@hasna/hooks 0.10.6 → 0.10.8

package/dist/lib/claude-safety-check.d.ts

@@ -0,0 +1,32 @@
+import { verifyNativeSafetyCommand } from "../native-safety.js";
+export declare class ClaudeSafetyError extends Error {
+    readonly code: "settings_unsafe" | "settings_invalid" | "settings_changed" | "hooks_disabled" | "guard_missing" | "guard_ambiguous" | "guard_definition_invalid" | "guard_failed";
+    constructor(code: "settings_unsafe" | "settings_invalid" | "settings_changed" | "hooks_disabled" | "guard_missing" | "guard_ambiguous" | "guard_definition_invalid" | "guard_failed");
+}
+export interface ClaudeSafetyOptions {
+    home?: string;
+    cwd?: string;
+    /** Exact user settings path, for the native CLAUDE_CONFIG_DIR override. */
+    userSettingsPath?: string;
+    /** An already-resolved main-checkout local file may be outside cwd. */
+    localSettingsPath?: string;
+}
+/** This does not claim to reproduce Claude's MDM/server/CLI policy merge.
+ * It checks these selected native settings sources and their exact bytes. */
+export declare function verifyClaudeSafetyConfiguration(options?: ClaudeSafetyOptions, dependencies?: {
+    verify?: typeof verifyNativeSafetyCommand;
+}): Promise<{
+    ok: true;
+    target: "claude";
+    cwd: string;
+    configurationVerified: boolean;
+    guardVerified: boolean;
+    sources: {
+        path: string;
+        sha256: string | null;
+    }[];
+    guardSHA256: string;
+    runtimePolicyVerified: boolean;
+    nativeDiscoveryVerified: boolean;
+    nativeAdoptionVerified: boolean;
+}>;

package/dist/lib/codex-safety-check.d.ts

@@ -0,0 +1,58 @@
+import { verifyNativeSafetyCommand } from "../native-safety.js";
+export type CodexSafetyCode = "native_unavailable" | "native_unsafe_executable" | "native_executable_required" | "native_unsupported" | "native_failed" | "native_discovery_failed" | "hooks_disabled" | "guard_missing" | "guard_ambiguous" | "guard_definition_invalid" | "guard_disabled" | "guard_untrusted" | "guard_changed" | "guard_failed";
+export declare class CodexSafetyError extends Error {
+    readonly code: CodexSafetyCode;
+    constructor(code: CodexSafetyCode);
+}
+export interface CodexSafetyRpc {
+    version: string;
+    request(method: "hooks/list" | "config/read" | "experimentalFeature/list" | "config/batchWrite", params: unknown): Promise<unknown>;
+    close(): Promise<void>;
+}
+export type CodexSafetyOptions = {
+    command?: string;
+    home?: string;
+    cwd?: string;
+    codexHome?: string;
+};
+/** Owns only its fresh app-server subprocess. It never reloads a running agent,
+ * enrolls trust, starts a model turn or forwards native diagnostic text. */
+export declare function connectCodexSafety(options: Required<Pick<CodexSafetyOptions, "home">> & CodexSafetyOptions): Promise<CodexSafetyRpc>;
+type NativeGuard = {
+    key: string;
+    command: string;
+    currentHash: string;
+    sourcePath: string;
+    enabled: boolean;
+    trustStatus: string;
+};
+/** Select only the exact packaged composite definition in native discovery.
+ * A name, a settings file, or a trusted hash by itself is not enough. */
+export declare function selectCodexSafety(discovery: unknown, configuration: unknown, home: string, cwd: string, featureEnabled?: boolean, requireReady?: boolean): NativeGuard;
+export declare function readCodexSafety(rpc: CodexSafetyRpc, home: string, cwd: string, options?: {
+    includeLayers?: boolean;
+    requireReady?: boolean;
+}): Promise<{
+    guard: NativeGuard;
+    discovery: unknown;
+    configuration: unknown;
+}>;
+/** Two native observations surround stateless guard classification. No requested
+ * file operation is executed and no Hooks registry credential is consulted. */
+export declare function verifyCodexNativeSafety(options?: CodexSafetyOptions, dependencies?: {
+    connect?: typeof connectCodexSafety;
+    verify?: typeof verifyNativeSafetyCommand;
+}): Promise<{
+    ok: true;
+    target: "codex";
+    nativeVersion: string;
+    cwd: string;
+    key: string;
+    currentHash: string;
+    enabled: boolean;
+    trusted: boolean;
+    guardVerified: boolean;
+    nativeDiscoveryVerified: boolean;
+    nativeAdoptionVerified: boolean;
+}>;
+export {};

package/dist/lib/codex-safety-trust.d.ts

@@ -0,0 +1,54 @@
+import { connectCodexSafety, type CodexSafetyOptions } from "./codex-safety-check.js";
+import { verifyNativeSafetyCommand } from "../native-safety.js";
+export declare class CodexTrustError extends Error {
+    readonly code: "input_invalid" | "native_changed" | "native_config_invalid" | "preimage_unsafe" | "trust_outcome_uncertain";
+    readonly operationId?: string | undefined;
+    constructor(code: "input_invalid" | "native_changed" | "native_config_invalid" | "preimage_unsafe" | "trust_outcome_uncertain", operationId?: string | undefined);
+}
+interface Dependencies {
+    connect?: typeof connectCodexSafety;
+    verify?: typeof verifyNativeSafetyCommand;
+}
+type Options = CodexSafetyOptions;
+export interface CodexTrustPlan {
+    schema: "hasna.hooks.codex-safety-trust/v1";
+    planDigest: string;
+    nativeVersion: string;
+    cwd: string;
+    key: string;
+    currentHash: string;
+    configPath: string;
+    configVersion: string;
+    action: "unchanged" | "trust_and_enable";
+    guardVerified: true;
+    nativeAdoptionVerified: false;
+}
+export declare function planCodexSafetyTrust(options?: Options, dependencies?: Dependencies): Promise<CodexTrustPlan>;
+export declare function applyCodexSafetyTrust(options: Options & {
+    expectedPlanDigest: string;
+}, dependencies?: Dependencies): Promise<{
+    ok: boolean;
+    changed: boolean;
+    operationId: string;
+    planDigest: string;
+    configVersion: any;
+    guardVerified: boolean;
+    nativeDiscoveryVerified: boolean;
+    nativeAdoptionVerified: boolean;
+    unrelatedConfigurationPreserved: boolean;
+} | {
+    schema: "hasna.hooks.codex-safety-trust/v1";
+    planDigest: string;
+    nativeVersion: string;
+    cwd: string;
+    key: string;
+    currentHash: string;
+    configPath: string;
+    configVersion: string;
+    action: "unchanged" | "trust_and_enable";
+    guardVerified: true;
+    nativeAdoptionVerified: false;
+    ok: boolean;
+    changed: boolean;
+}>;
+export {};

package/dist/lib/codex-settings.d.ts

@@ -1,3 +1,7 @@
 export declare function readCodexSettings(path: string): Record<string, any>;
 /** Preserve the exact read version. Never write trust state or config.toml. */
-export declare function writeCodexSettings(path: string, settings: Record<string, any>): void;
+export declare function capturedCodexSettings(settings: Record<string, any>): string | null;
+export declare function assertSettingsPreimage(raw: string | null, expected?: string): void;
+export declare function writeCodexSettings(path: string, settings: Record<string, any>, expectedSha256?: string): void;
+/** Shared standalone writer. Managed Claude settings still use Skills. */
+export declare function writeHookSettingsPreimage(path: string, settings: Record<string, any>, before: string | null): void;

package/dist/lib/installer.d.ts

@@ -30,6 +30,8 @@ export interface InstallResult {
     configPath?: string;
 }
 export interface InstallOptions {
+    /** Optional exact predecessor for a planned native safety registration. */
+    expectedSettingsSha256?: string;
     /** Explicit persistent opt-in for mementos-context; omitted updates retain its current choice. */
     mementos?: MementosRegistration;
     scope?: Scope;
@@ -64,6 +66,12 @@ export declare function detectRewriteConflict(name: string, scope: Scope, target
 /** Injected for tests: the rewrite claim is a registry concern, the overlap is not. */
 lookup?: (hookName: string) => HookMeta | undefined): string | undefined;
 export declare function installHook(name: string, options?: InstallOptions): InstallResult;
+/** Render through the installer without writing settings or trust state. */
+export declare function previewNativeSafetyRegistration(target: "codex" | "claude", scope?: Scope): {
+    before: string | null;
+    after: string;
+    command: string;
+};
 export declare function installHooks(names: string[], options?: InstallOptions): InstallResult[];
 export declare function getRegisteredHooksForTarget(scope?: Scope, target?: SingleTarget): string[];
 export declare function getRegisteredHooks(scope?: Scope): string[];

package/dist/lib/native-safety-registration.d.ts

@@ -0,0 +1,52 @@
+import { verifyNativeSafetyCommand } from "../native-safety.js";
+export declare class NativeRegistrationError extends Error {
+    readonly code: "input_invalid" | "settings_unsafe" | "settings_invalid" | "settings_changed" | "hooks_disabled" | "registration_conflict" | "guard_failed" | "apply_outcome_uncertain";
+    readonly operationId?: string | undefined;
+    constructor(code: "input_invalid" | "settings_unsafe" | "settings_invalid" | "settings_changed" | "hooks_disabled" | "registration_conflict" | "guard_failed" | "apply_outcome_uncertain", operationId?: string | undefined);
+}
+export interface NativeRegistrationOptions {
+    target: "codex" | "claude";
+}
+export interface NativeRegistrationPlan {
+    schema: "hasna.hooks.native-safety-registration/v1";
+    target: "codex" | "claude";
+    settingsPath: string;
+    resolvedPath: string;
+    beforeSHA256: string;
+    desiredSHA256: string;
+    commandSHA256: string;
+    action: "unchanged" | "register";
+    planDigest: string;
+    guardVerified: true;
+    nativeAdoptionVerified: false;
+}
+interface Dependencies {
+    verify?: typeof verifyNativeSafetyCommand;
+}
+export declare function planNativeSafetyRegistration(options: NativeRegistrationOptions, dependencies?: Dependencies): Promise<NativeRegistrationPlan>;
+export declare function applyNativeSafetyRegistration(options: NativeRegistrationOptions & {
+    expectedPlanDigest: string;
+}, dependencies?: Dependencies): Promise<{
+    ok: boolean;
+    changed: boolean;
+    operationId: `${string}-${string}-${string}-${string}-${string}`;
+    planDigest: string;
+    settingsSHA256: string;
+    guardVerified: boolean;
+    nativeAdoptionVerified: boolean;
+} | {
+    schema: "hasna.hooks.native-safety-registration/v1";
+    target: "codex" | "claude";
+    settingsPath: string;
+    resolvedPath: string;
+    beforeSHA256: string;
+    desiredSHA256: string;
+    commandSHA256: string;
+    action: "unchanged" | "register";
+    planDigest: string;
+    guardVerified: true;
+    nativeAdoptionVerified: false;
+    ok: boolean;
+    changed: boolean;
+}>;
+export {};

package/dist/lib/native-safety.d.ts

@@ -12,5 +12,9 @@ export declare function isNativeSafetyName(name: string): name is NativeSafetyNa
 export declare function buildNativeSafetyCommand(binding: NativeSafetyBinding): string;
 export declare function nativeSafetyRegistration(command: string): NativeSafetyName | undefined;
 export declare function nativeSafetyCommandBinding(command: string): NativeSafetyBinding | undefined;
+/** Whether a saved supervisor command's pinned runtime and worker still verify
+ * on disk. `undefined` means the command is not a native-safety binding at all.
+ * Read-only: it never registers, rewrites or executes anything. */
+export declare function nativeSafetyBindingVerified(command: string): boolean | undefined;
 /** Built-in capability only: no registry, custom source, profile or app store. */
 export declare function installedNativeSafetyCommand(name: NativeSafetyName): string;

package/dist/native-safety.d.ts

@@ -43,6 +43,12 @@ export declare function readNativeSafetyRegistration(home?: string): {
     sha256: string;
     path: string;
 };
+/** Bounded, non-leaking explanation for a refused binding: which integrity
+ * property the saved record fails. A binding that a third party could rewrite
+ * can point the supervisor at a different worker, so its owner and mode are part
+ * of the trust decision, not decoration. Read-only — it never repairs, rewrites
+ * or executes anything, and returns undefined when the record looks intact. */
+export declare function nativeSafetyBindingIntegrityReason(home?: string): string | undefined;
 /** Register only the bundled composite guard. Updates preserve the exact prior
  * record and require its digest. A lock coordinates package-owned writers; an
  * unexpected preimage or a retained interrupted lock requires reconciliation. */

package/dist/native-safety.js

@@ -210,6 +210,23 @@ function readNativeSafetyRegistration(home = homedir2()) {
     throw new NativeSafetyError(error?.code === "ENOENT" ? "binding_missing" : "binding_invalid");
   }
 }
+function nativeSafetyBindingIntegrityReason(home = homedir2()) {
+  try {
+    const path = join2(canonicalHome(home), ".hasna/hooks/native", filename);
+    const stat = lstatSync2(path);
+    if (!stat.isFile())
+      return "the saved binding is not a regular file";
+    if (!owner(stat.uid))
+      return "the saved binding is not owned by the current user";
+    if (stat.mode & 63)
+      return `the saved binding is accessible by group or others (mode ${(stat.mode & 511).toString(8).padStart(3, "0")})`;
+    if (stat.size > 32768)
+      return "the saved binding exceeds its size bound";
+    return;
+  } catch (error) {
+    return error?.code === "ENOENT" ? "the saved binding is missing" : undefined;
+  }
+}
 function registerNativeSafety(options = {}) {
   const home = canonicalHome(options.home ?? homedir2());
   const record = { schema: "hasna.hooks.native-safety.v1", harness: "sumi", command: options.command ?? installedNativeSafetyCommand("trash-guard") };
@@ -395,6 +412,7 @@ export {
   verifyNativeSafetyCommand,
   registerNativeSafety,
   readNativeSafetyRegistration,
+  nativeSafetyBindingIntegrityReason,
   evaluateNativeSafetyForExecution,
   evaluateNativeSafety,
   NativeSafetyError

package/hooks/hook-workspace-repos-guard/README.md

@@ -45,6 +45,18 @@ a newline or `||` the `cd` may have failed, so the earlier directories stay
 in scope. A `cd` inside `( ... )`, a pipeline or the background does not move
 it, and neither does a `cd` whose target cannot be resolved statically.
 Descriptor duplication (`2>&1`, `>&2`, `1>&-`) is not a write.
+Each pipeline stage is classified on its own, with its output redirections
+split off: `ls <root> 2>/dev/null | head` reads `<root>`, and the trailing
+word of a later read-only stage (`| head -60`) is never taken as the write
+target of an earlier stage. Pipes inside quotes or command substitutions are
+not stage boundaries.
+A protected path named anywhere in a pipeline takes the strongest operation
+of any stage (`find <root>/x | xargs rm -rf` is a delete). Deletes and
+`mkdir`/`touch` check every operand; other writers check their last one.
+An operand or redirect target that cannot be read statically (a variable
+other than `$HOME`, `$( )`, backticks, a glob) fails closed to the directory
+the command runs in, so `rm -rf "$TMPDIR/x"` run from a protected checkout is
+refused. Use a literal absolute path for deletes outside the roots.
 
 ## Configuration
 

package/hooks/hook-workspace-repos-guard/src/hook.ts

@@ -32,6 +32,8 @@
  * redirection operands) are resolved against the directory the segment runs
  * in: the command's cwd, narrowed by a plain `cd` only across `&&` (see
  * bashTargets). Descriptor duplication (`2>&1`, `>&2`) is not a write.
+ * Each pipeline stage is classified on its own, with its redirections split
+ * off, so a later read-only stage never supplies an earlier stage's target.
  * apply_patch tools are inspected through their `*** Add File:` /
  * `*** Update File:` / `*** Delete File:` markers. Parenthesized command
  * groups are unwrapped.
@@ -215,6 +217,140 @@ function withoutFdDuplication(segment: string): string {
   return segment.replace(FD_DUPLICATION, " ");
 }
 
+/**
+ * Split one command segment into its pipeline stages at every unquoted `|`
+ * (and `|&`) that sits outside quotes, backticks, every parenthesis (`$( )`,
+ * `$(( ))`, `<( )`, `>( )`, `( )`) and every `${ }` expansion. The `|` of a
+ * `>|` clobber redirect is not a pipe, and `||` never reaches here because
+ * bashTargets splits on it first. When quoting, parentheses or braces do not
+ * balance, the segment is returned whole (fail closed to the whole-segment
+ * classification).
+ */
+export function pipelineStages(segment: string): string[] {
+  const stages: string[] = [];
+  let quote: "'" | '"' | null = null;
+  let parens = 0;
+  let braces = 0;
+  let backtick = false;
+  let start = 0;
+  for (let i = 0; i < segment.length; i++) {
+    const ch = segment[i];
+    if (quote === "'") {
+      if (ch === "'") quote = null;
+      continue;
+    }
+    if (ch === "\\") {
+      i++;
+      continue;
+    }
+    if (ch === "(") {
+      parens++;
+      continue;
+    }
+    if (ch === ")") {
+      if (--parens < 0) return [segment];
+      continue;
+    }
+    if (ch === "$" && segment[i + 1] === "{") {
+      braces++;
+      i++;
+      continue;
+    }
+    if (ch === "}" && braces > 0) {
+      braces--;
+      continue;
+    }
+    if (ch === "\x60") {
+      backtick = !backtick;
+      continue;
+    }
+    if (quote === '"') {
+      if (ch === '"') quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      continue;
+    }
+    if (ch !== "|" || parens > 0 || braces > 0 || backtick || segment[i - 1] === ">") continue;
+    stages.push(segment.slice(start, i));
+    if (segment[i + 1] === "&") i++;
+    start = i + 1;
+  }
+  if (quote || parens !== 0 || braces !== 0 || backtick) return [segment];
+  stages.push(segment.slice(start));
+  return stages;
+}
+
+interface ShellWord {
+  text: string;
+  opaque: boolean;
+}
+
+/**
+ * Split a command into shell words, honouring single and double quotes and
+ * backslash escapes, and removing the quotes. A word is opaque when its
+ * value cannot be read statically: it holds an expansion other than a
+ * leading `$HOME`/`${HOME}`, a command substitution, a backtick, a glob or
+ * an unbalanced quote.
+ */
+function shellWords(command: string): ShellWord[] {
+  const words: ShellWord[] = [];
+  let text = "";
+  let raw = "";
+  let quote: "'" | '"' | null = null;
+  let inWord = false;
+  const flush = () => {
+    if (!inWord) return;
+    const body = raw.replace(/^"?\$\{?HOME\}?"?(?=\/|$)/, "");
+    // Bash expands `~` only when the whole tilde prefix (up to the first
+    // unquoted `/`) is unquoted and unescaped. `~"/x"`, `~\/x` and `~""`
+    // name an entry called `~` in the current directory.
+    const literalTilde = text.startsWith("~") && !/^~(?:\/|$)/.test(raw);
+    words.push({ text: literalTilde ? `./${text}` : text, opaque: /[$\x60*?[]/.test(body) || /[()]/.test(body) });
+    text = "";
+    raw = "";
+    inWord = false;
+  };
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (quote === "'") {
+      if (ch === "'") quote = null;
+      else text += ch;
+      raw += ch;
+      continue;
+    }
+    if (ch === "\\" && i + 1 < command.length) {
+      const next = command[i + 1];
+      // Inside double quotes a backslash escapes only $ ` " \ and newline.
+      text += quote === '"' && !/[$\x60"\\\n]/.test(next) ? ch + next : next;
+      raw += ch + next;
+      inWord = true;
+      i++;
+      continue;
+    }
+    if (quote === '"') {
+      if (ch === '"') quote = null;
+      else text += ch;
+      raw += ch;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      flush();
+      continue;
+    }
+    inWord = true;
+    raw += ch;
+    if (ch === "'" || ch === '"') quote = ch;
+    else text += ch;
+  }
+  if (quote) {
+    raw += "$";
+  }
+  flush();
+  return words;
+}
+
 /**
  * Classify the operation of one command segment (a `&&`/`||`/`;`-delimited
  * unit). Git is handled by its subcommand: clean|rm delete, clone|init write,
@@ -364,7 +500,6 @@ export function bashTargets(command: string, home: string, cwd: string): PathTar
     for (let i = 0; i < opens; i++) subshells.push({ current: [...current], reachable: new Set(reachable), certain });
 
     const segment = unwrapSegment(rawSegment);
-    const op = segmentOperation(segment);
 
     const plainCd = segment.match(/^cd(?:\s+(?:-[A-Za-z@]+|--))*(?:\s+([^\s;&|<>()\x60]+))?$/);
     const embeddedCd = plainCd ? null : segment.match(/(?:^|\s)cd(?:\s+(?:-[A-Za-z]+|--))*\s+([^\s;&|<>()\x60]+)/);
@@ -380,27 +515,125 @@ export function bashTargets(command: string, home: string, cwd: string): PathTar
     const suffix = roots.map((root) => regexEscape(root.slice(home.length + 1))).join("|");
     const prefixRe = new RegExp(`(?:~|\\$HOME"*|\\$\\{HOME\\}"*|${homeLiteral}"*)/(?:${suffix})`);
     const re = new RegExp(`(${prefixRe.source})([^\\s"';&|<>()\x60]*|$)`, "g");
-    let m: RegExpExecArray | null;
-    let foundExplicit = false;
-    while ((m = re.exec(segment)) !== null) {
-      foundExplicit = true;
-      const expanded = expandHomeSpelling(m[0], home);
-      targets.push({ path: normalize(expanded).replace(/\/+$/, ""), op });
-    }
+    const explicitTargets = (text: string): string[] => {
+      const found: string[] = [];
+      let m: RegExpExecArray | null;
+      re.lastIndex = 0;
+      while ((m = re.exec(text)) !== null) found.push(normalize(expandHomeSpelling(m[0], home)).replace(/\/+$/, ""));
+      return found;
+    };
 
