@hasna/skills 0.9.17 → 0.9.19

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.9.17",
+    version: "0.9.19",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -48622,7 +48622,8 @@ async function resolveSkillsConnection(env3 = process.env, options = {}) {
   }
   let completed;
   try {
-    completed = await completePointerCredential(SKILLS_APP, pointer, env3);
+    const explicitVault = Boolean(snapshotEnv.HASNA_SECRETS_API_URL?.trim() && snapshotEnv.HASNA_SECRETS_API_KEY_OVERRIDE?.trim());
+    completed = await completePointerCredential(SKILLS_APP, pointer, explicitVault ? snapshotEnv : env3);
   } catch (error) {
     const translated = asSkillsFleetCredentialError(error, pointer.pointerVaultKey);
     if (translated)
@@ -79049,7 +79050,20 @@ class RemoteSkillsClient {
       const url2 = new URL(upload.uploadUrl);
       if (url2.username || url2.password || url2.hash || url2.protocol !== "https:" && !(url2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname)))
         throw new Error("Unsafe input upload URL");
-      const uploaded = await fetch(url2, { method: "PUT", body: file2.bytes, headers: { "Content-Type": file2.contentType ?? "application/octet-stream" }, redirect: "error", signal: AbortSignal.timeout(60000) });
+      const headers = new Headers({ "Content-Type": file2.contentType ?? "application/octet-stream" });
+      if (upload.uploadHeaders !== undefined) {
+        if (upload.uploadHeaders === null || typeof upload.uploadHeaders !== "object" || Array.isArray(upload.uploadHeaders))
+          throw new Error("Invalid input upload headers");
+        const seen = new Set;
+        for (const [name, value] of Object.entries(upload.uploadHeaders)) {
+          const lowerName = name.toLowerCase();
+          if (seen.has(lowerName) || !["if-none-match", "x-amz-tagging"].includes(lowerName) || typeof value !== "string" || value.length === 0 || value.length > 2048 || !/^[\x20-\x7e]+$/.test(value) || value.trim() !== value || lowerName === "if-none-match" && value !== "*")
+            throw new Error("Invalid input upload headers");
+          seen.add(lowerName);
+          headers.set(name, value);
+        }
+      }
+      const uploaded = await fetch(url2, { method: "PUT", body: file2.bytes, headers, redirect: "error", signal: AbortSignal.timeout(60000) });
       if (!uploaded.ok)
         throw new Error("Input upload failed");
       await uploaded.body?.cancel();
@@ -108490,6 +108504,52 @@ var init_create_sync_config = __esm(() => {
   init_station_snapshot();
 });
 
+// src/lib/codex-native-config.ts
+import { isDeepStrictEqual as isDeepStrictEqual9 } from "util";
+function isRecord6(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function decimalIdentity(text4) {
+  if (text4.length > 4096)
+    return;
+  const match = /^(-?)(0|[1-9][0-9]*)(?:\.([0-9]+))?(?:[eE]([+-]?[0-9]+))?$/.exec(text4);
+  if (!match || !Number.isFinite(Number(text4)))
+    return;
+  const fraction = match[3] ?? "";
+  const digits = (match[2] + fraction).replace(/^0+/, "");
+  if (!digits)
+    return match[1] + "0";
+  const coefficient = digits.replace(/0+$/, "");
+  const exponent = BigInt(match[4] ?? "0") - BigInt(fraction.length) + BigInt(digits.length - coefficient.length);
+  return `${match[1]}${coefficient}e${exponent}`;
+}
+function codexNativeConfigEqual(native, expected) {
+  if (isDeepStrictEqual9(native, expected))
+    return true;
+  if (typeof expected === "number") {
+    if (!Number.isFinite(expected) || !isRecord6(native))
+      return false;
+    const keys3 = Object.keys(native);
+    const value = native[NUMBER_TAG];
+    if (keys3.length !== 1 || keys3[0] !== NUMBER_TAG || typeof value !== "string")
+      return false;
+    const actual2 = decimalIdentity(value);
+    return actual2 !== undefined && actual2 === decimalIdentity(Object.is(expected, -0) ? "-0" : String(expected));
+  }
+  if (Array.isArray(native) || Array.isArray(expected)) {
+    return Array.isArray(native) && Array.isArray(expected) && native.length === expected.length && native.every((value, index) => codexNativeConfigEqual(value, expected[index]));
+  }
+  if (!isRecord6(native) || !isRecord6(expected))
