@hasna/hooks 0.10.6 → 0.10.7

package/dist/index.js

@@ -6202,8 +6202,8 @@ var init_db_writer = __esm(() => {
 });
 
 // src/lib/hook-env.ts
-import { dirname as dirname19, isAbsolute as isAbsolute15 } from "path";
-import { existsSync as existsSync13, realpathSync as realpathSync8, statSync as statSync2 } from "fs";
+import { dirname as dirname24, isAbsolute as isAbsolute21 } from "path";
+import { existsSync as existsSync14, realpathSync as realpathSync13, statSync as statSync2 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 function isDeniedEnvName(name) {
   const upper = name.toUpperCase();
@@ -6222,7 +6222,7 @@ function isBashFunctionEnvName(name) {
   return name.startsWith("BASH_FUNC_");
 }
 function isUnsafePathEntry(entry, home) {
-  if (entry === "" || !isAbsolute15(entry))
+  if (entry === "" || !isAbsolute21(entry))
     return true;
   if (home && (entry === home || entry.startsWith(home + "/")))
     return true;
@@ -6230,16 +6230,16 @@ function isUnsafePathEntry(entry, home) {
     return true;
   if (entry === "/var/tmp" || entry.startsWith("/var/tmp/"))
     return true;
-  const canonical4 = (path) => {
+  const canonical5 = (path) => {
     try {
-      return realpathSync8(path);
+      return realpathSync13(path);
     } catch {
       return path;
     }
   };
-  const resolved = canonical4(entry);
+  const resolved = canonical5(entry);
   for (const root of [home, tmpdir2(), "/tmp", "/var/tmp"].filter((value) => Boolean(value))) {
-    const blocked = canonical4(root);
+    const blocked = canonical5(root);
     if (resolved === blocked || resolved.startsWith(blocked + "/"))
       return true;
   }
@@ -6251,9 +6251,9 @@ function isUnsafePathEntry(entry, home) {
 }
 function sanitizeHookPath(pathValue, home) {
   const baseline = PATH_BASELINE.slice();
-  if (process.platform === "darwin" && existsSync13("/opt/homebrew/bin"))
+  if (process.platform === "darwin" && existsSync14("/opt/homebrew/bin"))
     baseline.push("/opt/homebrew/bin");
-  const bunDir = dirname19(process.execPath);
+  const bunDir = dirname24(process.execPath);
   const seen = new Set;
   const out = [];
   for (const dir of baseline) {
@@ -6377,10 +6377,10 @@ __export(exports_run, {
   HookTimeoutError: () => HookTimeoutError
 });
 import { randomBytes as randomBytes2 } from "crypto";
-import { rmSync as rmSync4, writeFileSync as writeFileSync10 } from "fs";
-import { basename as basename9, dirname as dirname20, isAbsolute as isAbsolute17, join as join20 } from "path";
+import { rmSync as rmSync4, writeFileSync as writeFileSync13 } from "fs";
+import { basename as basename11, dirname as dirname25, isAbsolute as isAbsolute23, join as join30 } from "path";
 function extensionOf(scriptPath) {
-  const base = basename9(scriptPath);
+  const base = basename11(scriptPath);
   const dot = base.lastIndexOf(".");
   return dot > 0 ? base.slice(dot + 1) : "ts";
 }
@@ -6392,9 +6392,9 @@ function shebangInterpreter(firstLine) {
     return null;
   const parts = rest.split(/\s+/);
   if (parts[0] === "env" || parts[0] === "/usr/bin/env") {
-    return parts[1] && parts[1] !== "-S" ? basename9(parts[1]) : parts[2] ? basename9(parts[2]) : null;
+    return parts[1] && parts[1] !== "-S" ? basename11(parts[1]) : parts[2] ? basename11(parts[2]) : null;
   }
-  return basename9(parts[0]);
+  return basename11(parts[0]);
 }
 function interpreterFor(name, scriptPath, content) {
   const ext = extensionOf(scriptPath);
@@ -6447,9 +6447,9 @@ async function readPipeWithDeadline(stream, deadlineMs) {
   return chunks.join("");
 }
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname20(options.scriptPath);
+  const scriptDir = dirname25(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
-  const tempPath = join20(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
+  const tempPath = join30(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
   let timedOut = false;
   const timeoutTimer = options.timeout ? setTimeout(() => {
@@ -6457,8 +6457,8 @@ async function executeVerifiedScript(options) {
     killGroup(proc, { leaderAlive: proc !== null && proc.exitCode === null });
   }, options.timeout) : null;
   try {
-    writeFileSync10(tempPath, options.content, { flag: "wx", mode: 384 });
-    proc = Bun.spawn([...interpreter.command, isAbsolute17(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
+    writeFileSync13(tempPath, options.content, { flag: "wx", mode: 384 });
+    proc = Bun.spawn([...interpreter.command, isAbsolute23(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
       stdin: new Response(options.stdin),
       stdout: "pipe",
       stderr: "pipe",
@@ -7854,7 +7854,7 @@ init_store();
 // src/lib/codex-settings.ts
 import { closeSync as closeSync2, existsSync as existsSync8, lstatSync as lstatSync2, mkdirSync as mkdirSync4, openSync as openSync2, readFileSync as readFileSync5, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
 import { dirname as dirname4 } from "path";
-import { randomUUID } from "crypto";
+import { createHash as createHash3, randomUUID } from "crypto";
 var snapshots = new WeakMap;
 function current(path) {
   try {
@@ -7889,11 +7889,30 @@ function readCodexSettings(path) {
   snapshots.set(settings, { path, raw });
   return settings;
 }
-function writeCodexSettings(path, settings) {
+function capturedCodexSettings(settings) {
+  const snapshot = snapshots.get(settings);
+  if (!snapshot)
+    throw new Error("Hook settings require a complete current read.");
+  return snapshot.raw;
+}
+function assertSettingsPreimage(raw, expected) {
+  if (expected === undefined)
+    return;
+  if (!/^(?:absent|[a-f0-9]{64})$/.test(expected) || (raw === null ? "absent" : createHash3("sha256").update(raw).digest("hex")) !== expected) {
+    throw new Error("Hook settings changed since planning; no settings were written.");
+  }
+}
+function writeCodexSettings(path, settings, expectedSha256) {
   const snapshot = snapshots.get(settings);
   if (!snapshot || snapshot.path !== path)
     throw new Error("Codex settings require a complete current read before writing.");
-  mkdirSync4(dirname4(path), { recursive: true });
+  assertSettingsPreimage(snapshot.raw, expectedSha256);
+  writeHookSettingsPreimage(path, settings, snapshot.raw);
+  snapshots.set(settings, { path, raw: JSON.stringify(settings, null, 2) + `
+` });
+}
+function writeHookSettingsPreimage(path, settings, before) {
+  mkdirSync4(dirname4(path), { recursive: true, mode: 448 });
   const lock = `${path}.hooks-write.lock`;
   let fd;
   try {
@@ -7903,15 +7922,14 @@ function writeCodexSettings(path, settings) {
   }
   const temp = `${path}.${randomUUID()}.tmp`;
   try {
-    if (current(path) !== snapshot.raw)
-      throw new Error("Codex settings changed since reading; re-read before retrying.");
+    if (current(path) !== before)
+      throw new Error("Hook settings changed since reading; re-read before retrying.");
     const next = JSON.stringify(settings, null, 2) + `
 `;
     writeFileSync3(temp, next, { flag: "wx", mode: 384 });
-    if (current(path) !== snapshot.raw)
-      throw new Error("Codex settings changed since reading; re-read before retrying.");
+    if (current(path) !== before)
+      throw new Error("Hook settings changed since reading; re-read before retrying.");
     renameSync2(temp, path);
-    snapshots.set(settings, { path, raw: next });
   } finally {
     if (existsSync8(temp))
       unlinkSync(temp);
@@ -7929,7 +7947,7 @@ import { homedir as homedir4 } from "os";
 import { join as join8, resolve as resolve3 } from "path";
 import { homedir as pathsResolverHomedir2 } from "os";
 import { join as pathsResolverJoin2 } from "path";
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { existsSync as existsSync52, readdirSync as readdirSync3, readFileSync as readFileSync42, statSync as statSync3 } from "fs";
 import { join as join52, sep as sep2 } from "path";
 import { basename as basename2, isAbsolute as isAbsolute22, resolve as resolve22 } from "path";
