@hasna/skills 0.9.10 → 0.9.11

package/dist/lib/agent-codex-trust.d.ts

@@ -40,16 +40,6 @@ export declare function reconcileCodexNativeHooks(options: CodexNativeHookReconc
             before: any;
             after: any;
         }[] | undefined;
-        version: number;
-        kind: string;
-        journal: string;
-        journalIntentSha256: string;
-        stoppedSha256: string;
-        originalPlanDigest: any;
-        policyBeforeSha256: string;
-        policyCurrentSha256: string;
-        configBeforeSha256: string;
-        configCurrentSha256: string;
         hooksSha256: string;
         nativeConfigPath: any;
         nativeVersion: string;
@@ -68,6 +58,17 @@ export declare function reconcileCodexNativeHooks(options: CodexNativeHookReconc
             manifestSha256: string;
         };
         releaseProof: SkillsCliReleaseProof | undefined;
+        configDiscoveryRecovery?: import("./codex-hook-discovery-recovery.js").CodexHookDiscoveryRecovery | undefined;
+        version: number;
+        kind: string;
+        journal: string;
+        journalIntentSha256: string;
+        stoppedSha256: string;
+        originalPlanDigest: any;
+        policyBeforeSha256: string;
+        policyCurrentSha256: string;
+        configBeforeSha256: string;
+        configCurrentSha256: string;
     } | undefined;
     recoveryPlanDigest?: string | undefined;
     version: number;
@@ -80,6 +81,7 @@ export declare function reconcileCodexNativeHooks(options: CodexNativeHookReconc
     nativeVersion: string;
     nativeStateVerified: boolean;
     nativeTrustPending: boolean;
+    bindingRefreshRequired: boolean;
     nativeExecutionVerified: boolean;
     configSha256: string;
     hooksSha256: string;
@@ -125,6 +127,7 @@ export declare function enrollCodexNativeHooks(options?: CodexNativeHookTrustOpt
         trustStatus: any;
     }[];
     nativeEligible: boolean;
+    bindingRefreshRequired: boolean;
     transport: string;
     existingSessionsReloaded: boolean;
     nativeExecutionVerified: boolean;

package/dist/lib/agent-discovery.d.ts

@@ -1,6 +1,7 @@
 import type { IntegrationAgent } from "./agent-adapters.js";
 import { type DiscoveryDirectory } from "./agent-discovery-directories.js";
 import { type ManagedPluginRegistrationWitness } from "./plugin-discovery.js";
+import { type CodexHookDiscoveryRecovery } from "./codex-hook-discovery-recovery.js";
 export { captureDiscoveryDirectories, type DiscoveryDirectory } from "./agent-discovery-directories.js";
 export interface DiscoverySource {
     path: string;
@@ -28,7 +29,7 @@ export interface ReviewedDiscoveryInputs {
         pluginHooks: "reviewed-no-skill-injection";
     }>;
 }
-export declare function verifyAgentDiscovery(binding: AgentDiscoveryBinding): void;
+export declare function verifyAgentDiscovery(binding: AgentDiscoveryBinding, codexRecovery?: CodexHookDiscoveryRecovery): void;
 export declare function rebindAgentDiscovery(binding: AgentDiscoveryBinding, changes: Map<string, string>): AgentDiscoveryBinding;
 /** Capture full byte witnesses for reviewed source or executable files; never import or execute them. */
 export declare function captureDiscoveryByteSources(paths: string[]): DiscoverySource[];

package/dist/lib/agent-integration.d.ts

@@ -1,5 +1,6 @@
 import { type AgentDiscoveryBinding, type ReviewedDiscoveryInputs } from "./agent-discovery.js";
 import { type IntegrationAgent } from "./agent-adapters.js";
+import type { CodexHookDiscoveryRecovery } from "./codex-hook-discovery-recovery.js";
 export type { IntegrationAgent } from "./agent-adapters.js";
 export type ContextHookEvent = "UserPromptSubmit" | "SessionStart" | "SubagentStart";
 export interface AgentRootAlias {
@@ -120,6 +121,7 @@ export declare function assertManagedAgentBridge(agent: IntegrationAgent, option
     projectDir?: string;
     projectDirs?: string[];
     profileId?: string;
+    codexDiscoveryRecovery?: CodexHookDiscoveryRecovery;
 }): void;
 export declare function normalizeAgentHookPrompt(agent: IntegrationAgent, event: string, prompt: string): string;
 export declare function hookContextOutput(event: string, result: {

package/dist/lib/codex-hook-discovery-recovery.d.ts

@@ -0,0 +1,25 @@
+import type { AgentDiscoveryBinding, DiscoverySource } from "./agent-discovery.js";
+import { type snapshot } from "./codex-hook-trust-files.js";
+type Snapshot = ReturnType<typeof snapshot>;
+/** A receipt projection, not an override supplied by a CLI caller. Only this
+ * module can create the in-memory proof used by discovery verification. */
+export interface CodexHookDiscoveryRecovery {
+    readonly configPath: string;
+    readonly beforeSha256: string;
+    readonly currentSha256: string;
+    readonly discoverySha256: string;
+    readonly typedProjectionSha256: string;
+}
+/** Called after a complete journal/intent or the current reviewed native
+ * transaction and exact intended trust writes have been checked. Recheck those
+ * writes here so a raw hash alone can never
+ * grant this exception. Policy bytes and recorded sources remain unchanged. */
+export declare function createCodexHookDiscoveryRecovery(binding: AgentDiscoveryBinding, before: Snapshot, current: Snapshot, hooks: Array<{
+    key: string;
+    currentHash: string;
+}>): CodexHookDiscoveryRecovery | undefined;
+export declare function assertCodexHookDiscoveryRecovery(binding: AgentDiscoveryBinding, witness: CodexHookDiscoveryRecovery): void;
+/** Verify this one historical byte witness using the already-validated native
+ * transition. Every other source still uses its ordinary current-file hash. */
+export declare function verifiesCodexHookDiscoverySource(binding: AgentDiscoveryBinding, source: DiscoverySource, currentDigest: string | null, witness?: CodexHookDiscoveryRecovery): boolean;
+export {};