@hasna/hooks 0.10.7 → 0.10.9

package/README.md

@@ -393,8 +393,46 @@ commands are credential-free and return compact JSON. Verification explicitly
 reports `nativeAdoptionVerified: false`: a fresh native Sumi tool invocation is
 still required to prove that the installed harness uses this binding.
 
+The binding is provisioned from the package's own install, upgrade and safety
+surfaces, so a rollout cannot leave Sumi's fail-closed check unbound:
+
+- the package lifecycle script (`postinstall`) provisions it for a packaged
+  install — a copy inside a `node_modules` directory, never a source checkout;
+- `hooks install` and `hooks upgrade` apply the same step after a successful
+  hook install or package upgrade, and report it as `sumiBinding` in `--json`;
+- `hooks safety provision` runs it on demand and is credential-free.
+
+Every surface is idempotent and shares one policy: a missing binding is created,
+a byte-identical one is written nowhere, a different binding that still verifies
+is left intact, and one whose pinned runtime or worker no longer verifies (an
+upgrade rewrote the worker, or the runtime prefix was pruned) is re-registered
+with the previous record preserved beside it as `<path>.before-<sha256>`. An
+unreadable or unrecognized record is refused rather than overwritten, and
+provisioning never fails the calling command — it reports a stable `code`,
+because an unavailable Trash guard must not break a hook install. bun blocks
+lifecycle scripts for untrusted dependencies and `--ignore-scripts` skips them,
+so the CLI surfaces carry the same policy wherever the lifecycle script does not
+run. A harness rollout that installs this package with scripts disabled must run
+one of those surfaces; that is the harness owner's half of this contract.
+
+The binding pins the absolute paths and sha256 of the Bun runtime and the worker
+bundle as they exist when it is registered, and every evaluation re-verifies
+those exact bytes. A worker inside a tree a package upgrade rewrites in place —
+bun's global install root, its cache, or an isolated `node_modules/.bun/…` store —
+is therefore only valid until that tree is upgraded; the next rewrite refuses
+every command until provisioning runs again. Provisioning still closes the
+immediate gap (an unbound station has no shell at all) but reports it: every
+result carries `durable`, and a false value prints the repair step. Provision
+rollouts from a stable, versioned install tree (for example the fleet's
+`~/.hasna/hooks/runtime/<version>-copyfile` layout) and re-run
+`hooks safety provision` after upgrading a tree the binding points at.
+
 The owner-only `~/.hasna/hooks/native/sumi-trash-guard.json` pins the supervisor's
-runtime, worker, home and PATH. Identical setup is a no-op. An upgrade requires
+runtime, worker, home and PATH. Owner and mode are part of the trust decision: a
+record that is not owned by the current user, or that group or others can read or
+write, is refused with the failing property named — never trusted, adopted or
+silently replaced — because a rewritable binding can point the supervisor at a
+different worker. Identical setup is a no-op. An upgrade requires
 `--expected-binding-sha256 <current-digest>` and preserves the previous record.
 An interrupted lock or unexpected current record requires reconciliation; setup
 does not overwrite it. This file is native configuration, not a Hooks app store.

package/bin/hooks-mcp.js

@@ -3185,7 +3185,7 @@ function writeHookSettingsPreimage(path, settings, before) {
 // src/lib/claude-skills-coordination.ts
 import { createHash as createHash5 } from "crypto";
 
-// ../../node_modules/.bun/@hasna+skills@0.9.14+a00d3064559565bb/node_modules/@hasna/skills/dist/index.js
+// ../../node_modules/.bun/@hasna+skills@0.9.17+a00d3064559565bb/node_modules/@hasna/skills/dist/index.js
 import { existsSync as existsSync9 } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join8, resolve as resolve3 } from "path";
@@ -3198,6 +3198,7 @@ import { basename as basename2, isAbsolute as isAbsolute22, resolve as resolve22
 import { createHash as createHash16 } from "crypto";
 import { lstatSync as lstatSync20, readFileSync as readFileSync16, readdirSync as readdirSync9, realpathSync as realpathSync4 } from "fs";
 import { basename as basename8, dirname as dirname16, isAbsolute as isAbsolute14, join as join26, resolve as resolve14, sep as sep5 } from "path";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 import { dirname as dirname32, isAbsolute as isAbsolute3, join as join72, resolve as resolve32 } from "path";
 import { lstatSync as lstatSync3, readFileSync as readFileSync6, opendirSync } from "fs";
 import { createHash as createHash22 } from "crypto";
@@ -10678,8 +10679,8 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-marketplace-registry-v2"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
-      if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2")
+        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute22(source.path) && resolve22(source.path) === source.path && basename2(source.path) === "settings.json");
       if (source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute22(source.path) && resolve22(source.path) === source.path && basename2(source.path) === "known_marketplaces.json");
@@ -11174,7 +11175,7 @@ function hashDiscoveryPathFile(path, budget, changes) {
 }
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.14",
+  version: "0.9.17",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -12029,7 +12030,7 @@ function assertClaudeHookEventsReplacement(before, replacement, events) {
   need2(JSON.stringify(withoutOwnedEvents(original)) === JSON.stringify(withoutOwnedEvents(next)), `${label} update changed settings outside hooks.${label}`);
 }
 var PERSISTED_EFFORT_LEVELS = new Set(["low", "medium", "high", "xhigh"]);
-function inferencePreference(key, child) {
+function inferencePreference(key, child, version) {
   if (key === "skipDangerousModePermissionPrompt") {
     need2(child.kind === "literal" && (child.value === "true" || child.value === "false"), "contains an invalid dialog acknowledgment");
     return false;
@@ -12042,7 +12043,7 @@ function inferencePreference(key, child) {
     return false;
   need2(child.kind === "object", "requires an object of model preferences");
   child.entries = child.entries.filter(([model, preferences]) => {
-    if (!BUILTIN_MODEL_SELECTIONS.has(model) || preferences.kind !== "object" || preferences.entries.length !== 1 || preferences.entries[0][0] !== "effortLevel")
+    if (version === 2 && !BUILTIN_MODEL_SELECTIONS.has(model) || preferences.kind !== "object" || preferences.entries.length !== 1 || preferences.entries[0][0] !== "effortLevel")
       return true;
     const effort = preferences.entries[0][1];
     need2(effort.kind === "string" && PERSISTED_EFFORT_LEVELS.has(effort.value), "contains an invalid persisted model effort level");
@@ -12053,7 +12054,7 @@ function inferencePreference(key, child) {
 function settingsDigest(text2, version = 1) {
   const value = parse3(text2);
   value.entries = value.entries.filter(([key, child]) => {
-    if (version === 2 && inferencePreference(key, child))
+    if (version !== 1 && inferencePreference(key, child, version))
       return false;
     if (key === "model") {
       need2(child.kind === "string", "contains an invalid model selection");
@@ -12091,6 +12092,16 @@ function hashClaudeSettingsReplacementV2(text2, budget) {
   budget.remaining -= bytes;
   return settingsDigest(text2, 2);
 }
+function captureClaudeSettingsV3(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "claude-settings-v3", sha256: settingsDigest(readSettings(path, budget), 3) };
+}
+function hashClaudeSettingsReplacementV3(text2, budget) {
+  need2(typeof text2 === "string", "requires settings text");
+  const bytes = Buffer.byteLength(text2);
+  need2(bytes <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes && Number.isSafeInteger(budget.remaining) && budget.remaining >= bytes, "exceeds its byte limit");
+  budget.remaining -= bytes;
+  return settingsDigest(text2, 3);
+}
 var sha = (data) => createHash10("sha256").update(data).digest("hex");
 var ROOTS = NATIVE_SKILL_ROOTS;
 function assertSafePath(path) {
@@ -12544,6 +12555,8 @@ function applyAgentIntegration(plan) {
       parseManagedSkillPolicy(change.after);
   const aliases = plan.rootAliases ?? [];
   recheckRootAliases(aliases);
+  for (const agent of plan.retainedReviewChecks?.agents ?? [])
+    assertManagedAgentBridge(agent, { ...plan.retainedReviewChecks, dataDir: plan.dataDir });
   for (const agent of plan.managedAgentChecks?.agents ?? [])
     assertManagedAgentBridge(agent, { home: plan.managedAgentChecks.home, dataDir: plan.dataDir, projectDir: plan.managedAgentChecks.home });
   for (const binding of plan.discoveryBefore ?? []) {
@@ -13557,13 +13570,17 @@ function unchanged2(before) {
   const after = snapshot(before.file, before.privateFile, before.readOnlyPackage ? { readOnlyPackage: true } : {});
   need4(sameStat(before.stat, after.stat) && after.sha256 === before.sha256, "INPUT_CHANGED");
 }
-var sha2 = (text2) => createHash15("sha256").update(text2).digest("hex");
+var events = { UserPromptSubmit: ["userPromptSubmit", "user_prompt_submit"], SessionStart: ["sessionStart", "session_start"], SubagentStart: ["subagentStart", "subagent_start"] };
+var matchedEvents = { ...events, PreToolUse: ["preToolUse", "pre_tool_use"] };
 var proofs = new WeakMap;
+var sha2 = (text2) => createHash15("sha256").update(text2).digest("hex");
+var proofs2 = new WeakMap;
 function assertCodexHookDiscoveryRecovery(binding, witness) {
-  const proof = proofs.get(witness);
+  const proof = proofs2.get(witness);
   need4(!!proof && binding.agent === "codex" && witness.discoverySha256 === sha2(JSON.stringify(binding)), "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
   unchanged2(proof.before);
   unchanged2(proof.current);
+  proof.recheckAdditions();
 }
 function verifiesCodexHookDiscoverySource(binding, source, currentDigest, witness) {
   if (!witness || source.path !== witness.configPath || source.hashMode !== "bytes")
@@ -13605,13 +13622,13 @@ function read2(path, changes) {
   return readFileSync16(path, "utf8");
 }
 function projected(source, changes, budget = discoveryByteBudget()) {
-  if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2") {
+  if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Claude settings witnesses require exact typed metadata");
-    const current2 = (source.hashMode === "claude-settings-v2" ? captureClaudeSettingsV2 : captureClaudeSettings)(source.path, budget).sha256;
+    const current2 = (source.hashMode === "claude-settings-v3" ? captureClaudeSettingsV3 : source.hashMode === "claude-settings-v2" ? captureClaudeSettingsV2 : captureClaudeSettings)(source.path, budget).sha256;
     if (current2 !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
-    return changes?.has(source.path) ? (source.hashMode === "claude-settings-v2" ? hashClaudeSettingsReplacementV2 : hashClaudeSettingsReplacement)(changes.get(source.path), budget) : current2;
+    return changes?.has(source.path) ? (source.hashMode === "claude-settings-v3" ? hashClaudeSettingsReplacementV3 : source.hashMode === "claude-settings-v2" ? hashClaudeSettingsReplacementV2 : hashClaudeSettingsReplacement)(changes.get(source.path), budget) : current2;
   }
   if (source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256) || changes?.has(source.path))
@@ -13673,7 +13690,7 @@ function verifyAgentDiscovery(binding, codexRecovery) {
     safe4(root2);
 }
 function assertMarketplaceBinding(binding, source) {
-  if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename8(source.path) !== "settings.json"))
+  if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename8(source.path) !== "settings.json"))
     throw new Error("Claude settings witnesses require explicit reviewed Claude configuration");
   if ((source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2") && (binding.agent !== "claude" || binding.method !== "reviewed"))
     throw new Error("Claude marketplace witnesses require explicit reviewed Claude discovery");
@@ -13682,7 +13699,10 @@ function rebindAgentDiscovery(binding, changes) {
   const budget = discoveryByteBudget();
   return { ...binding, sources: binding.sources.map((source) => {
     assertMarketplaceBinding(binding, source);
-    return { ...source, sha256: projected(source, changes, budget) };
+    const sha2562 = projected(source, changes, budget);
+    if (!changes.has(source.path) && sha2562 !== source.sha256)
+      throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
+    return { ...source, sha256: sha2562 };
   }) };
 }
 function assertProjectDiscovery(agent, directories, home, canonical4 = resolve14, reviewed) {
@@ -13794,6 +13814,19 @@ function resolveAgentDiscovery(options) {
       }
     }
   }
+  if (options.reviewed === undefined && options.retainedReview !== undefined) {
+    const retained = options.retainedReview;
+    if (retained.agent !== agent || retained.method !== "reviewed")
+      unresolved("invalid retained review");
+    verifyAgentDiscovery(retained);
+    if (!retained.sources.some((source) => source.path === canonical4(configPath) && source.format === undefined && source.fields === undefined))
+      unresolved("retained review is missing the full agent configuration source");
+    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && source.path !== canonical4(configPath)))
+      unresolved("retained settings witness names another configuration source");
+    if (sources.some((source) => !retained.sources.some((saved) => isDeepStrictEqual3(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
+      unresolved("retained review is missing current runtime discovery coverage");
+    return retained;
+  }
   if (options.reviewed && (options.reviewed.version !== 1 || !Array.isArray(options.reviewed.agents) || options.reviewed.agents.some((item) => !item || typeof item !== "object") || new Set(options.reviewed.agents.map((item) => item.agent)).size !== options.reviewed.agents.length))
     throw new Error("Invalid --discovery-inputs version or agents");
   const review = options.reviewed?.agents.find((item) => item.agent === agent);
@@ -13804,7 +13837,7 @@ function resolveAgentDiscovery(options) {
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
-    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2") && source.path !== canonical4(configPath)))
+    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && source.path !== canonical4(configPath)))
       throw new Error("Semantic settings witnesses must name the configured Claude configuration source");
     if (!review.sources.some((source) => source.path === canonical4(configPath)))
       throw new Error("Discovery review must include the agent configuration source");
@@ -34314,8 +34347,8 @@ var SESSION_RECONCILIATION_PLAN_TTL_MS = 5 * 60 * 1000;
 // src/lib/claude-skills-coordination.ts
 function coordinateClaudeSettings(before, replacement, options) {
   const prior = JSON.parse(before ?? "{}"), next = JSON.parse(replacement);
-  const events = new Set([...Object.keys(prior.hooks ?? {}), ...Object.keys(next.hooks ?? {})]);
-  const changed = [...events].filter((event) => JSON.stringify(prior.hooks?.[event]) !== JSON.stringify(next.hooks?.[event]));
+  const events2 = new Set([...Object.keys(prior.hooks ?? {}), ...Object.keys(next.hooks ?? {})]);
+  const changed = [...events2].filter((event) => JSON.stringify(prior.hooks?.[event]) !== JSON.stringify(next.hooks?.[event]));
   const selected = changed.length ? changed : ["PreToolUse"];
   const plan = planClaudeHookEventsUpdate({
     ...options,
@@ -34603,7 +34636,7 @@ function detectConflict(name, scope, target) {
   const meta3 = isNativeSafetyName(name) ? getHook(name) : resolveHookMeta(name);
   if (!meta3 || !meta3.matcher)
     return;
-  const events = new Set(getHookEvents(meta3));
+  const events2 = new Set(getHookEvents(meta3));
   const registered = getRegisteredHooksForTarget(scope, target);
   for (const existingName of registered) {
     if (existingName === name)
@@ -34611,7 +34644,7 @@ function detectConflict(name, scope, target) {
     const existing = getHook(existingName);
     if (!existing || !existing.matcher)
       continue;
-    if (!getHookEvents(existing).some((event) => events.has(event)))
+    if (!getHookEvents(existing).some((event) => events2.has(event)))
       continue;
     if (matchersOverlap(meta3.matcher.toLowerCase(), existing.matcher.toLowerCase())) {
       return `conflicts with '${existingName}' (same event ${meta3.event}, overlapping matcher '${existing.matcher}')`;