@hasna/skills 0.9.7 → 0.9.9

package/README.md

@@ -120,6 +120,12 @@ skills hook trust --agent codex --apply --plan-digest <reviewed-plan-digest> --j
 
 Review the commands, current hashes, and existing trust/enable state in the
 plan. Apply refuses if the plan, package, declarations, or configuration changed.
+The plan preserves the native `CODEX_HOME` choice. When unset, Codex uses
+the lexical `~/.codex` path; an explicit `CODEX_HOME` resolves canonically.
+Only the home root and an explicitly admitted canonical root-alias target
+are accepted. Those views have separate hook identities even when they reach
+the same files; enrolling one preserves the other's trust entries. Keep the
+same `CODEX_HOME` choice for enrollment and the consuming agent.
 It enrolls the current exact definitions, including reviewed modified hooks,
 and preserves unrelated trust, settings, and comments. A private journal keeps
 the pre-write configuration; a failed write or verification requires journal

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.9.7",
+    version: "0.9.9",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -107920,9 +107920,14 @@ async function connectCodexHookRpc(options) {
   const current = statSync20(binary);
   if (realpathSync11(found) !== binary || ["dev", "ino", "size", "mtimeMs", "ctimeMs"].some((k) => stat3[k] !== current[k]))
     throw new Error("CODEX_HOOK_TRUST_NATIVE_EXECUTABLE_CHANGED");
+  const env3 = { ...process.env, HOME: options.home, NO_COLOR: "1" };
+  if (options.codexHome === undefined)
+    delete env3.CODEX_HOME;
+  else
+    env3.CODEX_HOME = options.codexHome;
   const child = spawn3(binary, ["app-server", "--strict-config", "--stdio"], {
     cwd: options.home,
-    env: { ...process.env, HOME: options.home, CODEX_HOME: options.codexHome, NO_COLOR: "1" },
+    env: env3,
     stdio: ["pipe", "pipe", "pipe"]
   });
   const pending = new Map;
@@ -108256,11 +108261,33 @@ var init_codex_hook_trust_identity = __esm(() => {
 });
 
 // src/lib/agent-codex-trust.ts
-import { lstatSync as lstatSync28, mkdirSync as mkdirSync25, readdirSync as readdirSync20 } from "fs";
+import { lstatSync as lstatSync28, mkdirSync as mkdirSync25, readdirSync as readdirSync20, readFileSync as readFileSync37, realpathSync as realpathSync13, statSync as statSync21 } from "fs";
 import { createHash as createHash26, randomUUID as randomUUID10 } from "crypto";
-import { join as join56, resolve as resolve22 } from "path";
+import { execFileSync } from "child_process";
+import { dirname as dirname30, isAbsolute as isAbsolute25, join as join56, resolve as resolve22 } from "path";
 import { homedir as homedir11 } from "os";
 import { isDeepStrictEqual as isDeepStrictEqual6 } from "util";
+function verifyReleaseArtifact(proof, skillsCli) {
+  need4(isAbsolute25(proof.packageTarPath) && !proof.packageTarPath.includes("\x00"), "RECONCILE_RELEASE_PROVENANCE_PATH");
+  const tarPath = realpathSync13(proof.packageTarPath);
+  need4(statSync21(tarPath).isFile(), "RECONCILE_RELEASE_PROVENANCE_PATH");
+  const tarBytes = readFileSync37(tarPath);
+  need4(tarBytes.byteLength === proof.packageTarBytes && createHash26("sha256").update(tarBytes).digest("hex") === proof.packageTarSha256, "RECONCILE_RELEASE_ARTIFACT_CHANGED");
+  const packageRoot = dirname30(dirname30(realpathSync13(skillsCli.receipt.path)));
+  const manifest = readFileSync37(join56(packageRoot, "package.json"));
+  need4(createHash26("sha256").update(manifest).digest("hex") === skillsCli.receipt.manifestSha256 && skillsCli.receipt.manifestSha256 === proof.manifestSha256, "RECONCILE_RELEASE_MANIFEST_CHANGED");
+  need4(createHash26("sha256").update(readFileSync37(skillsCli.receipt.path)).digest("hex") === proof.executableSha256 && skillsCli.receipt.sha256 === proof.executableSha256, "RECONCILE_RELEASE_EXECUTABLE_CHANGED");
+  const members2 = [["package/package.json", manifest], ["package/bin/index.js", readFileSync37(skillsCli.receipt.path)]];
+  for (const [member, expected] of members2) {
+    let actual;
+    try {
+      actual = execFileSync("tar", ["-xOf", tarPath, member], { maxBuffer: 32 * 1024 * 1024 });
+    } catch {
+      throw new Error("RECONCILE_RELEASE_ARTIFACT_MEMBER_MISSING");
+    }
+    need4(Buffer.compare(actual, expected) === 0, "RECONCILE_RELEASE_ARTIFACT_MEMBER_CHANGED");
+  }
+}
 async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc) {
   let rpc;
   try {
@@ -108279,30 +108306,61 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     const declarations = intent.declarations ?? intent.hooks.map((hook) => ({ event: hook.event, key: `${join56(home, ".codex/hooks.json")}${hook.key.slice(hook.key.indexOf(".codex/hooks.json") + ".codex/hooks.json".length)}`, command: hook.command }));
     const admitted = intent.admitted ?? intent.hooks;
     const configSha256 = intent.configSha256 ?? configBefore.sha256, configVersion = intent.configVersion ?? intent.expectedVersion;
-    const digestInput = { version: 1, home: intent.home ?? home, configPath: intent.configPath, configSha256, configVersion, policySha256: intent.policySha256, hooksSha256: intent.hooksSha256, skillsCli: intent.skillsCli, nativeVersion: intent.nativeVersion, declarations, admitted };
+    const digestInput = { version: 1, home: intent.home ?? home, configPath: intent.configPath, ...intent.nativeConfigPath !== undefined ? { nativeConfigPath: intent.nativeConfigPath } : {}, configSha256, configVersion, policySha256: intent.policySha256, hooksSha256: intent.hooksSha256, skillsCli: intent.skillsCli, nativeVersion: intent.nativeVersion, declarations, admitted };
     need4(makePlanDigest(digestInput) === intent.planDigest, "RECONCILE_PLAN_CHANGED");
     need4(isDeepStrictEqual6(intent.hooks, admitted.filter((hook) => !hook.enabled || hook.trustStatus !== "trusted")), "RECONCILE_INTENT_HOOKS_CHANGED");
-    need4(configBefore.sha256 === intent.beforeSha256 && hooksBefore.sha256 === intent.hooksSha256 && policyBefore.sha256 === intent.policySha256, "RECONCILE_JOURNAL_CHANGED");
+    need4(configBefore.sha256 === (intent.beforeSha256 ?? intent.configSha256) && hooksBefore.sha256 === intent.hooksSha256 && policyBefore.sha256 === intent.policySha256, "RECONCILE_JOURNAL_CHANGED");
+    const policyCurrent = snapshot(join56(dataDir3, "agent-policy.json"), true);
+    let supersededBinding = false;
+    if (policyCurrent.sha256 !== policyBefore.sha256) {
+      need4(options.supersedeBinding === true, "RECONCILE_POLICY_CHANGED");
+      const oldPolicy = JSON.parse(policyBefore.text), currentPolicy = JSON.parse(policyCurrent.text);
+      need4(isDeepStrictEqual6(withoutCodexCommand(oldPolicy), withoutCodexCommand(currentPolicy)), "RECONCILE_POLICY_CHANGED");
+      supersededBinding = true;
+    }
+    if (supersededBinding) {
+      need4(Array.isArray(intent.nativeHooks) && intent.nativeHooks.length > 0, "RECONCILE_NATIVE_INVENTORY_REQUIRED");
+      const proof = options.releaseProof;
+      need4(!!proof && isAbsolute25(proof.packageTarPath) && /^[a-f0-9]{64}$/.test(proof.packageTarSha256) && Number.isInteger(proof.packageTarBytes) && proof.packageTarBytes > 0 && /^[a-f0-9]{64}$/.test(proof.manifestSha256) && /^[a-f0-9]{64}$/.test(proof.executableSha256), "RECONCILE_RELEASE_PROVENANCE_REQUIRED");
+    }
     const currentConfig = snapshot(intent.configPath, true);
     const managedKeys = intent.hooks.map((h) => h.key);
-    need4(codexTrustReconcileWitness(configBefore.text, managedKeys) === codexTrustReconcileWitness(currentConfig.text, managedKeys), "RECONCILE_UNRELATED_CONFIG_CHANGED");
-    need4(codexTrustUnmanagedSemantic(configBefore.text, managedKeys) === codexTrustUnmanagedSemantic(currentConfig.text, managedKeys), "RECONCILE_UNRELATED_CONFIG_CHANGED");
+    const witnessSame = codexTrustReconcileWitness(configBefore.text, managedKeys) === codexTrustReconcileWitness(currentConfig.text, managedKeys);
+    const unmanagedSame = codexTrustUnmanagedSemantic(configBefore.text, managedKeys) === codexTrustUnmanagedSemantic(currentConfig.text, managedKeys);
+    need4(unmanagedSame && (witnessSame || supersededBinding), "RECONCILE_UNRELATED_CONFIG_CHANGED");
     const before2 = structure(configBefore.text), current = structure(currentConfig.text), expectedConfig = structuredClone(before2);
     expectedConfig.hooks ??= {};
     expectedConfig.hooks.state ??= {};
     for (const hook of intent.hooks)
       expectedConfig.hooks.state[hook.key] = { ...expectedConfig.hooks.state[hook.key], enabled: true, trusted_hash: hook.currentHash };
-    need4(isDeepStrictEqual6(expectedConfig, current), "RECONCILE_CONFIG_DRIFT");
-    const policyCurrent = snapshot(join56(dataDir3, "agent-policy.json"), true);
-    need4(policyCurrent.sha256 === policyBefore.sha256, "RECONCILE_POLICY_CHANGED");
-    const policy = parseManagedSkillPolicy(policyBefore.text), binding = policy.bridge;
+    if (supersededBinding) {
+      for (const hook of intent.hooks) {
+        const state = current.hooks?.state?.[hook.key];
+        need4(state?.enabled === true && typeof state.trusted_hash === "string" && /^sha256:[a-f0-9]{64}$/.test(state.trusted_hash), "RECONCILE_CONFIG_DRIFT");
+      }
+    } else
+      need4(isDeepStrictEqual6(expectedConfig, current), "RECONCILE_CONFIG_DRIFT");
+    const policy = parseManagedSkillPolicy(policyCurrent.text), binding = policy.bridge;
     assertManagedAgentBridge("codex", { home, dataDir: dataDir3, projectDir: home });
     const skillsCli = bindSkillsCli(binding.commands.codex, options.reviewedSkillsCli);
-    need4(isDeepStrictEqual6(skillsCli.receipt, intent.skillsCli), "RECONCILE_SKILLS_BINDING_CHANGED");
-    const alias = binding.rootAliases?.find((item) => item.agent === "codex"), codexHome = alias?.target ?? join56(home, ".codex"), hooksPath = join56(codexHome, "hooks.json");
-    need4(resolve22(intent.configPath) === resolve22(join56(codexHome, "config.toml")), "RECONCILE_CONFIG_PATH_CHANGED");
+    if (supersededBinding)
+      verifyReleaseArtifact(options.releaseProof, skillsCli);
+    const skillsBindingChanged = !isDeepStrictEqual6(skillsCli.receipt, intent.skillsCli);
+    need4(!skillsBindingChanged || supersededBinding, "RECONCILE_SKILLS_BINDING_CHANGED");
+    const alias = binding.rootAliases?.find((item) => item.agent === "codex"), physicalRoot = alias?.target ?? join56(home, ".codex"), hooksPath = join56(physicalRoot, "hooks.json");
+    need4(resolve22(intent.configPath) === resolve22(join56(physicalRoot, "config.toml")), "RECONCILE_CONFIG_PATH_CHANGED");
+    const nativeConfigPath = intent.nativeConfigPath ?? intent.configPath;
+    need4([join56(home, ".codex/config.toml"), join56(physicalRoot, "config.toml")].includes(nativeConfigPath), "RECONCILE_NATIVE_CONFIG_PATH_CHANGED");
+    const codexHome = nativeConfigPath !== intent.configPath ? undefined : dirname30(nativeConfigPath);
     const hooksCurrent = snapshot(hooksPath);
-    need4(hooksCurrent.sha256 === intent.hooksSha256 || hooksCurrent.sha256 === hooksBefore.sha256, "RECONCILE_HOOKS_CHANGED");
+    if (hooksCurrent.sha256 !== intent.hooksSha256 && hooksCurrent.sha256 !== hooksBefore.sha256) {
+      need4(supersededBinding, "RECONCILE_HOOKS_CHANGED");
+      const currentDeclarations = JSON.parse(hooksCurrent.text).hooks;