+    return false;
+  const actual = native, wanted = expected;
+  return Object.keys(actual).length === Object.keys(wanted).length && Object.keys(wanted).every((key) => Object.hasOwn(actual, key) && codexNativeConfigEqual(actual[key], wanted[key]));
+}
+var NUMBER_TAG = "$serde_json::private::Number";
+var init_codex_native_config = () => {};
+
 // src/lib/codex-hook-rpc.ts
 import { execFile, spawn as spawn3 } from "child_process";
 import { realpathSync as realpathSync12, statSync as statSync20 } from "fs";
@@ -108633,7 +108693,7 @@ var init_codex_hook_rpc = __esm(() => {
 // src/lib/codex-hook-trust-identity.ts
 import { realpathSync as realpathSync13 } from "fs";
 import { dirname as dirname30, isAbsolute as isAbsolute25, join as join56 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual9 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual10 } from "util";
 function inspectRecordedSkillsCli(command, expected) {
   need4(isAbsolute25(command) && !command.includes("\x00"), "RECONCILE_RECORDED_COMMAND_REQUIRED");
   const resolved = realpathSync13(command);
@@ -108643,7 +108703,7 @@ function inspectRecordedSkillsCli(command, expected) {
   need4(pkg.name === "@hasna/skills" && /^\d+\.\d+\.\d+$/.test(pkg.version) && pkg.bin?.skills === "bin/index.js" && resolved === join56(dirname30(manifest.file), "bin/index.js"), "SKILLS_PACKAGE_MISMATCH");
   need4((cli.stat.mode & 0o100n) !== 0n, "SKILLS_COMMAND_NOT_EXECUTABLE");
   const receipt = { path: resolved, version: pkg.version, sha256: cli.sha256, manifestSha256: manifest.sha256 };
-  need4(isDeepStrictEqual9(receipt, expected), "RECONCILE_SKILLS_BINDING_CHANGED");
+  need4(isDeepStrictEqual10(receipt, expected), "RECONCILE_SKILLS_BINDING_CHANGED");
   return { receipt, recheck() {
     need4(realpathSync13(command) === resolved, "SKILLS_COMMAND_CHANGED");
     unchanged2(cli);
@@ -108679,19 +108739,19 @@ var init_codex_hook_trust_identity = __esm(() => {
 });
 
 // src/lib/codex-hook-policy-recovery.ts
-import { isDeepStrictEqual as isDeepStrictEqual10 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual11 } from "util";
 function reviewedClaudeDiscoveryChange(beforeText, currentText, options) {
   need4(typeof options.reason === "string" && options.reason.trim().length > 0 && options.reason.length <= 512 && !/[\x00-\x1f\x7f]/.test(options.reason), "RECONCILE_RECOVERY_REASON_REQUIRED");
   need4(options.reviewedPlanDigest === undefined || /^[a-f0-9]{64}$/.test(options.reviewedPlanDigest), "RECONCILE_RECOVERY_PLAN_CHANGED");
   const before2 = parseManagedSkillPolicy(beforeText), current = parseManagedSkillPolicy(currentText);
   const oldDiscovery = before2.bridge?.discovery?.claude, newDiscovery = current.bridge?.discovery?.claude;
   need4(oldDiscovery?.agent === "claude" && newDiscovery?.agent === "claude" && oldDiscovery.method === "reviewed" && newDiscovery.method === "reviewed", "RECONCILE_POLICY_CHANGED");
-  const changes = ["roots", "sources"].filter((key) => !isDeepStrictEqual10(oldDiscovery[key], newDiscovery[key])).map((key) => ({ path: `bridge.discovery.claude.${key}`, before: oldDiscovery[key], after: newDiscovery[key] }));
+  const changes = ["roots", "sources"].filter((key) => !isDeepStrictEqual11(oldDiscovery[key], newDiscovery[key])).map((key) => ({ path: `bridge.discovery.claude.${key}`, before: oldDiscovery[key], after: newDiscovery[key] }));
   need4(changes.length > 0, "RECONCILE_POLICY_CHANGED");
   const compared = structuredClone(current);
   compared.bridge.discovery.claude.roots = oldDiscovery.roots;
   compared.bridge.discovery.claude.sources = oldDiscovery.sources;
-  need4(isDeepStrictEqual10(before2, compared), "RECONCILE_POLICY_CHANGED");
+  need4(isDeepStrictEqual11(before2, compared), "RECONCILE_POLICY_CHANGED");
   verifyAgentDiscovery(newDiscovery);
   return { reason: options.reason, changes };
 }
@@ -108707,7 +108767,7 @@ import { createHash as createHash27, randomUUID as randomUUID10 } from "crypto";
 import { execFileSync } from "child_process";
 import { dirname as dirname31, isAbsolute as isAbsolute26, join as join57, resolve as resolve23 } from "path";
 import { homedir as homedir12 } from "os";
