@hasna/hooks 0.10.4 → 0.10.5

package/README.md

@@ -333,13 +333,27 @@ Trash script's Bun interpreter and all preceding PATH directories are checked
 before its identity probe runs; unsafe or unsupported interpreter resolution
 reports `unsafe_interpreter` without executing it.
 
-Native adapters import `@hasna/hooks/native-safety`, pass the final shell/patch
-operation to `evaluateNativeSafety`, and enforce its continue, rewrite or deny
-verdict before execution. Missing or unhealthy bindings reject the call. The
-adapter must preserve cancellation and prevent later hooks from changing admitted
-inputs. This covers supported shell removal and whole-file patch deletion; it
-does not claim universal interception of arbitrary filesystem writes or plugin
-executor replacements. Installing the record alone does not activate a harness.
+Native adapters import `@hasna/hooks/native-safety` and pass the final shell/patch
+operation to `evaluateNativeSafetyForExecution`, with cancellation and an explicit
+agent label. A rewrite returns the complete command, shell, resolved cwd and
+environment. The adapter must use those fields together, disable environment
+inheritance, and prevent later hooks from changing them. Every rewritten removal
+uses the verified absolute Bun runtime with a clean environment and project
+configuration, env files, macros and installation disabled. Deletions combined
+with shell environment changes are refused; run those removals separately.
+
+Use `hooks safety verify --target sumi --execution` for a small, read-only check
+that the saved worker supports this execution contract. A legacy worker that only
+classifies commands cannot pass it. The compatible `evaluateNativeSafety` API and
+verification without `--execution` classify commands only; their success does not
+prove execution compatibility. Neither check runs the returned deletion, creates
+a test file, authenticates Trash or proves native adoption.
+
+The bounded agent label can identify the Sumi session in Trash's existing name
+field; it does not invent unsupported harness/session fields. Missing or unhealthy
+bindings reject the call. This covers supported shell removal and whole-file patch
+deletion, not arbitrary filesystem writes or plugin executor replacements.
+Installing the record alone does not activate a harness.
 
 ## Data Directory
 

package/bin/index.js

@@ -44610,6 +44610,7 @@ class NativeSafetyError extends Error {
     this.name = "NativeSafetyError";
   }
 }
+var executionSchema = "hasna.hooks.execution.v1";
 var hash = (value) => createHash7("sha256").update(value).digest("hex");
 var filename = "sumi-trash-guard.json";
 var owner2 = (uid2) => uid2 === 0 || uid2 === process.getuid?.();
@@ -44764,10 +44765,31 @@ function registerNativeSafety(options = {}) {
     syncDirectory(directory2);
   }
 }
-async function evaluateRecord(event, record3, signal) {
+async function evaluateNativeSafetyForExecution(event, options) {
+  if (!options || typeof options.agent !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/.test(options.agent))
+    throw new NativeSafetyError("input_invalid");
+  let snapshot2;
+  try {
+    snapshot2 = JSON.parse(JSON.stringify(event));
+  } catch {
+    throw new NativeSafetyError("input_invalid");
+  }
+  if (snapshot2?.tool_input && Object.hasOwn(snapshot2.tool_input, "hasna_execution"))
+    throw new NativeSafetyError("input_invalid");
+  const before = readNativeSafetyRegistration(options.home);
+  const binding = nativeSafetyCommandBinding(before.record.command);
+  const decision = await evaluateRecord(snapshot2, before.record, options.signal, options.agent);
+  if (readNativeSafetyRegistration(options.home).sha256 !== before.sha256)
+    throw new NativeSafetyError("binding_changed");
+  return decision.decision === "rewrite" ? {
+    decision: "rewrite",
+    execution: { command: decision.command, shell: "/bin/sh", cwd: snapshot2.cwd, env: { HOME: binding.home, PATH: binding.path } }
+  } : decision;
+}
+async function evaluateRecord(event, record3, signal, executionAgent) {
   if (!event || event.hook_event_name !== "PreToolUse" || !["Bash", "apply_patch"].includes(event.tool_name) || typeof event.cwd !== "string" || !isAbsolute7(event.cwd) || !event.tool_input || typeof event.tool_input !== "object" || Array.isArray(event.tool_input))
     throw new NativeSafetyError("input_invalid");
-  const input2 = JSON.stringify(event);
+  const input2 = JSON.stringify(executionAgent === undefined ? event : { ...event, hasna_execution: { schema: executionSchema, agent: executionAgent } });
   if (Buffer.byteLength(input2) > 1048576)
     throw new NativeSafetyError("input_invalid");
   const output2 = await new Promise((accept, reject) => {
@@ -44792,7 +44814,7 @@ async function evaluateRecord(event, record3, signal) {
       throw new Error;
     if (verdict.permissionDecision === "deny" && Object.keys(verdict).sort().join() === "hookEventName,permissionDecision,permissionDecisionReason" && typeof verdict.permissionDecisionReason === "string" && verdict.permissionDecisionReason.trim())
       return { decision: "deny", reason: verdict.permissionDecisionReason };
-    if (event.tool_name === "Bash" && verdict.permissionDecision === "allow" && Object.keys(verdict).sort().join() === "hookEventName,permissionDecision,updatedInput" && typeof verdict.updatedInput?.command === "string" && verdict.updatedInput.command.trim())
+    if (event.tool_name === "Bash" && verdict.permissionDecision === "allow" && Object.keys(verdict).sort().join() === "hookEventName,permissionDecision,updatedInput" && typeof verdict.updatedInput?.command === "string" && verdict.updatedInput.command.trim() && (executionAgent === undefined || verdict.updatedInput.hasna_execution === executionSchema))
       return { decision: "rewrite", command: verdict.updatedInput.command };
   } catch {}
   throw new NativeSafetyError("guard_failed");
@@ -44812,6 +44834,20 @@ async function verifyNativeSafetyRegistration(home = homedir7()) {
     throw new NativeSafetyError("binding_changed");
   return { path: before.path, sha256: before.sha256 };
 }
+async function verifyNativeSafetyExecutionRegistration(home = homedir7()) {
+  const before = readNativeSafetyRegistration(home);
+  const verdict = await evaluateNativeSafetyForExecution({
+    hook_event_name: "PreToolUse",
+    tool_name: "Bash",
+    cwd: home,
+    tool_input: { command: "rm -- .hasna-trash-verification-only" }
+  }, { home, agent: "native-safety-verification" });
+  if (verdict.decision !== "rewrite")
+    throw new NativeSafetyError("guard_failed", verdict.decision === "deny" ? verdict.reason.slice(0, 512) : undefined);
+  if (readNativeSafetyRegistration(home).sha256 !== before.sha256)
+    throw new NativeSafetyError("binding_changed");
+  return { path: before.path, sha256: before.sha256 };
+}
 
 // hooks/hook-trash-guard/src/binary.ts
 import { dirname as dirname17, isAbsolute as isAbsolute15, join as join17, resolve as resolve17 } from "path";
@@ -46759,12 +46795,12 @@ safety.command("install <guard>").option("--target <target>", "codex, claude or
   if (!result.success)
     process.exitCode = 1;
 });
-safety.command("verify").requiredOption("--target <target>", "sumi").description("Verify a required native binding and its supervisor without running a file operation").action(async (options) => {
+safety.command("verify").requiredOption("--target <target>", "sumi").option("--execution", "Also require the pinned native execution capability; no file operation is run").description("Verify a required native binding and its supervisor without running a file operation").action(async (options) => {
   try {
     if (options.target !== "sumi")
       throw new NativeSafetyError("input_invalid");
-    const current2 = await verifyNativeSafetyRegistration();
-    console.log(JSON.stringify({ ok: true, target: "sumi", sha256: current2.sha256, guardVerified: true, nativeAdoptionVerified: false }));
+    const current2 = await (options.execution ? verifyNativeSafetyExecutionRegistration() : verifyNativeSafetyRegistration());
+    console.log(JSON.stringify({ ok: true, target: "sumi", sha256: current2.sha256, guardVerified: true, ...options.execution ? { executionCapabilityVerified: true } : {}, nativeAdoptionVerified: false }));
   } catch (error61) {
     console.log(JSON.stringify({ ok: false, target: "sumi", code: error61 instanceof NativeSafetyError ? error61.code : "guard_failed", ...error61 instanceof NativeSafetyError && error61.reason ? { reason: error61.reason } : {} }));
     process.exitCode = 1;

package/bin/native-safety-entry.js

@@ -911,8 +911,21 @@ function shellQuoteWord(word) {
     return word;
   return `'${word.replace(/'/g, `'\\''`)}'`;
 }
-function rewriteCommand(command, hits, trashPath) {
-  const replacement = `${shellQuoteWord(trashPath)} guard`;
+function rewriteCommand(command, hits, trashPath, execution) {
+  const replacement = execution ? [
+    "/usr/bin/env",
+    "-i",
+    `HOME=${execution.home}`,
+    `PATH=${execution.path}`,
+    `HASNA_TRASH_AGENT=${execution.agent}`,
+    execution.runtime,
+    "--config=/dev/null",
+    "--no-env-file",
+    "--no-macros",
+    "--no-install",
+    trashPath,
+    "guard"
+  ].map(shellQuoteWord).join(" ") : `${shellQuoteWord(trashPath)} guard`;
   const ordered = [...hits].sort((a, b) => b.word.start - a.word.start);
   let out = command;
   for (const hit of ordered) {
@@ -964,6 +977,20 @@ function updatedInputIsComplete(updated, original, hits, cwd, home) {
     return false;
   return rewriteIsComplete(original, updated.command, hits, cwd, home);
 }
+function changesExecutionEnvironment(command) {
+  const stateCommands = new Set(["export", "set", "unset", "readonly", "declare", "typeset", "local", "alias", "unalias", "read", "readarray", "mapfile", "getopts", "trap", "enable", "function", "env", "sudo", "doas", "stdbuf"]);
+  const parsed = lexCommand(command);
+  return parsed.segments.some((segment) => {
+    const index = commandWordIndex(segment);
+    const prefix = segment.words.slice(0, index < 0 ? segment.words.length : index);
+    if (prefix.some((word2) => ASSIGNMENT_RE.test(decodeWord(word2.text)) || stateCommands.has(baseVerb(decodeWord(word2.text)))))
+      return true;
+    if (index < 0)
+      return false;
+    const word = segment.words[index];
+    return stateCommands.has(baseVerb(decodeWord(word.text))) || /^\s*\(\s*\)\s*\{/.test(command.slice(word.end));
+  });
+}
 function deny(reason) {
   return {
     hookSpecificOutput: {
@@ -1042,8 +1069,13 @@ function evaluate(input, deps) {
     return deny(ABSENT_REASON);
   }
   const trashPath = trash.path;
-  const rewritten = rewriteCommand(command, scanned.rmHits, trashPath);
+  if (deps.execution && changesExecutionEnvironment(command)) {
+    return deny("[trash-guard] A deletion combined with shell environment changes cannot use the verified native execution context. Run the deletion as a separate plain rm command.");
+  }
+  const rewritten = rewriteCommand(command, scanned.rmHits, trashPath, deps.execution);
   const updatedInput = buildUpdatedInput(input.tool_input, rewritten);
+  if (deps.execution)
+    updatedInput.hasna_execution = "hasna.hooks.execution.v1";
   if (!updatedInputIsComplete(updatedInput, command, scanned.rmHits, deps.cwd, deps.home)) {
     return deny("[trash-guard] The rewrite of this command did not verify (the delete could not be redirected cleanly), so the command is refused rather than run unredirected. Re-run the delete as a plain `rm -- <path>` command.");
   }
@@ -1379,6 +1411,17 @@ if (!input || Array.isArray(input) || input.hook_event_name !== "PreToolUse" ||
   throw new Error("Invalid safety input");
 if (input.tool_name === "Bash" && typeof input.tool_input.command !== "string")
   throw new Error("Invalid shell input");
+var requestedExecution = input.hasna_execution;
+if (requestedExecution !== undefined && (!requestedExecution || Object.keys(requestedExecution).sort().join() !== "agent,schema" || requestedExecution.schema !== "hasna.hooks.execution.v1" || typeof requestedExecution.agent !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/.test(requestedExecution.agent)))
+  throw new Error("Invalid execution capability");
+var execution = requestedExecution === undefined ? undefined : {
+  runtime: process.execPath,
+  home: homedir2(),
+  path: process.env.PATH,
+  agent: requestedExecution.agent
+};
+if (execution && (!isAbsolute4(execution.runtime) || !execution.path))
+  throw new Error("Invalid bound execution context");
 if (["apply_patch", "ApplyPatch", "functions.apply_patch"].includes(input.tool_name)) {
   if (input.tool_input.command !== undefined && input.tool_input.patch !== undefined && input.tool_input.command !== input.tool_input.patch)
     throw new Error("Conflicting patch aliases");
@@ -1389,5 +1432,5 @@ if (["apply_patch", "ApplyPatch", "functions.apply_patch"].includes(input.tool_n
 }
 var repos = evaluate2(input).output;
 var handoff = input.tool_name === "Bash" && scanCommand(input.tool_input.command, { home: homedir2(), cwd: input.cwd }).handoffHits.length > 0;
-var verdict = repos.decision === "block" ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: repos.reason } } : handoff ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "[workspace-repos-guard] Deletion under a protected repository checkout is refused." } } : name === "trash-guard" ? evaluate(input, { home: homedir2(), cwd: input.cwd, findTrash: findTrashBinary, inspectTrash: inspectTrashBinary }) : { continue: true };
+var verdict = repos.decision === "block" ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: repos.reason } } : handoff ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "[workspace-repos-guard] Deletion under a protected repository checkout is refused." } } : name === "trash-guard" ? evaluate(input, { home: homedir2(), cwd: input.cwd, findTrash: findTrashBinary, inspectTrash: inspectTrashBinary, execution }) : { continue: true };
 process.stdout.write(JSON.stringify({ verdict: "continue" in verdict ? null : verdict }));

package/dist/native-safety.d.ts

@@ -19,6 +19,20 @@ export type NativeSafetyDecision = {
     decision: "rewrite";
     command: string;
 };
+export type NativeSafetyExecutionDecision = Exclude<NativeSafetyDecision, {
+    decision: "rewrite";
+}> | {
+    decision: "rewrite";
+    execution: {
+        command: string;
+        shell: "/bin/sh";
+        cwd: string;
+        env: {
+            HOME: string;
+            PATH: string;
+        };
+    };
+};
 export type NativeSafetyRecord = {
     schema: "hasna.hooks.native-safety.v1";
     harness: "sumi";
@@ -48,6 +62,15 @@ export declare function evaluateNativeSafety(event: NativeSafetyEvent, options?:
     home?: string;
     signal?: AbortSignal;
 }): Promise<NativeSafetyDecision>;
+/** Native tool dispatch consumes this entire context, with environment inheritance
+ * disabled. The worker pins each Trash invocation to its verified Bun runtime,
+ * ignoring caller PATH, preload variables and cwd Bun configuration. `agent` is
+ * the bounded explicit Trash label; it does not invent a harness/session enum. */
+export declare function evaluateNativeSafetyForExecution(event: NativeSafetyEvent, options: {
+    home?: string;
+    signal?: AbortSignal;
+    agent: string;
+}): Promise<NativeSafetyExecutionDecision>;
 /** Classify a synthetic removal through this exact supervisor without executing
  * the returned command or creating a file. A harmless ':' would not test whether
  * the saved PATH can actually resolve Trash. */
@@ -56,3 +79,10 @@ export declare function verifyNativeSafetyRegistration(home?: string): Promise<{
     path: string;
     sha256: string;
 }>;
+/** Read-only compatibility check for native dispatch. This classifies one
+ * synthetic removal and requires the execution capability; it never executes
+ * the rewrite, creates a fixture, authenticates Trash or proves harness adoption. */
+export declare function verifyNativeSafetyExecutionRegistration(home?: string): Promise<{
+    path: string;
+    sha256: string;
+}>;