+      for (const [event, [nativeEvent]] of Object.entries(eventNames)) {
+        const command = renderAgentHookCommand(binding.commands.codex, "codex", binding.profiles.codex, event);
+        need4(isDeepStrictEqual6(currentDeclarations?.[event], [{ hooks: [{ type: "command", command, timeout: 15 }] }]), "RECONCILE_BINDING_HOOK_CHANGED");
+      }
+    }
     rpc = await connect({ command: options.codexCommand ?? "codex", home, codexHome });
     need4(rpc.version === intent.nativeVersion, "RECONCILE_NATIVE_VERSION_CHANGED");
     const discovered = await rpc.request("hooks/list", { cwds: [home] });
@@ -108312,12 +108370,15 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     if (recordedNativeHooks)
       need4(nativeHooks.length === recordedNativeHooks.length, "RECONCILE_NATIVE_HOOK_LIST_CHANGED");
     const plannedKeys = new Set(intent.hooks.map((hook) => hook.key));
+    let nativeTrustPending = false;
     for (const expected of recordedNativeHooks ?? []) {
       const matches2 = nativeHooks.filter((hook) => hook.key === expected.key);
       need4(matches2.length === 1, "RECONCILE_NATIVE_HOOK_LIST_CHANGED");
       const actual = safeNativeHook(matches2[0]);
       const stable = (hook) => {
         const { enabled, trustStatus, ...identity4 } = hook;
+        if (supersededBinding)
+          delete identity4.command;
         return identity4;
       };
       need4(isDeepStrictEqual6(stable(actual), stable(expected)), "RECONCILE_NATIVE_IDENTITY_CHANGED");
@@ -108328,15 +108389,22 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
       const matches2 = nativeHooks.filter((h2) => h2.key === wanted.key || h2.key === wanted.key.replace(join56(home, ".codex/hooks.json"), hooksPath));
       need4(matches2.length === 1, "RECONCILE_NATIVE_IDENTITY_CHANGED");
       const h = matches2[0];
-      need4(h.enabled === true && h.trustStatus === "trusted" && h.currentHash === wanted.currentHash, "RECONCILE_NATIVE_STATE_INCOMPLETE");
+      const trusted = h.trustStatus === "trusted";
+      need4(h.enabled === true && (trusted || supersededBinding && h.trustStatus === "modified") && (h.currentHash === wanted.currentHash || supersededBinding && /^sha256:[a-f0-9]{64}$/.test(h.currentHash)), "RECONCILE_NATIVE_STATE_INCOMPLETE");
+      if (!trusted)
+        nativeTrustPending = true;
+      if (supersededBinding) {
+        const nativeToCliEvent = { userPromptSubmit: "UserPromptSubmit", sessionStart: "SessionStart", subagentStart: "SubagentStart" };
+        need4(h.command === renderAgentHookCommand(binding.commands.codex, "codex", binding.profiles.codex, nativeToCliEvent[wanted.event] ?? ""), "RECONCILE_BINDING_HOOK_CHANGED");
+      }
     }
     const config2 = await rpc.request("config/read", { includeLayers: true, cwd: home });
-    const layers = config2?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === intent.configPath && !layer.name.profile);
+    const layers = config2?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
     need4(layers?.length === 1 && !layers[0].disabledReason && isDeepStrictEqual6(layers[0].config, current), "RECONCILE_NATIVE_CONFIG_MISMATCH");
     const finalDiscovery = await rpc.request("hooks/list", { cwds: [home] });
     need4(Array.isArray(finalDiscovery?.data) && finalDiscovery.data.length === 1 && finalDiscovery.data[0].cwd === home && !finalDiscovery.data[0].errors?.length && !finalDiscovery.data[0].warnings?.length && (!recordedNativeHooks || isDeepStrictEqual6(finalDiscovery.data[0].hooks.map(safeNativeHook), nativeHooks.map(safeNativeHook))), "RECONCILE_NATIVE_STATE_CHANGED");
     const finalConfig = await rpc.request("config/read", { includeLayers: true, cwd: home });
-    const finalLayers = finalConfig?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === intent.configPath && !layer.name.profile);
+    const finalLayers = finalConfig?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
     need4(finalLayers?.length === 1 && isDeepStrictEqual6(finalLayers[0].config, current), "RECONCILE_NATIVE_CONFIG_CHANGED");
     unchanged2(stoppedFile);
     unchanged2(intentFile);
@@ -108348,7 +108416,7 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     unchanged2(currentConfig);
     skillsCli.recheck();
     assertManagedAgentBridge("codex", { home, dataDir: dataDir3, projectDir: home });
-    const receipt = { version: 1, status: "reconciled", reconciled: true, automaticRollback: false, journal, planDigest: intent.planDigest, nativeVersion: rpc.version, nativeStateVerified: true, nativeExecutionVerified: false, configSha256: currentConfig.sha256, hooksSha256: hooksCurrent.sha256, policySha256: policyBefore.sha256, skillsCli: skillsCli.receipt, nativeInventoryScope: recordedNativeHooks ? "complete" : "declared-managed-hooks-only", unrelatedNativeHooksPreserved: !!recordedNativeHooks, unrelatedSettingsAndCommentsPreserved: true };
+    const receipt = { version: 1, status: supersededBinding ? "superseded" : "reconciled", reconciled: true, supersededBinding, automaticRollback: false, journal, planDigest: intent.planDigest, nativeVersion: rpc.version, nativeStateVerified: !nativeTrustPending, nativeTrustPending, nativeExecutionVerified: false, configSha256: currentConfig.sha256, hooksSha256: hooksCurrent.sha256, policySha256: policyBefore.sha256, policyBeforeSha256: policyBefore.sha256, policyCurrentSha256: policyCurrent.sha256, previousSkillsCli: intent.skillsCli, skillsCli: skillsCli.receipt, releaseProof: options.releaseProof, nativeInventoryScope: recordedNativeHooks ? "complete" : "declared-managed-hooks-only", unrelatedNativeHooksPreserved: !!recordedNativeHooks, unrelatedSettingsAndCommentsPreserved: true };
