@hasna/hooks 0.10.7 → 0.10.9

package/hooks/hook-workspace-repos-guard/src/hook.ts

@@ -32,6 +32,8 @@
  * redirection operands) are resolved against the directory the segment runs
  * in: the command's cwd, narrowed by a plain `cd` only across `&&` (see
  * bashTargets). Descriptor duplication (`2>&1`, `>&2`) is not a write.
+ * Each pipeline stage is classified on its own, with its redirections split
+ * off, so a later read-only stage never supplies an earlier stage's target.
  * apply_patch tools are inspected through their `*** Add File:` /
  * `*** Update File:` / `*** Delete File:` markers. Parenthesized command
  * groups are unwrapped.
@@ -215,6 +217,140 @@ function withoutFdDuplication(segment: string): string {
   return segment.replace(FD_DUPLICATION, " ");
 }
 
+/**
+ * Split one command segment into its pipeline stages at every unquoted `|`
+ * (and `|&`) that sits outside quotes, backticks, every parenthesis (`$( )`,
+ * `$(( ))`, `<( )`, `>( )`, `( )`) and every `${ }` expansion. The `|` of a
+ * `>|` clobber redirect is not a pipe, and `||` never reaches here because
+ * bashTargets splits on it first. When quoting, parentheses or braces do not
+ * balance, the segment is returned whole (fail closed to the whole-segment
+ * classification).
+ */
+export function pipelineStages(segment: string): string[] {
+  const stages: string[] = [];
+  let quote: "'" | '"' | null = null;
+  let parens = 0;
+  let braces = 0;
+  let backtick = false;
+  let start = 0;
+  for (let i = 0; i < segment.length; i++) {
+    const ch = segment[i];
+    if (quote === "'") {
+      if (ch === "'") quote = null;
+      continue;
+    }
+    if (ch === "\\") {
+      i++;
+      continue;
+    }
+    if (ch === "(") {
+      parens++;
+      continue;
+    }
+    if (ch === ")") {
+      if (--parens < 0) return [segment];
+      continue;
+    }
+    if (ch === "$" && segment[i + 1] === "{") {
+      braces++;
+      i++;
+      continue;
+    }
+    if (ch === "}" && braces > 0) {
+      braces--;
+      continue;
+    }
+    if (ch === "\x60") {
+      backtick = !backtick;
+      continue;
+    }
+    if (quote === '"') {
+      if (ch === '"') quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      continue;
+    }
+    if (ch !== "|" || parens > 0 || braces > 0 || backtick || segment[i - 1] === ">") continue;
+    stages.push(segment.slice(start, i));
+    if (segment[i + 1] === "&") i++;
+    start = i + 1;
+  }
+  if (quote || parens !== 0 || braces !== 0 || backtick) return [segment];
+  stages.push(segment.slice(start));
+  return stages;
+}
+
+interface ShellWord {
+  text: string;
+  opaque: boolean;
+}
+
+/**
+ * Split a command into shell words, honouring single and double quotes and
+ * backslash escapes, and removing the quotes. A word is opaque when its
+ * value cannot be read statically: it holds an expansion other than a
+ * leading `$HOME`/`${HOME}`, a command substitution, a backtick, a glob or
+ * an unbalanced quote.
+ */
+function shellWords(command: string): ShellWord[] {
+  const words: ShellWord[] = [];
+  let text = "";
+  let raw = "";
+  let quote: "'" | '"' | null = null;
+  let inWord = false;
+  const flush = () => {
+    if (!inWord) return;
+    const body = raw.replace(/^"?\$\{?HOME\}?"?(?=\/|$)/, "");
+    // Bash expands `~` only when the whole tilde prefix (up to the first
+    // unquoted `/`) is unquoted and unescaped. `~"/x"`, `~\/x` and `~""`
+    // name an entry called `~` in the current directory.
+    const literalTilde = text.startsWith("~") && !/^~(?:\/|$)/.test(raw);
+    words.push({ text: literalTilde ? `./${text}` : text, opaque: /[$\x60*?[]/.test(body) || /[()]/.test(body) });
+    text = "";
+    raw = "";
+    inWord = false;
+  };
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (quote === "'") {
+      if (ch === "'") quote = null;
+      else text += ch;
+      raw += ch;
+      continue;
+    }
+    if (ch === "\\" && i + 1 < command.length) {
+      const next = command[i + 1];
+      // Inside double quotes a backslash escapes only $ ` " \ and newline.
+      text += quote === '"' && !/[$\x60"\\\n]/.test(next) ? ch + next : next;
+      raw += ch + next;
+      inWord = true;
+      i++;
+      continue;
+    }
+    if (quote === '"') {
+      if (ch === '"') quote = null;
+      else text += ch;
+      raw += ch;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      flush();
+      continue;
+    }
+    inWord = true;
+    raw += ch;
+    if (ch === "'" || ch === '"') quote = ch;
+    else text += ch;
+  }
+  if (quote) {
+    raw += "$";
+  }
+  flush();
+  return words;
+}
+
 /**
  * Classify the operation of one command segment (a `&&`/`||`/`;`-delimited
  * unit). Git is handled by its subcommand: clean|rm delete, clone|init write,
@@ -229,13 +365,13 @@ function segmentOperation(segment: string): Operation {
   const trimmed = segment.trim();
   if (!trimmed) return "read";
 
-  if (/(?:^|\s)(?:rm|rmdir|unlink|shred|trash|rmtree|del)(?:\s|$)/.test(trimmed)) return "delete";
+  if (/(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:rm|rmdir|unlink|shred|trash|rmtree|del)(?:\s|$)/.test(trimmed)) return "delete";
   if (/\bgit\b/.test(trimmed)) {
     if (/\bgit\b[^;&|]*\b(?:clean|rm)\b/.test(trimmed)) return "delete";
     if (/\bgit\b[^;&|]*\b(?:clone|init)\b/.test(trimmed)) return "write";
     return "read";
   }
-  if (/(?:^|\s)(?:mkdir|mkfile|touch|mv|cp|ln|tee|install|dd)(?:\s|$)/.test(trimmed)) return "write";
+  if (/(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:mkdir|mkfile|touch|mv|cp|ln|tee|install|dd)(?:\s|$)/.test(trimmed)) return "write";
   if (/\b(?:curl|wget)\b/.test(trimmed)) {
     if (WRITE_FLAGS.test(trimmed)) return "write";
     return "read";
@@ -364,7 +500,6 @@ export function bashTargets(command: string, home: string, cwd: string): PathTar
     for (let i = 0; i < opens; i++) subshells.push({ current: [...current], reachable: new Set(reachable), certain });
 
     const segment = unwrapSegment(rawSegment);
-    const op = segmentOperation(segment);
 
     const plainCd = segment.match(/^cd(?:\s+(?:-[A-Za-z@]+|--))*(?:\s+([^\s;&|<>()\x60]+))?$/);
     const embeddedCd = plainCd ? null : segment.match(/(?:^|\s)cd(?:\s+(?:-[A-Za-z]+|--))*\s+([^\s;&|<>()\x60]+)/);
@@ -380,27 +515,134 @@ export function bashTargets(command: string, home: string, cwd: string): PathTar
     const suffix = roots.map((root) => regexEscape(root.slice(home.length + 1))).join("|");
     const prefixRe = new RegExp(`(?:~|\\$HOME"*|\\$\\{HOME\\}"*|${homeLiteral}"*)/(?:${suffix})`);
     const re = new RegExp(`(${prefixRe.source})([^\\s"';&|<>()\x60]*|$)`, "g");
-    let m: RegExpExecArray | null;
-    let foundExplicit = false;
-    while ((m = re.exec(segment)) !== null) {
-      foundExplicit = true;
-      const expanded = expandHomeSpelling(m[0], home);
-      targets.push({ path: normalize(expanded).replace(/\/+$/, ""), op });
-    }
+    const explicitTargets = (text: string): string[] => {
+      const found: string[] = [];
+      let m: RegExpExecArray | null;
+      re.lastIndex = 0;
+      while ((m = re.exec(text)) !== null) found.push(normalize(expandHomeSpelling(m[0], home)).replace(/\/+$/, ""));
+      return found;
+    };
 
-    if (!foundExplicit && (op === "delete" || op === "write")) {
+    // Each pipeline stage is classified on its own, with its output
+    // redirections split off: a redirect operand is a write on that operand
+    // only, so `ls <root> 2>/dev/null | head` reads <root>. A stage's relative
+    // trailing operand counts only when that stage's own command writes or
+    // deletes, so the last word of a later read-only stage (`| head -60`) is
+    // never taken as the write target of an earlier stage.
+    const stages = pipelineStages(segment).map((stage) => {
       const operands: string[] = [];
-      const commandPart = withoutFdDuplication(segment).replace(OUTPUT_REDIRECT, (_match, operand: string) => {
+      // A redirect whose target cannot be read statically (empty, or built
+      // from `$...`/`$( )`/backticks) may write anywhere, including a
+      // protected path the stage names: the stage then counts as a write.
+      let opaqueRedirect = false;
+      const commandPart = withoutFdDuplication(stage).replace(OUTPUT_REDIRECT, (_match, operand: string) => {
+        if (!operand || /[$\x60]/.test(operand)) opaqueRedirect = true;
         if (operand) operands.push(operand);
         return " ";
       });
       const commandOp = segmentOperation(commandPart);
-      const relMatch = commandOp === "read" ? null : commandPart.match(REL_OPERAND);
-      for (const base of current.filter(underRoot)) {
-        for (const operand of operands) {
+      return { commandPart, operands, op: opaqueRedirect && commandOp === "read" ? ("write" as Operation) : commandOp };
+    });
+
+    // A protected path named in one stage can be acted on by another
+    // (`find <root>/x | xargs rm -rf`, `printf <root>/x | xargs mkdir`), so
+    // every explicit path outside a redirect operand takes the strongest
+    // operation of any stage's command. Only redirects are attributed to
+    // their own operand.
+    const pipelineOp: Operation = stages.some((stage) => stage.op === "delete")
+      ? "delete"
+      : stages.some((stage) => stage.op === "write")
+        ? "write"
+        : "read";
+    const bases = current.filter(underRoot);
+    for (const stage of stages) {
+      let foundExplicit = false;
+      for (const path of explicitTargets(stage.commandPart)) {
+        foundExplicit = true;
+        targets.push({ path, op: pipelineOp });
+      }
+      // Every redirect operand is a write: an explicit protected path as
+      // named, and any other operand resolved against each protected
+      // directory the stage can run in, whether or not the stage also names
+      // a protected path.
+      for (const operand of stage.operands) {
+        const explicit = explicitTargets(operand);
+        for (const path of explicit) targets.push({ path, op: "write" });
+        if (explicit.length > 0) continue;
+        for (const base of bases) {
           targets.push({ path: normalize(resolve(base, expandHomeSpelling(operand, home))), op: "write" });
         }
-        if (relMatch) targets.push({ path: normalize(resolve(base, relMatch[1])), op: commandOp });
+      }
+      if (foundExplicit || stage.op === "read") continue;
+      // A writing or deleting stage that names no protected path acts on its
+      // trailing operand, resolved against each protected directory it can
+      // run in. When no operand can be read statically (quoted, `$( )`), it
+      // fails closed to that directory itself.
+      // Deletes, mkdir/touch, tee, truncate, install, mv and sed -i act on
+      // every operand, so each operand word counts; other writers (cp, ln,
+      // ...) act on their last one. A word that cannot be read statically
+      // fails closed to the directory.
+      const words = shellWords(stage.commandPart);
+      // Operands after the command word. Options end at `--` or, as BSD
+      // getopt does, at the first operand: every later word is an operand
+      // even when it starts with `-`.
+      // A delete tool's subcommand word is not an operand: `trash put <path>`
+      // and `git [-C dir] rm|clean ...` act on the words after it.
+      let operandStart = 1;
+      const tool = (words[0]?.text ?? "").split("/").pop();
+      if (tool === "trash" && ["put", "rm", "delete", "remove"].includes(words[1]?.text ?? "")) operandStart = 2;
+      if (tool === "git") {
+        const sub = words.findIndex((word, index) => index > 0 && (word.text === "rm" || word.text === "clean"));
+        if (sub > 0) operandStart = sub + 1;
+      }
+      let endOfOptions = false;
+      const nonFlag = words.slice(operandStart).flatMap((word) => {
+        if (!endOfOptions && word.text === "--") {
+          endOfOptions = true;
+          return [];
+        }
+        if (!endOfOptions && word.text.startsWith("-")) return [];
+        endOfOptions = true;
+        return [word.opaque ? "." : word.text];
+      });
+      // mv changes its sources too, so every mv operand counts as a write.
+      const everyOperand =
+        stage.op === "delete" ||
+        /(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:mkdir|mkfile|touch|tee|truncate|install|mv)(?:\s|$)/.test(stage.commandPart) ||
+        (/(?:^|\s)sed(?:\s|$)/.test(stage.commandPart) && /(?:^|\s)(?:-i\S*|--in-place\S*)(?:\s|$)/.test(stage.commandPart));
+      const operandTargets: Array<{ operand: string; op: Operation }> = [];
+      if (everyOperand) {
+        for (const operand of nonFlag.length > 0 ? nonFlag : ["."]) operandTargets.push({ operand, op: stage.op });
+      } else {
+        const relMatch = stage.commandPart.match(REL_OPERAND);
+        const last = words.at(-1);
+        operandTargets.push({ operand: relMatch ? relMatch[1] : !last || last.opaque ? "." : last.text, op: stage.op });
+        // cp/ln/install/mv -t DIR write into DIR: `-t DIR`, `-tDIR`, `-t` in
+        // a short-flag cluster (`-rt DIR`, `-rtDIR`) and any abbreviation of
+        // `--target-directory[=]DIR` (GNU).
+        if (/(?:^|\s)(?:cp|ln|install|mv)(?:\s|$)/.test(stage.commandPart)) {
+          words.forEach((word, index) => {
+            let value: ShellWord | undefined;
+            const short = word.text.match(/^-[A-Za-z]*?t(.*)$/);
+            const long = word.text.match(/^(--t[a-z-]*)(?:=(.*))?$/);
+            if (short && !word.text.startsWith("--")) {
+              value = short[1] ? { text: short[1], opaque: word.opaque } : words[index + 1];
+            } else if (long && "--target-directory".startsWith(long[1])) {
+              value = long[2] !== undefined ? { text: long[2], opaque: word.opaque } : words[index + 1];
+            }
+            if (value) operandTargets.push({ operand: value.opaque || !value.text ? "." : value.text, op: stage.op });
+          });
+        }
+        // An inline script (python3 -c, node -e, bun -e) can write anywhere
+        // relative to where it runs, whatever its arguments.
+        if (/(?:^|\s)(?:python3?|node|bun)\b[^;&|]*\s+-[ce](?:\s|$)/.test(stage.commandPart)) {
+          operandTargets.push({ operand: ".", op: stage.op });
+        }
+      }
+      for (const base of bases) {
+        for (const { operand, op } of operandTargets) {
+          targets.push({ path: normalize(resolve(base, expandHomeSpelling(operand, home))), op });
+        }
       }
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/hooks",
-  "version": "0.10.7",
+  "version": "0.10.9",
   "description": "Open source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command",
   "type": "module",
   "bin": {
@@ -64,7 +64,7 @@
     "@hasna/contracts": "~1.2.1"
   },
   "dependencies": {
-    "@hasna/skills": "0.9.14",
+    "@hasna/skills": "0.9.17",
     "@hasna/events": "^0.1.16",
     "@hasna/secrets": "0.4.2",
     "@modelcontextprotocol/sdk": "^1.26.0",

package/scripts/ensure-profiles-dir.mjs

@@ -5,7 +5,13 @@
 // resolver data root once adopted (HASNA_DATA_HOME set or hooks.db already
 // present there), then the legacy ~/.hasna/hooks default. Best-effort — the
 // package must never fail to install because this script cannot run.
+//
+// It also provisions the required Sumi native-safety binding for the installing
+// user (see the second block below). Same best-effort contract.
 import { existsSync, mkdirSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { dirname } from "node:path";
 // --- Local path resolver -------------------------------------------------
 // @hasna/paths was deleted (hasna/apps#1535, 2026-09-03); this in-package
 // implementation preserves the resolver contract (XDG / macOS home layout
@@ -58,7 +64,7 @@ function dataDir(options) {
   return pathsResolverResolve("data", options);
 }
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { join, resolve, sep } from "node:path";
 
 const HOME = process.env.HOME || process.env.USERPROFILE || homedir();
 
@@ -97,3 +103,61 @@ try {
 } catch {
   // ignore
 }
+
+/**
+ * The bun runtime that must execute the provisioning entry: the package's own
+ * bin targets are bun bundles (`#!/usr/bin/env bun`) and `installedNativeSafetyCommand`
+ * pins `process.execPath`, so the runtime that runs this decides the binding.
+ * Well-known install locations first, then PATH; null when neither exists.
+ */
+function resolveBun() {
+  const wellKnown = [
+    process.env.BUN_INSTALL ? join(process.env.BUN_INSTALL, "bin", "bun") : null,
+    join(HOME, ".bun", "bin", "bun"),
+  ];
+  for (const candidate of wellKnown) {
+    if (candidate && existsSync(candidate)) return candidate;
+  }
+  return spawnSync("bun", ["--version"], { encoding: "utf8" }).status === 0 ? "bun" : null;
+}
+
+// ---------------------------------------------------------------------------
+// Required Sumi native-safety binding (hasna/apps incidents 798053).
+//
+// Sumi refuses EVERY shell command while
+// `~/.hasna/hooks/native/sumi-trash-guard.json` is absent, and neither a package
+// install nor an upgrade used to create it: a rollout could install this package
+// and still leave every Sumi seat on the station without a shell.
+//
+// The packaged CLI owns the policy (`hooks safety provision`, also applied by
+// `hooks install` and `hooks upgrade`): idempotent, a healthy existing binding is
+// left intact, a stale one is replaced with its predecessor preserved beside it,
+// and an unrecognized one is refused rather than overwritten. This lifecycle
+// surface only reaches installs whose scripts actually run — bun blocks
+// lifecycle scripts for untrusted dependencies and `--ignore-scripts` skips
+// them, which is why the CLI surfaces apply the same policy.
+//
+// Two gates keep a source checkout from touching the operator's home: the
+// package must be an INSTALLED copy (inside a node_modules directory) and its
+// built CLI must exist. Best-effort — install never fails on a native guard.
+try {
+  const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+  const cli = join(packageRoot, "bin", "index.js");
+  if (packageRoot.includes(`${sep}node_modules${sep}`) && existsSync(cli)) {
+    const bun = resolveBun();
+    if (!bun) {
+      process.stderr.write("[@hasna/hooks] Sumi native-safety binding not provisioned: no bun runtime found; run `hooks safety provision`.\n");
+    } else {
+      const provisioned = spawnSync(bun, [cli, "safety", "provision", "--target", "sumi"], {
+        encoding: "utf8", timeout: 60_000, env: { ...process.env, HOME },
+      });
+      let result = null;
+      try { result = JSON.parse(provisioned.stdout?.trim() ?? ""); } catch { /* reported below */ }
+      if (!result?.ok) {
+        process.stderr.write(`[@hasna/hooks] Sumi native-safety binding not provisioned (${result?.code ?? "provision_failed"}); run \`hooks safety provision\` on this station before a Sumi seat needs its shell.\n`);
+      }
+    }
+  }
+} catch {
+  // ignore
+}