@hasna/skills 0.10.75 → 0.10.77

package/dist/lib/agent-codex-trust.d.ts

@@ -35,6 +35,8 @@ type Connect = typeof connectCodexHookRpc;
  * receipt for an already-effective operation so the ordinary apply guard can
  * stop refusing the same journal. */
 export declare function reconcileCodexNativeHooks(options: CodexNativeHookReconcileOptions, connect?: Connect): Promise<{
+    nativeAdmission?: "unavailable";
+    nativeAdmissionProbe?: import("./codex-corpus-write.js").CodexAdmissionProbe;
     recoveryPlan?: {
         reason?: string | undefined;
         changes?: {
@@ -119,6 +121,8 @@ export declare function reconcileCodexNativeHooks(options: CodexNativeHookReconc
 /** Deliberately separate from filesystem hook installation: native trust is an
  * explicit authorization of exact owned commands, never a broad trust bypass. */
 export declare function enrollCodexNativeHooks(options?: CodexNativeHookTrustOptions, connect?: Connect): Promise<{
+    nativeAdmission?: "unavailable";
+    nativeAdmissionProbe?: import("./codex-corpus-write.js").CodexAdmissionProbe;
     planDigest: string;
     skillsCli: {
         path: string;

package/dist/lib/agent-integration.d.ts

@@ -1,4 +1,4 @@
-import { type CodexCorpusWriteOptions } from "./codex-corpus-write.js";
+import { type CodexAdmissionReceipt, type CodexCorpusWriteOptions } from "./codex-corpus-write.js";
 import { type ReviewedCodexSkillDenial } from "./codex-plugin-skill-controls.js";
 import { type CodexNativeHookEnvelope, type ProcessInspector, type NativePolicyHelperRunner } from "./codex-native-skill-policy.js";
 import { type CodexNativeSkillCatalog } from "./codex-native-skill-catalog.js";
@@ -242,7 +242,7 @@ export declare function applyAgentIntegration(plan: AgentIntegrationPlan, option
     changed: string[];
     backups: string[];
     rootAliases?: AgentRootAlias[];
-};
+} & CodexAdmissionReceipt;
 export declare function archiveNativeSkills(inventory: NativeSkillEntry[], options: CodexCorpusWriteOptions & {
     dataDir?: string;
     includeUnmanaged?: boolean;
@@ -263,7 +263,7 @@ export declare function archiveNativeSkills(inventory: NativeSkillEntry[], optio
         digest: string;
         targetCount: number;
     };
-};
+} & CodexAdmissionReceipt;
 /** Native hook input for the Codex policy adapter. Only the Codex hook paths that
  * receive native SessionStart/UserPromptSubmit input supply it; install-time and
  * other guard calls never do. `inspector` is a test seam for process lineage. */

package/dist/lib/agent-sync.d.ts

@@ -1,4 +1,4 @@
-import { type CodexCorpusWriteOptions } from "./codex-corpus-write.js";
+import { type CodexAdmissionReceipt, type CodexAdmissionRecordOptions, type CodexCorpusWriteOptions } from "./codex-corpus-write.js";
 /**
  * `skills sync` — the last mile: write skills from this machine's corpus
  * (the migrated owner-layout cache ~/.hasna/skills/skills/<name>/, or the
@@ -76,7 +76,7 @@ export declare function isPointerSkillMd(markdown: string): boolean;
 /** A pointer SKILL.md for an executable skill: what it is and how to actually run it. */
 export declare function pointerSkillMd(name: string, description: string): string;
 export type SyncActionKind = "create" | "update" | "skip";
-export interface AgentSyncAction {
+export interface AgentSyncAction extends CodexAdmissionReceipt {
     skill: string;
     agent: SyncAgent;
     path: string;
@@ -155,7 +155,7 @@ export interface WriteManagedAgentSkillParams extends CodexCorpusWriteOptions {
  * directory is always left untouched. A fresh directory is created.
  */
 export declare function writeManagedAgentSkill(params: WriteManagedAgentSkillParams): AgentSyncAction;
-export interface ManagedDirWriteResult {
+export interface ManagedDirWriteResult extends CodexAdmissionReceipt {
     action: SyncActionKind;
     path: string;
     reason?: string;
@@ -181,4 +181,6 @@ export declare function writeManagedSkillDir(dir: string, skillMd: string, optio
  * did not write (no valid Skills ownership marker). Foreign or malformed markers
  * grant no deletion authority, and removal has no force override.
  */
-export declare function removeManagedAgentSkill(skill: string, agent: SyncAgent, homeDir?: string, options?: CodexCorpusWriteOptions): boolean;
+/** Returns only whether it removed; pass `onCodexAdmission` to receive the admission
+ * record. Without it, a Codex home without native admission refuses as before. */
+export declare function removeManagedAgentSkill(skill: string, agent: SyncAgent, homeDir?: string, options?: CodexCorpusWriteOptions & CodexAdmissionRecordOptions): boolean;

package/dist/lib/auth-store.d.ts

@@ -88,7 +88,7 @@ export declare function getAuthConfigReadOnly(env?: Env, options?: SkillsFleetOp
  * forgotten locally. Recorded in identity.json (never a secret).
  */
 export type StoredKeyIssuer = "sign-in" | "api-key";
-export declare function saveAuthConfig(config: StoredAuthConfig, env?: Env, authenticatedOrigin?: string, issuedBy?: StoredKeyIssuer): string;
+export declare function saveAuthConfig(config: StoredAuthConfig, env?: Env, authenticatedOrigin?: string, issuedBy?: StoredKeyIssuer, assertUnchanged?: () => void): string;
 /**
  * Who put the active profile's stored credential there — the question
  * `skills logout` has to answer before it touches it (Instructions rule

package/dist/lib/codex-corpus-write.d.ts

@@ -1,16 +1,57 @@
+/** Fixed refusal vocabulary for the interim fallback; never native text. */
+export type CodexCorpusRefusal = "native-lock-present" | "executable-unverified" | "probe-inconclusive" | "command-present" | "writer-busy" | "skills-lock-unavailable" | "lease-changed";
 export interface CodexCorpusWriteOptions {
     /** The selected native executable; never a shell command. */
     codexCommand?: string;
     /** Existing callers with a reviewed executable binding retain that binding. */
     codexSha256?: string;
 }
+/** The probe behind a fallback write. `executable`, `sha256` and `size` identify the
+ * selected executable file (for an npm install, the launcher script), not the vendor
+ * binary it starts. Never contains native output. */
+export interface CodexAdmissionProbe {
+    kind: "help-unrecognized-subcommand";
+    executable: string;
+    sha256: string;
+    size: number;
+    version: string;
+    probeExitCode: 2;
+    controlExitCode: 0;
+}
+export interface CodexCorpusAdmission {
+    nativeAdmission: "verified" | "unavailable";
+    probe?: CodexAdmissionProbe;
+}
+export interface CodexAdmissionReceipt {
+    nativeAdmission?: "unavailable";
+    nativeAdmissionProbe?: CodexAdmissionProbe;
+}
+export interface CodexCorpusLease {
+    assertCurrent(): void;
+    close(): void;
+    admission: CodexCorpusAdmission;
+}
+/** Boolean writers have no receipt: they use the fallback only when the caller takes this record. */
+export interface CodexAdmissionRecordOptions {
+    onCodexAdmission?: (admission: CodexCorpusAdmission) => void;
+}
+/** Gate policy for one transaction; writers without a receipt disable the fallback. */
+export interface CodexCorpusWritePolicy {
+    fallback?: boolean;
+}
+/** Reads `onCodexAdmission` once. Only a synchronous function enables the fallback and
+ * receives the record; any other defined value refuses before anything happens, and a
+ * callback that returns a thenable refuses before anything is removed. */
+export declare function codexAdmissionRecord(options: CodexAdmissionRecordOptions): {
+    policy: CodexCorpusWritePolicy;
+    deliver(admission: CodexCorpusAdmission | undefined): void;
+};
+/** Receipt fields for a write made under the interim fallback; native-path receipts are unchanged. */
+export declare function codexAdmissionReceipt(admission: CodexCorpusAdmission | undefined): CodexAdmissionReceipt;
 /** Protected aliases fail closed; unrelated project paths remain usable. */
 export declare function codexCorpusRootForPath(path: string): string | undefined;
-export declare function acquireCodexCorpusWrite(roots: readonly string[], options: CodexCorpusWriteOptions): {
-    assertCurrent: () => void;
-    close: () => void;
-};
+export declare function acquireCodexCorpusWrite(roots: readonly string[], options: CodexCorpusWriteOptions, policy?: CodexCorpusWritePolicy): CodexCorpusLease;
 /** Keep the descriptor through preimage checks, writes, rollback and readback. */
-export declare function withCodexCorpusWrite<T>(roots: readonly string[], run: (assertCurrent: () => void) => T, options?: CodexCorpusWriteOptions): T;
+export declare function withCodexCorpusWrite<T>(roots: readonly string[], run: (assertCurrent: () => void, admission?: CodexCorpusAdmission) => T, options?: CodexCorpusWriteOptions, policy?: CodexCorpusWritePolicy): T;
 /** The callback must await every native child's close before settling. */
-export declare function withCodexCorpusWriteAsync<T>(roots: readonly string[], run: (assertCurrent: () => void) => Promise<T>, options?: CodexCorpusWriteOptions): Promise<T>;
+export declare function withCodexCorpusWriteAsync<T>(roots: readonly string[], run: (assertCurrent: () => void, admission?: CodexCorpusAdmission) => Promise<T>, options?: CodexCorpusWriteOptions, policy?: CodexCorpusWritePolicy): Promise<T>;

package/dist/lib/codex-hook-rpc.d.ts

@@ -1,7 +1,10 @@
+import { type CodexCorpusAdmission } from "./codex-corpus-write.js";
 export { SUPPORTED_CODEX_HOOK_VERSIONS } from "./codex-native-compatibility.js";
 export interface CodexHookRpc {
     version: string;
     processId?: number;
+    /** How the owned client's corpus lease was admitted; absent on synthetic clients. */
+    admission?: CodexCorpusAdmission;
     request(method: string, params: unknown): Promise<any>;
     close(): Promise<void>;
 }

package/dist/lib/codex-plugin-capability-paths.d.ts

@@ -0,0 +1,31 @@
+/** The one package-owned definition of the plugin-root locations Codex reads.
+ *
+ * The vendor-refresh guard (codex-vendor-refresh.ts), the semantic cache
+ * witness (codex-semantic-cache-witness.ts) and the reviewed hook dependency
+ * closure (codex-hook-mcp-dependencies.ts) all derive their capability rules
+ * from these lists, so a location added here reaches every mode at once.
+ */
+/** Manifest locations in a plugin version root, in the order Codex 0.160.0 and
+ * later look them up: the Agent Plugins root `plugin.json` first, then the
+ * `.codex-plugin`, `.claude-plugin` and `.cursor-plugin` manifests. The first
+ * one present is the plugin's manifest. */
+export declare const CODEX_PLUGIN_MANIFEST_LOCATIONS: readonly string[];
+/** The manifest directories among CODEX_PLUGIN_MANIFEST_LOCATIONS. */
+export declare const CODEX_PLUGIN_MANIFEST_DIRECTORIES: readonly string[];
+/** Every direct entry of a plugin version root that carries a capability Codex
+ * reads: each manifest location, the default hooks directory and a root hooks
+ * file, the MCP and connector declarations, and the default command and agent
+ * directories. Spelled in lowercase; compare names through
+ * codexPluginRootCapabilityEntry so a case-insensitive file system cannot alias
+ * one. */
+export declare const CODEX_PLUGIN_ROOT_CAPABILITY_ENTRIES: readonly string[];
+/** Case-insensitive comparison form. Upper- then lower-casing also folds the
+ * Kelvin sign, long s and dotless i onto their ASCII letters, so a name a
+ * case-insensitive file system could open as a capability entry folds onto it. */
+export declare function foldCodexPluginEntryName(name: string): string;
+/** The lowercase CODEX_PLUGIN_ROOT_CAPABILITY_ENTRIES member a directory entry
+ * name denotes, matched without regard to case, or null. */
+export declare function codexPluginRootCapabilityEntry(name: string): string | null;
+/** Whether a directory entry name is a skill document (`SKILL.md`), matched
+ * without regard to case. */
+export declare function isCodexSkillDocumentName(name: string): boolean;

package/dist/lib/credential-profile-command.d.ts

@@ -0,0 +1,5 @@
+export declare function skillsShellArgument(value: string): string;
+/** Set every supported URL alias consistently for this invocation only. */
+export declare function skillsApiUrlEnvironment(origin: string): string;
+/** Keep copied CLI commands on the credential profile selected by CLI or environment. */
+export declare function skillsProfileCommand(command: string, env?: Record<string, string | undefined>, origin?: string): string;

package/dist/lib/fleet-credentials.d.ts

@@ -134,7 +134,7 @@ export interface LocalSkillsFleet {
 }
 export type SkillsFleet = HostedSkillsFleet | LocalSkillsFleet;
 /** Machine-readable reasons a hosted resolution was refused. */
-export type SkillsFleetErrorCode = "MISSING_API_CREDENTIAL" | "INVALID_API_URL" | "INSTANCE_CREDENTIAL_MISMATCH" | "GATEWAY_AUTH_UNAVAILABLE";
+export type SkillsFleetErrorCode = "MISSING_API_CREDENTIAL" | "INVALID_API_URL" | "INSTANCE_CREDENTIAL_MISMATCH" | "GATEWAY_AUTH_UNAVAILABLE" | "STORED_CREDENTIAL_PROTECTED";
 /**
  * A configured install could not produce a usable hosted client.
  *
@@ -336,14 +336,17 @@ export interface SignInTarget {
     source: string;
     /** Set when an already-resolving credential decided the origin: its source NAME, never a value. */
     credentialSource?: string;
+    /** A captured sign-in carries this through approval and persistence. */
+    unchanged?: () => void;
 }
 /**
  * The refusal for a sign-in that would target the internal gateway, which has
- * no sign-in service — or null. It names what to unset or remove, and never
- * suggests pointing this machine at the product server while an internal
- * credential is still configured. Nothing is sent either way.
+ * no sign-in service — or null. Use a separate profile for product sign-in,
+ * preserving the existing fleet configuration. Nothing is sent either way.
  */
 export declare function gatewaySignInRefusal(target: SignInTarget): SkillsFleetCredentialError | null;
+/** Refuse before sign-in traffic can replace a selected fleet key or vault reference. */
+export declare function assertSkillsSignInCredentialReplaceable(env?: Env, profile?: string): void;
 /**
  * The authority a SIGN-IN talks to: `skills login`, `skills auth login` /
  * `signup`, and the TUI `/login`. Resolved on its own because signing in is how
@@ -354,7 +357,8 @@ export declare function gatewaySignInRefusal(target: SignInTarget): SkillsFleetC
  *   1. `--url <origin>` — an explicit choice for this sign-in. It is refused when
  *      an outranking URL (the environment or the Keychain) names a different
  *      instance, because the key it mints would be shadowed the moment it is
- *      saved. A URL in the credentials file is what a sign-in replaces.
+ *      saved. A URL in the credentials file is replaceable only when it does
+ *      not protect a fleet credential or vault reference.
  *   2. a configured URL — environment, profile or credentials file, Keychain.
  *   3. the instance an already-stored credential belongs to. A legacy internal
  *      key with no recorded URL belongs to the fleet gateway, so a machine that
@@ -366,6 +370,8 @@ export declare function gatewaySignInRefusal(target: SignInTarget): SkillsFleetC
  * Nothing here sends a request.
  */
 export declare function resolveSkillsSignInOrigin(env?: Env, options?: SkillsFleetOptions, explicitUrl?: string): SignInTarget;
+/** Retain the selected credential's exact file state across a multi-step sign-in. */
+export declare function captureSkillsSignInTarget(env?: Env, options?: SkillsFleetOptions, explicitUrl?: string): SignInTarget;
 /**
  * The hosted resolution, or throw. Use on every auth and write path.
  *

package/dist/lib/home-adoption.d.ts

@@ -1,6 +1,6 @@
 import { type SyncAgent, type SyncMarker } from "./agent-sync.js";
 import type { PortableSkillOptions } from "./portable-skills.js";
-import { type CodexCorpusWriteOptions } from "./codex-corpus-write.js";
+import { type CodexAdmissionReceipt, type CodexCorpusWriteOptions } from "./codex-corpus-write.js";
 export declare const CONFLICTS_LEDGER_FILE = "conflicts.json";
 export declare const ROLLBACK_DIRNAME = "rollback";
 export interface HomeSkillEntry {
@@ -36,7 +36,7 @@ export interface AdoptionOptions extends PortableSkillOptions, CodexCorpusWriteO
     /** Write markers and the conflicts ledger. Without it, scan only. */
     apply?: boolean;
 }
-export interface AdoptionResult extends AdoptionScan {
+export interface AdoptionResult extends AdoptionScan, CodexAdmissionReceipt {
     applied: boolean;
     /** Rollback record path, when markers were written. */
     rollbackFile?: string;
@@ -48,7 +48,7 @@ export interface RollbackMarker {
     hash: string;
     marker: SyncMarker;
 }
-export interface RollbackRecord {
+export interface RollbackRecord extends CodexAdmissionReceipt {
     version: 1;
     mode: "adopt" | "prune";
     timestamp: string;
@@ -58,7 +58,7 @@ export interface PruneCandidate extends RollbackMarker {
     /** The agent home skills directory. */
     home: string;
 }
-export interface PruneResult {
+export interface PruneResult extends CodexAdmissionReceipt {
     candidates: PruneCandidate[];
     pruned: number;
     dryRun: boolean;
@@ -78,7 +78,7 @@ export declare function scanUnmarkedHomes(options?: AdoptionOptions): AdoptionSc
  * every directory removed (mode "prune"), so both operations are auditable
  * from a single machine-readable file. Deleted resource bytes are not stored.
  */
-export declare function writeRollbackRecord(mode: "adopt" | "prune", entries: RollbackMarker[], appDir?: string): string;
+export declare function writeRollbackRecord(mode: "adopt" | "prune", entries: RollbackMarker[], appDir?: string, admission?: CodexAdmissionReceipt): string;
 /**
  * Adopt unmarked home skills whose content exactly matches the canonical
  * corpus. Without `apply` this is a pure scan; with `apply` it writes one

package/dist/lib/installer.d.ts

@@ -1,7 +1,7 @@
-import { type CodexCorpusWriteOptions } from "./codex-corpus-write.js";
+import { type CodexAdmissionReceipt, type CodexAdmissionRecordOptions, type CodexCorpusWriteOptions } from "./codex-corpus-write.js";
 import { type SkillMeta } from "./registry.js";
 import { type ProjectSkillPin } from "./project-state.js";
-export interface InstallResult {
+export interface InstallResult extends CodexAdmissionReceipt {
     skill: string;
     success: boolean;
     error?: string;
@@ -108,5 +108,7 @@ export declare function installSkillForAgent(name: string, options: AgentInstall
     overwrite?: boolean;
     dryRun?: boolean;
 }, generateSkillMd?: (name: string) => string | null): InstallResult;
-export declare function removeSkillForAgent(name: string, options: AgentInstallOptions): boolean;
+/** Returns only whether it removed; pass `onCodexAdmission` to receive the admission
+ * record. Without it, a Codex home without native admission refuses as before. */
+export declare function removeSkillForAgent(name: string, options: AgentInstallOptions & CodexAdmissionRecordOptions): boolean;
 export {};

package/dist/lib/instance-credentials.d.ts

@@ -16,4 +16,6 @@ export declare function readSkillsInstanceMetadata(file: string): {
  * profile (nothing stored yet, so it may sign in) from a broken selection.
  */
 export declare function skillsFileHasCredential(file: string): boolean;
+/** A stored vault reference must survive interactive sign-in unchanged. */
+export declare function skillsFileHasVaultReference(file: string): boolean;
 export {};

package/dist/lib/sign-in.d.ts

@@ -119,7 +119,7 @@ export declare function clearPendingDeviceSignIn(env?: Env, origin?: string): vo
  * Store the key a sign-in produced, bound to the instance that issued it.
  * A session-only answer (a token, no key) mints a CLI key first.
  */
-export declare function persistSignIn(result: SignInResult, origin: string, env?: Env, issuedBy?: StoredKeyIssuer): Promise<string>;
+export declare function persistSignIn(result: SignInResult, origin: string, env?: Env, issuedBy?: StoredKeyIssuer, assertUnchanged?: () => void): Promise<string>;
 /**
  * What happened to server-side revocation.
  *

package/dist/runtime-prerequisites.js

@@ -49,7 +49,7 @@ var __require = import.meta.require;
 // src/runtime-prerequisites.ts
 import { isAbsolute as isAbsolute7 } from "path";
 // package.json
-var version = "0.10.75";
+var version = "0.10.77";
 var package_default = {
   name: "@hasna/skills",
   version,