     save2(join56(journal, "receipt.json"), json2(receipt));
     return receipt;
   } catch (error61) {
@@ -108366,7 +108434,10 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
     const policyFile = snapshot(join56(dataDir3, "agent-policy.json"), true), policy = parseManagedSkillPolicy(policyFile.text);
     const binding = policy.bridge, alias = binding.rootAliases?.find((item) => item.agent === "codex");
     const skillsCli = bindSkillsCli(binding.commands.codex, options.reviewedSkillsCli);
-    const codexHome = alias?.target ?? join56(home, ".codex"), hooksPath = join56(codexHome, "hooks.json"), configPath = join56(codexHome, "config.toml");
+    const physicalRoot = alias?.target ?? join56(home, ".codex"), hooksPath = join56(physicalRoot, "hooks.json"), configPath = join56(physicalRoot, "config.toml");
+    need4(options.codexHome === undefined || isAbsolute25(options.codexHome) && [join56(home, ".codex"), physicalRoot].includes(options.codexHome), "NATIVE_HOME_NOT_ADMITTED");
+    const codexHome = options.codexHome === undefined ? undefined : physicalRoot;
+    const nativeConfigPath = join56(codexHome ?? join56(home, ".codex"), "config.toml");
     const hooksFile = snapshot(hooksPath), configFile = snapshot(configPath, true), original = structure(configFile.text);
     const declarations = JSON.parse(hooksFile.text).hooks, expected = [];
     for (const [event, [nativeEvent, label]] of Object.entries(eventNames)) {
@@ -108397,7 +108468,7 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
     });
     const discovered = await list2(), admitted = admit(discovered);
     const config2 = await rpc.request("config/read", { includeLayers: true, cwd: home });
-    const layers = config2?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === configPath && !layer.name.profile);
+    const layers = config2?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
     need4(layers?.length === 1 && /^sha256:[a-f0-9]{64}$/.test(layers[0].version) && !layers[0].disabledReason && isDeepStrictEqual6(layers[0].config, original), "NATIVE_CONFIG_MISMATCH");
     need4(config2.config && config2.config.features?.hooks !== false, "NATIVE_HOOKS_DISABLED");
     need4(config2.layers.slice(0, config2.layers.indexOf(layers[0])).every((layer) => layer.config?.hooks === undefined && layer.config?.features?.hooks === undefined), "NATIVE_CONFIG_OVERRIDDEN");
@@ -108411,9 +108482,9 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
       unchanged2(configFile);
     };
     checkInputs();
-    const digestInput = { version: 1, home, configPath, configSha256: configFile.sha256, configVersion: layers[0].version, policySha256: policyFile.sha256, hooksSha256: hooksFile.sha256, skillsCli: skillsCli.receipt, nativeVersion: rpc.version, declarations: expected, admitted };
+    const digestInput = { version: 1, home, configPath, ...nativeConfigPath !== configPath ? { nativeConfigPath } : {}, configSha256: configFile.sha256, configVersion: layers[0].version, policySha256: policyFile.sha256, hooksSha256: hooksFile.sha256, skillsCli: skillsCli.receipt, nativeVersion: rpc.version, declarations: expected, admitted };
     const planDigest = makePlanDigest(digestInput);
-    const baseReceipt = { planDigest, skillsCli: skillsCli.receipt, nativeVersion: rpc.version, ownedNativeProcessId: rpc.processId, agent: "codex", applied: false, planned, nativeEligible: planned.length === 0, transport: "owned-stdio-process", existingSessionsReloaded: false, nativeExecutionVerified: false };
+    const baseReceipt = { planDigest, skillsCli: skillsCli.receipt, nativeVersion: rpc.version, nativeConfigPath, ownedNativeProcessId: rpc.processId, agent: "codex", applied: false, planned, nativeEligible: planned.length === 0, transport: "owned-stdio-process", existingSessionsReloaded: false, nativeExecutionVerified: false };
     if (options.apply)
       need4(options.reviewedPlanDigest === planDigest, "PLAN_CHANGED: run the dry-run again and pass its reviewed --plan-digest with --apply");
     const parent = join56(dataDir3, "native-hook-trust");
@@ -108478,7 +108549,12 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
   }
 }
 var json2 = (value) => JSON.stringify(value, null, 2) + `
-`, structure = (text3) => JSON.parse(JSON.stringify(Bun.TOML.parse(text3))), eventNames, makePlanDigest = (value) => createHash26("sha256").update(json2(value)).digest("hex"), safeNativeHook = (hook) => ({ key: hook.key, eventName: hook.eventName, handlerType: hook.handlerType, command: hook.command, matcher: hook.matcher, timeoutSec: hook.timeoutSec, async: hook.async, statusMessage: hook.statusMessage, additionalContextLimit: hook.additionalContextLimit, sourcePath: hook.sourcePath, source: hook.source, pluginId: hook.pluginId, isManaged: hook.isManaged, currentHash: hook.currentHash, enabled: hook.enabled, trustStatus: hook.trustStatus });
+`, structure = (text3) => JSON.parse(JSON.stringify(Bun.TOML.parse(text3))), eventNames, makePlanDigest = (value) => createHash26("sha256").update(json2(value)).digest("hex"), safeNativeHook = (hook) => ({ key: hook.key, eventName: hook.eventName, handlerType: hook.handlerType, command: hook.command, matcher: hook.matcher, timeoutSec: hook.timeoutSec, async: hook.async, statusMessage: hook.statusMessage, additionalContextLimit: hook.additionalContextLimit, sourcePath: hook.sourcePath, source: hook.source, pluginId: hook.pluginId, isManaged: hook.isManaged, currentHash: hook.currentHash, enabled: hook.enabled, trustStatus: hook.trustStatus }), withoutCodexCommand = (value) => {
+  const copy = structuredClone(value);
+  if (copy?.bridge?.commands && Object.hasOwn(copy.bridge.commands, "codex"))
+    copy.bridge.commands.codex = "<reviewed-codex-binding>";
+  return copy;
+};
 var init_agent_codex_trust = __esm(() => {
   init_config();
   init_managed_policy();
@@ -108571,8 +108647,8 @@ var exports_agent_integration = {};
 __export(exports_agent_integration, {
   registerAgentIntegration: () => registerAgentIntegration
 });
-import { readFileSync as readFileSync37 } from "fs";
-import { isAbsolute as isAbsolute25 } from "path";
+import { readFileSync as readFileSync38 } from "fs";
+import { isAbsolute as isAbsolute26 } from "path";
 function pinnedHookProfile(input3, configuredProfile) {
   try {
     const parsed = parseSkillContextInput(JSON.stringify(input3));
@@ -108643,7 +108719,7 @@ function registerAgentIntegration(parent) {
   });
   hook.command("install").option("--agent <agent>", `Agent to configure: ${INTEGRATION_AGENTS.join(", ")}, all`, "all").option("--command <path>", "Skills executable used by the hook (preserves existing binding; new agents use skills)").option("--selection-profile <id>", "Selection profile (preserves existing binding; new agents use default)").option("--include-vendor", "Retained for compatibility; vendor system skills are always inventoried and disabled", false).option("--discovery-inputs <file>", "Advanced reviewed active plugin roots and source hashes for unsupported registrations").option("--allow-root-aliases", "Allow home .claude/.codex aliases to existing directories within this home", false).option("--apply", "Apply the plan, preserving prior configuration in private backups", false).option("--json", "Output a receipt as JSON", false).description("Plan or install one Skills CLI bridge plus native prompt hooks").action(async (options) => {
     try {
-      const discoveryInputs = options.discoveryInputs ? JSON.parse(readFileSync37(options.discoveryInputs, "utf8")) : undefined;
+      const discoveryInputs = options.discoveryInputs ? JSON.parse(readFileSync38(options.discoveryInputs, "utf8")) : undefined;
       const plan = planAgentIntegration({ agents: agents(options.agent), command: options.command, profileId: options.selectionProfile, includeVendor: options.includeVendor, discoveryInputs, allowRootAliases: options.allowRootAliases });
       const result2 = options.apply ? applyAgentIntegration(plan) : { changed: [], backups: [] };
       const receipt = { applied: options.apply, planned: plan.changes.map((change) => change.path), ...result2, rootAliases: plan.rootAliases ?? [], discovery: plan.discoveryAfter, nativeSkills: plan.nativeSkills.map((entry) => ({ agent: entry.agent, path: entry.path, managed: entry.managed, vendor: entry.vendor, system: entry.system === true, bridge: entry.bridge === true })), requiresNativeRetirement: plan.nativeSkills.some((entry) => !entry.bridge && !entry.system) };
@@ -108662,7 +108738,7 @@ function registerAgentIntegration(parent) {
         throw new Error("Native trust enrollment requires --agent codex");
       if (options.agent !== "codex")
         throw new Error("Native trust enrollment currently supports --agent codex only");
-      const result2 = await enrollCodexNativeHooks({ codexCommand: options.codexCommand, apply: options.apply, reviewedPlanDigest: options.planDigest });
+      const result2 = await enrollCodexNativeHooks({ codexCommand: options.codexCommand, codexHome: process.env.CODEX_HOME, apply: options.apply, reviewedPlanDigest: options.planDigest });
       if (options.json)
         await writeCliOutput(JSON.stringify(result2));
       else
@@ -108672,11 +108748,15 @@ function registerAgentIntegration(parent) {
       process.exitCode = 1;
     }
   });
-  trust.command("reconcile").requiredOption("--agent <agent>", "Native trust adapter (codex)").requiredOption("--journal <path>", "Private incomplete native trust journal to inspect").option("--codex-command <path>", "Installed Codex executable used for its native configuration API", "codex").option("--json", "Output the reconciliation receipt", false).description("Verify an interrupted Codex native trust write and resolve its private journal").action(async (options) => {
+  trust.command("reconcile").requiredOption("--agent <agent>", "Native trust adapter (codex)").requiredOption("--journal <path>", "Private incomplete native trust journal to inspect").option("--codex-command <path>", "Installed Codex executable used for its native configuration API", "codex").option("--supersede-binding", "Resolve a stale journal only when current policy differs solely by the reviewed Codex CLI binding", false).option("--skills-package-tar <path>", "Exact package tarball consumed by the reviewed executable").option("--skills-package-tar-sha256 <sha256>", "SHA-256 of the reviewed Skills package tarball").option("--skills-package-tar-bytes <bytes>", "Byte length of the reviewed Skills package tarball").option("--skills-package-manifest-sha256 <sha256>", "SHA-256 of the reviewed Skills package manifest").option("--skills-executable-sha256 <sha256>", "SHA-256 of the reviewed running Skills executable").option("--json", "Output the reconciliation receipt", false).description("Verify an interrupted Codex native trust write and resolve its private journal").action(async (options) => {
     try {
       if (options.agent !== "codex")
         throw new Error("Native trust reconciliation currently supports --agent codex only");
-      const result2 = await reconcileCodexNativeHooks({ journal: options.journal, codexCommand: options.codexCommand });
+      const proofFields = [options.skillsPackageTar, options.skillsPackageTarSha256, options.skillsPackageTarBytes, options.skillsPackageManifestSha256, options.skillsExecutableSha256];
+      if (proofFields.some((value) => value !== undefined) && proofFields.some((value) => value === undefined))
+        throw new Error("Release provenance requires package tar path, tar hash/bytes, manifest hash, and executable hash together");
+      const releaseProof = proofFields.every((value) => value !== undefined) ? { packageTarPath: options.skillsPackageTar, packageTarSha256: options.skillsPackageTarSha256, packageTarBytes: Number(options.skillsPackageTarBytes), manifestSha256: options.skillsPackageManifestSha256, executableSha256: options.skillsExecutableSha256 } : undefined;
+      const result2 = await reconcileCodexNativeHooks({ journal: options.journal, codexCommand: options.codexCommand, supersedeBinding: options.supersedeBinding, releaseProof });
       if (options.json)
         await writeCliOutput(JSON.stringify(result2));
       else
@@ -108693,7 +108773,7 @@ function registerAgentIntegration(parent) {
     try {
       if (agents(options.agent).length !== 1)
         throw new Error("A hook invocation requires one agent");
-      const inputText = readFileSync37(0, "utf8");
+      const inputText = readFileSync38(0, "utf8");
       if (inputText.length > 1024 * 1024)
         throw new Error("Hook input is too large");
       let input3 = JSON.parse(inputText);
@@ -108706,12 +108786,12 @@ function registerAgentIntegration(parent) {
       input3.hook_event_name = event;
       const projects = [process.cwd()];
       if (input3.cwd !== undefined) {
-        if (typeof input3.cwd !== "string" || !isAbsolute25(input3.cwd) || input3.cwd.includes("\x00"))
+        if (typeof input3.cwd !== "string" || !isAbsolute26(input3.cwd) || input3.cwd.includes("\x00"))
           throw new Error("Invalid native hook working directory");
         projects.push(input3.cwd);
       }
       if (options.agent === "cursor") {
-        if (!Array.isArray(input3.workspace_roots) || input3.workspace_roots.length > 32 || input3.workspace_roots.some((path) => typeof path !== "string" || !isAbsolute25(path) || path.includes("\x00")))
+        if (!Array.isArray(input3.workspace_roots) || input3.workspace_roots.length > 32 || input3.workspace_roots.some((path) => typeof path !== "string" || !isAbsolute26(path) || path.includes("\x00")))
           throw new Error("Invalid Cursor workspace roots");
         projects.push(...input3.workspace_roots);
         input3.cwd ??= input3.workspace_roots[0] ?? process.cwd();
@@ -108789,7 +108869,7 @@ function registerAgentIntegration(parent) {
   const migrate = parent.command("migrate").description("Preserve and retire native agent skill copies");
   migrate.command("native").option("--project <directory>", "Also inventory a project and its ancestors (the current directory and its ancestors are always included)").option("--include-unmanaged", "Archive user-authored skills as well as Skills-managed copies", false).option("--include-vendor", "Retire vendor SKILL.md discovery files while preserving plugin scripts and assets", false).option("--target-manifest <file>", "Reviewed exact native migration target manifest").option("--discovery-inputs <file>", "Advanced reviewed active plugin roots and source hashes").option("--allow-root-aliases", "Allow home .claude/.codex aliases to existing directories within this home", false).option("--apply", "Move selected skills to private archives outside agent discovery roots", false).option("--json", "Output inventory and archive receipt as JSON", false).description("Inventory native skill copies; preserve complete directories before retiring them").action(async (options) => {
     try {
-      const discoveryInputs = options.discoveryInputs ? JSON.parse(readFileSync37(options.discoveryInputs, "utf8")) : undefined;
+      const discoveryInputs = options.discoveryInputs ? JSON.parse(readFileSync38(options.discoveryInputs, "utf8")) : undefined;
       if (options.targetManifest && (options.includeUnmanaged || options.includeVendor))
         throw new Error("--target-manifest cannot be combined with broad native migration selectors");
       const targetManifest = options.targetManifest ? readNativeMigrationTargetManifest(options.targetManifest) : undefined;
@@ -109094,11 +109174,11 @@ import {
   copyFileSync as copyFileSync2,
   mkdirSync as mkdirSync26,
   readdirSync as readdirSync21,
-  readFileSync as readFileSync38,
-  statSync as statSync21,
+  readFileSync as readFileSync39,
+  statSync as statSync22,
   writeFileSync as writeFileSync26
 } from "fs";
-import { dirname as dirname30, join as join57, resolve as resolve23, sep as sep10 } from "path";
+import { dirname as dirname31, join as join57, resolve as resolve23, sep as sep10 } from "path";
 function fail5(code2, message, detail = []) {
   throw new StationSnapshotError(code2, message, detail);
 }
@@ -109110,7 +109190,7 @@ function readSnapshotManifest(repoRoot, stationId) {
   const manifestPath = join57(snapshotRoot, "sync-manifest.json");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync38(manifestPath, "utf8"));
+    manifest = JSON.parse(readFileSync39(manifestPath, "utf8"));
   } catch (error61) {
     fail5("MANIFEST_UNREADABLE", `cannot read snapshot manifest: ${manifestPath}: ${error61.message}`);
   }
@@ -109192,7 +109272,7 @@ function planStationHydration(stationId, repoRoot) {
           });
           continue;
         }
-        const info = statSync21(entry.fullPath);
+        const info = statSync22(entry.fullPath);
         const manifestHash = manifestHashes.get(`${agent}${MANIFEST_HASH_KEY_SEP}${homeRelative}`) ?? null;
         let verified = false;
         if (manifestHash !== null) {
@@ -109246,7 +109326,7 @@ function planStationHydration(stationId, repoRoot) {
         for (const copy of copies) {
           let isStub = false;
           try {
-            isStub = isPointerSkillMd(readFileSync38(copy.fullPath, "utf8"));
+            isStub = isPointerSkillMd(readFileSync39(copy.fullPath, "utf8"));
           } catch {
             isStub = false;
           }
@@ -109351,7 +109431,7 @@ function writeStationHydration(options) {
   }
   let written = 0;
   for (const entry of toWrite) {
-    mkdirSync26(dirname30(entry.destination), { recursive: true });
+    mkdirSync26(dirname31(entry.destination), { recursive: true });
     copyFileSync2(entry.fullPath, entry.destination);
     written += 1;
   }
@@ -109372,8 +109452,8 @@ function writeStationHydration(options) {
     },
     skills: resultSkills
   };
-  const hydrationManifestPath = join57(dirname30(cacheRoot), `hydration-${options.stationId}.json`);
-  mkdirSync26(dirname30(hydrationManifestPath), { recursive: true });
+  const hydrationManifestPath = join57(dirname31(cacheRoot), `hydration-${options.stationId}.json`);
+  mkdirSync26(dirname31(hydrationManifestPath), { recursive: true });
   writeFileSync26(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
 `);
   return {
@@ -109450,9 +109530,9 @@ var init_hydrate = __esm(() => {
 
 // src/lib/prepare-skill.ts
 import { createHash as createHash28, randomUUID as randomUUID11 } from "crypto";
-import { chmodSync as chmodSync3, existsSync as existsSync34, lstatSync as lstatSync29, mkdirSync as mkdirSync27, mkdtempSync as mkdtempSync6, readFileSync as readFileSync39, readdirSync as readdirSync22, renameSync as renameSync12, rmSync as rmSync9, writeFileSync as writeFileSync27 } from "fs";
+import { chmodSync as chmodSync3, existsSync as existsSync34, lstatSync as lstatSync29, mkdirSync as mkdirSync27, mkdtempSync as mkdtempSync6, readFileSync as readFileSync40, readdirSync as readdirSync22, renameSync as renameSync12, rmSync as rmSync9, writeFileSync as writeFileSync27 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname31, isAbsolute as isAbsolute26, join as join58, relative as relative9, resolve as resolve24, sep as sep11 } from "path";
+import { dirname as dirname32, isAbsolute as isAbsolute27, join as join58, relative as relative9, resolve as resolve24, sep as sep11 } from "path";
 function prepareSkill(name, options) {
   const normalized = normalizePortableSkillName(name);
   if (!new RegExp(SEMVER_PATTERN).test(options.version))
@@ -109497,7 +109577,7 @@ function prepareSkill(name, options) {
       mkdirSync27(join58(staging, directory2), { recursive: true });
     for (const file2 of before2.files) {
       const destination = join58(staging, file2.path);
-      mkdirSync27(dirname31(destination), { recursive: true });
+      mkdirSync27(dirname32(destination), { recursive: true });
       writeFileSync27(destination, file2.bytes, { mode: file2.mode });
     }
     const stagedManifest = join58(staging, "skill.json");
@@ -109558,7 +109638,7 @@ function validateRuntimeEntrypoint(candidate2, root2) {
   if (typeof entry !== "string")
     return;
   const target = resolve24(root2, entry), rel = relative9(root2, target);
-  if (isAbsolute26(entry) || /^[a-zA-Z]:/.test(entry) || entry.includes("\\") || !rel || rel === ".." || rel.startsWith(`..${sep11}`) || isAbsolute26(rel) || !existsSync34(target) || !lstatSync29(target).isFile()) {
+  if (isAbsolute27(entry) || /^[a-zA-Z]:/.test(entry) || entry.includes("\\") || !rel || rel === ".." || rel.startsWith(`..${sep11}`) || isAbsolute27(rel) || !existsSync34(target) || !lstatSync29(target).isFile()) {
     throw new Error("Executable runtime.entrypoint must name an existing regular file inside the skill directory.");
   }
 }
@@ -109669,7 +109749,7 @@ function snapshot2(root2) {
         bytes += stat3.size;
         if (bytes > 50000000)
           throw new Error("Skill exceeds the preparation size limit (50000000 bytes).");
-        const content = readFileSync39(absolute);
+        const content = readFileSync40(absolute);
         if (content.length !== stat3.size)
           throw new Error("Skill changed during preparation.");
         files.push({ path, bytes: content, mode: stat3.mode & 511 });
@@ -110071,7 +110151,7 @@ var init_schedule = __esm(() => {
 
 // src/lib/registry-sync.ts
 import { mkdirSync as mkdirSync28, writeFileSync as writeFileSync28 } from "fs";
-import { dirname as dirname32, relative as relative10 } from "path";
+import { dirname as dirname33, relative as relative10 } from "path";
 function createRegistrySyncArtifact(options = {}) {
   const profile = options.profile ?? "all";
   const includeDocs = options.includeDocs ?? true;
@@ -110128,7 +110208,7 @@ function createRegistrySyncArtifact(options = {}) {
   };
 }
 function writeRegistrySyncArtifact(path, artifact) {
-  mkdirSync28(dirname32(path), { recursive: true });
+  mkdirSync28(dirname33(path), { recursive: true });
   writeFileSync28(path, `${JSON.stringify(artifact, null, 2)}
 `);
 }
@@ -110349,8 +110429,8 @@ __export(exports_publish, {
   buildVersionManifest: () => buildVersionManifest,
   PushSkillError: () => PushSkillError
 });
-import { execFileSync } from "child_process";
-import { existsSync as existsSync35, readFileSync as readFileSync40 } from "fs";
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync35, readFileSync as readFileSync41 } from "fs";
 import { hostname as hostname4 } from "os";
 import { join as join59 } from "path";
 function registerPublish(parent) {
@@ -110405,7 +110485,7 @@ async function pushSkill(name, options = {}) {
   await verifyPackedCanonicalHash(skill.name, packed);
   const versionManifest = buildVersionManifest(skill.path, packed);
   const skillMdPath = join59(skill.path, "SKILL.md");
-  const skillMd = existsSync35(skillMdPath) ? readFileSync40(skillMdPath, "utf-8") : undefined;
+  const skillMd = existsSync35(skillMdPath) ? readFileSync41(skillMdPath, "utf-8") : undefined;
   const base3 = {
     slug: skill.name,
     path: skill.path,
@@ -110562,7 +110642,7 @@ function sanitizeGitRemote(url2) {
 }
 function gitValue(dir, args2) {
   try {
-    const out = execFileSync("git", ["-C", dir, ...args2], { stdio: ["ignore", "pipe", "ignore"], encoding: "utf-8" }).trim();
+    const out = execFileSync2("git", ["-C", dir, ...args2], { stdio: ["ignore", "pipe", "ignore"], encoding: "utf-8" }).trim();
     return out || null;
   } catch {
     return null;
@@ -112026,11 +112106,11 @@ var init_storage2 = __esm(() => {
 });
 
 // src/lib/registry-reconcile.ts
-import { existsSync as existsSync36, readFileSync as readFileSync41, statSync as statSync22, writeFileSync as writeFileSync29 } from "fs";
+import { existsSync as existsSync36, readFileSync as readFileSync42, statSync as statSync23, writeFileSync as writeFileSync29 } from "fs";
 import { join as join60 } from "path";
 function isDirectory2(path) {
   try {
-    return statSync22(path).isDirectory();
+    return statSync23(path).isDirectory();
   } catch {
     return false;
   }
@@ -112046,7 +112126,7 @@ function readBaseline(skillDir) {
   if (!existsSync36(markerPath))
     return;
   try {
-    const marker = JSON.parse(readFileSync41(markerPath, "utf-8"));
+    const marker = JSON.parse(readFileSync42(markerPath, "utf-8"));
     if (!isSkillsOwnershipMarker(marker))
       return;
     return {
@@ -112062,7 +112142,7 @@ function readCursor(root2) {
   if (!existsSync36(path))
     return { runCount: 0 };
   try {
-    const cursor2 = JSON.parse(readFileSync41(path, "utf-8"));
+    const cursor2 = JSON.parse(readFileSync42(path, "utf-8"));
     return { runCount: typeof cursor2.runCount === "number" ? cursor2.runCount : 0 };
   } catch {
     return { runCount: 0 };

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.9.7",
+    version: "0.9.9",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.7",
+  version: "0.9.9",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.7",
+  version: "0.9.9",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -24125,7 +24125,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.7",
+  version: "0.9.9",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/index.js

@@ -11448,7 +11448,7 @@ import { isAbsolute as isAbsolute10, join as join20, resolve as resolve10 } from
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.7",
+  version: "0.9.9",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/lib/agent-codex-trust.d.ts

@@ -4,16 +4,26 @@ export interface CodexNativeHookTrustOptions {
     home?: string;
     dataDir?: string;
     codexCommand?: string;
+    codexHome?: string;
     apply?: boolean;
     reviewedPlanDigest?: string;
     reviewedSkillsCli?: ReviewedSkillsCli;
 }
+export interface SkillsCliReleaseProof {
+    packageTarPath: string;
+    packageTarSha256: string;
+    packageTarBytes: number;
+    manifestSha256: string;
+    executableSha256: string;
+}
 export interface CodexNativeHookReconcileOptions {
     home?: string;
     dataDir?: string;
     codexCommand?: string;
     journal: string;
     reviewedSkillsCli?: ReviewedSkillsCli;
+    releaseProof?: SkillsCliReleaseProof;
+    supersedeBinding?: boolean;
 }
 type Connect = typeof connectCodexHookRpc;
 /** Resolve an interrupted native write only after the native consumer and every
@@ -24,21 +34,27 @@ export declare function reconcileCodexNativeHooks(options: CodexNativeHookReconc
     version: number;
     status: string;
     reconciled: boolean;
+    supersededBinding: boolean;
     automaticRollback: boolean;
     journal: string;
     planDigest: any;
     nativeVersion: string;
     nativeStateVerified: boolean;
+    nativeTrustPending: boolean;
     nativeExecutionVerified: boolean;
     configSha256: string;
     hooksSha256: string;
     policySha256: string;
+    policyBeforeSha256: string;
+    policyCurrentSha256: string;
+    previousSkillsCli: any;
     skillsCli: {
         path: string;
         version: string;
         sha256: string;
         manifestSha256: string;
     };
+    releaseProof: SkillsCliReleaseProof | undefined;
     nativeInventoryScope: string;
     unrelatedNativeHooksPreserved: boolean;
     unrelatedSettingsAndCommentsPreserved: boolean;
@@ -54,6 +70,7 @@ export declare function enrollCodexNativeHooks(options?: CodexNativeHookTrustOpt
         manifestSha256: string;
     };
     nativeVersion: string;
+    nativeConfigPath: string;
     ownedNativeProcessId: number | undefined;
     agent: string;
     applied: boolean;

package/dist/lib/codex-hook-rpc.d.ts

@@ -9,5 +9,5 @@ export interface CodexHookRpc {
 export declare function connectCodexHookRpc(options: {
     command: string;
     home: string;
-    codexHome: string;
+    codexHome?: string;
 }): Promise<CodexHookRpc>;

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.7",
+  version: "0.9.9",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.9.7",
+  "version": "0.9.9",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {