@hasna/hooks 0.10.7 → 0.10.8

package/bin/index.js

@@ -1079,6 +1079,19 @@ function pinEligibleFile(file, maximum, executable = false) {
     closeSync(fd);
   }
 }
+function pinVerified(file, expected, maximum, executable = false) {
+  try {
+    return pinEligibleFile(file, maximum, executable) === expected;
+  } catch {
+    return false;
+  }
+}
+function nativeSafetyBindingVerified(command) {
+  const binding = nativeSafetyCommandBinding(command);
+  if (!binding)
+    return;
+  return pinVerified(binding.runtime, binding.runtimeSHA256, 200000000, true) && pinVerified(binding.worker, binding.workerSHA256, 256000);
+}
 function installedNativeSafetyCommand(name) {
   const home = realpathSync2(homedir2());
   const runtime = realpathSync2(process.execPath);
@@ -2068,7 +2081,7 @@ var init_codex_settings = __esm(() => {
   snapshots = new WeakMap;
 });
 
-// ../../node_modules/.bun/@hasna+skills@0.9.14+a00d3064559565bb/node_modules/@hasna/skills/dist/index.js
+// ../../node_modules/.bun/@hasna+skills@0.9.17+a00d3064559565bb/node_modules/@hasna/skills/dist/index.js
 import { existsSync as existsSync9 } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join8, resolve as resolve3 } from "path";
@@ -2081,6 +2094,7 @@ import { basename as basename2, isAbsolute as isAbsolute22, resolve as resolve22
 import { createHash as createHash16 } from "crypto";
 import { lstatSync as lstatSync20, readFileSync as readFileSync16, readdirSync as readdirSync9, realpathSync as realpathSync4 } from "fs";
 import { basename as basename8, dirname as dirname16, isAbsolute as isAbsolute14, join as join26, resolve as resolve14, sep as sep5 } from "path";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 import { dirname as dirname32, isAbsolute as isAbsolute3, join as join72, resolve as resolve32 } from "path";
 import { lstatSync as lstatSync3, readFileSync as readFileSync6, opendirSync } from "fs";
 import { createHash as createHash22 } from "crypto";
@@ -2579,8 +2593,8 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-marketplace-registry-v2"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
-      if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2")
+        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute22(source.path) && resolve22(source.path) === source.path && basename2(source.path) === "settings.json");
       if (source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute22(source.path) && resolve22(source.path) === source.path && basename2(source.path) === "known_marketplaces.json");
@@ -3494,7 +3508,7 @@ function assertClaudeHookEventsReplacement(before, replacement, events) {
   }
   need2(JSON.stringify(withoutOwnedEvents(original)) === JSON.stringify(withoutOwnedEvents(next)), `${label} update changed settings outside hooks.${label}`);
 }
-function inferencePreference(key, child) {
+function inferencePreference(key, child, version) {
   if (key === "skipDangerousModePermissionPrompt") {
     need2(child.kind === "literal" && (child.value === "true" || child.value === "false"), "contains an invalid dialog acknowledgment");
     return false;
@@ -3507,7 +3521,7 @@ function inferencePreference(key, child) {
     return false;
   need2(child.kind === "object", "requires an object of model preferences");
   child.entries = child.entries.filter(([model, preferences]) => {
-    if (!BUILTIN_MODEL_SELECTIONS.has(model) || preferences.kind !== "object" || preferences.entries.length !== 1 || preferences.entries[0][0] !== "effortLevel")
+    if (version === 2 && !BUILTIN_MODEL_SELECTIONS.has(model) || preferences.kind !== "object" || preferences.entries.length !== 1 || preferences.entries[0][0] !== "effortLevel")
       return true;
     const effort = preferences.entries[0][1];
     need2(effort.kind === "string" && PERSISTED_EFFORT_LEVELS.has(effort.value), "contains an invalid persisted model effort level");
@@ -3518,7 +3532,7 @@ function inferencePreference(key, child) {
 function settingsDigest(text2, version = 1) {
   const value = parse3(text2);
   value.entries = value.entries.filter(([key, child]) => {
-    if (version === 2 && inferencePreference(key, child))
+    if (version !== 1 && inferencePreference(key, child, version))
       return false;
     if (key === "model") {
       need2(child.kind === "string", "contains an invalid model selection");
@@ -3556,6 +3570,16 @@ function hashClaudeSettingsReplacementV2(text2, budget) {
   budget.remaining -= bytes;
   return settingsDigest(text2, 2);
 }
+function captureClaudeSettingsV3(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "claude-settings-v3", sha256: settingsDigest(readSettings(path, budget), 3) };
+}
+function hashClaudeSettingsReplacementV3(text2, budget) {
+  need2(typeof text2 === "string", "requires settings text");
+  const bytes = Buffer.byteLength(text2);
+  need2(bytes <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes && Number.isSafeInteger(budget.remaining) && budget.remaining >= bytes, "exceeds its byte limit");
+  budget.remaining -= bytes;
+  return settingsDigest(text2, 3);
+}
 function assertSafePath(path) {
   let cursor = resolve9(path);
   while (true) {
@@ -4007,6 +4031,8 @@ function applyAgentIntegration(plan) {
       parseManagedSkillPolicy(change.after);
   const aliases = plan.rootAliases ?? [];
   recheckRootAliases(aliases);
+  for (const agent of plan.retainedReviewChecks?.agents ?? [])
+    assertManagedAgentBridge(agent, { ...plan.retainedReviewChecks, dataDir: plan.dataDir });
   for (const agent of plan.managedAgentChecks?.agents ?? [])
     assertManagedAgentBridge(agent, { home: plan.managedAgentChecks.home, dataDir: plan.dataDir, projectDir: plan.managedAgentChecks.home });
   for (const binding of plan.discoveryBefore ?? []) {
@@ -5009,10 +5035,11 @@ function unchanged2(before) {
   need4(sameStat(before.stat, after.stat) && after.sha256 === before.sha256, "INPUT_CHANGED");
 }
 function assertCodexHookDiscoveryRecovery(binding, witness) {
-  const proof = proofs.get(witness);
+  const proof = proofs2.get(witness);
   need4(!!proof && binding.agent === "codex" && witness.discoverySha256 === sha2(JSON.stringify(binding)), "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
   unchanged2(proof.before);
   unchanged2(proof.current);
+  proof.recheckAdditions();
 }
 function verifiesCodexHookDiscoverySource(binding, source, currentDigest, witness) {
   if (!witness || source.path !== witness.configPath || source.hashMode !== "bytes")
@@ -5053,13 +5080,13 @@ function read2(path, changes) {
   return readFileSync16(path, "utf8");
 }
 function projected(source, changes, budget = discoveryByteBudget()) {
-  if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2") {
+  if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Claude settings witnesses require exact typed metadata");
-    const current2 = (source.hashMode === "claude-settings-v2" ? captureClaudeSettingsV2 : captureClaudeSettings)(source.path, budget).sha256;
+    const current2 = (source.hashMode === "claude-settings-v3" ? captureClaudeSettingsV3 : source.hashMode === "claude-settings-v2" ? captureClaudeSettingsV2 : captureClaudeSettings)(source.path, budget).sha256;
     if (current2 !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
-    return changes?.has(source.path) ? (source.hashMode === "claude-settings-v2" ? hashClaudeSettingsReplacementV2 : hashClaudeSettingsReplacement)(changes.get(source.path), budget) : current2;
+    return changes?.has(source.path) ? (source.hashMode === "claude-settings-v3" ? hashClaudeSettingsReplacementV3 : source.hashMode === "claude-settings-v2" ? hashClaudeSettingsReplacementV2 : hashClaudeSettingsReplacement)(changes.get(source.path), budget) : current2;
   }
   if (source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256) || changes?.has(source.path))
@@ -5121,7 +5148,7 @@ function verifyAgentDiscovery(binding, codexRecovery) {
     safe4(root2);
 }
 function assertMarketplaceBinding(binding, source) {
-  if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename8(source.path) !== "settings.json"))
+  if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename8(source.path) !== "settings.json"))
     throw new Error("Claude settings witnesses require explicit reviewed Claude configuration");
   if ((source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2") && (binding.agent !== "claude" || binding.method !== "reviewed"))
     throw new Error("Claude marketplace witnesses require explicit reviewed Claude discovery");
@@ -5130,7 +5157,10 @@ function rebindAgentDiscovery(binding, changes) {
   const budget = discoveryByteBudget();
   return { ...binding, sources: binding.sources.map((source) => {
     assertMarketplaceBinding(binding, source);
-    return { ...source, sha256: projected(source, changes, budget) };
+    const sha2562 = projected(source, changes, budget);
+    if (!changes.has(source.path) && sha2562 !== source.sha256)
+      throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
+    return { ...source, sha256: sha2562 };
   }) };
 }
 function assertProjectDiscovery(agent, directories, home, canonical4 = resolve14, reviewed) {
@@ -5242,6 +5272,19 @@ function resolveAgentDiscovery(options) {
       }
     }
   }
+  if (options.reviewed === undefined && options.retainedReview !== undefined) {
+    const retained = options.retainedReview;
+    if (retained.agent !== agent || retained.method !== "reviewed")
+      unresolved("invalid retained review");
+    verifyAgentDiscovery(retained);
+    if (!retained.sources.some((source) => source.path === canonical4(configPath) && source.format === undefined && source.fields === undefined))
+      unresolved("retained review is missing the full agent configuration source");
+    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && source.path !== canonical4(configPath)))
+      unresolved("retained settings witness names another configuration source");
+    if (sources.some((source) => !retained.sources.some((saved) => isDeepStrictEqual3(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
+      unresolved("retained review is missing current runtime discovery coverage");
+    return retained;
+  }
   if (options.reviewed && (options.reviewed.version !== 1 || !Array.isArray(options.reviewed.agents) || options.reviewed.agents.some((item) => !item || typeof item !== "object") || new Set(options.reviewed.agents.map((item) => item.agent)).size !== options.reviewed.agents.length))
     throw new Error("Invalid --discovery-inputs version or agents");
   const review = options.reviewed?.agents.find((item) => item.agent === agent);
@@ -5252,7 +5295,7 @@ function resolveAgentDiscovery(options) {
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
-    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2") && source.path !== canonical4(configPath)))
+    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && source.path !== canonical4(configPath)))
       throw new Error("Semantic settings witnesses must name the configured Claude configuration source");
     if (!review.sources.some((source) => source.path === canonical4(configPath)))
       throw new Error("Discovery review must include the agent configuration source");
@@ -12042,7 +12085,7 @@ Use the Skills CLI as the skill authority for this station.
 - Run a skill only when the user's task calls for execution. Use \`skills run --help\` and select the intended local or cloud target explicitly.
 
 This bridge contains no skill payloads. Do not copy skill content into agent-native skill directories or load other native skill copies. If a Skills command refuses authority, selection, integrity, or native drift, report that refusal and use its repair guidance; do not substitute bundled or stale local content. Explicit local draft authoring remains available.
