@hasna/hooks 0.10.3 → 0.10.5

package/bin/native-safety-entry.js

@@ -1,13 +1,198 @@
 // @bun
 // hooks/native-safety-entry.ts
 import { homedir as homedir2 } from "os";
-import { isAbsolute as isAbsolute3 } from "path";
+import { isAbsolute as isAbsolute4 } from "path";
 
 // hooks/hook-trash-guard/src/hook.ts
-import { dirname, isAbsolute, join, normalize, resolve, sep } from "path";
-import { readFileSync, realpathSync, statSync } from "fs";
-import { spawnSync } from "child_process";
+import { isAbsolute as isAbsolute2, join as join2, normalize, resolve as resolve2, sep } from "path";
 
+// hooks/hook-trash-guard/src/binary.ts
+import { dirname, isAbsolute, join, resolve } from "path";
+import { accessSync, closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, readlinkSync, readSync, realpathSync, statSync } from "fs";
+import { spawnSync } from "child_process";
+var BINARY_FAILURES = {
+  missing: "No verified @hasna/trash guard was found on PATH.",
+  unsafe_executable: "The Trash candidate is not an owned executable file or is writable by group or others.",
+  unsafe_manifest: "The Trash package manifest is not a safe owned regular file.",
+  unsafe_directory: "A Trash PATH or package directory is not owned safely or is writable by group or others.",
+  unsafe_interpreter: "The Trash interpreter is missing, unsupported, or not a safe owned executable on its actual PATH.",
+  unrecognized_package: "The candidate is not the registered @hasna/trash executable.",
+  identity_failed: "The installed Trash identity probe failed or exceeded its deadline.",
+  unsupported_protocol: "The installed Trash version does not expose the required guard protocol."
+};
+function trustedOwner(uid) {
+  return uid === 0 || uid === process.getuid?.();
+}
+function safeExecutableFile(path, systemBinAlias = false) {
+  let current = path;
+  for (let hop = 0;hop < 32; hop++) {
+    if (!isAbsolute(current) || current.length > 4096 || !safeBinaryDirectory("/"))
+      return false;
+    const parts = current.split("/"), name = parts.pop();
+    if (!name || name === "." || name === "..")
+      return false;
+    let parent = "/";
+    for (const part of parts) {
+      if (!part || part === ".")
+        continue;
+      if (part === "..") {
+        parent = dirname(parent);
+        continue;
+      }
+      const next = join(parent, part), info2 = lstatSync(next);
+      if (systemBinAlias && next === "/bin" && info2.isSymbolicLink() && info2.uid === 0) {
+        const target = realpathSync(next);
+        if (!safeBinaryDirectory(target))
+          return false;
+        parent = target;
+        continue;
+      }
+      if (!info2.isDirectory() || !trustedOwner(info2.uid) || info2.mode & 18)
+        return false;
+      parent = next;
+    }
+    const candidate = join(parent, name), info = lstatSync(candidate);
+    if (!trustedOwner(info.uid))
+      return false;
+    if (info.isSymbolicLink()) {
+      const target = readlinkSync(candidate);
+      current = isAbsolute(target) ? target : parent + "/" + target;
+      continue;
+    }
+    return info.isFile() && Boolean(info.mode & 73) && !(info.mode & 18);
+  }
+  return false;
+}
+function safeInterpreterSearchDirectory(path) {
+  if (!isAbsolute(path) || resolve(path) !== (path.replace(/\/+$/, "") || "/"))
+    return false;
+  for (let cursor = resolve(path);; cursor = dirname(cursor)) {
+    try {
+      lstatSync(cursor);
+      return safeBinaryDirectory(cursor);
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        return false;
+    }
+    if (dirname(cursor) === cursor)
+      return false;
+  }
+}
+function safeScriptInterpreter(executable, pathValue) {
+  const fd = openSync(executable, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  let header;
+  try {
+    if (!fstatSync(fd).isFile())
+      return false;
+    const bytes = Buffer.alloc(256), length = readSync(fd, bytes, 0, bytes.length, 0);
+    header = bytes.subarray(0, length).toString("utf8").split(`
+`)[0];
+  } finally {
+    closeSync(fd);
+  }
+  const direct = /^#!(\/[A-Za-z0-9_./-]+)$/.exec(header);
+  if (direct && direct[1] !== "/usr/bin/env")
+    return safeExecutableFile(direct[1], true);
+  if (header !== "#!/usr/bin/env bun" || !safeExecutableFile("/usr/bin/env", true))
+    return false;
+  for (const dir of pathValue.split(":").slice(0, 64)) {
+    if (!safeInterpreterSearchDirectory(dir))
+      return false;
+    const interpreter = resolve(dir, "bun");
+    try {
+      if (!statSync(interpreter).isFile())
+        continue;
+      accessSync(interpreter, constants.X_OK);
+    } catch {
+      continue;
+    }
+    return safeExecutableFile(interpreter, true);
+  }
+  return false;
+}
+function safeBinaryDirectory(path) {
+  let current = path;
+  for (;; ) {
+    const info = lstatSync(current);
+    if (!info.isDirectory() || !trustedOwner(info.uid) || (info.mode & 18) !== 0)
+      return false;
+    const parent = dirname(current);
+    if (parent === current)
+      return true;
+    current = parent;
+  }
+}
+function inspectTrashBinary(env = process.env) {
+  const pathValue = env.PATH ?? "";
+  const deadline = Date.now() + 2000;
+  let failure = "missing";
+  const reject = (code) => {
+    if (failure === "missing" || failure === "unrecognized_package" || code.startsWith("unsafe_"))
+      failure = code;
+  };
+  for (const dir of pathValue.split(":").slice(0, 64)) {
+    if (!isAbsolute(dir) || Date.now() >= deadline)
+      continue;
+    const candidate = resolve(dir, "trash");
+    try {
+      const stat = statSync(candidate);
+      if (!stat.isFile() || !trustedOwner(stat.uid) || (stat.mode & 73) === 0 || (stat.mode & 18) !== 0) {
+        reject("unsafe_executable");
+        continue;
+      }
+      const executable = realpathSync(candidate);
+      if (!safeBinaryDirectory(resolve(dir)) || !safeBinaryDirectory(dirname(executable))) {
+        reject("unsafe_directory");
+        continue;
+      }
+      if (!safeExecutableFile(candidate)) {
+        reject("unsafe_directory");
+        continue;
+      }
+      const packageRoot = resolve(dirname(executable), "../..");
+      const manifestPath = join(packageRoot, "package.json");
+      const manifestStat = statSync(manifestPath);
+      if (!manifestStat.isFile() || !trustedOwner(manifestStat.uid) || manifestStat.size > 16384 || (manifestStat.mode & 18) !== 0 || lstatSync(manifestPath).isSymbolicLink()) {
+        reject("unsafe_manifest");
+        continue;
+      }
+      const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+      if (manifest.name !== "@hasna/trash" || typeof manifest.version !== "string" || typeof manifest.bin?.trash !== "string" || realpathSync(resolve(packageRoot, manifest.bin.trash)) !== executable) {
+        reject("unrecognized_package");
+        continue;
+      }
+      try {
+        if (!safeScriptInterpreter(executable, pathValue)) {
+          reject("unsafe_interpreter");
+          continue;
+        }
+      } catch {
+        reject("unsafe_interpreter");
+        continue;
+      }
+      const probe = spawnSync(candidate, ["--identity"], {
+        encoding: "utf8",
+        timeout: Math.max(1, Math.min(500, deadline - Date.now())),
+        maxBuffer: 2048,
+        env: { PATH: pathValue },
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      if (probe.error || probe.status !== 0) {
+        reject("identity_failed");
+        continue;
+      }
+      const identity = JSON.parse(probe.stdout);
+      if (identity.name === "@hasna/trash" && identity.version === manifest.version && identity.guardProtocol === "hasna.trash.guard.v1")
+        return { ok: true, path: candidate, version: manifest.version };
+      reject("unsupported_protocol");
+    } catch {}
+  }
+  return { ok: false, code: failure };
+}
+function findTrashBinary(env = process.env) {
+  const result = inspectTrashBinary(env);
+  return result.ok ? result.path : null;
+}
 // hooks/codewith-native-common.ts
 function getCommand(input) {
   const command = input.tool_input?.command;
@@ -495,17 +680,17 @@ function rmOperands(segment, verbIndex) {
   return operands;
 }
 function handoffRoots(home) {
-  return HANDOFF_ROOTS.map((suffix) => join(home, ...suffix.split("/")));
+  return HANDOFF_ROOTS.map((suffix) => join2(home, ...suffix.split("/")));
 }
 function expandHomeSpelling(token, home) {
   if (token === "~" || token === "$HOME" || token === "${HOME}")
     return home;
   if (token.startsWith("~/"))
-    return join(home, token.slice(2));
+    return join2(home, token.slice(2));
   if (token.startsWith("$HOME/"))
-    return join(home, token.slice("$HOME/".length));
+    return join2(home, token.slice("$HOME/".length));
   if (token.startsWith("${HOME}/"))
-    return join(home, token.slice("${HOME}/".length));
+    return join2(home, token.slice("${HOME}/".length));
   return token;
 }
 function resolveLiteralTarget(raw, cwd, home) {
@@ -527,7 +712,7 @@ function resolveLiteralTarget(raw, cwd, home) {
       return null;
     decoded = expanded;
   }
-  const absolute = isAbsolute(decoded) ? normalize(decoded) : resolve(cwd, decoded);
+  const absolute = isAbsolute2(decoded) ? normalize(decoded) : resolve2(cwd, decoded);
   const trimmed = absolute.replace(/\/+$/, "");
   return trimmed === "" ? "/" : trimmed;
 }
@@ -535,7 +720,7 @@ function isUnder(target, root) {
   return target === root || target.startsWith(`${root}${sep}`);
 }
 function isScratchpadContent(target, home) {
-  const prefix = `${join(home, ".hasna", "scratchpad", "scratch")}${sep}`;
+  const prefix = `${join2(home, ".hasna", "scratchpad", "scratch")}${sep}`;
   if (!target.startsWith(prefix))
     return false;
   const [session, firstChild] = target.slice(prefix.length).split(sep);
@@ -554,7 +739,7 @@ function protectedTargetReason(target, home) {
     return root === "/" ? `\`${target}\` is the filesystem root, which is never deleted.` : `\`${target}\` is the system root \`${root}\` (or an ancestor of it), which is never deleted or trashed.`;
   }
   for (const suffix of PROTECTED_HOME_TREES) {
-    const root = join(home, suffix);
+    const root = join2(home, suffix);
     if (suffix === ".hasna" && isScratchpadContent(target, home))
       continue;
     if (!isUnder(target, root) && !isUnder(root, target))
@@ -721,49 +906,26 @@ function gitHasDryRun(segment, verbIndex) {
   const options = segment.words.slice(verbIndex + 1).map((word) => decodeWord(word.text));
   return options.includes("-n") || options.includes("--dry-run");
 }
-function findTrashBinary(env = process.env) {
-  const pathValue = env.PATH ?? "";
-  const deadline = Date.now() + 2000;
-  for (const dir of pathValue.split(":").slice(0, 64)) {
-    if (!isAbsolute(dir) || Date.now() >= deadline)
-      continue;
-    const candidate = resolve(dir, "trash");
-    try {
-      const stat = statSync(candidate);
-      if (!stat.isFile() || (stat.mode & 73) === 0 || (stat.mode & 18) !== 0)
-        continue;
-      const executable = realpathSync(candidate);