-import { isDeepStrictEqual as isDeepStrictEqual11 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual12 } from "util";
 function verifyReleaseArtifact(proof, skillsCli) {
   need4(isAbsolute26(proof.packageTarPath) && !proof.packageTarPath.includes("\x00"), "RECONCILE_RELEASE_PROVENANCE_PATH");
   const tarPath = realpathSync14(proof.packageTarPath);
@@ -108749,7 +108809,7 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     const configSha256 = intent.configSha256 ?? configBefore.sha256, configVersion = intent.configVersion ?? intent.expectedVersion;
     const digestInput = { version: 1, home: intent.home ?? home, configPath: intent.configPath, ...intent.nativeConfigPath !== undefined ? { nativeConfigPath: intent.nativeConfigPath } : {}, configSha256, configVersion, policySha256: intent.policySha256, hooksSha256: intent.hooksSha256, skillsCli: intent.skillsCli, nativeVersion: intent.nativeVersion, declarations, admitted };
     need4(makePlanDigest(digestInput) === intent.planDigest, "RECONCILE_PLAN_CHANGED");
-    need4(isDeepStrictEqual11(intent.hooks, admitted.filter((hook) => !hook.enabled || hook.trustStatus !== "trusted")), "RECONCILE_INTENT_HOOKS_CHANGED");
+    need4(isDeepStrictEqual12(intent.hooks, admitted.filter((hook) => !hook.enabled || hook.trustStatus !== "trusted")), "RECONCILE_INTENT_HOOKS_CHANGED");
     need4(configBefore.sha256 === (intent.beforeSha256 ?? intent.configSha256) && hooksBefore.sha256 === intent.hooksSha256 && policyBefore.sha256 === intent.policySha256, "RECONCILE_JOURNAL_CHANGED");
     const policyCurrent = snapshot(join57(dataDir3, "agent-policy.json"), true);
     const { claudeDiscoveryRecovery: claudeRecovery, nativeHookAdditionsRecovery: additionsRecovery } = options;
@@ -108762,7 +108822,7 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     if (policyCurrent.sha256 !== policyBefore.sha256 && !claudeRecovery) {
       need4(options.supersedeBinding === true, "RECONCILE_POLICY_CHANGED");
       const oldPolicy = JSON.parse(policyBefore.text), currentPolicy = JSON.parse(policyCurrent.text);
-      need4(isDeepStrictEqual11(withoutCodexCommand(oldPolicy), withoutCodexCommand(currentPolicy)), "RECONCILE_POLICY_CHANGED");
+      need4(isDeepStrictEqual12(withoutCodexCommand(oldPolicy), withoutCodexCommand(currentPolicy)), "RECONCILE_POLICY_CHANGED");
       supersededBinding = true;
     }
     if (supersededBinding || recovery) {
@@ -108798,7 +108858,7 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
         need4(state?.enabled === true && typeof state.trusted_hash === "string" && /^sha256:[a-f0-9]{64}$/.test(state.trusted_hash), "RECONCILE_CONFIG_DRIFT");
       }
     } else
-      need4(isDeepStrictEqual11(expectedConfig, current), "RECONCILE_CONFIG_DRIFT");
+      need4(isDeepStrictEqual12(expectedConfig, current), "RECONCILE_CONFIG_DRIFT");
     const configDiscoveryRecovery = recovery && binding.discovery?.codex ? createCodexHookDiscoveryRecovery(binding.discovery.codex, configBefore, currentConfig, intent.hooks, additions?.trustProof) : undefined;
     assertManagedAgentBridge("codex", { home, dataDir: dataDir3, projectDir: home, codexDiscoveryRecovery: configDiscoveryRecovery });
     const recoveryCli = recovery ? bindSkillsCli("skills", options.reviewedSkillsCli) : undefined;
@@ -108807,14 +108867,14 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     const skillsCli = recovery ? inspectRecordedSkillsCli(binding.commands.codex, intent.skillsCli) : bindSkillsCli(binding.commands.codex, options.reviewedSkillsCli);
     if (supersededBinding)
       verifyReleaseArtifact(options.releaseProof, skillsCli);
-    const skillsBindingChanged = !isDeepStrictEqual11(skillsCli.receipt, intent.skillsCli);
+    const skillsBindingChanged = !isDeepStrictEqual12(skillsCli.receipt, intent.skillsCli);
     need4(!skillsBindingChanged || supersededBinding, "RECONCILE_SKILLS_BINDING_CHANGED");
     if (!additions && hooksCurrent.sha256 !== intent.hooksSha256 && hooksCurrent.sha256 !== hooksBefore.sha256) {
       need4(supersededBinding, "RECONCILE_HOOKS_CHANGED");
       const currentDeclarations = JSON.parse(hooksCurrent.text).hooks;
       for (const [event, [nativeEvent]] of Object.entries(eventNames)) {
         const command = renderAgentHookCommand(binding.commands.codex, "codex", binding.profiles.codex, event);
-        need4(isDeepStrictEqual11(currentDeclarations?.[event], [{ hooks: [{ type: "command", command, timeout: 15 }] }]), "RECONCILE_BINDING_HOOK_CHANGED");
+        need4(isDeepStrictEqual12(currentDeclarations?.[event], [{ hooks: [{ type: "command", command, timeout: 15 }] }]), "RECONCILE_BINDING_HOOK_CHANGED");
       }
     }
     rpc = await connect({ command: options.codexCommand ?? "codex", home, codexHome });
@@ -108837,9 +108897,9 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
           delete identity4.command;
         return identity4;
       };
-      need4(isDeepStrictEqual11(stable(actual), stable(expected)), "RECONCILE_NATIVE_IDENTITY_CHANGED");
+      need4(isDeepStrictEqual12(stable(actual), stable(expected)), "RECONCILE_NATIVE_IDENTITY_CHANGED");
       if (!plannedKeys.has(expected.key))
-        need4(isDeepStrictEqual11(actual, expected), "RECONCILE_UNRELATED_HOOK_CHANGED");
+        need4(isDeepStrictEqual12(actual, expected), "RECONCILE_UNRELATED_HOOK_CHANGED");
     }
     for (const wanted of intent.hooks) {
       const matches2 = nativeHooks.filter((h2) => h2.key === wanted.key || h2.key === wanted.key.replace(join57(home, ".codex/hooks.json"), hooksPath));
@@ -108856,12 +108916,12 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     }
     const config2 = await rpc.request("config/read", { includeLayers: true, cwd: home });
     const layers = config2?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
-    need4(layers?.length === 1 && !layers[0].disabledReason && isDeepStrictEqual11(layers[0].config, current), "RECONCILE_NATIVE_CONFIG_MISMATCH");
+    need4(layers?.length === 1 && !layers[0].disabledReason && codexNativeConfigEqual(layers[0].config, current), "RECONCILE_NATIVE_CONFIG_MISMATCH");
     const finalDiscovery = await rpc.request("hooks/list", { cwds: [home] });
-    need4(Array.isArray(finalDiscovery?.data) && finalDiscovery.data.length === 1 && finalDiscovery.data[0].cwd === home && !finalDiscovery.data[0].errors?.length && !finalDiscovery.data[0].warnings?.length && (!recordedNativeHooks || isDeepStrictEqual11(finalDiscovery.data[0].hooks.map(safeNativeHook), nativeHooks.map(safeNativeHook))), "RECONCILE_NATIVE_STATE_CHANGED");
+    need4(Array.isArray(finalDiscovery?.data) && finalDiscovery.data.length === 1 && finalDiscovery.data[0].cwd === home && !finalDiscovery.data[0].errors?.length && !finalDiscovery.data[0].warnings?.length && (!recordedNativeHooks || isDeepStrictEqual12(finalDiscovery.data[0].hooks.map(safeNativeHook), nativeHooks.map(safeNativeHook))), "RECONCILE_NATIVE_STATE_CHANGED");
     const finalConfig = await rpc.request("config/read", { includeLayers: true, cwd: home });
     const finalLayers = finalConfig?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
-    need4(finalLayers?.length === 1 && !finalLayers[0].disabledReason && isDeepStrictEqual11(finalLayers[0].config, current), "RECONCILE_NATIVE_CONFIG_CHANGED");
+    need4(finalLayers?.length === 1 && !finalLayers[0].disabledReason && codexNativeConfigEqual(finalLayers[0].config, current), "RECONCILE_NATIVE_CONFIG_CHANGED");
     if (recovery) {
       for (const response of [config2, finalConfig]) {
         const layerIndex = response.layers.findIndex((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
@@ -108919,7 +108979,7 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
       const groups = declarations[event];
       need4(Array.isArray(groups), "DECLARATION_CHANGED");
       const matches2 = groups.flatMap((group, gi) => (group.hooks ?? []).flatMap((entry, hi) => entry.command === command ? [{ group, entry, gi, hi }] : []));
-      need4(matches2.length === 1 && isDeepStrictEqual11(matches2[0].group, { hooks: [{ type: "command", command, timeout: 15 }] }), "DECLARATION_CHANGED");
+      need4(matches2.length === 1 && isDeepStrictEqual12(matches2[0].group, { hooks: [{ type: "command", command, timeout: 15 }] }), "DECLARATION_CHANGED");
       expected.push({ event: nativeEvent, key: `${join57(home, ".codex/hooks.json")}:${label}:${matches2[0].gi}:${matches2[0].hi}`, command });
