Set;
+        for (const hook of array(source.hookSources, AGENT_POLICY_LIMITS.discoverySources)) {
+          requireBound(object(hook) && Object.keys(hook).length === 2 && Object.keys(hook).every((key) => ["path", "sha256"].includes(key)));
+          text(hook.path);
+          requireBound(isAbsolute3(hook.path) && resolve5(hook.path) === hook.path && !seen.has(hook.path));
+          seen.add(hook.path);
+          requireBound(hook.sha256 === null || typeof hook.sha256 === "string" && /^[a-f0-9]{64}$/.test(hook.sha256));
+          requireBound(value.sources.some((row) => row.path === hook.path && row.sha256 === hook.sha256 && [undefined, "bytes"].includes(row.hashMode) && row.format === undefined && row.fields === undefined));
+        }
+      } else
+        requireBound(source.hookSources === undefined);
       if (source.hashMode === "claude-plugin-manifest-v1")
         requireBound(agent === "claude" && value.agent === "claude" && ["automatic", "reviewed"].includes(value.method) && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve5(source.path) === source.path && source.path.endsWith(join5(sep, ".claude-plugin", "plugin.json")) && source.managedPlugins === undefined);
       if (source.hashMode === "sumi-settings-v1")
         requireBound(agent === "sumi" && value.agent === "sumi" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve5(source.path) === source.path && basename3(source.path) === "sumi.json");
-      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4" || source.hashMode === "codex-settings-v5"))
+      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4" || source.hashMode === "codex-settings-v5" || source.hashMode === "codex-settings-v6"))
         requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve5(source.path) === source.path && basename3(source.path) === "config.toml");
       if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || source.hashMode === "claude-settings-v4"))
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve5(source.path) === source.path && basename3(source.path) === "settings.json");