@hasna/hooks 0.10.4 → 0.10.6

package/README.md

@@ -92,6 +92,36 @@ Repair unsafe installation permissions with a verified package installer, then
 check again. This check alone does not prove hosted authentication, native hook
 trust or a running agent's interception.
 
+## Codex safety readiness
+
+```bash
+hooks safety verify --target codex --cwd /path/to/project --codex-command /absolute/path/to/native/codex
+```
+
+This bounded, read-only check starts its own fresh Codex app-server and asks the
+native consumer for the selected project's hook definitions and feature state.
+It requires exactly one enabled, trusted, synchronous bundled Trash guard, checks
+its installed supervisor by classifying data, and verifies that the native
+definition stayed unchanged. It returns compact JSON and a nonzero exit on
+missing, disabled, untrusted, changed or unsafe state. No deletion is executed.
+
+The command accepts a native Linux ELF or macOS Mach-O executable for the host
+architecture (arm64 or x64); script launchers are refused before execution. When
+Codex is installed through npm, pass the platform package's native binary rather
+than its JavaScript launcher. Executable ownership, permissions, ancestry and
+bytes are checked. Supported protocol versions are 0.153.0, 0.154.0, 0.155.0,
+0.155.1 and 0.156.1; other versions refuse pending compatibility validation.
+The version probe has a five-second forced timeout and native discovery a
+fifteen-second lifetime budget. Neither step restarts an existing agent.
+
+Success reports `nativeDiscoveryVerified: true`, `guardVerified: true` and
+`nativeAdoptionVerified: false`. It does not enroll trust, change configuration,
+authenticate Trash, verify MCP or Instructions, or prove interception by an
+already-running session. Complete those separate setup checks and a fresh native
+interception proof before declaring station support. Use this small readiness
+check after installation, meaningful upgrades and during fresh-agent startup;
+never substitute repeated deletion smoke tests for a startup check.
+
 ## Optional Mementos prompt context
 
 `hooks install mementos-context --target codex` registers a native prompt hook.
@@ -333,13 +363,27 @@ Trash script's Bun interpreter and all preceding PATH directories are checked
 before its identity probe runs; unsafe or unsupported interpreter resolution
 reports `unsafe_interpreter` without executing it.
 
-Native adapters import `@hasna/hooks/native-safety`, pass the final shell/patch
-operation to `evaluateNativeSafety`, and enforce its continue, rewrite or deny
-verdict before execution. Missing or unhealthy bindings reject the call. The
-adapter must preserve cancellation and prevent later hooks from changing admitted
-inputs. This covers supported shell removal and whole-file patch deletion; it
-does not claim universal interception of arbitrary filesystem writes or plugin
-executor replacements. Installing the record alone does not activate a harness.
+Native adapters import `@hasna/hooks/native-safety` and pass the final shell/patch
+operation to `evaluateNativeSafetyForExecution`, with cancellation and an explicit
+agent label. A rewrite returns the complete command, shell, resolved cwd and
+environment. The adapter must use those fields together, disable environment
+inheritance, and prevent later hooks from changing them. Every rewritten removal
+uses the verified absolute Bun runtime with a clean environment and project
+configuration, env files, macros and installation disabled. Deletions combined
+with shell environment changes are refused; run those removals separately.
+
+Use `hooks safety verify --target sumi --execution` for a small, read-only check
+that the saved worker supports this execution contract. A legacy worker that only
+classifies commands cannot pass it. The compatible `evaluateNativeSafety` API and
+verification without `--execution` classify commands only; their success does not
+prove execution compatibility. Neither check runs the returned deletion, creates
+a test file, authenticates Trash or proves native adoption.
+
+The bounded agent label can identify the Sumi session in Trash's existing name
+field; it does not invent unsupported harness/session fields. Missing or unhealthy
+bindings reject the call. This covers supported shell removal and whole-file patch
+deletion, not arbitrary filesystem writes or plugin executor replacements.
+Installing the record alone does not activate a harness.
 
 ## Data Directory
 

package/bin/index.js

@@ -37388,7 +37388,7 @@ var init_redact = __esm(() => {
 });
 
 // src/lib/profiles.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync10, readdirSync as readdirSync8, rmSync, cpSync as cpSync2 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync15, writeFileSync as writeFileSync10, readdirSync as readdirSync8, rmSync, cpSync as cpSync2 } from "fs";
 import { join as join19 } from "path";
 function getProfilesDir() {
   const newDir = join19(getEffectiveDataRoot(), "profiles");
@@ -37434,7 +37434,7 @@ function getProfile(id) {
   try {
     if (!existsSync15(path))
       return null;
-    return JSON.parse(readFileSync14(path, "utf-8"));
+    return JSON.parse(readFileSync15(path, "utf-8"));
   } catch {
     return null;
   }
@@ -37448,7 +37448,7 @@ function listProfiles() {
     const profiles = [];
     for (const file2 of files) {
       try {
-        const content = readFileSync14(join19(dir, file2), "utf-8");
+        const content = readFileSync15(join19(dir, file2), "utf-8");
         profiles.push(JSON.parse(content));
       } catch {}
     }
@@ -37498,12 +37498,12 @@ import { spawnSync as spawnSync2 } from "child_process";
 import { closeSync as closeSync22, fstatSync as fstatSync22, openSync as openSync22, readFileSync as readFileSync22 } from "fs";
 import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";
 import { hostname as osHostname } from "os";
-import { isAbsolute as isAbsolute17, join as join22 } from "path";
+import { isAbsolute as isAbsolute18, join as join22 } from "path";
 import { createRequire as createRequire3 } from "module";
 import { fileURLToPath as fileURLToPath22 } from "url";
-import { closeSync as closeSync6, fstatSync as fstatSync5, lstatSync as lstatSync10, openSync as openSync6, readFileSync as readFileSync15, realpathSync as realpathSync9, statSync as statSync2 } from "fs";
+import { closeSync as closeSync7, fstatSync as fstatSync6, lstatSync as lstatSync15, openSync as openSync7, readFileSync as readFileSync17, realpathSync as realpathSync10, statSync as statSync2 } from "fs";
 import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
-import { basename as basename5, dirname as dirname19, join as join20, relative, sep as sep3 } from "path";
+import { basename as basename5, dirname as dirname20, join as join20, relative, sep as sep3 } from "path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL } from "url";
 function envToken2(name) {
   return name.toUpperCase().replace(/-/g, "_");
@@ -37577,16 +37577,16 @@ function o(e2, r2, t2) {
   }
 }
 function entryPoint(directory2) {
-  const root = realpathSync9(directory2);
-  const fd = openSync6(join20(root, "package.json"), O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+  const root = realpathSync10(directory2);
+  const fd = openSync7(join20(root, "package.json"), O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
   let pkg;
   try {
-    const stat2 = fstatSync5(fd);
+    const stat2 = fstatSync6(fd);
     if (!stat2.isFile() || stat2.size > MAX_PACKAGE_BYTES3)
       throw new Error("Invalid Secrets package metadata");
-    pkg = JSON.parse(readFileSync15(fd, "utf8"));
+    pkg = JSON.parse(readFileSync17(fd, "utf8"));
   } finally {
-    closeSync6(fd);
+    closeSync7(fd);
   }
   if (!pkg || typeof pkg !== "object" || !("name" in pkg) || pkg.name !== PACKAGE) {
     throw new Error("Invalid Secrets package identity");
@@ -37598,7 +37598,7 @@ function entryPoint(directory2) {
   if (/[\\%?#\0]/.test(target) || parts.some((part) => !part || part === "." || part === ".." || part === "node_modules")) {
     throw new Error("Invalid Secrets import export");
   }
-  const file2 = realpathSync9(join20(root, ...parts));
+  const file2 = realpathSync10(join20(root, ...parts));
   const within = relative(root, file2);
   if (!within || within === ".." || within.startsWith(`..${sep3}`) || !statSync2(file2).isFile()) {
     throw new Error("Secrets import export escapes its package or is not a file");
@@ -37606,13 +37606,13 @@ function entryPoint(directory2) {
   return pathToFileURL(file2).href;
 }
 function resolveInstalledSecrets(parentUrl) {
-  let directory2 = dirname19(fileURLToPath3(parentUrl));
+  let directory2 = dirname20(fileURLToPath3(parentUrl));
   for (;; ) {
     if (basename5(directory2) !== "node_modules") {
       const candidate = join20(directory2, "node_modules", PACKAGE);
       let absent = false;
       try {
-        lstatSync10(candidate);
+        lstatSync15(candidate);
       } catch (error61) {
         if (error61.code !== "ENOENT")
           throw error61;
@@ -37621,7 +37621,7 @@ function resolveInstalledSecrets(parentUrl) {
       if (!absent)
         return entryPoint(candidate);
     }
-    const parent = dirname19(directory2);
+    const parent = dirname20(directory2);
     if (parent === directory2)
       throw new Error("Secrets SDK is not installed for this consumer");
     directory2 = parent;
@@ -37633,7 +37633,7 @@ function homeDir(env) {
 }
 function absoluteOverride(env, key) {
   const value = env[key]?.trim();
-  return value && isAbsolute17(value) ? value : null;
+  return value && isAbsolute18(value) ? value : null;
 }
 function hasnaHomeDir(env) {
   const override = absoluteOverride(env, HASNA_HOME_ENV_KEY);
@@ -38740,8 +38740,8 @@ var init_db_writer = __esm(() => {
 });
 