     }
     codexTrustTextWitness(configFile.text, expected.map((h) => h.key));
@@ -108943,7 +109003,7 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
     const discovered = await list2(), admitted = admit(discovered);
     const config2 = await rpc.request("config/read", { includeLayers: true, cwd: home });
     const layers = config2?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
-    need4(layers?.length === 1 && /^sha256:[a-f0-9]{64}$/.test(layers[0].version) && !layers[0].disabledReason && isDeepStrictEqual11(layers[0].config, original), "NATIVE_CONFIG_MISMATCH");
+    need4(layers?.length === 1 && /^sha256:[a-f0-9]{64}$/.test(layers[0].version) && !layers[0].disabledReason && codexNativeConfigEqual(layers[0].config, original), "NATIVE_CONFIG_MISMATCH");
     need4(config2.config && config2.config.features?.hooks !== false, "NATIVE_HOOKS_DISABLED");
     need4(config2.layers.slice(0, config2.layers.indexOf(layers[0])).every((layer) => layer.config?.hooks === undefined && layer.config?.features?.hooks === undefined), "NATIVE_CONFIG_OVERRIDDEN");
     const keys3 = admitted.map((h) => h.key), planned = admitted.filter((h) => !h.enabled || h.trustStatus !== "trusted");
@@ -108982,7 +109042,7 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
     save(join57(journal, "hooks.before.json"), hooksFile.bytes);
     save(join57(journal, "policy.before.json"), policyFile.bytes);
     save(join57(journal, "intent.json"), json2({ ...digestInput, planDigest, hooks: planned, nativeHooks: discovered.map(safeNativeHook) }));
-    need4(isDeepStrictEqual11(admit(await list2()), admitted), "NATIVE_DISCOVERY_CHANGED");
+    need4(isDeepStrictEqual12(admit(await list2()), admitted), "NATIVE_DISCOVERY_CHANGED");
     checkInputs();
     let result2;
     try {
@@ -108996,7 +109056,7 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
     expectedConfig.hooks.state ??= {};
     for (const h of planned)
       expectedConfig.hooks.state[h.key] = { ...expectedConfig.hooks.state[h.key], enabled: true, trusted_hash: h.currentHash };
-    need4(isDeepStrictEqual11(structure3(after2.text), expectedConfig) && codexTrustTextWitness(after2.text, keys3) === preservationText, "PRESERVATION_FAILED");
+    need4(isDeepStrictEqual12(structure3(after2.text), expectedConfig) && codexTrustTextWitness(after2.text, keys3) === preservationText, "PRESERVATION_FAILED");
     const savedConfig = snapshot(join57(journal, "config.before.toml"), true);
     need4(savedConfig.sha256 === configFile.sha256, "JOURNAL_CHANGED");
     const discoveryTransition = binding.discovery?.codex ? createCodexHookDiscoveryRecovery(binding.discovery.codex, savedConfig, after2, planned) : undefined;
@@ -109004,8 +109064,8 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
     unchanged2(hooksFile);
     assertManagedAgentBridge("codex", { home, dataDir: dataDir3, projectDir: home, codexDiscoveryRecovery: discoveryTransition });
     const current = await list2(), confirmed = admit(current);
-    need4(confirmed.every((h) => h.enabled && h.trustStatus === "trusted") && isDeepStrictEqual11(confirmed.map((h) => [h.key, h.currentHash]), admitted.map((h) => [h.key, h.currentHash])), "NATIVE_NOT_ELIGIBLE");
-    need4(isDeepStrictEqual11(current.filter((h) => !keys3.includes(h.key)), discovered.filter((h) => !keys3.includes(h.key))), "UNRELATED_HOOK_CHANGED");
+    need4(confirmed.every((h) => h.enabled && h.trustStatus === "trusted") && isDeepStrictEqual12(confirmed.map((h) => [h.key, h.currentHash]), admitted.map((h) => [h.key, h.currentHash])), "NATIVE_NOT_ELIGIBLE");
+    need4(isDeepStrictEqual12(current.filter((h) => !keys3.includes(h.key)), discovered.filter((h) => !keys3.includes(h.key))), "UNRELATED_HOOK_CHANGED");
     unchanged2(after2);
     unchanged2(savedConfig);
     unchanged2(hooksFile);
@@ -109035,6 +109095,7 @@ var json2 = (value) => JSON.stringify(value, null, 2) + `
   return copy;
 };
 var init_agent_codex_trust = __esm(() => {
+  init_codex_native_config();
   init_config();
   init_managed_policy();
   init_agent_integration();
@@ -110044,7 +110105,7 @@ function prepareSkill(name, options) {
   let manifest;
   try {
     const parsed = JSON.parse(manifestFile.bytes.toString("utf8"));
-    if (!isRecord6(parsed))
+    if (!isRecord7(parsed))
       throw new Error("not an object");
     manifest = parsed;
   } catch {
@@ -110066,7 +110127,7 @@ function prepareSkill(name, options) {
   if (documentKind !== undefined && documentKind !== kind) {
     throw new Error("SKILL.md kind conflicts with the candidate skill.json kind. Review and align both declarations (or remove the optional frontmatter kind), then prepare again; no files were changed.");
   }
-  if (manifest.provenance !== undefined && !isRecord6(manifest.provenance))
+  if (manifest.provenance !== undefined && !isRecord7(manifest.provenance))
     throw new Error("skill.json provenance must be an object.");
   const provenance = manifest.provenance;
   const candidate2 = { ...manifest, version: options.version, kind, provenance: { ...provenance } };
@@ -110131,7 +110192,7 @@ function escapedRelativePath(path) {
   return JSON.stringify(bounded);
 }
 function validateRuntimeEntrypoint(candidate2, root2) {
-  if (candidate2.kind !== "executable" || !isRecord6(candidate2.runtime))
+  if (candidate2.kind !== "executable" || !isRecord7(candidate2.runtime))
     return;
   const entry = candidate2.runtime.entrypoint;
   if (typeof entry !== "string")
@@ -110141,7 +110202,7 @@ function validateRuntimeEntrypoint(candidate2, root2) {
     throw new Error("Executable runtime.entrypoint must name an existing regular file inside the skill directory.");
   }
 }
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function validateRawCandidate(candidate2) {
@@ -110166,7 +110227,7 @@ function validateRawCandidate(candidate2) {
     if (!Array.isArray(items))
       throw new Error(`skill.json ${field2} must be an array.`);
     for (const item of items) {
-      if (!isRecord6(item) || typeof item.name !== "string" || !item.name.trim())
+      if (!isRecord7(item) || typeof item.name !== "string" || !item.name.trim())
         throw new Error(`Invalid skill.json ${field2} name.`);
       if (field2 === "inputs" && (typeof item.type !== "string" || !item.type.trim() || item.required !== undefined && typeof item.required !== "boolean"))
         throw new Error("Invalid skill.json input type or required flag.");
@@ -110185,7 +110246,7 @@ function validateRawCandidate(candidate2) {
   }
 }
 function validateRuntimeEntrypointCompatibility(candidate2) {
-  if (candidate2.kind !== "executable" || !isRecord6(candidate2.runtime))
+  if (candidate2.kind !== "executable" || !isRecord7(candidate2.runtime))
     return;
   const runtime = candidate2.runtime.runtime;
   const entrypoint = candidate2.runtime.entrypoint;
@@ -111400,7 +111461,7 @@ async function apiRequest(path, options, instance) {
   const origin = instance ?? getApiUrl(`${(options?.method || "GET").toUpperCase()} ${path}`);
   return new RemoteSkillsAuthClient(origin).request(path, options);
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 function commandErrorPayload(err, fallback) {
@@ -111414,7 +111475,7 @@ function commandErrorPayload(err, fallback) {
       ...err.apiUrl ? { apiUrl: err.apiUrl } : {}
     };
   }
-  const code2 = isRecord7(err) && typeof err.code === "string" ? err.code : undefined;
+  const code2 = isRecord8(err) && typeof err.code === "string" ? err.code : undefined;
   return {
     error: err?.message || fallback,
     ...code2 ? { code: code2 } : {}
@@ -111442,7 +111503,7 @@ function stringField2(value) {
   return typeof value === "string" && value.length > 0 ? value : undefined;
 }
 function recordField(value) {
-  return isRecord7(value) ? value : undefined;
+  return isRecord8(value) ? value : undefined;
 }
 function identityApiKey(live) {
   const root2 = recordField(live);
@@ -111932,7 +111993,7 @@ function registerAuth(parent) {
       } catch {}
       payload.permissions = { publish: access?.permissions?.publish ?? null, profilesWrite: access?.permissions?.profilesWrite ?? null };
       const apiKey = identityApiKey(res);
-      if (access?.scopes && (apiKey === undefined || isRecord7(apiKey) && !Object.hasOwn(apiKey, "scopes"))) {
