@hasna/hooks 0.10.2 → 0.10.4

package/dist/index.js

@@ -581,7 +581,7 @@ var init_redact = __esm(() => {
   ];
 });
 
-// ../hooks0102-standalone-lock/node_modules/zod/v3/helpers/util.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType = (data) => {
   const t = typeof data;
   switch (t) {
@@ -712,7 +712,7 @@ var init_util = __esm(() => {
   ]);
 });
 
-// ../hooks0102-standalone-lock/node_modules/zod/v3/ZodError.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode, quotelessJson = (obj) => {
   const json = JSON.stringify(obj, null, 2);
   return json.replace(/"([^"]+)":/g, "$1:");
@@ -833,7 +833,7 @@ var init_ZodError = __esm(() => {
   };
 });
 
-// ../hooks0102-standalone-lock/node_modules/zod/v3/locales/en.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -940,7 +940,7 @@ var init_en = __esm(() => {
   en_default = errorMap;
 });
 
-// ../hooks0102-standalone-lock/node_modules/zod/v3/errors.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
 function setErrorMap(map) {
   overrideErrorMap = map;
 }
@@ -953,7 +953,7 @@ var init_errors = __esm(() => {
   overrideErrorMap = en_default;
 });
 
-// ../hooks0102-standalone-lock/node_modules/zod/v3/helpers/parseUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 function addIssueToContext(ctx, issueData) {
   const overrideMap = getErrorMap();
   const issue = makeIssue({
@@ -1058,10 +1058,10 @@ var init_parseUtil = __esm(() => {
   });
 });
 
-// ../hooks0102-standalone-lock/node_modules/zod/v3/helpers/typeAliases.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/typeAliases.js
 var init_typeAliases = () => {};
 
-// ../hooks0102-standalone-lock/node_modules/zod/v3/helpers/errorUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 var init_errorUtil = __esm(() => {
   (function(errorUtil2) {
@@ -1070,7 +1070,7 @@ var init_errorUtil = __esm(() => {
   })(errorUtil || (errorUtil = {}));
 });
 
-// ../hooks0102-standalone-lock/node_modules/zod/v3/types.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
 class ParseInputLazyPath {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -4421,7 +4421,7 @@ var init_types = __esm(() => {
   NEVER = INVALID;
 });
 
-// ../hooks0102-standalone-lock/node_modules/zod/v3/external.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
   void: () => voidType,
@@ -4541,7 +4541,7 @@ var init_external = __esm(() => {
   init_ZodError();
 });
 
-// ../hooks0102-standalone-lock/node_modules/zod/index.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/index.js
 var init_zod = __esm(() => {
   init_external();
   init_external();
@@ -5101,7 +5101,7 @@ var init_profiles = __esm(() => {
   init_app_home();
 });
 
-// ../hooks0102-standalone-lock/node_modules/@hasna/contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.2.2+944b86d8024e79fa/node_modules/@hasna/contracts/dist/client/transport.js
 import { isIP } from "net";
 import { spawnSync } from "child_process";
 import { closeSync as closeSync22, fstatSync as fstatSync22, openSync as openSync22, readFileSync as readFileSync22 } from "fs";
@@ -7719,6 +7719,9 @@ function buildNativeSafetyCommand(binding) {
   return prefix + [encoded, binding.runtime, binding.home, binding.path].map(quote).join(" ");
 }
 function nativeSafetyRegistration(command) {
+  return nativeSafetyCommandBinding(command)?.name;
+}
+function nativeSafetyCommandBinding(command) {
   if (!command.startsWith(prefix))
     return;
   const encoded = command.slice(prefix.length).match(/^'([A-Za-z0-9_-]+)' /)?.[1];
@@ -7726,7 +7729,7 @@ function nativeSafetyRegistration(command) {
     return;
   try {
     const binding = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
-    return buildNativeSafetyCommand(binding) === command ? binding.name : undefined;
+    return buildNativeSafetyCommand(binding) === command ? binding : undefined;
   } catch {
     return;
   }
@@ -7920,7 +7923,7 @@ function writeCodexSettings(path, settings) {
 // src/lib/claude-skills-coordination.ts
 import { createHash as createHash5 } from "crypto";
 
-// ../hooks0102-standalone-lock/node_modules/@hasna/skills/dist/index.js
+// ../../node_modules/.bun/@hasna+skills@0.9.14+a00d3064559565bb/node_modules/@hasna/skills/dist/index.js
 import { existsSync as existsSync9 } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join8, resolve as resolve3 } from "path";

package/dist/lib/native-safety.d.ts

@@ -11,5 +11,6 @@ export interface NativeSafetyBinding {
 export declare function isNativeSafetyName(name: string): name is NativeSafetyName;
 export declare function buildNativeSafetyCommand(binding: NativeSafetyBinding): string;
 export declare function nativeSafetyRegistration(command: string): NativeSafetyName | undefined;
+export declare function nativeSafetyCommandBinding(command: string): NativeSafetyBinding | undefined;
 /** Built-in capability only: no registry, custom source, profile or app store. */
 export declare function installedNativeSafetyCommand(name: NativeSafetyName): string;

package/dist/native-safety.d.ts

@@ -0,0 +1,58 @@
+export declare class NativeSafetyError extends Error {
+    readonly code: "binding_missing" | "binding_invalid" | "binding_changed" | "binding_busy" | "guard_failed" | "input_invalid";
+    readonly reason?: string | undefined;
+    constructor(code: "binding_missing" | "binding_invalid" | "binding_changed" | "binding_busy" | "guard_failed" | "input_invalid", reason?: string | undefined);
+}
+export type NativeSafetyEvent = {
+    hook_event_name: "PreToolUse";
+    tool_name: "Bash" | "apply_patch";
+    cwd: string;
+    session_id?: string;
+    tool_input: Record<string, unknown>;
+};
+export type NativeSafetyDecision = {
+    decision: "continue";
+} | {
+    decision: "deny";
+    reason: string;
+} | {
+    decision: "rewrite";
+    command: string;
+};
+export type NativeSafetyRecord = {
+    schema: "hasna.hooks.native-safety.v1";
+    harness: "sumi";
+    command: string;
+};
+export declare function readNativeSafetyRegistration(home?: string): {
+    record: NativeSafetyRecord;
+    sha256: string;
+    path: string;
+};
+/** Register only the bundled composite guard. Updates preserve the exact prior
+ * record and require its digest. A lock coordinates package-owned writers; an
+ * unexpected preimage or a retained interrupted lock requires reconciliation. */
+export declare function registerNativeSafety(options?: {
+    home?: string;
+    expectedSHA256?: string;
+    command?: string;
+}): {
+    ok: true;
+    changed: boolean;
+    path: string;
+    sha256: string;
+};
+/** A bounded supervisor subprocess evaluates data only; it never runs the
+ * requested shell command. AbortSignal targets this newly created child. */
+export declare function evaluateNativeSafety(event: NativeSafetyEvent, options?: {
+    home?: string;
+    signal?: AbortSignal;
+}): Promise<NativeSafetyDecision>;
+/** Classify a synthetic removal through this exact supervisor without executing
+ * the returned command or creating a file. A harmless ':' would not test whether
+ * the saved PATH can actually resolve Trash. */
+export declare function verifyNativeSafetyCommand(command: string, home?: string): Promise<void>;
+export declare function verifyNativeSafetyRegistration(home?: string): Promise<{
+    path: string;
+    sha256: string;
+}>;

package/dist/native-safety.js

@@ -0,0 +1,363 @@
+// @bun
+// src/native-safety.ts
+import { execFile } from "child_process";
+import { createHash as createHash2, randomUUID } from "crypto";
+import { closeSync as closeSync2, constants as constants2, existsSync as existsSync2, fstatSync as fstatSync2, fsyncSync, linkSync, lstatSync as lstatSync2, mkdirSync, openSync as openSync2, readFileSync as readFileSync2, realpathSync as realpathSync2, renameSync, unlinkSync, writeFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2, resolve } from "path";
+
+// src/lib/native-safety.ts
+import { createHash } from "crypto";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, openSync, readFileSync, realpathSync } from "fs";
+import { dirname, isAbsolute, join } from "path";
+import { homedir } from "os";
+function isNativeSafetyName(name) {
+  return name === "trash-guard" || name === "workspace-repos-guard";
+}
+var supervisorSource = String.raw`async function supervise(encoded) {
+  const fs = require("node:fs");
+  const path = require("node:path");
+  const crypto = require("node:crypto");
+  const cp = require("node:child_process");
+  const fail = () => { process.stderr.write("Native safety guard refused: verification or execution failed.\n"); process.exit(2); };
+  try {
+    const b = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    const check = (file, hash, maximum) => {
+      if (!path.isAbsolute(file) || fs.realpathSync(file) !== file) throw Error();
+      for (let parent = path.dirname(file);;) {
+        const s = fs.lstatSync(parent);
+        if (!s.isDirectory() || ![0, process.getuid()].includes(s.uid) || (s.mode & 0o022)) throw Error();
+        if (parent === path.dirname(parent)) break;
+        parent = path.dirname(parent);
+      }
+      const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+      try {
+        const s = fs.fstatSync(fd);
+        if (!s.isFile() || ![0, process.getuid()].includes(s.uid) || (s.mode & 0o022) || s.size > maximum) throw Error();
+        const bytes = fs.readFileSync(fd);
+        if (crypto.createHash("sha256").update(bytes).digest("hex") !== hash) throw Error();
+        return bytes;
+      } finally { fs.closeSync(fd); }
+    };
+    check(b.runtime, b.runtimeSHA256, 200_000_000);
+    const bytes = check(b.worker, b.workerSHA256, 256_000);
+    const deadline = setTimeout(fail, 1500);
+    const chunks = []; let size = 0;
+    for await (const chunk of process.stdin) {
+      size += chunk.length;
+      if (size > 1_048_576) throw Error();
+      chunks.push(chunk);
+    }
+    clearTimeout(deadline);
+    const input = Buffer.concat(chunks);
+    const child = cp.spawnSync(b.runtime, ["--config=/dev/null", "--no-env-file", "--no-macros", "--no-install", "--eval", bytes.toString("utf8"), b.name], {
+      input, env: { HOME: b.home, PATH: b.path }, cwd: "/", timeout: 2500, killSignal: "SIGKILL", maxBuffer: 1_048_576,
+    });
+    if (child.error || child.status !== 0 || child.signal || child.stderr.length) throw Error();
+    const result = JSON.parse(child.stdout.toString("utf8"));
+    if (!result || Array.isArray(result) || Object.keys(result).length !== 1) throw Error();
+    if (result.verdict === null) return;
+    const output = result.verdict?.hookSpecificOutput;
+    if (!output || Object.keys(result.verdict).length !== 1 || output.hookEventName !== "PreToolUse") throw Error();
+    if (output.permissionDecision === "deny") {
+      if (Object.keys(output).sort().join() !== "hookEventName,permissionDecision,permissionDecisionReason" || typeof output.permissionDecisionReason !== "string" || !output.permissionDecisionReason.trim()) throw Error();
+    } else if (output.permissionDecision === "allow") {
+      if (b.name !== "trash-guard" || Object.keys(output).sort().join() !== "hookEventName,permissionDecision,updatedInput" || !output.updatedInput || typeof output.updatedInput.command !== "string" || !output.updatedInput.command.trim()) throw Error();
+    } else throw Error();
+    process.stdout.write(JSON.stringify(result.verdict));
+  } catch { fail(); }
+}`;
+var quote = (value) => "'" + value.replaceAll("'", "'\\''") + "'";
+var program = `(${supervisorSource})(process.argv[1]);`;
+var shell = `cd / || exit 2
+exec 3<&0 || exit 2
+/usr/bin/env -i HOME="$3" PATH="$4" "$2" --config=/dev/null --no-env-file --no-macros --no-install --eval ${quote(program)} "$1" <&3 3<&- 2>/dev/null &
+runner=$!
+exec 3<&-
+(trap 'kill "$sleeper" 2>/dev/null; exit 0' TERM; /bin/sleep 6 & sleeper=$!; wait "$sleeper"; kill -KILL "$runner" 2>/dev/null) &
+watchdog=$!
+wait "$runner"; result=$?
+kill "$watchdog" 2>/dev/null; wait "$watchdog" 2>/dev/null
+if [ "$result" -ne 0 ]; then printf '%s\\n' 'Native safety guard refused: verification or execution failed.' >&2; exit 2; fi`;
+var prefix = `/usr/bin/env -i /bin/sh -c ${quote(shell)} hasna-native-safety-v1 `;
+function validateBinding(b) {
+  if (!b || !isNativeSafetyName(b.name) || ![b.runtime, b.worker, b.home].every((p) => typeof p === "string" && isAbsolute(p) && !/[\0\r\n]/.test(p)) || ![b.runtimeSHA256, b.workerSHA256].every((h) => /^[0-9a-f]{64}$/.test(h)) || typeof b.path !== "string" || b.path.split(":").some((p) => !isAbsolute(p) || /[\0\r\n]/.test(p)))
+    throw new Error("Invalid native safety binding");
+}
+function buildNativeSafetyCommand(binding) {
+  validateBinding(binding);
+  const encoded = Buffer.from(JSON.stringify(binding)).toString("base64url");
+  return prefix + [encoded, binding.runtime, binding.home, binding.path].map(quote).join(" ");
+}
+function nativeSafetyCommandBinding(command) {
+  if (!command.startsWith(prefix))
+    return;
+  const encoded = command.slice(prefix.length).match(/^'([A-Za-z0-9_-]+)' /)?.[1];
+  if (!encoded || encoded.length > 16384)
+    return;
+  try {
+    const binding = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    return buildNativeSafetyCommand(binding) === command ? binding : undefined;
+  } catch {
+    return;
+  }
+}
+function pinEligibleFile(file, maximum, executable = false) {
+  if (!isAbsolute(file) || realpathSync(file) !== file)
+    throw new Error("Native safety requires canonical files");
+  for (let parent = dirname(file);; ) {
+    const s = lstatSync(parent);
+    if (!s.isDirectory() || ![0, process.getuid()].includes(s.uid) || s.mode & 18)
+      throw new Error("Native safety requires trusted, non-writable file ancestry");
+    if (parent === dirname(parent))
+      break;
+    parent = dirname(parent);
+  }
+  const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const s = fstatSync(fd);
+    if (!s.isFile() || ![0, process.getuid()].includes(s.uid) || s.mode & 18 || s.size > maximum || executable && !(s.mode & 64))
+      throw new Error("Native safety requires an eligible installed file");
+    const bytes = readFileSync(fd);
+    if (bytes.length > maximum)
+      throw new Error("Native safety file exceeds its bound");
+    return createHash("sha256").update(bytes).digest("hex");
+  } finally {
+    closeSync(fd);
+  }
+}
+function installedNativeSafetyCommand(name) {
+  const home = realpathSync(homedir());
+  const runtime = realpathSync(process.execPath);
+  const candidates = [join(import.meta.dir, "../../bin/native-safety-entry.js"), join(import.meta.dir, "../bin/native-safety-entry.js"), join(import.meta.dir, "native-safety-entry.js")];
+  const worker = candidates.find(existsSync);
+  if (!worker)
+    throw new Error("Bundled native safety runner is missing; build or reinstall @hasna/hooks before installing its guards.");
+  const canonicalWorker = realpathSync(worker);
+  return buildNativeSafetyCommand({ name, runtime, runtimeSHA256: pinEligibleFile(runtime, 200000000, true), worker: canonicalWorker, workerSHA256: pinEligibleFile(canonicalWorker, 256000), home, path: `${dirname(runtime)}:${join(home, ".bun/bin")}:/usr/local/bin:/usr/bin:/bin` });
+}
+
+// src/native-safety.ts
+class NativeSafetyError extends Error {
+  code;
+  reason;
+  constructor(code, reason) {
+    super(`Native deletion safety refused (${code}). Run the reviewed Hooks safety setup before using shell or patch tools.`);
+    this.code = code;
+    this.reason = reason;
+    this.name = "NativeSafetyError";
+  }
+}
+var hash = (value) => createHash2("sha256").update(value).digest("hex");
+var filename = "sumi-trash-guard.json";
+var owner = (uid) => uid === 0 || uid === process.getuid?.();
+function safeDirectory(path) {
+  for (let cursor = path;; cursor = dirname2(cursor)) {
+    const stat = lstatSync2(cursor);
+    if (!stat.isDirectory() || !owner(stat.uid) || stat.mode & 18)
+      throw new NativeSafetyError("binding_invalid");
+    if (dirname2(cursor) === cursor)
+      return;
+  }
+}
+function canonicalHome(home) {
+  if (!isAbsolute2(home) || home.includes("\x00") || realpathSync2(home) !== resolve(home))
+    throw new NativeSafetyError("binding_invalid");
+  safeDirectory(home);
+  return resolve(home);
+}
+function readOwned(path) {
+  safeDirectory(dirname2(path));
+  const fd = openSync2(path, constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK);
+  try {
+    const stat = fstatSync2(fd);
+    if (!stat.isFile() || !owner(stat.uid) || stat.mode & 63 || stat.size > 32768)
+      throw new NativeSafetyError("binding_invalid");
+    const value = readFileSync2(fd, "utf8");
+    if (Buffer.byteLength(value) > 32768)
+      throw new NativeSafetyError("binding_invalid");
+    return value;
+  } finally {
+    closeSync2(fd);
+  }
+}
+function parseRecord(text, home) {
+  const record = JSON.parse(text);
+  if (!record || Array.isArray(record) || Object.keys(record).sort().join() !== "command,harness,schema" || record.schema !== "hasna.hooks.native-safety.v1" || record.harness !== "sumi" || typeof record.command !== "string")
+    throw new NativeSafetyError("binding_invalid");
+  const binding = nativeSafetyCommandBinding(record.command);
+  if (binding?.name !== "trash-guard" || binding.home !== home)
+    throw new NativeSafetyError("binding_invalid");
+  return record;
+}
+function syncDirectory(path) {
+  const fd = openSync2(path, constants2.O_RDONLY | constants2.O_DIRECTORY | constants2.O_NOFOLLOW);
+  try {
+    fsyncSync(fd);
+  } finally {
+    closeSync2(fd);
+  }
+}
+function readNativeSafetyRegistration(home = homedir2()) {
+  try {
+    home = canonicalHome(home);
+    const path = join2(home, ".hasna/hooks/native", filename), text = readOwned(path);
+    return { record: parseRecord(text, home), sha256: hash(text), path };
+  } catch (error) {
+    if (error instanceof NativeSafetyError)
+      throw error;
+    throw new NativeSafetyError(error?.code === "ENOENT" ? "binding_missing" : "binding_invalid");
+  }
+}
+function registerNativeSafety(options = {}) {
+  const home = canonicalHome(options.home ?? homedir2());
+  const record = { schema: "hasna.hooks.native-safety.v1", harness: "sumi", command: options.command ?? installedNativeSafetyCommand("trash-guard") };
+  const text = JSON.stringify(record) + `
+`;
+  parseRecord(text, home);
+  for (const dir of [join2(home, ".hasna"), join2(home, ".hasna/hooks"), join2(home, ".hasna/hooks/native")]) {
+    try {
+      mkdirSync(dir, { mode: 448 });
+      syncDirectory(dirname2(dir));
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+    }
+    safeDirectory(dir);
+  }
+  const directory = join2(home, ".hasna/hooks/native"), path = join2(directory, filename), lock = path + ".lock";
+  let lockFD;
+  try {
+    lockFD = openSync2(lock, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY, 384);
+  } catch {
+    throw new NativeSafetyError("binding_busy");
+  }
+  const lockIdentity = fstatSync2(lockFD);
+  let temporaryIdentity;
+  const temporary = join2(directory, `.${filename}.${randomUUID()}`);
+  try {
+    writeFileSync(lockFD, JSON.stringify({ pid: process.pid, expectedSHA256: options.expectedSHA256 ?? "absent" }));
+    fsyncSync(lockFD);
+    syncDirectory(directory);
+    let before;
+    try {
+      before = readNativeSafetyRegistration(home);
+    } catch (error) {
+      if (!(error instanceof NativeSafetyError) || error.code !== "binding_missing")
+        throw error;
+    }
+    if (before?.sha256 === hash(text))
+      return { ok: true, changed: false, path, sha256: before.sha256 };
+    if (before ? options.expectedSHA256 !== before.sha256 : options.expectedSHA256 !== undefined && options.expectedSHA256 !== "absent")
+      throw new NativeSafetyError("binding_changed");
+    if (before) {
+      const backup = path + ".before-" + before.sha256;
+      if (existsSync2(backup)) {
+        if (hash(readOwned(backup)) !== before.sha256)
+          throw new NativeSafetyError("binding_changed");
+      } else {
+        const original = readOwned(path);
+        if (hash(original) !== before.sha256)
+          throw new NativeSafetyError("binding_changed");
+        const fd2 = openSync2(backup, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY, 384);
+        try {
+          writeFileSync(fd2, original);
+          fsyncSync(fd2);
+        } finally {
+          closeSync2(fd2);
+        }
+        syncDirectory(directory);
+      }
+    }
+    const fd = openSync2(temporary, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY, 384);
+    try {
+      temporaryIdentity = fstatSync2(fd);
+      writeFileSync(fd, text);
+      fsyncSync(fd);
+    } finally {
+      closeSync2(fd);
+    }
+    if (before) {
+      if (hash(readOwned(path)) !== before.sha256)
+        throw new NativeSafetyError("binding_changed");
+      renameSync(temporary, path);
+    } else {
+      linkSync(temporary, path);
+      unlinkSync(temporary);
+    }
+    syncDirectory(directory);
+    const after = readNativeSafetyRegistration(home);
+    if (after.sha256 !== hash(text))
+      throw new NativeSafetyError("binding_changed");
+    return { ok: true, changed: true, path, sha256: after.sha256 };
+  } finally {
+    closeSync2(lockFD);
+    const currentTemporary = lstatSync2(temporary, { throwIfNoEntry: false });
+    if (temporaryIdentity && currentTemporary?.dev === temporaryIdentity.dev && currentTemporary.ino === temporaryIdentity.ino)
+      unlinkSync(temporary);
+    const currentLock = lstatSync2(lock, { throwIfNoEntry: false });
+    if (currentLock?.dev !== lockIdentity.dev || currentLock.ino !== lockIdentity.ino)
+      throw new NativeSafetyError("binding_changed");
+    unlinkSync(lock);
+    syncDirectory(directory);
+  }
+}
+async function evaluateNativeSafety(event, options = {}) {
+  return evaluateRecord(event, readNativeSafetyRegistration(options.home).record, options.signal);
+}
+async function evaluateRecord(event, record, signal) {
+  if (!event || event.hook_event_name !== "PreToolUse" || !["Bash", "apply_patch"].includes(event.tool_name) || typeof event.cwd !== "string" || !isAbsolute2(event.cwd) || !event.tool_input || typeof event.tool_input !== "object" || Array.isArray(event.tool_input))
+    throw new NativeSafetyError("input_invalid");
+  const input = JSON.stringify(event);
+  if (Buffer.byteLength(input) > 1048576)
+    throw new NativeSafetyError("input_invalid");
+  const output = await new Promise((accept, reject) => {
+    const child = execFile("/bin/sh", ["-c", record.command], { cwd: "/", env: {}, encoding: "utf8", timeout: 8000, maxBuffer: 1048576, signal }, (error, stdout, stderr) => {
+      if (error || stderr) {
+        reject(new NativeSafetyError("guard_failed"));
+        return;
+      }
+      accept(stdout);
+    });
+    child.stdin?.on("error", () => {});
+    child.stdin?.end(input);
+  });
+  if (!output)
+    return { decision: "continue" };
+  try {
+    const value = JSON.parse(output);
+    if (Object.keys(value).join() !== "hookSpecificOutput")
+      throw new Error;
+    const verdict = value.hookSpecificOutput;
+    if (verdict.hookEventName !== "PreToolUse")
+      throw new Error;
+    if (verdict.permissionDecision === "deny" && Object.keys(verdict).sort().join() === "hookEventName,permissionDecision,permissionDecisionReason" && typeof verdict.permissionDecisionReason === "string" && verdict.permissionDecisionReason.trim())
+      return { decision: "deny", reason: verdict.permissionDecisionReason };
+    if (event.tool_name === "Bash" && verdict.permissionDecision === "allow" && Object.keys(verdict).sort().join() === "hookEventName,permissionDecision,updatedInput" && typeof verdict.updatedInput?.command === "string" && verdict.updatedInput.command.trim())
+      return { decision: "rewrite", command: verdict.updatedInput.command };
+  } catch {}
+  throw new NativeSafetyError("guard_failed");
+}
+async function verifyNativeSafetyCommand(command, home = homedir2()) {
+  home = canonicalHome(home);
+  const record = parseRecord(JSON.stringify({ schema: "hasna.hooks.native-safety.v1", harness: "sumi", command }), home);
+  const verdict = await evaluateRecord({ hook_event_name: "PreToolUse", tool_name: "Bash", cwd: home, tool_input: { command: "rm -- .hasna-trash-verification-only" } }, record);
+  if (verdict.decision !== "rewrite")
+    throw new NativeSafetyError("guard_failed", verdict.decision === "deny" ? verdict.reason.slice(0, 512) : undefined);
+}
+async function verifyNativeSafetyRegistration(home = homedir2()) {
+  const before = readNativeSafetyRegistration(home);
+  await verifyNativeSafetyCommand(before.record.command, home);
+  const after = readNativeSafetyRegistration(home);
+  if (after.sha256 !== before.sha256)
+    throw new NativeSafetyError("binding_changed");
+  return { path: before.path, sha256: before.sha256 };
+}
+export {
+  verifyNativeSafetyRegistration,
+  verifyNativeSafetyCommand,
+  registerNativeSafety,
+  readNativeSafetyRegistration,
+  evaluateNativeSafety,
+  NativeSafetyError
+};

package/dist/sdk/index.js

@@ -1,5 +1,5 @@
 // @bun
-// ../hooks0102-standalone-lock/node_modules/@hasna/contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.2.2+944b86d8024e79fa/node_modules/@hasna/contracts/dist/client/transport.js
 import { isIP } from "net";
 import { spawnSync } from "child_process";
 import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync2 } from "fs";