@hasna/skills 0.9.11 → 0.9.12

package/dist/lib/agent-codex-trust.d.ts

@@ -1,6 +1,7 @@
 import { connectCodexHookRpc } from "./codex-hook-rpc.js";
 import { type ReviewedSkillsCli } from "./codex-hook-trust-identity.js";
 import { type ClaudeDiscoveryRecovery } from "./codex-hook-policy-recovery.js";
+import { type NativeHookAdditionsRecovery } from "./codex-hook-additions-review.js";
 export interface CodexNativeHookTrustOptions {
     home?: string;
     dataDir?: string;
@@ -26,6 +27,7 @@ export interface CodexNativeHookReconcileOptions {
     releaseProof?: SkillsCliReleaseProof;
     supersedeBinding?: boolean;
     claudeDiscoveryRecovery?: ClaudeDiscoveryRecovery;
+    nativeHookAdditionsRecovery?: NativeHookAdditionsRecovery;
 }
 type Connect = typeof connectCodexHookRpc;
 /** Resolve an interrupted native write only after the native consumer and every
@@ -58,6 +60,19 @@ export declare function reconcileCodexNativeHooks(options: CodexNativeHookReconc
             manifestSha256: string;
         };
         releaseProof: SkillsCliReleaseProof | undefined;
+        nativeHookAdditions?: {
+            reviewPath: string;
+            reviewSha256: string;
+            reason: string;
+            producerEvidence: string;
+            producerBefore: {
+                configPath: string;
+                configSha256: string;
+                hooksPath: string;
+                hooksSha256: string;
+            };
+            additions: any[];
+        } | undefined;
         configDiscoveryRecovery?: import("./codex-hook-discovery-recovery.js").CodexHookDiscoveryRecovery | undefined;
         version: number;
         kind: string;

package/dist/lib/agent-discovery.d.ts

@@ -41,6 +41,7 @@ export declare function captureDiscoveryPathSources(paths: string[]): DiscoveryS
 export declare function assertProjectDiscovery(agent: IntegrationAgent, directories: string[], home: string, canonical?: (path: string) => string, reviewed?: AgentDiscoveryBinding): void;
 /** Resolve configured plugin discovery without starting an agent or loading a plugin.
  * Unknown runtime registrations require explicit reviewed inputs, never a cache guess. */
+export declare function agentDiscoveryConfigPath(home: string, agent: IntegrationAgent): string;
 export declare function resolveAgentDiscovery(options: {
     home: string;
     agent: IntegrationAgent;

package/dist/lib/agent-integration.d.ts

@@ -51,6 +51,10 @@ export interface AgentIntegrationPlan {
     discoveryBefore?: AgentDiscoveryBinding[];
     discoveryAfter?: AgentDiscoveryBinding[];
     rootAliases?: AgentRootAlias[];
+    managedAgentChecks?: {
+        home: string;
+        agents: IntegrationAgent[];
+    };
 }
 /** Parse the reviewed exact-target binding used by native migration. Paths are
  * deliberately project-relative so a manifest cannot silently select another
@@ -87,6 +91,17 @@ export declare function planAgentIntegration(options: {
     discoveryInputs?: ReviewedDiscoveryInputs;
     allowRootAliases?: boolean;
 }): AgentIntegrationPlan;
+/** Plan an explicitly authorized Stop hook replacement without adopting drift.
+ * The caller owns authorization of its exact Stop hook delta; Skills refuses
+ * every other settings change and owns discovery witnesses and guarded writes.
+ * No policy means this installer has no Skills integration to update.
+ */
+export declare function planClaudeStopHookUpdate(options: {
+    home?: string;
+    dataDir?: string;
+    expectedSettingsSha256: string;
+    replacement: string;
+}): AgentIntegrationPlan | null;
 export declare function applyAgentIntegration(plan: AgentIntegrationPlan): {
     changed: string[];
     backups: string[];

package/dist/lib/authoring-path.d.ts

@@ -0,0 +1,10 @@
+export interface PortableAuthoringPathOptions {
+    /** The account whose native discovery must remain free of authored payloads. */
+    homeDir?: string;
+}
+/**
+ * Refuse a write target that is, or physically aliases, an agent discovery
+ * root. Read-only inventory and archive operations deliberately do not call
+ * this guard; they must remain able to inspect and migrate native copies.
+ */
+export declare function assertPortableAuthoringPath(path: string, options?: PortableAuthoringPathOptions): void;

package/dist/lib/claude-settings-witness.d.ts

@@ -9,6 +9,12 @@ export declare const CLAUDE_SETTINGS_WITNESS_LIMITS: Readonly<{
 export interface ClaudeSettingsWitnessBudget {
     remaining: number;
 }
+/** Cooperating installers may replace Stop only. Compare the strict syntax
+ * trees, not JSON.parse values or the preference-tolerant witness digest: all
+ * other hooks, discovery settings, unknown values and number spellings remain
+ * identical. Whitespace and object-key order have no configuration meaning.
+ */
+export declare function assertClaudeStopHookReplacement(before: string | null, replacement: string): void;
 /** Hash only reviewed installer-rendered settings after the disk preimage has been verified. */
 export declare function hashClaudeSettingsReplacement(text: string, budget: ClaudeSettingsWitnessBudget): string;
 /** Explicit capture never converts a stored legacy raw witness or changes settings. */

package/dist/lib/codex-hook-additions-review.d.ts

@@ -0,0 +1,42 @@
+import { snapshot } from "./codex-hook-trust-files.js";
+type Snapshot = ReturnType<typeof snapshot>;
+export interface NativeHookAdditionsRecovery {
+    path: string;
+    reviewedPlanDigest?: string;
+}
+/** An explicit, private review of a later producer's append-only hook change.
+ * The producer backups must themselves describe exactly the completed journal
+ * operation. Neither a claimed receipt nor a matching raw hash grants authority
+ * to replace an original hook or accept unrelated configuration changes. */
+export declare function reviewNativeHookAdditions(options: {
+    path: string;
+    intent: Snapshot;
+    policy: Snapshot;
+    configBefore: Snapshot;
+    configCurrent: Snapshot;
+    hooksBefore: Snapshot;
+    hooksCurrent: Snapshot;
+    nativeHooksPath: string;
+    journalHooks: Array<{
+        key: string;
+        currentHash: string;
+    }>;
+    recordedNativeHooks: any[];
+}): {
+    hooks: any[];
+    recheck: () => void;
+    receipt: {
+        reviewPath: string;
+        reviewSha256: string;
+        reason: string;
+        producerEvidence: string;
+        producerBefore: {
+            configPath: string;
+            configSha256: string;
+            hooksPath: string;
+            hooksSha256: string;
+        };
+        additions: any[];
+    };
+};
+export {};

package/dist/lib/native-discovery-roots.d.ts

@@ -0,0 +1,2 @@
+/** Shared default discovery roots for inventory and authoring exclusion. */
+export declare const NATIVE_SKILL_ROOTS: readonly [readonly ["claude", ".claude/skills"], readonly ["codex", ".codex/skills"], readonly ["codex", ".agents/skills"], readonly ["gemini", ".gemini/skills"], readonly ["codewith", ".codewith/skills"], readonly ["opencode", ".config/opencode/skills"], readonly ["opencode", ".opencode/skills"], readonly ["cursor", ".cursor/skills"], readonly ["hermes", ".hermes/skills"], readonly ["windsurf", ".windsurf/skills"], readonly ["pi", ".pi/agent/skills"], readonly ["amp", ".amp/skills"], readonly ["cline", ".cline/skills"], readonly ["roo", ".roo/skills"], readonly ["copilot", ".github/skills"]];