@@ -7944,7 +7962,7 @@ import { dirname as dirname42, isAbsolute as isAbsolute4, join as join82, resolv
 import { createHash as createHash32 } from "crypto";
 import { closeSync as closeSync3, constants as constants2, fstatSync as fstatSync2, lstatSync as lstatSync5, openSync as openSync3, readSync } from "fs";
 import { dirname as dirname5, isAbsolute as isAbsolute5, resolve as resolve5 } from "path";
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash42 } from "crypto";
 import { lstatSync as lstatSync6, readlinkSync } from "fs";
 import { dirname as dirname6, isAbsolute as isAbsolute6, join as join9, parse, resolve as resolve6, sep as sep22 } from "path";
 import { closeSync as closeSync12, constants as constants9, fstatSync as fstatSync12, lstatSync as lstatSync17, openSync as openSync12, opendirSync as opendirSync5, readSync as readSync8 } from "fs";
@@ -15072,7 +15090,7 @@ function* bundleHashParts(files) {
   yield new TextEncoder().encode("\x00");
 }
 function hashBundleFiles(files) {
-  const hash = createHash3(CONTENT_HASH_ALGORITHM);
+  const hash = createHash4(CONTENT_HASH_ALGORITHM);
   for (const part of bundleHashParts(files))
     hash.update(part);
   return hash.digest("hex");
@@ -15908,7 +15926,7 @@ function hashDiscoveryPathFile(path, budget, changes) {
   const after = trace(path);
   if (JSON.stringify(before.rows) !== JSON.stringify(after.rows) || before.file !== after.file)
     throw new Error("Discovery path input changed during read");
-  return createHash4("sha256").update(JSON.stringify({ version: 1, path, rows: before.rows, content })).digest("hex");
+  return createHash42("sha256").update(JSON.stringify({ version: 1, path, rows: before.rows, content })).digest("hex");
 }
 var package_default = {
   name: "@hasna/skills",
@@ -39139,9 +39157,9 @@ function getTargetSettingsDir(target) {
 }
 function getGlobalSettingsPathOverride(target) {
   if (target === "codex")
-    return process.env.HASNA_HOOKS_CODEX_SETTINGS_PATH;
+    return process.env.HASNA_HOOKS_CODEX_SETTINGS_PATH ?? (process.env.CODEX_HOME ? resolve7(process.env.CODEX_HOME, "hooks.json") : undefined);
   if (target === "claude")
-    return process.env.HASNA_HOOKS_CLAUDE_SETTINGS_PATH;
+    return process.env.HASNA_HOOKS_CLAUDE_SETTINGS_PATH ?? (process.env.CLAUDE_CONFIG_DIR ? resolve7(process.env.CLAUDE_CONFIG_DIR, "settings.json") : undefined);
   if (target === "gemini")
     return process.env.HASNA_HOOKS_GEMINI_SETTINGS_PATH;
   return;
@@ -39185,7 +39203,7 @@ function readSettings2(scope = "global", target = "claude") {
       return value;
     }
   } catch (error61) {
-    console.warn(`[hooks] Failed to read settings at ${path}: ${error61 instanceof Error ? error61.message : String(error61)}`);
+    console.warn("[hooks] Cannot read hook settings; repair the selected file before installation.");
   }
   const empty = {};
   if (!existsSync10(path))
@@ -39197,10 +39215,16 @@ function settingsIdentity(path) {
     return realpathSync5(path);
   return existsSync10(dirname7(path)) ? join10(realpathSync5(dirname7(path)), basename3(path)) : resolve7(path);
 }
-function writeSettings(settings, scope = "global", target = "claude") {
+function writeSettings(settings, scope = "global", target = "claude", expectedSettingsSha256) {
   const path = getSettingsPath(scope, target);
   if (target === "codex")
-    return writeCodexSettings(path, settings);
+    return writeCodexSettings(path, settings, expectedSettingsSha256);
+  const captured = settingsPreimages.get(settings);
+  if (expectedSettingsSha256 !== undefined) {
+    if (!captured || captured.path !== path)
+      throw new Error("Hook settings require a valid captured preimage.");
+    assertSettingsPreimage(captured.text, expectedSettingsSha256);
+  }
   if (target === "claude" && settingsIdentity(path) === settingsIdentity(join10(homedir5(), ".claude/settings.json"))) {
     const before = settingsPreimages.get(settings);
     if (!before || before.path !== path)
@@ -39212,6 +39236,8 @@ function writeSettings(settings, scope = "global", target = "claude") {
 `, { home: homedir5() }))
       return;
   }
+  if (expectedSettingsSha256 !== undefined)
+    return writeHookSettingsPreimage(path, settings, captured.text);
   const dir = dirname7(path);
   if (!existsSync10(dir)) {
     mkdirSync6(dir, { recursive: true });
@@ -39369,7 +39395,7 @@ function detectRewriteConflict(name, scope, target, lookup = getHook) {
   }
   return;
 }
-function installForTarget(name, scope, overwrite, target, profile, codewithMode = "fragment", codewithConfigPath, mementos) {
+function installForTarget(name, scope, overwrite, target, profile, codewithMode = "fragment", codewithConfigPath, mementos, expectedSettingsSha256) {
   const shortName = shortHookName(name);
   if (isNativeSafetyName(shortName) && (profile || target === "gemini" || target === "codewith" && codewithMode === "write")) {
     return { hook: shortName, success: false, error: "Bundled native safety guards support Claude/Codex and managed Codewith fragments, without registry profiles.", target };
@@ -39436,7 +39462,7 @@ function installForTarget(name, scope, overwrite, target, profile, codewithMode
     if (rewriteConflict) {
       return { hook: shortName, success: false, error: `Refused: ${rewriteConflict}`, scope, target };
     }
-    registerHook(shortName, scope, target, profile, mementos);
+    registerHook(shortName, scope, target, profile, mementos, (settings, selectedScope, selectedTarget) => writeSettings(settings, selectedScope, selectedTarget, expectedSettingsSha256));
     return {
       hook: shortName,
       success: true,
@@ -39455,7 +39481,10 @@ function installForTarget(name, scope, overwrite, target, profile, codewithMode
   }
 }
 function installHook(name, options = {}) {
-  const { scope = "global", overwrite = false, target = "claude", profile, codewithMode = "fragment", codewithConfigPath, mementos } = options;
+  const { scope = "global", overwrite = false, target = "claude", profile, codewithMode = "fragment", codewithConfigPath, mementos, expectedSettingsSha256 } = options;
+  if (expectedSettingsSha256 !== undefined && (!/^(?:absent|[a-f0-9]{64})$/.test(expectedSettingsSha256) || !isNativeSafetyName(shortHookName(name)) || target !== "codex" && target !== "claude")) {
+    return { hook: name, success: false, target, error: "An exact settings predecessor requires a Claude or Codex native safety guard." };
+  }
   try {
     validateMementosRegistration(name, mementos);
   } catch (error61) {
@@ -39496,9 +39525,26 @@ function installHook(name, options = {}) {
     }
     return { ...claudeResult, target: "all" };
   }
-  return installForTarget(name, scope, overwrite, target, profile, codewithMode, codewithConfigPath, mementos);
+  return installForTarget(name, scope, overwrite, target, profile, codewithMode, codewithConfigPath, mementos, expectedSettingsSha256);
 }
-function registerHook(name, scope = "global", target = "claude", profile, mementos) {
+function previewNativeSafetyRegistration(target, scope = "global") {
+  const conflict = detectRewriteConflict("trash-guard", scope, target);
+  if (conflict)
+    throw new Error("Conflicting input rewriter; reconcile it before installing the safety guard.");
+  let result;
+  registerHook("trash-guard", scope, target, undefined, undefined, (settings) => {
+    const before = target === "codex" ? capturedCodexSettings(settings) : settingsPreimages.get(settings)?.text;
+    if (before === undefined)
+      throw new Error("Hook settings require a valid captured preimage.");
+    const command = installedNativeSafetyCommand("trash-guard");
+    result = { before, after: JSON.stringify(settings, null, 2) + `
+`, command };
+  });
+  if (!result)
+    throw new Error("Native safety registration could not be rendered.");
+  return result;
+}
+function registerHook(name, scope = "global", target = "claude", profile, mementos, write = writeSettings) {
   const meta3 = isNativeSafetyName(name) ? getHook(name) : resolveHookMeta(name);
   if (!meta3)
     return;
@@ -39527,7 +39573,7 @@ function registerHook(name, scope = "global", target = "claude", profile, mement
   }
   const retained = name === "mementos-context" && mementos === undefined ? retainedMementosRegistration(Object.values(settings.hooks).flatMap((groups) => Array.isArray(groups) ? groups.flatMap((group) => Array.isArray(group.hooks) ? group.hooks.map((hook) => hook.command).filter((command) => typeof command === "string") : []) : [])) : undefined;
   const hookCommand = isNativeSafetyName(name) ? installedNativeSafetyCommand(name) : (profile ? `hooks run ${name} --profile ${profile}` : `hooks run ${name}`) + mementosCommandSuffix(mementos ?? retained);
-  if (target === "codex") {
+  if (target === "codex" || target === "claude" && isNativeSafetyName(name)) {
     const positions = [];
     for (const [event, groups] of Object.entries(settings.hooks)) {
       for (const entry of groups) {
@@ -39553,7 +39599,7 @@ function registerHook(name, scope = "global", target = "claude", profile, mement
         if (typeof meta3.timeoutSeconds === "number" && meta3.timeoutSeconds > 0)
           entry.hooks[index].timeout = meta3.timeoutSeconds;
       }
-      writeSettings(settings, scope, target);
+      write(settings, scope, target);
       return;
     }
   }
@@ -39573,7 +39619,7 @@ function registerHook(name, scope = "global", target = "claude", profile, mement
     }
     settings.hooks[eventKey].push(entry);
   }
-  writeSettings(settings, scope, target);
+  write(settings, scope, target);
 }
 function removeHookFromAllEvents(settings, name) {
   if (!settings.hooks)
@@ -39807,7 +39853,7 @@ function uninstallHook(name, scope = "global", target = "claude") {
 // src/index.ts
 init_profiles();
 init_config();
-import { existsSync as existsSync14, readFileSync as readFileSync19 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync26 } from "fs";
 
 // src/lib/transport.ts
 init_transport();
@@ -40046,16 +40092,16 @@ async function installManifestUrl(url2) {
   return { name, version: manifest.version, kind: "url", source: url2, dir, scriptPath };
 }
 // src/lib/sync.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { readFileSync as readFileSync15 } from "fs";
 init_db();
 init_store();
 init_manifest();
 function sha256OfText(text3) {
-  return createHash7("sha256").update(text3).digest("hex");
+  return createHash6("sha256").update(text3).digest("hex");
 }
 function sha256OfPath(path) {
-  return createHash7("sha256").update(readFileSync15(path)).digest("hex");
+  return createHash6("sha256").update(readFileSync15(path)).digest("hex");
 }
 function collectBundledCatalog() {
   const out = [];
@@ -40977,6 +41023,933 @@ async function provisionCloudflareResources(options) {
   ];
   return result;
 }
+// src/lib/codex-safety-trust.ts
+import { createHash as createHash12, randomUUID as randomUUID3 } from "crypto";
+import { constants as constants12, closeSync as closeSync7, fsyncSync as fsyncSync5, fstatSync as fstatSync6, lstatSync as lstatSync15, mkdirSync as mkdirSync13, openSync as openSync7, readFileSync as readFileSync21, realpathSync as realpathSync10, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname21, isAbsolute as isAbsolute18, join as join24, relative as relative2 } from "path";
+import { homedir as homedir7 } from "os";
+
+// src/lib/codex-safety-check.ts
+import { spawn, execFile as execFile2 } from "child_process";
+import { createHash as createHash7 } from "crypto";
+import { constants as constants4, openSync as openSync6, closeSync as closeSync6, fstatSync as fstatSync5, lstatSync as lstatSync10, readFileSync as readFileSync20, realpathSync as realpathSync9 } from "fs";
+import { dirname as dirname20, isAbsolute as isAbsolute17, resolve as resolve17 } from "path";
+import { promisify } from "util";
+
+// src/native-safety.ts
+import { execFile } from "child_process";
+import { closeSync as closeSync5, constants as constants3, existsSync as existsSync13, fstatSync as fstatSync4, fsyncSync, linkSync as linkSync3, lstatSync as lstatSync9, mkdirSync as mkdirSync12, openSync as openSync5, readFileSync as readFileSync19, realpathSync as realpathSync8, renameSync as renameSync3, unlinkSync as unlinkSync5, writeFileSync as writeFileSync10 } from "fs";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname19, isAbsolute as isAbsolute15, join as join20, resolve as resolve15 } from "path";
+class NativeSafetyError extends Error {
+  code;
+  reason;
+  constructor(code2, reason) {
+    super(`Native deletion safety refused (${code2}). Run the reviewed Hooks safety setup before using shell or patch tools.`);
+    this.code = code2;
+    this.reason = reason;
+    this.name = "NativeSafetyError";
+  }
+}
+var executionSchema = "hasna.hooks.execution.v1";
+var owner2 = (uid2) => uid2 === 0 || uid2 === process.getuid?.();
+function safeDirectory(path) {
+  for (let cursor = path;; cursor = dirname19(cursor)) {
+    const stat2 = lstatSync9(cursor);
+    if (!stat2.isDirectory() || !owner2(stat2.uid) || stat2.mode & 18)
+      throw new NativeSafetyError("binding_invalid");
+    if (dirname19(cursor) === cursor)
+      return;
+  }
+}
+function canonicalHome(home) {
+  if (!isAbsolute15(home) || home.includes("\x00") || realpathSync8(home) !== resolve15(home))
+    throw new NativeSafetyError("binding_invalid");
+  safeDirectory(home);
+  return resolve15(home);
+}
+function parseRecord(text3, home) {
+  const record3 = JSON.parse(text3);
+  if (!record3 || Array.isArray(record3) || Object.keys(record3).sort().join() !== "command,harness,schema" || record3.schema !== "hasna.hooks.native-safety.v1" || record3.harness !== "sumi" || typeof record3.command !== "string")
+    throw new NativeSafetyError("binding_invalid");
+  const binding = nativeSafetyCommandBinding(record3.command);
+  if (binding?.name !== "trash-guard" || binding.home !== home)
+    throw new NativeSafetyError("binding_invalid");
+  return record3;
+}
+async function evaluateRecord(event, record3, signal, executionAgent) {
+  if (!event || event.hook_event_name !== "PreToolUse" || !["Bash", "apply_patch"].includes(event.tool_name) || typeof event.cwd !== "string" || !isAbsolute15(event.cwd) || !event.tool_input || typeof event.tool_input !== "object" || Array.isArray(event.tool_input))
+    throw new NativeSafetyError("input_invalid");
+  const input2 = JSON.stringify(executionAgent === undefined ? event : { ...event, hasna_execution: { schema: executionSchema, agent: executionAgent } });
+  if (Buffer.byteLength(input2) > 1048576)
+    throw new NativeSafetyError("input_invalid");
+  const output2 = await new Promise((accept, reject) => {
+    const child = execFile("/bin/sh", ["-c", record3.command], { cwd: "/", env: {}, encoding: "utf8", timeout: 8000, maxBuffer: 1048576, signal }, (error61, stdout, stderr) => {
+      if (error61 || stderr) {
+        reject(new NativeSafetyError("guard_failed"));
+        return;
+      }
+      accept(stdout);
+    });
+    child.stdin?.on("error", () => {});
+    child.stdin?.end(input2);
+  });
+  if (!output2)
+    return { decision: "continue" };
+  try {
+    const value = JSON.parse(output2);
+    if (Object.keys(value).join() !== "hookSpecificOutput")
+      throw new Error;
+    const verdict = value.hookSpecificOutput;
+    if (verdict.hookEventName !== "PreToolUse")
+      throw new Error;
+    if (verdict.permissionDecision === "deny" && Object.keys(verdict).sort().join() === "hookEventName,permissionDecision,permissionDecisionReason" && typeof verdict.permissionDecisionReason === "string" && verdict.permissionDecisionReason.trim())
+      return { decision: "deny", reason: verdict.permissionDecisionReason };
+    if (event.tool_name === "Bash" && verdict.permissionDecision === "allow" && Object.keys(verdict).sort().join() === "hookEventName,permissionDecision,updatedInput" && typeof verdict.updatedInput?.command === "string" && verdict.updatedInput.command.trim() && (executionAgent === undefined || verdict.updatedInput.hasna_execution === executionSchema))
+      return { decision: "rewrite", command: verdict.updatedInput.command };
+  } catch {}
+  throw new NativeSafetyError("guard_failed");
+}
+async function verifyNativeSafetyCommand(command, home = homedir6()) {
+  home = canonicalHome(home);
+  const record3 = parseRecord(JSON.stringify({ schema: "hasna.hooks.native-safety.v1", harness: "sumi", command }), home);
+  const verdict = await evaluateRecord({ hook_event_name: "PreToolUse", tool_name: "Bash", cwd: home, tool_input: { command: "rm -- .hasna-trash-verification-only" } }, record3);
+  if (verdict.decision !== "rewrite")
+    throw new NativeSafetyError("guard_failed", verdict.decision === "deny" ? verdict.reason.slice(0, 512) : undefined);
+}
+
+// src/lib/codex-safety-check.ts
+var versions = new Set(["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1"]);
+var matcher = "^(Bash|apply_patch|ApplyPatch|functions\\.apply_patch)$";
+
+class CodexSafetyError extends Error {
+  code;
+  constructor(code2) {
+    super(`Codex deletion safety check failed (${code2}).`);
+    this.code = code2;
+    this.name = "CodexSafetyError";
+  }
+}
+function need5(condition, code2) {
+  if (!condition)
+    throw new CodexSafetyError(code2);
+}
+var digest3 = (bytes) => createHash7("sha256").update(bytes).digest("hex");
+function nativeHeader(bytes) {
+  if (bytes.length < 64 || !["arm64", "x64"].includes(process.arch))
+    return false;
+  if (process.platform === "darwin") {
+    const cpu = process.arch === "arm64" ? 16777228 : 16777223;
+    return bytes.readUInt32LE(0) === 4277009103 && bytes.readUInt32LE(4) === cpu && bytes.readUInt32LE(12) === 2 && bytes.readUInt32LE(16) > 0 && bytes.readUInt32LE(16) <= 4096 && bytes.readUInt32LE(20) > 0 && bytes.readUInt32LE(20) <= bytes.length - 32;
+  }
+  if (process.platform === "linux") {
+    const offset = bytes.readBigUInt64LE(32), count = bytes.readUInt16LE(56);
+    return bytes.subarray(0, 7).equals(Buffer.from([127, 69, 76, 70, 2, 1, 1])) && [2, 3].includes(bytes.readUInt16LE(16)) && bytes.readUInt16LE(18) === (process.arch === "arm64" ? 183 : 62) && bytes.readUInt32LE(20) === 1 && bytes.readUInt16LE(52) === 64 && bytes.readUInt16LE(54) === 56 && count > 0 && count <= 1024 && offset >= 64n && offset + BigInt(count * 56) <= BigInt(bytes.length);
+  }
+  return false;
+}
+function executable(command) {
+  const found = isAbsolute17(command) ? command : Bun.which(command);
+  need5(found, "native_unavailable");
+  try {
+    const path = realpathSync9(found);
+    for (let parent = dirname20(path);; parent = dirname20(parent)) {
+      const stat2 = lstatSync10(parent);
+      need5(stat2.isDirectory() && [0, process.getuid?.()].includes(stat2.uid) && !(stat2.mode & 18), "native_unsafe_executable");
+      if (parent === dirname20(parent))
+        break;
+    }
+    const fd = openSync6(path, constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
+    try {
+      const stat2 = fstatSync5(fd);
+      need5(stat2.isFile() && [0, process.getuid?.()].includes(stat2.uid) && !(stat2.mode & 18) && !!(stat2.mode & 64) && stat2.size <= 256000000, "native_unsafe_executable");
+      const bytes = readFileSync20(fd);
+      need5(bytes.length <= 256000000, "native_unavailable");
+      need5(nativeHeader(bytes), "native_executable_required");
+      return { path, sha256: digest3(bytes) };
+    } finally {
+      closeSync6(fd);
+    }
+  } catch (error61) {
+    if (error61 instanceof CodexSafetyError)
+      throw error61;
+    throw new CodexSafetyError("native_unavailable");
+  }
+}
+async function connectCodexSafety(options) {
+  const command = options.command ?? "codex", before = executable(command);
+  const env = { ...process.env, HOME: options.home, NO_COLOR: "1" };
+  for (const key of ["NODE_OPTIONS", "NODE_PATH", "BUN_OPTIONS", "BASH_ENV", "ENV", "DYLD_INSERT_LIBRARIES", "LD_PRELOAD"])
+    delete env[key];
+  if (options.codexHome === undefined)
+    delete env.CODEX_HOME;
+  else
+    env.CODEX_HOME = options.codexHome;
+  let version2;
+  try {
+    version2 = (await promisify(execFile2)(before.path, ["--version"], { env, cwd: options.home, timeout: 5000, killSignal: "SIGKILL", maxBuffer: 4096 })).stdout.trim();
+  } catch {
+    throw new CodexSafetyError("native_unavailable");
+  }
+  need5(versions.has(version2), "native_unsupported");
+  need5(JSON.stringify(executable(command)) === JSON.stringify(before), "guard_changed");
+  const child = spawn(before.path, ["app-server", "--strict-config", "--stdio"], { env, cwd: options.home, stdio: ["pipe", "pipe", "pipe"] });
+  let stopped = false, buffer = Buffer.alloc(0), total = 0, nextId = 1;
+  const pending = new Map;
+  const fail = () => {
+    stopped = true;
+    for (const waiter of pending.values())
+      waiter.reject(new CodexSafetyError("native_failed"));
+    pending.clear();
+  };
+  const deadline = setTimeout(() => {
+    fail();
+    child.kill("SIGKILL");
+  }, 15000);
+  const exited = new Promise((done) => {
+    child.once("exit", () => {
+      fail();
+      clearTimeout(deadline);
+      done();
+    });
+    child.once("error", () => {
+      fail();
+      clearTimeout(deadline);
+      done();
+    });
+  });
+  child.stdin.on("error", fail);
+  const account = (length) => {
+    total += length;
+    if (total > 8388608) {
+      fail();
+      child.kill("SIGKILL");
+      return false;
+    }
+    return true;
+  };
+  child.stderr.on("data", (bytes) => {
+    account(bytes.length);
+  });
+  child.stdout.on("data", (bytes) => {
+    if (stopped || !account(bytes.length))
+      return;
+    buffer = Buffer.concat([buffer, bytes]);
+    for (;; ) {
+      const end = buffer.indexOf(10);
+      if (end < 0)
+        return;
+      const line = buffer.subarray(0, end);
+      buffer = buffer.subarray(end + 1);
+      try {
+        const value = JSON.parse(line.toString("utf8"));
+        if (!value || typeof value !== "object" || Array.isArray(value))
+          throw Error();
+        if (!Object.hasOwn(value, "id"))
+          continue;
+        const waiter = pending.get(value.id);
+        if (!waiter)
+          throw Error();
+        pending.delete(value.id);
+        if (value.error || !Object.hasOwn(value, "result"))
+          waiter.reject(new CodexSafetyError("native_failed"));
+        else
+          waiter.resolve(value.result);
+      } catch {
+        fail();
+        child.kill("SIGKILL");
+        return;
+      }
+    }
+  });
+  const request = (method, params) => new Promise((accept, reject) => {
+    if (stopped) {
+      reject(new CodexSafetyError("native_failed"));
+      return;
+    }
+    const id = nextId++;
+    pending.set(id, { resolve: accept, reject });
+    child.stdin.write(JSON.stringify({ id, method, params }) + `
+`);
+  });
+  const rpc = {
+    version: version2,
+    request,
+    async close() {
+      fail();
+      child.stdin.end();
+      const force = setTimeout(() => child.kill("SIGKILL"), 1000);
+      await exited;
+      clearTimeout(force);
+      clearTimeout(deadline);
+      need5(JSON.stringify(executable(command)) === JSON.stringify(before), "guard_changed");
+    }
+  };
+  try {
+    await request("initialize", { clientInfo: { name: "hooks-safety-check", version: "1" }, capabilities: { experimentalApi: true } });
+    child.stdin.write(`{"method":"initialized"}
+`);
+    return rpc;
+  } catch {
+    await rpc.close();
+    throw new CodexSafetyError("native_failed");
+  }
+}
+function supportedDiscoveryWarnings(hooks, warnings) {
+  if (warnings.length === 0)
+    return true;
+  if (warnings.length > 128)
+    return false;
+  const allowed = new Set;
+  const sources = new Set(hooks.map((hook) => JSON.stringify([hook?.source, hook?.sourcePath])));
+  for (const hook of hooks) {
+    const path = hook?.sourcePath;
+    if (typeof path !== "string" || path.length > 4096 || !isAbsolute17(path) || path !== resolve17(dirname20(path), "hooks.json") || !["user", "project"].includes(hook.source))
+      continue;
+    const toml = resolve17(dirname20(path), "config.toml");
+    if (sources.has(JSON.stringify([hook.source, toml]))) {
+      allowed.add(`loading hooks from both ${path} and ${toml}; prefer a single representation for this layer`);
+    }
+  }
+  return warnings.every((warning) => typeof warning === "string" && allowed.delete(warning));
+}
+function selectCodexSafety(discovery, configuration, home, cwd, featureEnabled, requireReady = true) {
+  const data = discovery?.data;
+  need5(Array.isArray(data) && data.length === 1 && data[0]?.cwd === cwd && Array.isArray(data[0]?.hooks) && data[0].hooks.length <= 1e4 && Array.isArray(data[0].errors) && data[0].errors.length === 0 && Array.isArray(data[0].warnings) && supportedDiscoveryWarnings(data[0].hooks, data[0].warnings), "native_discovery_failed");
+  const config2 = configuration?.config;
+  need5(config2 && typeof config2 === "object" && !Array.isArray(config2), "native_discovery_failed");
+  need5((config2.features?.hooks ?? featureEnabled) === true, "hooks_disabled");
+  for (const hook2 of data[0].hooks)
+    if (typeof hook2?.command === "string") {
+      if (/\bhasna-native-safety-v\d+\b/.test(hook2.command))
+        need5(nativeSafetyCommandBinding(hook2.command), "guard_definition_invalid");
+      need5(!/^(?:hooks run trash-guard|hook-trash-guard)(?:\s|$)/.test(hook2.command.trim()), "guard_definition_invalid");
+    }
+  const selected = data[0].hooks.filter((hook2) => typeof hook2?.command === "string" && nativeSafetyCommandBinding(hook2.command)?.name === "trash-guard");
+  need5(selected.length !== 0, "guard_missing");
+  need5(selected.length === 1, "guard_ambiguous");
+  const hook = selected[0], binding = nativeSafetyCommandBinding(hook.command);
+  need5(binding.home === home && hook.eventName === "preToolUse" && hook.handlerType === "command" && hook.matcher === matcher && hook.timeoutSec === 10 && hook.async === false && hook.statusMessage === null && hook.additionalContextLimit === null && typeof hook.key === "string" && hook.key.length <= 4096 && typeof hook.sourcePath === "string" && isAbsolute17(hook.sourcePath) && hook.pluginId === null && hook.isManaged === false && ["user", "project"].includes(hook.source) && typeof hook.currentHash === "string" && /^sha256:[a-f0-9]{64}$/.test(hook.currentHash), "guard_definition_invalid");
+  need5(typeof hook.enabled === "boolean" && ["trusted", "untrusted", "modified"].includes(hook.trustStatus), "guard_definition_invalid");
+  if (requireReady) {
+    need5(hook.enabled === true, "guard_disabled");
+    need5(hook.trustStatus === "trusted", "guard_untrusted");
+  }
+  return { key: hook.key, command: hook.command, currentHash: hook.currentHash, sourcePath: hook.sourcePath, enabled: hook.enabled, trustStatus: hook.trustStatus };
+}
+async function readCodexSafety(rpc, home, cwd, options = {}) {
+  need5(versions.has(rpc.version), "native_unsupported");
+  const hooks = await rpc.request("hooks/list", { cwds: [cwd] });
+  const configuration = await rpc.request("config/read", { cwd, includeLayers: options.includeLayers ?? false });
+  let enabled;
+  if (configuration?.config?.features?.hooks === undefined) {
+    let cursor = null, count = 0;
+    const seen = new Set;
+    do {
+      const page3 = await rpc.request("experimentalFeature/list", { cursor, limit: 100 });
+      need5(Array.isArray(page3?.data) && page3.data.length <= 100 && (page3.nextCursor === null || typeof page3.nextCursor === "string"), "native_discovery_failed");
+      count += page3.data.length;
+      need5(count <= 1000, "native_discovery_failed");
+      for (const feature of page3.data)
+        if (feature?.name === "hooks") {
+          need5(enabled === undefined && typeof feature.enabled === "boolean", "native_discovery_failed");
+          enabled = feature.enabled;
+        }
+      cursor = page3.nextCursor;
+      if (cursor !== null) {
+        need5(cursor.length > 0 && cursor.length <= 4096 && !seen.has(cursor) && page3.data.length > 0, "native_discovery_failed");
+        seen.add(cursor);
+      }
+    } while (cursor !== null);
+  }
+  return { guard: selectCodexSafety(hooks, configuration, home, cwd, enabled, options.requireReady ?? true), discovery: hooks, configuration };
+}
+
+// src/lib/codex-safety-trust.ts
+class CodexTrustError extends Error {
+  code;
+  operationId;
+  constructor(code2, operationId) {
+    super("Codex safety trust failed (" + code2 + ").");
+    this.code = code2;
+    this.operationId = operationId;
+    this.name = "CodexTrustError";
+  }
+}
+function need7(value, code2 = "native_changed") {
+  if (!value)
+    throw new CodexTrustError(code2);
+}
+var sha4 = (value) => createHash12("sha256").update(value).digest("hex");
+function canonical4(value) {
+  if (Array.isArray(value))
+    return "[" + value.map(canonical4).join(",") + "]";
+  if (value !== null && typeof value === "object")
+    return "{" + Object.keys(value).sort().map((key) => JSON.stringify(key) + ":" + canonical4(value[key])).join(",") + "}";
+  return JSON.stringify(value);
+}
+function mergedConfiguration(value) {
+  const copy = structuredClone(value);
+  if (copy?.hooks && typeof copy.hooks === "object" && !Array.isArray(copy.hooks)) {
+    for (const event of [
+      "PreToolUse",
+      "PermissionRequest",
+      "PostToolUse",
+      "PreCompact",
+      "PostCompact",
+      "SessionStart",
+      "SessionEnd",
+      "UserPromptSubmit",
+      "SubagentStart",
+      "SubagentStop",
+      "Stop",
+      "Interrupt"
+    ]) {
+      if (!Object.hasOwn(copy.hooks, event))
+        copy.hooks[event] = [];
+    }
+  }
+  return canonical4(copy);
+}
+function safeDirectory2(path) {
+  for (let p = path;; p = dirname21(p)) {
+    const s = lstatSync15(p);
+    need7(s.isDirectory() && [0, process.getuid?.()].includes(s.uid) && !(s.mode & 18), "preimage_unsafe");
+    if (dirname21(p) === p)
+      return;
+  }
+}
+function readPrivate(path) {
+  safeDirectory2(dirname21(path));
+  const fd = openSync7(path, constants12.O_RDONLY | constants12.O_NOFOLLOW | constants12.O_NONBLOCK);
+  try {
+    const s = fstatSync6(fd);
+    need7(s.isFile() && s.uid === process.getuid?.() && !(s.mode & 63) && s.size <= 4194304, "preimage_unsafe");
+    const bytes = readFileSync21(fd);
+    need7(bytes.length <= 4194304, "preimage_unsafe");
+    return bytes;
+  } finally {
+    closeSync7(fd);
+  }
+}
+function syncDirectory(path) {
+  const fd = openSync7(path, constants12.O_RDONLY | constants12.O_DIRECTORY | constants12.O_NOFOLLOW);
+  try {
+    fsyncSync5(fd);
+  } finally {
+    closeSync7(fd);
+  }
+}
+function exclusive(path, bytes) {
+  const fd = openSync7(path, constants12.O_CREAT | constants12.O_EXCL | constants12.O_WRONLY | constants12.O_NOFOLLOW, 384);
+  try {
+    writeFileSync11(fd, bytes);
+    fsyncSync5(fd);
+  } finally {
+    closeSync7(fd);
+  }
+  syncDirectory(dirname21(path));
+}
+async function inspect(rpc, home, cwd) {
+  const observed = await readCodexSafety(rpc, home, cwd, { includeLayers: true, requireReady: false });
+  const { guard, configuration, discovery } = observed;
+  const layers = configuration?.layers;
+  need7(Array.isArray(layers) && layers.length <= 1000, "native_config_invalid");
+  const userLayers = layers.filter((layer2) => layer2?.name?.type === "user" && layer2.name.profile === null);
+  need7(userLayers.length === 1, "native_config_invalid");
+  const layer = userLayers[0], path = layer.name.file;
+  need7(typeof path === "string" && isAbsolute18(path) && typeof layer.version === "string" && /^sha256:[a-f0-9]{64}$/.test(layer.version), "native_config_invalid");
+  const canonicalPath = realpathSync10(path), inside = relative2(home, canonicalPath);
+  need7(inside !== "" && !inside.startsWith("..") && !isAbsolute18(inside), "native_config_invalid");
+  const definition = discovery.data[0].hooks.find((h) => h.key === guard.key);
+  need7(definition.source === "user", "native_config_invalid");
+  const before = readPrivate(canonicalPath);
+  const rawState = layer.config?.hooks?.state?.[guard.key];
+  need7(rawState === undefined || rawState && typeof rawState === "object" && !Array.isArray(rawState), "native_config_invalid");
+  const desired = { ...rawState, enabled: true, trusted_hash: guard.currentHash };
+  const planBase = {
+    schema: "hasna.hooks.codex-safety-trust/v1",
+    nativeVersion: rpc.version,
+    cwd,
+    key: guard.key,
+    currentHash: guard.currentHash,
+    configPath: path,
+    configVersion: layer.version,
+    action: guard.enabled && guard.trustStatus === "trusted" ? "unchanged" : "trust_and_enable",
+    guardVerified: true,
+    nativeAdoptionVerified: false
+  };
+  const plan = { ...planBase, planDigest: sha4(canonical4({ planBase, configuration, discovery, raw: sha4(before) })) };
+  return { ...observed, layer, layers, canonicalPath, before, desired, plan };
+}
+async function context2(options, dependencies) {
+  const home = realpathSync10(options.home ?? homedir7()), cwd = realpathSync10(options.cwd ?? process.cwd());
+  need7(isAbsolute18(home) && isAbsolute18(cwd), "input_invalid");
+  return { home, cwd, rpc: await (dependencies.connect ?? connectCodexSafety)({ ...options, home }) };
+}
+async function planCodexSafetyTrust(options = {}, dependencies = {}) {
+  const { home, cwd, rpc } = await context2(options, dependencies);
+  try {
+    const before = await inspect(rpc, home, cwd);
+    await (dependencies.verify ?? verifyNativeSafetyCommand)(before.guard.command, home);
+    need7((await inspect(rpc, home, cwd)).plan.planDigest === before.plan.planDigest);
+    return before.plan;
+  } finally {
+    await rpc.close();
+  }
+}
+async function applyCodexSafetyTrust(options, dependencies = {}) {
+  need7(/^[a-f0-9]{64}$/.test(options.expectedPlanDigest), "input_invalid");
+  const selected = { ...options }, { home, cwd, rpc } = await context2(selected, dependencies);
+  let operationId;
+  try {
+    const before = await inspect(rpc, home, cwd);
+    need7(before.plan.planDigest === selected.expectedPlanDigest);
+    await (dependencies.verify ?? verifyNativeSafetyCommand)(before.guard.command, home);
+    need7((await inspect(rpc, home, cwd)).plan.planDigest === before.plan.planDigest);
+    if (before.plan.action === "unchanged")
+      return { ok: true, changed: false, ...before.plan };
+    const expectedConfiguration = structuredClone(before.configuration);
+    const expectedLayer = expectedConfiguration.layers.find((layer) => layer.name?.type === "user" && layer.name.profile === null);
+    for (const config2 of [expectedConfiguration.config, expectedLayer.config]) {
+      config2.hooks ??= {};
+      config2.hooks.state ??= {};
+      config2.hooks.state[before.guard.key] = before.desired;
+    }
+    const expectedDiscovery = structuredClone(before.discovery);
+    const expectedGuard = expectedDiscovery.data[0].hooks.find((h) => h.key === before.guard.key);
+    expectedGuard.enabled = true;
+    expectedGuard.trustStatus = "trusted";
+    operationId = randomUUID3();
+    let directory2 = home;
+    for (const part of [".hasna", "hooks", "native", "codex-trash-trust", operationId]) {
+      directory2 = join24(directory2, part);
+      try {
+        mkdirSync13(directory2, { mode: 448 });
+        syncDirectory(dirname21(directory2));
+      } catch (error61) {
+        if (error61.code !== "EEXIST")
+          throw error61;
+      }
+      safeDirectory2(directory2);
+    }
+    exclusive(join24(directory2, "config.before"), before.before);
+    exclusive(join24(directory2, "intent.json"), JSON.stringify({ operationId, plan: before.plan, configSHA256: sha4(before.before) }) + `
+`);
+    need7(sha4(readPrivate(before.canonicalPath)) === sha4(before.before));
+    const result = await rpc.request("config/batchWrite", {
+      filePath: before.plan.configPath,
+      expectedVersion: before.plan.configVersion,
+      reloadUserConfig: true,
+      edits: [{ keyPath: "hooks.state." + JSON.stringify(before.guard.key), value: before.desired, mergeStrategy: "replace" }]
+    });
+    need7(result?.status === "ok" && result.filePath === before.plan.configPath && result.overriddenMetadata === null && /^sha256:[a-f0-9]{64}$/.test(result.version));
+    const after = await inspect(rpc, home, cwd);
+    expectedLayer.version = result.version;
+    need7(after.layer.version === result.version && after.plan.action === "unchanged" && mergedConfiguration(after.configuration.config) === mergedConfiguration(expectedConfiguration.config) && canonical4(after.configuration.layers) === canonical4(expectedConfiguration.layers) && canonical4(after.discovery) === canonical4(expectedDiscovery));
+    const receipt = {
+      ok: true,
+      changed: true,
+      operationId,
+      planDigest: before.plan.planDigest,
+      configVersion: result.version,
+      guardVerified: true,
+      nativeDiscoveryVerified: true,
+      nativeAdoptionVerified: false,
+      unrelatedConfigurationPreserved: true
+    };
+    exclusive(join24(directory2, "receipt.json"), JSON.stringify(receipt) + `
+`);
+    return receipt;
+  } catch (error61) {
+    if (operationId)
+      throw new CodexTrustError("trust_outcome_uncertain", operationId);
+    throw error61;
+  } finally {
+    await rpc.close();
+  }
+}
+// src/lib/claude-safety-check.ts
+import { constants as constants14, closeSync as closeSync15, fstatSync as fstatSync7, lstatSync as lstatSync21, openSync as openSync15, readFileSync as readFileSync23, realpathSync as realpathSync11 } from "fs";
+import { createHash as createHash17 } from "crypto";
+import { dirname as dirname22, isAbsolute as isAbsolute19, join as join27, resolve as resolve18 } from "path";
+import { homedir as homedir8 } from "os";
+class ClaudeSafetyError extends Error {
+  code;
+  constructor(code2) {
+    super("Claude safety configuration check failed (" + code2 + ").");
+    this.code = code2;
+    this.name = "ClaudeSafetyError";
+  }
+}
+function need8(value, code2) {
+  if (!value)
+    throw new ClaudeSafetyError(code2);
+}
+var sha6 = (value) => createHash17("sha256").update(value).digest("hex");
+function read3(path) {
+  try {
+    const resolved = realpathSync11(path);
+    for (let parent = dirname22(resolved);; parent = dirname22(parent)) {
+      const s = lstatSync21(parent);
+      need8(s.isDirectory() && [0, process.getuid?.()].includes(s.uid) && !(s.mode & 18), "settings_unsafe");
+      if (dirname22(parent) === parent)
+        break;
+    }
+    const fd = openSync15(resolved, constants14.O_RDONLY | constants14.O_NOFOLLOW | constants14.O_NONBLOCK);
+    try {
+      const s = fstatSync7(fd);
+      need8(s.isFile() && [0, process.getuid?.()].includes(s.uid) && !(s.mode & 18) && s.size <= 1048576, "settings_unsafe");
+      const raw = readFileSync23(fd, "utf8");
+      need8(Buffer.byteLength(raw) <= 1048576, "settings_unsafe");
+      return { path, resolved, sha256: sha6(raw), raw };
+    } finally {
+      closeSync15(fd);
+    }
+  } catch (error61) {
+    if (error61.code === "ENOENT")
+      return { path, resolved: null, sha256: null, raw: null };
+    if (error61 instanceof ClaudeSafetyError)
+      throw error61;
+    throw new ClaudeSafetyError("settings_unsafe");
+  }
+}
+async function verifyClaudeSafetyConfiguration(options = {}, dependencies = {}) {
+  const home = realpathSync11(options.home ?? homedir8()), cwd = realpathSync11(options.cwd ?? process.cwd());
+  const paths = [
+    options.userSettingsPath ?? join27(home, ".claude/settings.json"),
+    join27(cwd, ".claude/settings.json"),
+    options.localSettingsPath ?? join27(cwd, ".claude/settings.local.json")
+  ];
+  need8(paths.every((path) => isAbsolute19(path) && resolve18(path) === path), "settings_unsafe");
+  const inspect2 = () => [...new Set(paths)].map(read3);
+  const before = inspect2(), unique = [...new Map(before.filter((file2) => file2.resolved !== null).map((file2) => [file2.resolved, file2])).values()];
+  const guards = [];
+  for (const file2 of unique) {
+    let settings;
+    try {
+      settings = JSON.parse(file2.raw);
+    } catch {
+      throw new ClaudeSafetyError("settings_invalid");
+    }
+    need8(settings && typeof settings === "object" && !Array.isArray(settings), "settings_invalid");
+    need8(settings.disableAllHooks === undefined || settings.disableAllHooks === false, "hooks_disabled");
+    if (settings.hooks === undefined)
+      continue;
+    need8(settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks), "settings_invalid");
+    let count = 0;
+    for (const [event, groups] of Object.entries(settings.hooks)) {
+      need8(Array.isArray(groups), "settings_invalid");
+      for (const group of groups) {
+        need8(group && Array.isArray(group.hooks), "settings_invalid");
+        for (const handler of group.hooks) {
+          need8(++count <= 1e4 && handler && typeof handler === "object", "settings_invalid");
+          if (typeof handler.command !== "string")
+            continue;
+          const binding = nativeSafetyCommandBinding(handler.command);
+          if (/\bhasna-native-safety-v\d+\b/.test(handler.command))
+            need8(binding, "guard_definition_invalid");
+          need8(!/^(?:hooks run trash-guard|hook-trash-guard)(?:\s|$)/.test(handler.command.trim()), "guard_definition_invalid");
+          if (binding?.name !== "trash-guard")
+            continue;
+          need8(binding.home === home && event === "PreToolUse" && handler.type === "command" && group.matcher === "^(Bash|apply_patch|ApplyPatch|functions\\.apply_patch)$" && handler.timeout === 10 && (handler.async === undefined || handler.async === false) && handler.asyncRewake !== true, "guard_definition_invalid");
+          guards.push({ command: handler.command, path: file2.path });
+        }
+      }
+    }
+  }
+  need8(guards.length !== 0, "guard_missing");
+  need8(guards.length === 1, "guard_ambiguous");
+  try {
+    await (dependencies.verify ?? verifyNativeSafetyCommand)(guards[0].command, home);
+  } catch {
+    throw new ClaudeSafetyError("guard_failed");
+  }
+  need8(JSON.stringify(inspect2()) === JSON.stringify(before), "settings_changed");
+  return {
+    ok: true,
+    target: "claude",
+    cwd,
+    configurationVerified: true,
+    guardVerified: true,
+    sources: before.map(({ path, sha256 }) => ({ path, sha256 })),
+    guardSHA256: sha6(guards[0].command),
+    runtimePolicyVerified: false,
+    nativeDiscoveryVerified: false,
+    nativeAdoptionVerified: false
+  };
+}
+// src/lib/native-safety-registration.ts
+import { createHash as createHash19, randomUUID as randomUUID5 } from "crypto";
+import { constants as constants15, closeSync as closeSync17, fstatSync as fstatSync15, fsyncSync as fsyncSync7, lstatSync as lstatSync23, mkdirSync as mkdirSync14, openSync as openSync17, readFileSync as readFileSync25, realpathSync as realpathSync12, writeFileSync as writeFileSync12 } from "fs";
+import { basename as basename9, dirname as dirname23, isAbsolute as isAbsolute20, join as join29, relative as relative3, resolve as resolve19 } from "path";
+import { homedir as homedir9 } from "os";
+class NativeRegistrationError extends Error {
+  code;
+  operationId;
+  constructor(code2, operationId) {
+    super("Native safety registration failed (" + code2 + ").");
+    this.code = code2;
+    this.operationId = operationId;
+    this.name = "NativeRegistrationError";
+  }
+}
+var need9 = (value, code2) => {
+  if (!value)
+    throw new NativeRegistrationError(code2);
+};
+var sha7 = (value) => createHash19("sha256").update(value).digest("hex");
+function canonical6(value) {
+  if (Array.isArray(value))
+    return "[" + value.map(canonical6).join(",") + "]";
+  if (value !== null && typeof value === "object")
+    return "{" + Object.keys(value).sort().map((key) => JSON.stringify(key) + ":" + canonical6(value[key])).join(",") + "}";
+  return JSON.stringify(value);
+}
+function safeDirectory3(path) {
+  for (let p = path;; p = dirname23(p)) {
+    const s = lstatSync23(p);
+    need9(s.isDirectory() && [0, process.getuid?.()].includes(s.uid) && !(s.mode & 18), "settings_unsafe");
+    if (dirname23(p) === p)
+      return;
+  }
+}
+function read5(path) {
+  let resolved;
+  try {
+    resolved = realpathSync12(path);
+  } catch (error61) {
+    if (error61.code !== "ENOENT")
+      throw new NativeRegistrationError("settings_unsafe");
+    try {
+      lstatSync23(path);
+      throw new NativeRegistrationError("settings_unsafe");
+    } catch (missing2) {
+      if (missing2.code !== "ENOENT")
+        throw missing2;
+    }
+    let ancestor = dirname23(path);
+    const suffix = [basename9(path)];
+    for (;; ) {
+      try {
+        resolved = join29(realpathSync12(ancestor), ...suffix);
+        break;
+      } catch (missing2) {
+        if (missing2.code !== "ENOENT" || dirname23(ancestor) === ancestor || suffix.length >= 64)
+          throw new NativeRegistrationError("settings_unsafe");
+        try {
+          lstatSync23(ancestor);
+          throw new NativeRegistrationError("settings_unsafe");
+        } catch (absent) {
+          if (absent.code !== "ENOENT")
+            throw absent;
+        }
+        suffix.unshift(basename9(ancestor));
+        ancestor = dirname23(ancestor);
+      }
+    }
+    safeDirectory3(realpathSync12(ancestor));
+    return { resolved, raw: null, sha256: "absent" };
+  }
+  safeDirectory3(dirname23(resolved));
+  let fd;
+  try {
+    fd = openSync17(resolved, constants15.O_RDONLY | constants15.O_NOFOLLOW | constants15.O_NONBLOCK);
+  } catch (error61) {
+    if (error61.code === "ENOENT")
+      return { resolved, raw: null, sha256: "absent" };
+    throw new NativeRegistrationError("settings_unsafe");
+  }
+  try {
+    const s = fstatSync15(fd);
+    need9(s.isFile() && s.uid === process.getuid?.() && !(s.mode & 18) && s.nlink === 1 && s.size <= 1048576, "settings_unsafe");
+    const bytes = readFileSync25(fd);
+    need9(bytes.length <= 1048576, "settings_unsafe");
+    const raw = bytes.toString("utf8");
+    need9(Buffer.from(raw).equals(bytes), "settings_invalid");
+    return { resolved, raw, sha256: sha7(bytes) };
+  } finally {
+    closeSync17(fd);
+  }
+}
+function assertLosslessJson(raw) {
+  const tokens = /"(?:\\[\s\S]|[^"\\])*"|-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?|true|false|null|[{}\[\],:]/g;
+  const stack = [];
+  function decimal(text3) {
+    const match = /^(-?)([0-9]+)(?:\.([0-9]+))?(?:[eE]([+-]?[0-9]+))?$/.exec(text3);
+    need9((match[4]?.replace(/^[+-]/, "").length ?? 0) <= 6, "settings_invalid");
+    let digits = (match[2] + (match[3] ?? "")).replace(/^0+/, "");
+    if (!digits)
+      return match[1] ? "-0" : "0";
+    let exponent = Number(match[4] ?? "0") - (match[3]?.length ?? 0);
+    while (digits.endsWith("0")) {
+      digits = digits.slice(0, -1);
+      exponent++;
+    }
+    return match[1] + digits + "e" + exponent;
+  }
+  for (const match of raw.matchAll(tokens)) {
+    const token = match[0], current2 = stack.at(-1);
+    if (token === "{")
+      stack.push({ kind: "object", key: true, names: new Set });
+    else if (token === "[")
+      stack.push({ kind: "array", key: false, names: new Set });
+    else if (token === "}" || token === "]")
+      stack.pop();
+    else if (token === "," && current2?.kind === "object")
+      current2.key = true;
+    else if (token.startsWith('"') && current2?.kind === "object" && current2.key) {
+      const key = JSON.parse(token);
+      need9(!current2.names.has(key), "settings_invalid");
+      current2.names.add(key);
+      current2.key = false;
+    } else if (/^-?[0-9]/.test(token)) {
+      const parsed = Number(token);
+      need9(Number.isFinite(parsed) && decimal(token) === decimal(JSON.stringify(parsed)), "settings_invalid");
+    }
+  }
+}
+function validateSettings(raw) {
+  let settings;
+  try {
+    settings = JSON.parse(raw ?? "{}");
+  } catch {
+    throw new NativeRegistrationError("settings_invalid");
+  }
+  need9(settings && typeof settings === "object" && !Array.isArray(settings), "settings_invalid");
+  assertLosslessJson(raw ?? "{}");
+  need9(settings.disableAllHooks === undefined || settings.disableAllHooks === false, "hooks_disabled");
+  if (settings.hooks !== undefined) {
+    need9(settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks), "settings_invalid");
+    for (const groups of Object.values(settings.hooks)) {
+      need9(Array.isArray(groups), "settings_invalid");
+      for (const group of groups) {
+        need9(group && Array.isArray(group.hooks), "settings_invalid");
+        for (const hook of group.hooks) {
+          need9(hook && typeof hook === "object", "settings_invalid");
+          if (registrationName(hook.command) === "trash-guard") {
+            need9((hook.async === undefined || hook.async === false) && hook.asyncRewake !== true, "registration_conflict");
+          }
+        }
+      }
+    }
+  }
+  return settings;
+}
+function inspect2(options) {
+  need9(options?.target === "codex" || options?.target === "claude", "input_invalid");
+  const home = realpathSync12(homedir9()), path = getSettingsPath("global", options.target);
+  need9(isAbsolute20(path) && resolve19(path) === path, "input_invalid");
+  const nativeHome = options.target === "codex" ? process.env.CODEX_HOME : process.env.CLAUDE_CONFIG_DIR;
+  if (nativeHome !== undefined) {
+    need9(nativeHome.length > 0 && isAbsolute20(nativeHome), "input_invalid");
+    const selectedNative = read5(resolve19(nativeHome, options.target === "codex" ? "hooks.json" : "settings.json"));
+    need9(read5(path).resolved === selectedNative.resolved, "input_invalid");
+  }
+  const before = read5(path), inside = relative3(home, before.resolved);
+  need9(inside !== "" && !inside.startsWith("..") && !isAbsolute20(inside), "settings_unsafe");
+  const parsed = validateSettings(before.raw);
+  let preview2;
+  try {
+    preview2 = previewNativeSafetyRegistration(options.target);
+  } catch {
+    throw new NativeRegistrationError("registration_conflict");
+  }
+  need9(preview2.before === before.raw, "settings_changed");
+  validateSettings(preview2.after);
+  const changed = canonical6(parsed) !== canonical6(JSON.parse(preview2.after));
+  const base = {
+    schema: "hasna.hooks.native-safety-registration/v1",
+    target: options.target,
+    settingsPath: path,
+    resolvedPath: before.resolved,
+    beforeSHA256: before.sha256,
+    desiredSHA256: changed ? sha7(preview2.after) : before.sha256,
+    commandSHA256: sha7(preview2.command),
+    action: changed ? "register" : "unchanged",
+    guardVerified: true,
+    nativeAdoptionVerified: false
+  };
+  const plan = { ...base, planDigest: sha7(canonical6(base)) };
+  need9(canonical6(read5(path)) === canonical6(before), "settings_changed");
+  return { home, before, preview: preview2, plan };
+}
+function syncDirectory2(path) {
+  const fd = openSync17(path, constants15.O_RDONLY | constants15.O_DIRECTORY | constants15.O_NOFOLLOW);
+  try {
+    fsyncSync7(fd);
+  } finally {
+    closeSync17(fd);
+  }
+}
+function exclusive2(path, bytes) {
+  const fd = openSync17(path, constants15.O_CREAT | constants15.O_EXCL | constants15.O_WRONLY | constants15.O_NOFOLLOW, 384);
+  try {
+    writeFileSync12(fd, bytes);
+    fsyncSync7(fd);
+  } finally {
+    closeSync17(fd);
+  }
+  syncDirectory2(dirname23(path));
+}
+async function planNativeSafetyRegistration(options, dependencies = {}) {
+  const selected = { ...options }, before = inspect2(selected);
+  try {
+    await (dependencies.verify ?? verifyNativeSafetyCommand)(before.preview.command, before.home);
+  } catch {
+    throw new NativeRegistrationError("guard_failed");
+  }
+  need9(inspect2(selected).plan.planDigest === before.plan.planDigest, "settings_changed");
+  return before.plan;
+}
+async function applyNativeSafetyRegistration(options, dependencies = {}) {
+  const selected = { ...options };
+  need9(/^[a-f0-9]{64}$/.test(selected.expectedPlanDigest), "input_invalid");
+  const plan = await planNativeSafetyRegistration(selected, dependencies);
+  need9(plan.planDigest === selected.expectedPlanDigest, "settings_changed");
+  const before = inspect2(selected);
+  need9(before.plan.planDigest === plan.planDigest, "settings_changed");
+  if (plan.action === "unchanged")
+    return { ok: true, changed: false, ...plan };
+  const operationId = randomUUID5();
+  let directory2 = before.home;
+  for (const part of [".hasna", "hooks", "native", "trash-registration", operationId]) {
+    directory2 = join29(directory2, part);
+    try {
+      mkdirSync14(directory2, { mode: 448 });
+      syncDirectory2(dirname23(directory2));
+    } catch (error61) {
+      if (error61.code !== "EEXIST")
+        throw new NativeRegistrationError("settings_unsafe");
+    }
+    safeDirectory3(directory2);
+  }
+  if (before.before.raw !== null)
+    exclusive2(join29(directory2, "settings.before"), before.before.raw);
+  exclusive2(join29(directory2, "intent.json"), JSON.stringify({ operationId, plan }) + `
+`);
+  try {
+    need9(inspect2(selected).plan.planDigest === plan.planDigest, "settings_changed");
+    const result = installHook("trash-guard", { target: selected.target, overwrite: true, expectedSettingsSha256: plan.beforeSHA256 });
+    need9(result.success, "apply_outcome_uncertain");
+    const after = inspect2(selected);
+    need9(after.before.sha256 === plan.desiredSHA256 && after.plan.resolvedPath === plan.resolvedPath && after.plan.action === "unchanged" && after.plan.commandSHA256 === plan.commandSHA256, "apply_outcome_uncertain");
+    const receipt = {
+      ok: true,
+      changed: true,
+      operationId,
+      planDigest: plan.planDigest,
+      settingsSHA256: after.before.sha256,
+      guardVerified: true,
+      nativeAdoptionVerified: false
+    };
+    exclusive2(join29(directory2, "receipt.json"), JSON.stringify(receipt) + `
+`);
+    return receipt;
+  } catch {
+    throw new NativeRegistrationError("apply_outcome_uncertain", operationId);
+  }
+}
 
 // src/index.ts
 function installHookForProject(name, options = {}) {
@@ -40999,11 +41972,11 @@ async function runHook(name, input2, options = {}) {
     throw new Error(`Hook '${name}' not found`);
   const hookScript = getHookPath(name) + "/src/hook.ts";
   const resolvedScript = custom3?.scriptPath;
-  const script = resolvedScript ?? (existsSync14(hookScript) ? hookScript : undefined);
+  const script = resolvedScript ?? (existsSync15(hookScript) ? hookScript : undefined);
   if (!script)
     throw new Error(`Hook script not found: ${name}`);
   const { sha256Of: sha256Of2, checkScriptHash: checkScriptHash2 } = await Promise.resolve().then(() => (init_store(), exports_store));
-  const content = readFileSync19(script);
+  const content = readFileSync26(script);
   const check2 = checkScriptHash2(name, sha256Of2(content));
   if (!check2.ok) {
     throw new Error(`Hook '${name}' script changed since it was trusted (sha256 ${check2.expected} != ${check2.actual}). Run 'hooks trust ${name}' to trust the new content.`);
@@ -41095,6 +42068,7 @@ export {
   writeLock,
   writeCustomHook,
   verifyScriptHash,
+  verifyClaudeSafetyConfiguration,
   upsertHookRecord,
   updateProfile,
   uninstallHook,
@@ -41133,6 +42107,8 @@ export {
   readCustomManifest,
   provisionCloudflareResources,
   planSync,
+  planNativeSafetyRegistration,
+  planCodexSafetyTrust,
   pinInstalledHook,
   parseStorageTables,
   parseManifest,
@@ -41186,12 +42162,15 @@ export {
   createProfile,
   checkScriptHash,
   buildCodewithTomlFragment,
+  applyNativeSafetyRegistration,
+  applyCodexSafetyTrust,
   allowLocalStore,
   STORAGE_TABLES,
   STORAGE_DATABASE_ENV,
   STORAGE_BACKEND_ENV,
   STORAGE_BACKENDS,
   RETIRED_STORAGE_MODE_ENV,
+  NativeRegistrationError,
   HOOK_EVENTS,
   HOOKS_STORAGE_TABLES,
   HOOKS_STORAGE_FALLBACK_ENV,
@@ -41201,5 +42180,7 @@ export {
   HOOKS_LOCAL_OPT_IN_ENV_KEYS,
   HOOKS,
   DEFAULT_SERVE_PORT,
+  CodexTrustError,
+  ClaudeSafetyError,
   CATEGORIES
 };