@hasna/skills 0.9.8 → 0.9.9

package/README.md

@@ -120,6 +120,12 @@ skills hook trust --agent codex --apply --plan-digest <reviewed-plan-digest> --j
 
 Review the commands, current hashes, and existing trust/enable state in the
 plan. Apply refuses if the plan, package, declarations, or configuration changed.
+The plan preserves the native `CODEX_HOME` choice. When unset, Codex uses
+the lexical `~/.codex` path; an explicit `CODEX_HOME` resolves canonically.
+Only the home root and an explicitly admitted canonical root-alias target
+are accepted. Those views have separate hook identities even when they reach
+the same files; enrolling one preserves the other's trust entries. Keep the
+same `CODEX_HOME` choice for enrollment and the consuming agent.
 It enrolls the current exact definitions, including reviewed modified hooks,
 and preserves unrelated trust, settings, and comments. A private journal keeps
 the pre-write configuration; a failed write or verification requires journal

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.9.8",
+    version: "0.9.9",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -107920,9 +107920,14 @@ async function connectCodexHookRpc(options) {
   const current = statSync20(binary);
   if (realpathSync11(found) !== binary || ["dev", "ino", "size", "mtimeMs", "ctimeMs"].some((k) => stat3[k] !== current[k]))
     throw new Error("CODEX_HOOK_TRUST_NATIVE_EXECUTABLE_CHANGED");
+  const env3 = { ...process.env, HOME: options.home, NO_COLOR: "1" };
+  if (options.codexHome === undefined)
+    delete env3.CODEX_HOME;
+  else
+    env3.CODEX_HOME = options.codexHome;
   const child = spawn3(binary, ["app-server", "--strict-config", "--stdio"], {
     cwd: options.home,
-    env: { ...process.env, HOME: options.home, CODEX_HOME: options.codexHome, NO_COLOR: "1" },
+    env: env3,
     stdio: ["pipe", "pipe", "pipe"]
   });
   const pending = new Map;
@@ -108301,10 +108306,10 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     const declarations = intent.declarations ?? intent.hooks.map((hook) => ({ event: hook.event, key: `${join56(home, ".codex/hooks.json")}${hook.key.slice(hook.key.indexOf(".codex/hooks.json") + ".codex/hooks.json".length)}`, command: hook.command }));
     const admitted = intent.admitted ?? intent.hooks;
     const configSha256 = intent.configSha256 ?? configBefore.sha256, configVersion = intent.configVersion ?? intent.expectedVersion;
-    const digestInput = { version: 1, home: intent.home ?? home, configPath: intent.configPath, configSha256, configVersion, policySha256: intent.policySha256, hooksSha256: intent.hooksSha256, skillsCli: intent.skillsCli, nativeVersion: intent.nativeVersion, declarations, admitted };
+    const digestInput = { version: 1, home: intent.home ?? home, configPath: intent.configPath, ...intent.nativeConfigPath !== undefined ? { nativeConfigPath: intent.nativeConfigPath } : {}, configSha256, configVersion, policySha256: intent.policySha256, hooksSha256: intent.hooksSha256, skillsCli: intent.skillsCli, nativeVersion: intent.nativeVersion, declarations, admitted };
     need4(makePlanDigest(digestInput) === intent.planDigest, "RECONCILE_PLAN_CHANGED");
     need4(isDeepStrictEqual6(intent.hooks, admitted.filter((hook) => !hook.enabled || hook.trustStatus !== "trusted")), "RECONCILE_INTENT_HOOKS_CHANGED");
-    need4(configBefore.sha256 === intent.beforeSha256 && hooksBefore.sha256 === intent.hooksSha256 && policyBefore.sha256 === intent.policySha256, "RECONCILE_JOURNAL_CHANGED");
+    need4(configBefore.sha256 === (intent.beforeSha256 ?? intent.configSha256) && hooksBefore.sha256 === intent.hooksSha256 && policyBefore.sha256 === intent.policySha256, "RECONCILE_JOURNAL_CHANGED");
     const policyCurrent = snapshot(join56(dataDir3, "agent-policy.json"), true);
     let supersededBinding = false;
     if (policyCurrent.sha256 !== policyBefore.sha256) {
@@ -108342,8 +108347,11 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
       verifyReleaseArtifact(options.releaseProof, skillsCli);
     const skillsBindingChanged = !isDeepStrictEqual6(skillsCli.receipt, intent.skillsCli);
     need4(!skillsBindingChanged || supersededBinding, "RECONCILE_SKILLS_BINDING_CHANGED");
-    const alias = binding.rootAliases?.find((item) => item.agent === "codex"), codexHome = alias?.target ?? join56(home, ".codex"), hooksPath = join56(codexHome, "hooks.json");
-    need4(resolve22(intent.configPath) === resolve22(join56(codexHome, "config.toml")), "RECONCILE_CONFIG_PATH_CHANGED");
+    const alias = binding.rootAliases?.find((item) => item.agent === "codex"), physicalRoot = alias?.target ?? join56(home, ".codex"), hooksPath = join56(physicalRoot, "hooks.json");
+    need4(resolve22(intent.configPath) === resolve22(join56(physicalRoot, "config.toml")), "RECONCILE_CONFIG_PATH_CHANGED");
+    const nativeConfigPath = intent.nativeConfigPath ?? intent.configPath;
+    need4([join56(home, ".codex/config.toml"), join56(physicalRoot, "config.toml")].includes(nativeConfigPath), "RECONCILE_NATIVE_CONFIG_PATH_CHANGED");
+    const codexHome = nativeConfigPath !== intent.configPath ? undefined : dirname30(nativeConfigPath);
     const hooksCurrent = snapshot(hooksPath);
     if (hooksCurrent.sha256 !== intent.hooksSha256 && hooksCurrent.sha256 !== hooksBefore.sha256) {
       need4(supersededBinding, "RECONCILE_HOOKS_CHANGED");
@@ -108391,12 +108399,12 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
       }
     }
     const config2 = await rpc.request("config/read", { includeLayers: true, cwd: home });
-    const layers = config2?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === intent.configPath && !layer.name.profile);
+    const layers = config2?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
     need4(layers?.length === 1 && !layers[0].disabledReason && isDeepStrictEqual6(layers[0].config, current), "RECONCILE_NATIVE_CONFIG_MISMATCH");
     const finalDiscovery = await rpc.request("hooks/list", { cwds: [home] });
     need4(Array.isArray(finalDiscovery?.data) && finalDiscovery.data.length === 1 && finalDiscovery.data[0].cwd === home && !finalDiscovery.data[0].errors?.length && !finalDiscovery.data[0].warnings?.length && (!recordedNativeHooks || isDeepStrictEqual6(finalDiscovery.data[0].hooks.map(safeNativeHook), nativeHooks.map(safeNativeHook))), "RECONCILE_NATIVE_STATE_CHANGED");
     const finalConfig = await rpc.request("config/read", { includeLayers: true, cwd: home });
-    const finalLayers = finalConfig?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === intent.configPath && !layer.name.profile);
+    const finalLayers = finalConfig?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
     need4(finalLayers?.length === 1 && isDeepStrictEqual6(finalLayers[0].config, current), "RECONCILE_NATIVE_CONFIG_CHANGED");
     unchanged2(stoppedFile);
     unchanged2(intentFile);
@@ -108426,7 +108434,10 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
     const policyFile = snapshot(join56(dataDir3, "agent-policy.json"), true), policy = parseManagedSkillPolicy(policyFile.text);
     const binding = policy.bridge, alias = binding.rootAliases?.find((item) => item.agent === "codex");
     const skillsCli = bindSkillsCli(binding.commands.codex, options.reviewedSkillsCli);
-    const codexHome = alias?.target ?? join56(home, ".codex"), hooksPath = join56(codexHome, "hooks.json"), configPath = join56(codexHome, "config.toml");
+    const physicalRoot = alias?.target ?? join56(home, ".codex"), hooksPath = join56(physicalRoot, "hooks.json"), configPath = join56(physicalRoot, "config.toml");
+    need4(options.codexHome === undefined || isAbsolute25(options.codexHome) && [join56(home, ".codex"), physicalRoot].includes(options.codexHome), "NATIVE_HOME_NOT_ADMITTED");
+    const codexHome = options.codexHome === undefined ? undefined : physicalRoot;
+    const nativeConfigPath = join56(codexHome ?? join56(home, ".codex"), "config.toml");
     const hooksFile = snapshot(hooksPath), configFile = snapshot(configPath, true), original = structure(configFile.text);
     const declarations = JSON.parse(hooksFile.text).hooks, expected = [];
     for (const [event, [nativeEvent, label]] of Object.entries(eventNames)) {
@@ -108457,7 +108468,7 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
     });
     const discovered = await list2(), admitted = admit(discovered);
     const config2 = await rpc.request("config/read", { includeLayers: true, cwd: home });
-    const layers = config2?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === configPath && !layer.name.profile);
+    const layers = config2?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
     need4(layers?.length === 1 && /^sha256:[a-f0-9]{64}$/.test(layers[0].version) && !layers[0].disabledReason && isDeepStrictEqual6(layers[0].config, original), "NATIVE_CONFIG_MISMATCH");
     need4(config2.config && config2.config.features?.hooks !== false, "NATIVE_HOOKS_DISABLED");
     need4(config2.layers.slice(0, config2.layers.indexOf(layers[0])).every((layer) => layer.config?.hooks === undefined && layer.config?.features?.hooks === undefined), "NATIVE_CONFIG_OVERRIDDEN");
@@ -108471,9 +108482,9 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
       unchanged2(configFile);
     };
     checkInputs();
-    const digestInput = { version: 1, home, configPath, configSha256: configFile.sha256, configVersion: layers[0].version, policySha256: policyFile.sha256, hooksSha256: hooksFile.sha256, skillsCli: skillsCli.receipt, nativeVersion: rpc.version, declarations: expected, admitted };
+    const digestInput = { version: 1, home, configPath, ...nativeConfigPath !== configPath ? { nativeConfigPath } : {}, configSha256: configFile.sha256, configVersion: layers[0].version, policySha256: policyFile.sha256, hooksSha256: hooksFile.sha256, skillsCli: skillsCli.receipt, nativeVersion: rpc.version, declarations: expected, admitted };
     const planDigest = makePlanDigest(digestInput);
-    const baseReceipt = { planDigest, skillsCli: skillsCli.receipt, nativeVersion: rpc.version, ownedNativeProcessId: rpc.processId, agent: "codex", applied: false, planned, nativeEligible: planned.length === 0, transport: "owned-stdio-process", existingSessionsReloaded: false, nativeExecutionVerified: false };
+    const baseReceipt = { planDigest, skillsCli: skillsCli.receipt, nativeVersion: rpc.version, nativeConfigPath, ownedNativeProcessId: rpc.processId, agent: "codex", applied: false, planned, nativeEligible: planned.length === 0, transport: "owned-stdio-process", existingSessionsReloaded: false, nativeExecutionVerified: false };
     if (options.apply)
       need4(options.reviewedPlanDigest === planDigest, "PLAN_CHANGED: run the dry-run again and pass its reviewed --plan-digest with --apply");
     const parent = join56(dataDir3, "native-hook-trust");
@@ -108727,7 +108738,7 @@ function registerAgentIntegration(parent) {
         throw new Error("Native trust enrollment requires --agent codex");
       if (options.agent !== "codex")
         throw new Error("Native trust enrollment currently supports --agent codex only");
-      const result2 = await enrollCodexNativeHooks({ codexCommand: options.codexCommand, apply: options.apply, reviewedPlanDigest: options.planDigest });
+      const result2 = await enrollCodexNativeHooks({ codexCommand: options.codexCommand, codexHome: process.env.CODEX_HOME, apply: options.apply, reviewedPlanDigest: options.planDigest });
       if (options.json)
         await writeCliOutput(JSON.stringify(result2));
       else

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.9.8",
+    version: "0.9.9",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.8",
+  version: "0.9.9",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.8",
+  version: "0.9.9",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -24125,7 +24125,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.8",
+  version: "0.9.9",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/index.js

@@ -11448,7 +11448,7 @@ import { isAbsolute as isAbsolute10, join as join20, resolve as resolve10 } from
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.8",
+  version: "0.9.9",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/lib/agent-codex-trust.d.ts

@@ -4,6 +4,7 @@ export interface CodexNativeHookTrustOptions {
     home?: string;
     dataDir?: string;
     codexCommand?: string;
+    codexHome?: string;
     apply?: boolean;
     reviewedPlanDigest?: string;
     reviewedSkillsCli?: ReviewedSkillsCli;
@@ -69,6 +70,7 @@ export declare function enrollCodexNativeHooks(options?: CodexNativeHookTrustOpt
         manifestSha256: string;
     };
     nativeVersion: string;
+    nativeConfigPath: string;
     ownedNativeProcessId: number | undefined;
     agent: string;
     applied: boolean;

package/dist/lib/codex-hook-rpc.d.ts

@@ -9,5 +9,5 @@ export interface CodexHookRpc {
 export declare function connectCodexHookRpc(options: {
     command: string;
     home: string;
-    codexHome: string;
+    codexHome?: string;
 }): Promise<CodexHookRpc>;

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.8",
+  version: "0.9.9",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.9.8",
+  "version": "0.9.9",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {