@hasna/hooks 0.10.1 → 0.10.3

package/bin/native-safety-entry.js

@@ -899,8 +899,9 @@ function evaluate(input, deps) {
 if (false) {}
 
 // hooks/hook-workspace-repos-guard/src/hook.ts
+import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
 import { homedir } from "os";
-import { isAbsolute as isAbsolute2, join as join2, normalize as normalize2, relative, resolve as resolve2, sep as sep2 } from "path";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2, normalize as normalize2, relative, resolve as resolve2, sep as sep2 } from "path";
 var FILE_WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
 var PATCH_TOOLS = new Set(["apply_patch", "ApplyPatch", "functions.apply_patch"]);
 var DEFAULT_ORGS = ["hasna", "hasnaxyz", "hasna-products"];
@@ -914,11 +915,47 @@ function legacyRoot(home) {
 function protectedRoots(home) {
   return [reposRoot(home), legacyRoot(home)];
 }
-function resolveAllowedOrgs(env = process.env) {
+function allowedOrgsFile(home) {
+  return join2(home, ".hasna", "hooks", "config", "workspace-repos-guard-orgs");
+}
+var ORG_NAME = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;
+function ownedAndClosed(stat) {
+  const uid = process.getuid?.();
+  return uid !== undefined && (stat.uid === 0 || stat.uid === uid) && (stat.mode & 18) === 0;
+}
+function readAllowedOrgsFile(home) {
+  const file = allowedOrgsFile(home);
+  let text;
+  try {
+    const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+      const stat = fstatSync(fd);
+      if (!stat.isFile() || !ownedAndClosed(stat) || stat.size > 4096)
+        return null;
+      text = readFileSync2(fd, "utf8");
+    } finally {
+      closeSync(fd);
+    }
+    const top = normalize2(home);
+    for (let dir = dirname2(file);dir !== top; dir = dirname2(dir)) {
+      const stat = lstatSync(dir);
+      if (!stat.isDirectory() || !ownedAndClosed(stat) || dir === dirname2(dir))
+        return null;
+    }
+    if (!ownedAndClosed(statSync2(top)))
+      return null;
+  } catch {
+    return null;
+  }
+  const names = text.replace(/#[^\n]*/g, "").split(/[\s,]+/).filter(Boolean);
+  return names.length > 0 && names.every((name) => ORG_NAME.test(name)) ? new Set(names) : null;
+}
+function resolveAllowedOrgs(env = process.env, home = homedir()) {
   const raw = env.WORKSPACE_REPOS_GUARD_ORGS;
-  if (typeof raw !== "string" || !raw.trim())
-    return new Set(DEFAULT_ORGS);
-  return new Set(raw.split(",").map((s) => s.trim()).filter(Boolean));
+  if (typeof raw === "string" && raw.trim()) {
+    return new Set(raw.split(",").map((s) => s.trim()).filter(Boolean));
+  }
+  return readAllowedOrgsFile(home) ?? new Set(DEFAULT_ORGS);
 }
 function classifyPath(target, root, orgs, op) {
   if (op === "read")
@@ -952,6 +989,11 @@ function classifyPath(target, root, orgs, op) {
   return { blocked: false };
 }
 var WRITE_FLAGS = /\b(?:-o|--output|-O|--output-document|-out)\b/;
+var FD_DUPLICATION = /\d*[<>]&\s*(?:\d+|-)(?=$|[\s;&|)])/g;
+var OUTPUT_REDIRECT = /(?:\d+|&)?(?:>>|>\||>&|<>|>)\s*([^\s;&|<>()\x60]*)/g;
+function withoutFdDuplication(segment) {
+  return segment.replace(FD_DUPLICATION, " ");
+}
 function segmentOperation(segment) {
   const trimmed = segment.trim();
   if (!trimmed)
@@ -980,7 +1022,7 @@ function segmentOperation(segment) {
   } else if (/(?:^|\s)(?:python3?|node|bun)\b[^;&|]*\s+-[ce](?:\s|$)/.test(trimmed)) {
     return "write";
   }
-  if (/(?:^|[;&|])\s*echo\b/.test(trimmed) || /[>&]/.test(trimmed))
+  if (/(?:^|[;&|])\s*echo\b/.test(trimmed) || />/.test(withoutFdDuplication(trimmed)))
     return "write";
   return "read";
 }
@@ -1017,22 +1059,51 @@ function unwrapSegment(segment) {
 function regexEscape(text) {
   return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function cdDestinations(operand, bases, home) {
+  if (operand === undefined)
+    return [home];
+  let word = expandHomeSpelling2(operand, home);
+  const quoted = word.match(/^(['"])(.*)\1$/);
+  if (quoted)
+    word = quoted[2];
+  if (!word || word === "-" || /[$\x60*?[\]{}~\\'"]/.test(word))
+    return null;
+  return [...new Set(bases.map((base) => resolve2(base, word)))];
+}
+var REL_OPERAND = /(?:^|\s)(\.\.?|[^\s"';&|<>()\x60/]+(?:\/[^\s"';&|<>()\x60]*)?)\s*$/;
 function bashTargets(command, home, cwd) {
   if (!command)
     return [];
   const roots = protectedRoots(home);
-  const segments = command.split(/\s*&&\s*|\s*\|\|\s*|;\s*|\n+/);
+  const underRoot = (path) => roots.some((root) => path === root || path.startsWith(`${root}${sep2}`));
+  const parts = command.split(/(\s*&&\s*|\s*\|\|\s*|;\s*|\n+)/);
   const targets = [];
-  let cwdUnderRepos = null;
-  for (const rawSegment of segments) {
+  let current = [cwd];
+  let reachable = new Set([cwd]);
+  let certain = true;
+  const subshells = [];
+  for (let index = 0;index < parts.length; index += 2) {
+    const separator = index === 0 ? "" : parts[index - 1].trim();
+    if (separator === "||")
+      certain = false;
+    else if (separator !== "&&")
+      certain = true;
+    if (separator !== "&&" || !certain)
+      current = [...reachable];
+    const rawSegment = parts[index];
+    const opens = (rawSegment.match(/^[\s({]*/)?.[0].match(/\(/g) ?? []).length;
+    const closes = (rawSegment.match(/[\s)}]*$/)?.[0].match(/\)/g) ?? []).length;
+    for (let i = 0;i < opens; i++)
+      subshells.push({ current: [...current], reachable: new Set(reachable), certain });
     const segment = unwrapSegment(rawSegment);
     const op = segmentOperation(segment);
-    const cdMatch = segment.match(/(?:^|\s)cd(?:\s+(?:-[A-Za-z]+|--))*\s+([^\s;&|<>()\x60]+)/);
-    if (cdMatch) {
-      const cdTarget = expandHomeSpelling2(cdMatch[1], home);
-      if (cdTarget && roots.some((root) => cdTarget === root || cdTarget.startsWith(`${root}${sep2}`))) {
-        cwdUnderRepos = cdTarget;
-      }
+    const plainCd = segment.match(/^cd(?:\s+(?:-[A-Za-z@]+|--))*(?:\s+([^\s;&|<>()\x60]+))?$/);
+    const embeddedCd = plainCd ? null : segment.match(/(?:^|\s)cd(?:\s+(?:-[A-Za-z]+|--))*\s+([^\s;&|<>()\x60]+)/);
+    if (embeddedCd) {
+      for (const dir of cdDestinations(embeddedCd[1], current, home) ?? [])
+        reachable.add(dir);
+      certain = false;
+      current = [...reachable];
     }
     const homeLiteral = regexEscape(home);
     const suffix = roots.map((root) => regexEscape(root.slice(home.length + 1))).join("|");
@@ -1046,14 +1117,35 @@ function bashTargets(command, home, cwd) {
       targets.push({ path: normalize2(expanded).replace(/\/+$/, ""), op });
     }
     if (!foundExplicit && (op === "delete" || op === "write")) {
-      const base = cwdUnderRepos ?? (roots.some((root) => cwd === root || cwd.startsWith(`${root}${sep2}`)) ? cwd : null);
-      if (base) {
-        const relMatch = segment.match(/(?:^|\s)(\.\.?|[^\s"';&|<>()\x60/]+(?:\/[^\s"';&|<>()\x60]*)?)\s*$/);
-        if (relMatch) {
-          targets.push({ path: normalize2(resolve2(base, relMatch[1])), op });
+      const operands = [];
+      const commandPart = withoutFdDuplication(segment).replace(OUTPUT_REDIRECT, (_match, operand) => {
+        if (operand)
+          operands.push(operand);
+        return " ";
+      });
+      const commandOp = segmentOperation(commandPart);
+      const relMatch = commandOp === "read" ? null : commandPart.match(REL_OPERAND);
+      for (const base of current.filter(underRoot)) {
+        for (const operand of operands) {
+          targets.push({ path: normalize2(resolve2(base, expandHomeSpelling2(operand, home))), op: "write" });
         }
+        if (relMatch)
+          targets.push({ path: normalize2(resolve2(base, relMatch[1])), op: commandOp });
+      }
+    }
+    if (plainCd) {
+      const next = cdDestinations(plainCd[1], current, home);
+      if (next) {
+        for (const dir of next)
+          reachable.add(dir);
+        if (certain)
+          current = next;
+      } else {
+        certain = false;
       }
     }
+    for (let i = 0;i < closes && subshells.length > 0; i++)
+      ({ current, reachable, certain } = subshells.pop());
   }
   return targets;
 }
@@ -1067,14 +1159,14 @@ function patchTargets(patch, cwd) {
   }
   return targets;
 }
-function evaluate2(input) {
+function evaluate2(input, options = {}) {
   const warnings = [];
   if (input.hook_event_name !== "PreToolUse")
     return { output: { continue: true }, warnings };
   const tool = typeof input.tool_name === "string" ? input.tool_name : "";
-  const home = homedir();
+  const home = options.home ?? homedir();
   const roots = protectedRoots(home);
-  const orgs = resolveAllowedOrgs();
+  const orgs = resolveAllowedOrgs(process.env, home);
   if (tool === "Bash") {
     const command = getCommand(input);
     if (!command)

package/bin/serve.js

@@ -5362,7 +5362,7 @@ import { readFileSync as readFileSync5 } from "fs";
 import { dirname as dirname4, join as join8 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 
-// ../contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.2.2+944b86d8024e79fa/node_modules/@hasna/contracts/dist/client/transport.js
 import { spawnSync } from "child_process";
 import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync22 } from "fs";
 import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";