 // src/lib/hook-env.ts
-import { dirname as dirname20, isAbsolute as isAbsolute18 } from "path";
-import { existsSync as existsSync16, realpathSync as realpathSync10, statSync as statSync4 } from "fs";
+import { dirname as dirname21, isAbsolute as isAbsolute19 } from "path";
+import { existsSync as existsSync16, realpathSync as realpathSync11, statSync as statSync4 } from "fs";
 import { tmpdir } from "os";
 function isDeniedEnvName(name) {
   const upper = name.toUpperCase();
@@ -38760,7 +38760,7 @@ function isBashFunctionEnvName(name) {
   return name.startsWith("BASH_FUNC_");
 }
 function isUnsafePathEntry(entry, home) {
-  if (entry === "" || !isAbsolute18(entry))
+  if (entry === "" || !isAbsolute19(entry))
     return true;
   if (home && (entry === home || entry.startsWith(home + "/")))
     return true;
@@ -38770,7 +38770,7 @@ function isUnsafePathEntry(entry, home) {
     return true;
   const canonical4 = (path) => {
     try {
-      return realpathSync10(path);
+      return realpathSync11(path);
     } catch {
       return path;
     }
@@ -38791,7 +38791,7 @@ function sanitizeHookPath(pathValue, home) {
   const baseline = PATH_BASELINE.slice();
   if (process.platform === "darwin" && existsSync16("/opt/homebrew/bin"))
     baseline.push("/opt/homebrew/bin");
-  const bunDir = dirname20(process.execPath);
+  const bunDir = dirname21(process.execPath);
   const seen = new Set;
   const out = [];
   for (const dir of baseline) {
@@ -38916,7 +38916,7 @@ __export(exports_run, {
 });
 import { randomBytes as randomBytes2 } from "crypto";
 import { rmSync as rmSync2, writeFileSync as writeFileSync11 } from "fs";
-import { basename as basename9, dirname as dirname21, isAbsolute as isAbsolute19, join as join24 } from "path";
+import { basename as basename9, dirname as dirname22, isAbsolute as isAbsolute20, join as join24 } from "path";
 function extensionOf(scriptPath) {
   const base = basename9(scriptPath);
   const dot = base.lastIndexOf(".");
@@ -38985,7 +38985,7 @@ async function readPipeWithDeadline(stream, deadlineMs) {
   return chunks.join("");
 }
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname21(options.scriptPath);
+  const scriptDir = dirname22(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
   const tempPath = join24(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
@@ -38996,7 +38996,7 @@ async function executeVerifiedScript(options) {
   }, options.timeout) : null;
   try {
     writeFileSync11(tempPath, options.content, { flag: "wx", mode: 384 });
-    proc = Bun.spawn([...interpreter.command, isAbsolute19(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
+    proc = Bun.spawn([...interpreter.command, isAbsolute20(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
       stdin: new Response(options.stdin),
       stdout: "pipe",
       stderr: "pipe",
@@ -39078,7 +39078,7 @@ __export(exports_custom_install, {
   installCustomSource: () => installCustomSource,
   ensureCustomDir: () => ensureCustomDir
 });
-import { existsSync as existsSync17, mkdirSync as mkdirSync12, mkdtempSync, readFileSync as readFileSync17, rmSync as rmSync4 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync12, mkdtempSync, readFileSync as readFileSync19, rmSync as rmSync4 } from "fs";
 import { join as join27 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 function manifestAt(dir) {
@@ -39086,7 +39086,7 @@ function manifestAt(dir) {
   if (!existsSync17(path))
     return;
   try {
-    return parseManifest(readFileSync17(path, "utf-8"));
+    return parseManifest(readFileSync19(path, "utf-8"));
   } catch {
     return;
   }
@@ -39147,7 +39147,7 @@ async function installCustomSource(source) {
     throw new Error(`No such local path: ${source}`);
   }
   if (source.endsWith("manifest.json")) {
-    const manifest = parseManifest(readFileSync17(source, "utf-8"));
+    const manifest = parseManifest(readFileSync19(source, "utf-8"));
     return writeFromManifest(manifest, source.substring(0, source.lastIndexOf("/")), source, "local");
   }
   return copyManifestDir(source, source, "local");
@@ -39196,13 +39196,13 @@ __export(exports_sync, {
   fetchPinnedHook: () => fetchPinnedHook,
   commitSyncArtifacts: () => commitSyncArtifacts
 });
-import { createHash as createHash12 } from "crypto";
-import { readFileSync as readFileSync19 } from "fs";
+import { createHash as createHash17 } from "crypto";
+import { readFileSync as readFileSync20 } from "fs";
 function sha256OfText(text3) {
-  return createHash12("sha256").update(text3).digest("hex");
+  return createHash17("sha256").update(text3).digest("hex");
 }
 function sha256OfPath(path) {
-  return createHash12("sha256").update(readFileSync19(path)).digest("hex");
+  return createHash17("sha256").update(readFileSync20(path)).digest("hex");
 }
 function collectBundledCatalog() {
   const out = [];
@@ -40357,13 +40357,13 @@ __export(exports_serve, {
   SERVE_HOST: () => SERVE_HOST,
   DEFAULT_SERVE_PORT: () => DEFAULT_SERVE_PORT
 });
-import { readFileSync as readFileSync20 } from "fs";
-import { dirname as dirname22, join as join29 } from "path";
+import { readFileSync as readFileSync21 } from "fs";
+import { dirname as dirname23, join as join29 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function packageVersion() {
   try {
-    const pkgPath = join29(dirname22(fileURLToPath4(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync20(pkgPath, "utf-8")).version || "0.0.0";
+    const pkgPath = join29(dirname23(fileURLToPath4(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync21(pkgPath, "utf-8")).version || "0.0.0";
   } catch {
     return "0.0.0";
   }
@@ -40663,8 +40663,8 @@ import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z as z3 } from "zod";
 import { createServer } from "http";
-import { existsSync as existsSync18, readFileSync as readFileSync21 } from "fs";
-import { join as join30, dirname as dirname23 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync23 } from "fs";
+import { join as join30, dirname as dirname24 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 async function runVerifiedHook(name, stdin, timeoutMs) {
   const { resolveHook: resolveHook2, resolveScriptPath: resolveScriptPath2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
@@ -40673,7 +40673,7 @@ async function runVerifiedHook(name, stdin, timeoutMs) {
   if (!resolved || !hookScript || !existsSync18(hookScript)) {
     throw new Error(`Hook '${name}' not found`);
   }
-  const content = readFileSync21(hookScript);
+  const content = readFileSync23(hookScript);
   const sha4 = sha256Of(content);
   const check2 = checkScriptHash(name, sha4);
   if (!check2.ok) {
@@ -40905,7 +40905,7 @@ function createHooksServer() {
       }
       if (meta3 && settingsExist) {
         try {
-          const settings = JSON.parse(readFileSync21(settingsPath, "utf-8"));
+          const settings = JSON.parse(readFileSync23(settingsPath, "utf-8"));
           if (!hookRegisteredInSettings(settings, name, meta3.event, meta3.matcher)) {
             const eventName = meta3.event.split(":")[0];
             issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
@@ -40945,7 +40945,7 @@ function createHooksServer() {
       const readmePath = join30(hookPath, "README.md");
       let readme = "";
       if (existsSync18(readmePath)) {
-        readme = readFileSync21(readmePath, "utf-8");
+        readme = readFileSync23(readmePath, "utf-8");
       }
       if (verbose) {
         return { content: [{ type: "text", text: JSON.stringify({ ...meta3, readme }) }] };
@@ -41275,7 +41275,7 @@ function createHooksServer() {
     let settings = {};
     try {
       if (existsSync18(settingsPath))
-        settings = JSON.parse(readFileSync21(settingsPath, "utf-8"));
+        settings = JSON.parse(readFileSync23(settingsPath, "utf-8"));
     } catch {}
     if (!settings.hooks)
       settings.hooks = {};
@@ -41298,7 +41298,7 @@ function createHooksServer() {
     let settings = {};
     try {
       if (existsSync18(settingsPath))
-        settings = JSON.parse(readFileSync21(settingsPath, "utf-8"));
+        settings = JSON.parse(readFileSync23(settingsPath, "utf-8"));
     } catch {}
     if (settings.hooks?.__disabled) {
       settings.hooks.__disabled = settings.hooks.__disabled.filter((n2) => n2 !== name);
@@ -41668,13 +41668,13 @@ var init_server = __esm(() => {
   init_redact();
   init_authority();
   init_storage();
-  __dirname3 = dirname23(fileURLToPath5(import.meta.url));
+  __dirname3 = dirname24(fileURLToPath5(import.meta.url));
   pkg = { name: "@hasna/hooks", version: "0.0.0" };
   try {
     for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
       const p = join30(__dirname3, rel);
       if (existsSync18(p)) {
-        pkg = JSON.parse(readFileSync21(p, "utf-8"));
+        pkg = JSON.parse(readFileSync23(p, "utf-8"));
         break;
       }
     }
@@ -43416,8 +43416,8 @@ var {
 
 // src/cli/index.tsx
 import chalk2 from "chalk";
-import { existsSync as existsSync19, readFileSync as readFileSync23, rmSync as rmSync6 } from "fs";
-import { join as join31, dirname as dirname24 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync25, rmSync as rmSync6 } from "fs";
+import { join as join31, dirname as dirname25 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 
 // src/cli/components/App.tsx
@@ -44610,6 +44610,7 @@ class NativeSafetyError extends Error {
     this.name = "NativeSafetyError";
   }
 }
+var executionSchema = "hasna.hooks.execution.v1";
 var hash = (value) => createHash7("sha256").update(value).digest("hex");
 var filename = "sumi-trash-guard.json";
 var owner2 = (uid2) => uid2 === 0 || uid2 === process.getuid?.();
@@ -44764,10 +44765,31 @@ function registerNativeSafety(options = {}) {
     syncDirectory(directory2);
   }
 }
-async function evaluateRecord(event, record3, signal) {
+async function evaluateNativeSafetyForExecution(event, options) {
+  if (!options || typeof options.agent !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/.test(options.agent))
+    throw new NativeSafetyError("input_invalid");
+  let snapshot2;
+  try {
+    snapshot2 = JSON.parse(JSON.stringify(event));
+  } catch {
+    throw new NativeSafetyError("input_invalid");
+  }
+  if (snapshot2?.tool_input && Object.hasOwn(snapshot2.tool_input, "hasna_execution"))
+    throw new NativeSafetyError("input_invalid");
+  const before = readNativeSafetyRegistration(options.home);
+  const binding = nativeSafetyCommandBinding(before.record.command);
+  const decision = await evaluateRecord(snapshot2, before.record, options.signal, options.agent);
+  if (readNativeSafetyRegistration(options.home).sha256 !== before.sha256)
+    throw new NativeSafetyError("binding_changed");
+  return decision.decision === "rewrite" ? {
+    decision: "rewrite",
+    execution: { command: decision.command, shell: "/bin/sh", cwd: snapshot2.cwd, env: { HOME: binding.home, PATH: binding.path } }
+  } : decision;
+}
+async function evaluateRecord(event, record3, signal, executionAgent) {
   if (!event || event.hook_event_name !== "PreToolUse" || !["Bash", "apply_patch"].includes(event.tool_name) || typeof event.cwd !== "string" || !isAbsolute7(event.cwd) || !event.tool_input || typeof event.tool_input !== "object" || Array.isArray(event.tool_input))
     throw new NativeSafetyError("input_invalid");
-  const input2 = JSON.stringify(event);
+  const input2 = JSON.stringify(executionAgent === undefined ? event : { ...event, hasna_execution: { schema: executionSchema, agent: executionAgent } });
   if (Buffer.byteLength(input2) > 1048576)
     throw new NativeSafetyError("input_invalid");
   const output2 = await new Promise((accept, reject) => {
@@ -44792,7 +44814,7 @@ async function evaluateRecord(event, record3, signal) {
       throw new Error;
     if (verdict.permissionDecision === "deny" && Object.keys(verdict).sort().join() === "hookEventName,permissionDecision,permissionDecisionReason" && typeof verdict.permissionDecisionReason === "string" && verdict.permissionDecisionReason.trim())
       return { decision: "deny", reason: verdict.permissionDecisionReason };
-    if (event.tool_name === "Bash" && verdict.permissionDecision === "allow" && Object.keys(verdict).sort().join() === "hookEventName,permissionDecision,updatedInput" && typeof verdict.updatedInput?.command === "string" && verdict.updatedInput.command.trim())
+    if (event.tool_name === "Bash" && verdict.permissionDecision === "allow" && Object.keys(verdict).sort().join() === "hookEventName,permissionDecision,updatedInput" && typeof verdict.updatedInput?.command === "string" && verdict.updatedInput.command.trim() && (executionAgent === undefined || verdict.updatedInput.hasna_execution === executionSchema))
       return { decision: "rewrite", command: verdict.updatedInput.command };
   } catch {}
   throw new NativeSafetyError("guard_failed");
@@ -44812,6 +44834,20 @@ async function verifyNativeSafetyRegistration(home = homedir7()) {
     throw new NativeSafetyError("binding_changed");
   return { path: before.path, sha256: before.sha256 };
 }
+async function verifyNativeSafetyExecutionRegistration(home = homedir7()) {
+  const before = readNativeSafetyRegistration(home);
+  const verdict = await evaluateNativeSafetyForExecution({
+    hook_event_name: "PreToolUse",
+    tool_name: "Bash",
+    cwd: home,
+    tool_input: { command: "rm -- .hasna-trash-verification-only" }
+  }, { home, agent: "native-safety-verification" });
+  if (verdict.decision !== "rewrite")
+    throw new NativeSafetyError("guard_failed", verdict.decision === "deny" ? verdict.reason.slice(0, 512) : undefined);
+  if (readNativeSafetyRegistration(home).sha256 !== before.sha256)
+    throw new NativeSafetyError("binding_changed");
+  return { path: before.path, sha256: before.sha256 };
+}
 
 // hooks/hook-trash-guard/src/binary.ts
 import { dirname as dirname17, isAbsolute as isAbsolute15, join as join17, resolve as resolve17 } from "path";
@@ -44987,6 +45023,268 @@ function inspectTrashBinary(env = process.env) {
   return { ok: false, code: failure };
 }
 
+// src/lib/codex-safety-check.ts
+init_native_safety();
+import { spawn as spawn2, execFile as execFile2 } from "child_process";
+import { createHash as createHash12 } from "crypto";
+import { constants as constants12, openSync as openSync6, closeSync as closeSync6, fstatSync as fstatSync5, lstatSync as lstatSync10, readFileSync as readFileSync14, realpathSync as realpathSync9 } from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname19, isAbsolute as isAbsolute17 } from "path";
+import { promisify } from "util";
+var versions = new Set(["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1"]);
+var matcher = "^(Bash|apply_patch|ApplyPatch|functions\\.apply_patch)$";
+
+class CodexSafetyError extends Error {
+  code;
+  constructor(code2) {
+    super(`Codex deletion safety check failed (${code2}).`);
+    this.code = code2;
+    this.name = "CodexSafetyError";
+  }
+}
+function need5(condition, code2) {
+  if (!condition)
+    throw new CodexSafetyError(code2);
+}
+var digest3 = (bytes) => createHash12("sha256").update(bytes).digest("hex");
+function nativeHeader(bytes) {
+  if (bytes.length < 64 || !["arm64", "x64"].includes(process.arch))
+    return false;
+  if (process.platform === "darwin") {
+    const cpu = process.arch === "arm64" ? 16777228 : 16777223;
+    return bytes.readUInt32LE(0) === 4277009103 && bytes.readUInt32LE(4) === cpu && bytes.readUInt32LE(12) === 2 && bytes.readUInt32LE(16) > 0 && bytes.readUInt32LE(16) <= 4096 && bytes.readUInt32LE(20) > 0 && bytes.readUInt32LE(20) <= bytes.length - 32;
+  }
+  if (process.platform === "linux") {
+    const offset = bytes.readBigUInt64LE(32), count = bytes.readUInt16LE(56);
+    return bytes.subarray(0, 7).equals(Buffer.from([127, 69, 76, 70, 2, 1, 1])) && [2, 3].includes(bytes.readUInt16LE(16)) && bytes.readUInt16LE(18) === (process.arch === "arm64" ? 183 : 62) && bytes.readUInt32LE(20) === 1 && bytes.readUInt16LE(52) === 64 && bytes.readUInt16LE(54) === 56 && count > 0 && count <= 1024 && offset >= 64n && offset + BigInt(count * 56) <= BigInt(bytes.length);
+  }
+  return false;
+}
+function executable(command) {
+  const found = isAbsolute17(command) ? command : Bun.which(command);
+  need5(found, "native_unavailable");
+  try {
+    const path = realpathSync9(found);
+    for (let parent = dirname19(path);; parent = dirname19(parent)) {
+      const stat2 = lstatSync10(parent);
+      need5(stat2.isDirectory() && [0, process.getuid?.()].includes(stat2.uid) && !(stat2.mode & 18), "native_unsafe_executable");
+      if (parent === dirname19(parent))
+        break;
+    }
+    const fd = openSync6(path, constants12.O_RDONLY | constants12.O_NOFOLLOW | constants12.O_NONBLOCK);
+    try {
+      const stat2 = fstatSync5(fd);
+      need5(stat2.isFile() && [0, process.getuid?.()].includes(stat2.uid) && !(stat2.mode & 18) && !!(stat2.mode & 64) && stat2.size <= 256000000, "native_unsafe_executable");
+      const bytes = readFileSync14(fd);
+      need5(bytes.length <= 256000000, "native_unavailable");
+      need5(nativeHeader(bytes), "native_executable_required");
+      return { path, sha256: digest3(bytes) };
+    } finally {
+      closeSync6(fd);
+    }
+  } catch (error61) {
+    if (error61 instanceof CodexSafetyError)
+      throw error61;
+    throw new CodexSafetyError("native_unavailable");
+  }
+}
+async function connectCodexSafety(options) {
+  const command = options.command ?? "codex", before = executable(command);
+  const env = { ...process.env, HOME: options.home, NO_COLOR: "1" };
+  for (const key of ["NODE_OPTIONS", "NODE_PATH", "BUN_OPTIONS", "BASH_ENV", "ENV", "DYLD_INSERT_LIBRARIES", "LD_PRELOAD"])
+    delete env[key];
+  if (options.codexHome === undefined)
+    delete env.CODEX_HOME;
+  else
+    env.CODEX_HOME = options.codexHome;
+  let version2;
+  try {
+    version2 = (await promisify(execFile2)(before.path, ["--version"], { env, cwd: options.home, timeout: 5000, killSignal: "SIGKILL", maxBuffer: 4096 })).stdout.trim();
+  } catch {
+    throw new CodexSafetyError("native_unavailable");
+  }
+  need5(versions.has(version2), "native_unsupported");
+  need5(JSON.stringify(executable(command)) === JSON.stringify(before), "guard_changed");
+  const child = spawn2(before.path, ["app-server", "--strict-config", "--stdio"], { env, cwd: options.home, stdio: ["pipe", "pipe", "pipe"] });
+  let stopped = false, buffer = Buffer.alloc(0), total = 0, nextId = 1;
+  const pending = new Map;
+  const fail2 = () => {
+    stopped = true;
+    for (const waiter of pending.values())
+      waiter.reject(new CodexSafetyError("native_failed"));
+    pending.clear();
+  };
+  const deadline = setTimeout(() => {
+    fail2();
+    child.kill("SIGKILL");
+  }, 15000);
+  const exited = new Promise((done) => {
+    child.once("exit", () => {
+      fail2();
+      clearTimeout(deadline);
+      done();
+    });
+    child.once("error", () => {
+      fail2();
+      clearTimeout(deadline);
+      done();
+    });
+  });
+  child.stdin.on("error", fail2);
+  const account = (length) => {
+    total += length;
+    if (total > 8388608) {
+      fail2();
+      child.kill("SIGKILL");
+      return false;
+    }
+    return true;
+  };
+  child.stderr.on("data", (bytes) => {
+    account(bytes.length);
+  });
+  child.stdout.on("data", (bytes) => {
+    if (stopped || !account(bytes.length))
+      return;
+    buffer = Buffer.concat([buffer, bytes]);
+    for (;; ) {
+      const end = buffer.indexOf(10);
+      if (end < 0)
+        return;
+      const line = buffer.subarray(0, end);
+      buffer = buffer.subarray(end + 1);
+      try {
+        const value = JSON.parse(line.toString("utf8"));
+        if (!value || typeof value !== "object" || Array.isArray(value))
+          throw Error();
+        if (!Object.hasOwn(value, "id"))
+          continue;
+        const waiter = pending.get(value.id);
+        if (!waiter)
+          throw Error();
+        pending.delete(value.id);
+        if (value.error || !Object.hasOwn(value, "result"))
+          waiter.reject(new CodexSafetyError("native_failed"));
+        else
+          waiter.resolve(value.result);
+      } catch {
+        fail2();
+        child.kill("SIGKILL");
+        return;
+      }
+    }
+  });
+  const request = (method, params) => new Promise((accept, reject) => {
+    if (stopped) {
+      reject(new CodexSafetyError("native_failed"));
+      return;
+    }
+    const id = nextId++;
+    pending.set(id, { resolve: accept, reject });
+    child.stdin.write(JSON.stringify({ id, method, params }) + `
+`);
+  });
+  const rpc = {
+    version: version2,
+    request,
+    async close() {
+      fail2();
+      child.stdin.end();
+      const force = setTimeout(() => child.kill("SIGKILL"), 1000);
+      await exited;
+      clearTimeout(force);
+      clearTimeout(deadline);
+      need5(JSON.stringify(executable(command)) === JSON.stringify(before), "guard_changed");
+    }
+  };
+  try {
+    await request("initialize", { clientInfo: { name: "hooks-safety-check", version: "1" }, capabilities: { experimentalApi: true } });
+    child.stdin.write(`{"method":"initialized"}
+`);
+    return rpc;
+  } catch {
+    await rpc.close();
+    throw new CodexSafetyError("native_failed");
+  }
+}
+function selectCodexSafety(discovery, configuration, home, cwd, featureEnabled) {
+  const data = discovery?.data;
+  need5(Array.isArray(data) && data.length === 1 && data[0]?.cwd === cwd && Array.isArray(data[0]?.hooks) && data[0].hooks.length <= 1e4 && Array.isArray(data[0].errors) && data[0].errors.length === 0 && Array.isArray(data[0].warnings) && data[0].warnings.length === 0, "native_discovery_failed");
+  const config2 = configuration?.config;
+  need5(config2 && typeof config2 === "object" && !Array.isArray(config2), "native_discovery_failed");
+  need5((config2.features?.hooks ?? featureEnabled) === true, "hooks_disabled");
+  for (const hook2 of data[0].hooks)
+    if (typeof hook2?.command === "string") {
+      if (/\bhasna-native-safety-v\d+\b/.test(hook2.command))
+        need5(nativeSafetyCommandBinding(hook2.command), "guard_definition_invalid");
+      need5(!/^(?:hooks run trash-guard|hook-trash-guard)(?:\s|$)/.test(hook2.command.trim()), "guard_definition_invalid");
+    }
+  const selected = data[0].hooks.filter((hook2) => typeof hook2?.command === "string" && nativeSafetyCommandBinding(hook2.command)?.name === "trash-guard");
+  need5(selected.length !== 0, "guard_missing");
+  need5(selected.length === 1, "guard_ambiguous");
+  const hook = selected[0], binding = nativeSafetyCommandBinding(hook.command);
+  need5(binding.home === home && hook.eventName === "preToolUse" && hook.handlerType === "command" && hook.matcher === matcher && hook.timeoutSec === 10 && hook.async === false && hook.statusMessage === null && hook.additionalContextLimit === null && typeof hook.key === "string" && hook.key.length <= 4096 && typeof hook.sourcePath === "string" && isAbsolute17(hook.sourcePath) && hook.pluginId === null && hook.isManaged === false && ["user", "project"].includes(hook.source) && typeof hook.currentHash === "string" && /^sha256:[a-f0-9]{64}$/.test(hook.currentHash), "guard_definition_invalid");
+  need5(hook.enabled === true, "guard_disabled");
+  need5(hook.trustStatus === "trusted", "guard_untrusted");
+  return { key: hook.key, command: hook.command, currentHash: hook.currentHash, sourcePath: hook.sourcePath, enabled: true, trustStatus: "trusted" };
+}
+async function verifyCodexNativeSafety(options = {}, dependencies = {}) {
+  const home = realpathSync9(options.home ?? homedir8()), cwd = realpathSync9(options.cwd ?? process.cwd());
+  need5(isAbsolute17(home) && isAbsolute17(cwd), "native_unavailable");
+  const rpc = await (dependencies.connect ?? connectCodexSafety)({ ...options, home });
+  try {
+    need5(versions.has(rpc.version), "native_unsupported");
+    const inspect = async () => {
+      const hooks = await rpc.request("hooks/list", { cwds: [cwd] });
+      const configuration = await rpc.request("config/read", { cwd, includeLayers: false });
+      let enabled;
+      if (configuration?.config?.features?.hooks === undefined) {
+        let cursor = null, count = 0;
+        const seen = new Set;
+        do {
+          const page3 = await rpc.request("experimentalFeature/list", { cursor, limit: 100 });
+          need5(Array.isArray(page3?.data) && page3.data.length <= 100 && (page3.nextCursor === null || typeof page3.nextCursor === "string"), "native_discovery_failed");
+          count += page3.data.length;
+          need5(count <= 1000, "native_discovery_failed");
+          for (const feature of page3.data)
+            if (feature?.name === "hooks") {
+              need5(enabled === undefined && typeof feature.enabled === "boolean", "native_discovery_failed");
+              enabled = feature.enabled;
+            }
+          cursor = page3.nextCursor;
+          if (cursor !== null) {
+            need5(cursor.length > 0 && cursor.length <= 4096 && !seen.has(cursor) && page3.data.length > 0, "native_discovery_failed");
+            seen.add(cursor);
+          }
+        } while (cursor !== null);
+      }
+      return selectCodexSafety(hooks, configuration, home, cwd, enabled);
+    };
+    const before = await inspect();
+    try {
+      await (dependencies.verify ?? verifyNativeSafetyCommand)(before.command, home);
+    } catch {
+      throw new CodexSafetyError("guard_failed");
+    }
+    need5(JSON.stringify(await inspect()) === JSON.stringify(before), "guard_changed");
+    return {
+      ok: true,
+      target: "codex",
+      nativeVersion: rpc.version,
+      cwd,
+      key: before.key,
+      currentHash: before.currentHash,
+      enabled: true,
+      trusted: true,
+      guardVerified: true,
+      nativeDiscoveryVerified: true,
+      nativeAdoptionVerified: false
+    };
+  } finally {
+    await rpc.close();
+  }
+}
+
 // src/cli/index.tsx
 init_registry();
 init_installer();
@@ -45003,9 +45301,9 @@ init_local_opt_in();
 init_transport2();
 init_db();
 import { jsxDEV as jsxDEV8 } from "react/jsx-dev-runtime";
-var __dirname4 = dirname24(fileURLToPath6(import.meta.url));
+var __dirname4 = dirname25(fileURLToPath6(import.meta.url));
 var pkgPath = existsSync19(join31(__dirname4, "..", "package.json")) ? join31(__dirname4, "..", "package.json") : join31(__dirname4, "..", "..", "package.json");
-var pkg2 = JSON.parse(readFileSync23(pkgPath, "utf-8"));
+var pkg2 = JSON.parse(readFileSync25(pkgPath, "utf-8"));
 var program3 = new Command;
 function resolveScope(options) {
   if (options.project)
@@ -45085,7 +45383,7 @@ async function openLocalStoreOrExit(json3) {
 function readToken(tokenFile) {
   if (tokenFile) {
     try {
-      return readFileSync23(tokenFile, "utf-8").trim();
+      return readFileSync25(tokenFile, "utf-8").trim();
     } catch {
       return;
     }
@@ -45099,9 +45397,9 @@ function readmePreview(readme, max = 280) {
   return preview2 ? truncateText2(preview2, max) : undefined;
 }
 function hookSummaryLine(hook, options = {}) {
-  const matcher = hook.matcher ? ` ${hook.matcher}` : "";
+  const matcher2 = hook.matcher ? ` ${hook.matcher}` : "";
   const description = options.verbose ? ` - ${truncateText2(hook.description, 110)}` : "";
-  return `  ${chalk2.cyan(hook.name.padEnd(17))} ${chalk2.dim(`[${hook.event}${matcher}]`)} ${chalk2.dim(hook.category)}${description}`;
+  return `  ${chalk2.cyan(hook.name.padEnd(17))} ${chalk2.dim(`[${hook.event}${matcher2}]`)} ${chalk2.dim(hook.category)}${description}`;
 }
 function listStoreHooks() {
   const out = [];
@@ -45251,7 +45549,7 @@ program3.command("run").argument("<hook>", "Hook to run").option("--profile <id>
     console.error(JSON.stringify({ error: `Hook script not found: ${hookScript ?? hook}` }));
     process.exit(1);
   }
-  const content = readFileSync23(hookScript);
+  const content = readFileSync25(hookScript);
   const sha4 = sha256Of2(content);
   const check2 = checkScriptHash2(hook, sha4);
   if (!check2.ok) {
@@ -45853,7 +46151,7 @@ program3.command("doctor").option("-g, --global", "Check global settings", false
   let wiringCount = 0;
   if (settingsExist) {
     try {
-      const settings = JSON.parse(readFileSync23(settingsPath, "utf-8"));
+      const settings = JSON.parse(readFileSync25(settingsPath, "utf-8"));
       wiringCount = countSettingsWiring(settings);
     } catch {}
   }
@@ -45883,7 +46181,7 @@ program3.command("doctor").option("-g, --global", "Check global settings", false
     }
     if (meta3 && settingsExist) {
       try {
-        const settings = JSON.parse(readFileSync23(settingsPath, "utf-8"));
+        const settings = JSON.parse(readFileSync25(settingsPath, "utf-8"));
         if (!hookRegisteredInSettings(settings, name, meta3.event, meta3.matcher)) {
           const eventName = meta3.event.split(":")[0];
           issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
@@ -46089,7 +46387,7 @@ program3.command("docs").argument("[hook]", "Hook name (shows general docs if om
     const readmePath = join31(hookPath, "README.md");
     let readme = "";
     if (existsSync19(readmePath)) {
-      readme = readFileSync23(readmePath, "utf-8");
+      readme = readFileSync25(readmePath, "utf-8");
     }
     if (options.json) {
       console.log(JSON.stringify({ ...meta3, readme }));
@@ -46759,12 +47057,25 @@ safety.command("install <guard>").option("--target <target>", "codex, claude or
   if (!result.success)
     process.exitCode = 1;
 });
-safety.command("verify").requiredOption("--target <target>", "sumi").description("Verify a required native binding and its supervisor without running a file operation").action(async (options) => {
+safety.command("verify").requiredOption("--target <target>", "sumi or codex").option("--cwd <path>", "Codex project context to inspect (defaults to the current directory)").option("--codex-command <path>", "Installed Codex executable").option("--execution", "Also require the pinned native execution capability; no file operation is run").description("Verify a required native binding and its supervisor without running a file operation").action(async (options) => {
+  if (options.target === "codex") {
+    try {
+      if (options.execution)
+        throw new CodexSafetyError("native_unsupported");
+      console.log(JSON.stringify(await verifyCodexNativeSafety({ command: options.codexCommand, cwd: options.cwd, codexHome: process.env.CODEX_HOME })));
+    } catch (error61) {
+      console.log(JSON.stringify({ ok: false, target: "codex", code: error61 instanceof CodexSafetyError ? error61.code : "native_failed" }));
+      process.exitCode = 1;
+    }
+    return;
+  }
   try {
+    if (options.cwd || options.codexCommand)
+      throw new NativeSafetyError("input_invalid");
     if (options.target !== "sumi")
       throw new NativeSafetyError("input_invalid");
-    const current2 = await verifyNativeSafetyRegistration();
-    console.log(JSON.stringify({ ok: true, target: "sumi", sha256: current2.sha256, guardVerified: true, nativeAdoptionVerified: false }));
+    const current2 = await (options.execution ? verifyNativeSafetyExecutionRegistration() : verifyNativeSafetyRegistration());
+    console.log(JSON.stringify({ ok: true, target: "sumi", sha256: current2.sha256, guardVerified: true, ...options.execution ? { executionCapabilityVerified: true } : {}, nativeAdoptionVerified: false }));
   } catch (error61) {
     console.log(JSON.stringify({ ok: false, target: "sumi", code: error61 instanceof NativeSafetyError ? error61.code : "guard_failed", ...error61 instanceof NativeSafetyError && error61.reason ? { reason: error61.reason } : {} }));
     process.exitCode = 1;

package/bin/native-safety-entry.js

@@ -911,8 +911,21 @@ function shellQuoteWord(word) {
     return word;
   return `'${word.replace(/'/g, `'\\''`)}'`;
 }
-function rewriteCommand(command, hits, trashPath) {
-  const replacement = `${shellQuoteWord(trashPath)} guard`;
+function rewriteCommand(command, hits, trashPath, execution) {
+  const replacement = execution ? [
+    "/usr/bin/env",
+    "-i",
+    `HOME=${execution.home}`,
+    `PATH=${execution.path}`,
+    `HASNA_TRASH_AGENT=${execution.agent}`,
+    execution.runtime,
+    "--config=/dev/null",
+    "--no-env-file",
+    "--no-macros",
+    "--no-install",
+    trashPath,
+    "guard"
+  ].map(shellQuoteWord).join(" ") : `${shellQuoteWord(trashPath)} guard`;
   const ordered = [...hits].sort((a, b) => b.word.start - a.word.start);
   let out = command;
   for (const hit of ordered) {
@@ -964,6 +977,20 @@ function updatedInputIsComplete(updated, original, hits, cwd, home) {
     return false;
   return rewriteIsComplete(original, updated.command, hits, cwd, home);
 }
+function changesExecutionEnvironment(command) {
+  const stateCommands = new Set(["export", "set", "unset", "readonly", "declare", "typeset", "local", "alias", "unalias", "read", "readarray", "mapfile", "getopts", "trap", "enable", "function", "env", "sudo", "doas", "stdbuf"]);
+  const parsed = lexCommand(command);
+  return parsed.segments.some((segment) => {
+    const index = commandWordIndex(segment);
+    const prefix = segment.words.slice(0, index < 0 ? segment.words.length : index);
+    if (prefix.some((word2) => ASSIGNMENT_RE.test(decodeWord(word2.text)) || stateCommands.has(baseVerb(decodeWord(word2.text)))))
+      return true;
+    if (index < 0)
+      return false;
+    const word = segment.words[index];
+    return stateCommands.has(baseVerb(decodeWord(word.text))) || /^\s*\(\s*\)\s*\{/.test(command.slice(word.end));
+  });
+}
 function deny(reason) {
   return {
     hookSpecificOutput: {
@@ -1042,8 +1069,13 @@ function evaluate(input, deps) {
     return deny(ABSENT_REASON);
   }
   const trashPath = trash.path;
-  const rewritten = rewriteCommand(command, scanned.rmHits, trashPath);
+  if (deps.execution && changesExecutionEnvironment(command)) {
+    return deny("[trash-guard] A deletion combined with shell environment changes cannot use the verified native execution context. Run the deletion as a separate plain rm command.");
+  }
+  const rewritten = rewriteCommand(command, scanned.rmHits, trashPath, deps.execution);
   const updatedInput = buildUpdatedInput(input.tool_input, rewritten);
+  if (deps.execution)
+    updatedInput.hasna_execution = "hasna.hooks.execution.v1";
   if (!updatedInputIsComplete(updatedInput, command, scanned.rmHits, deps.cwd, deps.home)) {
     return deny("[trash-guard] The rewrite of this command did not verify (the delete could not be redirected cleanly), so the command is refused rather than run unredirected. Re-run the delete as a plain `rm -- <path>` command.");
   }
@@ -1379,6 +1411,17 @@ if (!input || Array.isArray(input) || input.hook_event_name !== "PreToolUse" ||
   throw new Error("Invalid safety input");
 if (input.tool_name === "Bash" && typeof input.tool_input.command !== "string")
   throw new Error("Invalid shell input");
+var requestedExecution = input.hasna_execution;
+if (requestedExecution !== undefined && (!requestedExecution || Object.keys(requestedExecution).sort().join() !== "agent,schema" || requestedExecution.schema !== "hasna.hooks.execution.v1" || typeof requestedExecution.agent !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/.test(requestedExecution.agent)))
+  throw new Error("Invalid execution capability");
+var execution = requestedExecution === undefined ? undefined : {
+  runtime: process.execPath,
+  home: homedir2(),
+  path: process.env.PATH,
+  agent: requestedExecution.agent
+};
+if (execution && (!isAbsolute4(execution.runtime) || !execution.path))
+  throw new Error("Invalid bound execution context");
 if (["apply_patch", "ApplyPatch", "functions.apply_patch"].includes(input.tool_name)) {
   if (input.tool_input.command !== undefined && input.tool_input.patch !== undefined && input.tool_input.command !== input.tool_input.patch)
     throw new Error("Conflicting patch aliases");
@@ -1389,5 +1432,5 @@ if (["apply_patch", "ApplyPatch", "functions.apply_patch"].includes(input.tool_n
 }
 var repos = evaluate2(input).output;
 var handoff = input.tool_name === "Bash" && scanCommand(input.tool_input.command, { home: homedir2(), cwd: input.cwd }).handoffHits.length > 0;
-var verdict = repos.decision === "block" ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: repos.reason } } : handoff ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "[workspace-repos-guard] Deletion under a protected repository checkout is refused." } } : name === "trash-guard" ? evaluate(input, { home: homedir2(), cwd: input.cwd, findTrash: findTrashBinary, inspectTrash: inspectTrashBinary }) : { continue: true };
+var verdict = repos.decision === "block" ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: repos.reason } } : handoff ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "[workspace-repos-guard] Deletion under a protected repository checkout is refused." } } : name === "trash-guard" ? evaluate(input, { home: homedir2(), cwd: input.cwd, findTrash: findTrashBinary, inspectTrash: inspectTrashBinary, execution }) : { continue: true };
 process.stdout.write(JSON.stringify({ verdict: "continue" in verdict ? null : verdict }));

package/dist/native-safety.d.ts

@@ -19,6 +19,20 @@ export type NativeSafetyDecision = {
     decision: "rewrite";
     command: string;
 };
+export type NativeSafetyExecutionDecision = Exclude<NativeSafetyDecision, {
+    decision: "rewrite";
+}> | {
+    decision: "rewrite";
+    execution: {
+        command: string;
+        shell: "/bin/sh";
+        cwd: string;
+        env: {
+            HOME: string;
+            PATH: string;
+        };
+    };
+};
 export type NativeSafetyRecord = {
     schema: "hasna.hooks.native-safety.v1";
     harness: "sumi";
@@ -48,6 +62,15 @@ export declare function evaluateNativeSafety(event: NativeSafetyEvent, options?:
     home?: string;
     signal?: AbortSignal;
 }): Promise<NativeSafetyDecision>;
+/** Native tool dispatch consumes this entire context, with environment inheritance
+ * disabled. The worker pins each Trash invocation to its verified Bun runtime,
+ * ignoring caller PATH, preload variables and cwd Bun configuration. `agent` is
+ * the bounded explicit Trash label; it does not invent a harness/session enum. */
+export declare function evaluateNativeSafetyForExecution(event: NativeSafetyEvent, options: {
+    home?: string;
+    signal?: AbortSignal;
+    agent: string;
+}): Promise<NativeSafetyExecutionDecision>;
 /** Classify a synthetic removal through this exact supervisor without executing
  * the returned command or creating a file. A harmless ':' would not test whether
  * the saved PATH can actually resolve Trash. */
@@ -56,3 +79,10 @@ export declare function verifyNativeSafetyRegistration(home?: string): Promise<{
     path: string;
     sha256: string;
 }>;
+/** Read-only compatibility check for native dispatch. This classifies one
+ * synthetic removal and requires the execution capability; it never executes
+ * the rewrite, creates a fixture, authenticates Trash or proves harness adoption. */
+export declare function verifyNativeSafetyExecutionRegistration(home?: string): Promise<{
+    path: string;
+    sha256: string;
+}>;

package/dist/native-safety.js

@@ -148,6 +148,7 @@ class NativeSafetyError extends Error {
     this.name = "NativeSafetyError";
   }
 }
+var executionSchema = "hasna.hooks.execution.v1";
 var hash = (value) => createHash2("sha256").update(value).digest("hex");
 var filename = "sumi-trash-guard.json";
 var owner = (uid) => uid === 0 || uid === process.getuid?.();
@@ -305,10 +306,31 @@ function registerNativeSafety(options = {}) {
 async function evaluateNativeSafety(event, options = {}) {
   return evaluateRecord(event, readNativeSafetyRegistration(options.home).record, options.signal);
 }
-async function evaluateRecord(event, record, signal) {
+async function evaluateNativeSafetyForExecution(event, options) {
+  if (!options || typeof options.agent !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/.test(options.agent))
+    throw new NativeSafetyError("input_invalid");
+  let snapshot;
+  try {
+    snapshot = JSON.parse(JSON.stringify(event));
+  } catch {
+    throw new NativeSafetyError("input_invalid");
+  }
+  if (snapshot?.tool_input && Object.hasOwn(snapshot.tool_input, "hasna_execution"))
+    throw new NativeSafetyError("input_invalid");
+  const before = readNativeSafetyRegistration(options.home);
+  const binding = nativeSafetyCommandBinding(before.record.command);
+  const decision = await evaluateRecord(snapshot, before.record, options.signal, options.agent);
+  if (readNativeSafetyRegistration(options.home).sha256 !== before.sha256)
+    throw new NativeSafetyError("binding_changed");
+  return decision.decision === "rewrite" ? {
+    decision: "rewrite",
+    execution: { command: decision.command, shell: "/bin/sh", cwd: snapshot.cwd, env: { HOME: binding.home, PATH: binding.path } }
+  } : decision;
+}
+async function evaluateRecord(event, record, signal, executionAgent) {
   if (!event || event.hook_event_name !== "PreToolUse" || !["Bash", "apply_patch"].includes(event.tool_name) || typeof event.cwd !== "string" || !isAbsolute2(event.cwd) || !event.tool_input || typeof event.tool_input !== "object" || Array.isArray(event.tool_input))
     throw new NativeSafetyError("input_invalid");
-  const input = JSON.stringify(event);
+  const input = JSON.stringify(executionAgent === undefined ? event : { ...event, hasna_execution: { schema: executionSchema, agent: executionAgent } });
   if (Buffer.byteLength(input) > 1048576)
     throw new NativeSafetyError("input_invalid");
   const output = await new Promise((accept, reject) => {
@@ -333,7 +355,7 @@ async function evaluateRecord(event, record, signal) {
       throw new Error;
     if (verdict.permissionDecision === "deny" && Object.keys(verdict).sort().join() === "hookEventName,permissionDecision,permissionDecisionReason" && typeof verdict.permissionDecisionReason === "string" && verdict.permissionDecisionReason.trim())
       return { decision: "deny", reason: verdict.permissionDecisionReason };
-    if (event.tool_name === "Bash" && verdict.permissionDecision === "allow" && Object.keys(verdict).sort().join() === "hookEventName,permissionDecision,updatedInput" && typeof verdict.updatedInput?.command === "string" && verdict.updatedInput.command.trim())
+    if (event.tool_name === "Bash" && verdict.permissionDecision === "allow" && Object.keys(verdict).sort().join() === "hookEventName,permissionDecision,updatedInput" && typeof verdict.updatedInput?.command === "string" && verdict.updatedInput.command.trim() && (executionAgent === undefined || verdict.updatedInput.hasna_execution === executionSchema))
       return { decision: "rewrite", command: verdict.updatedInput.command };
   } catch {}
   throw new NativeSafetyError("guard_failed");
@@ -353,11 +375,27 @@ async function verifyNativeSafetyRegistration(home = homedir2()) {
     throw new NativeSafetyError("binding_changed");
   return { path: before.path, sha256: before.sha256 };
 }
+async function verifyNativeSafetyExecutionRegistration(home = homedir2()) {
+  const before = readNativeSafetyRegistration(home);
+  const verdict = await evaluateNativeSafetyForExecution({
+    hook_event_name: "PreToolUse",
+    tool_name: "Bash",
+    cwd: home,
+    tool_input: { command: "rm -- .hasna-trash-verification-only" }
+  }, { home, agent: "native-safety-verification" });
+  if (verdict.decision !== "rewrite")
+    throw new NativeSafetyError("guard_failed", verdict.decision === "deny" ? verdict.reason.slice(0, 512) : undefined);
+  if (readNativeSafetyRegistration(home).sha256 !== before.sha256)
+    throw new NativeSafetyError("binding_changed");
+  return { path: before.path, sha256: before.sha256 };
+}
 export {
   verifyNativeSafetyRegistration,
+  verifyNativeSafetyExecutionRegistration,
   verifyNativeSafetyCommand,
   registerNativeSafety,
   readNativeSafetyRegistration,
+  evaluateNativeSafetyForExecution,
   evaluateNativeSafety,
   NativeSafetyError
 };

package/hooks/hook-trash-guard/src/hook.ts

@@ -886,8 +886,11 @@ function shellQuoteWord(word: string): string {
  * Replace the verb token of every owned `rm` with `<quoted trash> guard`,
  * leaving every other byte of the command untouched.
  */
-export function rewriteCommand(command: string, hits: RmHit[], trashPath: string): string {
-  const replacement = `${shellQuoteWord(trashPath)} guard`;
+export function rewriteCommand(command: string, hits: RmHit[], trashPath: string, execution?: GuardDependencies["execution"]): string {
+  const replacement = execution
+    ? ["/usr/bin/env", "-i", `HOME=${execution.home}`, `PATH=${execution.path}`, `HASNA_TRASH_AGENT=${execution.agent}`,
+      execution.runtime, "--config=/dev/null", "--no-env-file", "--no-macros", "--no-install", trashPath, "guard"].map(shellQuoteWord).join(" ")
+    : `${shellQuoteWord(trashPath)} guard`;
   const ordered = [...hits].sort((a, b) => b.word.start - a.word.start);
   let out = command;
   for (const hit of ordered) {
@@ -956,6 +959,24 @@ export interface GuardDependencies {
   cwd: string;
   findTrash: (env?: NodeJS.ProcessEnv) => string | null;
   inspectTrash?: (env?: NodeJS.ProcessEnv) => TrashBinaryInspection;
+  /** Only the verified native worker supplies this execution capability. */
+  execution?: { runtime: string; home: string; path: string; agent: string };
+}
+
+/** Environment-changing shell constructs could run before even /usr/bin/env.
+ * Refuse them in execution mode rather than pretending an outer clean env is
+ * enough. Ordinary command/control-flow/quoting stays with the existing lexer. */
+function changesExecutionEnvironment(command: string): boolean {
+  const stateCommands = new Set(["export", "set", "unset", "readonly", "declare", "typeset", "local", "alias", "unalias", "read", "readarray", "mapfile", "getopts", "trap", "enable", "function", "env", "sudo", "doas", "stdbuf"]);
+  const parsed = lexCommand(command);
+  return parsed.segments.some((segment) => {
+    const index = commandWordIndex(segment);
+    const prefix = segment.words.slice(0, index < 0 ? segment.words.length : index);
+    if (prefix.some((word) => ASSIGNMENT_RE.test(decodeWord(word.text)) || stateCommands.has(baseVerb(decodeWord(word.text))))) return true;
+    if (index < 0) return false;
+    const word = segment.words[index]!;
+    return stateCommands.has(baseVerb(decodeWord(word.text))) || /^\s*\(\s*\)\s*\{/.test(command.slice(word.end));
+  });
 }
 
 function deny(reason: string): CodewithHookOutput {
@@ -1078,8 +1099,12 @@ export function evaluate(input: CodewithHookInput, deps: GuardDependencies): Cod
   }
   const trashPath = trash.path;
 
-  const rewritten = rewriteCommand(command, scanned.rmHits, trashPath);
+  if (deps.execution && changesExecutionEnvironment(command)) {
+    return deny("[trash-guard] A deletion combined with shell environment changes cannot use the verified native execution context. Run the deletion as a separate plain rm command.");
+  }
+  const rewritten = rewriteCommand(command, scanned.rmHits, trashPath, deps.execution);
   const updatedInput = buildUpdatedInput(input.tool_input, rewritten);
+  if (deps.execution) updatedInput.hasna_execution = "hasna.hooks.execution.v1";
 
   if (!updatedInputIsComplete(updatedInput, command, scanned.rmHits, deps.cwd, deps.home)) {
     // Never allow a partial rewrite: the harness falls back to the ORIGINAL

package/hooks/native-safety-entry.ts

@@ -13,6 +13,14 @@ if (!input || Array.isArray(input) || input.hook_event_name !== "PreToolUse" ||
   || !input.tool_input || typeof input.tool_input !== "object" || Array.isArray(input.tool_input)
   || typeof input.cwd !== "string" || !isAbsolute(input.cwd)) throw new Error("Invalid safety input");
 if (input.tool_name === "Bash" && typeof input.tool_input.command !== "string") throw new Error("Invalid shell input");
+const requestedExecution = (input as CodewithHookInput & { hasna_execution?: { schema: string; agent: string } }).hasna_execution;
+if (requestedExecution !== undefined && (!requestedExecution || Object.keys(requestedExecution).sort().join() !== "agent,schema"
+  || requestedExecution.schema !== "hasna.hooks.execution.v1" || typeof requestedExecution.agent !== "string"
+  || !/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/.test(requestedExecution.agent))) throw new Error("Invalid execution capability");
+const execution = requestedExecution === undefined ? undefined : {
+  runtime: process.execPath, home: homedir(), path: process.env.PATH!, agent: requestedExecution.agent,
+};
+if (execution && (!isAbsolute(execution.runtime) || !execution.path)) throw new Error("Invalid bound execution context");
 if (["apply_patch", "ApplyPatch", "functions.apply_patch"].includes(input.tool_name)) {
   if (input.tool_input.command !== undefined && input.tool_input.patch !== undefined && input.tool_input.command !== input.tool_input.patch) throw new Error("Conflicting patch aliases");
   const patch = input.tool_input.command ?? input.tool_input.patch;
@@ -24,5 +32,5 @@ const handoff = input.tool_name === "Bash" && scanCommand(input.tool_input.comma
 const verdict = repos.decision === "block"
   ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: repos.reason } }
   : handoff ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "[workspace-repos-guard] Deletion under a protected repository checkout is refused." } }
-  : name === "trash-guard" ? evaluateTrash(input, { home: homedir(), cwd: input.cwd, findTrash: findTrashBinary, inspectTrash: inspectTrashBinary }) : { continue: true };
+  : name === "trash-guard" ? evaluateTrash(input, { home: homedir(), cwd: input.cwd, findTrash: findTrashBinary, inspectTrash: inspectTrashBinary, execution }) : { continue: true };
 process.stdout.write(JSON.stringify({ verdict: "continue" in verdict ? null : verdict }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/hooks",
-  "version": "0.10.4",
+  "version": "0.10.6",
   "description": "Open source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command",
   "type": "module",
   "bin": {