@hasna/hooks 0.10.3 → 0.10.4

package/README.md

@@ -82,6 +82,16 @@ or in-place edits. A missing or unauthenticated Trash client refuses the rewritt
 operation; it never falls back to raw removal. Configure hosted Trash and verify a
 disposable capture/restore before relying on recoverable deletion.
 
+`hooks safety inspect` is a small, read-only installation check. It returns
+compact JSON with the verified Trash path and version, or a fixed failure code
+such as `unsafe_executable`, `unsafe_directory`, `unsafe_manifest` or
+`identity_failed`, and exits nonzero on failure. It checks package identity,
+ownership, permissions and a bounded credential-free protocol probe; it does not
+contact the registry or Trash API. Use it after setup and package upgrades.
+Repair unsafe installation permissions with a verified package installer, then
+check again. This check alone does not prove hosted authentication, native hook
+trust or a running agent's interception.
+
 ## Optional Mementos prompt context
 
 `hooks install mementos-context --target codex` registers a native prompt hook.
@@ -300,6 +310,37 @@ store is never a silent default: every client surface either resolves a registry
 credential (hosted route — no local store is opened) or is told `HASNA_HOOKS_LOCAL=1`
 (local mode — announced on stderr); with neither it exits non-zero and creates nothing.
 
+## Required Sumi safety binding
+
+`hooks safety install trash-guard --target sumi` registers the bundled composite
+guard for Sumi's required native adapter. `hooks safety verify --target sumi`
+checks the exact saved supervisor by classifying a synthetic removal without
+creating a file or executing the rewritten command. Both
+commands are credential-free and return compact JSON. Verification explicitly
+reports `nativeAdoptionVerified: false`: a fresh native Sumi tool invocation is
+still required to prove that the installed harness uses this binding.
+
+The owner-only `~/.hasna/hooks/native/sumi-trash-guard.json` pins the supervisor's
+runtime, worker, home and PATH. Identical setup is a no-op. An upgrade requires
+`--expected-binding-sha256 <current-digest>` and preserves the previous record.
+An interrupted lock or unexpected current record requires reconciliation; setup
+does not overwrite it. This file is native configuration, not a Hooks app store.
+Setup checks the supervisor's bound PATH before registration; verification checks
+the same readback digest before and after the probe. Package-manager bin file
+symlinks are supported, but symlinked or writable PATH directory ancestry refuses
+instead of hiding an unsafe parent through realpath resolution. The published
+Trash script's Bun interpreter and all preceding PATH directories are checked
+before its identity probe runs; unsafe or unsupported interpreter resolution
+reports `unsafe_interpreter` without executing it.
+
+Native adapters import `@hasna/hooks/native-safety`, pass the final shell/patch
+operation to `evaluateNativeSafety`, and enforce its continue, rewrite or deny
+verdict before execution. Missing or unhealthy bindings reject the call. The
+adapter must preserve cancellation and prevent later hooks from changing admitted
+inputs. This covers supported shell removal and whole-file patch deletion; it
+does not claim universal interception of arbitrary filesystem writes or plugin
+executor replacements. Installing the record alone does not activate a harness.
+
 ## Data Directory
 
 Data is stored in `~/.hasna/hooks/`.

package/bin/hooks-mcp.js

@@ -2781,6 +2781,9 @@ function buildNativeSafetyCommand(binding) {
   return prefix + [encoded, binding.runtime, binding.home, binding.path].map(quote).join(" ");
 }
 function nativeSafetyRegistration(command) {
+  return nativeSafetyCommandBinding(command)?.name;
+}
+function nativeSafetyCommandBinding(command) {
   if (!command.startsWith(prefix))
     return;
   const encoded = command.slice(prefix.length).match(/^'([A-Za-z0-9_-]+)' /)?.[1];
@@ -2788,7 +2791,7 @@ function nativeSafetyRegistration(command) {
     return;
   try {
     const binding = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
-    return buildNativeSafetyCommand(binding) === command ? binding.name : undefined;
+    return buildNativeSafetyCommand(binding) === command ? binding : undefined;
   } catch {
     return;
   }