-      const packageRoot = resolve(dirname(executable), "../..");
-      const manifestPath = join(packageRoot, "package.json");
-      const manifestStat = statSync(manifestPath);
-      if (!manifestStat.isFile() || manifestStat.size > 16384 || (manifestStat.mode & 18) !== 0)
-        continue;
-      const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-      if (manifest.name !== "@hasna/trash" || typeof manifest.version !== "string" || typeof manifest.bin?.trash !== "string" || realpathSync(resolve(packageRoot, manifest.bin.trash)) !== executable)
-        continue;
-      const probe = spawnSync(candidate, ["--identity"], {
-        encoding: "utf8",
-        timeout: Math.max(1, Math.min(500, deadline - Date.now())),
-        maxBuffer: 2048,
-        env: { PATH: pathValue },
-        stdio: ["ignore", "pipe", "pipe"]
-      });
-      if (probe.error || probe.status !== 0)
-        continue;
-      const identity = JSON.parse(probe.stdout);
-      if (identity.name === "@hasna/trash" && identity.version === manifest.version && identity.guardProtocol === "hasna.trash.guard.v1")
-        return candidate;
-    } catch {}
-  }
-  return null;
-}
 function shellQuoteWord(word) {
   if (/^[A-Za-z0-9_\-./+=:,@%^]+$/.test(word))
     return word;
   return `'${word.replace(/'/g, `'\\''`)}'`;
 }
-function rewriteCommand(command, hits, trashPath) {
-  const replacement = `${shellQuoteWord(trashPath)} guard`;
+function rewriteCommand(command, hits, trashPath, execution) {
+  const replacement = execution ? [
+    "/usr/bin/env",
+    "-i",
+    `HOME=${execution.home}`,
+    `PATH=${execution.path}`,
+    `HASNA_TRASH_AGENT=${execution.agent}`,
+    execution.runtime,
+    "--config=/dev/null",
+    "--no-env-file",
+    "--no-macros",
+    "--no-install",
+    trashPath,
+    "guard"
+  ].map(shellQuoteWord).join(" ") : `${shellQuoteWord(trashPath)} guard`;
   const ordered = [...hits].sort((a, b) => b.word.start - a.word.start);
   let out = command;
   for (const hit of ordered) {
@@ -815,6 +977,20 @@ function updatedInputIsComplete(updated, original, hits, cwd, home) {
     return false;
   return rewriteIsComplete(original, updated.command, hits, cwd, home);
 }
+function changesExecutionEnvironment(command) {
+  const stateCommands = new Set(["export", "set", "unset", "readonly", "declare", "typeset", "local", "alias", "unalias", "read", "readarray", "mapfile", "getopts", "trap", "enable", "function", "env", "sudo", "doas", "stdbuf"]);
+  const parsed = lexCommand(command);
+  return parsed.segments.some((segment) => {
+    const index = commandWordIndex(segment);
+    const prefix = segment.words.slice(0, index < 0 ? segment.words.length : index);
+    if (prefix.some((word2) => ASSIGNMENT_RE.test(decodeWord(word2.text)) || stateCommands.has(baseVerb(decodeWord(word2.text)))))
+      return true;
+    if (index < 0)
+      return false;
+    const word = segment.words[index];
+    return stateCommands.has(baseVerb(decodeWord(word.text))) || /^\s*\(\s*\)\s*\{/.test(command.slice(word.end));
+  });
+}
 function deny(reason) {
   return {
     hookSpecificOutput: {
@@ -835,6 +1011,10 @@ function allowRewrite(updatedInput) {
 }
 function resolveTrash(deps) {
   try {
+    if (deps.inspectTrash) {
+      const inspection = deps.inspectTrash();
+      return inspection.ok ? { path: inspection.path, error: null } : { path: null, error: `${inspection.code}: ${BINARY_FAILURES[inspection.code]}` };
+    }
     return { path: deps.findTrash(), error: null };
   } catch (cause) {
     return { path: null, error: cause instanceof Error ? cause.message : String(cause) };
@@ -889,8 +1069,13 @@ function evaluate(input, deps) {
     return deny(ABSENT_REASON);
   }
   const trashPath = trash.path;
-  const rewritten = rewriteCommand(command, scanned.rmHits, trashPath);
+  if (deps.execution && changesExecutionEnvironment(command)) {
+    return deny("[trash-guard] A deletion combined with shell environment changes cannot use the verified native execution context. Run the deletion as a separate plain rm command.");
+  }
+  const rewritten = rewriteCommand(command, scanned.rmHits, trashPath, deps.execution);
   const updatedInput = buildUpdatedInput(input.tool_input, rewritten);
+  if (deps.execution)
+    updatedInput.hasna_execution = "hasna.hooks.execution.v1";
   if (!updatedInputIsComplete(updatedInput, command, scanned.rmHits, deps.cwd, deps.home)) {
     return deny("[trash-guard] The rewrite of this command did not verify (the delete could not be redirected cleanly), so the command is refused rather than run unredirected. Re-run the delete as a plain `rm -- <path>` command.");
   }
@@ -899,24 +1084,24 @@ function evaluate(input, deps) {
 if (false) {}
 
 // hooks/hook-workspace-repos-guard/src/hook.ts
-import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { closeSync as closeSync2, constants as constants2, fstatSync as fstatSync2, lstatSync as lstatSync2, openSync as openSync2, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2, normalize as normalize2, relative, resolve as resolve2, sep as sep2 } from "path";
+import { dirname as dirname2, isAbsolute as isAbsolute3, join as join3, normalize as normalize2, relative, resolve as resolve3, sep as sep2 } from "path";
 var FILE_WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
 var PATCH_TOOLS = new Set(["apply_patch", "ApplyPatch", "functions.apply_patch"]);
 var DEFAULT_ORGS = ["hasna", "hasnaxyz", "hasna-products"];
 var RULE = "workspace-repos-guard";
 function reposRoot(home) {
-  return join2(home, ".hasna", "repos", "clones");
+  return join3(home, ".hasna", "repos", "clones");
 }
 function legacyRoot(home) {
-  return join2(home, "workspace", "repos");
+  return join3(home, "workspace", "repos");
 }
 function protectedRoots(home) {
   return [reposRoot(home), legacyRoot(home)];
 }
 function allowedOrgsFile(home) {
-  return join2(home, ".hasna", "hooks", "config", "workspace-repos-guard-orgs");
+  return join3(home, ".hasna", "hooks", "config", "workspace-repos-guard-orgs");
 }
 var ORG_NAME = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;
 function ownedAndClosed(stat) {
@@ -927,18 +1112,18 @@ function readAllowedOrgsFile(home) {
   const file = allowedOrgsFile(home);
   let text;
   try {
-    const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const fd = openSync2(file, constants2.O_RDONLY | constants2.O_NOFOLLOW);
     try {
-      const stat = fstatSync(fd);
+      const stat = fstatSync2(fd);
       if (!stat.isFile() || !ownedAndClosed(stat) || stat.size > 4096)
         return null;
       text = readFileSync2(fd, "utf8");
     } finally {
-      closeSync(fd);
+      closeSync2(fd);
     }
     const top = normalize2(home);
     for (let dir = dirname2(file);dir !== top; dir = dirname2(dir)) {
-      const stat = lstatSync(dir);
+      const stat = lstatSync2(dir);
       if (!stat.isDirectory() || !ownedAndClosed(stat) || dir === dirname2(dir))
         return null;
     }
@@ -966,7 +1151,7 @@ function classifyPath(target, root, orgs, op) {
       return { blocked: true, reason: `[${RULE}] delete of the protected repo-checkout root is forbidden: ${root}` };
     return { blocked: true, reason: `[${RULE}] writes directly to the protected repo-checkout root are forbidden: ${root}` };
   }
-  if (rel.startsWith(`..${sep2}`) || rel === ".." || isAbsolute2(rel)) {
+  if (rel.startsWith(`..${sep2}`) || rel === ".." || isAbsolute3(rel)) {
     return { blocked: false };
   }
   const segments = rel.split(sep2).filter(Boolean);
@@ -1036,13 +1221,13 @@ function expandHomeSpelling2(token, home) {
   if (body === "~")
     return home;
   if (body.startsWith("~/"))
-    return join2(home, body.slice(2));
+    return join3(home, body.slice(2));
   if (body === "$HOME" || body === "${HOME}")
     return home;
   if (body.startsWith("$HOME/"))
-    return join2(home, body.slice("$HOME/".length));
+    return join3(home, body.slice("$HOME/".length));
   if (body.startsWith("${HOME}/"))
-    return join2(home, body.slice("${HOME}/".length));
+    return join3(home, body.slice("${HOME}/".length));
   const homeMatch = body.match(new RegExp(`^"*${regexEscape(home)}"*/`));
   if (homeMatch)
     return home + "/" + body.slice(homeMatch[0].length);
@@ -1068,7 +1253,7 @@ function cdDestinations(operand, bases, home) {
     word = quoted[2];
   if (!word || word === "-" || /[$\x60*?[\]{}~\\'"]/.test(word))
     return null;
-  return [...new Set(bases.map((base) => resolve2(base, word)))];
+  return [...new Set(bases.map((base) => resolve3(base, word)))];
 }
 var REL_OPERAND = /(?:^|\s)(\.\.?|[^\s"';&|<>()\x60/]+(?:\/[^\s"';&|<>()\x60]*)?)\s*$/;
 function bashTargets(command, home, cwd) {
@@ -1127,10 +1312,10 @@ function bashTargets(command, home, cwd) {
       const relMatch = commandOp === "read" ? null : commandPart.match(REL_OPERAND);
       for (const base of current.filter(underRoot)) {
         for (const operand of operands) {
-          targets.push({ path: normalize2(resolve2(base, expandHomeSpelling2(operand, home))), op: "write" });
+          targets.push({ path: normalize2(resolve3(base, expandHomeSpelling2(operand, home))), op: "write" });
         }
         if (relMatch)
-          targets.push({ path: normalize2(resolve2(base, relMatch[1])), op: commandOp });
+          targets.push({ path: normalize2(resolve3(base, relMatch[1])), op: commandOp });
       }
     }
     if (plainCd) {
@@ -1155,7 +1340,7 @@ function patchTargets(patch, cwd) {
   let m;
   while ((m = PATCH_FILE_RE.exec(patch)) !== null) {
     const op = m[1] === "Delete File" ? "delete" : "write";
-    targets.push({ path: normalize2(resolve2(cwd, m[2])), op });
+    targets.push({ path: normalize2(resolve3(cwd, m[2])), op });
   }
   return targets;
 }
@@ -1206,7 +1391,7 @@ function evaluate2(input, options = {}) {
   if (!raw)
     return { output: { continue: true }, warnings };
   const expanded = expandHomeSpelling2(raw, home);
-  const target = isAbsolute2(expanded) ? normalize2(expanded) : resolve2(cwd, expanded);
+  const target = isAbsolute3(expanded) ? normalize2(expanded) : resolve3(cwd, expanded);
   for (const root of roots) {
     const verdict = classifyPath(target, root, orgs, "write");
     if (verdict.blocked) {
@@ -1222,10 +1407,21 @@ var name = process.argv[1];
 if (name !== "trash-guard" && name !== "workspace-repos-guard")
   throw new Error("Invalid safety capability");
 var input = JSON.parse(await Bun.stdin.text());
-if (!input || Array.isArray(input) || input.hook_event_name !== "PreToolUse" || typeof input.tool_name !== "string" || !input.tool_input || typeof input.tool_input !== "object" || Array.isArray(input.tool_input) || typeof input.cwd !== "string" || !isAbsolute3(input.cwd))
+if (!input || Array.isArray(input) || input.hook_event_name !== "PreToolUse" || typeof input.tool_name !== "string" || !input.tool_input || typeof input.tool_input !== "object" || Array.isArray(input.tool_input) || typeof input.cwd !== "string" || !isAbsolute4(input.cwd))
   throw new Error("Invalid safety input");
 if (input.tool_name === "Bash" && typeof input.tool_input.command !== "string")
   throw new Error("Invalid shell input");
+var requestedExecution = input.hasna_execution;
+if (requestedExecution !== undefined && (!requestedExecution || Object.keys(requestedExecution).sort().join() !== "agent,schema" || requestedExecution.schema !== "hasna.hooks.execution.v1" || typeof requestedExecution.agent !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/.test(requestedExecution.agent)))
+  throw new Error("Invalid execution capability");
+var execution = requestedExecution === undefined ? undefined : {
+  runtime: process.execPath,
+  home: homedir2(),
+  path: process.env.PATH,
+  agent: requestedExecution.agent
+};
+if (execution && (!isAbsolute4(execution.runtime) || !execution.path))
+  throw new Error("Invalid bound execution context");
 if (["apply_patch", "ApplyPatch", "functions.apply_patch"].includes(input.tool_name)) {
   if (input.tool_input.command !== undefined && input.tool_input.patch !== undefined && input.tool_input.command !== input.tool_input.patch)
     throw new Error("Conflicting patch aliases");
@@ -1236,5 +1432,5 @@ if (["apply_patch", "ApplyPatch", "functions.apply_patch"].includes(input.tool_n
 }
 var repos = evaluate2(input).output;
 var handoff = input.tool_name === "Bash" && scanCommand(input.tool_input.command, { home: homedir2(), cwd: input.cwd }).handoffHits.length > 0;
-var verdict = repos.decision === "block" ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: repos.reason } } : handoff ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "[workspace-repos-guard] Deletion under a protected repository checkout is refused." } } : name === "trash-guard" ? evaluate(input, { home: homedir2(), cwd: input.cwd, findTrash: findTrashBinary }) : { continue: true };
+var verdict = repos.decision === "block" ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: repos.reason } } : handoff ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "[workspace-repos-guard] Deletion under a protected repository checkout is refused." } } : name === "trash-guard" ? evaluate(input, { home: homedir2(), cwd: input.cwd, findTrash: findTrashBinary, inspectTrash: inspectTrashBinary, execution }) : { continue: true };
 process.stdout.write(JSON.stringify({ verdict: "continue" in verdict ? null : verdict }));

package/dist/index.js

@@ -7719,6 +7719,9 @@ function buildNativeSafetyCommand(binding) {
   return prefix + [encoded, binding.runtime, binding.home, binding.path].map(quote).join(" ");
 }
 function nativeSafetyRegistration(command) {
+  return nativeSafetyCommandBinding(command)?.name;
+}
+function nativeSafetyCommandBinding(command) {
   if (!command.startsWith(prefix))
     return;
   const encoded = command.slice(prefix.length).match(/^'([A-Za-z0-9_-]+)' /)?.[1];
@@ -7726,7 +7729,7 @@ function nativeSafetyRegistration(command) {
     return;
   try {
     const binding = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
-    return buildNativeSafetyCommand(binding) === command ? binding.name : undefined;
+    return buildNativeSafetyCommand(binding) === command ? binding : undefined;
   } catch {
     return;
   }

package/dist/lib/native-safety.d.ts

@@ -11,5 +11,6 @@ export interface NativeSafetyBinding {
 export declare function isNativeSafetyName(name: string): name is NativeSafetyName;
 export declare function buildNativeSafetyCommand(binding: NativeSafetyBinding): string;
 export declare function nativeSafetyRegistration(command: string): NativeSafetyName | undefined;
+export declare function nativeSafetyCommandBinding(command: string): NativeSafetyBinding | undefined;
 /** Built-in capability only: no registry, custom source, profile or app store. */
