@hasna/hooks 0.10.6 → 0.10.8

package/scripts/ensure-profiles-dir.mjs

@@ -5,7 +5,13 @@
 // resolver data root once adopted (HASNA_DATA_HOME set or hooks.db already
 // present there), then the legacy ~/.hasna/hooks default. Best-effort — the
 // package must never fail to install because this script cannot run.
+//
+// It also provisions the required Sumi native-safety binding for the installing
+// user (see the second block below). Same best-effort contract.
 import { existsSync, mkdirSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { dirname } from "node:path";
 // --- Local path resolver -------------------------------------------------
 // @hasna/paths was deleted (hasna/apps#1535, 2026-09-03); this in-package
 // implementation preserves the resolver contract (XDG / macOS home layout
@@ -58,7 +64,7 @@ function dataDir(options) {
   return pathsResolverResolve("data", options);
 }
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { join, resolve, sep } from "node:path";
 
 const HOME = process.env.HOME || process.env.USERPROFILE || homedir();
 
@@ -97,3 +103,61 @@ try {
 } catch {
   // ignore
 }
+
+/**
+ * The bun runtime that must execute the provisioning entry: the package's own
+ * bin targets are bun bundles (`#!/usr/bin/env bun`) and `installedNativeSafetyCommand`
+ * pins `process.execPath`, so the runtime that runs this decides the binding.
+ * Well-known install locations first, then PATH; null when neither exists.
+ */
+function resolveBun() {
+  const wellKnown = [
+    process.env.BUN_INSTALL ? join(process.env.BUN_INSTALL, "bin", "bun") : null,
+    join(HOME, ".bun", "bin", "bun"),
+  ];
+  for (const candidate of wellKnown) {
+    if (candidate && existsSync(candidate)) return candidate;
+  }
+  return spawnSync("bun", ["--version"], { encoding: "utf8" }).status === 0 ? "bun" : null;
+}
+
+// ---------------------------------------------------------------------------
+// Required Sumi native-safety binding (hasna/apps incidents 798053).
+//
+// Sumi refuses EVERY shell command while
+// `~/.hasna/hooks/native/sumi-trash-guard.json` is absent, and neither a package
+// install nor an upgrade used to create it: a rollout could install this package
+// and still leave every Sumi seat on the station without a shell.
+//
+// The packaged CLI owns the policy (`hooks safety provision`, also applied by
+// `hooks install` and `hooks upgrade`): idempotent, a healthy existing binding is
+// left intact, a stale one is replaced with its predecessor preserved beside it,
+// and an unrecognized one is refused rather than overwritten. This lifecycle
+// surface only reaches installs whose scripts actually run — bun blocks
+// lifecycle scripts for untrusted dependencies and `--ignore-scripts` skips
+// them, which is why the CLI surfaces apply the same policy.
+//
+// Two gates keep a source checkout from touching the operator's home: the
+// package must be an INSTALLED copy (inside a node_modules directory) and its
+// built CLI must exist. Best-effort — install never fails on a native guard.
+try {
+  const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+  const cli = join(packageRoot, "bin", "index.js");
+  if (packageRoot.includes(`${sep}node_modules${sep}`) && existsSync(cli)) {
+    const bun = resolveBun();
+    if (!bun) {
+      process.stderr.write("[@hasna/hooks] Sumi native-safety binding not provisioned: no bun runtime found; run `hooks safety provision`.\n");
+    } else {
+      const provisioned = spawnSync(bun, [cli, "safety", "provision", "--target", "sumi"], {
+        encoding: "utf8", timeout: 60_000, env: { ...process.env, HOME },
+      });
+      let result = null;
+      try { result = JSON.parse(provisioned.stdout?.trim() ?? ""); } catch { /* reported below */ }
+      if (!result?.ok) {
+        process.stderr.write(`[@hasna/hooks] Sumi native-safety binding not provisioned (${result?.code ?? "provision_failed"}); run \`hooks safety provision\` on this station before a Sumi seat needs its shell.\n`);
+      }
+    }
+  }
+} catch {
+  // ignore
+}