-`, CLI_BRIDGE_DIGEST, CLI_BRIDGE_FILES, CLAUDE_SETTINGS_WITNESS_LIMITS, sameFile = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode && a.uid === b.uid && a.gid === b.gid && a.nlink === b.nlink && a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs, BOOLEAN_PREFERENCES, ENUM_PREFERENCES, BUILTIN_MODEL_SELECTIONS, CLAUDE_COORDINATED_HOOK_EVENTS, PERSISTED_EFFORT_LEVELS, sha = (data) => createHash10("sha256").update(data).digest("hex"), ROOTS, PLUGIN_PROJECTION_LIMITS, pluginHash = (bytes) => createHash11("sha256").update(bytes).digest("hex"), READ_FLAGS, WRITE_FLAGS, uid = () => typeof process.getuid === "function" ? BigInt(process.getuid()) : undefined, missing = (error) => Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT"), quote2 = (value) => `'${value.replaceAll("'", "'\\''")}'`, resolverGuard = 'exec 9<"$1"; actual=$(/usr/bin/sha256sum /proc/self/fd/9); actual=${actual%% *}; [ "sha256:$actual" = "$2" ]; exec /proc/self/fd/9 integration plugin resolve --binding "$3"', CLAUDE_MARKETPLACE_REGISTRY_LIMITS, sameFile2 = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode && a.uid === b.uid && a.gid === b.gid && a.nlink === b.nlink && a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs, field = (object4, key) => object4.entries.find(([name]) => name === key)?.[1], sameStat = (a, b) => ["dev", "ino", "uid", "nlink", "mode", "size", "mtimeNs", "ctimeNs"].every((key) => a[key] === b[key]), sha2 = (text2) => createHash15("sha256").update(text2).digest("hex"), proofs, digest = (text2) => createHash16("sha256").update(text2).digest("hex"), NATIVE_DISCOVERY_ROOTS, OFFICIAL_SKILL_NAMES, exports_external, exports_core2, exports_util, EVALUATING, captureStackTrace, allowsEval, getParsedType = (data) => {
+`, CLI_BRIDGE_DIGEST, CLI_BRIDGE_FILES, CLAUDE_SETTINGS_WITNESS_LIMITS, sameFile = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode && a.uid === b.uid && a.gid === b.gid && a.nlink === b.nlink && a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs, BOOLEAN_PREFERENCES, ENUM_PREFERENCES, BUILTIN_MODEL_SELECTIONS, CLAUDE_COORDINATED_HOOK_EVENTS, PERSISTED_EFFORT_LEVELS, sha = (data) => createHash10("sha256").update(data).digest("hex"), ROOTS, PLUGIN_PROJECTION_LIMITS, pluginHash = (bytes) => createHash11("sha256").update(bytes).digest("hex"), READ_FLAGS, WRITE_FLAGS, uid = () => typeof process.getuid === "function" ? BigInt(process.getuid()) : undefined, missing = (error) => Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT"), quote2 = (value) => `'${value.replaceAll("'", "'\\''")}'`, resolverGuard = 'exec 9<"$1"; actual=$(/usr/bin/sha256sum /proc/self/fd/9); actual=${actual%% *}; [ "sha256:$actual" = "$2" ]; exec /proc/self/fd/9 integration plugin resolve --binding "$3"', CLAUDE_MARKETPLACE_REGISTRY_LIMITS, sameFile2 = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode && a.uid === b.uid && a.gid === b.gid && a.nlink === b.nlink && a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs, field = (object4, key) => object4.entries.find(([name]) => name === key)?.[1], sameStat = (a, b) => ["dev", "ino", "uid", "nlink", "mode", "size", "mtimeNs", "ctimeNs"].every((key) => a[key] === b[key]), events, matchedEvents, proofs, sha2 = (text2) => createHash15("sha256").update(text2).digest("hex"), proofs2, digest = (text2) => createHash16("sha256").update(text2).digest("hex"), NATIVE_DISCOVERY_ROOTS, OFFICIAL_SKILL_NAMES, exports_external, exports_core2, exports_util, EVALUATING, captureStackTrace, allowsEval, getParsedType = (data) => {
   const t2 = typeof data;
   switch (t2) {
     case "undefined":
@@ -26445,7 +26488,7 @@ ${end.comment}` : end.comment;
   $visitAsync = visit.visitAsync;
   package_default = {
     name: "@hasna/skills",
-    version: "0.9.14",
+    version: "0.9.17",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -26817,7 +26860,10 @@ ${end.comment}` : end.comment;
   READ_FLAGS = constants8.O_RDONLY | constants8.O_NOFOLLOW | constants8.O_NONBLOCK;
   WRITE_FLAGS = constants8.O_WRONLY | constants8.O_CREAT | constants8.O_EXCL | constants8.O_NOFOLLOW | constants8.O_NONBLOCK;
   CLAUDE_MARKETPLACE_REGISTRY_LIMITS = Object.freeze({ bytes: 1024 * 1024, rows: 1024, depth: 32, nodes: 65536, stringCharacters: 16384, pathCharacters: 4096 });
+  events = { UserPromptSubmit: ["userPromptSubmit", "user_prompt_submit"], SessionStart: ["sessionStart", "session_start"], SubagentStart: ["subagentStart", "subagent_start"] };
+  matchedEvents = { ...events, PreToolUse: ["preToolUse", "pre_tool_use"] };
   proofs = new WeakMap;
+  proofs2 = new WeakMap;
   NATIVE_DISCOVERY_ROOTS = NATIVE_SKILL_ROOTS.map(([, path]) => path.split("/"));
   OFFICIAL_SKILL_NAMES = new Set(SKILLS.map((skill) => skill.name));
   exports_external = {};
@@ -32999,8 +33045,8 @@ CREATE TABLE IF NOT EXISTS skills_sync_cursors (
 import { createHash as createHash5 } from "crypto";
 function coordinateClaudeSettings(before, replacement, options) {
   const prior = JSON.parse(before ?? "{}"), next = JSON.parse(replacement);
-  const events = new Set([...Object.keys(prior.hooks ?? {}), ...Object.keys(next.hooks ?? {})]);
-  const changed = [...events].filter((event) => JSON.stringify(prior.hooks?.[event]) !== JSON.stringify(next.hooks?.[event]));
+  const events2 = new Set([...Object.keys(prior.hooks ?? {}), ...Object.keys(next.hooks ?? {})]);
+  const changed = [...events2].filter((event) => JSON.stringify(prior.hooks?.[event]) !== JSON.stringify(next.hooks?.[event]));
   const selected = changed.length ? changed : ["PreToolUse"];
   const plan = planClaudeHookEventsUpdate({
     ...options,
@@ -33270,7 +33316,7 @@ function detectConflict(name, scope, target) {
   const meta3 = isNativeSafetyName(name) ? getHook(name) : resolveHookMeta(name);
   if (!meta3 || !meta3.matcher)
     return;
-  const events = new Set(getHookEvents(meta3));
+  const events2 = new Set(getHookEvents(meta3));
   const registered = getRegisteredHooksForTarget(scope, target);
   for (const existingName of registered) {
     if (existingName === name)
@@ -33278,7 +33324,7 @@ function detectConflict(name, scope, target) {
     const existing = getHook(existingName);
     if (!existing || !existing.matcher)
       continue;
-    if (!getHookEvents(existing).some((event) => events.has(event)))
