@hasna/hooks 0.10.5 → 0.10.7

package/dist/lib/claude-safety-check.d.ts

@@ -0,0 +1,32 @@
+import { verifyNativeSafetyCommand } from "../native-safety.js";
+export declare class ClaudeSafetyError extends Error {
+    readonly code: "settings_unsafe" | "settings_invalid" | "settings_changed" | "hooks_disabled" | "guard_missing" | "guard_ambiguous" | "guard_definition_invalid" | "guard_failed";
+    constructor(code: "settings_unsafe" | "settings_invalid" | "settings_changed" | "hooks_disabled" | "guard_missing" | "guard_ambiguous" | "guard_definition_invalid" | "guard_failed");
+}
+export interface ClaudeSafetyOptions {
+    home?: string;
+    cwd?: string;
+    /** Exact user settings path, for the native CLAUDE_CONFIG_DIR override. */
+    userSettingsPath?: string;
+    /** An already-resolved main-checkout local file may be outside cwd. */
+    localSettingsPath?: string;
+}
+/** This does not claim to reproduce Claude's MDM/server/CLI policy merge.
+ * It checks these selected native settings sources and their exact bytes. */
+export declare function verifyClaudeSafetyConfiguration(options?: ClaudeSafetyOptions, dependencies?: {
+    verify?: typeof verifyNativeSafetyCommand;
+}): Promise<{
+    ok: true;
+    target: "claude";
+    cwd: string;
+    configurationVerified: boolean;
+    guardVerified: boolean;
+    sources: {
+        path: string;
+        sha256: string | null;
+    }[];
+    guardSHA256: string;
+    runtimePolicyVerified: boolean;
+    nativeDiscoveryVerified: boolean;
+    nativeAdoptionVerified: boolean;
+}>;

package/dist/lib/codex-safety-check.d.ts

@@ -0,0 +1,58 @@
+import { verifyNativeSafetyCommand } from "../native-safety.js";
+export type CodexSafetyCode = "native_unavailable" | "native_unsafe_executable" | "native_executable_required" | "native_unsupported" | "native_failed" | "native_discovery_failed" | "hooks_disabled" | "guard_missing" | "guard_ambiguous" | "guard_definition_invalid" | "guard_disabled" | "guard_untrusted" | "guard_changed" | "guard_failed";
+export declare class CodexSafetyError extends Error {
+    readonly code: CodexSafetyCode;
+    constructor(code: CodexSafetyCode);
+}
+export interface CodexSafetyRpc {
+    version: string;
+    request(method: "hooks/list" | "config/read" | "experimentalFeature/list" | "config/batchWrite", params: unknown): Promise<unknown>;
+    close(): Promise<void>;
+}
+export type CodexSafetyOptions = {
+    command?: string;
+    home?: string;
+    cwd?: string;
+    codexHome?: string;
+};
+/** Owns only its fresh app-server subprocess. It never reloads a running agent,
+ * enrolls trust, starts a model turn or forwards native diagnostic text. */
+export declare function connectCodexSafety(options: Required<Pick<CodexSafetyOptions, "home">> & CodexSafetyOptions): Promise<CodexSafetyRpc>;
+type NativeGuard = {
+    key: string;
+    command: string;
+    currentHash: string;
+    sourcePath: string;
+    enabled: boolean;
+    trustStatus: string;
+};
+/** Select only the exact packaged composite definition in native discovery.
+ * A name, a settings file, or a trusted hash by itself is not enough. */
+export declare function selectCodexSafety(discovery: unknown, configuration: unknown, home: string, cwd: string, featureEnabled?: boolean, requireReady?: boolean): NativeGuard;
+export declare function readCodexSafety(rpc: CodexSafetyRpc, home: string, cwd: string, options?: {
+    includeLayers?: boolean;
+    requireReady?: boolean;
+}): Promise<{
+    guard: NativeGuard;
+    discovery: unknown;
+    configuration: unknown;
+}>;
+/** Two native observations surround stateless guard classification. No requested
+ * file operation is executed and no Hooks registry credential is consulted. */
+export declare function verifyCodexNativeSafety(options?: CodexSafetyOptions, dependencies?: {
+    connect?: typeof connectCodexSafety;
+    verify?: typeof verifyNativeSafetyCommand;
+}): Promise<{
+    ok: true;
+    target: "codex";
+    nativeVersion: string;
+    cwd: string;
+    key: string;
+    currentHash: string;
+    enabled: boolean;
+    trusted: boolean;
+    guardVerified: boolean;
+    nativeDiscoveryVerified: boolean;
+    nativeAdoptionVerified: boolean;
+}>;
+export {};

package/dist/lib/codex-safety-trust.d.ts

@@ -0,0 +1,54 @@
+import { connectCodexSafety, type CodexSafetyOptions } from "./codex-safety-check.js";
+import { verifyNativeSafetyCommand } from "../native-safety.js";
+export declare class CodexTrustError extends Error {
+    readonly code: "input_invalid" | "native_changed" | "native_config_invalid" | "preimage_unsafe" | "trust_outcome_uncertain";
+    readonly operationId?: string | undefined;
+    constructor(code: "input_invalid" | "native_changed" | "native_config_invalid" | "preimage_unsafe" | "trust_outcome_uncertain", operationId?: string | undefined);
+}
+interface Dependencies {
+    connect?: typeof connectCodexSafety;
+    verify?: typeof verifyNativeSafetyCommand;
+}
+type Options = CodexSafetyOptions;
+export interface CodexTrustPlan {
+    schema: "hasna.hooks.codex-safety-trust/v1";
+    planDigest: string;
+    nativeVersion: string;
+    cwd: string;
+    key: string;
+    currentHash: string;
+    configPath: string;
+    configVersion: string;
+    action: "unchanged" | "trust_and_enable";
+    guardVerified: true;
+    nativeAdoptionVerified: false;
+}
+export declare function planCodexSafetyTrust(options?: Options, dependencies?: Dependencies): Promise<CodexTrustPlan>;
+export declare function applyCodexSafetyTrust(options: Options & {
+    expectedPlanDigest: string;
+}, dependencies?: Dependencies): Promise<{
+    ok: boolean;
+    changed: boolean;
+    operationId: string;
+    planDigest: string;
+    configVersion: any;
+    guardVerified: boolean;
+    nativeDiscoveryVerified: boolean;
+    nativeAdoptionVerified: boolean;
+    unrelatedConfigurationPreserved: boolean;
+} | {
+    schema: "hasna.hooks.codex-safety-trust/v1";
+    planDigest: string;
+    nativeVersion: string;
+    cwd: string;
+    key: string;
+    currentHash: string;
+    configPath: string;
+    configVersion: string;
+    action: "unchanged" | "trust_and_enable";
+    guardVerified: true;
+    nativeAdoptionVerified: false;
+    ok: boolean;
+    changed: boolean;
+}>;
+export {};

package/dist/lib/codex-settings.d.ts

@@ -1,3 +1,7 @@
 export declare function readCodexSettings(path: string): Record<string, any>;
 /** Preserve the exact read version. Never write trust state or config.toml. */
-export declare function writeCodexSettings(path: string, settings: Record<string, any>): void;
+export declare function capturedCodexSettings(settings: Record<string, any>): string | null;
+export declare function assertSettingsPreimage(raw: string | null, expected?: string): void;
+export declare function writeCodexSettings(path: string, settings: Record<string, any>, expectedSha256?: string): void;
+/** Shared standalone writer. Managed Claude settings still use Skills. */
+export declare function writeHookSettingsPreimage(path: string, settings: Record<string, any>, before: string | null): void;

package/dist/lib/installer.d.ts

@@ -30,6 +30,8 @@ export interface InstallResult {
     configPath?: string;
 }
 export interface InstallOptions {
+    /** Optional exact predecessor for a planned native safety registration. */
+    expectedSettingsSha256?: string;
     /** Explicit persistent opt-in for mementos-context; omitted updates retain its current choice. */
     mementos?: MementosRegistration;
     scope?: Scope;
@@ -64,6 +66,12 @@ export declare function detectRewriteConflict(name: string, scope: Scope, target
 /** Injected for tests: the rewrite claim is a registry concern, the overlap is not. */
 lookup?: (hookName: string) => HookMeta | undefined): string | undefined;
 export declare function installHook(name: string, options?: InstallOptions): InstallResult;
+/** Render through the installer without writing settings or trust state. */
+export declare function previewNativeSafetyRegistration(target: "codex" | "claude", scope?: Scope): {
+    before: string | null;
+    after: string;
+    command: string;
+};
 export declare function installHooks(names: string[], options?: InstallOptions): InstallResult[];
 export declare function getRegisteredHooksForTarget(scope?: Scope, target?: SingleTarget): string[];
 export declare function getRegisteredHooks(scope?: Scope): string[];

package/dist/lib/native-safety-registration.d.ts

@@ -0,0 +1,52 @@
+import { verifyNativeSafetyCommand } from "../native-safety.js";
+export declare class NativeRegistrationError extends Error {
+    readonly code: "input_invalid" | "settings_unsafe" | "settings_invalid" | "settings_changed" | "hooks_disabled" | "registration_conflict" | "guard_failed" | "apply_outcome_uncertain";
+    readonly operationId?: string | undefined;
+    constructor(code: "input_invalid" | "settings_unsafe" | "settings_invalid" | "settings_changed" | "hooks_disabled" | "registration_conflict" | "guard_failed" | "apply_outcome_uncertain", operationId?: string | undefined);
+}
+export interface NativeRegistrationOptions {
+    target: "codex" | "claude";
+}
+export interface NativeRegistrationPlan {
+    schema: "hasna.hooks.native-safety-registration/v1";
+    target: "codex" | "claude";
+    settingsPath: string;
+    resolvedPath: string;
+    beforeSHA256: string;
+    desiredSHA256: string;
+    commandSHA256: string;
+    action: "unchanged" | "register";
+    planDigest: string;
+    guardVerified: true;
+    nativeAdoptionVerified: false;
+}
+interface Dependencies {
+    verify?: typeof verifyNativeSafetyCommand;
+}
+export declare function planNativeSafetyRegistration(options: NativeRegistrationOptions, dependencies?: Dependencies): Promise<NativeRegistrationPlan>;
+export declare function applyNativeSafetyRegistration(options: NativeRegistrationOptions & {
+    expectedPlanDigest: string;
+}, dependencies?: Dependencies): Promise<{
+    ok: boolean;
+    changed: boolean;
+    operationId: `${string}-${string}-${string}-${string}-${string}`;
+    planDigest: string;
+    settingsSHA256: string;
+    guardVerified: boolean;
+    nativeAdoptionVerified: boolean;
+} | {
+    schema: "hasna.hooks.native-safety-registration/v1";
+    target: "codex" | "claude";
+    settingsPath: string;
+    resolvedPath: string;
+    beforeSHA256: string;
+    desiredSHA256: string;
+    commandSHA256: string;
+    action: "unchanged" | "register";
+    planDigest: string;
+    guardVerified: true;
+    nativeAdoptionVerified: false;
+    ok: boolean;
+    changed: boolean;
+}>;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/hooks",
-  "version": "0.10.5",
+  "version": "0.10.7",
   "description": "Open source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command",
   "type": "module",
   "bin": {