package/dist/native-safety.js

@@ -148,6 +148,7 @@ class NativeSafetyError extends Error {
     this.name = "NativeSafetyError";
   }
 }
+var executionSchema = "hasna.hooks.execution.v1";
 var hash = (value) => createHash2("sha256").update(value).digest("hex");
 var filename = "sumi-trash-guard.json";
 var owner = (uid) => uid === 0 || uid === process.getuid?.();
@@ -305,10 +306,31 @@ function registerNativeSafety(options = {}) {
 async function evaluateNativeSafety(event, options = {}) {
   return evaluateRecord(event, readNativeSafetyRegistration(options.home).record, options.signal);
 }
-async function evaluateRecord(event, record, signal) {
+async function evaluateNativeSafetyForExecution(event, options) {
+  if (!options || typeof options.agent !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/.test(options.agent))
+    throw new NativeSafetyError("input_invalid");
+  let snapshot;
+  try {
+    snapshot = JSON.parse(JSON.stringify(event));
+  } catch {
+    throw new NativeSafetyError("input_invalid");
+  }
+  if (snapshot?.tool_input && Object.hasOwn(snapshot.tool_input, "hasna_execution"))
+    throw new NativeSafetyError("input_invalid");
+  const before = readNativeSafetyRegistration(options.home);
+  const binding = nativeSafetyCommandBinding(before.record.command);
+  const decision = await evaluateRecord(snapshot, before.record, options.signal, options.agent);
+  if (readNativeSafetyRegistration(options.home).sha256 !== before.sha256)
+    throw new NativeSafetyError("binding_changed");
+  return decision.decision === "rewrite" ? {
+    decision: "rewrite",
+    execution: { command: decision.command, shell: "/bin/sh", cwd: snapshot.cwd, env: { HOME: binding.home, PATH: binding.path } }
+  } : decision;
+}
+async function evaluateRecord(event, record, signal, executionAgent) {
   if (!event || event.hook_event_name !== "PreToolUse" || !["Bash", "apply_patch"].includes(event.tool_name) || typeof event.cwd !== "string" || !isAbsolute2(event.cwd) || !event.tool_input || typeof event.tool_input !== "object" || Array.isArray(event.tool_input))
     throw new NativeSafetyError("input_invalid");
-  const input = JSON.stringify(event);
+  const input = JSON.stringify(executionAgent === undefined ? event : { ...event, hasna_execution: { schema: executionSchema, agent: executionAgent } });
   if (Buffer.byteLength(input) > 1048576)
     throw new NativeSafetyError("input_invalid");
   const output = await new Promise((accept, reject) => {
@@ -333,7 +355,7 @@ async function evaluateRecord(event, record, signal) {
       throw new Error;
     if (verdict.permissionDecision === "deny" && Object.keys(verdict).sort().join() === "hookEventName,permissionDecision,permissionDecisionReason" && typeof verdict.permissionDecisionReason === "string" && verdict.permissionDecisionReason.trim())
       return { decision: "deny", reason: verdict.permissionDecisionReason };
-    if (event.tool_name === "Bash" && verdict.permissionDecision === "allow" && Object.keys(verdict).sort().join() === "hookEventName,permissionDecision,updatedInput" && typeof verdict.updatedInput?.command === "string" && verdict.updatedInput.command.trim())
+    if (event.tool_name === "Bash" && verdict.permissionDecision === "allow" && Object.keys(verdict).sort().join() === "hookEventName,permissionDecision,updatedInput" && typeof verdict.updatedInput?.command === "string" && verdict.updatedInput.command.trim() && (executionAgent === undefined || verdict.updatedInput.hasna_execution === executionSchema))
       return { decision: "rewrite", command: verdict.updatedInput.command };
   } catch {}
   throw new NativeSafetyError("guard_failed");
@@ -353,11 +375,27 @@ async function verifyNativeSafetyRegistration(home = homedir2()) {
     throw new NativeSafetyError("binding_changed");
   return { path: before.path, sha256: before.sha256 };
 }
+async function verifyNativeSafetyExecutionRegistration(home = homedir2()) {
+  const before = readNativeSafetyRegistration(home);
+  const verdict = await evaluateNativeSafetyForExecution({
+    hook_event_name: "PreToolUse",
+    tool_name: "Bash",
+    cwd: home,
+    tool_input: { command: "rm -- .hasna-trash-verification-only" }
+  }, { home, agent: "native-safety-verification" });
+  if (verdict.decision !== "rewrite")
+    throw new NativeSafetyError("guard_failed", verdict.decision === "deny" ? verdict.reason.slice(0, 512) : undefined);
+  if (readNativeSafetyRegistration(home).sha256 !== before.sha256)
+    throw new NativeSafetyError("binding_changed");
+  return { path: before.path, sha256: before.sha256 };
+}
 export {
   verifyNativeSafetyRegistration,
+  verifyNativeSafetyExecutionRegistration,
   verifyNativeSafetyCommand,
   registerNativeSafety,
   readNativeSafetyRegistration,
+  evaluateNativeSafetyForExecution,
   evaluateNativeSafety,
   NativeSafetyError
 };

package/hooks/hook-trash-guard/src/hook.ts

@@ -886,8 +886,11 @@ function shellQuoteWord(word: string): string {
  * Replace the verb token of every owned `rm` with `<quoted trash> guard`,
  * leaving every other byte of the command untouched.
  */
-export function rewriteCommand(command: string, hits: RmHit[], trashPath: string): string {
-  const replacement = `${shellQuoteWord(trashPath)} guard`;
+export function rewriteCommand(command: string, hits: RmHit[], trashPath: string, execution?: GuardDependencies["execution"]): string {
+  const replacement = execution
+    ? ["/usr/bin/env", "-i", `HOME=${execution.home}`, `PATH=${execution.path}`, `HASNA_TRASH_AGENT=${execution.agent}`,
+      execution.runtime, "--config=/dev/null", "--no-env-file", "--no-macros", "--no-install", trashPath, "guard"].map(shellQuoteWord).join(" ")
+    : `${shellQuoteWord(trashPath)} guard`;
   const ordered = [...hits].sort((a, b) => b.word.start - a.word.start);
   let out = command;
   for (const hit of ordered) {
@@ -956,6 +959,24 @@ export interface GuardDependencies {
   cwd: string;
   findTrash: (env?: NodeJS.ProcessEnv) => string | null;
   inspectTrash?: (env?: NodeJS.ProcessEnv) => TrashBinaryInspection;
+  /** Only the verified native worker supplies this execution capability. */
+  execution?: { runtime: string; home: string; path: string; agent: string };
+}
+
+/** Environment-changing shell constructs could run before even /usr/bin/env.
+ * Refuse them in execution mode rather than pretending an outer clean env is
+ * enough. Ordinary command/control-flow/quoting stays with the existing lexer. */
+function changesExecutionEnvironment(command: string): boolean {
+  const stateCommands = new Set(["export", "set", "unset", "readonly", "declare", "typeset", "local", "alias", "unalias", "read", "readarray", "mapfile", "getopts", "trap", "enable", "function", "env", "sudo", "doas", "stdbuf"]);
+  const parsed = lexCommand(command);
+  return parsed.segments.some((segment) => {
+    const index = commandWordIndex(segment);
+    const prefix = segment.words.slice(0, index < 0 ? segment.words.length : index);
+    if (prefix.some((word) => ASSIGNMENT_RE.test(decodeWord(word.text)) || stateCommands.has(baseVerb(decodeWord(word.text))))) return true;
+    if (index < 0) return false;
+    const word = segment.words[index]!;
+    return stateCommands.has(baseVerb(decodeWord(word.text))) || /^\s*\(\s*\)\s*\{/.test(command.slice(word.end));
+  });
 }
 
 function deny(reason: string): CodewithHookOutput {
@@ -1078,8 +1099,12 @@ export function evaluate(input: CodewithHookInput, deps: GuardDependencies): Cod
   }
   const trashPath = trash.path;
 
-  const rewritten = rewriteCommand(command, scanned.rmHits, trashPath);
+  if (deps.execution && changesExecutionEnvironment(command)) {
+    return deny("[trash-guard] A deletion combined with shell environment changes cannot use the verified native execution context. Run the deletion as a separate plain rm command.");
+  }
+  const rewritten = rewriteCommand(command, scanned.rmHits, trashPath, deps.execution);
   const updatedInput = buildUpdatedInput(input.tool_input, rewritten);
+  if (deps.execution) updatedInput.hasna_execution = "hasna.hooks.execution.v1";
 
   if (!updatedInputIsComplete(updatedInput, command, scanned.rmHits, deps.cwd, deps.home)) {
     // Never allow a partial rewrite: the harness falls back to the ORIGINAL

package/hooks/native-safety-entry.ts

@@ -13,6 +13,14 @@ if (!input || Array.isArray(input) || input.hook_event_name !== "PreToolUse" ||
   || !input.tool_input || typeof input.tool_input !== "object" || Array.isArray(input.tool_input)
   || typeof input.cwd !== "string" || !isAbsolute(input.cwd)) throw new Error("Invalid safety input");
 if (input.tool_name === "Bash" && typeof input.tool_input.command !== "string") throw new Error("Invalid shell input");
+const requestedExecution = (input as CodewithHookInput & { hasna_execution?: { schema: string; agent: string } }).hasna_execution;
+if (requestedExecution !== undefined && (!requestedExecution || Object.keys(requestedExecution).sort().join() !== "agent,schema"
+  || requestedExecution.schema !== "hasna.hooks.execution.v1" || typeof requestedExecution.agent !== "string"
+  || !/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/.test(requestedExecution.agent))) throw new Error("Invalid execution capability");
+const execution = requestedExecution === undefined ? undefined : {
+  runtime: process.execPath, home: homedir(), path: process.env.PATH!, agent: requestedExecution.agent,
+};
+if (execution && (!isAbsolute(execution.runtime) || !execution.path)) throw new Error("Invalid bound execution context");
 if (["apply_patch", "ApplyPatch", "functions.apply_patch"].includes(input.tool_name)) {
   if (input.tool_input.command !== undefined && input.tool_input.patch !== undefined && input.tool_input.command !== input.tool_input.patch) throw new Error("Conflicting patch aliases");
   const patch = input.tool_input.command ?? input.tool_input.patch;
@@ -24,5 +32,5 @@ const handoff = input.tool_name === "Bash" && scanCommand(input.tool_input.comma
 const verdict = repos.decision === "block"
   ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: repos.reason } }
   : handoff ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "[workspace-repos-guard] Deletion under a protected repository checkout is refused." } }
-  : name === "trash-guard" ? evaluateTrash(input, { home: homedir(), cwd: input.cwd, findTrash: findTrashBinary, inspectTrash: inspectTrashBinary }) : { continue: true };
+  : name === "trash-guard" ? evaluateTrash(input, { home: homedir(), cwd: input.cwd, findTrash: findTrashBinary, inspectTrash: inspectTrashBinary, execution }) : { continue: true };
 process.stdout.write(JSON.stringify({ verdict: "continue" in verdict ? null : verdict }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/hooks",
-  "version": "0.10.4",
+  "version": "0.10.5",
   "description": "Open source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command",
   "type": "module",
   "bin": {