@hasna/hooks 0.10.3 → 0.10.5

package/README.md

@@ -82,6 +82,16 @@ or in-place edits. A missing or unauthenticated Trash client refuses the rewritt
 operation; it never falls back to raw removal. Configure hosted Trash and verify a
 disposable capture/restore before relying on recoverable deletion.
 
+`hooks safety inspect` is a small, read-only installation check. It returns
+compact JSON with the verified Trash path and version, or a fixed failure code
+such as `unsafe_executable`, `unsafe_directory`, `unsafe_manifest` or
+`identity_failed`, and exits nonzero on failure. It checks package identity,
+ownership, permissions and a bounded credential-free protocol probe; it does not
+contact the registry or Trash API. Use it after setup and package upgrades.
+Repair unsafe installation permissions with a verified package installer, then
+check again. This check alone does not prove hosted authentication, native hook
+trust or a running agent's interception.
+
 ## Optional Mementos prompt context
 
 `hooks install mementos-context --target codex` registers a native prompt hook.
@@ -300,6 +310,51 @@ store is never a silent default: every client surface either resolves a registry
 credential (hosted route — no local store is opened) or is told `HASNA_HOOKS_LOCAL=1`
 (local mode — announced on stderr); with neither it exits non-zero and creates nothing.
 
+## Required Sumi safety binding
+
+`hooks safety install trash-guard --target sumi` registers the bundled composite
+guard for Sumi's required native adapter. `hooks safety verify --target sumi`
+checks the exact saved supervisor by classifying a synthetic removal without
+creating a file or executing the rewritten command. Both
+commands are credential-free and return compact JSON. Verification explicitly
+reports `nativeAdoptionVerified: false`: a fresh native Sumi tool invocation is
+still required to prove that the installed harness uses this binding.
+
+The owner-only `~/.hasna/hooks/native/sumi-trash-guard.json` pins the supervisor's
+runtime, worker, home and PATH. Identical setup is a no-op. An upgrade requires
+`--expected-binding-sha256 <current-digest>` and preserves the previous record.
+An interrupted lock or unexpected current record requires reconciliation; setup
+does not overwrite it. This file is native configuration, not a Hooks app store.
+Setup checks the supervisor's bound PATH before registration; verification checks
+the same readback digest before and after the probe. Package-manager bin file
+symlinks are supported, but symlinked or writable PATH directory ancestry refuses
+instead of hiding an unsafe parent through realpath resolution. The published
+Trash script's Bun interpreter and all preceding PATH directories are checked
+before its identity probe runs; unsafe or unsupported interpreter resolution
+reports `unsafe_interpreter` without executing it.
+
+Native adapters import `@hasna/hooks/native-safety` and pass the final shell/patch
+operation to `evaluateNativeSafetyForExecution`, with cancellation and an explicit
+agent label. A rewrite returns the complete command, shell, resolved cwd and
+environment. The adapter must use those fields together, disable environment
+inheritance, and prevent later hooks from changing them. Every rewritten removal
+uses the verified absolute Bun runtime with a clean environment and project
+configuration, env files, macros and installation disabled. Deletions combined
+with shell environment changes are refused; run those removals separately.
+
+Use `hooks safety verify --target sumi --execution` for a small, read-only check
+that the saved worker supports this execution contract. A legacy worker that only
+classifies commands cannot pass it. The compatible `evaluateNativeSafety` API and
+verification without `--execution` classify commands only; their success does not
+prove execution compatibility. Neither check runs the returned deletion, creates
+a test file, authenticates Trash or proves native adoption.
+
+The bounded agent label can identify the Sumi session in Trash's existing name
+field; it does not invent unsupported harness/session fields. Missing or unhealthy
+bindings reject the call. This covers supported shell removal and whole-file patch
+deletion, not arbitrary filesystem writes or plugin executor replacements.
+Installing the record alone does not activate a harness.
+
 ## Data Directory
 
 Data is stored in `~/.hasna/hooks/`.

package/bin/hooks-mcp.js

@@ -2781,6 +2781,9 @@ function buildNativeSafetyCommand(binding) {
   return prefix + [encoded, binding.runtime, binding.home, binding.path].map(quote).join(" ");
 }
 function nativeSafetyRegistration(command) {
+  return nativeSafetyCommandBinding(command)?.name;
+}
+function nativeSafetyCommandBinding(command) {
   if (!command.startsWith(prefix))
     return;
   const encoded = command.slice(prefix.length).match(/^'([A-Za-z0-9_-]+)' /)?.[1];
@@ -2788,7 +2791,7 @@ function nativeSafetyRegistration(command) {
     return;
   try {
     const binding = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
-    return buildNativeSafetyCommand(binding) === command ? binding.name : undefined;
+    return buildNativeSafetyCommand(binding) === command ? binding : undefined;
   } catch {
     return;
   }