+      if (access?.scopes && (apiKey === undefined || isRecord8(apiKey) && !Object.hasOwn(apiKey, "scopes"))) {
         payload.scopes = access.scopes;
       }
       if (options.json) {

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.9.17",
+    version: "0.9.19",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -21311,7 +21311,8 @@ async function resolveSkillsConnection(env = process.env, options = {}) {
   }
   let completed;
   try {
-    completed = await completePointerCredential(SKILLS_APP, pointer, env);
+    const explicitVault = Boolean(snapshotEnv.HASNA_SECRETS_API_URL?.trim() && snapshotEnv.HASNA_SECRETS_API_KEY_OVERRIDE?.trim());
+    completed = await completePointerCredential(SKILLS_APP, pointer, explicitVault ? snapshotEnv : env);
   } catch (error61) {
     const translated = asSkillsFleetCredentialError(error61, pointer.pointerVaultKey);
     if (translated)
@@ -52027,7 +52028,20 @@ class RemoteSkillsClient {
       const url2 = new URL(upload.uploadUrl);
       if (url2.username || url2.password || url2.hash || url2.protocol !== "https:" && !(url2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname)))
         throw new Error("Unsafe input upload URL");
-      const uploaded = await fetch(url2, { method: "PUT", body: file2.bytes, headers: { "Content-Type": file2.contentType ?? "application/octet-stream" }, redirect: "error", signal: AbortSignal.timeout(60000) });
+      const headers = new Headers({ "Content-Type": file2.contentType ?? "application/octet-stream" });
+      if (upload.uploadHeaders !== undefined) {
+        if (upload.uploadHeaders === null || typeof upload.uploadHeaders !== "object" || Array.isArray(upload.uploadHeaders))
+          throw new Error("Invalid input upload headers");
+        const seen = new Set;
+        for (const [name, value] of Object.entries(upload.uploadHeaders)) {
+          const lowerName = name.toLowerCase();
+          if (seen.has(lowerName) || !["if-none-match", "x-amz-tagging"].includes(lowerName) || typeof value !== "string" || value.length === 0 || value.length > 2048 || !/^[\x20-\x7e]+$/.test(value) || value.trim() !== value || lowerName === "if-none-match" && value !== "*")
+            throw new Error("Invalid input upload headers");
+          seen.add(lowerName);
+          headers.set(name, value);
+        }
+      }
+      const uploaded = await fetch(url2, { method: "PUT", body: file2.bytes, headers, redirect: "error", signal: AbortSignal.timeout(60000) });
       if (!uploaded.ok)
         throw new Error("Input upload failed");
       await uploaded.body?.cancel();

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.17",
+  version: "0.9.19",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.17",
+  version: "0.9.19",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -24125,7 +24125,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.17",
+  version: "0.9.19",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/index.js

@@ -9611,7 +9611,7 @@ import { isAbsolute as isAbsolute11, join as join23, resolve as resolve11 } from
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.17",
+  version: "0.9.19",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -10891,7 +10891,8 @@ async function resolveSkillsConnection(env = process.env, options = {}) {
   }
   let completed;
   try {
-    completed = await completePointerCredential(SKILLS_APP, pointer, env);
+    const explicitVault = Boolean(snapshotEnv.HASNA_SECRETS_API_URL?.trim() && snapshotEnv.HASNA_SECRETS_API_KEY_OVERRIDE?.trim());
+    completed = await completePointerCredential(SKILLS_APP, pointer, explicitVault ? snapshotEnv : env);
   } catch (error) {
     const translated = asSkillsFleetCredentialError(error, pointer.pointerVaultKey);
     if (translated)
@@ -39095,7 +39096,20 @@ class RemoteSkillsClient {
       const url2 = new URL(upload.uploadUrl);
       if (url2.username || url2.password || url2.hash || url2.protocol !== "https:" && !(url2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname)))
         throw new Error("Unsafe input upload URL");
-      const uploaded = await fetch(url2, { method: "PUT", body: file2.bytes, headers: { "Content-Type": file2.contentType ?? "application/octet-stream" }, redirect: "error", signal: AbortSignal.timeout(60000) });