-    if (!foundExplicit && (op === "delete" || op === "write")) {
+    // Each pipeline stage is classified on its own, with its output
+    // redirections split off: a redirect operand is a write on that operand
+    // only, so `ls <root> 2>/dev/null | head` reads <root>. A stage's relative
+    // trailing operand counts only when that stage's own command writes or
+    // deletes, so the last word of a later read-only stage (`| head -60`) is
+    // never taken as the write target of an earlier stage.
+    const stages = pipelineStages(segment).map((stage) => {
       const operands: string[] = [];
-      const commandPart = withoutFdDuplication(segment).replace(OUTPUT_REDIRECT, (_match, operand: string) => {
+      // A redirect whose target cannot be read statically (empty, or built
+      // from `$...`/`$( )`/backticks) may write anywhere, including a
+      // protected path the stage names: the stage then counts as a write.
+      let opaqueRedirect = false;
+      const commandPart = withoutFdDuplication(stage).replace(OUTPUT_REDIRECT, (_match, operand: string) => {
+        if (!operand || /[$\x60]/.test(operand)) opaqueRedirect = true;
         if (operand) operands.push(operand);
         return " ";
       });
       const commandOp = segmentOperation(commandPart);
-      const relMatch = commandOp === "read" ? null : commandPart.match(REL_OPERAND);
-      for (const base of current.filter(underRoot)) {
-        for (const operand of operands) {
+      return { commandPart, operands, op: opaqueRedirect && commandOp === "read" ? ("write" as Operation) : commandOp };
+    });
+
+    // A protected path named in one stage can be acted on by another
+    // (`find <root>/x | xargs rm -rf`, `printf <root>/x | xargs mkdir`), so
+    // every explicit path outside a redirect operand takes the strongest
+    // operation of any stage's command. Only redirects are attributed to
+    // their own operand.
+    const pipelineOp: Operation = stages.some((stage) => stage.op === "delete")
+      ? "delete"
+      : stages.some((stage) => stage.op === "write")
+        ? "write"
+        : "read";
+    const bases = current.filter(underRoot);
+    for (const stage of stages) {
+      let foundExplicit = false;
+      for (const path of explicitTargets(stage.commandPart)) {
+        foundExplicit = true;
+        targets.push({ path, op: pipelineOp });
+      }
+      // Every redirect operand is a write: an explicit protected path as
+      // named, and any other operand resolved against each protected
+      // directory the stage can run in, whether or not the stage also names
+      // a protected path.
+      for (const operand of stage.operands) {
+        const explicit = explicitTargets(operand);
+        for (const path of explicit) targets.push({ path, op: "write" });
+        if (explicit.length > 0) continue;
+        for (const base of bases) {
           targets.push({ path: normalize(resolve(base, expandHomeSpelling(operand, home))), op: "write" });
         }
-        if (relMatch) targets.push({ path: normalize(resolve(base, relMatch[1])), op: commandOp });
+      }
+      if (foundExplicit || stage.op === "read") continue;
+      // A writing or deleting stage that names no protected path acts on its
+      // trailing operand, resolved against each protected directory it can
+      // run in. When no operand can be read statically (quoted, `$( )`), it
+      // fails closed to that directory itself.
+      // Deletes, mkdir/touch, tee, truncate, install, mv and sed -i act on
+      // every operand, so each operand word counts; other writers (cp, ln,
+      // ...) act on their last one. A word that cannot be read statically
+      // fails closed to the directory.
+      const words = shellWords(stage.commandPart);
+      // Operands after the command word. Options end at `--` or, as BSD
+      // getopt does, at the first operand: every later word is an operand
+      // even when it starts with `-`.
+      let endOfOptions = false;
+      const nonFlag = words.slice(1).flatMap((word) => {
+        if (!endOfOptions && word.text === "--") {
+          endOfOptions = true;
+          return [];
+        }
+        if (!endOfOptions && word.text.startsWith("-")) return [];
+        endOfOptions = true;
+        return [word.opaque ? "." : word.text];
+      });
+      // mv changes its sources too, so every mv operand counts as a write.
+      const everyOperand =
+        stage.op === "delete" ||
+        /(?:^|\s)(?:mkdir|mkfile|touch|tee|truncate|install|mv)(?:\s|$)/.test(stage.commandPart) ||
+        (/(?:^|\s)sed(?:\s|$)/.test(stage.commandPart) && /(?:^|\s)(?:-i\S*|--in-place\S*)(?:\s|$)/.test(stage.commandPart));
+      const operandTargets: Array<{ operand: string; op: Operation }> = [];
+      if (everyOperand) {
+        for (const operand of nonFlag.length > 0 ? nonFlag : ["."]) operandTargets.push({ operand, op: stage.op });
+      } else {
+        const relMatch = stage.commandPart.match(REL_OPERAND);
+        const last = words.at(-1);
+        operandTargets.push({ operand: relMatch ? relMatch[1] : !last || last.opaque ? "." : last.text, op: stage.op });
+        // cp/ln/install/mv -t DIR write into DIR: `-t DIR`, `-tDIR`, `-t` in
+        // a short-flag cluster (`-rt DIR`, `-rtDIR`) and any abbreviation of
+        // `--target-directory[=]DIR` (GNU).
+        if (/(?:^|\s)(?:cp|ln|install|mv)(?:\s|$)/.test(stage.commandPart)) {
+          words.forEach((word, index) => {
+            let value: ShellWord | undefined;
+            const short = word.text.match(/^-[A-Za-z]*?t(.*)$/);
+            const long = word.text.match(/^(--t[a-z-]*)(?:=(.*))?$/);
+            if (short && !word.text.startsWith("--")) {
+              value = short[1] ? { text: short[1], opaque: word.opaque } : words[index + 1];
+            } else if (long && "--target-directory".startsWith(long[1])) {
+              value = long[2] !== undefined ? { text: long[2], opaque: word.opaque } : words[index + 1];
+            }
+            if (value) operandTargets.push({ operand: value.opaque || !value.text ? "." : value.text, op: stage.op });
+          });
+        }
+        // An inline script (python3 -c, node -e, bun -e) can write anywhere
+        // relative to where it runs, whatever its arguments.
+        if (/(?:^|\s)(?:python3?|node|bun)\b[^;&|]*\s+-[ce](?:\s|$)/.test(stage.commandPart)) {
+          operandTargets.push({ operand: ".", op: stage.op });
+        }
+      }
+      for (const base of bases) {
+        for (const { operand, op } of operandTargets) {
+          targets.push({ path: normalize(resolve(base, expandHomeSpelling(operand, home))), op });
+        }
       }
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/hooks",
-  "version": "0.10.6",
+  "version": "0.10.8",
   "description": "Open source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command",
   "type": "module",
   "bin": {
@@ -64,7 +64,7 @@
     "@hasna/contracts": "~1.2.1"
   },
   "dependencies": {
-    "@hasna/skills": "0.9.14",
+    "@hasna/skills": "0.9.17",
     "@hasna/events": "^0.1.16",
     "@hasna/secrets": "0.4.2",
     "@modelcontextprotocol/sdk": "^1.26.0",