@hasna/hooks 0.10.7 → 0.10.9

package/bin/native-safety-entry.js

@@ -1179,11 +1179,131 @@ var OUTPUT_REDIRECT = /(?:\d+|&)?(?:>>|>\||>&|<>|>)\s*([^\s;&|<>()\x60]*)/g;
 function withoutFdDuplication(segment) {
   return segment.replace(FD_DUPLICATION, " ");
 }
+function pipelineStages(segment) {
+  const stages = [];
+  let quote = null;
+  let parens = 0;
+  let braces = 0;
+  let backtick = false;
+  let start = 0;
+  for (let i = 0;i < segment.length; i++) {
+    const ch = segment[i];
+    if (quote === "'") {
+      if (ch === "'")
+        quote = null;
+      continue;
+    }
+    if (ch === "\\") {
+      i++;
+      continue;
+    }
+    if (ch === "(") {
+      parens++;
+      continue;
+    }
+    if (ch === ")") {
+      if (--parens < 0)
+        return [segment];
+      continue;
+    }
+    if (ch === "$" && segment[i + 1] === "{") {
+      braces++;
+      i++;
+      continue;
+    }
+    if (ch === "}" && braces > 0) {
+      braces--;
+      continue;
+    }
+    if (ch === "`") {
+      backtick = !backtick;
+      continue;
+    }
+    if (quote === '"') {
+      if (ch === '"')
+        quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      continue;
+    }
+    if (ch !== "|" || parens > 0 || braces > 0 || backtick || segment[i - 1] === ">")
+      continue;
+    stages.push(segment.slice(start, i));
+    if (segment[i + 1] === "&")
+      i++;
+    start = i + 1;
+  }
+  if (quote || parens !== 0 || braces !== 0 || backtick)
+    return [segment];
+  stages.push(segment.slice(start));
+  return stages;
+}
+function shellWords(command) {
+  const words = [];
+  let text = "";
+  let raw = "";
+  let quote = null;
+  let inWord = false;
+  const flush = () => {
+    if (!inWord)
+      return;
+    const body = raw.replace(/^"?\$\{?HOME\}?"?(?=\/|$)/, "");
+    const literalTilde = text.startsWith("~") && !/^~(?:\/|$)/.test(raw);
+    words.push({ text: literalTilde ? `./${text}` : text, opaque: /[$\x60*?[]/.test(body) || /[()]/.test(body) });
+    text = "";
+    raw = "";
+    inWord = false;
+  };
+  for (let i = 0;i < command.length; i++) {
+    const ch = command[i];
+    if (quote === "'") {
+      if (ch === "'")
+        quote = null;
+      else
+        text += ch;
+      raw += ch;
+      continue;
+    }
+    if (ch === "\\" && i + 1 < command.length) {
+      const next = command[i + 1];
+      text += quote === '"' && !/[$\x60"\\\n]/.test(next) ? ch + next : next;
+      raw += ch + next;
+      inWord = true;
+      i++;
+      continue;
+    }
+    if (quote === '"') {
+      if (ch === '"')
+        quote = null;
+      else
+        text += ch;
+      raw += ch;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      flush();
+      continue;
+    }
+    inWord = true;
+    raw += ch;
+    if (ch === "'" || ch === '"')
+      quote = ch;
+    else
+      text += ch;
+  }
+  if (quote) {
+    raw += "$";
+  }
+  flush();
+  return words;
+}
 function segmentOperation(segment) {
   const trimmed = segment.trim();
   if (!trimmed)
     return "read";
-  if (/(?:^|\s)(?:rm|rmdir|unlink|shred|trash|rmtree|del)(?:\s|$)/.test(trimmed))
+  if (/(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:rm|rmdir|unlink|shred|trash|rmtree|del)(?:\s|$)/.test(trimmed))
     return "delete";
   if (/\bgit\b/.test(trimmed)) {
     if (/\bgit\b[^;&|]*\b(?:clean|rm)\b/.test(trimmed))
@@ -1192,7 +1312,7 @@ function segmentOperation(segment) {
       return "write";
     return "read";
   }
-  if (/(?:^|\s)(?:mkdir|mkfile|touch|mv|cp|ln|tee|install|dd)(?:\s|$)/.test(trimmed))
+  if (/(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:mkdir|mkfile|touch|mv|cp|ln|tee|install|dd)(?:\s|$)/.test(trimmed))
     return "write";
   if (/\b(?:curl|wget)\b/.test(trimmed)) {
     if (WRITE_FLAGS.test(trimmed))
@@ -1281,7 +1401,6 @@ function bashTargets(command, home, cwd) {
     for (let i = 0;i < opens; i++)
       subshells.push({ current: [...current], reachable: new Set(reachable), certain });
     const segment = unwrapSegment(rawSegment);
-    const op = segmentOperation(segment);
     const plainCd = segment.match(/^cd(?:\s+(?:-[A-Za-z@]+|--))*(?:\s+([^\s;&|<>()\x60]+))?$/);
     const embeddedCd = plainCd ? null : segment.match(/(?:^|\s)cd(?:\s+(?:-[A-Za-z]+|--))*\s+([^\s;&|<>()\x60]+)/);
     if (embeddedCd) {
@@ -1294,28 +1413,99 @@ function bashTargets(command, home, cwd) {
     const suffix = roots.map((root) => regexEscape(root.slice(home.length + 1))).join("|");
     const prefixRe = new RegExp(`(?:~|\\$HOME"*|\\$\\{HOME\\}"*|${homeLiteral}"*)/(?:${suffix})`);
     const re = new RegExp(`(${prefixRe.source})([^\\s"';&|<>()\`]*|$)`, "g");
-    let m;
-    let foundExplicit = false;
-    while ((m = re.exec(segment)) !== null) {
-      foundExplicit = true;
-      const expanded = expandHomeSpelling2(m[0], home);
-      targets.push({ path: normalize2(expanded).replace(/\/+$/, ""), op });
-    }
-    if (!foundExplicit && (op === "delete" || op === "write")) {
+    const explicitTargets = (text) => {
+      const found = [];
+      let m;
+      re.lastIndex = 0;
+      while ((m = re.exec(text)) !== null)
+        found.push(normalize2(expandHomeSpelling2(m[0], home)).replace(/\/+$/, ""));
+      return found;
+    };
+    const stages = pipelineStages(segment).map((stage) => {
       const operands = [];
-      const commandPart = withoutFdDuplication(segment).replace(OUTPUT_REDIRECT, (_match, operand) => {
+      let opaqueRedirect = false;
+      const commandPart = withoutFdDuplication(stage).replace(OUTPUT_REDIRECT, (_match, operand) => {
+        if (!operand || /[$\x60]/.test(operand))
+          opaqueRedirect = true;
         if (operand)
           operands.push(operand);
         return " ";
       });
       const commandOp = segmentOperation(commandPart);
-      const relMatch = commandOp === "read" ? null : commandPart.match(REL_OPERAND);
-      for (const base of current.filter(underRoot)) {
-        for (const operand of operands) {
+      return { commandPart, operands, op: opaqueRedirect && commandOp === "read" ? "write" : commandOp };
+    });
+    const pipelineOp = stages.some((stage) => stage.op === "delete") ? "delete" : stages.some((stage) => stage.op === "write") ? "write" : "read";
+    const bases = current.filter(underRoot);
+    for (const stage of stages) {
+      let foundExplicit = false;
+      for (const path of explicitTargets(stage.commandPart)) {
+        foundExplicit = true;
+        targets.push({ path, op: pipelineOp });
+      }
+      for (const operand of stage.operands) {
+        const explicit = explicitTargets(operand);
+        for (const path of explicit)
+          targets.push({ path, op: "write" });
+        if (explicit.length > 0)
+          continue;
+        for (const base of bases) {
           targets.push({ path: normalize2(resolve3(base, expandHomeSpelling2(operand, home))), op: "write" });
         }
-        if (relMatch)
-          targets.push({ path: normalize2(resolve3(base, relMatch[1])), op: commandOp });
+      }
+      if (foundExplicit || stage.op === "read")
+        continue;
+      const words = shellWords(stage.commandPart);
+      let operandStart = 1;
+      const tool = (words[0]?.text ?? "").split("/").pop();
+      if (tool === "trash" && ["put", "rm", "delete", "remove"].includes(words[1]?.text ?? ""))
+        operandStart = 2;
+      if (tool === "git") {
+        const sub = words.findIndex((word, index2) => index2 > 0 && (word.text === "rm" || word.text === "clean"));
+        if (sub > 0)
+          operandStart = sub + 1;
+      }
+      let endOfOptions = false;
+      const nonFlag = words.slice(operandStart).flatMap((word) => {
+        if (!endOfOptions && word.text === "--") {
+          endOfOptions = true;
+          return [];
+        }
+        if (!endOfOptions && word.text.startsWith("-"))
+          return [];
+        endOfOptions = true;
+        return [word.opaque ? "." : word.text];
+      });
+      const everyOperand = stage.op === "delete" || /(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:mkdir|mkfile|touch|tee|truncate|install|mv)(?:\s|$)/.test(stage.commandPart) || /(?:^|\s)sed(?:\s|$)/.test(stage.commandPart) && /(?:^|\s)(?:-i\S*|--in-place\S*)(?:\s|$)/.test(stage.commandPart);
+      const operandTargets = [];
+      if (everyOperand) {
+        for (const operand of nonFlag.length > 0 ? nonFlag : ["."])
+          operandTargets.push({ operand, op: stage.op });
+      } else {
+        const relMatch = stage.commandPart.match(REL_OPERAND);
+        const last = words.at(-1);
+        operandTargets.push({ operand: relMatch ? relMatch[1] : !last || last.opaque ? "." : last.text, op: stage.op });
+        if (/(?:^|\s)(?:cp|ln|install|mv)(?:\s|$)/.test(stage.commandPart)) {
+          words.forEach((word, index2) => {
+            let value;
+            const short = word.text.match(/^-[A-Za-z]*?t(.*)$/);
+            const long = word.text.match(/^(--t[a-z-]*)(?:=(.*))?$/);
+            if (short && !word.text.startsWith("--")) {
+              value = short[1] ? { text: short[1], opaque: word.opaque } : words[index2 + 1];
+            } else if (long && "--target-directory".startsWith(long[1])) {
+              value = long[2] !== undefined ? { text: long[2], opaque: word.opaque } : words[index2 + 1];
+            }
+            if (value)
+              operandTargets.push({ operand: value.opaque || !value.text ? "." : value.text, op: stage.op });
+          });
+        }
+        if (/(?:^|\s)(?:python3?|node|bun)\b[^;&|]*\s+-[ce](?:\s|$)/.test(stage.commandPart)) {
+          operandTargets.push({ operand: ".", op: stage.op });
+        }
+      }
+      for (const base of bases) {
+        for (const { operand, op } of operandTargets) {
+          targets.push({ path: normalize2(resolve3(base, expandHomeSpelling2(operand, home))), op });
+        }
       }
     }
     if (plainCd) {

package/dist/index.js

@@ -7941,7 +7941,7 @@ function writeHookSettingsPreimage(path, settings, before) {
 // src/lib/claude-skills-coordination.ts
 import { createHash as createHash5 } from "crypto";
 
-// ../../node_modules/.bun/@hasna+skills@0.9.14+a00d3064559565bb/node_modules/@hasna/skills/dist/index.js
+// ../../node_modules/.bun/@hasna+skills@0.9.17+a00d3064559565bb/node_modules/@hasna/skills/dist/index.js
 import { existsSync as existsSync9 } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join8, resolve as resolve3 } from "path";
@@ -7954,6 +7954,7 @@ import { basename as basename2, isAbsolute as isAbsolute22, resolve as resolve22
 import { createHash as createHash16 } from "crypto";
 import { lstatSync as lstatSync20, readFileSync as readFileSync16, readdirSync as readdirSync9, realpathSync as realpathSync4 } from "fs";
 import { basename as basename8, dirname as dirname16, isAbsolute as isAbsolute14, join as join26, resolve as resolve14, sep as sep5 } from "path";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 import { dirname as dirname32, isAbsolute as isAbsolute3, join as join72, resolve as resolve32 } from "path";
 import { lstatSync as lstatSync3, readFileSync as readFileSync6, opendirSync } from "fs";
 import { createHash as createHash22 } from "crypto";
@@ -15434,8 +15435,8 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-marketplace-registry-v2"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
-      if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2")
+        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute22(source.path) && resolve22(source.path) === source.path && basename2(source.path) === "settings.json");
       if (source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute22(source.path) && resolve22(source.path) === source.path && basename2(source.path) === "known_marketplaces.json");
@@ -15930,7 +15931,7 @@ function hashDiscoveryPathFile(path, budget, changes) {
 }
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.14",
+  version: "0.9.17",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -16785,7 +16786,7 @@ function assertClaudeHookEventsReplacement(before, replacement, events) {
   need2(JSON.stringify(withoutOwnedEvents(original)) === JSON.stringify(withoutOwnedEvents(next)), `${label} update changed settings outside hooks.${label}`);
 }
 var PERSISTED_EFFORT_LEVELS = new Set(["low", "medium", "high", "xhigh"]);
-function inferencePreference(key, child) {
+function inferencePreference(key, child, version) {
   if (key === "skipDangerousModePermissionPrompt") {
     need2(child.kind === "literal" && (child.value === "true" || child.value === "false"), "contains an invalid dialog acknowledgment");
     return false;
@@ -16798,7 +16799,7 @@ function inferencePreference(key, child) {
     return false;
   need2(child.kind === "object", "requires an object of model preferences");
   child.entries = child.entries.filter(([model, preferences]) => {
-    if (!BUILTIN_MODEL_SELECTIONS.has(model) || preferences.kind !== "object" || preferences.entries.length !== 1 || preferences.entries[0][0] !== "effortLevel")
+    if (version === 2 && !BUILTIN_MODEL_SELECTIONS.has(model) || preferences.kind !== "object" || preferences.entries.length !== 1 || preferences.entries[0][0] !== "effortLevel")
       return true;
     const effort = preferences.entries[0][1];
     need2(effort.kind === "string" && PERSISTED_EFFORT_LEVELS.has(effort.value), "contains an invalid persisted model effort level");
@@ -16809,7 +16810,7 @@ function inferencePreference(key, child) {
 function settingsDigest(text2, version = 1) {
   const value = parse3(text2);
   value.entries = value.entries.filter(([key, child]) => {
-    if (version === 2 && inferencePreference(key, child))
+    if (version !== 1 && inferencePreference(key, child, version))
       return false;
     if (key === "model") {
       need2(child.kind === "string", "contains an invalid model selection");
@@ -16847,6 +16848,16 @@ function hashClaudeSettingsReplacementV2(text2, budget) {
   budget.remaining -= bytes;
   return settingsDigest(text2, 2);
 }
+function captureClaudeSettingsV3(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "claude-settings-v3", sha256: settingsDigest(readSettings(path, budget), 3) };
+}
+function hashClaudeSettingsReplacementV3(text2, budget) {
+  need2(typeof text2 === "string", "requires settings text");
+  const bytes = Buffer.byteLength(text2);
+  need2(bytes <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes && Number.isSafeInteger(budget.remaining) && budget.remaining >= bytes, "exceeds its byte limit");
+  budget.remaining -= bytes;
+  return settingsDigest(text2, 3);
+}
 var sha = (data) => createHash10("sha256").update(data).digest("hex");
 var ROOTS = NATIVE_SKILL_ROOTS;
 function assertSafePath(path) {
@@ -17300,6 +17311,8 @@ function applyAgentIntegration(plan) {
       parseManagedSkillPolicy(change.after);
   const aliases = plan.rootAliases ?? [];
   recheckRootAliases(aliases);
+  for (const agent of plan.retainedReviewChecks?.agents ?? [])
+    assertManagedAgentBridge(agent, { ...plan.retainedReviewChecks, dataDir: plan.dataDir });
   for (const agent of plan.managedAgentChecks?.agents ?? [])
     assertManagedAgentBridge(agent, { home: plan.managedAgentChecks.home, dataDir: plan.dataDir, projectDir: plan.managedAgentChecks.home });
   for (const binding of plan.discoveryBefore ?? []) {
@@ -18313,13 +18326,17 @@ function unchanged2(before) {
   const after = snapshot(before.file, before.privateFile, before.readOnlyPackage ? { readOnlyPackage: true } : {});
   need4(sameStat(before.stat, after.stat) && after.sha256 === before.sha256, "INPUT_CHANGED");
 }
-var sha2 = (text2) => createHash15("sha256").update(text2).digest("hex");
+var events = { UserPromptSubmit: ["userPromptSubmit", "user_prompt_submit"], SessionStart: ["sessionStart", "session_start"], SubagentStart: ["subagentStart", "subagent_start"] };
+var matchedEvents = { ...events, PreToolUse: ["preToolUse", "pre_tool_use"] };
 var proofs = new WeakMap;
+var sha2 = (text2) => createHash15("sha256").update(text2).digest("hex");
+var proofs2 = new WeakMap;
 function assertCodexHookDiscoveryRecovery(binding, witness) {
-  const proof = proofs.get(witness);
+  const proof = proofs2.get(witness);
   need4(!!proof && binding.agent === "codex" && witness.discoverySha256 === sha2(JSON.stringify(binding)), "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
   unchanged2(proof.before);
   unchanged2(proof.current);
+  proof.recheckAdditions();
 }
 function verifiesCodexHookDiscoverySource(binding, source, currentDigest, witness) {
   if (!witness || source.path !== witness.configPath || source.hashMode !== "bytes")
@@ -18361,13 +18378,13 @@ function read2(path, changes) {
   return readFileSync16(path, "utf8");
 }
 function projected(source, changes, budget = discoveryByteBudget()) {
-  if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2") {
+  if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Claude settings witnesses require exact typed metadata");
-    const current2 = (source.hashMode === "claude-settings-v2" ? captureClaudeSettingsV2 : captureClaudeSettings)(source.path, budget).sha256;
+    const current2 = (source.hashMode === "claude-settings-v3" ? captureClaudeSettingsV3 : source.hashMode === "claude-settings-v2" ? captureClaudeSettingsV2 : captureClaudeSettings)(source.path, budget).sha256;
     if (current2 !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
-    return changes?.has(source.path) ? (source.hashMode === "claude-settings-v2" ? hashClaudeSettingsReplacementV2 : hashClaudeSettingsReplacement)(changes.get(source.path), budget) : current2;
+    return changes?.has(source.path) ? (source.hashMode === "claude-settings-v3" ? hashClaudeSettingsReplacementV3 : source.hashMode === "claude-settings-v2" ? hashClaudeSettingsReplacementV2 : hashClaudeSettingsReplacement)(changes.get(source.path), budget) : current2;
   }
   if (source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256) || changes?.has(source.path))
@@ -18429,7 +18446,7 @@ function verifyAgentDiscovery(binding, codexRecovery) {
     safe4(root2);
 }
 function assertMarketplaceBinding(binding, source) {
-  if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename8(source.path) !== "settings.json"))
+  if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename8(source.path) !== "settings.json"))
     throw new Error("Claude settings witnesses require explicit reviewed Claude configuration");
   if ((source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2") && (binding.agent !== "claude" || binding.method !== "reviewed"))
     throw new Error("Claude marketplace witnesses require explicit reviewed Claude discovery");
@@ -18438,7 +18455,10 @@ function rebindAgentDiscovery(binding, changes) {
   const budget = discoveryByteBudget();
   return { ...binding, sources: binding.sources.map((source) => {
     assertMarketplaceBinding(binding, source);
-    return { ...source, sha256: projected(source, changes, budget) };
+    const sha2562 = projected(source, changes, budget);
+    if (!changes.has(source.path) && sha2562 !== source.sha256)
+      throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
+    return { ...source, sha256: sha2562 };
   }) };
 }
 function assertProjectDiscovery(agent, directories, home, canonical4 = resolve14, reviewed) {
@@ -18550,6 +18570,19 @@ function resolveAgentDiscovery(options) {
       }
     }
   }
+  if (options.reviewed === undefined && options.retainedReview !== undefined) {
+    const retained = options.retainedReview;
+    if (retained.agent !== agent || retained.method !== "reviewed")
+      unresolved("invalid retained review");
+    verifyAgentDiscovery(retained);
+    if (!retained.sources.some((source) => source.path === canonical4(configPath) && source.format === undefined && source.fields === undefined))
+      unresolved("retained review is missing the full agent configuration source");
+    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && source.path !== canonical4(configPath)))
+      unresolved("retained settings witness names another configuration source");
+    if (sources.some((source) => !retained.sources.some((saved) => isDeepStrictEqual3(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
+      unresolved("retained review is missing current runtime discovery coverage");
+    return retained;
+  }
   if (options.reviewed && (options.reviewed.version !== 1 || !Array.isArray(options.reviewed.agents) || options.reviewed.agents.some((item) => !item || typeof item !== "object") || new Set(options.reviewed.agents.map((item) => item.agent)).size !== options.reviewed.agents.length))
     throw new Error("Invalid --discovery-inputs version or agents");
   const review = options.reviewed?.agents.find((item) => item.agent === agent);
@@ -18560,7 +18593,7 @@ function resolveAgentDiscovery(options) {
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
-    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2") && source.path !== canonical4(configPath)))
+    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && source.path !== canonical4(configPath)))
       throw new Error("Semantic settings witnesses must name the configured Claude configuration source");
     if (!review.sources.some((source) => source.path === canonical4(configPath)))
       throw new Error("Discovery review must include the agent configuration source");
@@ -39070,8 +39103,8 @@ var SESSION_RECONCILIATION_PLAN_TTL_MS = 5 * 60 * 1000;
 // src/lib/claude-skills-coordination.ts
 function coordinateClaudeSettings(before, replacement, options) {
   const prior = JSON.parse(before ?? "{}"), next = JSON.parse(replacement);
-  const events = new Set([...Object.keys(prior.hooks ?? {}), ...Object.keys(next.hooks ?? {})]);
-  const changed = [...events].filter((event) => JSON.stringify(prior.hooks?.[event]) !== JSON.stringify(next.hooks?.[event]));
+  const events2 = new Set([...Object.keys(prior.hooks ?? {}), ...Object.keys(next.hooks ?? {})]);
+  const changed = [...events2].filter((event) => JSON.stringify(prior.hooks?.[event]) !== JSON.stringify(next.hooks?.[event]));
   const selected = changed.length ? changed : ["PreToolUse"];
   const plan = planClaudeHookEventsUpdate({
     ...options,
@@ -39359,7 +39392,7 @@ function detectConflict(name, scope, target) {
   const meta3 = isNativeSafetyName(name) ? getHook(name) : resolveHookMeta(name);
   if (!meta3 || !meta3.matcher)
     return;
-  const events = new Set(getHookEvents(meta3));
+  const events2 = new Set(getHookEvents(meta3));
   const registered = getRegisteredHooksForTarget(scope, target);
   for (const existingName of registered) {
     if (existingName === name)
@@ -39367,7 +39400,7 @@ function detectConflict(name, scope, target) {
     const existing = getHook(existingName);
     if (!existing || !existing.matcher)
       continue;
-    if (!getHookEvents(existing).some((event) => events.has(event)))
+    if (!getHookEvents(existing).some((event) => events2.has(event)))
       continue;
     if (matchersOverlap(meta3.matcher.toLowerCase(), existing.matcher.toLowerCase())) {
       return `conflicts with '${existingName}' (same event ${meta3.event}, overlapping matcher '${existing.matcher}')`;

package/dist/lib/native-safety.d.ts

@@ -12,5 +12,9 @@ export declare function isNativeSafetyName(name: string): name is NativeSafetyNa
 export declare function buildNativeSafetyCommand(binding: NativeSafetyBinding): string;
 export declare function nativeSafetyRegistration(command: string): NativeSafetyName | undefined;
 export declare function nativeSafetyCommandBinding(command: string): NativeSafetyBinding | undefined;
+/** Whether a saved supervisor command's pinned runtime and worker still verify
+ * on disk. `undefined` means the command is not a native-safety binding at all.
+ * Read-only: it never registers, rewrites or executes anything. */
+export declare function nativeSafetyBindingVerified(command: string): boolean | undefined;
 /** Built-in capability only: no registry, custom source, profile or app store. */
 export declare function installedNativeSafetyCommand(name: NativeSafetyName): string;

package/dist/native-safety.d.ts

@@ -43,6 +43,12 @@ export declare function readNativeSafetyRegistration(home?: string): {
     sha256: string;
     path: string;
 };
+/** Bounded, non-leaking explanation for a refused binding: which integrity
+ * property the saved record fails. A binding that a third party could rewrite
+ * can point the supervisor at a different worker, so its owner and mode are part
+ * of the trust decision, not decoration. Read-only — it never repairs, rewrites
+ * or executes anything, and returns undefined when the record looks intact. */
+export declare function nativeSafetyBindingIntegrityReason(home?: string): string | undefined;
 /** Register only the bundled composite guard. Updates preserve the exact prior
  * record and require its digest. A lock coordinates package-owned writers; an
  * unexpected preimage or a retained interrupted lock requires reconciliation. */

package/dist/native-safety.js

@@ -210,6 +210,23 @@ function readNativeSafetyRegistration(home = homedir2()) {
     throw new NativeSafetyError(error?.code === "ENOENT" ? "binding_missing" : "binding_invalid");
   }
 }
+function nativeSafetyBindingIntegrityReason(home = homedir2()) {
+  try {
+    const path = join2(canonicalHome(home), ".hasna/hooks/native", filename);
+    const stat = lstatSync2(path);
+    if (!stat.isFile())
+      return "the saved binding is not a regular file";
+    if (!owner(stat.uid))
+      return "the saved binding is not owned by the current user";
+    if (stat.mode & 63)
+      return `the saved binding is accessible by group or others (mode ${(stat.mode & 511).toString(8).padStart(3, "0")})`;
+    if (stat.size > 32768)
+      return "the saved binding exceeds its size bound";
+    return;
+  } catch (error) {
+    return error?.code === "ENOENT" ? "the saved binding is missing" : undefined;
+  }
+}
 function registerNativeSafety(options = {}) {
   const home = canonicalHome(options.home ?? homedir2());
   const record = { schema: "hasna.hooks.native-safety.v1", harness: "sumi", command: options.command ?? installedNativeSafetyCommand("trash-guard") };
@@ -395,6 +412,7 @@ export {
   verifyNativeSafetyCommand,
   registerNativeSafety,
   readNativeSafetyRegistration,
+  nativeSafetyBindingIntegrityReason,
   evaluateNativeSafetyForExecution,
   evaluateNativeSafety,
   NativeSafetyError

package/hooks/hook-workspace-repos-guard/README.md

@@ -45,6 +45,21 @@ a newline or `||` the `cd` may have failed, so the earlier directories stay
 in scope. A `cd` inside `( ... )`, a pipeline or the background does not move
 it, and neither does a `cd` whose target cannot be resolved statically.
 Descriptor duplication (`2>&1`, `>&2`, `1>&-`) is not a write.
+Each pipeline stage is classified on its own, with its output redirections
+split off: `ls <root> 2>/dev/null | head` reads `<root>`, and the trailing
+word of a later read-only stage (`| head -60`) is never taken as the write
+target of an earlier stage. Pipes inside quotes or command substitutions are
+not stage boundaries.
+A protected path named anywhere in a pipeline takes the strongest operation
+of any stage (`find <root>/x | xargs rm -rf` is a delete). Deletes,
+`mkdir`/`touch`, `tee`, `truncate`, `install`, `mv` and `sed -i` check every
+operand (options end at `--` or at the first operand); other writers check
+their last one, plus any `-t`/`--target-directory` value. A delete tool's
+subcommand word is not an operand (`trash put <path>`, `git rm <path>`).
+An operand or redirect target that cannot be read statically (a variable
+other than `$HOME`, `$( )`, backticks, a glob) fails closed to the directory
+the command runs in, so `rm -rf "$TMPDIR/x"` run from a protected checkout is
+refused. Use a literal absolute path for deletes outside the roots.
 
 ## Configuration