@hasna/skills 0.10.70 → 0.10.72

package/dist/storage.js

@@ -53,13 +53,13 @@ import {
   mkdirSync as mkdirSync3,
   readFileSync as readFileSync3,
   readdirSync,
-  statSync,
+  statSync as statSync2,
   writeFileSync as writeFileSync3
 } from "fs";
 import { dirname as dirname2, join as join4, normalize, relative, sep } from "path";
 
 // src/lib/config.ts
-import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync } from "fs";
+import { closeSync, constants, existsSync as existsSync2, fstatSync, lstatSync, openSync, readFileSync, statSync, writeFileSync, mkdirSync } from "fs";
 import { join as join2, dirname } from "path";
 
 // src/lib/retired-settings.ts
@@ -195,7 +195,8 @@ function skillsDataRootForHome(home) {
 var ENUM_KEYS = {
   defaultAgent: ["claude", "codex", "gemini", "pi", "opencode", "all"],
   defaultScope: ["global", "project"],
-  format: ["compact", "json", "csv"]
+  format: ["compact", "json", "csv"],
+  sessionPinMigration: ["auto", "off"]
 };
 var STRING_KEYS = ["extensionsDir"];
 function validKeys() {
@@ -266,6 +267,9 @@ function saveConfig(key, value, scope = "project") {
   if (!validKeys().includes(key)) {
     throw new Error(`Unknown config key: ${key}. Valid keys: ${validKeys().join(", ")}`);
   }
+  if (key === "sessionPinMigration" && scope !== "global") {
+    throw new Error(`${key} is read only from the global configuration. Use: skills config set ${key} <auto|off> --global`);
+  }
   const normalized = normalizeConfigValue(key, value);
   if (normalized === undefined) {
     const allowed = allowedValues(key);
@@ -959,7 +963,7 @@ function walkFiles(dir) {
   const files = [];
   for (const entry of readdirSync(dir)) {
     const full = join4(dir, entry);
-    const stats = statSync(full);
+    const stats = statSync2(full);
     if (stats.isDirectory())
       files.push(...walkFiles(full));
     else

package/docs/plugin-admission.md

@@ -194,8 +194,9 @@ closure. Nontrivial `metadata.pluginRoot` values and native catalog or selected
 plugin dependency declarations refuse because this validator does not resolve
 or review unselected external plugins.
 The request may declare `functionHooksEnv: "1"`; without that declaration the
-environment document is preserved unchanged. For a measured Claude 2.1.293
-user-scoped install, `candidate.settingsMarketplaceSource: "directory"`
+environment document is preserved unchanged. For a measured Claude 2.1.276,
+2.1.278, 2.1.282, 2.1.287, 2.1.293, 2.1.296 or 2.1.299 user-scoped install,
+`candidate.settingsMarketplaceSource: "directory"`
 explicitly declares the native settings registration. Skills derives
 `extraKnownMarketplaces[candidate.marketplace].source` from the exact frozen
 candidate root. The measured operation accepts existing directory sources
@@ -329,9 +330,23 @@ What the software currently enforces is narrower:
   managed row's `installPath` to be `cache/<marketplace>/<plugin>/<version>`,
   checks every file in every retained cache version against the admission
   receipts without the review listing them, and binds unmanaged rows exactly.
+- Claude rewrites the 13-digit millisecond timestamp in
+  `.claude/plugins/cache/<marketplace>/<plugin>/<version>/.orphaned_at` when it
+  starts. Capturing that exact path with `captureDiscoveryByteSources` or
+  `captureDiscoveryPathSources` (including the installer `path-bytes`
+  operation) produces a `claude-plugin-orphaned-at-v1` witness, and a fresh
+  explicit review converts a plain byte or `path-bytes` witness of it to that
+  form. The witness binds the marker's presence or absence, not its bytes or
+  inode. Every capture and check still requires a regular, non-symlink file
+  owned by the current user, at most 32 bytes, matching `^[1-9][0-9]{12}$`.
+  The name stays in `directories` membership, so other added or removed names
+  are still detected. A marker at any other depth, any other name, and any
+  Skills-owned producer tree keep their exact byte witnesses. A stored review
+  that binds the marker's bytes keeps that meaning and needs one fresh review.
 - An entirely absent retired Claude version root exempts only its plain byte
   sources (`hashMode` omitted or `"bytes"`, with no `format`, `fields` or
-  `managedPlugins`). Such a source with a non-null `sha256` is also the only
+  `managedPlugins`) and a present `claude-plugin-orphaned-at-v1` marker. Such a
+  source with a non-null `sha256` is also the only
   thing that identifies the root, and the root qualifies only while it stays
   entirely absent and the reviewed settings and registry select a different,
   verified version. Every other source under that root is re-hashed as usual,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.70",
+  "version": "0.10.72",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {