@bensandee/tooling 0.37.0 → 0.39.0

package/dist/bin.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { d as debug, f as debugExec, h as note, l as createRealExecutor$1, m as log, p as isEnvVerbose, t as runDockerCheck, u as isExecSyncError } from "./check-Ceom_OgJ.mjs";
+import { d as debug, f as debugExec, g as note, h as log, l as createRealExecutor$1, m as redact, p as isEnvVerbose, t as runDockerCheck, u as isExecSyncError } from "./check-hutCTIXe.mjs";
 import { defineCommand, runMain } from "citty";
 import * as p from "@clack/prompts";
 import { isCancel, select } from "@clack/prompts";
 import path from "node:path";
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
-import { execSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { execFileSync, execSync } from "node:child_process";
 import JSON5 from "json5";
 import { parse } from "jsonc-parser";
 import { z } from "zod";
@@ -102,6 +102,7 @@ function detectProject(targetDir) {
 		hasPackageJson: exists("package.json"),
 		hasTsconfig: exists("tsconfig.json"),
 		hasOxlintConfig: exists("oxlint.config.ts"),
+		oxlintExtendsRecommended: fileContains(path.join(targetDir, "oxlint.config.ts"), "@bensandee/config/oxlint/recommended"),
 		hasLegacyOxlintJson: exists(".oxlintrc.json"),
 		hasGitignore: exists(".gitignore"),
 		hasVitestConfig: exists("vitest.config.ts") || exists("vitest.config.mts"),
@@ -170,6 +171,15 @@ function detectLegacyConfigs(targetDir) {
 	}
 	return results;
 }
+/** Check whether a file exists and contains a given substring. */
+function fileContains(filePath, substring) {
+	if (!existsSync(filePath)) return false;
+	try {
+		return readFileSync(filePath, "utf-8").includes(substring);
+	} catch (_error) {
+		return false;
+	}
+}
 /** Read and parse existing package.json, or return undefined. */
 function readPackageJson(targetDir) {
 	const pkgPath = path.join(targetDir, "package.json");
@@ -455,6 +465,11 @@ function buildDefaultConfig(targetDir, flags) {
 }
 //#endregion
 //#region src/utils/fs.ts
+/** Verify that a relative path resolves within the target directory. */
+function assertContained(targetDir, rel) {
+	const resolved = path.resolve(targetDir, rel);
+	if (!resolved.startsWith(targetDir + path.sep) && resolved !== targetDir) throw new FatalError(`Path traversal detected: ${rel} resolves outside target directory`);
+}
 /**
 * Compare file content, using parsed comparison for JSON files to ignore
 * formatting differences. Falls back to exact string comparison for JSONC
@@ -495,9 +510,18 @@ function createContext(config, confirmOverwrite) {
 		config,
 		targetDir: config.targetDir,
 		packageJson: pkgRaw ? parsePackageJson(pkgRaw) : void 0,
-		exists: (rel) => fileExists(config.targetDir, rel),
-		read: (rel) => readFile(config.targetDir, rel),
+		exists: (rel) => {
+			const resolved = path.resolve(config.targetDir, rel);
+			if (!resolved.startsWith(config.targetDir + path.sep) && resolved !== config.targetDir) return false;
+			return fileExists(config.targetDir, rel);
+		},
+		read: (rel) => {
+			const resolved = path.resolve(config.targetDir, rel);
+			if (!resolved.startsWith(config.targetDir + path.sep) && resolved !== config.targetDir) return;
+			return readFile(config.targetDir, rel);
+		},
 		write: (rel, content) => {
+			assertContained(config.targetDir, rel);
 			if (!rel.startsWith(".tooling-archived/")) {
 				const existing = readFile(config.targetDir, rel);
 				if (existing !== void 0 && !contentEqual(rel, existing, content)) {
@@ -509,6 +533,7 @@ function createContext(config, confirmOverwrite) {
 			if (rel === "package.json") ctx.packageJson = parsePackageJson(content);
 		},
 		remove: (rel) => {
+			assertContained(config.targetDir, rel);
 			const fullPath = path.join(config.targetDir, rel);
 			if (existsSync(fullPath)) rmSync(fullPath);
 		},
@@ -560,7 +585,7 @@ const DockerCheckConfigSchema = z.object({
 	envFile: z.string().optional().meta({ description: "Environment file for compose" }),
 	services: z.array(z.string()).optional().meta({ description: "Services to check (default: all)" }),
 	healthChecks: z.array(DeclarativeHealthCheckSchema).optional().meta({ description: "Health check definitions" }),
-	buildCommand: z.string().optional().meta({ description: "Command to build images before checking" }),
+	buildCommand: z.array(z.string()).optional().meta({ description: "Command to build images before checking (e.g. [\"pnpm\", \"image:build\"])" }),
 	buildCwd: z.string().optional().meta({ description: "Working directory for build command" }),
 	timeoutMs: z.number().int().positive().optional().meta({ description: "Overall timeout in milliseconds" }),
 	pollIntervalMs: z.number().int().positive().optional().meta({ description: "Poll interval in milliseconds" })
@@ -596,7 +621,9 @@ const ToolingConfigSchema = z.strictObject({
 		dockerfile: z.string().meta({ description: "Path to Dockerfile relative to package" }),
 		context: z.string().default(".").meta({ description: "Docker build context relative to package" })
 	})).optional().meta({ description: "Docker package overrides (package name → config)" }),
-	dockerCheck: z.union([z.literal(false), DockerCheckConfigSchema]).optional().meta({ description: "Docker health check configuration or false to disable" })
+	dockerCheck: z.union([z.literal(false), DockerCheckConfigSchema]).optional().meta({ description: "Docker health check configuration or false to disable" }),
+	registryHost: z.string().optional().meta({ description: "Docker registry hostname (e.g. ghcr.io, code.example.com)" }),
+	registryNamespace: z.string().optional().meta({ description: "Docker registry namespace (e.g. ghcr.io/myorg, code.example.com/myorg)" })
 });
 /** Load saved tooling config from the target directory. Returns undefined if missing, throws on invalid. */
 function loadToolingConfig(targetDir) {
@@ -855,14 +882,15 @@ function readRepoName(executor, cwd) {
 function buildImage(executor, pkg, cwd, extraArgs) {
 	const dockerfilePath = path.resolve(cwd, pkg.docker.dockerfile);
 	const contextPath = path.resolve(cwd, pkg.docker.context);
-	const command = [
-		"docker build",
-		`-f ${dockerfilePath}`,
-		`-t ${pkg.imageName}:latest`,
+	executor.execInherit("docker", [
+		"build",
+		"-f",
+		dockerfilePath,
+		"-t",
+		`${pkg.imageName}:latest`,
 		...extraArgs,
 		contextPath
-	].join(" ");
-	executor.execInherit(command);
+	]);
 }
 /**
 * Detect packages with docker config in .tooling.json and build each one.
@@ -917,7 +945,13 @@ function runDockerPublish(executor, config) {
 	for (const pkg of packages) if (!pkg.version) throw new FatalError(`Package ${pkg.dir} has docker config but no version in package.json`);
 	if (!config.dryRun) {
 		log.info(`Logging in to ${config.registryHost}...`);
-		const loginResult = executor.exec(`echo "${config.password}" | docker login ${config.registryHost} -u ${config.username} --password-stdin`);
+		const loginResult = executor.exec("docker", [
+			"login",
+			config.registryHost,
+			"-u",
+			config.username,
+			"--password-stdin"
+		], { input: config.password });
 		debugExec(config, "docker login", loginResult);
 		if (loginResult.exitCode !== 0) throw new FatalError(`Docker login failed: ${loginResult.stderr}`);
 	} else log.info("[dry-run] Skipping docker login");
@@ -930,12 +964,16 @@ function runDockerPublish(executor, config) {
 				const ref = imageRef(config.registryNamespace, pkg.imageName, tag);
 				allTags.push(ref);
 				log.info(`Tagging ${pkg.imageName} → ${ref}`);
-				const tagResult = executor.exec(`docker tag ${pkg.imageName} ${ref}`);
+				const tagResult = executor.exec("docker", [
+					"tag",
+					pkg.imageName,
+					ref
+				]);
 				debugExec(config, `docker tag ${pkg.imageName} ${ref}`, tagResult);
 				if (tagResult.exitCode !== 0) throw new FatalError(`docker tag failed: ${tagResult.stderr}`);
 				if (!config.dryRun) {
 					log.info(`Pushing ${ref}...`);
-					const pushResult = executor.exec(`docker push ${ref}`);
+					const pushResult = executor.exec("docker", ["push", ref]);
 					debugExec(config, `docker push ${ref}`, pushResult);
 					if (pushResult.exitCode !== 0) throw new FatalError(`docker push failed: ${pushResult.stderr}`);
 				} else log.info(`[dry-run] Skipping push for ${ref}`);
@@ -944,7 +982,7 @@ function runDockerPublish(executor, config) {
 	} finally {
 		if (!config.dryRun) {
 			log.info(`Logging out from ${config.registryHost}...`);
-			executor.exec(`docker logout ${config.registryHost}`);
+			executor.exec("docker", ["logout", config.registryHost]);
 		}
 	}
 	log.info(`Published ${String(allTags.length)} image tag(s)`);
@@ -1143,7 +1181,29 @@ function computeNodeVersionYaml(ctx) {
 }
 //#endregion
 //#region src/generators/publish-ci.ts
-function publishSteps(nodeVersionYaml) {
+/**
+* Check whether the project has a repository URL in package.json.
+* When true, the CLI can derive DOCKER_REGISTRY_HOST and DOCKER_REGISTRY_NAMESPACE
+* at runtime, so workflows can omit those env vars.
+*/
+function hasRepositoryUrl(ctx) {
+	const raw = ctx.read("package.json");
+	if (!raw) return false;
+	return parsePackageJson(raw)?.repository !== void 0;
+}
+/** Build the docker publish env block, omitting registry vars when derivable at runtime. */
+function dockerPublishEnv$1(registryDerivable) {
+	return {
+		...registryDerivable ? {} : {
+			DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
+			DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE")
+		},
+		DOCKER_USERNAME: actionsExpr("secrets.DOCKER_USERNAME"),
+		DOCKER_PASSWORD: actionsExpr("secrets.DOCKER_PASSWORD"),
+		RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
+	};
+}
+function publishSteps(nodeVersionYaml, registryDerivable) {
 	return [
 		{ step: { uses: "actions/checkout@v6" } },
 		{ step: { uses: "pnpm/action-setup@v5" } },
@@ -1154,13 +1214,7 @@ function publishSteps(nodeVersionYaml) {
 		{ step: { run: "pnpm install --frozen-lockfile" } },
 		{ step: {
 			name: "Publish Docker images",
-			env: {
-				DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
-				DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE"),
-				DOCKER_USERNAME: actionsExpr("secrets.DOCKER_USERNAME"),
-				DOCKER_PASSWORD: actionsExpr("secrets.DOCKER_PASSWORD"),
-				RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
-			},
+			env: dockerPublishEnv$1(registryDerivable),
 			run: "pnpm exec bst docker:publish"
 		} }
 	];
@@ -1203,7 +1257,7 @@ async function generateDeployCi(ctx) {
 	};
 	const isGitHub = ctx.config.ci === "github";
 	const workflowPath = isGitHub ? ".github/workflows/publish.yml" : ".forgejo/workflows/publish.yml";
-	const steps = publishSteps(computeNodeVersionYaml(ctx));
+	const steps = publishSteps(computeNodeVersionYaml(ctx), hasRepositoryUrl(ctx));
 	const content = buildWorkflowYaml({
 		ci: ctx.config.ci,
 		name: "Publish",
@@ -1284,8 +1338,8 @@ const PER_PACKAGE_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1300,8 +1354,8 @@ const PER_PACKAGE_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1316,8 +1370,8 @@ const PER_PACKAGE_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1332,8 +1386,8 @@ const PER_PACKAGE_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1351,8 +1405,8 @@ const ROOT_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1367,8 +1421,8 @@ const ROOT_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1383,8 +1437,8 @@ const ROOT_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1424,8 +1478,8 @@ function addReleaseDeps(deps, config) {
 				"@changesets/cli": "2.30.0",
 				"@release-it/bumper": "7.0.5",
 				"@types/node": "24.12.0",
-				"commit-and-tag-version": "12.7.0",
-				"knip": "5.87.0",
+				"commit-and-tag-version": "12.7.1",
+				"knip": "6.0.3",
 				"lefthook": "2.1.4",
 				"oxfmt": "0.41.0",
 				"oxlint": "1.56.0",
@@ -1440,8 +1494,8 @@ function addReleaseDeps(deps, config) {
 				"@changesets/cli": "2.30.0",
 				"@release-it/bumper": "7.0.5",
 				"@types/node": "24.12.0",
-				"commit-and-tag-version": "12.7.0",
-				"knip": "5.87.0",
+				"commit-and-tag-version": "12.7.1",
+				"knip": "6.0.3",
 				"lefthook": "2.1.4",
 				"oxfmt": "0.41.0",
 				"oxlint": "1.56.0",
@@ -1458,8 +1512,8 @@ function addReleaseDeps(deps, config) {
 				"@changesets/cli": "2.30.0",
 				"@release-it/bumper": "7.0.5",
 				"@types/node": "24.12.0",
-				"commit-and-tag-version": "12.7.0",
-				"knip": "5.87.0",
+				"commit-and-tag-version": "12.7.1",
+				"knip": "6.0.3",
 				"lefthook": "2.1.4",
 				"oxfmt": "0.41.0",
 				"oxlint": "1.56.0",
@@ -1476,8 +1530,8 @@ function addReleaseDeps(deps, config) {
 				"@changesets/cli": "2.30.0",
 				"@release-it/bumper": "7.0.5",
 				"@types/node": "24.12.0",
-				"commit-and-tag-version": "12.7.0",
-				"knip": "5.87.0",
+				"commit-and-tag-version": "12.7.1",
+				"knip": "6.0.3",
 				"lefthook": "2.1.4",
 				"oxfmt": "0.41.0",
 				"oxlint": "1.56.0",
@@ -1509,15 +1563,15 @@ async function generatePackageJson(ctx) {
 	}
 	const devDeps = { ...ROOT_DEV_DEPS };
 	if (!isMonorepo) Object.assign(devDeps, PER_PACKAGE_DEV_DEPS);
-	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.9.1";
-	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.37.0";
-	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.9.2";
+	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.9.3";
+	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.39.0";
+	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.11.0";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1532,8 +1586,8 @@ async function generatePackageJson(ctx) {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1616,8 +1670,8 @@ async function generatePackageJson(ctx) {
 			"@changesets/cli": "2.30.0",
 			"@release-it/bumper": "7.0.5",
 			"@types/node": "24.12.0",
-			"commit-and-tag-version": "12.7.0",
-			"knip": "5.87.0",
+			"commit-and-tag-version": "12.7.1",
+			"knip": "6.0.3",
 			"lefthook": "2.1.4",
 			"oxfmt": "0.41.0",
 			"oxlint": "1.56.0",
@@ -1878,6 +1932,7 @@ import { defineConfig } from "oxlint";
 
 export default defineConfig({
   extends: [recommended],
+  ignorePatterns: [".claude/hooks/bst-hook.mjs"],
 });
 `;
 const CONFIG_PRESET_ONLY = `import { presetRules } from "@bensandee/config/oxlint";
@@ -1885,6 +1940,7 @@ import { defineConfig } from "oxlint";
 
 export default defineConfig({
   rules: presetRules,
+  ignorePatterns: [".claude/hooks/bst-hook.mjs"],
 });
 `;
 async function generateOxlint(ctx) {
@@ -1912,7 +1968,10 @@ async function generateOxlint(ctx) {
 }
 //#endregion
 //#region src/generators/formatter.ts
-const OXFMT_CONFIG = `{}\n`;
+const OXFMT_CONFIG = `{
+  "ignorePatterns": [".claude"]
+}
+`;
 const PRETTIER_CONFIG = `{
   "semi": true,
   "singleQuote": false,
@@ -2001,7 +2060,11 @@ const REQUIRED_ENTRIES = [
 	"!.env.example"
 ];
 /** Tooling-specific entries added during init/update but not required for repo:sync --check. */
-const OPTIONAL_ENTRIES = [".tooling-migrate.md", ".tooling-archived/"];
+const OPTIONAL_ENTRIES = [
+	".tooling-migrate.md",
+	".tooling-archived/",
+	".claude/hooks/bst-hook.audit.local.jsonl"
+];
 const ALL_ENTRIES = [...REQUIRED_ENTRIES, ...OPTIONAL_ENTRIES];
 /** Normalize a gitignore entry for comparison: strip leading `/` and trailing `/`. */
 function normalizeEntry(entry) {
@@ -2160,12 +2223,13 @@ const KNIP_CONFIG_SINGLE = `import type { KnipConfig } from "knip";
 export default {
   entry: ["src/index.ts"],
   project: ["src/**/*.ts"],
-  ignore: ["dist/**"],
+  ignore: ["dist/**", ".claude/hooks/**"],
 } satisfies KnipConfig;
 `;
 const KNIP_CONFIG_MONOREPO = `import type { KnipConfig } from "knip";
 
 export default {
+  ignore: [".claude/hooks/**"],
   workspaces: {
     ".": {
       entry: [],
@@ -2296,7 +2360,33 @@ async function generatePnpmWorkspace(ctx) {
 	};
 }
 //#endregion
+//#region src/generators/claude-hooks.ts
+const HOOK_PATH = ".claude/hooks/bst-hook.mjs";
+async function generateClaudeHooks(ctx) {
+	const content = "/**\n * bst-hook — Claude Code PreToolUse hook\n * @bensandee/claude-hooks v0.1.0\n * https://github.com/bensandee/tooling\n *\n * Auto-generated by @bensandee/tooling repo:sync — do not edit manually.\n */\nimport*as e from\"node:fs\";import{readFileSync as t,readdirSync as n,statSync as r}from\"node:fs\";import*as i from\"node:path\";import{join as a,resolve as o}from\"node:path\";import{fileURLToPath as s}from\"node:url\";Object.freeze({status:`aborted`});function c(e,t,n){function r(n,r){if(n._zod||Object.defineProperty(n,`_zod`,{value:{def:r,constr:o,traits:new Set},enumerable:!1}),n._zod.traits.has(e))return;n._zod.traits.add(e),t(n,r);let i=o.prototype,a=Object.keys(i);for(let e=0;e<a.length;e++){let t=a[e];t in n||(n[t]=i[t].bind(n))}}let i=n?.Parent??Object;class a extends i{}Object.defineProperty(a,`name`,{value:e});function o(e){var t;let i=n?.Parent?new a:this;r(i,e),(t=i._zod).deferred??(t.deferred=[]);for(let e of i._zod.deferred)e();return i}return Object.defineProperty(o,`init`,{value:r}),Object.defineProperty(o,Symbol.hasInstance,{value:t=>n?.Parent&&t instanceof n.Parent?!0:t?._zod?.traits?.has(e)}),Object.defineProperty(o,`name`,{value:e}),o}var l=class extends Error{constructor(){super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`)}};const u={};function d(e){return e&&Object.assign(u,e),u}function ee(e,t){return typeof t==`bigint`?t.toString():t}function te(e){return{get value(){{let t=e();return Object.defineProperty(this,`value`,{value:t}),t}throw Error(`cached value already set`)}}}function ne(e){let t=e.startsWith(`^`)?1:0,n=e.endsWith(`$`)?e.length-1:e.length;return e.slice(t,n)}const f=Symbol(`evaluating`);function p(e,t,n){let r;Object.defineProperty(e,t,{get(){if(r!==f)return r===void 0&&(r=f,r=n()),r},set(n){Object.defineProperty(e,t,{value:n})},configurable:!0})}const m=`captureStackTrace`in Error?Error.captureStackTrace:(...e)=>{};function h(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function re(e){if(h(e)===!1)return!1;let t=e.constructor;if(t===void 0||typeof t!=`function`)return!0;let n=t.prototype;return!(h(n)===!1||Object.prototype.hasOwnProperty.call(n,`isPrototypeOf`)===!1)}function ie(e,t,n){let r=new e._zod.constr(t??e._zod.def);return(!t||n?.parent)&&(r._zod.parent=e),r}function g(e){let t=e;if(!t)return{};if(typeof t==`string`)return{error:()=>t};if(t?.message!==void 0){if(t?.error!==void 0)throw Error(\"Cannot specify both `message` and `error` params\");t.error=t.message}return delete t.message,typeof t.error==`string`?{...t,error:()=>t.error}:t}function _(e){return Object.keys(e).filter(t=>e[t]._zod.optin===`optional`&&e[t]._zod.optout===`optional`)}-Number.MAX_VALUE,Number.MAX_VALUE;function v(e,t=0){if(e.aborted===!0)return!0;for(let n=t;n<e.issues.length;n++)if(e.issues[n]?.continue!==!0)return!0;return!1}function y(e,t){return t.map(t=>{var n;return(n=t).path??(n.path=[]),t.path.unshift(e),t})}function b(e){return typeof e==`string`?e:e?.message}function x(e,t,n){let r={...e,path:e.path??[]};return e.message||(r.message=b(e.inst?._zod.def?.error?.(e))??b(t?.error?.(e))??b(n.customError?.(e))??b(n.localeError?.(e))??`Invalid input`),delete r.inst,delete r.continue,t?.reportInput||delete r.input,r}const S=(e,t)=>{e.name=`$ZodError`,Object.defineProperty(e,`_zod`,{value:e._zod,enumerable:!1}),Object.defineProperty(e,`issues`,{value:t,enumerable:!1}),e.message=JSON.stringify(t,ee,2),Object.defineProperty(e,`toString`,{value:()=>e.message,enumerable:!1})},ae=c(`$ZodError`,S),C=c(`$ZodError`,S,{Parent:Error}),w=(e=>(t,n,r,i)=>{let a=r?Object.assign(r,{async:!1}):{async:!1},o=t._zod.run({value:n,issues:[]},a);if(o instanceof Promise)throw new l;if(o.issues.length){let t=new(i?.Err??e)(o.issues.map(e=>x(e,a,d())));throw m(t,i?.callee),t}return o.value})(C),oe=(e=>async(t,n,r,i)=>{let a=r?Object.assign(r,{async:!0}):{async:!0},o=t._zod.run({value:n,issues:[]},a);if(o instanceof Promise&&(o=await o),o.issues.length){let t=new(i?.Err??e)(o.issues.map(e=>x(e,a,d())));throw m(t,i?.callee),t}return o.value})(C),T=(e=>(t,n,r)=>{let i=r?{...r,async:!1}:{async:!1},a=t._zod.run({value:n,issues:[]},i);if(a instanceof Promise)throw new l;return a.issues.length?{success:!1,error:new(e??ae)(a.issues.map(e=>x(e,i,d())))}:{success:!0,data:a.value}})(C),E=(e=>async(t,n,r)=>{let i=r?Object.assign(r,{async:!0}):{async:!0},a=t._zod.run({value:n,issues:[]},i);return a instanceof Promise&&(a=await a),a.issues.length?{success:!1,error:new e(a.issues.map(e=>x(e,i,d())))}:{success:!0,data:a.value}})(C),se=e=>{let t=e?`[\\\\s\\\\S]{${e?.minimum??0},${e?.maximum??``}}`:`[\\\\s\\\\S]*`;return RegExp(`^${t}$`)},ce=/^-?\\d+(?:\\.\\d+)?$/,le={major:4,minor:3,patch:6},D=c(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=le;let r=[...e._zod.def.checks??[]];e._zod.traits.has(`$ZodCheck`)&&r.unshift(e);for(let t of r)for(let n of t._zod.onattach)n(e);if(r.length===0)(n=e._zod).deferred??(n.deferred=[]),e._zod.deferred?.push(()=>{e._zod.run=e._zod.parse});else{let t=(e,t,n)=>{let r=v(e),i;for(let a of t){if(a._zod.def.when){if(!a._zod.def.when(e))continue}else if(r)continue;let t=e.issues.length,o=a._zod.check(e);if(o instanceof Promise&&n?.async===!1)throw new l;if(i||o instanceof Promise)i=(i??Promise.resolve()).then(async()=>{await o,e.issues.length!==t&&(r||=v(e,t))});else{if(e.issues.length===t)continue;r||=v(e,t)}}return i?i.then(()=>e):e},n=(n,i,a)=>{if(v(n))return n.aborted=!0,n;let o=t(i,r,a);if(o instanceof Promise){if(a.async===!1)throw new l;return o.then(t=>e._zod.parse(t,a))}return e._zod.parse(o,a)};e._zod.run=(i,a)=>{if(a.skipChecks)return e._zod.parse(i,a);if(a.direction===`backward`){let t=e._zod.parse({value:i.value,issues:[]},{...a,skipChecks:!0});return t instanceof Promise?t.then(e=>n(e,i,a)):n(t,i,a)}let o=e._zod.parse(i,a);if(o instanceof Promise){if(a.async===!1)throw new l;return o.then(e=>t(e,r,a))}return t(o,r,a)}}p(e,`~standard`,()=>({validate:t=>{try{let n=T(e,t);return n.success?{value:n.data}:{issues:n.error?.issues}}catch{return E(e,t).then(e=>e.success?{value:e.data}:{issues:e.error?.issues})}},vendor:`zod`,version:1}))}),ue=c(`$ZodString`,(e,t)=>{D.init(e,t),e._zod.pattern=[...e?._zod.bag?.patterns??[]].pop()??se(e._zod.bag),e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=String(n.value)}catch{}return typeof n.value==`string`||n.issues.push({expected:`string`,code:`invalid_type`,input:n.value,inst:e}),n}}),de=c(`$ZodUnknown`,(e,t)=>{D.init(e,t),e._zod.parse=e=>e});function O(e,t,n,r,i){if(e.issues.length){if(i&&!(n in r))return;t.issues.push(...y(n,e.issues))}e.value===void 0?n in r&&(t.value[n]=void 0):t.value[n]=e.value}function fe(e){let t=Object.keys(e.shape);for(let n of t)if(!e.shape?.[n]?._zod?.traits?.has(`$ZodType`))throw Error(`Invalid element at key \"${n}\": expected a Zod schema`);let n=_(e.shape);return{...e,keys:t,keySet:new Set(t),numKeys:t.length,optionalKeys:new Set(n)}}function pe(e,t,n,r,i,a){let o=[],s=i.keySet,c=i.catchall._zod,l=c.def.type,u=c.optout===`optional`;for(let i in t){if(s.has(i))continue;if(l===`never`){o.push(i);continue}let a=c.run({value:t[i],issues:[]},r);a instanceof Promise?e.push(a.then(e=>O(e,n,i,t,u))):O(a,n,i,t,u)}return o.length&&n.issues.push({code:`unrecognized_keys`,keys:o,input:t,inst:a}),e.length?Promise.all(e).then(()=>n):n}const me=c(`$ZodObject`,(e,t)=>{if(D.init(e,t),!Object.getOwnPropertyDescriptor(t,`shape`)?.get){let e=t.shape;Object.defineProperty(t,`shape`,{get:()=>{let n={...e};return Object.defineProperty(t,`shape`,{value:n}),n}})}let n=te(()=>fe(t));p(e._zod,`propValues`,()=>{let e=t.shape,n={};for(let t in e){let r=e[t]._zod;if(r.values){n[t]??(n[t]=new Set);for(let e of r.values)n[t].add(e)}}return n});let r=h,i=t.catchall,a;e._zod.parse=(t,o)=>{a??=n.value;let s=t.value;if(!r(s))return t.issues.push({expected:`object`,code:`invalid_type`,input:s,inst:e}),t;t.value={};let c=[],l=a.shape;for(let e of a.keys){let n=l[e],r=n._zod.optout===`optional`,i=n._zod.run({value:s[e],issues:[]},o);i instanceof Promise?c.push(i.then(n=>O(n,t,e,s,r))):O(i,t,e,s,r)}return i?pe(c,s,t,o,n.value,e):c.length?Promise.all(c).then(()=>t):t}}),he=c(`$ZodRecord`,(e,t)=>{D.init(e,t),e._zod.parse=(n,r)=>{let i=n.value;if(!re(i))return n.issues.push({expected:`record`,code:`invalid_type`,input:i,inst:e}),n;let a=[],o=t.keyType._zod.values;if(o){n.value={};let s=new Set;for(let e of o)if(typeof e==`string`||typeof e==`number`||typeof e==`symbol`){s.add(typeof e==`number`?e.toString():e);let o=t.valueType._zod.run({value:i[e],issues:[]},r);o instanceof Promise?a.push(o.then(t=>{t.issues.length&&n.issues.push(...y(e,t.issues)),n.value[e]=t.value})):(o.issues.length&&n.issues.push(...y(e,o.issues)),n.value[e]=o.value)}let c;for(let e in i)s.has(e)||(c??=[],c.push(e));c&&c.length>0&&n.issues.push({code:`unrecognized_keys`,input:i,inst:e,keys:c})}else{n.value={};for(let o of Reflect.ownKeys(i)){if(o===`__proto__`)continue;let s=t.keyType._zod.run({value:o,issues:[]},r);if(s instanceof Promise)throw Error(`Async schemas not supported in object keys currently`);if(typeof o==`string`&&ce.test(o)&&s.issues.length){let e=t.keyType._zod.run({value:Number(o),issues:[]},r);if(e instanceof Promise)throw Error(`Async schemas not supported in object keys currently`);e.issues.length===0&&(s=e)}if(s.issues.length){t.mode===`loose`?n.value[o]=i[o]:n.issues.push({code:`invalid_key`,origin:`record`,issues:s.issues.map(e=>x(e,r,d())),input:o,path:[o],inst:e});continue}let c=t.valueType._zod.run({value:i[o],issues:[]},r);c instanceof Promise?a.push(c.then(e=>{e.issues.length&&n.issues.push(...y(o,e.issues)),n.value[s.value]=e.value})):(c.issues.length&&n.issues.push(...y(o,c.issues)),n.value[s.value]=c.value)}}return a.length?Promise.all(a).then(()=>n):n}});function k(e,t){return e.issues.length&&t===void 0?{issues:[],value:void 0}:e}const ge=c(`$ZodOptional`,(e,t)=>{D.init(e,t),e._zod.optin=`optional`,e._zod.optout=`optional`,p(e._zod,`values`,()=>t.innerType._zod.values?new Set([...t.innerType._zod.values,void 0]):void 0),p(e._zod,`pattern`,()=>{let e=t.innerType._zod.pattern;return e?RegExp(`^(${ne(e.source)})?$`):void 0}),e._zod.parse=(e,n)=>{if(t.innerType._zod.optin===`optional`){let r=t.innerType._zod.run(e,n);return r instanceof Promise?r.then(t=>k(t,e.value)):k(r,e.value)}return e.value===void 0?e:t.innerType._zod.run(e,n)}});var A,j=class{constructor(){this._map=new WeakMap,this._idmap=new Map}add(e,...t){let n=t[0];return this._map.set(e,n),n&&typeof n==`object`&&`id`in n&&this._idmap.set(n.id,e),this}clear(){return this._map=new WeakMap,this._idmap=new Map,this}remove(e){let t=this._map.get(e);return t&&typeof t==`object`&&`id`in t&&this._idmap.delete(t.id),this._map.delete(e),this}get(e){let t=e._zod.parent;if(t){let n={...this.get(t)??{}};delete n.id;let r={...n,...this._map.get(e)};return Object.keys(r).length?r:void 0}return this._map.get(e)}has(e){return this._map.has(e)}};function M(){return new j}(A=globalThis).__zod_globalRegistry??(A.__zod_globalRegistry=M()),globalThis.__zod_globalRegistry;function N(e,t){return new e({type:`string`,...g(t)})}function P(e){return new e({type:`unknown`})}const F=c(`ZodMiniType`,(e,t)=>{if(!e._zod)throw Error(`Uninitialized schema in ZodMiniType.`);D.init(e,t),e.def=t,e.type=t.type,e.parse=(t,n)=>w(e,t,n,{callee:e.parse}),e.safeParse=(t,n)=>T(e,t,n),e.parseAsync=async(t,n)=>oe(e,t,n,{callee:e.parseAsync}),e.safeParseAsync=async(t,n)=>E(e,t,n),e.check=(...n)=>e.clone({...t,checks:[...t.checks??[],...n.map(e=>typeof e==`function`?{_zod:{check:e,def:{check:`custom`},onattach:[]}}:e)]},{parent:!0}),e.with=e.check,e.clone=(t,n)=>ie(e,t,n),e.brand=()=>e,e.register=((t,n)=>(t.add(e,n),e)),e.apply=t=>t(e)}),I=c(`ZodMiniString`,(e,t)=>{ue.init(e,t),F.init(e,t)});function L(e){return N(I,e)}const _e=c(`ZodMiniUnknown`,(e,t)=>{de.init(e,t),F.init(e,t)});function ve(){return P(_e)}const ye=c(`ZodMiniObject`,(e,t)=>{me.init(e,t),F.init(e,t),p(e,`shape`,()=>t.shape)});function R(e,t){return new ye({type:`object`,shape:e??{},...g(t)})}const be=c(`ZodMiniRecord`,(e,t)=>{he.init(e,t),F.init(e,t)});function xe(e,t,n){return new be({type:`record`,keyType:e,valueType:t,...g(n)})}const Se=c(`ZodMiniOptional`,(e,t)=>{ge.init(e,t),F.init(e,t)});function Ce(e){return new Se({type:`optional`,innerType:e})}const we=R({session_id:L(),transcript_path:L(),cwd:L(),permission_mode:L(),hook_event_name:L(),tool_name:L(),tool_input:R({command:L(),description:Ce(L())})});async function Te(){let e=[];for await(let t of process.stdin)e.push(typeof t==`string`?t:String(t));let t=JSON.parse(e.join(``)),n=we.safeParse(t);return n.success||(process.stderr.write(`[bst-hook] invalid hook input: ${n.error.message}\\n`),process.exit(0)),n.data}function z(e,t){let n={hookSpecificOutput:{hookEventName:`PreToolUse`,permissionDecision:e,...e===`deny`&&t?{permissionDecisionReason:t}:{}}};process.stdout.write(JSON.stringify(n))}function Ee(){let e=i.dirname(s(import.meta.url));return i.join(e,`bst-hook.audit.local.jsonl`)}function De(t){try{if(e.statSync(t).size>1048576){let n=`${t}.1`;e.renameSync(t,n)}}catch{}}let Oe=!1;function ke(t){try{let n=Ee();Oe||=(De(n),!0);let r={timestamp:new Date().toISOString(),...t};e.appendFileSync(n,JSON.stringify(r)+`\n`)}catch(e){process.stderr.write(`[bst-hook] audit write failed: ${e instanceof Error?e.message:String(e)}\\n`)}}function B(e){let t=[],n=``,r=0,i=!1;for(;r<e.length;){let a=e[r];if(a===`'`){for(i=!0,r++;r<e.length&&e[r]!==`'`;)n+=e[r],r++;if(r>=e.length)return{ok:!1,error:`unterminated single quote`};r++}else if(a===`\"`){for(i=!0,r++;r<e.length&&e[r]!==`\"`;){if(e[r]===`\\\\`&&r+1<e.length){let t=e[r+1];if(t===`\"`||t===`\\\\`||t===`$`||t===\"`\"){n+=t,r+=2;continue}}n+=e[r],r++}if(r>=e.length)return{ok:!1,error:`unterminated double quote`};r++}else a===`\\\\`&&r+1<e.length?(i=!0,n+=e[r+1],r+=2):a===` `||a===`	`?(i&&=(t.push(n),n=``,!1),r++):(i=!0,n+=a,r++)}return i&&t.push(n),{ok:!0,tokens:t}}function Ae(e){if(!e||!e.trim())return[];let t=[],n=``,r=0,i=!1,a=!1;for(;r<e.length;){let o=e[r];if(o===`'`&&!a){i=!i,n+=o,r++;continue}if(o===`\"`&&!i){a=!a,n+=o,r++;continue}if(o===`\\\\`&&!i&&r+1<e.length){n+=o+e[r+1],r+=2;continue}if(!i&&!a){if(o===`&`&&r+1<e.length&&e[r+1]===`&`){V(t,n,`&&`),n=``,r+=2;continue}if(o===`|`&&r+1<e.length&&e[r+1]===`|`){V(t,n,`||`),n=``,r+=2;continue}if(o===`|`){V(t,n,`|`),n=``,r++;continue}if(o===`;`){V(t,n,`;`),n=``,r++;continue}}n+=o,r++}let o=n.trim();return o&&t.push({command:o,operator:null}),t}function V(e,t,n){let r=t.trim();r&&e.push({command:r,operator:n})}const H=new Set([`2>&1`,`2>/dev/null`,`>/dev/null`,`1>/dev/null`]);function je(e,t){if(/[\\n\\r]/.test(t))return{safe:!1,reason:`unquoted newline in command`};for(let t of e){if(t===\"`\")return{safe:!1,reason:`backtick command substitution`};if(t.includes(`$(`))return{safe:!1,reason:`dollar command substitution`};if(t.includes(\"`\"))return{safe:!1,reason:`backtick command substitution`};if(t.includes(`<(`)||t.includes(`>(`)&&!H.has(t))return{safe:!1,reason:`process substitution`}}for(let t=0;t<e.length;t++){let n=e[t];if(!H.has(n)){if(n.includes(`<`)&&!n.includes(`<(`))return{safe:!1,reason:`input redirect`};if(n.includes(`>`)){if(n.endsWith(`>/dev/null`)||n.match(/^(&>>|&>|>>|>|1>|2>)$/)&&e[t+1]===`/dev/null`)continue;return{safe:!1,reason:`output redirect to file`}}}}return{safe:!0}}const Me=new Set([`status`,`log`,`diff`,`show`,`branch`,`remote`,`fetch`,`rev-parse`]),Ne=new Set([`-c`,`--exec-path`,`--pager`,`--upload-pack`,`--receive-pack`]);function Pe(e){for(let t of e.slice(1))if(Ne.has(t)||t.startsWith(`--exec-path=`)||t.startsWith(`--pager=`)||t.startsWith(`--upload-pack=`)||t.startsWith(`--receive-pack=`))return!1;for(let t of e.slice(1))if(!t.startsWith(`-`)){if(t===`stash`){let t=e[e.indexOf(`stash`)+1];return t===`list`||t===void 0}return Me.has(t)}return!1}const U=new Set(`install.i.add.remove.rm.uninstall.un.update.up.upgrade.list.ls.ll.la.why.view.info.show.outdated.audit.licenses.init.create.link.unlink.pack.publish.config.set.get.store.cache.rebuild.rb.prune.dedupe.dlx.exec.run.patch.patch-commit.recursive.-r`.split(`.`)),Fe=new Set([`list`,`ls`,`ll`,`la`,`why`,`view`,`info`,`show`,`outdated`]);function Ie(e){let t=e.slice(1),n;for(let e of t)if(!(e.startsWith(`-`)&&!U.has(e))){n=e;break}return n?Fe.has(n)?!0:n===`install`||n===`i`?t.slice(t.indexOf(n)+1).every(e=>e.startsWith(`-`)):!1:!1}const Le=new Set([`view`,`info`,`show`]);function Re(e){let t=e[1];return t!==void 0&&Le.has(t)}function ze(e){let t=e[1],n=`This project uses pnpm.`;return t?t===`install`||t===`i`||t===`ci`?e.slice(2).some(e=>!e.startsWith(`-`))?`${n} Use \\`pnpm add <pkg>\\` instead of \\`npm install <pkg>\\`.`:`${n} Use \\`pnpm install\\` instead of npm.`:t===`add`?`${n} Use \\`pnpm add <pkg>\\` instead of npm.`:t===`uninstall`||t===`remove`||t===`rm`||t===`un`||t===`r`?`${n} Use \\`pnpm remove <pkg>\\` instead of npm.`:t===`run`||t===`run-script`?`${n} Use \\`pnpm run <script>\\` or \\`pnpm <script>\\` instead of npm.`:t===`test`||t===`t`||t===`tst`?`${n} Use \\`pnpm test\\` instead of npm.`:t===`start`?`${n} Use \\`pnpm start\\` instead of npm.`:t===`stop`?`${n} Use \\`pnpm stop\\` instead of npm.`:t===`restart`?`${n} Use \\`pnpm restart\\` instead of npm.`:t===`exec`?`${n} Use \\`pnpm exec <cmd>\\` instead of npm.`:t===`list`||t===`ls`||t===`ll`||t===`la`?`${n} Use \\`pnpm list\\` instead of npm.`:t===`why`?`${n} Use \\`pnpm why\\` instead of npm.`:t===`outdated`?`${n} Use \\`pnpm outdated\\` instead of npm.`:t===`audit`?`${n} Use \\`pnpm audit\\` instead of npm.`:t===`update`||t===`up`||t===`upgrade`?`${n} Use \\`pnpm update\\` instead of npm.`:t===`init`?`${n} Use \\`pnpm init\\` instead of npm.`:t===`publish`?`${n} Use \\`pnpm publish\\` instead of npm.`:t===`link`?`${n} Use \\`pnpm link\\` instead of npm.`:t===`unlink`?`${n} Use \\`pnpm unlink\\` instead of npm.`:t===`pack`?`${n} Use \\`pnpm pack\\` instead of npm.`:t===`cache`?`${n} Use \\`pnpm store\\` instead of \\`npm cache\\`.`:t===`config`||t===`set`||t===`get`?`${n} Use \\`pnpm config\\` instead of npm.`:`${n} Use the equivalent pnpm command instead of npm.`:`${n} Use \\`pnpm\\` instead of npm.`}function W(e,t){for(let n of e.slice(1)){if(n.startsWith(`-`))continue;if(i.basename(n).startsWith(`.`)||n.startsWith(`~/`)||n===`~`)return!1;let e=i.resolve(t.cwd,n);if(e!==t.cwd&&!e.startsWith(t.cwd+i.sep))return!1}return!0}const Be=new Set([`-exec`,`-execdir`,`-ok`,`-delete`]);function Ve(e){return!e.some(e=>Be.has(e))}function He(e){return!e.includes(`-o`)&&!e.some(e=>e.startsWith(`--output`))}function Ue(e){let t=e.findIndex(e=>i.basename(e)===`rm`);if(t===-1)return!1;let n=e.slice(t+1),r=n.filter(e=>e.startsWith(`-`)&&!e.startsWith(`--`)),a=n.filter(e=>e.startsWith(`--`)),o=r.some(e=>/[rR]/.test(e)),s=a.includes(`--recursive`);return o||s}function We(e){return e.some(e=>e===`777`||e===`0777`)}const Ge=/(^|[/\\\\])(\\.env(\\..*)?|.*\\.env(\\..*)?|\\.env)$/;function G(e){return e.slice(1).some(e=>!e.startsWith(`-`)&&Ge.test(e))}function Ke(e){let t=e.indexOf(`push`);if(t===-1)return!1;let n=e.slice(t+1);return n.some(e=>e===`--force`||e===`-f`&&!n.includes(`--force-with-lease`))}function qe(e){if(!(e.includes(`reset`)&&e.includes(`--hard`)))return!1;if(e.some(e=>e===`main`||e===`master`))return!0;let t=e.filter(e=>e!==`git`&&e!==`reset`&&!e.startsWith(`-`));return t.length===0||t.includes(`HEAD`)}const Je=[{name:`rm-recursive`,match:/^rm$/,action:`deny`,when:e=>Ue(e),reason:\"Don't use recursive `rm`. Use more targeted deletes, or remove specific files/directories.\"},{name:`sudo`,match:/^sudo$/,action:`deny`,reason:`Don't use sudo. If you need elevated permissions, ask me to do it manually.`},{name:`git-force-push`,match:/^git$/,action:`deny`,when:e=>Ke(e),reason:\"Use `git push --force-with-lease` instead of `--force`.\"},{name:`git-reset-hard`,match:/^git$/,action:`deny`,when:e=>qe(e),reason:\"Don't `reset --hard` on main. Create a branch first.\"},{name:`chmod-777`,match:/^chmod$/,action:`deny`,when:e=>We(e),reason:`Don't use 777 permissions. Use more restrictive permissions.`},{name:`env-file-cat`,match:/^cat$/,action:`deny`,when:e=>G(e),reason:`Don't read .env files. These contain secrets that should not appear in the conversation.`},{name:`env-file-head`,match:/^head$/,action:`deny`,when:e=>G(e),reason:`Don't read .env files. These contain secrets that should not appear in the conversation.`},{name:`env-file-tail`,match:/^tail$/,action:`deny`,when:e=>G(e),reason:`Don't read .env files. These contain secrets that should not appear in the conversation.`},{name:`env-file-less`,match:/^less$/,action:`deny`,when:e=>G(e),reason:`Don't read .env files. These contain secrets that should not appear in the conversation.`},{name:`env-file-more`,match:/^more$/,action:`deny`,when:e=>G(e),reason:`Don't read .env files. These contain secrets that should not appear in the conversation.`},{name:`env-file-grep`,match:/^grep$/,action:`deny`,when:e=>G(e),reason:`Don't read .env files. These contain secrets that should not appear in the conversation.`},{name:`npx-redirect`,match:/^npx$/,action:`deny`,reason:\"This project uses pnpm. Use `pnpm dlx <pkg>` or `pnpm exec <cmd>` instead of npx.\"}],K=[{name:`vitest`,match:/^vitest$/,action:`allow`},{name:`jest`,match:/^jest$/,action:`allow`},{name:`tsc`,match:/^tsc$/,action:`allow`},{name:`tsdown`,match:/^tsdown$/,action:`allow`},{name:`oxlint`,match:/^oxlint$/,action:`allow`},{name:`oxfmt`,match:/^oxfmt$/,action:`allow`},{name:`eslint`,match:/^eslint$/,action:`allow`},{name:`prettier`,match:/^prettier$/,action:`allow`},{name:`biome`,match:/^biome$/,action:`allow`},{name:`knip`,match:/^knip$/,action:`allow`},{name:`cat`,match:/^cat$/,action:`allow`},{name:`head`,match:/^head$/,action:`allow`},{name:`tail`,match:/^tail$/,action:`allow`},{name:`grep`,match:/^grep$/,action:`allow`},{name:`ls`,match:/^ls$/,action:`allow`},{name:`wc`,match:/^wc$/,action:`allow`},{name:`uniq`,match:/^uniq$/,action:`allow`},{name:`diff`,match:/^diff$/,action:`allow`},{name:`echo`,match:/^echo$/,action:`allow`},{name:`pwd`,match:/^pwd$/,action:`allow`},{name:`which`,match:/^which$/,action:`allow`},{name:`dirname`,match:/^dirname$/,action:`allow`},{name:`basename`,match:/^basename$/,action:`allow`},{name:`realpath`,match:/^realpath$/,action:`allow`},{name:`npm`,match:/^npm$/,action:`allow`,when:e=>Re(e)},{name:`cd`,match:/^cd$/,action:`allow`},{name:`true`,match:/^true$/,action:`allow`},{name:`colon`,match:/^:$/,action:`allow`},{name:`find`,match:/^find$/,action:`allow`,when:e=>Ve(e)},{name:`sort`,match:/^sort$/,action:`allow`,when:e=>He(e)},{name:`git`,match:/^git$/,action:`allow`,when:e=>Pe(e)},{name:`pnpm`,match:/^pnpm$/,action:`allow`,when:e=>Ie(e)},{name:`cp`,match:/^cp$/,action:`allow`,when:(e,t)=>W(e,t)},{name:`mkdir`,match:/^mkdir$/,action:`allow`,when:(e,t)=>W(e,t)},{name:`touch`,match:/^touch$/,action:`allow`,when:(e,t)=>W(e,t)}],Ye=R({scripts:xe(L(),ve())});function q(e,t){let n=et(t);if(!n)return null;let r=n[e];if(typeof r!=`string`)return null;let i=n[`pre${e}`],a=n[`post${e}`];return{pre:typeof i==`string`?i:null,main:r,post:typeof a==`string`?a:null}}function Xe(e,t,n){let r=Ze(t,n);if(!r)return null;let i=q(e,r);return i?{...i,pkgDir:r}:null}function Ze(e,t){let i=Qe(t);if(!i)return null;for(let s of i){if(!s.endsWith(`/*`))continue;let i=o(t,s.slice(0,-2)),c;try{c=n(i)}catch{continue}for(let t of c){let n=a(i,t);try{if(!r(n).isDirectory())continue}catch{continue}let o=J(n);if(o===e||o===`@${e}`||t===e||o&&(o.startsWith(`@`)?o.split(`/`)[1]:o)===e)return n}}return null}function Qe(e){try{let n=t(a(e,`pnpm-workspace.yaml`),`utf-8`).split(`\n`),r=n.findIndex(e=>/^packages\\s*:/.test(e));if(r===-1)return null;let i=[];for(let e=r+1;e<n.length;e++){let t=n[e],r=/^\\s+-\\s+(.+)$/.exec(t);if(!r)break;i.push(r[1].trim().replace(/['\"`]/g,``))}return i.length>0?i:null}catch{return null}}const $e=R({name:L()});function J(e){try{let n=t(a(e,`package.json`),`utf-8`),r=$e.safeParse(JSON.parse(n));return r.success?r.data.name:null}catch{return null}}function et(e){try{let n=t(a(e,`package.json`),`utf-8`),r=Ye.safeParse(JSON.parse(n));return r.success?r.data.scripts:null}catch{return null}}const tt=new Set([`LD_PRELOAD`,`LD_LIBRARY_PATH`,`DYLD_INSERT_LIBRARIES`,`NODE_OPTIONS`,`PYTHONPATH`,`PYTHONSTARTUP`,`PERL5OPT`,`PERL5LIB`,`RUBYOPT`,`RUBYLIB`,`BASH_ENV`,`ENV`,`npm_config_prefix`,`npm_config_registry`,`EDITOR`,`VISUAL`]),nt=[`GIT_CONFIG_`,`GIT_PAGER`,`GIT_SSH_COMMAND`,`GIT_EDITOR`,`GIT_EXEC_PATH`];function Y(e){return tt.has(e)?!0:nt.some(t=>e.startsWith(t))}function rt(e,t){let n=B(e);if(!n.ok||n.tokens.length!==2)return null;let r=n.tokens;if(r[0]!==`cd`)return null;let a=r[1];return i.isAbsolute(a)?a:i.resolve(t.cwd,a)}function X(e,t){if(t.depth>=5)return{action:`passthrough`,rule:null,reason:`max evaluation depth exceeded`};let n=e.trim();if(!n)return{action:`passthrough`,rule:null,reason:null};if(n.startsWith(`(`)&&n.endsWith(`)`))return{action:`passthrough`,rule:null,reason:`subshell`};let r=Ae(n);if(r.length===0)return{action:`passthrough`,rule:null,reason:null};let i=null,a=null,o=t;for(let e of r){if(e.operator===`&&`){let t=rt(e.command,o);t&&(o={...o,cwd:t})}let t=it(e.command,o);if(t.action===`deny`)return t;t.action===`passthrough`&&(i||=t),t.action===`allow`&&(a=t)}return i||(r.length===1&&a?a:{action:`allow`,rule:`all-segments`,reason:null})}function it(e,t){let n=e.trim();if(n.startsWith(`(`)&&n.endsWith(`)`))return{action:`passthrough`,rule:null,reason:`subshell`};let r=B(e);if(!r.ok)return{action:`passthrough`,rule:null,reason:r.error};let a=r.tokens;if(a.length===0)return{action:`passthrough`,rule:null,reason:null};let o=0;for(;o<a.length&&/^\\w+=/.test(a[o]);){let e=a[o].split(`=`)[0];if(Y(e))return{action:`passthrough`,rule:null,reason:`dangerous env var: ${e}`};o++}if(o>=a.length)return{action:`allow`,rule:`env-only`,reason:null};a=a.slice(o);let s=je(a,e);if(!s.safe)return{action:`passthrough`,rule:null,reason:s.reason};for(let e=0;e<a.length;e++){let t=a[e];if(!(t===`2>&1`||t===`2>/dev/null`||t===`>/dev/null`||t===`1>/dev/null`)){if(t===`>`||t===`>>`){if(a[e+1]===`/dev/null`)continue;return{action:`passthrough`,rule:null,reason:`output redirect to file`}}if(t===`<`)return{action:`passthrough`,rule:null,reason:`input redirect`}}}let c=i.basename(a[0]);if(c===`command`&&a.length>1)return X(a.slice(1).join(` `),{...t,depth:t.depth+1});if(c===`env`){let e=1;for(;e<a.length&&/^\\w+=/.test(a[e]);){let t=a[e].split(`=`)[0];if(Y(t))return{action:`passthrough`,rule:null,reason:`dangerous env var: ${t}`};e++}return e>=a.length?{action:`allow`,rule:`env-only`,reason:null}:X(a.slice(e).join(` `),{...t,depth:t.depth+1})}if(c===`pnpm`)return at(a,t);if(c===`npm`)return ot(a);if(c===`bash`||c===`sh`||c===`zsh`)return lt(a,t);if(c===`node`&&(a.includes(`-e`)||a.includes(`-p`)||a.includes(`--eval`)||a.includes(`--print`)))return{action:`passthrough`,rule:null,reason:`node eval`};if(c===`mv`)return{action:`passthrough`,rule:null,reason:`mv`};for(let e of Je)if(e.match.test(c)&&(!e.when||e.when(a,t)))return{action:`deny`,rule:e.name,reason:e.reason??null};for(let e of K)if(e.match.test(c)&&(!e.when||e.when(a,t)))return{action:`allow`,rule:e.name,reason:null};return{action:`passthrough`,rule:null,reason:null}}function at(e,t){let n=e.slice(1),r,i=-1;for(let a=0;a<n.length;a++){let o=n[a];if(o===`--filter`||o.startsWith(`--filter=`))return st(e,n,a,t);if(o===`-r`||o===`--recursive`)return{action:`passthrough`,rule:null,reason:`pnpm recursive`};if(!(o.startsWith(`-`)&&!U.has(o))){r=o,i=a;break}}if(!r)return{action:`passthrough`,rule:null,reason:null};if(r===`dlx`)return{action:`passthrough`,rule:null,reason:`pnpm dlx`};if(r===`add`)return{action:`passthrough`,rule:null,reason:`pnpm add`};if(r===`exec`){let e=n.slice(i+1);return e.length===0?{action:`passthrough`,rule:null,reason:`bare pnpm exec`}:X(e.join(` `),{...t,depth:t.depth+1})}if(r===`run`){let e=n[i+1];return!e||e.startsWith(`-`)?{action:`passthrough`,rule:null,reason:`pnpm run without script name`}:Z(e,t)}if(U.has(r)){for(let n of K)if(n.match.test(`pnpm`)&&(!n.when||n.when(e,t)))return{action:`allow`,rule:n.name,reason:null};return{action:`passthrough`,rule:null,reason:null}}return Z(r,t)}function Z(e,t){let n=q(e,t.cwd);if(!n)return{action:`passthrough`,rule:null,reason:`script resolution failed`};let r={...t,depth:t.depth+1};if(n.pre){let e=X(n.pre,r);if(e.action!==`allow`)return e}let i=X(n.main,r);if(i.action!==`allow`)return i;if(n.post){let e=X(n.post,r);if(e.action!==`allow`)return e}return{action:`allow`,rule:`pnpm-script:${e}`,reason:null}}function ot(e){for(let t of K)if(t.match.test(`npm`)&&(!t.when||t.when(e,{cwd:``,depth:0})))return{action:`allow`,rule:t.name,reason:null};return{action:`deny`,rule:`npm-redirect`,reason:ze(e)}}function st(e,t,n,r){let i=t[n],a,o;if(i.startsWith(`--filter=`))a=i.slice(9),o=n+1;else{if(a=t[n+1],!a||a.startsWith(`-`))return{action:`passthrough`,rule:null,reason:`pnpm --filter without package`};o=n+2}if(!a)return{action:`passthrough`,rule:null,reason:`pnpm --filter without package`};let s;for(let e=o;e<t.length;e++){let n=t[e];if(!(n.startsWith(`-`)&&!U.has(n))){s=n;break}}if(!s)return{action:`passthrough`,rule:null,reason:`pnpm --filter without subcommand`};if(s===`install`||s===`i`)return t.slice(t.indexOf(s)+1).every(e=>e.startsWith(`-`))?{action:`allow`,rule:`pnpm`,reason:null}:{action:`passthrough`,rule:null,reason:`pnpm --filter install with package arg`};if(s===`dlx`)return{action:`passthrough`,rule:null,reason:`pnpm dlx`};if(s===`add`)return{action:`passthrough`,rule:null,reason:`pnpm add`};if(new Set([`list`,`ls`,`ll`,`la`,`why`,`view`,`info`,`show`,`outdated`,`licenses`,`audit`]).has(s))return{action:`allow`,rule:`pnpm`,reason:null};if(s===`exec`){let e=t.indexOf(`exec`,o),n=t.slice(e+1);return n.length===0?{action:`passthrough`,rule:null,reason:`bare pnpm exec`}:X(n.join(` `),{...r,depth:r.depth+1})}let c=s===`run`?t[t.indexOf(`run`,o)+1]:s;if(!c||c.startsWith(`-`))return{action:`passthrough`,rule:null,reason:`pnpm --filter run without script name`};if(U.has(c)&&c!==`run`)return{action:`passthrough`,rule:null,reason:null};let l=Xe(c,a,r.cwd);if(!l)return{action:`passthrough`,rule:null,reason:`filtered script resolution failed`};let u={...r,depth:r.depth+1,cwd:l.pkgDir??r.cwd};if(l.pre){let e=X(l.pre,u);if(e.action!==`allow`)return e}let d=X(l.main,u);if(d.action!==`allow`)return d;if(l.post){let e=X(l.post,u);if(e.action!==`allow`)return e}return{action:`allow`,rule:`pnpm-filter:${a}:${c}`,reason:null}}const ct=new Set([`-i`,`--interactive`,`-l`,`--login`,`--init-file`,`--rcfile`,`--norc`,`--noprofile`,`-s`,`--stdin`]);function lt(e,t){let n=e.indexOf(`-c`);if(n===-1)return{action:`passthrough`,rule:null,reason:`shell without -c`};for(let t=1;t<e.length;t++){if(t===n||t===n+1)continue;let r=e[t];if(r.startsWith(`-`)||ct.has(r))return{action:`passthrough`,rule:null,reason:`shell -c with extra flags`}}let r=e[n+1];return r?e.length>n+2?{action:`passthrough`,rule:null,reason:`shell -c with positional args`}:n===1?X(r,{...t,depth:t.depth+1}):{action:`passthrough`,rule:null,reason:`shell -c with extra flags`}:{action:`passthrough`,rule:null,reason:`shell -c without command`}}const Q=await Te();(Q.hook_event_name!==`PreToolUse`||Q.tool_name!==`Bash`)&&process.exit(0);const $=X(Q.tool_input.command,{cwd:Q.cwd,depth:0});ke({sessionId:Q.session_id,command:Q.tool_input.command,decision:$.action,rule:$.rule,reason:$.reason}),$.action===`allow`?z(`allow`):$.action===`deny`&&z(`deny`,$.reason);export{};";
+	const existing = ctx.read(HOOK_PATH);
+	if (existing === content) return {
+		filePath: HOOK_PATH,
+		action: "skipped",
+		description: "Hook is up to date"
+	};
+	ctx.write(HOOK_PATH, content);
+	return {
+		filePath: HOOK_PATH,
+		action: existing ? "updated" : "created",
+		description: existing ? "Updated bst-hook.mjs" : "Generated bst-hook.mjs"
+	};
+}
+//#endregion
 //#region src/generators/claude-settings.ts
+const HookEntrySchema = z.object({
+	type: z.string(),
+	command: z.string()
+});
+const HookMatcherSchema = z.object({
+	matcher: z.string(),
+	hooks: z.array(HookEntrySchema).default([])
+});
 const ClaudeSettingsSchema = z.object({
 	permissions: z.object({
 		allow: z.array(z.string()).default([]),
@@ -2305,6 +2395,7 @@ const ClaudeSettingsSchema = z.object({
 		allow: [],
 		deny: []
 	}),
+	hooks: z.record(z.string(), z.array(HookMatcherSchema)).default({}),
 	instructions: z.array(z.string()).default([]),
 	enabledPlugins: z.record(z.string(), z.boolean()).default({}),
 	extraKnownMarketplaces: z.record(z.string(), z.record(z.string(), z.unknown())).default({})
@@ -2326,64 +2417,11 @@ function parseClaudeSettings(raw) {
 function buildSettings(ctx) {
 	const pm = "pnpm";
 	const allow = [
-		`Bash(${pm} install)`,
-		`Bash(${pm} install *)`,
-		`Bash(${pm} add *)`,
-		`Bash(${pm} update *)`,
-		`Bash(${pm} view *)`,
-		`Bash(${pm} why *)`,
-		`Bash(${pm} list)`,
-		`Bash(${pm} list *)`,
-		`Bash(${pm} ls)`,
-		`Bash(${pm} ls *)`,
-		"Bash(npm view *)",
-		"Bash(npm info *)",
-		"Bash(npm show *)",
-		`Bash(${pm} build)`,
-		`Bash(${pm} -r build)`,
-		`Bash(${pm} dev)`,
-		`Bash(${pm} test)`,
-		`Bash(${pm} test *)`,
-		`Bash(${pm} -r test)`,
-		`Bash(${pm} vitest)`,
-		`Bash(${pm} vitest *)`,
-		`Bash(${pm} exec vitest)`,
-		`Bash(${pm} exec vitest *)`,
-		`Bash(${pm} exec oxfmt)`,
-		`Bash(${pm} exec oxfmt *)`,
-		`Bash(${pm} typecheck)`,
-		`Bash(${pm} -r --parallel run typecheck)`,
-		`Bash(${pm} tsc *)`,
-		`Bash(${pm} exec tsc *)`,
-		`Bash(${pm} lint)`,
-		`Bash(${pm} lint *)`,
-		`Bash(${pm} format)`,
-		`Bash(${pm} format *)`,
-		`Bash(${pm} knip)`,
-		`Bash(${pm} knip *)`,
-		`Bash(${pm} check)`,
-		`Bash(${pm} ci:check)`,
-		`Bash(${pm} exec oxlint *)`,
-		`Bash(${pm} exec knip *)`,
-		"Bash(git status *)",
-		"Bash(git log *)",
-		"Bash(git diff *)",
-		"Bash(git branch *)",
-		"Bash(git show *)",
-		"Bash(git rev-parse *)",
-		"Bash(ls *)",
-		"Bash(cat *)",
-		"Bash(head *)",
-		"Bash(tail *)",
-		"Bash(wc *)",
 		"Bash(test *)",
 		"Bash([ *)",
-		"Bash(grep *)",
-		"Bash(which *)",
-		"Bash(node -e *)",
-		"Bash(node -p *)"
+		"Bash(git -C * diff HEAD -- *)"
 	];
-	if (ctx.config.structure === "monorepo") allow.push(`Bash(${pm} --filter *)`, `Bash(${pm} -r *)`);
+	if (ctx.config.structure === "monorepo") allow.push(`Bash(${pm} -r *)`);
 	const enabledPlugins = { "code-simplifier@claude-plugins-official": true };
 	const extraKnownMarketplaces = {};
 	if (ctx.config.structure !== "monorepo") {
@@ -2393,7 +2431,6 @@ function buildSettings(ctx) {
 		permissions: {
 			allow,
 			deny: [
-				"Bash(npx *)",
 				"Bash(git push *)",
 				"Bash(git push)",
 				"Bash(git add *)",
@@ -2412,35 +2449,19 @@ function buildSettings(ctx) {
 				"Bash(git clean *)",
 				"Bash(git rm *)",
 				"Bash(git mv *)",
-				"Bash(rm -rf *)",
-				"Bash(cat *.env)",
-				"Bash(cat *.env.*)",
-				"Bash(cat .env)",
-				"Bash(cat .env.*)",
-				"Bash(head *.env)",
-				"Bash(head *.env.*)",
-				"Bash(head .env)",
-				"Bash(head .env.*)",
-				"Bash(tail *.env)",
-				"Bash(tail *.env.*)",
-				"Bash(tail .env)",
-				"Bash(tail .env.*)",
-				"Bash(less *.env)",
-				"Bash(less *.env.*)",
-				"Bash(less .env)",
-				"Bash(less .env.*)",
-				"Bash(more *.env)",
-				"Bash(more *.env.*)",
-				"Bash(more .env)",
-				"Bash(more .env.*)",
-				"Bash(grep * .env)",
-				"Bash(grep * .env.*)",
 				"Read(.env)",
 				"Read(.env.*)",
 				"Read(*.env)",
 				"Read(*.env.*)"
 			]
 		},
+		hooks: { PreToolUse: [{
+			matcher: "Bash",
+			hooks: [{
+				type: "command",
+				command: `node "$CLAUDE_PROJECT_DIR/.claude/hooks/bst-hook.mjs"`
+			}]
+		}] },
 		instructions: [
 			"Use pnpm, not npm/yarn/npx. Run binaries with `pnpm exec`.",
 			"No typecasts (as/any). Use zod schemas, type guards, or narrowing instead.",
@@ -2451,10 +2472,16 @@ function buildSettings(ctx) {
 		extraKnownMarketplaces
 	};
 }
-/** Remove enabledPlugins/extraKnownMarketplaces when empty to keep the file clean. */
+const BST_HOOK_MARKER = "bst-hook.mjs";
+/** Check if a hook entry list already contains the bst-hook command. */
+function hasBstHook(matchers) {
+	return matchers.some((m) => m.matcher === "Bash" && m.hooks.some((h) => h.command.includes(BST_HOOK_MARKER)));
+}
+/** Remove enabledPlugins/extraKnownMarketplaces/hooks when empty to keep the file clean. */
 function serializeSettings$1(settings) {
-	const { enabledPlugins, extraKnownMarketplaces, ...rest } = settings;
+	const { enabledPlugins, extraKnownMarketplaces, hooks, ...rest } = settings;
 	const out = { ...rest };
+	if (Object.keys(hooks).length > 0) out["hooks"] = hooks;
 	if (Object.keys(enabledPlugins).length > 0) out["enabledPlugins"] = enabledPlugins;
 	if (Object.keys(extraKnownMarketplaces).length > 0) out["extraKnownMarketplaces"] = extraKnownMarketplaces;
 	return JSON.stringify(out, null, 2) + "\n";
@@ -2480,9 +2507,18 @@ function writeOrMergeSettings(ctx, filePath, generated) {
 			else mergedInstructions.push(inst);
 			instructionChanges++;
 		}
+		let hookChanges = 0;
+		const mergedHooks = { ...settings.hooks };
+		for (const [event, generatedMatchers] of Object.entries(generated.hooks)) {
+			const existingMatchers = mergedHooks[event] ?? [];
+			if (!hasBstHook(existingMatchers)) {
+				mergedHooks[event] = [...existingMatchers, ...generatedMatchers];
+				hookChanges++;
+			}
+		}
 		const missingPlugins = Object.entries(generated.enabledPlugins).filter(([key]) => !(key in settings.enabledPlugins));
 		const missingMarketplaces = Object.entries(generated.extraKnownMarketplaces).filter(([key]) => !(key in settings.extraKnownMarketplaces));
-		const changed = missingAllow.length + missingDeny.length + instructionChanges + missingPlugins.length + missingMarketplaces.length;
+		const changed = missingAllow.length + missingDeny.length + hookChanges + instructionChanges + missingPlugins.length + missingMarketplaces.length;
 		if (changed === 0) return {
 			filePath,
 			action: "skipped",
@@ -2492,6 +2528,7 @@ function writeOrMergeSettings(ctx, filePath, generated) {
 			allow: [...settings.permissions.allow, ...missingAllow],
 			deny: [...settings.permissions.deny, ...missingDeny]
 		};
+		if (Object.keys(mergedHooks).length > 0) rawJson["hooks"] = mergedHooks;
 		rawJson["instructions"] = mergedInstructions;
 		const updatedPlugins = { ...settings.enabledPlugins };
 		for (const [key, value] of missingPlugins) updatedPlugins[key] = value;
@@ -2527,6 +2564,7 @@ async function generateClaudeSettings(ctx) {
 				allow: [],
 				deny: []
 			},
+			hooks: {},
 			instructions: [],
 			enabledPlugins: { "frontend-design@claude-plugins-official": true },
 			extraKnownMarketplaces: {}
@@ -2690,7 +2728,19 @@ function simpleReleaseCommand() {
 		"pnpm exec bst release:simple $FLAGS"
 	].join("\n");
 }
-function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker) {
+/** Build the docker publish env block, omitting registry vars when derivable at runtime. */
+function dockerPublishEnv(registryDerivable) {
+	return {
+		...registryDerivable ? {} : {
+			DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
+			DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE")
+		},
+		DOCKER_USERNAME: actionsExpr("secrets.DOCKER_USERNAME"),
+		DOCKER_PASSWORD: actionsExpr("secrets.DOCKER_PASSWORD"),
+		RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
+	};
+}
+function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable) {
 	const releaseStep = { step: {
 		name: "Release",
 		env: {
@@ -2706,13 +2756,7 @@ function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker) {
 	const dockerStep = { step: {
 		name: "Publish Docker images",
 		if: "success()",
-		env: {
-			DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
-			DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE"),
-			DOCKER_USERNAME: actionsExpr("secrets.DOCKER_USERNAME"),
-			DOCKER_PASSWORD: actionsExpr("secrets.DOCKER_PASSWORD"),
-			RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
-		},
+		env: dockerPublishEnv(registryDerivable),
 		run: "pnpm exec bst docker:publish"
 	} };
 	return [
@@ -2721,10 +2765,10 @@ function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker) {
 		...hasDocker ? [dockerStep] : []
 	];
 }
-function buildSteps(strategy, ci, nodeVersionYaml, publishesNpm, hasDocker) {
+function buildSteps(strategy, ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable) {
 	switch (strategy) {
 		case "release-it": return releaseItSteps(ci, nodeVersionYaml, publishesNpm);
-		case "simple": return simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker);
+		case "simple": return simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable);
 		default: return null;
 	}
 }
@@ -2745,7 +2789,8 @@ async function generateReleaseCi(ctx) {
 	const workflowPath = isGitHub ? ".github/workflows/release.yml" : ".forgejo/workflows/release.yml";
 	const nodeVersionYaml = computeNodeVersionYaml(ctx);
 	const hasDocker = hasDockerPackages(ctx);
-	const steps = buildSteps(ctx.config.releaseStrategy, ctx.config.ci, nodeVersionYaml, publishesNpm, hasDocker);
+	const registryDerivable = hasRepositoryUrl(ctx);
+	const steps = buildSteps(ctx.config.releaseStrategy, ctx.config.ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable);
 	if (!steps) return {
 		filePath,
 		action: "skipped",
@@ -3120,6 +3165,7 @@ async function runGenerators(ctx) {
 	results.push(await generateKnip(ctx));
 	results.push(await generateRenovate(ctx));
 	results.push(await generateCi(ctx));
+	results.push(await generateClaudeHooks(ctx));
 	results.push(...await generateClaudeSettings(ctx));
 	results.push(await generateReleaseIt(ctx));
 	results.push(await generateVersionrc(ctx));
@@ -3140,112 +3186,116 @@ async function runGenerators(ctx) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push("# Migration Prompt");
-	sections.push("");
-	sections.push(`_Generated by \`@bensandee/tooling@0.37.0 repo:sync\` on ${timestamp}_`);
-	sections.push("");
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.39.0 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
-		sections.push("## Files changed");
-		sections.push("");
-		for (const r of changed) {
+		const items = changed.map((r) => {
 			const label = r.action === "archived" ? "archived" : r.action;
-			sections.push(`- \`${r.filePath}\` (${label}) — ${r.description}`);
-		}
-		sections.push("");
+			return `- \`${r.filePath}\` (${label}) — ${r.description}`;
+		}).join("\n");
+		sections.push(`## Files changed\n\n${items}\n`);
 	}
 	const tasks = [];
-	const legacyToRemove = detected.legacyConfigs.filter((legacy) => !(legacy.tool === "prettier" && config.formatter === "prettier"));
-	if (legacyToRemove.length > 0) {
-		tasks.push("### Remove legacy tooling");
-		tasks.push("");
-		for (const legacy of legacyToRemove) {
-			const replacement = {
-				eslint: "oxlint",
-				prettier: "oxfmt",
-				jest: "vitest",
-				webpack: "tsdown",
-				rollup: "tsdown"
-			}[legacy.tool];
-			tasks.push(`- Remove ${legacy.tool} config files (${legacy.files.map((f) => `\`${f}\``).join(", ")}). This project now uses **${replacement}**.`);
-			tasks.push(`  - Uninstall ${legacy.tool}-related packages from devDependencies`);
-			if (legacy.tool === "eslint") tasks.push("  - Migrate any custom ESLint rules that don't have oxlint equivalents");
-			if (legacy.tool === "jest") tasks.push("  - Migrate jest-specific test utilities (jest.mock, jest.fn) to vitest equivalents (vi.mock, vi.fn)");
-		}
-		tasks.push("");
+	addLegacyToolingTasks(tasks, config, detected);
+	addArchivedFileTasks(tasks, results);
+	addOxlintTasks(tasks, results, detected);
+	addMonorepoTasks(tasks, config, detected);
+	addTestGenerationTasks(tasks, results);
+	if (tasks.length > 0) {
+		sections.push(`## Migration tasks\n\n${tasks.join("\n")}`);
+		sections.push(`## Ground rules
+
+Prefer fixing root causes over suppressing issues:
+
+- **Lint errors**: fix the code, not disable comments
+- **Type errors**: add proper types, not \`any\` or \`@ts-expect-error\`
+- **Test failures**: fix the test or bug, don't skip/delete
+- **Knip findings**: remove unused code, don't add ignores
+
+It is OK to add new packages (e.g. \`zod\`, \`@bensandee/common\`) to resolve errors. Only suppress an issue with a comment explaining why the fix is not feasible.
+`);
 	}
+	sections.push(`## Verify
+
+Run \`pnpm check\` and fix any errors. This runs the full pipeline:
+build → typecheck → lint → test → format → knip
+
+When everything passes, run \`/init\` to generate a \`CLAUDE.md\` for this repository.
+`);
+	return sections.join("\n");
+}
+const LEGACY_REPLACEMENTS = {
+	eslint: "oxlint",
+	prettier: "oxfmt",
+	jest: "vitest",
+	webpack: "tsdown",
+	rollup: "tsdown"
+};
+function addLegacyToolingTasks(tasks, config, detected) {
+	const legacyToRemove = detected.legacyConfigs.filter((legacy) => !(legacy.tool === "prettier" && config.formatter === "prettier"));
+	if (legacyToRemove.length === 0) return;
+	const items = legacyToRemove.map((legacy) => {
+		const replacement = LEGACY_REPLACEMENTS[legacy.tool];
+		const files = legacy.files.map((f) => `\`${f}\``).join(", ");
+		const lines = [`- Remove ${legacy.tool} config files (${files}). This project now uses **${replacement}**.`, `  - Uninstall ${legacy.tool}-related packages from devDependencies`];
+		if (legacy.tool === "eslint") lines.push("  - Migrate any custom ESLint rules that don't have oxlint equivalents");
+		if (legacy.tool === "jest") lines.push("  - Migrate jest-specific test utilities (jest.mock, jest.fn) to vitest equivalents (vi.mock, vi.fn)");
+		return lines.join("\n");
+	});
+	tasks.push(`### Remove legacy tooling\n\n${items.join("\n")}\n`);
+}
+function addArchivedFileTasks(tasks, results) {
 	const archived = results.filter((r) => r.action === "archived");
-	if (archived.length > 0) {
-		tasks.push("### Review archived files");
-		tasks.push("");
-		tasks.push("The originals have been saved to `.tooling-archived/`. For each, diff the old version against the new one and port any capabilities the new file lacks:");
-		tasks.push("");
-		for (const r of archived) tasks.push(`- \`${r.filePath}\` → \`.tooling-archived/${r.filePath}\``);
-		tasks.push("");
-		tasks.push("If the project previously used `husky` and `lint-staged`, remove them from `devDependencies`. Delete `.tooling-archived/` when done.");
-		tasks.push("");
-	}
-	const oxlintWasSkipped = results.find((r) => r.filePath === "oxlint.config.ts")?.action === "skipped";
+	if (archived.length === 0) return;
+	const items = archived.map((r) => `- \`${r.filePath}\` → \`.tooling-archived/${r.filePath}\``).join("\n");
+	tasks.push(`### Review archived files
+
+The originals have been saved to \`.tooling-archived/\`. For each, diff the old version against the new one and port any capabilities the new file lacks:
+
+${items}
+
+Delete \`.tooling-archived/\` when done.
+`);
+}
+function addOxlintTasks(tasks, results, detected) {
 	if (detected.hasLegacyOxlintJson) {
-		tasks.push("### Migrate .oxlintrc.json to oxlint.config.ts");
-		tasks.push("");
-		tasks.push("Compare `.oxlintrc.json` rules against `@bensandee/config/oxlint/recommended`. Port any custom rules/overrides into `oxlint.config.ts`, then delete `.oxlintrc.json`.");
-		tasks.push("");
-	} else if (oxlintWasSkipped && detected.hasOxlintConfig) {
-		tasks.push("### Verify oxlint.config.ts extends recommended rules");
-		tasks.push("");
-		tasks.push("Ensure `oxlint.config.ts` imports and extends `@bensandee/config/oxlint/recommended`:");
-		tasks.push("");
-		tasks.push("```ts");
-		tasks.push("import recommended from \"@bensandee/config/oxlint/recommended\";");
-		tasks.push("import { defineConfig } from \"oxlint\";");
-		tasks.push("");
-		tasks.push("export default defineConfig({ extends: [recommended] });");
-		tasks.push("```");
-		tasks.push("");
-	}
-	if (config.structure === "monorepo" && !detected.hasPnpmWorkspace) {
-		tasks.push("### Migrate to monorepo structure");
-		tasks.push("");
-		tasks.push("This project was converted to a monorepo. Complete the migration:");
-		tasks.push("");
-		tasks.push("1. Move existing source into `packages/<name>/`");
-		tasks.push("2. Split root `package.json` into workspace manifest + package-level `package.json`");
-		tasks.push("3. Move `tsconfig.json` into the package, add project references to root");
-		tasks.push("4. Create a package-level `tsdown.config.ts`");
-		tasks.push("5. Update import paths and build scripts");
-		tasks.push("");
-	}
-	if (results.some((r) => r.filePath === "test/example.test.ts" && r.action === "created")) {
-		tasks.push("### Generate tests");
-		tasks.push("");
-		tasks.push("A starter test was created at `test/example.test.ts`. Review `src/` and create additional tests covering exported functions and edge cases.");
-		tasks.push("");
+		tasks.push(`### Migrate .oxlintrc.json to oxlint.config.ts
+
+Compare \`.oxlintrc.json\` rules against \`@bensandee/config/oxlint/recommended\`. Port any custom rules/overrides into \`oxlint.config.ts\`, then delete \`.oxlintrc.json\`.
+`);
+		return;
 	}
-	if (tasks.length > 0) {
-		sections.push("## Migration tasks");
-		sections.push("");
-		sections.push(...tasks);
-		sections.push("## Ground rules");
-		sections.push("");
-		sections.push("Prefer fixing root causes over suppressing issues:");
-		sections.push("");
-		sections.push("- **Lint errors**: fix the code, not disable comments");
-		sections.push("- **Type errors**: add proper types, not `any` or `@ts-expect-error`");
-		sections.push("- **Test failures**: fix the test or bug, don't skip/delete");
-		sections.push("- **Knip findings**: remove unused code, don't add ignores");
-		sections.push("");
-		sections.push("It is OK to add new packages (e.g. `zod`, `@bensandee/common`) to resolve errors. Only suppress an issue with a comment explaining why the fix is not feasible.");
-		sections.push("");
-	}
-	sections.push("## Verify");
-	sections.push("");
-	sections.push("Run `pnpm check` and fix any errors. This runs the full pipeline:");
-	sections.push("build → typecheck → lint → test → format → knip");
-	sections.push("");
-	sections.push("When everything passes, run `/init` to generate a `CLAUDE.md` for this repository.");
-	sections.push("");
-	return sections.join("\n");
+	if (results.find((r) => r.filePath === "oxlint.config.ts")?.action === "skipped" && detected.hasOxlintConfig && !detected.oxlintExtendsRecommended) tasks.push(`### Verify oxlint.config.ts extends recommended rules
+
+Ensure \`oxlint.config.ts\` imports and extends \`@bensandee/config/oxlint/recommended\`:
+
+\`\`\`ts
+import recommended from "@bensandee/config/oxlint/recommended";
+import { defineConfig } from "oxlint";
+
+export default defineConfig({ extends: [recommended] });
+\`\`\`
+`);
+}
+function addMonorepoTasks(tasks, config, detected) {
+	if (config.structure !== "monorepo" || detected.hasPnpmWorkspace) return;
+	tasks.push(`### Migrate to monorepo structure
+
+This project was converted to a monorepo. Complete the migration:
+
+1. Move existing source into \`packages/<name>/\`
+2. Split root \`package.json\` into workspace manifest + package-level \`package.json\`
+3. Move \`tsconfig.json\` into the package, add project references to root
+4. Create a package-level \`tsdown.config.ts\`
+5. Update import paths and build scripts
+`);
+}
+function addTestGenerationTasks(tasks, results) {
+	if (!results.some((r) => r.filePath === "test/example.test.ts" && r.action === "created")) return;
+	tasks.push(`### Generate tests
+
+A starter test was created at \`test/example.test.ts\`. Review \`src/\` and create additional tests covering exported functions and edge cases.
+`);
 }
 //#endregion
 //#region src/commands/repo-init.ts
@@ -3436,7 +3486,8 @@ async function runCheck(targetDir) {
 		if (!newContent) continue;
 		const existingPath = path.join(targetDir, r.filePath);
 		const existing = existsSync(existingPath) ? readFileSync(existingPath, "utf-8") : void 0;
-		if (!existing) {
+		if (isBundledFile(r.filePath)) log.info(`    bundled file changed (${formatBytes(existing?.length ?? 0)} → ${formatBytes(newContent.length)})`);
+		else if (!existing) {
 			const lineCount = newContent.split("\n").length - 1;
 			log.info(`    + ${lineCount} new lines`);
 		} else {
@@ -3446,6 +3497,14 @@ async function runCheck(targetDir) {
 	}
 	return 1;
 }
+/** Files that are minified/bundled and produce unreadable diffs. */
+function isBundledFile(filePath) {
+	return filePath.endsWith("bst-hook.mjs");
+}
+function formatBytes(bytes) {
+	if (bytes < 1024) return `${String(bytes)} B`;
+	return `${(bytes / 1024).toFixed(1)} kB`;
+}
 const normalize = (line) => line.trimEnd();
 function lineDiff(oldText, newText) {
 	const oldLines = oldText.split("\n").map(normalize);
@@ -3464,15 +3523,16 @@ function lineDiff(oldText, newText) {
 /** Create an executor that runs real commands, fetches, and reads the filesystem. */
 function createRealExecutor() {
 	return {
-		exec(command, options) {
+		exec(file, args, options) {
 			try {
 				return {
-					stdout: execSync(command, {
+					stdout: execFileSync(file, args, {
 						cwd: options?.cwd,
 						env: {
 							...process.env,
 							...options?.env
 						},
+						input: options?.input,
 						encoding: "utf-8",
 						stdio: [
 							"pipe",
@@ -3496,8 +3556,8 @@ function createRealExecutor() {
 				};
 			}
 		},
-		execInherit(command, options) {
-			execSync(command, {
+		execInherit(file, args, options) {
+			execFileSync(file, args, {
 				cwd: options?.cwd,
 				env: options?.env ? {
 					...process.env,
@@ -3554,6 +3614,19 @@ function createRealExecutor() {
 		}
 	};
 }
+/**
+* Compute sliding version tags from a semver version string.
+* For "1.2.3" returns ["v1", "v1.2", "latest"]. Strips prerelease suffixes.
+*/
+function computeSlidingTags(version) {
+	const parts = (version.split("-")[0] ?? version).split(".");
+	if (parts.length < 2 || !parts[0] || !parts[1]) throw new FatalError(`Invalid version format "${version}". Expected semver (X.Y.Z)`);
+	return [
+		`v${parts[0]}`,
+		`v${parts[0]}.${parts[1]}`,
+		"latest"
+	];
+}
 /** Parse "New tag:" lines from changeset publish output. */
 function parseNewTags(output) {
 	const tags = [];
@@ -3595,7 +3668,7 @@ const RETRY_BASE_DELAY_MS = 1e3;
 async function responseBodyText(res) {
 	try {
 		const text = await res.text();
-		return text.length > 500 ? text.slice(0, 500) + "…" : text;
+		return redact(text.length > 500 ? text.slice(0, 500) + "…" : text);
 	} catch {
 		return "(could not read response body)";
 	}
@@ -3739,6 +3812,30 @@ async function ensureRelease(executor, conn, tag) {
 //#endregion
 //#region src/release/version.ts
 const BRANCH = "changeset-release/main";
+/** Pattern matching a dateless version heading like `## 1.2.3` or `## 1.2.3-beta.0`. */
+const DATELESS_VERSION_RE = /^## (\d+\.\d+\.\d+(?:-[^\s)]+)?)$/gm;
+/** Format today's date as YYYY-MM-DD. */
+function todayIso() {
+	return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+}
+/** Add today's date to dateless version headings in a changelog string. */
+function stampDates(content, date) {
+	return content.replace(DATELESS_VERSION_RE, `## $1 (${date})`);
+}
+/**
+* Stamp release dates on CHANGELOGs for packages that were just versioned.
+* Only modifies headings that don't already have a date (idempotent).
+*/
+function stampChangelogDates(executor, cwd, changedDirs, isMonorepo) {
+	const date = todayIso();
+	const changelogPaths = isMonorepo ? changedDirs.map((dir) => path.join(cwd, "packages", dir, "CHANGELOG.md")) : [path.join(cwd, "CHANGELOG.md")];
+	for (const changelogPath of changelogPaths) {
+		const content = executor.readFile(changelogPath);
+		if (!content) continue;
+		const updated = stampDates(content, date);
+		if (updated !== content) executor.writeFile(changelogPath, updated);
+	}
+}
 /** Extract the latest changelog entry (content between first and second `## ` heading). */
 function extractLatestEntry(changelog) {
 	const lines = changelog.split("\n");
@@ -3822,19 +3919,29 @@ async function runVersionMode(executor, config) {
 			debug(config, "Temporarily disabled changeset commit:true");
 		}
 	}
-	const versionResult = executor.exec("pnpm changeset version", { cwd: config.cwd });
+	const versionResult = executor.exec("pnpm", ["changeset", "version"], { cwd: config.cwd });
 	debugExec(config, "pnpm changeset version", versionResult);
 	if (originalConfig) executor.writeFile(changesetConfigPath, originalConfig);
 	if (versionResult.exitCode !== 0) throw new FatalError(`pnpm changeset version failed (exit code ${String(versionResult.exitCode)}):\n${versionResult.stderr}`);
-	debugExec(config, "pnpm install --no-frozen-lockfile", executor.exec("pnpm install --no-frozen-lockfile", { cwd: config.cwd }));
+	const packagesAfterVersion = executor.listWorkspacePackages(config.cwd);
+	if (packagesBefore.length > 0 || packagesAfterVersion.length > 0) {
+		const beforeMap = new Map(packagesBefore.map((pkg) => [pkg.name, pkg.version]));
+		const changedDirs = packagesAfterVersion.filter((pkg) => beforeMap.get(pkg.name) !== pkg.version).map((pkg) => pkg.dir);
+		stampChangelogDates(executor, config.cwd, changedDirs, true);
+	} else stampChangelogDates(executor, config.cwd, [], false);
+	debugExec(config, "pnpm install --no-frozen-lockfile", executor.exec("pnpm", ["install", "--no-frozen-lockfile"], { cwd: config.cwd }));
 	const { title, body } = buildPrContent(executor, config.cwd, packagesBefore);
 	debug(config, `PR title: ${title}`);
-	const addResult = executor.exec("git add -A", { cwd: config.cwd });
+	const addResult = executor.exec("git", ["add", "-A"], { cwd: config.cwd });
 	if (addResult.exitCode !== 0) throw new FatalError(`git add failed: ${addResult.stderr || addResult.stdout}`);
 	const remainingChangesets = executor.listChangesetFiles(config.cwd);
 	if (remainingChangesets.length > 0) log.warn(`Changeset files still present after versioning: ${remainingChangesets.join(", ")}`);
 	debug(config, `Changeset files after versioning: ${remainingChangesets.length > 0 ? remainingChangesets.join(", ") : "(none — all consumed)"}`);
-	const commitResult = executor.exec("git commit -m \"chore: version packages\"", { cwd: config.cwd });
+	const commitResult = executor.exec("git", [
+		"commit",
+		"-m",
+		"chore: version packages"
+	], { cwd: config.cwd });
 	debugExec(config, "git commit", commitResult);
 	if (commitResult.exitCode !== 0) {
 		log.info("Nothing to commit after versioning");
@@ -3850,7 +3957,12 @@ async function runVersionMode(executor, config) {
 			pr: "none"
 		};
 	}
-	const pushResult = executor.exec(`git push origin "HEAD:refs/heads/${BRANCH}" --force`, { cwd: config.cwd });
+	const pushResult = executor.exec("git", [
+		"push",
+		"origin",
+		`HEAD:refs/heads/${BRANCH}`,
+		"--force"
+	], { cwd: config.cwd });
 	debugExec(config, "git push", pushResult);
 	if (pushResult.exitCode !== 0) throw new FatalError(`git push failed (exit code ${String(pushResult.exitCode)}):\n${pushResult.stderr || pushResult.stdout}`);
 	const conn = {
@@ -3888,14 +4000,18 @@ async function runVersionMode(executor, config) {
 /** Mode 2: publish to npm, push tags, and create Forgejo releases. */
 async function runPublishMode(executor, config) {
 	log.info("No changesets — publishing packages");
-	const publishResult = executor.exec("pnpm changeset publish", { cwd: config.cwd });
+	const publishResult = executor.exec("pnpm", ["changeset", "publish"], { cwd: config.cwd });
 	debugExec(config, "pnpm changeset publish", publishResult);
 	if (publishResult.exitCode !== 0) throw new FatalError(`pnpm changeset publish failed (exit code ${String(publishResult.exitCode)}):\n${publishResult.stderr}`);
 	const stdoutTags = parseNewTags(publishResult.stdout + "\n" + publishResult.stderr);
 	debug(config, `Tags from publish stdout: ${stdoutTags.length > 0 ? stdoutTags.join(", ") : "(none)"}`);
 	const expectedTags = computeExpectedTags(executor.listWorkspacePackages(config.cwd));
 	debug(config, `Expected tags from workspace packages: ${expectedTags.length > 0 ? expectedTags.join(", ") : "(none)"}`);
-	const remoteTags = parseRemoteTags(executor.exec("git ls-remote --tags origin", { cwd: config.cwd }).stdout);
+	const remoteTags = parseRemoteTags(executor.exec("git", [
+		"ls-remote",
+		"--tags",
+		"origin"
+	], { cwd: config.cwd }).stdout);
 	debug(config, `Remote tags: ${remoteTags.length > 0 ? remoteTags.join(", ") : "(none)"}`);
 	const remoteSet = new Set(remoteTags);
 	const tagsToPush = reconcileTags(expectedTags, remoteTags, stdoutTags);
@@ -3929,11 +4045,19 @@ async function runPublishMode(executor, config) {
 	const errors = [];
 	for (const tag of allTags) try {
 		if (!remoteSet.has(tag)) {
-			if (executor.exec(`git tag -l ${JSON.stringify(tag)}`, { cwd: config.cwd }).stdout.trim() === "") {
-				const tagResult = executor.exec(`git tag ${JSON.stringify(tag)}`, { cwd: config.cwd });
+			if (executor.exec("git", [
+				"tag",
+				"-l",
+				tag
+			], { cwd: config.cwd }).stdout.trim() === "") {
+				const tagResult = executor.exec("git", ["tag", tag], { cwd: config.cwd });
 				if (tagResult.exitCode !== 0) throw new FatalError(`Failed to create tag ${tag}: ${tagResult.stderr || tagResult.stdout}`);
 			}
-			const pushTagResult = executor.exec(`git push origin refs/tags/${tag}`, { cwd: config.cwd });
+			const pushTagResult = executor.exec("git", [
+				"push",
+				"origin",
+				`refs/tags/${tag}`
+			], { cwd: config.cwd });
 			if (pushTagResult.exitCode !== 0) throw new FatalError(`Failed to push tag ${tag}: ${pushTagResult.stderr || pushTagResult.stdout}`);
 		}
 		if (await ensureRelease(executor, conn, tag) === "exists") log.warn(`Release for ${tag} already exists — skipping`);
@@ -3946,6 +4070,31 @@ async function runPublishMode(executor, config) {
 		log.warn(`Failed to process ${tag}: ${error instanceof Error ? error.message : String(error)}`);
 	}
 	if (errors.length > 0) throw new TransientError(`Failed to create releases for: ${errors.map((e) => e.tag).join(", ")}`);
+	const slidingTags = allTags.flatMap((t) => {
+		const atIndex = t.lastIndexOf("@");
+		if (atIndex <= 0) return [];
+		const name = t.slice(0, atIndex);
+		return computeSlidingTags(t.slice(atIndex + 1)).map((suffix) => `${name}@${suffix}`);
+	});
+	if (slidingTags.length > 0) {
+		for (const tag of slidingTags) {
+			const tagResult = executor.exec("git", [
+				"tag",
+				"-f",
+				tag
+			], { cwd: config.cwd });
+			if (tagResult.exitCode !== 0) log.warn(`Warning: Failed to create sliding tag ${tag}: ${tagResult.stderr || tagResult.stdout}`);
+		}
+		const forcePushResult = executor.exec("git", [
+			"push",
+			"origin",
+			...slidingTags.map((t) => `refs/tags/${t}`),
+			"--force"
+		], { cwd: config.cwd });
+		debugExec(config, "force-push sliding tags", forcePushResult);
+		if (forcePushResult.exitCode !== 0) log.warn(`Warning: Failed to push sliding tags: ${forcePushResult.stderr || forcePushResult.stdout}`);
+		else log.info(`Created sliding tags: ${slidingTags.join(", ")}`);
+	}
 	return {
 		mode: "publish",
 		tags: allTags
@@ -4035,15 +4184,28 @@ function parseGitUrl(urlStr) {
 function configureGitAuth(executor, conn, cwd) {
 	const host = conn.serverUrl.replace(/^https?:\/\//, "");
 	const authUrl = `https://x-access-token:${conn.token}@${host}/${conn.repository}`;
-	executor.exec(`git remote set-url origin ${authUrl}`, { cwd });
+	executor.exec("git", [
+		"remote",
+		"set-url",
+		"origin",
+		authUrl
+	], { cwd });
 }
 /** Configure git user.name and user.email for CI bot commits. */
 function configureGitIdentity(executor, platform, cwd) {
 	const isGitHub = platform === "github";
 	const name = isGitHub ? "github-actions[bot]" : "forgejo-actions[bot]";
 	const email = isGitHub ? "github-actions[bot]@users.noreply.github.com" : "forgejo-actions[bot]@noreply.localhost";
-	executor.exec(`git config user.name "${name}"`, { cwd });
-	executor.exec(`git config user.email "${email}"`, { cwd });
+	executor.exec("git", [
+		"config",
+		"user.name",
+		name
+	], { cwd });
+	executor.exec("git", [
+		"config",
+		"user.email",
+		email
+	], { cwd });
 }
 //#endregion
 //#region src/commands/release-changesets.ts
@@ -4084,7 +4246,11 @@ function buildReleaseConfig(flags) {
 function getCurrentBranch(executor, cwd) {
 	const ref = process.env["GITHUB_REF"];
 	if (ref?.startsWith("refs/heads/")) return ref.slice(11);
-	return executor.exec("git rev-parse --abbrev-ref HEAD", { cwd }).stdout.trim();
+	return executor.exec("git", [
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	], { cwd }).stdout.trim();
 }
 /** Core release logic — testable with a mock executor. */
 async function runRelease(config, executor) {
@@ -4155,9 +4321,15 @@ async function triggerForgejo(conn, ref, inputs) {
 }
 function triggerGitHub(ref, inputs) {
 	const executor = createRealExecutor();
-	const inputFlags = Object.entries(inputs).map(([k, v]) => `-f ${k}=${v}`).join(" ");
-	const cmd = `gh workflow run release.yml --ref ${ref}${inputFlags ? ` ${inputFlags}` : ""}`;
-	const result = executor.exec(cmd, { cwd: process.cwd() });
+	const inputFlags = Object.entries(inputs).flatMap(([k, v]) => ["-f", `${k}=${v}`]);
+	const result = executor.exec("gh", [
+		"workflow",
+		"run",
+		"release.yml",
+		"--ref",
+		ref,
+		...inputFlags
+	], { cwd: process.cwd() });
 	if (result.exitCode !== 0) throw new FatalError(`Failed to trigger GitHub workflow: ${result.stderr || result.stdout || "unknown error"}`);
 	log.info(`Triggered release workflow on GitHub (ref: ${ref})`);
 }
@@ -4222,34 +4394,39 @@ async function mergeForgejo(conn, dryRun) {
 function mergeGitHub(dryRun) {
 	const executor = createRealExecutor();
 	if (dryRun) {
-		const prNum = executor.exec(`gh pr view ${HEAD_BRANCH} --json number --jq .number`, { cwd: process.cwd() }).stdout.trim();
+		const prNum = executor.exec("gh", [
+			"pr",
+			"view",
+			HEAD_BRANCH,
+			"--json",
+			"number",
+			"--jq",
+			".number"
+		], { cwd: process.cwd() }).stdout.trim();
 		if (!prNum) throw new FatalError(`No open PR found for branch ${HEAD_BRANCH}`);
 		log.info(`[dry-run] Would merge PR #${prNum} and delete branch ${HEAD_BRANCH}`);
 		return;
 	}
-	const result = executor.exec(`gh pr merge ${HEAD_BRANCH} --merge --delete-branch`, { cwd: process.cwd() });
+	const result = executor.exec("gh", [
+		"pr",
+		"merge",
+		HEAD_BRANCH,
+		"--merge",
+		"--delete-branch"
+	], { cwd: process.cwd() });
 	if (result.exitCode !== 0) throw new FatalError(`Failed to merge PR: ${result.stderr || result.stdout || "unknown error"}`);
 	log.info(`Merged changesets PR and deleted branch ${HEAD_BRANCH}`);
 }
 //#endregion
 //#region src/release/simple.ts
-/**
-* Compute sliding version tags from a semver version string.
-* For "1.2.3" returns ["v1", "v1.2"]. Strips prerelease suffixes.
-*/
-function computeSlidingTags(version) {
-	const parts = (version.split("-")[0] ?? version).split(".");
-	if (parts.length < 2 || !parts[0] || !parts[1]) throw new FatalError(`Invalid version format "${version}". Expected semver (X.Y.Z)`);
-	return [`v${parts[0]}`, `v${parts[0]}.${parts[1]}`];
-}
-/** Build the commit-and-tag-version command with appropriate flags. */
-function buildCommand(config) {
-	const args = ["pnpm exec commit-and-tag-version"];
+/** Build the commit-and-tag-version args. */
+function buildArgs(config) {
+	const args = ["exec", "commit-and-tag-version"];
 	if (config.dryRun) args.push("--dry-run");
 	if (config.firstRelease) args.push("--first-release");
-	if (config.releaseAs) args.push(`--release-as ${config.releaseAs}`);
-	if (config.prerelease) args.push(`--prerelease ${config.prerelease}`);
-	return args.join(" ");
+	if (config.releaseAs) args.push("--release-as", config.releaseAs);
+	if (config.prerelease) args.push("--prerelease", config.prerelease);
+	return args;
 }
 /** Read the current version from package.json. */
 function readVersion(executor, cwd) {
@@ -4266,14 +4443,18 @@ function platformType(config) {
 /** Run the full commit-and-tag-version release flow. */
 async function runSimpleRelease(executor, config) {
 	configureGitIdentity(executor, platformType(config), config.cwd);
-	const command = buildCommand(config);
-	log.info(`Running: ${command}`);
-	const versionResult = executor.exec(command, { cwd: config.cwd });
+	const args = buildArgs(config);
+	log.info(`Running: pnpm ${args.join(" ")}`);
+	const versionResult = executor.exec("pnpm", args, { cwd: config.cwd });
 	debugExec(config, "commit-and-tag-version", versionResult);
 	if (versionResult.exitCode !== 0) throw new FatalError(`commit-and-tag-version failed (exit code ${String(versionResult.exitCode)}):\n${versionResult.stderr || versionResult.stdout}`);
 	const version = readVersion(executor, config.cwd);
 	debug(config, `New version: ${version}`);
-	const tagResult = executor.exec("git describe --tags --abbrev=0", { cwd: config.cwd });
+	const tagResult = executor.exec("git", [
+		"describe",
+		"--tags",
+		"--abbrev=0"
+	], { cwd: config.cwd });
 	debugExec(config, "git describe", tagResult);
 	const tag = tagResult.stdout.trim();
 	if (!tag) throw new FatalError("Could not determine the new tag from git describe");
@@ -4297,9 +4478,18 @@ async function runSimpleRelease(executor, config) {
 			configureGitAuth(executor, config.platform.conn, config.cwd);
 			debug(config, "Configured git remote with RELEASE_TOKEN auth");
 		}
-		const branch = executor.exec("git rev-parse --abbrev-ref HEAD", { cwd: config.cwd }).stdout.trim() || "main";
+		const branch = executor.exec("git", [
+			"rev-parse",
+			"--abbrev-ref",
+			"HEAD"
+		], { cwd: config.cwd }).stdout.trim() || "main";
 		debug(config, `Pushing to origin/${branch}`);
-		const pushResult = executor.exec(`git push --follow-tags origin ${branch}`, { cwd: config.cwd });
+		const pushResult = executor.exec("git", [
+			"push",
+			"--follow-tags",
+			"origin",
+			branch
+		], { cwd: config.cwd });
 		debugExec(config, "git push", pushResult);
 		if (pushResult.exitCode !== 0) throw new FatalError(`git push failed (exit code ${String(pushResult.exitCode)}):\n${pushResult.stderr || pushResult.stdout}`);
 		pushed = true;
@@ -4309,10 +4499,19 @@ async function runSimpleRelease(executor, config) {
 	if (!config.noSlidingTags && pushed) {
 		slidingTags = computeSlidingTags(version);
 		for (const slidingTag of slidingTags) {
-			const slidingTagResult = executor.exec(`git tag -f ${slidingTag}`, { cwd: config.cwd });
+			const slidingTagResult = executor.exec("git", [
+				"tag",
+				"-f",
+				slidingTag
+			], { cwd: config.cwd });
 			if (slidingTagResult.exitCode !== 0) throw new FatalError(`Failed to create sliding tag ${slidingTag}: ${slidingTagResult.stderr || slidingTagResult.stdout}`);
 		}
-		const forcePushResult = executor.exec(`git push origin ${slidingTags.join(" ")} --force`, { cwd: config.cwd });
+		const forcePushResult = executor.exec("git", [
+			"push",
+			"origin",
+			...slidingTags,
+			"--force"
+		], { cwd: config.cwd });
 		debugExec(config, "force-push sliding tags", forcePushResult);
 		if (forcePushResult.exitCode !== 0) log.warn(`Warning: Failed to push sliding tags: ${forcePushResult.stderr || forcePushResult.stdout}`);
 		else log.info(`Created sliding tags: ${slidingTags.join(", ")}`);
@@ -4337,7 +4536,12 @@ async function createPlatformRelease(executor, config, tag) {
 		log.info(`Created Forgejo release for ${tag}`);
 		return true;
 	}
-	const ghResult = executor.exec(`gh release create ${tag} --generate-notes`, { cwd: config.cwd });
+	const ghResult = executor.exec("gh", [
+		"release",
+		"create",
+		tag,
+		"--generate-notes"
+	], { cwd: config.cwd });
 	debugExec(config, "gh release create", ghResult);
 	if (ghResult.exitCode !== 0) {
 		log.warn(`Warning: Failed to create GitHub release: ${ghResult.stderr || ghResult.stdout}`);
@@ -4575,6 +4779,45 @@ function requireEnv(name) {
 	if (!value) throw new FatalError(`Missing required environment variable: ${name}`);
 	return value;
 }
+/**
+* Derive the registry host from a repository URL hostname.
+* GitHub uses ghcr.io; all other hosts (Forgejo, GitLab, etc.) use the hostname directly.
+*/
+function registryHostFromHostname(hostname) {
+	return hostname === "github.com" ? "ghcr.io" : hostname;
+}
+/**
+* Resolve docker registry config using a fallback chain:
+* 1. Environment variables (DOCKER_REGISTRY_HOST / DOCKER_REGISTRY_NAMESPACE)
+* 2. .tooling.json registryHost / registryNamespace fields
+* 3. Derived from package.json repository URL
+*/
+function resolveRegistryConfig(cwd) {
+	const envHost = process.env["DOCKER_REGISTRY_HOST"];
+	const envNamespace = process.env["DOCKER_REGISTRY_NAMESPACE"];
+	if (envHost && envNamespace) return {
+		registryHost: envHost,
+		registryNamespace: envNamespace
+	};
+	const toolingConfig = loadToolingConfig(cwd);
+	const toolingHost = toolingConfig?.registryHost;
+	const toolingNamespace = toolingConfig?.registryNamespace;
+	if (toolingHost && toolingNamespace) return {
+		registryHost: envHost ?? toolingHost,
+		registryNamespace: envNamespace ?? toolingNamespace
+	};
+	const parsed = parseRepositoryUrl(cwd);
+	if (parsed) {
+		const derivedHost = registryHostFromHostname(parsed.hostname);
+		const owner = parsed.repository.split("/")[0];
+		const host = envHost ?? toolingHost ?? derivedHost;
+		return {
+			registryHost: host,
+			registryNamespace: envNamespace ?? toolingNamespace ?? `${host}/${owner}`
+		};
+	}
+	throw new FatalError("Could not determine docker registry. Set DOCKER_REGISTRY_HOST and DOCKER_REGISTRY_NAMESPACE, or add registryHost/registryNamespace to .tooling.json, or ensure package.json has a repository URL.");
+}
 const publishDockerCommand = defineCommand({
 	meta: {
 		name: "docker:publish",
@@ -4591,10 +4834,12 @@ const publishDockerCommand = defineCommand({
 		}
 	},
 	async run({ args }) {
+		const cwd = process.cwd();
+		const { registryHost, registryNamespace } = resolveRegistryConfig(cwd);
 		const config = {
-			cwd: process.cwd(),
-			registryHost: requireEnv("DOCKER_REGISTRY_HOST"),
-			registryNamespace: requireEnv("DOCKER_REGISTRY_NAMESPACE"),
+			cwd,
+			registryHost,
+			registryNamespace,
 			username: requireEnv("DOCKER_USERNAME"),
 			password: requireEnv("DOCKER_PASSWORD"),
 			dryRun: args["dry-run"] === true,
@@ -4869,8 +5114,8 @@ function toHttpHealthChecks(checks) {
 }
 /** Write the generated check overlay to a temp file. Returns the absolute path. */
 function writeTempOverlay(content) {
-	const name = `tooling-check-overlay-${process.pid}.yaml`;
-	const filePath = path.join(tmpdir(), name);
+	const dir = mkdtempSync(path.join(tmpdir(), "tooling-check-"));
+	const filePath = path.join(dir, "overlay.yaml");
 	writeFileSync(filePath, content, "utf-8");
 	return filePath;
 }
@@ -4946,17 +5191,99 @@ const dockerCheckCommand = defineCommand({
 			if (!result.success) throw new FatalError(`Check failed (${result.reason}): ${result.message}`);
 		} finally {
 			try {
-				unlinkSync(tempOverlayPath);
+				rmSync(path.dirname(tempOverlayPath), { recursive: true });
 			} catch (_error) {}
 		}
 	}
 });
 //#endregion
+//#region src/commands/hooks-audit.ts
+const AuditEntrySchema = z.object({
+	timestamp: z.string(),
+	sessionId: z.string(),
+	command: z.string(),
+	decision: z.enum([
+		"allow",
+		"deny",
+		"passthrough"
+	]),
+	rule: z.string().nullable(),
+	reason: z.string().nullable()
+});
+function parseAuditLog(logPath) {
+	if (!existsSync(logPath)) return [];
+	const lines = readFileSync(logPath, "utf-8").split("\n").filter(Boolean);
+	const entries = [];
+	for (const line of lines) try {
+		const result = AuditEntrySchema.safeParse(JSON.parse(line));
+		if (result.success) entries.push(result.data);
+	} catch (_error) {}
+	return entries;
+}
+const hooksAuditCommand = defineCommand({
+	meta: {
+		name: "hooks:audit",
+		description: "Summarize the bst-hook audit log"
+	},
+	args: {
+		dir: {
+			type: "positional",
+			description: "Project directory (default: current directory)",
+			required: false
+		},
+		tail: {
+			type: "string",
+			description: "Show the last N entries (default: 20)"
+		},
+		decision: {
+			type: "string",
+			description: "Filter by decision: allow, deny, or passthrough"
+		},
+		json: {
+			type: "boolean",
+			description: "Output raw JSON lines instead of formatted summary"
+		}
+	},
+	async run({ args }) {
+		const targetDir = path.resolve(args.dir ?? ".");
+		const logPath = path.join(targetDir, ".claude/hooks/bst-hook.audit.local.jsonl");
+		let entries = parseAuditLog(logPath);
+		if (entries.length === 0) {
+			log.info("No audit log entries found.");
+			return;
+		}
+		const decisionFilter = args.decision;
+		if (decisionFilter) entries = entries.filter((e) => e.decision === decisionFilter);
+		const tailCount = args.tail ? Number.parseInt(args.tail, 10) : 20;
+		if (entries.length > tailCount) entries = entries.slice(-tailCount);
+		if (args.json === true) {
+			for (const entry of entries) console.log(JSON.stringify(entry));
+			return;
+		}
+		const allEntries = parseAuditLog(logPath);
+		const counts = {
+			allow: 0,
+			deny: 0,
+			passthrough: 0
+		};
+		for (const e of allEntries) counts[e.decision]++;
+		log.info(`Audit log: ${String(allEntries.length)} entries — ${String(counts.allow)} allow, ${String(counts.deny)} deny, ${String(counts.passthrough)} passthrough`);
+		log.info("");
+		for (const entry of entries) {
+			const ts = entry.timestamp.replace("T", " ").replace(/\.\d+Z$/, "");
+			const icon = entry.decision === "allow" ? "+" : entry.decision === "deny" ? "x" : "?";
+			const rule = entry.rule ? ` [${entry.rule}]` : "";
+			const reason = entry.reason ? ` — ${entry.reason}` : "";
+			log.info(`  ${icon} ${ts}  ${entry.decision.padEnd(11)} ${entry.command}${rule}${reason}`);
+		}
+	}
+});
+//#endregion
 //#region src/bin.ts
 const main = defineCommand({
 	meta: {
 		name: "bst",
-		version: "0.37.0",
+		version: "0.39.0",
 		description: "Bootstrap and maintain standardized TypeScript project tooling"
 	},
 	subCommands: {
@@ -4969,10 +5296,11 @@ const main = defineCommand({
 		"release:simple": releaseSimpleCommand,
 		"docker:publish": publishDockerCommand,
 		"docker:build": dockerBuildCommand,
-		"docker:check": dockerCheckCommand
+		"docker:check": dockerCheckCommand,
+		"hooks:audit": hooksAuditCommand
 	}
 });
-console.log(`@bensandee/tooling v0.37.0`);
+console.log(`@bensandee/tooling v0.39.0`);
 async function run() {
 	await runMain(main);
 	process.exit(process.exitCode ?? 0);