@hasna/skills 0.9.6 → 0.9.8

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.9.6",
+    version: "0.9.8",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -108033,7 +108033,7 @@ var init_codex_hook_rpc = __esm(() => {
 
 // src/lib/codex-hook-trust-layout.ts
 import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
-function codexTrustTextWitness(text3, keys3) {
+function codexTrustTextWitness(text3, keys3, canonicalize = true) {
   const parsed = Bun.TOML.parse(text3), wanted = new Set(keys3);
   const headers = [...text3.matchAll(/^[ \t]*(\[[^\r\n]+\])[ \t]*(#[^\r\n]*)?(?:\r?\n|$)/gm)];
   if (headers.length > 512)
@@ -108105,9 +108105,19 @@ function codexTrustTextWitness(text3, keys3) {
   let result2 = text3;
   for (const span of replacements2.reverse())
     result2 = result2.slice(0, span.start) + span.comments + result2.slice(span.end);
-  return canonicalizeTableOrder(result2).split(/\r?\n/).filter((line) => line.trim()).join(`
+  return (canonicalize ? canonicalizeTableOrder(result2) : result2).split(/\r?\n/).filter((line) => line.trim()).join(`
 `);
 }
+function codexTrustReconcileWitness(text3, keys3) {
+  return codexTrustTextWitness(text3, keys3, false).replace(/[ \t]+$/gm, "");
+}
+function codexTrustUnmanagedSemantic(text3, keys3) {
+  const parsed = structuredClone(Bun.TOML.parse(text3));
+  for (const key of keys3)
+    if (parsed.hooks?.state?.[key] !== undefined)
+      delete parsed.hooks.state[key];
+  return JSON.stringify(stableSemantic(prune(parsed)));
+}
 var fail4 = () => new Error('CODEX_HOOK_TRUST_UNSUPPORTED_LAYOUT: preserve and convert hook trust to ordinary [hooks.state."<key>"] tables before enrollment'), prune = (value) => {
   if (value.hooks?.state && !Object.keys(value.hooks.state).length)
     delete value.hooks.state;
@@ -108146,6 +108156,12 @@ var fail4 = () => new Error('CODEX_HOOK_TRUST_UNSUPPORTED_LAYOUT: preserve and c
   const simple = blocks.filter((block) => !block.key.startsWith("[["));
   const arrays = blocks.filter((block) => block.key.startsWith("[["));
   return prefix + [...simple, ...arrays].map((block) => block.text).join("");
+}, stableSemantic = (value) => {
+  if (Array.isArray(value))
+    return value.map(stableSemantic);
+  if (value && typeof value === "object")
+    return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stableSemantic(value[key])]));
+  return value;
 };
 var init_codex_hook_trust_layout = () => {};
 
@@ -108240,11 +108256,33 @@ var init_codex_hook_trust_identity = __esm(() => {
 });
 
 // src/lib/agent-codex-trust.ts
-import { lstatSync as lstatSync28, mkdirSync as mkdirSync25, readdirSync as readdirSync20 } from "fs";
+import { lstatSync as lstatSync28, mkdirSync as mkdirSync25, readdirSync as readdirSync20, readFileSync as readFileSync37, realpathSync as realpathSync13, statSync as statSync21 } from "fs";
 import { createHash as createHash26, randomUUID as randomUUID10 } from "crypto";
-import { join as join56, resolve as resolve22 } from "path";
+import { execFileSync } from "child_process";
+import { dirname as dirname30, isAbsolute as isAbsolute25, join as join56, resolve as resolve22 } from "path";
 import { homedir as homedir11 } from "os";
 import { isDeepStrictEqual as isDeepStrictEqual6 } from "util";
+function verifyReleaseArtifact(proof, skillsCli) {
+  need4(isAbsolute25(proof.packageTarPath) && !proof.packageTarPath.includes("\x00"), "RECONCILE_RELEASE_PROVENANCE_PATH");
+  const tarPath = realpathSync13(proof.packageTarPath);
+  need4(statSync21(tarPath).isFile(), "RECONCILE_RELEASE_PROVENANCE_PATH");
+  const tarBytes = readFileSync37(tarPath);
+  need4(tarBytes.byteLength === proof.packageTarBytes && createHash26("sha256").update(tarBytes).digest("hex") === proof.packageTarSha256, "RECONCILE_RELEASE_ARTIFACT_CHANGED");
+  const packageRoot = dirname30(dirname30(realpathSync13(skillsCli.receipt.path)));
+  const manifest = readFileSync37(join56(packageRoot, "package.json"));
+  need4(createHash26("sha256").update(manifest).digest("hex") === skillsCli.receipt.manifestSha256 && skillsCli.receipt.manifestSha256 === proof.manifestSha256, "RECONCILE_RELEASE_MANIFEST_CHANGED");
+  need4(createHash26("sha256").update(readFileSync37(skillsCli.receipt.path)).digest("hex") === proof.executableSha256 && skillsCli.receipt.sha256 === proof.executableSha256, "RECONCILE_RELEASE_EXECUTABLE_CHANGED");
+  const members2 = [["package/package.json", manifest], ["package/bin/index.js", readFileSync37(skillsCli.receipt.path)]];
+  for (const [member, expected] of members2) {
+    let actual;
+    try {
+      actual = execFileSync("tar", ["-xOf", tarPath, member], { maxBuffer: 32 * 1024 * 1024 });
+    } catch {
+      throw new Error("RECONCILE_RELEASE_ARTIFACT_MEMBER_MISSING");
+    }
+    need4(Buffer.compare(actual, expected) === 0, "RECONCILE_RELEASE_ARTIFACT_MEMBER_CHANGED");
+  }
+}
 async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc) {
   let rpc;
   try {
@@ -108267,24 +108305,54 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     need4(makePlanDigest(digestInput) === intent.planDigest, "RECONCILE_PLAN_CHANGED");
     need4(isDeepStrictEqual6(intent.hooks, admitted.filter((hook) => !hook.enabled || hook.trustStatus !== "trusted")), "RECONCILE_INTENT_HOOKS_CHANGED");
     need4(configBefore.sha256 === intent.beforeSha256 && hooksBefore.sha256 === intent.hooksSha256 && policyBefore.sha256 === intent.policySha256, "RECONCILE_JOURNAL_CHANGED");
+    const policyCurrent = snapshot(join56(dataDir3, "agent-policy.json"), true);
+    let supersededBinding = false;
+    if (policyCurrent.sha256 !== policyBefore.sha256) {
+      need4(options.supersedeBinding === true, "RECONCILE_POLICY_CHANGED");
+      const oldPolicy = JSON.parse(policyBefore.text), currentPolicy = JSON.parse(policyCurrent.text);
+      need4(isDeepStrictEqual6(withoutCodexCommand(oldPolicy), withoutCodexCommand(currentPolicy)), "RECONCILE_POLICY_CHANGED");
+      supersededBinding = true;
+    }
+    if (supersededBinding) {
+      need4(Array.isArray(intent.nativeHooks) && intent.nativeHooks.length > 0, "RECONCILE_NATIVE_INVENTORY_REQUIRED");
+      const proof = options.releaseProof;
+      need4(!!proof && isAbsolute25(proof.packageTarPath) && /^[a-f0-9]{64}$/.test(proof.packageTarSha256) && Number.isInteger(proof.packageTarBytes) && proof.packageTarBytes > 0 && /^[a-f0-9]{64}$/.test(proof.manifestSha256) && /^[a-f0-9]{64}$/.test(proof.executableSha256), "RECONCILE_RELEASE_PROVENANCE_REQUIRED");
+    }
     const currentConfig = snapshot(intent.configPath, true);
-    need4(codexTrustTextWitness(configBefore.text, intent.hooks.map((h) => h.key)) === codexTrustTextWitness(currentConfig.text, intent.hooks.map((h) => h.key)), "RECONCILE_UNRELATED_CONFIG_CHANGED");
+    const managedKeys = intent.hooks.map((h) => h.key);
+    const witnessSame = codexTrustReconcileWitness(configBefore.text, managedKeys) === codexTrustReconcileWitness(currentConfig.text, managedKeys);
+    const unmanagedSame = codexTrustUnmanagedSemantic(configBefore.text, managedKeys) === codexTrustUnmanagedSemantic(currentConfig.text, managedKeys);
+    need4(unmanagedSame && (witnessSame || supersededBinding), "RECONCILE_UNRELATED_CONFIG_CHANGED");
     const before2 = structure(configBefore.text), current = structure(currentConfig.text), expectedConfig = structuredClone(before2);
     expectedConfig.hooks ??= {};
     expectedConfig.hooks.state ??= {};
     for (const hook of intent.hooks)
       expectedConfig.hooks.state[hook.key] = { ...expectedConfig.hooks.state[hook.key], enabled: true, trusted_hash: hook.currentHash };
-    need4(isDeepStrictEqual6(expectedConfig, current), "RECONCILE_CONFIG_DRIFT");
-    const policyCurrent = snapshot(join56(dataDir3, "agent-policy.json"), true);
-    need4(policyCurrent.sha256 === policyBefore.sha256, "RECONCILE_POLICY_CHANGED");
-    const policy = parseManagedSkillPolicy(policyBefore.text), binding = policy.bridge;
+    if (supersededBinding) {
+      for (const hook of intent.hooks) {
+        const state = current.hooks?.state?.[hook.key];
+        need4(state?.enabled === true && typeof state.trusted_hash === "string" && /^sha256:[a-f0-9]{64}$/.test(state.trusted_hash), "RECONCILE_CONFIG_DRIFT");
+      }
+    } else
+      need4(isDeepStrictEqual6(expectedConfig, current), "RECONCILE_CONFIG_DRIFT");
+    const policy = parseManagedSkillPolicy(policyCurrent.text), binding = policy.bridge;
     assertManagedAgentBridge("codex", { home, dataDir: dataDir3, projectDir: home });
     const skillsCli = bindSkillsCli(binding.commands.codex, options.reviewedSkillsCli);
-    need4(isDeepStrictEqual6(skillsCli.receipt, intent.skillsCli), "RECONCILE_SKILLS_BINDING_CHANGED");
+    if (supersededBinding)
+      verifyReleaseArtifact(options.releaseProof, skillsCli);
+    const skillsBindingChanged = !isDeepStrictEqual6(skillsCli.receipt, intent.skillsCli);
+    need4(!skillsBindingChanged || supersededBinding, "RECONCILE_SKILLS_BINDING_CHANGED");
     const alias = binding.rootAliases?.find((item) => item.agent === "codex"), codexHome = alias?.target ?? join56(home, ".codex"), hooksPath = join56(codexHome, "hooks.json");
     need4(resolve22(intent.configPath) === resolve22(join56(codexHome, "config.toml")), "RECONCILE_CONFIG_PATH_CHANGED");
     const hooksCurrent = snapshot(hooksPath);
-    need4(hooksCurrent.sha256 === intent.hooksSha256 || hooksCurrent.sha256 === hooksBefore.sha256, "RECONCILE_HOOKS_CHANGED");
+    if (hooksCurrent.sha256 !== intent.hooksSha256 && hooksCurrent.sha256 !== hooksBefore.sha256) {
+      need4(supersededBinding, "RECONCILE_HOOKS_CHANGED");
+      const currentDeclarations = JSON.parse(hooksCurrent.text).hooks;
+      for (const [event, [nativeEvent]] of Object.entries(eventNames)) {
+        const command = renderAgentHookCommand(binding.commands.codex, "codex", binding.profiles.codex, event);
+        need4(isDeepStrictEqual6(currentDeclarations?.[event], [{ hooks: [{ type: "command", command, timeout: 15 }] }]), "RECONCILE_BINDING_HOOK_CHANGED");
+      }
+    }
     rpc = await connect({ command: options.codexCommand ?? "codex", home, codexHome });
     need4(rpc.version === intent.nativeVersion, "RECONCILE_NATIVE_VERSION_CHANGED");
     const discovered = await rpc.request("hooks/list", { cwds: [home] });
@@ -108294,12 +108362,15 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     if (recordedNativeHooks)
       need4(nativeHooks.length === recordedNativeHooks.length, "RECONCILE_NATIVE_HOOK_LIST_CHANGED");
     const plannedKeys = new Set(intent.hooks.map((hook) => hook.key));
+    let nativeTrustPending = false;
     for (const expected of recordedNativeHooks ?? []) {
       const matches2 = nativeHooks.filter((hook) => hook.key === expected.key);
       need4(matches2.length === 1, "RECONCILE_NATIVE_HOOK_LIST_CHANGED");
       const actual = safeNativeHook(matches2[0]);
       const stable = (hook) => {
         const { enabled, trustStatus, ...identity4 } = hook;
+        if (supersededBinding)
+          delete identity4.command;
         return identity4;
       };
       need4(isDeepStrictEqual6(stable(actual), stable(expected)), "RECONCILE_NATIVE_IDENTITY_CHANGED");
@@ -108310,7 +108381,14 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
       const matches2 = nativeHooks.filter((h2) => h2.key === wanted.key || h2.key === wanted.key.replace(join56(home, ".codex/hooks.json"), hooksPath));
       need4(matches2.length === 1, "RECONCILE_NATIVE_IDENTITY_CHANGED");
       const h = matches2[0];
-      need4(h.enabled === true && h.trustStatus === "trusted" && h.currentHash === wanted.currentHash, "RECONCILE_NATIVE_STATE_INCOMPLETE");
+      const trusted = h.trustStatus === "trusted";
+      need4(h.enabled === true && (trusted || supersededBinding && h.trustStatus === "modified") && (h.currentHash === wanted.currentHash || supersededBinding && /^sha256:[a-f0-9]{64}$/.test(h.currentHash)), "RECONCILE_NATIVE_STATE_INCOMPLETE");
+      if (!trusted)
+        nativeTrustPending = true;
+      if (supersededBinding) {
+        const nativeToCliEvent = { userPromptSubmit: "UserPromptSubmit", sessionStart: "SessionStart", subagentStart: "SubagentStart" };
+        need4(h.command === renderAgentHookCommand(binding.commands.codex, "codex", binding.profiles.codex, nativeToCliEvent[wanted.event] ?? ""), "RECONCILE_BINDING_HOOK_CHANGED");
+      }
     }
     const config2 = await rpc.request("config/read", { includeLayers: true, cwd: home });
     const layers = config2?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === intent.configPath && !layer.name.profile);
@@ -108330,7 +108408,7 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     unchanged2(currentConfig);
     skillsCli.recheck();
     assertManagedAgentBridge("codex", { home, dataDir: dataDir3, projectDir: home });
-    const receipt = { version: 1, status: "reconciled", reconciled: true, automaticRollback: false, journal, planDigest: intent.planDigest, nativeVersion: rpc.version, nativeStateVerified: true, nativeExecutionVerified: false, configSha256: currentConfig.sha256, hooksSha256: hooksCurrent.sha256, policySha256: policyBefore.sha256, skillsCli: skillsCli.receipt, nativeInventoryScope: recordedNativeHooks ? "complete" : "declared-managed-hooks-only", unrelatedNativeHooksPreserved: !!recordedNativeHooks, unrelatedSettingsAndCommentsPreserved: true };
+    const receipt = { version: 1, status: supersededBinding ? "superseded" : "reconciled", reconciled: true, supersededBinding, automaticRollback: false, journal, planDigest: intent.planDigest, nativeVersion: rpc.version, nativeStateVerified: !nativeTrustPending, nativeTrustPending, nativeExecutionVerified: false, configSha256: currentConfig.sha256, hooksSha256: hooksCurrent.sha256, policySha256: policyBefore.sha256, policyBeforeSha256: policyBefore.sha256, policyCurrentSha256: policyCurrent.sha256, previousSkillsCli: intent.skillsCli, skillsCli: skillsCli.receipt, releaseProof: options.releaseProof, nativeInventoryScope: recordedNativeHooks ? "complete" : "declared-managed-hooks-only", unrelatedNativeHooksPreserved: !!recordedNativeHooks, unrelatedSettingsAndCommentsPreserved: true };
     save2(join56(journal, "receipt.json"), json2(receipt));
     return receipt;
   } catch (error61) {
@@ -108460,7 +108538,12 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
   }
 }
 var json2 = (value) => JSON.stringify(value, null, 2) + `
-`, structure = (text3) => JSON.parse(JSON.stringify(Bun.TOML.parse(text3))), eventNames, makePlanDigest = (value) => createHash26("sha256").update(json2(value)).digest("hex"), safeNativeHook = (hook) => ({ key: hook.key, eventName: hook.eventName, handlerType: hook.handlerType, command: hook.command, matcher: hook.matcher, timeoutSec: hook.timeoutSec, async: hook.async, statusMessage: hook.statusMessage, additionalContextLimit: hook.additionalContextLimit, sourcePath: hook.sourcePath, source: hook.source, pluginId: hook.pluginId, isManaged: hook.isManaged, currentHash: hook.currentHash, enabled: hook.enabled, trustStatus: hook.trustStatus });
+`, structure = (text3) => JSON.parse(JSON.stringify(Bun.TOML.parse(text3))), eventNames, makePlanDigest = (value) => createHash26("sha256").update(json2(value)).digest("hex"), safeNativeHook = (hook) => ({ key: hook.key, eventName: hook.eventName, handlerType: hook.handlerType, command: hook.command, matcher: hook.matcher, timeoutSec: hook.timeoutSec, async: hook.async, statusMessage: hook.statusMessage, additionalContextLimit: hook.additionalContextLimit, sourcePath: hook.sourcePath, source: hook.source, pluginId: hook.pluginId, isManaged: hook.isManaged, currentHash: hook.currentHash, enabled: hook.enabled, trustStatus: hook.trustStatus }), withoutCodexCommand = (value) => {
+  const copy = structuredClone(value);
+  if (copy?.bridge?.commands && Object.hasOwn(copy.bridge.commands, "codex"))
+    copy.bridge.commands.codex = "<reviewed-codex-binding>";
+  return copy;
+};
 var init_agent_codex_trust = __esm(() => {
   init_config();
   init_managed_policy();
@@ -108553,8 +108636,8 @@ var exports_agent_integration = {};
 __export(exports_agent_integration, {
   registerAgentIntegration: () => registerAgentIntegration
 });
-import { readFileSync as readFileSync37 } from "fs";
-import { isAbsolute as isAbsolute25 } from "path";
+import { readFileSync as readFileSync38 } from "fs";
+import { isAbsolute as isAbsolute26 } from "path";
 function pinnedHookProfile(input3, configuredProfile) {
   try {
     const parsed = parseSkillContextInput(JSON.stringify(input3));
@@ -108625,7 +108708,7 @@ function registerAgentIntegration(parent) {
   });
   hook.command("install").option("--agent <agent>", `Agent to configure: ${INTEGRATION_AGENTS.join(", ")}, all`, "all").option("--command <path>", "Skills executable used by the hook (preserves existing binding; new agents use skills)").option("--selection-profile <id>", "Selection profile (preserves existing binding; new agents use default)").option("--include-vendor", "Retained for compatibility; vendor system skills are always inventoried and disabled", false).option("--discovery-inputs <file>", "Advanced reviewed active plugin roots and source hashes for unsupported registrations").option("--allow-root-aliases", "Allow home .claude/.codex aliases to existing directories within this home", false).option("--apply", "Apply the plan, preserving prior configuration in private backups", false).option("--json", "Output a receipt as JSON", false).description("Plan or install one Skills CLI bridge plus native prompt hooks").action(async (options) => {
     try {
-      const discoveryInputs = options.discoveryInputs ? JSON.parse(readFileSync37(options.discoveryInputs, "utf8")) : undefined;
+      const discoveryInputs = options.discoveryInputs ? JSON.parse(readFileSync38(options.discoveryInputs, "utf8")) : undefined;
       const plan = planAgentIntegration({ agents: agents(options.agent), command: options.command, profileId: options.selectionProfile, includeVendor: options.includeVendor, discoveryInputs, allowRootAliases: options.allowRootAliases });
       const result2 = options.apply ? applyAgentIntegration(plan) : { changed: [], backups: [] };
       const receipt = { applied: options.apply, planned: plan.changes.map((change) => change.path), ...result2, rootAliases: plan.rootAliases ?? [], discovery: plan.discoveryAfter, nativeSkills: plan.nativeSkills.map((entry) => ({ agent: entry.agent, path: entry.path, managed: entry.managed, vendor: entry.vendor, system: entry.system === true, bridge: entry.bridge === true })), requiresNativeRetirement: plan.nativeSkills.some((entry) => !entry.bridge && !entry.system) };
@@ -108638,8 +108721,10 @@ function registerAgentIntegration(parent) {
       process.exitCode = 1;
     }
   });
-  const trust = hook.command("trust").requiredOption("--agent <agent>", "Native trust adapter (codex)").option("--codex-command <path>", "Installed Codex executable used for its native configuration API", "codex").option("--apply", "Enable and trust only the exact managed Skills hook identities", false).option("--plan-digest <sha256>", "Exact reviewed dry-run digest required with --apply").option("--json", "Output the native trust plan or receipt", false).description("Plan or enroll exact Skills hooks through Codex native trust controls").action(async (options) => {
+  const trust = hook.command("trust").option("--agent <agent>", "Native trust adapter (codex)").option("--codex-command <path>", "Installed Codex executable used for its native configuration API", "codex").option("--apply", "Enable and trust only the exact managed Skills hook identities", false).option("--plan-digest <sha256>", "Exact reviewed dry-run digest required with --apply").option("--json", "Output the native trust plan or receipt", false).description("Plan or enroll exact Skills hooks through Codex native trust controls").action(async (options) => {
     try {
+      if (!options.agent)
+        throw new Error("Native trust enrollment requires --agent codex");
       if (options.agent !== "codex")
         throw new Error("Native trust enrollment currently supports --agent codex only");
       const result2 = await enrollCodexNativeHooks({ codexCommand: options.codexCommand, apply: options.apply, reviewedPlanDigest: options.planDigest });
@@ -108652,11 +108737,15 @@ function registerAgentIntegration(parent) {
       process.exitCode = 1;
     }
   });
-  trust.command("reconcile").requiredOption("--agent <agent>", "Native trust adapter (codex)").requiredOption("--journal <path>", "Private incomplete native trust journal to inspect").option("--codex-command <path>", "Installed Codex executable used for its native configuration API", "codex").option("--json", "Output the reconciliation receipt", false).description("Verify an interrupted Codex native trust write and resolve its private journal").action(async (options) => {
+  trust.command("reconcile").requiredOption("--agent <agent>", "Native trust adapter (codex)").requiredOption("--journal <path>", "Private incomplete native trust journal to inspect").option("--codex-command <path>", "Installed Codex executable used for its native configuration API", "codex").option("--supersede-binding", "Resolve a stale journal only when current policy differs solely by the reviewed Codex CLI binding", false).option("--skills-package-tar <path>", "Exact package tarball consumed by the reviewed executable").option("--skills-package-tar-sha256 <sha256>", "SHA-256 of the reviewed Skills package tarball").option("--skills-package-tar-bytes <bytes>", "Byte length of the reviewed Skills package tarball").option("--skills-package-manifest-sha256 <sha256>", "SHA-256 of the reviewed Skills package manifest").option("--skills-executable-sha256 <sha256>", "SHA-256 of the reviewed running Skills executable").option("--json", "Output the reconciliation receipt", false).description("Verify an interrupted Codex native trust write and resolve its private journal").action(async (options) => {
     try {
       if (options.agent !== "codex")
         throw new Error("Native trust reconciliation currently supports --agent codex only");
-      const result2 = await reconcileCodexNativeHooks({ journal: options.journal, codexCommand: options.codexCommand });
+      const proofFields = [options.skillsPackageTar, options.skillsPackageTarSha256, options.skillsPackageTarBytes, options.skillsPackageManifestSha256, options.skillsExecutableSha256];
+      if (proofFields.some((value) => value !== undefined) && proofFields.some((value) => value === undefined))
+        throw new Error("Release provenance requires package tar path, tar hash/bytes, manifest hash, and executable hash together");
+      const releaseProof = proofFields.every((value) => value !== undefined) ? { packageTarPath: options.skillsPackageTar, packageTarSha256: options.skillsPackageTarSha256, packageTarBytes: Number(options.skillsPackageTarBytes), manifestSha256: options.skillsPackageManifestSha256, executableSha256: options.skillsExecutableSha256 } : undefined;
+      const result2 = await reconcileCodexNativeHooks({ journal: options.journal, codexCommand: options.codexCommand, supersedeBinding: options.supersedeBinding, releaseProof });
       if (options.json)
         await writeCliOutput(JSON.stringify(result2));
       else
@@ -108673,7 +108762,7 @@ function registerAgentIntegration(parent) {
     try {
       if (agents(options.agent).length !== 1)
         throw new Error("A hook invocation requires one agent");
-      const inputText = readFileSync37(0, "utf8");
+      const inputText = readFileSync38(0, "utf8");
       if (inputText.length > 1024 * 1024)
         throw new Error("Hook input is too large");
       let input3 = JSON.parse(inputText);
@@ -108686,12 +108775,12 @@ function registerAgentIntegration(parent) {
       input3.hook_event_name = event;
       const projects = [process.cwd()];
       if (input3.cwd !== undefined) {
-        if (typeof input3.cwd !== "string" || !isAbsolute25(input3.cwd) || input3.cwd.includes("\x00"))
+        if (typeof input3.cwd !== "string" || !isAbsolute26(input3.cwd) || input3.cwd.includes("\x00"))
           throw new Error("Invalid native hook working directory");
         projects.push(input3.cwd);
       }
       if (options.agent === "cursor") {
-        if (!Array.isArray(input3.workspace_roots) || input3.workspace_roots.length > 32 || input3.workspace_roots.some((path) => typeof path !== "string" || !isAbsolute25(path) || path.includes("\x00")))
