@hasna/skills 0.10.69 → 0.10.70

package/dist/lib/agent-discovery.d.ts

@@ -1,5 +1,6 @@
 import type { IntegrationAgent } from "./agent-adapters.js";
 import { type DiscoveryDirectory } from "./agent-discovery-directories.js";
+import { type CodexReviewedHookSource } from "./codex-hook-mcp-dependencies.js";
 import { type ManagedPluginRegistrationWitness } from "./plugin-discovery.js";
 import { type CodexHookDiscoveryRecovery } from "./codex-hook-discovery-recovery.js";
 import { type CodexPluginSkillControl, type CodexPluginSourceInput } from "./codex-plugin-skill-controls.js";
@@ -10,7 +11,8 @@ export interface DiscoverySource {
     reviewArtifact?: RetainedReviewArtifact;
     path: string;
     sha256: string | null;
-    hashMode?: "bytes" | "path-bytes" | "claude-plugin-manifest-v1" | "claude-plugin-registry" | "claude-marketplace-registry" | "claude-settings-v1" | "claude-settings-v2" | "claude-settings-v3" | "claude-settings-v4" | "claude-marketplace-registry-v2" | "codex-settings-v1" | "codex-settings-v2" | "codex-settings-v3" | "codex-settings-v4" | "codex-settings-v5" | "sumi-settings-v1" | "claude-marketplace-entry-v1";
+    hashMode?: "bytes" | "path-bytes" | "claude-plugin-manifest-v1" | "claude-plugin-registry" | "claude-marketplace-registry" | "claude-settings-v1" | "claude-settings-v2" | "claude-settings-v3" | "claude-settings-v4" | "claude-marketplace-registry-v2" | "codex-settings-v1" | "codex-settings-v2" | "codex-settings-v3" | "codex-settings-v4" | "codex-settings-v5" | "codex-settings-v6" | "executable-v1" | "sumi-settings-v1" | "claude-marketplace-entry-v1";
+    hookSources?: CodexReviewedHookSource[];
     managedPlugins?: ManagedPluginRegistrationWitness[];
     format?: "json" | "toml" | "yaml";
     fields?: string[];
@@ -103,6 +105,8 @@ export declare function verifyAgentDiscovery(binding: AgentDiscoveryBinding, cod
     target: string;
 }[]): void;
 export declare function rebindAgentDiscovery(binding: AgentDiscoveryBinding, changes: Map<string, string>): AgentDiscoveryBinding;
+/** Explicit streaming integrity witness. Never read an executable as text or execute it. */
+export declare function captureDiscoveryExecutableSources(paths: string[]): DiscoverySource[];
 /** Capture full byte witnesses for reviewed source or executable files; never import or execute them. */
 export declare function captureDiscoveryByteSources(paths: string[]): DiscoverySource[];
 /** Capture executable/source path identity, including links and absent targets. */

package/dist/lib/codex-hook-mcp-dependencies.d.ts

@@ -0,0 +1,16 @@
+export interface CodexReviewedHookSource {
+    path: string;
+    sha256: string | null;
+}
+export interface CodexHookMcpDependencies {
+    sources: CodexReviewedHookSource[];
+    servers: string[];
+}
+/** Exact Codex installed.rs selector contract, using its locked semver1.0.27
+ * Version::cmp (including BuildMetadata::cmp), not loose npm precedence.
+ * Mixed semver/lexical comparisons can cycle. Validate the complete resulting
+ * order so selection cannot depend on native read_dir/sort enumeration. */
+export declare function selectCodexPluginVersion(versions: readonly string[], budget?: {
+    remaining: number;
+}): string;
+export declare function captureCodexHookMcpDependencies(configPath: string, reviewed: readonly CodexReviewedHookSource[], configText?: string, changes?: Map<string, string>, budget?: import("./agent-discovery-bytes.js").DiscoveryByteBudget): CodexHookMcpDependencies;

package/dist/lib/codex-numeric-provenance-v6.d.ts

@@ -0,0 +1,14 @@
+type Path = Array<string | number>;
+export interface CodexNumericToken {
+    path: Path;
+    kind: "integer" | "float" | "date";
+    value: string;
+}
+export declare class CodexNumericValue {
+    readonly token: CodexNumericToken;
+    constructor(token: CodexNumericToken);
+}
+export declare function codexNumericProvenance(text: string, original: unknown): Map<string, CodexNumericToken>;
+export declare function codexIntegerToken(tokens: Map<string, CodexNumericToken>, path: Path): boolean;
+export declare function embedCodexNumericTokens(value: any, tokens: Map<string, CodexNumericToken>, path?: Path): any;
+export {};

package/dist/lib/codex-settings-witness.d.ts

@@ -1,4 +1,5 @@
 export { captureCodexSettings, hashCodexSettingsReplacement } from "./codex-settings-witness-v1.js";
+import { type CodexReviewedHookSource } from "./codex-hook-mcp-dependencies.js";
 import { type ClaudeSettingsWitnessBudget } from "./claude-settings-witness.js";
 /** The Codex discovery fields the automatic TOML projection witnesses. A typed
  * `codex-settings-v2` witness binds strictly more of the same file, so it
@@ -60,3 +61,11 @@ export declare function upgradeCodexSettingsWitnessV5(previous: {
     hashMode?: "bytes" | "codex-settings-v1" | "codex-settings-v2" | "codex-settings-v3" | "codex-settings-v4";
     sha256: string;
 }, reviewedSettingsPath: string): ReturnType<typeof captureCodexSettingsV5>;
+/** V6 keeps V5 display tolerances and binds routes referenced by the complete
+ * independently reviewed native hook source population. No legacy migration. */
+export declare function captureCodexSettingsV6(path: string, reviewedSources: readonly CodexReviewedHookSource[], budget?: ClaudeSettingsWitnessBudget, changes?: Map<string, string>): {
+    path: string;
+    hashMode: "codex-settings-v6";
+    sha256: string;
+    hookSources: CodexReviewedHookSource[];
+};

package/dist/runtime-prerequisites.js

@@ -49,7 +49,7 @@ var __require = import.meta.require;
 // src/runtime-prerequisites.ts
 import { isAbsolute as isAbsolute5 } from "path";
 // package.json
-var version = "0.10.69";
+var version = "0.10.70";
 var package_default = {
   name: "@hasna/skills",
   version,
@@ -2732,12 +2732,26 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-manifest-v1", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-settings-v4", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3", "codex-settings-v4", "codex-settings-v5", "sumi-settings-v1", "claude-marketplace-entry-v1"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+        requireBound(["bytes", "path-bytes", "claude-plugin-manifest-v1", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-settings-v4", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3", "codex-settings-v4", "codex-settings-v5", "codex-settings-v6", "executable-v1", "sumi-settings-v1", "claude-marketplace-entry-v1"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "executable-v1")
+        requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && value.sources.some((row) => row.hashMode === "codex-settings-v6") && isAbsolute3(source.path) && resolve5(source.path) === source.path);
+      if (source.hashMode === "codex-settings-v6") {
+        const seen = new Set;
+        for (const hook of array(source.hookSources, AGENT_POLICY_LIMITS.discoverySources)) {
+          requireBound(object(hook) && Object.keys(hook).length === 2 && Object.keys(hook).every((key) => ["path", "sha256"].includes(key)));
+          text(hook.path);
+          requireBound(isAbsolute3(hook.path) && resolve5(hook.path) === hook.path && !seen.has(hook.path));
+          seen.add(hook.path);
+          requireBound(hook.sha256 === null || typeof hook.sha256 === "string" && /^[a-f0-9]{64}$/.test(hook.sha256));
+          requireBound(value.sources.some((row) => row.path === hook.path && row.sha256 === hook.sha256 && [undefined, "bytes"].includes(row.hashMode) && row.format === undefined && row.fields === undefined));
+        }
+      } else
+        requireBound(source.hookSources === undefined);
       if (source.hashMode === "claude-plugin-manifest-v1")
         requireBound(agent === "claude" && value.agent === "claude" && ["automatic", "reviewed"].includes(value.method) && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve5(source.path) === source.path && source.path.endsWith(join5(sep, ".claude-plugin", "plugin.json")) && source.managedPlugins === undefined);
       if (source.hashMode === "sumi-settings-v1")
         requireBound(agent === "sumi" && value.agent === "sumi" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve5(source.path) === source.path && basename3(source.path) === "sumi.json");
-      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4" || source.hashMode === "codex-settings-v5"))
+      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || (source.hashMode === "codex-settings-v3" || source.hashMode === "codex-settings-v4" || source.hashMode === "codex-settings-v5" || source.hashMode === "codex-settings-v6"))
         requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve5(source.path) === source.path && basename3(source.path) === "config.toml");
       if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || source.hashMode === "claude-settings-v4"))
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve5(source.path) === source.path && basename3(source.path) === "settings.json");