 export declare function installedNativeSafetyCommand(name: NativeSafetyName): string;

package/dist/native-safety.d.ts

@@ -0,0 +1,88 @@
+export declare class NativeSafetyError extends Error {
+    readonly code: "binding_missing" | "binding_invalid" | "binding_changed" | "binding_busy" | "guard_failed" | "input_invalid";
+    readonly reason?: string | undefined;
+    constructor(code: "binding_missing" | "binding_invalid" | "binding_changed" | "binding_busy" | "guard_failed" | "input_invalid", reason?: string | undefined);
+}
+export type NativeSafetyEvent = {
+    hook_event_name: "PreToolUse";
+    tool_name: "Bash" | "apply_patch";
+    cwd: string;
+    session_id?: string;
+    tool_input: Record<string, unknown>;
+};
+export type NativeSafetyDecision = {
+    decision: "continue";
+} | {
+    decision: "deny";
+    reason: string;
+} | {
+    decision: "rewrite";
+    command: string;
+};
+export type NativeSafetyExecutionDecision = Exclude<NativeSafetyDecision, {
+    decision: "rewrite";
+}> | {
+    decision: "rewrite";
+    execution: {
+        command: string;
+        shell: "/bin/sh";
+        cwd: string;
+        env: {
+            HOME: string;
+            PATH: string;
+        };
+    };
+};
+export type NativeSafetyRecord = {
+    schema: "hasna.hooks.native-safety.v1";
+    harness: "sumi";
+    command: string;
+};
+export declare function readNativeSafetyRegistration(home?: string): {
+    record: NativeSafetyRecord;
+    sha256: string;
+    path: string;
+};
+/** Register only the bundled composite guard. Updates preserve the exact prior
+ * record and require its digest. A lock coordinates package-owned writers; an
+ * unexpected preimage or a retained interrupted lock requires reconciliation. */
+export declare function registerNativeSafety(options?: {
+    home?: string;
+    expectedSHA256?: string;
+    command?: string;
+}): {
+    ok: true;
+    changed: boolean;
+    path: string;
+    sha256: string;
+};
+/** A bounded supervisor subprocess evaluates data only; it never runs the
+ * requested shell command. AbortSignal targets this newly created child. */
+export declare function evaluateNativeSafety(event: NativeSafetyEvent, options?: {
+    home?: string;
+    signal?: AbortSignal;
+}): Promise<NativeSafetyDecision>;
+/** Native tool dispatch consumes this entire context, with environment inheritance
+ * disabled. The worker pins each Trash invocation to its verified Bun runtime,
+ * ignoring caller PATH, preload variables and cwd Bun configuration. `agent` is
+ * the bounded explicit Trash label; it does not invent a harness/session enum. */
+export declare function evaluateNativeSafetyForExecution(event: NativeSafetyEvent, options: {
+    home?: string;
+    signal?: AbortSignal;
+    agent: string;
+}): Promise<NativeSafetyExecutionDecision>;
+/** Classify a synthetic removal through this exact supervisor without executing
+ * the returned command or creating a file. A harmless ':' would not test whether
+ * the saved PATH can actually resolve Trash. */
+export declare function verifyNativeSafetyCommand(command: string, home?: string): Promise<void>;
+export declare function verifyNativeSafetyRegistration(home?: string): Promise<{
+    path: string;
+    sha256: string;
+}>;
+/** Read-only compatibility check for native dispatch. This classifies one
+ * synthetic removal and requires the execution capability; it never executes
+ * the rewrite, creates a fixture, authenticates Trash or proves harness adoption. */
+export declare function verifyNativeSafetyExecutionRegistration(home?: string): Promise<{
+    path: string;
+    sha256: string;
+}>;