+        if (!Array.isArray(input3.workspace_roots) || input3.workspace_roots.length > 32 || input3.workspace_roots.some((path) => typeof path !== "string" || !isAbsolute26(path) || path.includes("\x00")))
           throw new Error("Invalid Cursor workspace roots");
         projects.push(...input3.workspace_roots);
         input3.cwd ??= input3.workspace_roots[0] ?? process.cwd();
@@ -108769,7 +108858,7 @@ function registerAgentIntegration(parent) {
   const migrate = parent.command("migrate").description("Preserve and retire native agent skill copies");
   migrate.command("native").option("--project <directory>", "Also inventory a project and its ancestors (the current directory and its ancestors are always included)").option("--include-unmanaged", "Archive user-authored skills as well as Skills-managed copies", false).option("--include-vendor", "Retire vendor SKILL.md discovery files while preserving plugin scripts and assets", false).option("--target-manifest <file>", "Reviewed exact native migration target manifest").option("--discovery-inputs <file>", "Advanced reviewed active plugin roots and source hashes").option("--allow-root-aliases", "Allow home .claude/.codex aliases to existing directories within this home", false).option("--apply", "Move selected skills to private archives outside agent discovery roots", false).option("--json", "Output inventory and archive receipt as JSON", false).description("Inventory native skill copies; preserve complete directories before retiring them").action(async (options) => {
     try {
-      const discoveryInputs = options.discoveryInputs ? JSON.parse(readFileSync37(options.discoveryInputs, "utf8")) : undefined;
+      const discoveryInputs = options.discoveryInputs ? JSON.parse(readFileSync38(options.discoveryInputs, "utf8")) : undefined;
       if (options.targetManifest && (options.includeUnmanaged || options.includeVendor))
         throw new Error("--target-manifest cannot be combined with broad native migration selectors");
       const targetManifest = options.targetManifest ? readNativeMigrationTargetManifest(options.targetManifest) : undefined;
@@ -109074,11 +109163,11 @@ import {
   copyFileSync as copyFileSync2,
   mkdirSync as mkdirSync26,
   readdirSync as readdirSync21,
-  readFileSync as readFileSync38,
-  statSync as statSync21,
+  readFileSync as readFileSync39,
+  statSync as statSync22,
   writeFileSync as writeFileSync26
 } from "fs";
-import { dirname as dirname30, join as join57, resolve as resolve23, sep as sep10 } from "path";
+import { dirname as dirname31, join as join57, resolve as resolve23, sep as sep10 } from "path";
 function fail5(code2, message, detail = []) {
   throw new StationSnapshotError(code2, message, detail);
 }
@@ -109090,7 +109179,7 @@ function readSnapshotManifest(repoRoot, stationId) {
   const manifestPath = join57(snapshotRoot, "sync-manifest.json");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync38(manifestPath, "utf8"));
+    manifest = JSON.parse(readFileSync39(manifestPath, "utf8"));
   } catch (error61) {
     fail5("MANIFEST_UNREADABLE", `cannot read snapshot manifest: ${manifestPath}: ${error61.message}`);
   }
@@ -109172,7 +109261,7 @@ function planStationHydration(stationId, repoRoot) {
           });
           continue;
         }
-        const info = statSync21(entry.fullPath);
+        const info = statSync22(entry.fullPath);
         const manifestHash = manifestHashes.get(`${agent}${MANIFEST_HASH_KEY_SEP}${homeRelative}`) ?? null;
         let verified = false;
         if (manifestHash !== null) {
@@ -109226,7 +109315,7 @@ function planStationHydration(stationId, repoRoot) {
         for (const copy of copies) {
           let isStub = false;
           try {
-            isStub = isPointerSkillMd(readFileSync38(copy.fullPath, "utf8"));
+            isStub = isPointerSkillMd(readFileSync39(copy.fullPath, "utf8"));
           } catch {
             isStub = false;
           }
@@ -109331,7 +109420,7 @@ function writeStationHydration(options) {
   }
   let written = 0;
   for (const entry of toWrite) {
-    mkdirSync26(dirname30(entry.destination), { recursive: true });
+    mkdirSync26(dirname31(entry.destination), { recursive: true });
     copyFileSync2(entry.fullPath, entry.destination);
     written += 1;
   }
@@ -109352,8 +109441,8 @@ function writeStationHydration(options) {
     },
     skills: resultSkills
   };
-  const hydrationManifestPath = join57(dirname30(cacheRoot), `hydration-${options.stationId}.json`);
-  mkdirSync26(dirname30(hydrationManifestPath), { recursive: true });
+  const hydrationManifestPath = join57(dirname31(cacheRoot), `hydration-${options.stationId}.json`);
+  mkdirSync26(dirname31(hydrationManifestPath), { recursive: true });
   writeFileSync26(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
 `);
   return {
@@ -109430,9 +109519,9 @@ var init_hydrate = __esm(() => {
 
 // src/lib/prepare-skill.ts
 import { createHash as createHash28, randomUUID as randomUUID11 } from "crypto";
-import { chmodSync as chmodSync3, existsSync as existsSync34, lstatSync as lstatSync29, mkdirSync as mkdirSync27, mkdtempSync as mkdtempSync6, readFileSync as readFileSync39, readdirSync as readdirSync22, renameSync as renameSync12, rmSync as rmSync9, writeFileSync as writeFileSync27 } from "fs";
+import { chmodSync as chmodSync3, existsSync as existsSync34, lstatSync as lstatSync29, mkdirSync as mkdirSync27, mkdtempSync as mkdtempSync6, readFileSync as readFileSync40, readdirSync as readdirSync22, renameSync as renameSync12, rmSync as rmSync9, writeFileSync as writeFileSync27 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname31, isAbsolute as isAbsolute26, join as join58, relative as relative9, resolve as resolve24, sep as sep11 } from "path";
+import { dirname as dirname32, isAbsolute as isAbsolute27, join as join58, relative as relative9, resolve as resolve24, sep as sep11 } from "path";
 function prepareSkill(name, options) {
   const normalized = normalizePortableSkillName(name);
   if (!new RegExp(SEMVER_PATTERN).test(options.version))
@@ -109477,7 +109566,7 @@ function prepareSkill(name, options) {
       mkdirSync27(join58(staging, directory2), { recursive: true });
     for (const file2 of before2.files) {
       const destination = join58(staging, file2.path);
-      mkdirSync27(dirname31(destination), { recursive: true });
+      mkdirSync27(dirname32(destination), { recursive: true });
       writeFileSync27(destination, file2.bytes, { mode: file2.mode });
     }
     const stagedManifest = join58(staging, "skill.json");
@@ -109538,7 +109627,7 @@ function validateRuntimeEntrypoint(candidate2, root2) {
   if (typeof entry !== "string")
     return;
   const target = resolve24(root2, entry), rel = relative9(root2, target);
-  if (isAbsolute26(entry) || /^[a-zA-Z]:/.test(entry) || entry.includes("\\") || !rel || rel === ".." || rel.startsWith(`..${sep11}`) || isAbsolute26(rel) || !existsSync34(target) || !lstatSync29(target).isFile()) {
+  if (isAbsolute27(entry) || /^[a-zA-Z]:/.test(entry) || entry.includes("\\") || !rel || rel === ".." || rel.startsWith(`..${sep11}`) || isAbsolute27(rel) || !existsSync34(target) || !lstatSync29(target).isFile()) {
     throw new Error("Executable runtime.entrypoint must name an existing regular file inside the skill directory.");
   }
 }
@@ -109649,7 +109738,7 @@ function snapshot2(root2) {
         bytes += stat3.size;
         if (bytes > 50000000)
           throw new Error("Skill exceeds the preparation size limit (50000000 bytes).");
-        const content = readFileSync39(absolute);
+        const content = readFileSync40(absolute);
         if (content.length !== stat3.size)
           throw new Error("Skill changed during preparation.");
         files.push({ path, bytes: content, mode: stat3.mode & 511 });
@@ -110051,7 +110140,7 @@ var init_schedule = __esm(() => {
 
 // src/lib/registry-sync.ts
 import { mkdirSync as mkdirSync28, writeFileSync as writeFileSync28 } from "fs";
-import { dirname as dirname32, relative as relative10 } from "path";
+import { dirname as dirname33, relative as relative10 } from "path";
 function createRegistrySyncArtifact(options = {}) {
   const profile = options.profile ?? "all";
   const includeDocs = options.includeDocs ?? true;
@@ -110108,7 +110197,7 @@ function createRegistrySyncArtifact(options = {}) {
   };
 }
 function writeRegistrySyncArtifact(path, artifact) {
-  mkdirSync28(dirname32(path), { recursive: true });
+  mkdirSync28(dirname33(path), { recursive: true });
   writeFileSync28(path, `${JSON.stringify(artifact, null, 2)}
 `);
 }
@@ -110329,8 +110418,8 @@ __export(exports_publish, {
   buildVersionManifest: () => buildVersionManifest,
   PushSkillError: () => PushSkillError
 });
-import { execFileSync } from "child_process";
-import { existsSync as existsSync35, readFileSync as readFileSync40 } from "fs";
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync35, readFileSync as readFileSync41 } from "fs";
 import { hostname as hostname4 } from "os";
 import { join as join59 } from "path";
 function registerPublish(parent) {
@@ -110385,7 +110474,7 @@ async function pushSkill(name, options = {}) {
   await verifyPackedCanonicalHash(skill.name, packed);
   const versionManifest = buildVersionManifest(skill.path, packed);
   const skillMdPath = join59(skill.path, "SKILL.md");
-  const skillMd = existsSync35(skillMdPath) ? readFileSync40(skillMdPath, "utf-8") : undefined;
+  const skillMd = existsSync35(skillMdPath) ? readFileSync41(skillMdPath, "utf-8") : undefined;
   const base3 = {
     slug: skill.name,
     path: skill.path,
@@ -110542,7 +110631,7 @@ function sanitizeGitRemote(url2) {
 }
 function gitValue(dir, args2) {
   try {
-    const out = execFileSync("git", ["-C", dir, ...args2], { stdio: ["ignore", "pipe", "ignore"], encoding: "utf-8" }).trim();
+    const out = execFileSync2("git", ["-C", dir, ...args2], { stdio: ["ignore", "pipe", "ignore"], encoding: "utf-8" }).trim();
     return out || null;
   } catch {
     return null;
@@ -112006,11 +112095,11 @@ var init_storage2 = __esm(() => {
 });
 
 // src/lib/registry-reconcile.ts
-import { existsSync as existsSync36, readFileSync as readFileSync41, statSync as statSync22, writeFileSync as writeFileSync29 } from "fs";
+import { existsSync as existsSync36, readFileSync as readFileSync42, statSync as statSync23, writeFileSync as writeFileSync29 } from "fs";
 import { join as join60 } from "path";
 function isDirectory2(path) {
   try {
-    return statSync22(path).isDirectory();
+    return statSync23(path).isDirectory();
   } catch {
     return false;
   }
@@ -112026,7 +112115,7 @@ function readBaseline(skillDir) {
   if (!existsSync36(markerPath))
     return;
   try {
-    const marker = JSON.parse(readFileSync41(markerPath, "utf-8"));
+    const marker = JSON.parse(readFileSync42(markerPath, "utf-8"));
     if (!isSkillsOwnershipMarker(marker))
       return;
     return {
@@ -112042,7 +112131,7 @@ function readCursor(root2) {
   if (!existsSync36(path))
     return { runCount: 0 };
   try {
-    const cursor2 = JSON.parse(readFileSync41(path, "utf-8"));
+    const cursor2 = JSON.parse(readFileSync42(path, "utf-8"));
     return { runCount: typeof cursor2.runCount === "number" ? cursor2.runCount : 0 };
   } catch {
     return { runCount: 0 };

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.9.6",
+    version: "0.9.8",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.6",
+  version: "0.9.8",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.6",
+  version: "0.9.8",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -24125,7 +24125,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.6",
+  version: "0.9.8",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/index.js

@@ -11448,7 +11448,7 @@ import { isAbsolute as isAbsolute10, join as join20, resolve as resolve10 } from
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.6",
+  version: "0.9.8",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/lib/agent-codex-trust.d.ts

@@ -8,12 +8,21 @@ export interface CodexNativeHookTrustOptions {
     reviewedPlanDigest?: string;
     reviewedSkillsCli?: ReviewedSkillsCli;
 }
+export interface SkillsCliReleaseProof {
+    packageTarPath: string;
+    packageTarSha256: string;
+    packageTarBytes: number;
+    manifestSha256: string;
+    executableSha256: string;
+}
 export interface CodexNativeHookReconcileOptions {
     home?: string;
     dataDir?: string;
     codexCommand?: string;
     journal: string;
     reviewedSkillsCli?: ReviewedSkillsCli;
+    releaseProof?: SkillsCliReleaseProof;
+    supersedeBinding?: boolean;
 }
 type Connect = typeof connectCodexHookRpc;
 /** Resolve an interrupted native write only after the native consumer and every
@@ -24,21 +33,27 @@ export declare function reconcileCodexNativeHooks(options: CodexNativeHookReconc
     version: number;
     status: string;
     reconciled: boolean;
+    supersededBinding: boolean;
     automaticRollback: boolean;
     journal: string;
     planDigest: any;
     nativeVersion: string;
     nativeStateVerified: boolean;
+    nativeTrustPending: boolean;
     nativeExecutionVerified: boolean;
     configSha256: string;
     hooksSha256: string;
     policySha256: string;
+    policyBeforeSha256: string;
+    policyCurrentSha256: string;
+    previousSkillsCli: any;
     skillsCli: {
         path: string;
         version: string;
         sha256: string;
         manifestSha256: string;
     };
+    releaseProof: SkillsCliReleaseProof | undefined;
     nativeInventoryScope: string;
     unrelatedNativeHooksPreserved: boolean;
     unrelatedSettingsAndCommentsPreserved: boolean;

package/dist/lib/codex-hook-trust-layout.d.ts

@@ -1,3 +1,9 @@
 /** Conservative admission and text witness, never a TOML writer. Native Codex
  * performs the versioned write; unrecognized inline/dotted trust shapes refuse. */
-export declare function codexTrustTextWitness(text: string, keys: string[]): string;
+export declare function codexTrustTextWitness(text: string, keys: string[], canonicalize?: boolean): string;
+/** Reconciliation witness: retain table/array order while tolerating only
+ * blank-line and line-ending formatting emitted by the native writer. */
+export declare function codexTrustReconcileWitness(text: string, keys: string[]): string;
+/** Parsed unmanaged TOML semantics. Arrays retain order; managed trust entries
+ * are excluded by exact journal key and all other keys/values remain bound. */
+export declare function codexTrustUnmanagedSemantic(text: string, keys: string[]): string;

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.6",
+  version: "0.9.8",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.9.6",
+  "version": "0.9.8",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {