@hasna/hooks 0.10.2 → 0.10.4

package/bin/native-safety-entry.js

@@ -1,13 +1,198 @@
 // @bun
 // hooks/native-safety-entry.ts
 import { homedir as homedir2 } from "os";
-import { isAbsolute as isAbsolute3 } from "path";
+import { isAbsolute as isAbsolute4 } from "path";
 
 // hooks/hook-trash-guard/src/hook.ts
-import { dirname, isAbsolute, join, normalize, resolve, sep } from "path";
-import { readFileSync, realpathSync, statSync } from "fs";
-import { spawnSync } from "child_process";
+import { isAbsolute as isAbsolute2, join as join2, normalize, resolve as resolve2, sep } from "path";
 
+// hooks/hook-trash-guard/src/binary.ts
+import { dirname, isAbsolute, join, resolve } from "path";
+import { accessSync, closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, readlinkSync, readSync, realpathSync, statSync } from "fs";
+import { spawnSync } from "child_process";
+var BINARY_FAILURES = {
+  missing: "No verified @hasna/trash guard was found on PATH.",
+  unsafe_executable: "The Trash candidate is not an owned executable file or is writable by group or others.",
+  unsafe_manifest: "The Trash package manifest is not a safe owned regular file.",
+  unsafe_directory: "A Trash PATH or package directory is not owned safely or is writable by group or others.",
+  unsafe_interpreter: "The Trash interpreter is missing, unsupported, or not a safe owned executable on its actual PATH.",
+  unrecognized_package: "The candidate is not the registered @hasna/trash executable.",
+  identity_failed: "The installed Trash identity probe failed or exceeded its deadline.",
+  unsupported_protocol: "The installed Trash version does not expose the required guard protocol."
+};
+function trustedOwner(uid) {
+  return uid === 0 || uid === process.getuid?.();
+}
+function safeExecutableFile(path, systemBinAlias = false) {
+  let current = path;
+  for (let hop = 0;hop < 32; hop++) {
+    if (!isAbsolute(current) || current.length > 4096 || !safeBinaryDirectory("/"))
+      return false;
+    const parts = current.split("/"), name = parts.pop();
+    if (!name || name === "." || name === "..")
+      return false;
+    let parent = "/";
+    for (const part of parts) {
+      if (!part || part === ".")
+        continue;
+      if (part === "..") {
+        parent = dirname(parent);
+        continue;
+      }
+      const next = join(parent, part), info2 = lstatSync(next);
+      if (systemBinAlias && next === "/bin" && info2.isSymbolicLink() && info2.uid === 0) {
+        const target = realpathSync(next);
+        if (!safeBinaryDirectory(target))
+          return false;
+        parent = target;
+        continue;
+      }
+      if (!info2.isDirectory() || !trustedOwner(info2.uid) || info2.mode & 18)
+        return false;
+      parent = next;
+    }
+    const candidate = join(parent, name), info = lstatSync(candidate);
+    if (!trustedOwner(info.uid))
+      return false;
+    if (info.isSymbolicLink()) {
+      const target = readlinkSync(candidate);
+      current = isAbsolute(target) ? target : parent + "/" + target;
+      continue;
+    }
+    return info.isFile() && Boolean(info.mode & 73) && !(info.mode & 18);
+  }
+  return false;
+}
+function safeInterpreterSearchDirectory(path) {
+  if (!isAbsolute(path) || resolve(path) !== (path.replace(/\/+$/, "") || "/"))
+    return false;
+  for (let cursor = resolve(path);; cursor = dirname(cursor)) {
+    try {
+      lstatSync(cursor);
+      return safeBinaryDirectory(cursor);
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        return false;
+    }
+    if (dirname(cursor) === cursor)
+      return false;
+  }
+}
+function safeScriptInterpreter(executable, pathValue) {
+  const fd = openSync(executable, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  let header;
+  try {
+    if (!fstatSync(fd).isFile())
+      return false;
+    const bytes = Buffer.alloc(256), length = readSync(fd, bytes, 0, bytes.length, 0);
+    header = bytes.subarray(0, length).toString("utf8").split(`
+`)[0];
+  } finally {
+    closeSync(fd);
+  }
+  const direct = /^#!(\/[A-Za-z0-9_./-]+)$/.exec(header);
+  if (direct && direct[1] !== "/usr/bin/env")
+    return safeExecutableFile(direct[1], true);
+  if (header !== "#!/usr/bin/env bun" || !safeExecutableFile("/usr/bin/env", true))
+    return false;
+  for (const dir of pathValue.split(":").slice(0, 64)) {
+    if (!safeInterpreterSearchDirectory(dir))
+      return false;
+    const interpreter = resolve(dir, "bun");
+    try {
+      if (!statSync(interpreter).isFile())
+        continue;
+      accessSync(interpreter, constants.X_OK);
+    } catch {
+      continue;
+    }
+    return safeExecutableFile(interpreter, true);
+  }
+  return false;
+}
+function safeBinaryDirectory(path) {
+  let current = path;
+  for (;; ) {
+    const info = lstatSync(current);
+    if (!info.isDirectory() || !trustedOwner(info.uid) || (info.mode & 18) !== 0)
+      return false;
+    const parent = dirname(current);
+    if (parent === current)
+      return true;
+    current = parent;
+  }
+}
+function inspectTrashBinary(env = process.env) {
+  const pathValue = env.PATH ?? "";
+  const deadline = Date.now() + 2000;
+  let failure = "missing";
+  const reject = (code) => {
+    if (failure === "missing" || failure === "unrecognized_package" || code.startsWith("unsafe_"))
+      failure = code;
+  };
+  for (const dir of pathValue.split(":").slice(0, 64)) {
+    if (!isAbsolute(dir) || Date.now() >= deadline)
+      continue;
+    const candidate = resolve(dir, "trash");
+    try {
+      const stat = statSync(candidate);
+      if (!stat.isFile() || !trustedOwner(stat.uid) || (stat.mode & 73) === 0 || (stat.mode & 18) !== 0) {
+        reject("unsafe_executable");
+        continue;
+      }
+      const executable = realpathSync(candidate);
+      if (!safeBinaryDirectory(resolve(dir)) || !safeBinaryDirectory(dirname(executable))) {
+        reject("unsafe_directory");
+        continue;
+      }
+      if (!safeExecutableFile(candidate)) {
+        reject("unsafe_directory");
+        continue;
+      }
+      const packageRoot = resolve(dirname(executable), "../..");
+      const manifestPath = join(packageRoot, "package.json");
+      const manifestStat = statSync(manifestPath);
+      if (!manifestStat.isFile() || !trustedOwner(manifestStat.uid) || manifestStat.size > 16384 || (manifestStat.mode & 18) !== 0 || lstatSync(manifestPath).isSymbolicLink()) {
+        reject("unsafe_manifest");
+        continue;
+      }
+      const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+      if (manifest.name !== "@hasna/trash" || typeof manifest.version !== "string" || typeof manifest.bin?.trash !== "string" || realpathSync(resolve(packageRoot, manifest.bin.trash)) !== executable) {
+        reject("unrecognized_package");
+        continue;
+      }
+      try {
+        if (!safeScriptInterpreter(executable, pathValue)) {
+          reject("unsafe_interpreter");
+          continue;
+        }
+      } catch {
+        reject("unsafe_interpreter");
+        continue;
+      }
+      const probe = spawnSync(candidate, ["--identity"], {
+        encoding: "utf8",
+        timeout: Math.max(1, Math.min(500, deadline - Date.now())),
+        maxBuffer: 2048,
+        env: { PATH: pathValue },
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      if (probe.error || probe.status !== 0) {
+        reject("identity_failed");
+        continue;
+      }
+      const identity = JSON.parse(probe.stdout);
+      if (identity.name === "@hasna/trash" && identity.version === manifest.version && identity.guardProtocol === "hasna.trash.guard.v1")
+        return { ok: true, path: candidate, version: manifest.version };
+      reject("unsupported_protocol");
+    } catch {}
+  }
+  return { ok: false, code: failure };
+}
+function findTrashBinary(env = process.env) {
+  const result = inspectTrashBinary(env);
+  return result.ok ? result.path : null;
+}
 // hooks/codewith-native-common.ts
 function getCommand(input) {
   const command = input.tool_input?.command;
@@ -495,17 +680,17 @@ function rmOperands(segment, verbIndex) {
   return operands;
 }
 function handoffRoots(home) {
-  return HANDOFF_ROOTS.map((suffix) => join(home, ...suffix.split("/")));
+  return HANDOFF_ROOTS.map((suffix) => join2(home, ...suffix.split("/")));
 }
 function expandHomeSpelling(token, home) {
   if (token === "~" || token === "$HOME" || token === "${HOME}")
     return home;
   if (token.startsWith("~/"))
-    return join(home, token.slice(2));
+    return join2(home, token.slice(2));
   if (token.startsWith("$HOME/"))
-    return join(home, token.slice("$HOME/".length));
+    return join2(home, token.slice("$HOME/".length));
   if (token.startsWith("${HOME}/"))
-    return join(home, token.slice("${HOME}/".length));
+    return join2(home, token.slice("${HOME}/".length));
   return token;
 }
 function resolveLiteralTarget(raw, cwd, home) {
@@ -527,7 +712,7 @@ function resolveLiteralTarget(raw, cwd, home) {
       return null;
     decoded = expanded;
   }
-  const absolute = isAbsolute(decoded) ? normalize(decoded) : resolve(cwd, decoded);
+  const absolute = isAbsolute2(decoded) ? normalize(decoded) : resolve2(cwd, decoded);
   const trimmed = absolute.replace(/\/+$/, "");
   return trimmed === "" ? "/" : trimmed;
 }
@@ -535,7 +720,7 @@ function isUnder(target, root) {
   return target === root || target.startsWith(`${root}${sep}`);
 }
 function isScratchpadContent(target, home) {
-  const prefix = `${join(home, ".hasna", "scratchpad", "scratch")}${sep}`;
+  const prefix = `${join2(home, ".hasna", "scratchpad", "scratch")}${sep}`;
   if (!target.startsWith(prefix))
     return false;
   const [session, firstChild] = target.slice(prefix.length).split(sep);
@@ -554,7 +739,7 @@ function protectedTargetReason(target, home) {
     return root === "/" ? `\`${target}\` is the filesystem root, which is never deleted.` : `\`${target}\` is the system root \`${root}\` (or an ancestor of it), which is never deleted or trashed.`;
   }
   for (const suffix of PROTECTED_HOME_TREES) {
-    const root = join(home, suffix);
+    const root = join2(home, suffix);
     if (suffix === ".hasna" && isScratchpadContent(target, home))
       continue;
     if (!isUnder(target, root) && !isUnder(root, target))
@@ -721,42 +906,6 @@ function gitHasDryRun(segment, verbIndex) {
   const options = segment.words.slice(verbIndex + 1).map((word) => decodeWord(word.text));
   return options.includes("-n") || options.includes("--dry-run");
 }
-function findTrashBinary(env = process.env) {
-  const pathValue = env.PATH ?? "";
-  const deadline = Date.now() + 2000;
-  for (const dir of pathValue.split(":").slice(0, 64)) {
-    if (!isAbsolute(dir) || Date.now() >= deadline)
-      continue;
-    const candidate = resolve(dir, "trash");
-    try {
-      const stat = statSync(candidate);
-      if (!stat.isFile() || (stat.mode & 73) === 0 || (stat.mode & 18) !== 0)
-        continue;
-      const executable = realpathSync(candidate);
-      const packageRoot = resolve(dirname(executable), "../..");
-      const manifestPath = join(packageRoot, "package.json");
-      const manifestStat = statSync(manifestPath);
-      if (!manifestStat.isFile() || manifestStat.size > 16384 || (manifestStat.mode & 18) !== 0)
-        continue;
-      const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-      if (manifest.name !== "@hasna/trash" || typeof manifest.version !== "string" || typeof manifest.bin?.trash !== "string" || realpathSync(resolve(packageRoot, manifest.bin.trash)) !== executable)
-        continue;
-      const probe = spawnSync(candidate, ["--identity"], {
-        encoding: "utf8",
-        timeout: Math.max(1, Math.min(500, deadline - Date.now())),
-        maxBuffer: 2048,
-        env: { PATH: pathValue },
-        stdio: ["ignore", "pipe", "pipe"]
-      });
-      if (probe.error || probe.status !== 0)
-        continue;
-      const identity = JSON.parse(probe.stdout);
-      if (identity.name === "@hasna/trash" && identity.version === manifest.version && identity.guardProtocol === "hasna.trash.guard.v1")
-        return candidate;
-    } catch {}
-  }
-  return null;
-}
 function shellQuoteWord(word) {
   if (/^[A-Za-z0-9_\-./+=:,@%^]+$/.test(word))
     return word;
@@ -835,6 +984,10 @@ function allowRewrite(updatedInput) {
 }
 function resolveTrash(deps) {
   try {
+    if (deps.inspectTrash) {
+      const inspection = deps.inspectTrash();
+      return inspection.ok ? { path: inspection.path, error: null } : { path: null, error: `${inspection.code}: ${BINARY_FAILURES[inspection.code]}` };
+    }
     return { path: deps.findTrash(), error: null };
   } catch (cause) {
     return { path: null, error: cause instanceof Error ? cause.message : String(cause) };
@@ -899,26 +1052,63 @@ function evaluate(input, deps) {
 if (false) {}
 
 // hooks/hook-workspace-repos-guard/src/hook.ts
+import { closeSync as closeSync2, constants as constants2, fstatSync as fstatSync2, lstatSync as lstatSync2, openSync as openSync2, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
 import { homedir } from "os";
-import { isAbsolute as isAbsolute2, join as join2, normalize as normalize2, relative, resolve as resolve2, sep as sep2 } from "path";
+import { dirname as dirname2, isAbsolute as isAbsolute3, join as join3, normalize as normalize2, relative, resolve as resolve3, sep as sep2 } from "path";
 var FILE_WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
 var PATCH_TOOLS = new Set(["apply_patch", "ApplyPatch", "functions.apply_patch"]);
 var DEFAULT_ORGS = ["hasna", "hasnaxyz", "hasna-products"];
 var RULE = "workspace-repos-guard";
 function reposRoot(home) {
-  return join2(home, ".hasna", "repos", "clones");
+  return join3(home, ".hasna", "repos", "clones");
 }
 function legacyRoot(home) {
-  return join2(home, "workspace", "repos");
+  return join3(home, "workspace", "repos");
 }
 function protectedRoots(home) {
   return [reposRoot(home), legacyRoot(home)];
 }
-function resolveAllowedOrgs(env = process.env) {
+function allowedOrgsFile(home) {
+  return join3(home, ".hasna", "hooks", "config", "workspace-repos-guard-orgs");
+}
+var ORG_NAME = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;
+function ownedAndClosed(stat) {
+  const uid = process.getuid?.();
+  return uid !== undefined && (stat.uid === 0 || stat.uid === uid) && (stat.mode & 18) === 0;
+}
+function readAllowedOrgsFile(home) {
+  const file = allowedOrgsFile(home);
+  let text;
+  try {
+    const fd = openSync2(file, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    try {
+      const stat = fstatSync2(fd);
+      if (!stat.isFile() || !ownedAndClosed(stat) || stat.size > 4096)
+        return null;
+      text = readFileSync2(fd, "utf8");
+    } finally {
+      closeSync2(fd);
+    }
+    const top = normalize2(home);
+    for (let dir = dirname2(file);dir !== top; dir = dirname2(dir)) {
+      const stat = lstatSync2(dir);
+      if (!stat.isDirectory() || !ownedAndClosed(stat) || dir === dirname2(dir))
+        return null;
+    }
+    if (!ownedAndClosed(statSync2(top)))
+      return null;
+  } catch {
+    return null;
+  }
+  const names = text.replace(/#[^\n]*/g, "").split(/[\s,]+/).filter(Boolean);
+  return names.length > 0 && names.every((name) => ORG_NAME.test(name)) ? new Set(names) : null;
+}
+function resolveAllowedOrgs(env = process.env, home = homedir()) {
   const raw = env.WORKSPACE_REPOS_GUARD_ORGS;
-  if (typeof raw !== "string" || !raw.trim())
-    return new Set(DEFAULT_ORGS);
-  return new Set(raw.split(",").map((s) => s.trim()).filter(Boolean));
+  if (typeof raw === "string" && raw.trim()) {
+    return new Set(raw.split(",").map((s) => s.trim()).filter(Boolean));
+  }
+  return readAllowedOrgsFile(home) ?? new Set(DEFAULT_ORGS);
 }
 function classifyPath(target, root, orgs, op) {
   if (op === "read")
@@ -929,7 +1119,7 @@ function classifyPath(target, root, orgs, op) {
       return { blocked: true, reason: `[${RULE}] delete of the protected repo-checkout root is forbidden: ${root}` };
     return { blocked: true, reason: `[${RULE}] writes directly to the protected repo-checkout root are forbidden: ${root}` };
   }
-  if (rel.startsWith(`..${sep2}`) || rel === ".." || isAbsolute2(rel)) {
+  if (rel.startsWith(`..${sep2}`) || rel === ".." || isAbsolute3(rel)) {
     return { blocked: false };
   }
   const segments = rel.split(sep2).filter(Boolean);
@@ -952,6 +1142,11 @@ function classifyPath(target, root, orgs, op) {
   return { blocked: false };
 }
 var WRITE_FLAGS = /\b(?:-o|--output|-O|--output-document|-out)\b/;
+var FD_DUPLICATION = /\d*[<>]&\s*(?:\d+|-)(?=$|[\s;&|)])/g;
+var OUTPUT_REDIRECT = /(?:\d+|&)?(?:>>|>\||>&|<>|>)\s*([^\s;&|<>()\x60]*)/g;
+function withoutFdDuplication(segment) {
+  return segment.replace(FD_DUPLICATION, " ");
+}
 function segmentOperation(segment) {
   const trimmed = segment.trim();
   if (!trimmed)
@@ -980,7 +1175,7 @@ function segmentOperation(segment) {
   } else if (/(?:^|\s)(?:python3?|node|bun)\b[^;&|]*\s+-[ce](?:\s|$)/.test(trimmed)) {
     return "write";
   }
-  if (/(?:^|[;&|])\s*echo\b/.test(trimmed) || /[>&]/.test(trimmed))
+  if (/(?:^|[;&|])\s*echo\b/.test(trimmed) || />/.test(withoutFdDuplication(trimmed)))
     return "write";
   return "read";
 }
@@ -994,13 +1189,13 @@ function expandHomeSpelling2(token, home) {
   if (body === "~")
     return home;
   if (body.startsWith("~/"))
-    return join2(home, body.slice(2));
+    return join3(home, body.slice(2));
   if (body === "$HOME" || body === "${HOME}")
     return home;
   if (body.startsWith("$HOME/"))
-    return join2(home, body.slice("$HOME/".length));
+    return join3(home, body.slice("$HOME/".length));
   if (body.startsWith("${HOME}/"))
-    return join2(home, body.slice("${HOME}/".length));
+    return join3(home, body.slice("${HOME}/".length));
   const homeMatch = body.match(new RegExp(`^"*${regexEscape(home)}"*/`));
   if (homeMatch)
     return home + "/" + body.slice(homeMatch[0].length);
@@ -1017,22 +1212,51 @@ function unwrapSegment(segment) {
 function regexEscape(text) {
   return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function cdDestinations(operand, bases, home) {
+  if (operand === undefined)
+    return [home];
+  let word = expandHomeSpelling2(operand, home);
+  const quoted = word.match(/^(['"])(.*)\1$/);
+  if (quoted)
+    word = quoted[2];
+  if (!word || word === "-" || /[$\x60*?[\]{}~\\'"]/.test(word))
+    return null;
+  return [...new Set(bases.map((base) => resolve3(base, word)))];
+}
+var REL_OPERAND = /(?:^|\s)(\.\.?|[^\s"';&|<>()\x60/]+(?:\/[^\s"';&|<>()\x60]*)?)\s*$/;
 function bashTargets(command, home, cwd) {
   if (!command)
     return [];
   const roots = protectedRoots(home);
-  const segments = command.split(/\s*&&\s*|\s*\|\|\s*|;\s*|\n+/);
+  const underRoot = (path) => roots.some((root) => path === root || path.startsWith(`${root}${sep2}`));
+  const parts = command.split(/(\s*&&\s*|\s*\|\|\s*|;\s*|\n+)/);
   const targets = [];
-  let cwdUnderRepos = null;
-  for (const rawSegment of segments) {
+  let current = [cwd];
+  let reachable = new Set([cwd]);
+  let certain = true;
+  const subshells = [];
+  for (let index = 0;index < parts.length; index += 2) {
+    const separator = index === 0 ? "" : parts[index - 1].trim();
+    if (separator === "||")
+      certain = false;
+    else if (separator !== "&&")
+      certain = true;
+    if (separator !== "&&" || !certain)
+      current = [...reachable];
+    const rawSegment = parts[index];
+    const opens = (rawSegment.match(/^[\s({]*/)?.[0].match(/\(/g) ?? []).length;
+    const closes = (rawSegment.match(/[\s)}]*$/)?.[0].match(/\)/g) ?? []).length;
+    for (let i = 0;i < opens; i++)
+      subshells.push({ current: [...current], reachable: new Set(reachable), certain });
     const segment = unwrapSegment(rawSegment);
     const op = segmentOperation(segment);
-    const cdMatch = segment.match(/(?:^|\s)cd(?:\s+(?:-[A-Za-z]+|--))*\s+([^\s;&|<>()\x60]+)/);
-    if (cdMatch) {
-      const cdTarget = expandHomeSpelling2(cdMatch[1], home);
-      if (cdTarget && roots.some((root) => cdTarget === root || cdTarget.startsWith(`${root}${sep2}`))) {
-        cwdUnderRepos = cdTarget;
-      }
+    const plainCd = segment.match(/^cd(?:\s+(?:-[A-Za-z@]+|--))*(?:\s+([^\s;&|<>()\x60]+))?$/);
+    const embeddedCd = plainCd ? null : segment.match(/(?:^|\s)cd(?:\s+(?:-[A-Za-z]+|--))*\s+([^\s;&|<>()\x60]+)/);
+    if (embeddedCd) {
+      for (const dir of cdDestinations(embeddedCd[1], current, home) ?? [])
+        reachable.add(dir);
+      certain = false;
+      current = [...reachable];
     }
     const homeLiteral = regexEscape(home);
     const suffix = roots.map((root) => regexEscape(root.slice(home.length + 1))).join("|");
@@ -1046,14 +1270,35 @@ function bashTargets(command, home, cwd) {
       targets.push({ path: normalize2(expanded).replace(/\/+$/, ""), op });
     }
     if (!foundExplicit && (op === "delete" || op === "write")) {
-      const base = cwdUnderRepos ?? (roots.some((root) => cwd === root || cwd.startsWith(`${root}${sep2}`)) ? cwd : null);
-      if (base) {
-        const relMatch = segment.match(/(?:^|\s)(\.\.?|[^\s"';&|<>()\x60/]+(?:\/[^\s"';&|<>()\x60]*)?)\s*$/);
-        if (relMatch) {
-          targets.push({ path: normalize2(resolve2(base, relMatch[1])), op });
+      const operands = [];
+      const commandPart = withoutFdDuplication(segment).replace(OUTPUT_REDIRECT, (_match, operand) => {
+        if (operand)
+          operands.push(operand);
+        return " ";
+      });
+      const commandOp = segmentOperation(commandPart);
+      const relMatch = commandOp === "read" ? null : commandPart.match(REL_OPERAND);
+      for (const base of current.filter(underRoot)) {
+        for (const operand of operands) {
+          targets.push({ path: normalize2(resolve3(base, expandHomeSpelling2(operand, home))), op: "write" });
         }
+        if (relMatch)
+          targets.push({ path: normalize2(resolve3(base, relMatch[1])), op: commandOp });
+      }
+    }
+    if (plainCd) {
+      const next = cdDestinations(plainCd[1], current, home);
+      if (next) {
+        for (const dir of next)
+          reachable.add(dir);
+        if (certain)
+          current = next;
+      } else {
+        certain = false;
       }
     }
+    for (let i = 0;i < closes && subshells.length > 0; i++)
+      ({ current, reachable, certain } = subshells.pop());
   }
   return targets;
 }
@@ -1063,18 +1308,18 @@ function patchTargets(patch, cwd) {
   let m;
   while ((m = PATCH_FILE_RE.exec(patch)) !== null) {
     const op = m[1] === "Delete File" ? "delete" : "write";
-    targets.push({ path: normalize2(resolve2(cwd, m[2])), op });
+    targets.push({ path: normalize2(resolve3(cwd, m[2])), op });
   }
   return targets;
 }
-function evaluate2(input) {
+function evaluate2(input, options = {}) {
   const warnings = [];
   if (input.hook_event_name !== "PreToolUse")
     return { output: { continue: true }, warnings };
   const tool = typeof input.tool_name === "string" ? input.tool_name : "";
-  const home = homedir();
+  const home = options.home ?? homedir();
   const roots = protectedRoots(home);
-  const orgs = resolveAllowedOrgs();
+  const orgs = resolveAllowedOrgs(process.env, home);
   if (tool === "Bash") {
     const command = getCommand(input);
     if (!command)
@@ -1114,7 +1359,7 @@ function evaluate2(input) {
   if (!raw)
     return { output: { continue: true }, warnings };
   const expanded = expandHomeSpelling2(raw, home);
-  const target = isAbsolute2(expanded) ? normalize2(expanded) : resolve2(cwd, expanded);
+  const target = isAbsolute3(expanded) ? normalize2(expanded) : resolve3(cwd, expanded);
   for (const root of roots) {
     const verdict = classifyPath(target, root, orgs, "write");
     if (verdict.blocked) {
@@ -1130,7 +1375,7 @@ var name = process.argv[1];
 if (name !== "trash-guard" && name !== "workspace-repos-guard")
   throw new Error("Invalid safety capability");
 var input = JSON.parse(await Bun.stdin.text());
-if (!input || Array.isArray(input) || input.hook_event_name !== "PreToolUse" || typeof input.tool_name !== "string" || !input.tool_input || typeof input.tool_input !== "object" || Array.isArray(input.tool_input) || typeof input.cwd !== "string" || !isAbsolute3(input.cwd))
+if (!input || Array.isArray(input) || input.hook_event_name !== "PreToolUse" || typeof input.tool_name !== "string" || !input.tool_input || typeof input.tool_input !== "object" || Array.isArray(input.tool_input) || typeof input.cwd !== "string" || !isAbsolute4(input.cwd))
   throw new Error("Invalid safety input");
 if (input.tool_name === "Bash" && typeof input.tool_input.command !== "string")
   throw new Error("Invalid shell input");
@@ -1144,5 +1389,5 @@ if (["apply_patch", "ApplyPatch", "functions.apply_patch"].includes(input.tool_n
 }
 var repos = evaluate2(input).output;
 var handoff = input.tool_name === "Bash" && scanCommand(input.tool_input.command, { home: homedir2(), cwd: input.cwd }).handoffHits.length > 0;
-var verdict = repos.decision === "block" ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: repos.reason } } : handoff ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "[workspace-repos-guard] Deletion under a protected repository checkout is refused." } } : name === "trash-guard" ? evaluate(input, { home: homedir2(), cwd: input.cwd, findTrash: findTrashBinary }) : { continue: true };
+var verdict = repos.decision === "block" ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: repos.reason } } : handoff ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "[workspace-repos-guard] Deletion under a protected repository checkout is refused." } } : name === "trash-guard" ? evaluate(input, { home: homedir2(), cwd: input.cwd, findTrash: findTrashBinary, inspectTrash: inspectTrashBinary }) : { continue: true };
 process.stdout.write(JSON.stringify({ verdict: "continue" in verdict ? null : verdict }));

package/bin/serve.js

@@ -676,7 +676,7 @@ function getHook(name) {
 import { existsSync as existsSync2, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "fs";
 import { basename, dirname, isAbsolute, join as join3, normalize, resolve as resolve2, sep } from "path";
 
-// ../hooks0102-standalone-lock/node_modules/zod/v3/external.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
   void: () => voidType,
@@ -788,7 +788,7 @@ __export(exports_external, {
   BRAND: () => BRAND
 });
 
-// ../hooks0102-standalone-lock/node_modules/zod/v3/helpers/util.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
   util2.assertEqual = (_) => {};
@@ -919,7 +919,7 @@ var getParsedType = (data) => {
   }
 };
 
-// ../hooks0102-standalone-lock/node_modules/zod/v3/ZodError.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode = util.arrayToEnum([
   "invalid_type",
   "invalid_literal",
@@ -1038,7 +1038,7 @@ ZodError.create = (issues) => {
   return error;
 };
 
-// ../hooks0102-standalone-lock/node_modules/zod/v3/locales/en.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -1141,7 +1141,7 @@ var errorMap = (issue, _ctx) => {
 };
 var en_default = errorMap;
 
-// ../hooks0102-standalone-lock/node_modules/zod/v3/errors.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
 var overrideErrorMap = en_default;
 function setErrorMap(map) {
   overrideErrorMap = map;
@@ -1149,7 +1149,7 @@ function setErrorMap(map) {
 function getErrorMap() {
   return overrideErrorMap;
 }
-// ../hooks0102-standalone-lock/node_modules/zod/v3/helpers/parseUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
   const { data, path, errorMaps, issueData } = params;
   const fullPath = [...path, ...issueData.path || []];
@@ -1255,14 +1255,14 @@ var isAborted = (x) => x.status === "aborted";
 var isDirty = (x) => x.status === "dirty";
 var isValid = (x) => x.status === "valid";
 var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
-// ../hooks0102-standalone-lock/node_modules/zod/v3/helpers/errorUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
   errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
   errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
 })(errorUtil || (errorUtil = {}));
 
-// ../hooks0102-standalone-lock/node_modules/zod/v3/types.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
 class ParseInputLazyPath {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -5362,7 +5362,7 @@ import { readFileSync as readFileSync5 } from "fs";
 import { dirname as dirname4, join as join8 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 
-// ../hooks0102-standalone-lock/node_modules/@hasna/contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.2.2+944b86d8024e79fa/node_modules/@hasna/contracts/dist/client/transport.js
 import { spawnSync } from "child_process";
 import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync22 } from "fs";
 import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";