+    if (!getHookEvents(existing).some((event) => events2.has(event)))
       continue;
     if (matchersOverlap(meta3.matcher.toLowerCase(), existing.matcher.toLowerCase())) {
       return `conflicts with '${existingName}' (same event ${meta3.event}, overlapping matcher '${existing.matcher}')`;
@@ -37436,10 +37482,10 @@ var init_redact = __esm(() => {
 
 // src/lib/profiles.ts
 import { existsSync as existsSync13, mkdirSync as mkdirSync13, readFileSync as readFileSync20, writeFileSync as writeFileSync12, readdirSync as readdirSync8, rmSync, cpSync as cpSync2 } from "fs";
-import { join as join27 } from "path";
+import { join as join29 } from "path";
 function getProfilesDir() {
-  const newDir = join27(getEffectiveDataRoot(), "profiles");
-  const oldDir = join27(getHomeDir(), ".hooks", "profiles");
+  const newDir = join29(getEffectiveDataRoot(), "profiles");
+  const oldDir = join29(getHomeDir(), ".hooks", "profiles");
   if (!existsSync13(newDir) && existsSync13(oldDir)) {
     mkdirSync13(newDir, { recursive: true });
     cpSync2(oldDir, newDir, { recursive: true });
@@ -37453,7 +37499,7 @@ function ensureProfilesDir() {
   }
 }
 function profilePath(id) {
-  return join27(getProfilesDir(), `${id}.json`);
+  return join29(getProfilesDir(), `${id}.json`);
 }
 function shortUuid() {
   return crypto.randomUUID().slice(0, 8);
@@ -37495,7 +37541,7 @@ function listProfiles() {
     const profiles = [];
     for (const file2 of files) {
       try {
-        const content = readFileSync20(join27(dir, file2), "utf-8");
+        const content = readFileSync20(join29(dir, file2), "utf-8");
         profiles.push(JSON.parse(content));
       } catch {}
     }
@@ -37550,7 +37596,7 @@ import { createRequire as createRequire3 } from "module";
 import { fileURLToPath as fileURLToPath22 } from "url";
 import { closeSync as closeSync18, fstatSync as fstatSync17, lstatSync as lstatSync24, openSync as openSync18, readFileSync as readFileSync21, realpathSync as realpathSync13, statSync as statSync2 } from "fs";
 import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
-import { basename as basename9, dirname as dirname23, join as join29, relative as relative3, sep as sep3 } from "path";
+import { basename as basename9, dirname as dirname23, join as join30, relative as relative3, sep as sep6 } from "path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL } from "url";
 function envToken2(name) {
   return name.toUpperCase().replace(/-/g, "_");
@@ -37625,7 +37671,7 @@ function o(e2, r2, t2) {
 }
 function entryPoint(directory2) {
   const root = realpathSync13(directory2);
-  const fd = openSync18(join29(root, "package.json"), O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+  const fd = openSync18(join30(root, "package.json"), O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
   let pkg;
   try {
     const stat2 = fstatSync17(fd);
@@ -37645,9 +37691,9 @@ function entryPoint(directory2) {
   if (/[\\%?#\0]/.test(target) || parts.some((part) => !part || part === "." || part === ".." || part === "node_modules")) {
     throw new Error("Invalid Secrets import export");
   }
-  const file2 = realpathSync13(join29(root, ...parts));
+  const file2 = realpathSync13(join30(root, ...parts));
   const within = relative3(root, file2);
-  if (!within || within === ".." || within.startsWith(`..${sep3}`) || !statSync2(file2).isFile()) {
+  if (!within || within === ".." || within.startsWith(`..${sep6}`) || !statSync2(file2).isFile()) {
     throw new Error("Secrets import export escapes its package or is not a file");
   }
   return pathToFileURL(file2).href;
@@ -37656,7 +37702,7 @@ function resolveInstalledSecrets(parentUrl) {
   let directory2 = dirname23(fileURLToPath3(parentUrl));
   for (;; ) {
     if (basename9(directory2) !== "node_modules") {
-      const candidate = join29(directory2, "node_modules", PACKAGE);
+      const candidate = join30(directory2, "node_modules", PACKAGE);
       let absent = false;
       try {
         lstatSync24(candidate);
@@ -38963,7 +39009,7 @@ __export(exports_run, {
 });
 import { randomBytes as randomBytes2 } from "crypto";
 import { rmSync as rmSync2, writeFileSync as writeFileSync13 } from "fs";
-import { basename as basename11, dirname as dirname25, isAbsolute as isAbsolute25, join as join30 } from "path";
+import { basename as basename11, dirname as dirname25, isAbsolute as isAbsolute25, join as join31 } from "path";
 function extensionOf(scriptPath) {
   const base = basename11(scriptPath);
   const dot = base.lastIndexOf(".");
@@ -39034,7 +39080,7 @@ async function readPipeWithDeadline(stream, deadlineMs) {
 async function executeVerifiedScript(options) {
   const scriptDir = dirname25(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
-  const tempPath = join30(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
+  const tempPath = join31(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
   let timedOut = false;
   const timeoutTimer = options.timeout ? setTimeout(() => {
@@ -39126,10 +39172,10 @@ __export(exports_custom_install, {
   ensureCustomDir: () => ensureCustomDir
 });
 import { existsSync as existsSync15, mkdirSync as mkdirSync14, mkdtempSync, readFileSync as readFileSync23, rmSync as rmSync4 } from "fs";
-import { join as join31 } from "path";
+import { join as join32 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 function manifestAt(dir) {
-  const path = join31(dir, "manifest.json");
+  const path = join32(dir, "manifest.json");
   if (!existsSync15(path))
     return;
   try {
@@ -39152,8 +39198,8 @@ function writeFromManifest(manifest, srcDir, source, kind) {
   return { name, version: manifest.version, kind, source, dir, scriptPath };
 }
 async function cloneToTemp(gitUrl) {
-  const tmp = mkdtempSync(join31(tmpdir2(), "hooks-install-"));
-  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join31(tmp, "repo")], {
+  const tmp = mkdtempSync(join32(tmpdir2(), "hooks-install-"));
+  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join32(tmp, "repo")], {
     stdout: "pipe",
     stderr: "pipe"
   });
@@ -39166,7 +39212,7 @@ async function cloneToTemp(gitUrl) {
     rmSync4(tmp, { recursive: true, force: true });
     throw new Error(`git clone failed (${exitCode}): ${stderr.trim()}`);
   }
-  return join31(tmp, "repo");
+  return join32(tmp, "repo");
 }
 function isGitUrl(value) {
   return value.startsWith("git@") || value.startsWith("ssh://") || value.startsWith("file://") || value.endsWith(".git");
@@ -40405,11 +40451,11 @@ __export(exports_serve, {
   DEFAULT_SERVE_PORT: () => DEFAULT_SERVE_PORT
 });
 import { readFileSync as readFileSync26 } from "fs";
-import { dirname as dirname26, join as join32 } from "path";
+import { dirname as dirname26, join as join33 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function packageVersion() {
   try {
-    const pkgPath = join32(dirname26(fileURLToPath4(import.meta.url)), "..", "package.json");
+    const pkgPath = join33(dirname26(fileURLToPath4(import.meta.url)), "..", "package.json");
     return JSON.parse(readFileSync26(pkgPath, "utf-8")).version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -40711,7 +40757,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z as z3 } from "zod";
 import { createServer } from "http";
 import { existsSync as existsSync16, readFileSync as readFileSync27 } from "fs";
-import { join as join33, dirname as dirname27 } from "path";
+import { join as join34, dirname as dirname27 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 async function runVerifiedHook(name, stdin, timeoutMs) {
   const { resolveHook: resolveHook2, resolveScriptPath: resolveScriptPath2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
@@ -40945,7 +40991,7 @@ function createHooksServer() {
           continue;
         }
         const hookDir = getHookPath(name);
-        if (!existsSync16(join33(hookDir, "src", "hook.ts"))) {
+        if (!existsSync16(join34(hookDir, "src", "hook.ts"))) {
           issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
           hookHealthy = false;
         }
@@ -40989,7 +41035,7 @@ function createHooksServer() {
         return { content: [{ type: "text", text: JSON.stringify({ error: `Hook '${name}' not found` }) }] };
       }
       const hookPath = getHookPath(name);
-      const readmePath = join33(hookPath, "README.md");
+      const readmePath = join34(hookPath, "README.md");
       let readme = "";
       if (existsSync16(readmePath)) {
         readme = readFileSync27(readmePath, "utf-8");
@@ -41719,7 +41765,7 @@ var init_server = __esm(() => {
   pkg = { name: "@hasna/hooks", version: "0.0.0" };
   try {
     for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
-      const p = join33(__dirname3, rel);
+      const p = join34(__dirname3, rel);
       if (existsSync16(p)) {
         pkg = JSON.parse(readFileSync27(p, "utf-8"));
         break;
@@ -41876,6 +41922,23 @@ function readNativeSafetyRegistration(home = homedir6()) {
     throw new NativeSafetyError(error61?.code === "ENOENT" ? "binding_missing" : "binding_invalid");
   }
 }
+function nativeSafetyBindingIntegrityReason(home = homedir6()) {
+  try {
+    const path = join12(canonicalHome(home), ".hasna/hooks/native", filename);
+    const stat2 = lstatSync7(path);
+    if (!stat2.isFile())
+      return "the saved binding is not a regular file";
+    if (!owner2(stat2.uid))
+      return "the saved binding is not owned by the current user";
+    if (stat2.mode & 63)
+      return `the saved binding is accessible by group or others (mode ${(stat2.mode & 511).toString(8).padStart(3, "0")})`;
+    if (stat2.size > 32768)
+      return "the saved binding exceeds its size bound";
+    return;
+  } catch (error61) {
+    return error61?.code === "ENOENT" ? "the saved binding is missing" : undefined;
+  }
+}
 function registerNativeSafety(options = {}) {
   const home = canonicalHome(options.home ?? homedir6());
   const record3 = { schema: "hasna.hooks.native-safety.v1", harness: "sumi", command: options.command ?? installedNativeSafetyCommand("trash-guard") };
@@ -43205,17 +43268,17 @@ class JsonEventsStore {
   }
   async appendEvent(event) {
     await this.init();
-    const events = await this.readJson(this.eventsPath, []);
-    events.push(event);
-    await this.writeJson(this.eventsPath, events);
+    const events2 = await this.readJson(this.eventsPath, []);
+    events2.push(event);
+    await this.writeJson(this.eventsPath, events2);
     return event;
   }
   async appendEventOnce(event, options = {}) {
     await this.init();
-    const events = await this.readJson(this.eventsPath, []);
+    const events2 = await this.readJson(this.eventsPath, []);
     const dedupe = options.dedupe !== false;
     if (dedupe) {
-      const existing = findEventByIdentity(events, { id: event.id, dedupeKey: event.dedupeKey });
+      const existing = findEventByIdentity(events2, { id: event.id, dedupeKey: event.dedupeKey });
       if (existing) {
         return {
           event: existing,
@@ -43225,8 +43288,8 @@ class JsonEventsStore {
         };
       }
     }
-    events.push(event);
-    await this.writeJson(this.eventsPath, events);
+    events2.push(event);
+    await this.writeJson(this.eventsPath, events2);
     return {
       event,
       stored: true,
@@ -43236,13 +43299,13 @@ class JsonEventsStore {
   }
   async listEvents(options = {}) {
     await this.init();
-    const events = await this.readJson(this.eventsPath, []);
-    return queryEvents(events, options);
+    const events2 = await this.readJson(this.eventsPath, []);
+    return queryEvents(events2, options);
   }
   async listEventsPage(options = {}) {
     await this.init();
-    const events = await this.readJson(this.eventsPath, []);
-    const queried = queryEvents(events, {
+    const events2 = await this.readJson(this.eventsPath, []);
+    const queried = queryEvents(events2, {
       eventId: options.eventId,
       source: options.source,
       type: options.type
@@ -43260,8 +43323,8 @@ class JsonEventsStore {
     };
   }
   async findEventByIdentity(identity3) {
-    const events = await this.listEvents();
-    return findEventByIdentity(events, identity3);
+    const events2 = await this.listEvents();
+    return findEventByIdentity(events2, identity3);
   }
   async appendDelivery(result) {
     await this.init();
@@ -43366,8 +43429,8 @@ function normalizeEventPageLimit(limit) {
     throw new Error(`Event page limit must be a positive integer, got ${limit}`);
   return Math.min(limit, MAX_EVENT_PAGE_LIMIT);
 }
-function queryEvents(events, options) {
-  let rows = events;
+function queryEvents(events2, options) {
+  let rows = events2;
   if (options.eventId)
     rows = rows.filter((event) => event.id === options.eventId);
   if (options.source)
@@ -43386,13 +43449,13 @@ function assertCursorFilter(name, cursorValue, optionValue) {
   if (cursorValue !== optionValue)
     throw new Error(`Local JSON event cursor ${name} filter mismatch`);
 }
-function findEventByIdentity(events, identity3) {
-  return events.find((event) => identity3.id !== undefined && event.id === identity3.id || identity3.dedupeKey !== undefined && event.dedupeKey === identity3.dedupeKey);
+function findEventByIdentity(events2, identity3) {
+  return events2.find((event) => identity3.id !== undefined && event.id === identity3.id || identity3.dedupeKey !== undefined && event.dedupeKey === identity3.dedupeKey);
 }
 async function getEventsStatus(dataDir22) {
   const store = new JsonEventsStore(dataDir22);
   await store.init();
-  const [channels, events, deliveries] = await Promise.all([
+  const [channels, events2, deliveries] = await Promise.all([
     store.listChannels(),
     store.listEvents(),
     store.listDeliveries()
@@ -43413,14 +43476,14 @@ async function getEventsStatus(dataDir22) {
     },
     files: {
       channels: statusFile(store.dataDir, "channels.json", channels.length),
-      events: statusFile(store.dataDir, "events.json", events.length),
+      events: statusFile(store.dataDir, "events.json", events2.length),
       deliveries: statusFile(store.dataDir, "deliveries.json", deliveries.length)
     },
     counts: {
       channels: channels.length,
       enabledChannels: channels.filter((channel) => channel.enabled).length,
       disabledChannels: channels.filter((channel) => !channel.enabled).length,
-      events: events.length,
+      events: events2.length,
       deliveries: deliveries.length
     },
     transports,
@@ -44135,16 +44198,16 @@ class EventsClient {
   async listEventsPage(options = {}) {
     if (this.store.listEventsPage)
       return this.store.listEventsPage(options);
-    const events = queryClientEvents(await this.store.listEvents(), {
+    const events2 = queryClientEvents(await this.store.listEvents(), {
       eventId: options.eventId,
       source: options.source,
       type: options.type
     });
     const offset = decodeLocalJsonEventCursor(options.cursor, options);
     const limit = normalizeEventPageLimit(options.limit);
-    const pageEvents = events.slice(offset, offset + limit);
+    const pageEvents = events2.slice(offset, offset + limit);
     const nextOffset = offset + pageEvents.length;
-    const hasMore = nextOffset < events.length;
+    const hasMore = nextOffset < events2.length;
     return {
       events: pageEvents,
       cursor: options.cursor,
@@ -44287,8 +44350,8 @@ function sanitizeChannelForOutput(channel) {
 function sanitizeChannelsForOutput(channels) {
   return channels.map(sanitizeChannelForOutput);
 }
-function queryClientEvents(events, options) {
-  let rows = events;
+function queryClientEvents(events2, options) {
+  let rows = events2;
   if (options.eventId)
     rows = rows.filter((event) => event.id === options.eventId);
   if (options.source)
@@ -44521,8 +44584,8 @@ function registerChannelCommands(program2, options) {
   return channels;
 }
 function registerEventCommands(program2, options) {
-  const events = program2.command(options.eventsCommandName ?? "events").description("Emit, list, and replay Hasna events");
-  events.command("emit").description("Emit an event from this app").argument("<type>", "Event type").option("--source <source>", "Event source override").option("--subject <subject>", "Event subject").option("--severity <severity>", "Event severity", "info").option("--message <message>", "Event message").option("--dedupe-key <key>", "Dedupe key").option("--data <json>", "Event data JSON object").option("--metadata <json>", "Event metadata JSON object").option("--no-deliver", "Record without delivering").option("--no-dedupe", "Allow duplicate id/dedupeKey events").option("-j, --json", "Print JSON output", false).action(async (type, actionOptions, command) => {
+  const events2 = program2.command(options.eventsCommandName ?? "events").description("Emit, list, and replay Hasna events");
+  events2.command("emit").description("Emit an event from this app").argument("<type>", "Event type").option("--source <source>", "Event source override").option("--subject <subject>", "Event subject").option("--severity <severity>", "Event severity", "info").option("--message <message>", "Event message").option("--dedupe-key <key>", "Dedupe key").option("--data <json>", "Event data JSON object").option("--metadata <json>", "Event metadata JSON object").option("--no-deliver", "Record without delivering").option("--no-dedupe", "Allow duplicate id/dedupeKey events").option("-j, --json", "Print JSON output", false).action(async (type, actionOptions, command) => {
     const result = await createClient(options).emit({
       source: actionOptions.source ?? options.source,
       type,
@@ -44536,7 +44599,7 @@ function registerEventCommands(program2, options) {
     print(result, wantsJson(actionOptions, command), `${result.deduped ? "Deduped" : "Emitted"} ${result.event.id} to ${result.deliveries.length} channel(s)`);
   });
   const defaultListLimit = options.defaultEventListLimit ?? DEFAULT_EVENT_LIST_LIMIT;
-  events.command("list").description("List recorded events").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--limit <n>", `Limit to the most recent <n> events (default ${defaultListLimit}; use 0 for all)`, parseNumber, defaultListLimit).option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
+  events2.command("list").description("List recorded events").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--limit <n>", `Limit to the most recent <n> events (default ${defaultListLimit}; use 0 for all)`, parseNumber, defaultListLimit).option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
     let rows = await createClient(options).listEvents();
     if (actionOptions.source)
       rows = rows.filter((event) => event.source === actionOptions.source);
@@ -44555,7 +44618,7 @@ function registerEventCommands(program2, options) {
     for (const event of rows)
       console.log(`${event.time}	${event.id}	${event.source}	${event.type}	${event.severity}`);
   });
-  events.command("replay").description("Replay recorded events").option("--id <id>", "Replay one event id").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--cursor <cursor>", "Opaque replay cursor from a previous page").option("--limit <n>", "Maximum events to replay", parseNumber).option("--dry-run", "Preview without delivery", false).option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
+  events2.command("replay").description("Replay recorded events").option("--id <id>", "Replay one event id").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--cursor <cursor>", "Opaque replay cursor from a previous page").option("--limit <n>", "Maximum events to replay", parseNumber).option("--dry-run", "Preview without delivery", false).option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
     const result = await createClient(options).replay({
       eventId: actionOptions.id,
       source: actionOptions.source,
@@ -44566,7 +44629,7 @@ function registerEventCommands(program2, options) {
     });
     print(result, wantsJson(actionOptions, command), replaySummary(result.events.length, result.deliveries.length, result.nextCursor));
   });
-  return events;
+  return events2;
 }
 function registerEventsCommands(program2, options) {
   registerChannelCommands(program2, options);
@@ -44582,9 +44645,9 @@ function collectValues(value, previous) {
   previous.push(value);
   return previous;
 }
-function replaySummary(events, deliveries, nextCursor) {
+function replaySummary(events2, deliveries, nextCursor) {
   const suffix = nextCursor ? `, next cursor: ${nextCursor}` : "";
-  return `Replayed ${events} event(s), ${deliveries} delivery result(s)${suffix}`;
+  return `Replayed ${events2} event(s), ${deliveries} delivery result(s)${suffix}`;
 }
 
 // src/cli/index.tsx
@@ -44609,7 +44672,7 @@ var {
 // src/cli/index.tsx
 import chalk2 from "chalk";
 import { existsSync as existsSync17, readFileSync as readFileSync28, rmSync as rmSync6 } from "fs";
-import { join as join34, dirname as dirname28 } from "path";
+import { join as join35, dirname as dirname28 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 
 // src/cli/components/App.tsx
@@ -45784,6 +45847,10 @@ function App({ initialHooks, overwrite = false }) {
 // src/cli/index.tsx
 init_native_safety();
 
+// src/lib/sumi-binding.ts
+import { homedir as homedir12 } from "os";
+import { join as join27, sep as sep3 } from "path";
+
 // hooks/hook-trash-guard/src/binary.ts
 import { dirname as dirname22, isAbsolute as isAbsolute20, join as join24, resolve as resolve21 } from "path";
 import { accessSync, closeSync as closeSync17, constants as constants16, fstatSync as fstatSync15, lstatSync as lstatSync23, openSync as openSync17, readFileSync as readFileSync19, readlinkSync as readlinkSync3, readSync as readSync2, realpathSync as realpathSync12, statSync } from "fs";
@@ -45958,6 +46025,68 @@ function inspectTrashBinary(env = process.env) {
   return { ok: false, code: failure };
 }
 
+// src/lib/sumi-binding.ts
+init_native_safety();
+function failure(code2, reason) {
+  return { ok: false, target: "sumi", code: code2, ...reason ? { reason: reason.slice(0, 300) } : {} };
+}
+function nativeSafetyBindingDurable(worker, home) {
+  return !(worker.startsWith(join27(home, ".bun") + sep3) || worker.includes(`${sep3}node_modules${sep3}.bun${sep3}`));
+}
+async function provisionSumiSafetyBinding(options = {}) {
+  const home = options.home ?? homedir12();
+  let desired;
+  try {
+    desired = options.command ?? installedNativeSafetyCommand("trash-guard");
+  } catch (error61) {
+    const message = error61 instanceof Error ? error61.message : String(error61);
+    return failure(/Bundled native safety runner is missing/.test(message) ? "runner_missing" : "guard_failed", message);
+  }
+  try {
+    if (nativeSafetyCommandBinding(desired)?.name !== "trash-guard")
+      throw new NativeSafetyError("input_invalid");
+    const durable = nativeSafetyBindingDurable(nativeSafetyCommandBinding(desired).worker, home);
+    let current2;
+    try {
+      current2 = readNativeSafetyRegistration(home);
+    } catch (error61) {
+      if (!(error61 instanceof NativeSafetyError) || error61.code !== "binding_missing")
+        throw error61;
+    }
+    if (current2) {
+      if (current2.record.command === desired) {
+        return { ok: true, target: "sumi", action: "unchanged", path: current2.path, sha256: current2.sha256, changed: false, durable };
+      }
+      if (nativeSafetyBindingVerified(current2.record.command)) {
+        return { ok: true, target: "sumi", action: "kept", path: current2.path, sha256: current2.sha256, changed: false, durable };
+      }
+    }
+    const binding = nativeSafetyCommandBinding(desired);
+    const trash = inspectTrashBinary({ PATH: binding.path });
+    if (!trash.ok)
+      return failure(trash.code);
+    await verifyNativeSafetyCommand(desired, home);
+    const registered = registerNativeSafety({ home, command: desired, expectedSHA256: current2?.sha256 });
+    const verified = await verifyNativeSafetyRegistration(home);
+    if (verified.sha256 !== registered.sha256)
+      throw new NativeSafetyError("binding_changed");
+    return {
+      ok: true,
+      target: "sumi",
+      action: current2 ? "repaired" : "created",
+      path: registered.path,
+      sha256: registered.sha256,
+      changed: true,
+      durable,
+      ...current2 ? { backup: `${registered.path}.before-${current2.sha256}` } : {}
+    };
+  } catch (error61) {
+    if (!(error61 instanceof NativeSafetyError))
+      return failure("guard_failed", error61 instanceof Error ? error61.message : String(error61));
+    return failure(error61.code, error61.reason ?? (error61.code === "binding_invalid" ? nativeSafetyBindingIntegrityReason(home) : undefined));
+  }
+}
+
 // src/cli/index.tsx
 init_registry();
 init_installer();
@@ -45975,7 +46104,7 @@ init_transport2();
 init_db();
 import { jsxDEV as jsxDEV8 } from "react/jsx-dev-runtime";
 var __dirname4 = dirname28(fileURLToPath6(import.meta.url));
-var pkgPath = existsSync17(join34(__dirname4, "..", "package.json")) ? join34(__dirname4, "..", "package.json") : join34(__dirname4, "..", "..", "package.json");
+var pkgPath = existsSync17(join35(__dirname4, "..", "package.json")) ? join35(__dirname4, "..", "package.json") : join35(__dirname4, "..", "..", "package.json");
 var pkg2 = JSON.parse(readFileSync28(pkgPath, "utf-8"));
 var program3 = new Command;
 function resolveScope(options) {
@@ -46003,6 +46132,20 @@ function resolveConcreteTarget(options) {
     return "codewith";
   return "claude";
 }
+function reportSumiBinding(result) {
+  if (result.ok) {
+    if (result.changed) {
+      console.log(chalk2.green(`\u2713 Sumi native-safety binding ${result.action}`) + chalk2.dim(` (${result.path})`));
+      if (result.backup)
+        console.log(chalk2.dim(`  previous binding preserved at ${result.backup}`));
+    }
+    if (!result.durable) {
+      console.error(chalk2.yellow("\u26A0 The Sumi binding pins a worker in a tree a package upgrade rewrites") + chalk2.dim(" \u2014 re-run `hooks safety provision` after upgrading that tree, or provision from a stable versioned install tree."));
+    }
+    return;
+  }
+  console.error(chalk2.yellow(`\u26A0 Sumi native-safety binding was not provisioned (${result.code})`) + chalk2.dim(` \u2014 run \`hooks safety provision\` on this station before a Sumi seat needs its shell.`));
+}
 function formatSettingsPath(scope, target) {
   if (target === "all")
     return "target-specific settings";
@@ -46194,7 +46337,7 @@ program3.command("init").description("Register a new agent profile with a unique
   if (profile.name) {
     console.log(`  ${chalk2.dim("Name:")}       ${profile.name}`);
   }
-  console.log(`  ${chalk2.dim("Profile:")}    ${join34(getProfilesDir(), `${profile.agent_id}.json`)}`);
+  console.log(`  ${chalk2.dim("Profile:")}    ${join35(getProfilesDir(), `${profile.agent_id}.json`)}`);
   console.log();
   console.log(chalk2.dim("  Install hooks with this profile:"));
   console.log(`    hooks install gitguard --profile ${profile.agent_id}`);
@@ -46512,6 +46655,7 @@ Dry run \u2014 would install (${scope}, ${target}):
     });
     results2.push(result);
   }
+  const sumiBinding = await provisionSumiSafetyBinding();
   if (options.json) {
     console.log(JSON.stringify({
       installed: results2.filter((r2) => r2.success).map((r2) => r2.hook),
@@ -46522,6 +46666,7 @@ Dry run \u2014 would install (${scope}, ${target}):
       scope,
       target,
       applied: results2.some((r2) => r2.applied),
+      sumiBinding,
       ...target === "codex" ? { notes: results2.filter((r2) => r2.success && r2.note).map((r2) => r2.note) } : {}
     }));
     if (results2.some((r2) => !r2.success)) {
@@ -46571,6 +46716,7 @@ Installing hooks (${scope}, ${target})...
   }
   console.log(chalk2.dim(`
 Registered in ${settingsFile}`));
+  reportSumiBinding(sumiBinding);
 });
 program3.command("list").alias("ls").option("-c, --category <category>", "Filter by category").option("-a, --all", "Show all available hooks", false).option("-i, --installed", "Show only installed hooks", false).option("-r, --registered", "Show registered hooks", false).option("-g, --global", "Check global settings", false).option("-p, --project", "Check project settings", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith, codex (default: claude)", "claude").option("-n, --limit <n>", "Max rows to show in compact output", "20").option("--verbose", "Show descriptions and full detail columns", false).option("-j, --json", "Output as JSON", false).description("List available or installed hooks (bundled + custom/registry)").action((options) => {
   const scope = resolveScope(options);
@@ -46846,7 +46992,7 @@ program3.command("doctor").option("-g, --global", "Check global settings", false
         continue;
       }
       const hookDir = getHookPath(name);
-      const hookScript = join34(hookDir, "src", "hook.ts");
+      const hookScript = join35(hookDir, "src", "hook.ts");
       if (!existsSync17(hookScript)) {
         issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
         hookHealthy = false;
@@ -47057,7 +47203,7 @@ program3.command("docs").argument("[hook]", "Hook name (shows general docs if om
       return;
     }
     const hookPath = getHookPath(hook);
-    const readmePath = join34(hookPath, "README.md");
+    const readmePath = join35(hookPath, "README.md");
     let readme = "";
     if (existsSync17(readmePath)) {
       readme = readFileSync28(readmePath, "utf-8");
@@ -47233,11 +47379,13 @@ Upgrading @hasna/hooks (${pm})...
   }
   const versionProc = Bun.spawnSync(["npm", "view", "@hasna/hooks", "version"]);
   const latest = new TextDecoder().decode(versionProc.stdout).trim() || "unknown";
+  const sumiBinding = await provisionSumiSafetyBinding();
   if (options.json) {
-    console.log(JSON.stringify({ current: current2, latest, updated: true }));
+    console.log(JSON.stringify({ current: current2, latest, updated: true, sumiBinding }));
   } else {
     console.log(chalk2.green(`
 \u2713 Upgraded: ${current2} \u2192 ${latest}`));
+    reportSumiBinding(sumiBinding);
   }
 });
 program3.command("profile-export").description("Export all agent profiles as JSON (for backup/cross-machine setup)").option("-o, --output <file>", "Write to file instead of stdout").option("-j, --json", "Output as JSON (default: true)", false).action(async (options) => {
@@ -47810,6 +47958,17 @@ safety.command("verify").requiredOption("--target <target>", "sumi, codex or cla
     process.exitCode = 1;
   }
 });
+safety.command("provision").option("--target <target>", "sumi", "sumi").description("Idempotently provision the required native binding from this installed package").action(async (options) => {
+  if (options.target !== "sumi") {
+    console.log(JSON.stringify({ ok: false, target: options.target, code: "input_invalid" }));
+    process.exitCode = 1;
+    return;
+  }
+  const result = await provisionSumiSafetyBinding();
+  console.log(JSON.stringify(result));
+  if (!result.ok)
+    process.exitCode = 1;
+});
 var API_INDEPENDENT_COMMANDS = new Set([
   "safety",
   "serve",