@hasna/hooks 0.10.6 → 0.10.8

package/bin/native-safety-entry.js

@@ -1179,6 +1179,126 @@ var OUTPUT_REDIRECT = /(?:\d+|&)?(?:>>|>\||>&|<>|>)\s*([^\s;&|<>()\x60]*)/g;
 function withoutFdDuplication(segment) {
   return segment.replace(FD_DUPLICATION, " ");
 }
+function pipelineStages(segment) {
+  const stages = [];
+  let quote = null;
+  let parens = 0;
+  let braces = 0;
+  let backtick = false;
+  let start = 0;
+  for (let i = 0;i < segment.length; i++) {
+    const ch = segment[i];
+    if (quote === "'") {
+      if (ch === "'")
+        quote = null;
+      continue;
+    }
+    if (ch === "\\") {
+      i++;
+      continue;
+    }
+    if (ch === "(") {
+      parens++;
+      continue;
+    }
+    if (ch === ")") {
+      if (--parens < 0)
+        return [segment];
+      continue;
+    }
+    if (ch === "$" && segment[i + 1] === "{") {
+      braces++;
+      i++;
+      continue;
+    }
+    if (ch === "}" && braces > 0) {
+      braces--;
+      continue;
+    }
+    if (ch === "`") {
+      backtick = !backtick;
+      continue;
+    }
+    if (quote === '"') {
+      if (ch === '"')
+        quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      continue;
+    }
+    if (ch !== "|" || parens > 0 || braces > 0 || backtick || segment[i - 1] === ">")
+      continue;
+    stages.push(segment.slice(start, i));
+    if (segment[i + 1] === "&")
+      i++;
+    start = i + 1;
+  }
+  if (quote || parens !== 0 || braces !== 0 || backtick)
+    return [segment];
+  stages.push(segment.slice(start));
+  return stages;
+}
+function shellWords(command) {
+  const words = [];
+  let text = "";
+  let raw = "";
+  let quote = null;
+  let inWord = false;
+  const flush = () => {
+    if (!inWord)
+      return;
+    const body = raw.replace(/^"?\$\{?HOME\}?"?(?=\/|$)/, "");
+    const literalTilde = text.startsWith("~") && !/^~(?:\/|$)/.test(raw);
+    words.push({ text: literalTilde ? `./${text}` : text, opaque: /[$\x60*?[]/.test(body) || /[()]/.test(body) });
+    text = "";
+    raw = "";
+    inWord = false;
+  };
+  for (let i = 0;i < command.length; i++) {
+    const ch = command[i];
+    if (quote === "'") {
+      if (ch === "'")
+        quote = null;
+      else
+        text += ch;
+      raw += ch;
+      continue;
+    }
+    if (ch === "\\" && i + 1 < command.length) {
+      const next = command[i + 1];
+      text += quote === '"' && !/[$\x60"\\\n]/.test(next) ? ch + next : next;
+      raw += ch + next;
+      inWord = true;
+      i++;
+      continue;
+    }
+    if (quote === '"') {
+      if (ch === '"')
+        quote = null;
+      else
+        text += ch;
+      raw += ch;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      flush();
+      continue;
+    }
+    inWord = true;
+    raw += ch;
+    if (ch === "'" || ch === '"')
+      quote = ch;
+    else
+      text += ch;
+  }
+  if (quote) {
+    raw += "$";
+  }
+  flush();
+  return words;
+}
 function segmentOperation(segment) {
   const trimmed = segment.trim();
   if (!trimmed)
@@ -1281,7 +1401,6 @@ function bashTargets(command, home, cwd) {
     for (let i = 0;i < opens; i++)
       subshells.push({ current: [...current], reachable: new Set(reachable), certain });
     const segment = unwrapSegment(rawSegment);
-    const op = segmentOperation(segment);
     const plainCd = segment.match(/^cd(?:\s+(?:-[A-Za-z@]+|--))*(?:\s+([^\s;&|<>()\x60]+))?$/);
     const embeddedCd = plainCd ? null : segment.match(/(?:^|\s)cd(?:\s+(?:-[A-Za-z]+|--))*\s+([^\s;&|<>()\x60]+)/);
     if (embeddedCd) {
@@ -1294,28 +1413,90 @@ function bashTargets(command, home, cwd) {
     const suffix = roots.map((root) => regexEscape(root.slice(home.length + 1))).join("|");
     const prefixRe = new RegExp(`(?:~|\\$HOME"*|\\$\\{HOME\\}"*|${homeLiteral}"*)/(?:${suffix})`);
     const re = new RegExp(`(${prefixRe.source})([^\\s"';&|<>()\`]*|$)`, "g");
-    let m;
-    let foundExplicit = false;
-    while ((m = re.exec(segment)) !== null) {
-      foundExplicit = true;
-      const expanded = expandHomeSpelling2(m[0], home);
-      targets.push({ path: normalize2(expanded).replace(/\/+$/, ""), op });
-    }
-    if (!foundExplicit && (op === "delete" || op === "write")) {
+    const explicitTargets = (text) => {
+      const found = [];
+      let m;
+      re.lastIndex = 0;
+      while ((m = re.exec(text)) !== null)
+        found.push(normalize2(expandHomeSpelling2(m[0], home)).replace(/\/+$/, ""));
+      return found;
+    };
+    const stages = pipelineStages(segment).map((stage) => {
       const operands = [];
-      const commandPart = withoutFdDuplication(segment).replace(OUTPUT_REDIRECT, (_match, operand) => {
+      let opaqueRedirect = false;
+      const commandPart = withoutFdDuplication(stage).replace(OUTPUT_REDIRECT, (_match, operand) => {
+        if (!operand || /[$\x60]/.test(operand))
+          opaqueRedirect = true;
         if (operand)
           operands.push(operand);
         return " ";
       });
       const commandOp = segmentOperation(commandPart);
-      const relMatch = commandOp === "read" ? null : commandPart.match(REL_OPERAND);
-      for (const base of current.filter(underRoot)) {
-        for (const operand of operands) {
+      return { commandPart, operands, op: opaqueRedirect && commandOp === "read" ? "write" : commandOp };
+    });
+    const pipelineOp = stages.some((stage) => stage.op === "delete") ? "delete" : stages.some((stage) => stage.op === "write") ? "write" : "read";
+    const bases = current.filter(underRoot);
+    for (const stage of stages) {
+      let foundExplicit = false;
+      for (const path of explicitTargets(stage.commandPart)) {
+        foundExplicit = true;
+        targets.push({ path, op: pipelineOp });
+      }
+      for (const operand of stage.operands) {
+        const explicit = explicitTargets(operand);
+        for (const path of explicit)
+          targets.push({ path, op: "write" });
+        if (explicit.length > 0)
+          continue;
+        for (const base of bases) {
           targets.push({ path: normalize2(resolve3(base, expandHomeSpelling2(operand, home))), op: "write" });
         }
-        if (relMatch)
-          targets.push({ path: normalize2(resolve3(base, relMatch[1])), op: commandOp });
+      }
+      if (foundExplicit || stage.op === "read")
+        continue;
+      const words = shellWords(stage.commandPart);
+      let endOfOptions = false;
+      const nonFlag = words.slice(1).flatMap((word) => {
+        if (!endOfOptions && word.text === "--") {
+          endOfOptions = true;
+          return [];
+        }
+        if (!endOfOptions && word.text.startsWith("-"))
+          return [];
+        endOfOptions = true;
+        return [word.opaque ? "." : word.text];
+      });
+      const everyOperand = stage.op === "delete" || /(?:^|\s)(?:mkdir|mkfile|touch|tee|truncate|install|mv)(?:\s|$)/.test(stage.commandPart) || /(?:^|\s)sed(?:\s|$)/.test(stage.commandPart) && /(?:^|\s)(?:-i\S*|--in-place\S*)(?:\s|$)/.test(stage.commandPart);
+      const operandTargets = [];
+      if (everyOperand) {
+        for (const operand of nonFlag.length > 0 ? nonFlag : ["."])
+          operandTargets.push({ operand, op: stage.op });
+      } else {
+        const relMatch = stage.commandPart.match(REL_OPERAND);
+        const last = words.at(-1);
+        operandTargets.push({ operand: relMatch ? relMatch[1] : !last || last.opaque ? "." : last.text, op: stage.op });
+        if (/(?:^|\s)(?:cp|ln|install|mv)(?:\s|$)/.test(stage.commandPart)) {
+          words.forEach((word, index2) => {
+            let value;
+            const short = word.text.match(/^-[A-Za-z]*?t(.*)$/);
+            const long = word.text.match(/^(--t[a-z-]*)(?:=(.*))?$/);
+            if (short && !word.text.startsWith("--")) {
+              value = short[1] ? { text: short[1], opaque: word.opaque } : words[index2 + 1];
+            } else if (long && "--target-directory".startsWith(long[1])) {
+              value = long[2] !== undefined ? { text: long[2], opaque: word.opaque } : words[index2 + 1];
+            }
+            if (value)
+              operandTargets.push({ operand: value.opaque || !value.text ? "." : value.text, op: stage.op });
+          });
+        }
+        if (/(?:^|\s)(?:python3?|node|bun)\b[^;&|]*\s+-[ce](?:\s|$)/.test(stage.commandPart)) {
+          operandTargets.push({ operand: ".", op: stage.op });
+        }
+      }
+      for (const base of bases) {
+        for (const { operand, op } of operandTargets) {
+          targets.push({ path: normalize2(resolve3(base, expandHomeSpelling2(operand, home))), op });
+        }
       }
     }
     if (plainCd) {

package/dist/index.d.ts

@@ -94,3 +94,6 @@ export { handleServeRequest, startServeServer, DEFAULT_SERVE_PORT, } from "./ser
 export type { CatalogEntry, ArtifactPayload } from "./serve.js";
 export { provisionCloudflareResources, } from "./cf/provision.js";
 export type { ProvisionOptions, ProvisionResult } from "./cf/provision.js";
+export { planCodexSafetyTrust, applyCodexSafetyTrust, CodexTrustError, type CodexTrustPlan } from "./lib/codex-safety-trust.js";
+export { verifyClaudeSafetyConfiguration, ClaudeSafetyError, type ClaudeSafetyOptions } from "./lib/claude-safety-check.js";
+export { planNativeSafetyRegistration, applyNativeSafetyRegistration, NativeRegistrationError, type NativeRegistrationPlan, type NativeRegistrationOptions } from "./lib/native-safety-registration.js";