+      const headers = new Headers({ "Content-Type": file2.contentType ?? "application/octet-stream" });
+      if (upload.uploadHeaders !== undefined) {
+        if (upload.uploadHeaders === null || typeof upload.uploadHeaders !== "object" || Array.isArray(upload.uploadHeaders))
+          throw new Error("Invalid input upload headers");
+        const seen = new Set;
+        for (const [name, value] of Object.entries(upload.uploadHeaders)) {
+          const lowerName = name.toLowerCase();
+          if (seen.has(lowerName) || !["if-none-match", "x-amz-tagging"].includes(lowerName) || typeof value !== "string" || value.length === 0 || value.length > 2048 || !/^[\x20-\x7e]+$/.test(value) || value.trim() !== value || lowerName === "if-none-match" && value !== "*")
+            throw new Error("Invalid input upload headers");
+          seen.add(lowerName);
+          headers.set(name, value);
+        }
+      }
+      const uploaded = await fetch(url2, { method: "PUT", body: file2.bytes, headers, redirect: "error", signal: AbortSignal.timeout(60000) });
       if (!uploaded.ok)
         throw new Error("Input upload failed");
       await uploaded.body?.cancel();

package/dist/lib/codex-native-config.d.ts

@@ -0,0 +1,5 @@
+/** Codex config/read can expose serde_json's numeric wrapper for TOML floats.
+ * Admit it only against an equal numeric value from the complete disk parse.
+ * Ordinary objects, strings, native trust state and unknown fields stay exact.
+ */
+export declare function codexNativeConfigEqual(native: unknown, expected: unknown): boolean;

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.17",
+  version: "0.9.19",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -33712,7 +33712,8 @@ async function resolveSkillsConnection(env = process.env, options = {}) {
   }
   let completed;
   try {
-    completed = await completePointerCredential(SKILLS_APP, pointer, env);
+    const explicitVault = Boolean(snapshotEnv.HASNA_SECRETS_API_URL?.trim() && snapshotEnv.HASNA_SECRETS_API_KEY_OVERRIDE?.trim());
+    completed = await completePointerCredential(SKILLS_APP, pointer, explicitVault ? snapshotEnv : env);
   } catch (error) {
     const translated = asSkillsFleetCredentialError(error, pointer.pointerVaultKey);
     if (translated)
@@ -89665,7 +89666,20 @@ class RemoteSkillsClient {
       const url2 = new URL(upload.uploadUrl);
       if (url2.username || url2.password || url2.hash || url2.protocol !== "https:" && !(url2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname)))
         throw new Error("Unsafe input upload URL");
-      const uploaded = await fetch(url2, { method: "PUT", body: file2.bytes, headers: { "Content-Type": file2.contentType ?? "application/octet-stream" }, redirect: "error", signal: AbortSignal.timeout(60000) });
+      const headers = new Headers({ "Content-Type": file2.contentType ?? "application/octet-stream" });
+      if (upload.uploadHeaders !== undefined) {
+        if (upload.uploadHeaders === null || typeof upload.uploadHeaders !== "object" || Array.isArray(upload.uploadHeaders))
+          throw new Error("Invalid input upload headers");
+        const seen = new Set;
+        for (const [name, value] of Object.entries(upload.uploadHeaders)) {
+          const lowerName = name.toLowerCase();
+          if (seen.has(lowerName) || !["if-none-match", "x-amz-tagging"].includes(lowerName) || typeof value !== "string" || value.length === 0 || value.length > 2048 || !/^[\x20-\x7e]+$/.test(value) || value.trim() !== value || lowerName === "if-none-match" && value !== "*")
+            throw new Error("Invalid input upload headers");
+          seen.add(lowerName);
+          headers.set(name, value);
+        }
+      }
+      const uploaded = await fetch(url2, { method: "PUT", body: file2.bytes, headers, redirect: "error", signal: AbortSignal.timeout(60000) });
       if (!uploaded.ok)
         throw new Error("Input upload failed");
       await uploaded.body?.cancel();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.9.17",
+  "version": "0.9.19",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {