@hasna/hooks 0.11.1 → 0.11.2

package/bin/index.js

@@ -2516,7 +2516,7 @@ var init_codex_settings = __esm(() => {
   snapshots = new WeakMap;
 });
 
-// node_modules/@hasna/skills/dist/index.js
+// ../../../../../../../../.bun/install/cache/@hasna/skills@0.9.17@@@1/dist/index.js
 import { existsSync as existsSync10 } from "fs";
 import { homedir as homedir6 } from "os";
 import { join as join10, resolve as resolve4 } from "path";
@@ -35248,7 +35248,7 @@ var init_codex_safety_check = __esm(() => {
   init_native_safety();
   init_native_readiness_command();
   init_native_safety2();
-  versions = new Set(["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1"]);
+  versions = new Set(["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1"]);
   CodexSafetyError = class CodexSafetyError extends Error {
     code;
     constructor(code2) {
@@ -35489,7 +35489,7 @@ var init_codex_safety_trust = __esm(() => {
   };
 });
 
-// node_modules/commander/lib/error.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/commander@12.1.0/node_modules/commander/lib/error.js
 var require_error = __commonJS((exports) => {
   class CommanderError extends Error {
     constructor(exitCode, code2, message) {
@@ -35513,7 +35513,7 @@ var require_error = __commonJS((exports) => {
   exports.InvalidArgumentError = InvalidArgumentError;
 });
 
-// node_modules/commander/lib/argument.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/commander@12.1.0/node_modules/commander/lib/argument.js
 var require_argument = __commonJS((exports) => {
   var { InvalidArgumentError } = require_error();
 
@@ -35592,7 +35592,7 @@ var require_argument = __commonJS((exports) => {
   exports.humanReadableArgName = humanReadableArgName;
 });
 
-// node_modules/commander/lib/help.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/commander@12.1.0/node_modules/commander/lib/help.js
 var require_help = __commonJS((exports) => {
   var { humanReadableArgName } = require_argument();
 
@@ -35841,7 +35841,7 @@ var require_help = __commonJS((exports) => {
   exports.Help = Help;
 });
 
-// node_modules/commander/lib/option.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/commander@12.1.0/node_modules/commander/lib/option.js
 var require_option = __commonJS((exports) => {
   var { InvalidArgumentError } = require_error();
 
@@ -35992,7 +35992,7 @@ var require_option = __commonJS((exports) => {
   exports.DualOptions = DualOptions;
 });
 
-// node_modules/commander/lib/suggestSimilar.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/commander@12.1.0/node_modules/commander/lib/suggestSimilar.js
 var require_suggestSimilar = __commonJS((exports) => {
   var maxDistance = 3;
   function editDistance(a, b) {
@@ -36065,7 +36065,7 @@ var require_suggestSimilar = __commonJS((exports) => {
   exports.suggestSimilar = suggestSimilar;
 });
 
-// node_modules/commander/lib/command.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/commander@12.1.0/node_modules/commander/lib/command.js
 var require_command = __commonJS((exports) => {
   var EventEmitter = __require("events").EventEmitter;
   var childProcess = __require("child_process");
@@ -37308,7 +37308,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
   exports.Command = Command;
 });
 
-// node_modules/commander/index.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/commander@12.1.0/node_modules/commander/index.js
 var require_commander = __commonJS((exports) => {
   var { Argument } = require_argument();
   var { Command } = require_command();
@@ -37328,7 +37328,7 @@ var require_commander = __commonJS((exports) => {
   exports.InvalidOptionArgumentError = InvalidArgumentError;
 });
 
-// node_modules/cli-spinners/spinners.json
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/cli-spinners@2.9.2/node_modules/cli-spinners/spinners.json
 var require_spinners = __commonJS((exports, module) => {
   module.exports = {
     dots: {
@@ -38954,7 +38954,7 @@ var require_spinners = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/cli-spinners/index.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/cli-spinners@2.9.2/node_modules/cli-spinners/index.js
 var require_cli_spinners = __commonJS((exports, module) => {
   var spinners = Object.assign({}, require_spinners());
   var spinnersList = Object.keys(spinners);
@@ -39035,10 +39035,10 @@ var init_redact = __esm(() => {
 
 // src/lib/profiles.ts
 import { existsSync as existsSync14, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync12, readdirSync as readdirSync8, rmSync, cpSync as cpSync2 } from "fs";
-import { join as join27 } from "path";
+import { join as join29 } from "path";
 function getProfilesDir() {
-  const newDir = join27(getEffectiveDataRoot(), "profiles");
-  const oldDir = join27(getHomeDir(), ".hooks", "profiles");
+  const newDir = join29(getEffectiveDataRoot(), "profiles");
+  const oldDir = join29(getHomeDir(), ".hooks", "profiles");
   if (!existsSync14(newDir) && existsSync14(oldDir)) {
     mkdirSync13(newDir, { recursive: true });
     cpSync2(oldDir, newDir, { recursive: true });
@@ -39052,7 +39052,7 @@ function ensureProfilesDir() {
   }
 }
 function profilePath(id) {
-  return join27(getProfilesDir(), `${id}.json`);
+  return join29(getProfilesDir(), `${id}.json`);
 }
 function shortUuid() {
   return crypto.randomUUID().slice(0, 8);
@@ -39094,7 +39094,7 @@ function listProfiles() {
     const profiles = [];
     for (const file2 of files) {
       try {
-        const content = readFileSync19(join27(dir, file2), "utf-8");
+        const content = readFileSync19(join29(dir, file2), "utf-8");
         profiles.push(JSON.parse(content));
       } catch {}
     }
@@ -39138,18 +39138,18 @@ var init_profiles = __esm(() => {
   init_app_home();
 });
 
-// node_modules/@hasna/contracts/dist/client/transport.js
-import { isIP } from "net";
+// ../../../../codex0157-source-repair/isolated-build/repo/apps/hooks/node_modules/@hasna/contracts/dist/client/transport.js
+import { isIP as isIP2 } from "net";
 import { spawnSync as spawnSync2 } from "child_process";
 import { closeSync as closeSync22, fstatSync as fstatSync22, openSync as openSync22, readFileSync as readFileSync22 } from "fs";
 import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";
 import { hostname as osHostname } from "os";
 import { isAbsolute as isAbsolute21, join as join28 } from "path";
-import { createRequire as createRequire2 } from "module";
+import { createRequire as createRequire3 } from "module";
 import { fileURLToPath as fileURLToPath22 } from "url";
 import { closeSync as closeSync20, fstatSync as fstatSync19, lstatSync as lstatSync24, openSync as openSync20, readFileSync as readFileSync20, realpathSync as realpathSync12, statSync as statSync2 } from "fs";
 import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
-import { basename as basename9, dirname as dirname22, join as join29, relative as relative5, sep as sep6 } from "path";
+import { basename as basename9, dirname as dirname22, join as join30, relative as relative5, sep as sep6 } from "path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL } from "url";
 function envToken2(name) {
   return name.toUpperCase().replace(/-/g, "_");
@@ -39224,11 +39224,11 @@ function o(e2, r2, t2) {
 }
 function entryPoint(directory2) {
   const root = realpathSync12(directory2);
-  const fd = openSync20(join29(root, "package.json"), O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+  const fd = openSync20(join30(root, "package.json"), O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
   let pkg;
   try {
     const stat2 = fstatSync19(fd);
-    if (!stat2.isFile() || stat2.size > MAX_PACKAGE_BYTES2)
+    if (!stat2.isFile() || stat2.size > MAX_PACKAGE_BYTES3)
       throw new Error("Invalid Secrets package metadata");
     pkg = JSON.parse(readFileSync20(fd, "utf8"));
   } finally {
@@ -39244,7 +39244,7 @@ function entryPoint(directory2) {
   if (/[\\%?#\0]/.test(target) || parts.some((part) => !part || part === "." || part === ".." || part === "node_modules")) {
     throw new Error("Invalid Secrets import export");
   }
-  const file2 = realpathSync12(join29(root, ...parts));
+  const file2 = realpathSync12(join30(root, ...parts));
   const within = relative5(root, file2);
   if (!within || within === ".." || within.startsWith(`..${sep6}`) || !statSync2(file2).isFile()) {
     throw new Error("Secrets import export escapes its package or is not a file");
@@ -39255,7 +39255,7 @@ function resolveInstalledSecrets(parentUrl) {
   let directory2 = dirname22(fileURLToPath3(parentUrl));
   for (;; ) {
     if (basename9(directory2) !== "node_modules") {
-      const candidate = join29(directory2, "node_modules", PACKAGE);
+      const candidate = join30(directory2, "node_modules", PACKAGE);
       let absent = false;
       try {
         lstatSync24(candidate);
@@ -39375,7 +39375,7 @@ function readAppConfigFile(path) {
     const uid2 = process.getuid?.() ?? process.geteuid?.();
     if (uid2 !== undefined && before.uid !== uid2)
       unsafe("the file is not owned by the current user");
-    if (before.size > MAX_CREDENTIAL_FILE_BYTES2)
+    if (before.size > MAX_CREDENTIAL_FILE_BYTES3)
       unsafe("the file exceeds the size limit");
     const bytes = readFileSync22(fd);
     const after = fstatSync22(fd);
@@ -39467,13 +39467,13 @@ function sealCredential(fields) {
       configurable: false
     });
   }
-  Object.defineProperty(sealed, INSPECT_CUSTOM2, {
+  Object.defineProperty(sealed, INSPECT_CUSTOM3, {
     value: () => ({ ...visible, apiKey: "[redacted]" }),
     enumerable: false,
     writable: false,
     configurable: false
   });
-  Object.defineProperty(sealed, CREDENTIAL_SEAL2, {
+  Object.defineProperty(sealed, CREDENTIAL_SEAL3, {
     value: true,
     enumerable: false,
     writable: false,
@@ -39504,7 +39504,7 @@ function firstEnvValue(env, keys2) {
   return null;
 }
 function isAmbientEnvironment(env) {
-  return env === process.env || env[AMBIENT_ENVIRONMENT2] === true;
+  return env === process.env || env[AMBIENT_ENVIRONMENT3] === true;
 }
 function defaultKeychainRunner(argv) {
   const result = spawnSync2(KEYCHAIN_SECURITY_BIN, [...argv], {
@@ -39598,7 +39598,7 @@ function snapshotClientEnvironment(name, env) {
     snapshot2[key] = descriptor.value;
   }
   if (ambient) {
-    Object.defineProperty(snapshot2, AMBIENT_ENVIRONMENT2, {
+    Object.defineProperty(snapshot2, AMBIENT_ENVIRONMENT3, {
       value: true,
       enumerable: false,
       writable: false,
@@ -39771,7 +39771,7 @@ async function completePointerCredential(name, pointerResolution, env = process.
   let secretsSdk;
   try {
     const sdkUrl = resolveInstalledSecrets(import.meta.url);
-    secretsSdk = requireSecretsSdk2(fileURLToPath22(sdkUrl));
+    secretsSdk = requireSecretsSdk3(fileURLToPath22(sdkUrl));
   } catch {
     throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets SDK (@hasna/secrets) is not installed ` + `in this process. A vault pointer is TERMINAL: install @hasna/secrets to resolve it, or unset ${pointerEnvKey}.`, [pointerEnvKey]);
   }
@@ -39855,7 +39855,7 @@ function canonicalAuthorityHostname(authority) {
       }
       assertCanonicalPort(portSuffix.slice(1));
     }
-    if (isIP(rawHostname.slice(1, -1)) !== 6) {
+    if (isIP2(rawHostname.slice(1, -1)) !== 6) {
       throw new Error("API URL authority must contain a canonical IPv6 literal.");
     }
   } else {
@@ -39871,7 +39871,7 @@ function canonicalAuthorityHostname(authority) {
     } else {
       rawHostname = authority;
     }
-    const ipVersion = isIP(rawHostname);
+    const ipVersion = isIP2(rawHostname);
     const numericAddressParts = rawHostname.split(".");
     const looksLikeNonCanonicalIpv4 = numericAddressParts.every((part) => /^(?:0x[0-9a-f]+|[0-9]+)$/i.test(part));
     if (ipVersion !== 4 && looksLikeNonCanonicalIpv4 || ipVersion !== 4 && !isValidDnsDomain(rawHostname.toLowerCase())) {
@@ -40007,9 +40007,9 @@ function credentialDiskSourcesForMessage(name, env) {
   const paths = credentialDiskSources(name, env);
   return paths.length > 0 ? paths.join(" or ") : "<no HOME or HASNA_HOME set in this environment, so no credential file was consulted>";
 }
-var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", PACKAGE = "@hasna/secrets", MAX_PACKAGE_BYTES2, CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES2, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM2, CREDENTIAL_SEAL2, AMBIENT_ENVIRONMENT2, requireSecretsSdk2, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", DEFAULT_AUTHORITY_SOURCE = "default", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, ClientTransportConfigurationError, IDEMPOTENT_METHODS2, AUTHORITY_OVERRIDE_HEADERS2;
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", PACKAGE = "@hasna/secrets", MAX_PACKAGE_BYTES3, CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES3, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM3, CREDENTIAL_SEAL3, AMBIENT_ENVIRONMENT3, requireSecretsSdk3, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", DEFAULT_AUTHORITY_SOURCE = "default", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, ClientTransportConfigurationError, IDEMPOTENT_METHODS3, AUTHORITY_OVERRIDE_HEADERS3;
 var init_transport = __esm(() => {
-  MAX_PACKAGE_BYTES2 = 1024 * 1024;
+  MAX_PACKAGE_BYTES3 = 1024 * 1024;
   CredentialResolutionError = class CredentialResolutionError extends Error {
     appName;
     attempted;
@@ -40028,16 +40028,16 @@ var init_transport = __esm(() => {
       this.path = path;
     }
   };
-  MAX_CREDENTIAL_FILE_BYTES2 = 64 * 1024;
+  MAX_CREDENTIAL_FILE_BYTES3 = 64 * 1024;
   SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
   SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
   ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
   VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
   CREDENTIAL_SHAPED_KEY = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)(?:_|$)/;
-  INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
-  CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
-  AMBIENT_ENVIRONMENT2 = Symbol.for("hasna:contracts:ambientClientEnvironment");
-  requireSecretsSdk2 = createRequire2(import.meta.url);
+  INSPECT_CUSTOM3 = Symbol.for("nodejs.util.inspect.custom");
+  CREDENTIAL_SEAL3 = Symbol.for("hasna:contracts:sealedCredential");
+  AMBIENT_ENVIRONMENT3 = Symbol.for("hasna:contracts:ambientClientEnvironment");
+  requireSecretsSdk3 = createRequire3(import.meta.url);
   ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
   DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
   ClientTransportConfigurationError = class ClientTransportConfigurationError extends Error {
@@ -40050,8 +40050,8 @@ var init_transport = __esm(() => {
       this.sources = Object.freeze([...sources]);
     }
   };
-  IDEMPOTENT_METHODS2 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
-  AUTHORITY_OVERRIDE_HEADERS2 = new Set([
+  IDEMPOTENT_METHODS3 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+  AUTHORITY_OVERRIDE_HEADERS3 = new Set([
     "host",
     ":authority",
     "forwarded",
@@ -40562,7 +40562,7 @@ __export(exports_run, {
 });
 import { randomBytes as randomBytes2 } from "crypto";
 import { rmSync as rmSync2, writeFileSync as writeFileSync13 } from "fs";
-import { basename as basename11, dirname as dirname24, isAbsolute as isAbsolute25, join as join30 } from "path";
+import { basename as basename11, dirname as dirname24, isAbsolute as isAbsolute25, join as join31 } from "path";
 function extensionOf(scriptPath) {
   const base = basename11(scriptPath);
   const dot = base.lastIndexOf(".");
@@ -40633,7 +40633,7 @@ async function readPipeWithDeadline(stream, deadlineMs) {
 async function executeVerifiedScript(options) {
   const scriptDir = dirname24(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
-  const tempPath = join30(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
+  const tempPath = join31(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
   let timedOut = false;
   const timeoutTimer = options.timeout ? setTimeout(() => {
@@ -40725,10 +40725,10 @@ __export(exports_custom_install, {
   ensureCustomDir: () => ensureCustomDir
 });
 import { existsSync as existsSync16, mkdirSync as mkdirSync14, mkdtempSync, readFileSync as readFileSync21, rmSync as rmSync4 } from "fs";
-import { join as join31 } from "path";
+import { join as join32 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 function manifestAt(dir) {
-  const path = join31(dir, "manifest.json");
+  const path = join32(dir, "manifest.json");
   if (!existsSync16(path))
     return;
   try {
@@ -40751,8 +40751,8 @@ function writeFromManifest(manifest, srcDir, source, kind) {
   return { name, version: manifest.version, kind, source, dir, scriptPath };
 }
 async function cloneToTemp(gitUrl) {
-  const tmp = mkdtempSync(join31(tmpdir2(), "hooks-install-"));
-  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join31(tmp, "repo")], {
+  const tmp = mkdtempSync(join32(tmpdir2(), "hooks-install-"));
+  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join32(tmp, "repo")], {
     stdout: "pipe",
     stderr: "pipe"
   });
@@ -40765,7 +40765,7 @@ async function cloneToTemp(gitUrl) {
     rmSync4(tmp, { recursive: true, force: true });
     throw new Error(`git clone failed (${exitCode}): ${stderr.trim()}`);
   }
-  return join31(tmp, "repo");
+  return join32(tmp, "repo");
 }
 function isGitUrl(value) {
   return value.startsWith("git@") || value.startsWith("ssh://") || value.startsWith("file://") || value.endsWith(".git");
@@ -42004,11 +42004,11 @@ __export(exports_serve, {
   DEFAULT_SERVE_PORT: () => DEFAULT_SERVE_PORT
 });
 import { readFileSync as readFileSync25 } from "fs";
-import { dirname as dirname25, join as join32 } from "path";
+import { dirname as dirname25, join as join33 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function packageVersion() {
   try {
-    const pkgPath = join32(dirname25(fileURLToPath4(import.meta.url)), "..", "package.json");
+    const pkgPath = join33(dirname25(fileURLToPath4(import.meta.url)), "..", "package.json");
     return JSON.parse(readFileSync25(pkgPath, "utf-8")).version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -42310,7 +42310,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z as z3 } from "zod";
 import { createServer } from "http";
 import { existsSync as existsSync17, readFileSync as readFileSync26 } from "fs";
-import { join as join33, dirname as dirname26 } from "path";
+import { join as join34, dirname as dirname26 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 async function runVerifiedHook(name, stdin, timeoutMs) {
   const { resolveHook: resolveHook2, resolveScriptPath: resolveScriptPath2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
@@ -42544,7 +42544,7 @@ function createHooksServer() {
           continue;
         }
         const hookDir = getHookPath(name);
-        if (!existsSync17(join33(hookDir, "src", "hook.ts"))) {
+        if (!existsSync17(join34(hookDir, "src", "hook.ts"))) {
           issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
           hookHealthy = false;
         }
@@ -42588,7 +42588,7 @@ function createHooksServer() {
         return { content: [{ type: "text", text: JSON.stringify({ error: `Hook '${name}' not found` }) }] };
       }
       const hookPath = getHookPath(name);
-      const readmePath = join33(hookPath, "README.md");
+      const readmePath = join34(hookPath, "README.md");
       let readme = "";
       if (existsSync17(readmePath)) {
         readme = readFileSync26(readmePath, "utf-8");
@@ -43318,7 +43318,7 @@ var init_server = __esm(() => {
   pkg = { name: "@hasna/hooks", version: "0.0.0" };
   try {
     for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
-      const p = join33(__dirname3, rel);
+      const p = join34(__dirname3, rel);
       if (existsSync17(p)) {
         pkg = JSON.parse(readFileSync26(p, "utf-8"));
         break;
@@ -43397,7 +43397,7 @@ __export(exports_native_readiness_binding, {
 import { createHash as createHash25, randomUUID as randomUUID8 } from "crypto";
 import { closeSync as closeSync21, constants as constants19, fsyncSync as fsyncSync8, lstatSync as lstatSync25, mkdirSync as mkdirSync15, openSync as openSync21, realpathSync as realpathSync14, writeFileSync as writeFileSync14 } from "fs";
 import { homedir as homedir15 } from "os";
-import { dirname as dirname27, join as join34 } from "path";
+import { dirname as dirname27, join as join35 } from "path";
 function need10(value, code2) {
   if (!value)
     throw new ReadinessBindingError(code2);
@@ -43455,7 +43455,7 @@ async function registerTrashReadinessBinding(input2, expectedSHA256) {
   const operationId = randomUUID8();
   let directory2 = home;
   for (const part of [".hasna", "hooks", "native", "trash-readiness"]) {
-    directory2 = join34(directory2, part);
+    directory2 = join35(directory2, part);
     try {
       mkdirSync15(directory2, { mode: 448 });
       syncDirectory4(dirname27(directory2));
@@ -43465,12 +43465,12 @@ async function registerTrashReadinessBinding(input2, expectedSHA256) {
     }
     safeDirectory4(directory2);
   }
-  const operation = join34(directory2, operationId);
+  const operation = join35(directory2, operationId);
   mkdirSync15(operation, { mode: 448 });
   syncDirectory4(directory2);
   if (before)
-    exclusive3(join34(operation, "binding.before"), before.raw);
-  exclusive3(join34(operation, "intent.json"), JSON.stringify({ operationId, target, expectedSHA256, desiredSHA256: digest4 }) + `
+    exclusive3(join35(operation, "binding.before"), before.raw);
+  exclusive3(join35(operation, "intent.json"), JSON.stringify({ operationId, target, expectedSHA256, desiredSHA256: digest4 }) + `
 `);
   try {
     need10((read4()?.sha256 ?? "absent") === expectedSHA256, "binding_changed");
@@ -43484,7 +43484,7 @@ async function registerTrashReadinessBinding(input2, expectedSHA256) {
     syncDirectory4(directory2);
     need10(read4()?.sha256 === digest4, "binding_changed");
     const receipt = { ok: true, changed: true, operationId, path: target, sha256: digest4, configurationReady: true, nativeAdoptionVerified: false };
-    exclusive3(join34(operation, "receipt.json"), JSON.stringify(receipt) + `
+    exclusive3(join35(operation, "receipt.json"), JSON.stringify(receipt) + `
 `);
     return receipt;
   } catch {
@@ -43508,7 +43508,7 @@ var init_native_readiness_binding = __esm(() => {
 
 // src/cli/index.tsx
 init_native_safety_registration();
-import { resolve as resolve21 } from "path";
+import { resolve as resolve23 } from "path";
 
 // src/lib/claude-safety-check.ts
 init_native_safety();
@@ -43627,16 +43627,25 @@ async function verifyClaudeSafetyConfiguration(options = {}, dependencies = {})
 // src/cli/index.tsx
 init_codex_safety_trust();
 
-// node_modules/@hasna/events/dist/commander.js
+// ../../../../../../../repos/clones/hasna/apps/apps/events/dist/commander.js
 import { chmod, mkdir, readFile as readFile2, rename, writeFile } from "fs/promises";
 import { Buffer as Buffer2 } from "buffer";
+import { existsSync as existsSync22 } from "fs";
+import { join as join22 } from "path";
 import { existsSync as existsSync13 } from "fs";
 import { homedir as homedir13 } from "os";
-import { join as join20 } from "path";
+import { join as join20, resolve as resolve20 } from "path";
+import { homedir as pathsResolverHomedir3 } from "os";
+import { join as pathsResolverJoin3 } from "path";
 import { createHmac, timingSafeEqual } from "crypto";
+import { lookup as dnsLookup } from "dns/promises";
+import { isIP } from "net";
 import { randomUUID as randomUUID7 } from "crypto";
 import { spawn as spawn3 } from "child_process";
+import { request as nodeHttpRequest } from "http";
+import { request as nodeHttpsRequest } from "https";
 import { randomUUID as randomUUID22 } from "crypto";
+import { createRequire as createRequire2 } from "module";
 function getPathValue(input2, path) {
   return path.split(".").reduce((value, part) => {
     if (value && typeof value === "object" && part in value) {
@@ -43732,13 +43741,103 @@ function channelMatchesEvent(channel, event) {
     return true;
   return channel.filters.some((filter) => eventMatchesFilter(event, filter));
 }
+var PATHS_RESOLVER_KIND_ENV2 = {
+  config: "HASNA_CONFIG_HOME",
+  data: "HASNA_DATA_HOME",
+  state: "HASNA_STATE_HOME",
+  cache: "HASNA_CACHE_HOME"
+};
+var PATHS_RESOLVER_APP_SLUG_RE3 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function pathsResolverAssertApp3(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!PATHS_RESOLVER_APP_SLUG_RE3.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function pathsResolverAssertKind2(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV2).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV2).join(", ")}`);
+  }
+}
+function pathsResolverBaseDir2(kind, options) {
+  pathsResolverAssertKind2(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV2[kind]];
+  if (typeof override === "string" && override.length > 0)
+    return override;
+  const home = options.home ?? pathsResolverHomedir3();
+  const platform = options.platform ?? process.platform;
+  if (platform === "darwin") {
+    switch (kind) {
+      case "config":
+      case "data":
+        return pathsResolverJoin3(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return pathsResolverJoin3(home, "Library", "Caches", "Hasna");
+      case "state":
+        return pathsResolverJoin3(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return pathsResolverJoin3(home, ".config", "hasna");
+    case "data":
+      return pathsResolverJoin3(home, ".local", "share", "hasna");
+    case "state":
+      return pathsResolverJoin3(home, ".local", "state", "hasna");
+    case "cache":
+      return pathsResolverJoin3(home, ".cache", "hasna");
+  }
+}
+function pathsResolverResolve2(kind, options) {
+  pathsResolverAssertApp3(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin3("internal", options.app) : options.app;
+  return pathsResolverJoin3(pathsResolverBaseDir2(kind, options), appSegment);
+}
+function dataDir3(options) {
+  return pathsResolverResolve2("data", options);
+}
 var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR";
 var HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME";
+var EVENTS_STORE_SENTINEL_FILE = "events.json";
+function effectiveHome2() {
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir13();
+}
+function legacyHomeDir() {
+  return join20(effectiveHome2(), ".hasna", "events");
+}
+function resolverHome() {
+  return dataDir3({ app: "events", home: effectiveHome2() || undefined });
+}
+function adoptResolverHome(resolved, env = process.env) {
+  const dataOverride = env.HASNA_DATA_HOME;
+  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
+    return true;
+  return existsSync13(join20(resolved, EVENTS_STORE_SENTINEL_FILE));
+}
+function exactEventsHome() {
+  const dir = process.env[HASNA_EVENTS_DIR_ENV];
+  if (dir && dir.trim())
+    return dir.trim();
+  const home = process.env[HASNA_EVENTS_HOME_ENV];
+  if (home && home.trim())
+    return home.trim();
+  return;
+}
+function getEventsHome() {
+  const exact2 = exactEventsHome();
+  if (exact2)
+    return resolve20(exact2);
+  const resolved = resolverHome();
+  return adoptResolverHome(resolved) ? resolve20(resolved) : resolve20(legacyHomeDir());
+}
 var LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:";
 var DEFAULT_EVENT_PAGE_LIMIT = 100;
 var MAX_EVENT_PAGE_LIMIT = 1000;
 function getEventsDataDir(override) {
-  return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join20(homedir13(), ".hasna", "events");
+  return override || getEventsHome();
 }
 function getActiveEventsDirEnv() {
   if (process.env[HASNA_EVENTS_DIR_ENV])
@@ -43754,12 +43853,12 @@ class JsonEventsStore {
   channelsPath;
   eventsPath;
   deliveriesPath;
-  constructor(dataDir3 = getEventsDataDir()) {
-    this.dataDir = dataDir3;
-    this.runtime = localJsonRuntime(dataDir3);
-    this.channelsPath = join20(dataDir3, "channels.json");
-    this.eventsPath = join20(dataDir3, "events.json");
-    this.deliveriesPath = join20(dataDir3, "deliveries.json");
+  constructor(dataDir22 = getEventsDataDir()) {
+    this.dataDir = dataDir22;
+    this.runtime = localJsonRuntime(dataDir22);
+    this.channelsPath = join22(dataDir22, "channels.json");
+    this.eventsPath = join22(dataDir22, "events.json");
+    this.deliveriesPath = join22(dataDir22, "deliveries.json");
   }
   async init() {
     await mkdir(this.dataDir, { recursive: true, mode: 448 });
@@ -43876,7 +43975,7 @@ class JsonEventsStore {
     };
   }
   async ensureArrayFile(path) {
-    if (!existsSync13(path)) {
+    if (!existsSync22(path)) {
       await writeFile(path, `[]
 `, { encoding: "utf-8", mode: 384 });
     }
@@ -43906,7 +44005,7 @@ class JsonEventsStore {
     });
   }
 }
-function localJsonRuntime(dataDir3 = getEventsDataDir()) {
+function localJsonRuntime(dataDir22 = getEventsDataDir()) {
   return {
     mode: "local-files",
     name: "json-events-store",
@@ -43919,7 +44018,7 @@ function localJsonRuntime(dataDir3 = getEventsDataDir()) {
     durable: true,
     idempotency: "best-effort-local",
     replayCursors: true,
-    description: `Local JSON files in ${dataDir3}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
+    description: `Local JSON files in ${dataDir22}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
   };
 }
 function encodeLocalJsonEventCursor(offset, options = {}) {
@@ -43983,8 +44082,8 @@ function assertCursorFilter(name, cursorValue, optionValue) {
 function findEventByIdentity(events2, identity3) {
   return events2.find((event) => identity3.id !== undefined && event.id === identity3.id || identity3.dedupeKey !== undefined && event.dedupeKey === identity3.dedupeKey);
 }
-async function getEventsStatus(dataDir3) {
-  const store = new JsonEventsStore(dataDir3);
+async function getEventsStatus(dataDir22) {
+  const store = new JsonEventsStore(dataDir22);
   await store.init();
   const [channels, events2, deliveries] = await Promise.all([
     store.listChannels(),
@@ -44026,9 +44125,9 @@ async function getEventsStatus(dataDir3) {
     }
   };
 }
-function statusFile(dataDir3, fileName, records) {
-  const path = join20(dataDir3, fileName);
-  return { path, exists: existsSync13(path), records };
+function statusFile(dataDir22, fileName, records) {
+  const path = join22(dataDir22, fileName);
+  return { path, exists: existsSync22(path), records };
 }
 var DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
 function buildSignatureBase(timestamp, body) {
@@ -44038,6 +44137,214 @@ function signPayload(secret, timestamp, body) {
   const digest4 = createHmac("sha256", secret).update(buildSignatureBase(timestamp, body)).digest("hex");
   return `sha256=${digest4}`;
 }
+var DEFAULT_MAX_REDIRECTS = 5;
+var IPV4_PRIVATE_RANGES = [
+  [0, 16777215],
+  [167772160, 184549375],
+  [1681915904, 1686110207],
+  [2130706432, 2147483647],
+  [2851995648, 2852061183],
+  [2886729728, 2887778303],
+  [3221225472, 3221225727],
+  [3221225984, 3221226239],
+  [3227017984, 3227018239],
+  [3232235520, 3232301055],
+  [3323068416, 3323199487],
+  [3325256704, 3325256959],
+  [3405803776, 3405804031],
+  [3758096384, 4294967295]
+];
+var IPV6_SPECIAL_PREFIXES = [
+  { groups: [0, 0, 0, 0, 0, 0, 0, 0], bits: 128 },
+  { groups: [0, 0, 0, 0, 0, 0, 0, 1], bits: 128 },
+  { groups: [0, 0, 0, 0, 0, 65535, 0, 0], bits: 96 },
+  { groups: [100, 65435, 0, 0, 0, 0, 0, 0], bits: 96 },
+  { groups: [256, 0, 0, 0, 0, 0, 0, 0], bits: 64 },
+  { groups: [8193, 0, 0, 0, 0, 0, 0, 0], bits: 32 },
+  { groups: [8193, 2, 0, 0, 0, 0, 0, 0], bits: 48 },
+  { groups: [8193, 16, 0, 0, 0, 0, 0, 0], bits: 28 },
+  { groups: [8193, 3512, 0, 0, 0, 0, 0, 0], bits: 32 },
+  { groups: [8194, 0, 0, 0, 0, 0, 0, 0], bits: 16 },
+  { groups: [16383, 0, 0, 0, 0, 0, 0, 0], bits: 20 },
+  { groups: [64512, 0, 0, 0, 0, 0, 0, 0], bits: 7 },
+  { groups: [65152, 0, 0, 0, 0, 0, 0, 0], bits: 10 },
+  { groups: [65216, 0, 0, 0, 0, 0, 0, 0], bits: 10 },
+  { groups: [65280, 0, 0, 0, 0, 0, 0, 0], bits: 8 }
+];
+function isPrivateAddress(address) {
+  const normalized = stripZoneId(address);
+  const version2 = isIP(normalized);
+  if (version2 === 4) {
+    const integer3 = ipv4ToInt(normalized);
+    if (integer3 === undefined)
+      return true;
+    return IPV4_PRIVATE_RANGES.some(([low, high]) => integer3 >= low && integer3 <= high);
+  }
+  if (version2 === 6) {
+    const groups = ipv6Groups(normalized);
+    if (!groups)
+      return true;
+    for (const prefix3 of IPV6_SPECIAL_PREFIXES) {
+      if (!ipv6MatchesPrefix(groups, prefix3.groups, prefix3.bits))
+        continue;
+      if (prefix3.bits === 96 && groups[5] === 65535) {
+        return isPrivateAddress(ipv4IntToString(groups[6] << 16 | groups[7]));
+      }
+      if (prefix3.bits === 16 && groups[0] === 8194) {
+        return isPrivateAddress(ipv4IntToString(groups[1] << 16 | groups[2]));
+      }
+      return true;
+    }
+    return false;
+  }
+  return true;
+}
+async function resolveWebhookTarget(url2, policy = {}) {
+  const hostname3 = normalizeHostname(url2.hostname);
+  const allowlist = (policy.allowPrivateHosts ?? []).map((entry) => normalizeHostname(entry.toLowerCase()));
+  if (allowlist.includes(hostname3)) {
+    const version22 = isIP(hostname3);
+    if (version22 === 4 || version22 === 6) {
+      return { hostname: hostname3, addresses: [hostname3] };
+    }
+    const lookup2 = policy.lookup ?? defaultTargetLookup;
+    let resolved2;
+    try {
+      resolved2 = await lookup2(hostname3);
+    } catch {
+      throw new Error(`Webhook target ${hostname3} could not be resolved`);
+    }
+    if (!Array.isArray(resolved2) || resolved2.length === 0) {
+      throw new Error(`Webhook target ${hostname3} resolved to no addresses`);
+    }
+    const addresses = resolved2.map((entry) => normalizeHostname(entry.address));
+    return { hostname: hostname3, addresses };
+  }
+  const version2 = isIP(hostname3);
+  if (version2 === 4 || version2 === 6) {
+    if (isPrivateAddress(hostname3)) {
+      throw new Error(`Webhook target ${hostname3} is a private or special-use address`);
+    }
+    return { hostname: hostname3, addresses: [hostname3] };
+  }
+  const lookup = policy.lookup ?? defaultTargetLookup;
+  let resolved;
+  try {
+    resolved = await lookup(hostname3);
+  } catch {
+    throw new Error(`Webhook target ${hostname3} could not be resolved`);
+  }
+  if (!Array.isArray(resolved) || resolved.length === 0) {
+    throw new Error(`Webhook target ${hostname3} resolved to no addresses`);
+  }
+  const allowed = [];
+  for (const entry of resolved) {
+    const address = normalizeHostname(entry.address);
+    if (isPrivateAddress(address)) {
+      if (allowlist.includes(address)) {
+        allowed.push(address);
+        continue;
+      }
+      throw new Error(`Webhook target ${hostname3} resolves to private or special-use address ${address}`);
+    }
+    allowed.push(address);
+  }
+  if (allowed.length === 0) {
+    throw new Error(`Webhook target ${hostname3} resolved to no public addresses`);
+  }
+  return { hostname: hostname3, addresses: allowed };
+}
+function normalizeMaxRedirects(value) {
+  if (value === undefined)
+    return DEFAULT_MAX_REDIRECTS;
+  if (!Number.isInteger(value) || value < 0)
+    throw new Error("webhookTargetPolicy.maxRedirects must be a non-negative integer");
+  return value;
+}
+var defaultTargetLookup = async (hostname3) => {
+  return dnsLookup(hostname3, { all: true, verbatim: false });
+};
+function normalizeHostname(hostname3) {
+  const lower = hostname3.toLowerCase();
+  if (lower.startsWith("[") && lower.endsWith("]"))
+    return lower.slice(1, -1);
+  return lower;
+}
+function stripZoneId(address) {
+  const percent = address.indexOf("%");
+  return percent === -1 ? address : address.slice(0, percent);
+}
+function ipv4ToInt(address) {
+  const parts = address.split(".");
+  if (parts.length !== 4)
+    return;
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part))
+      return;
+    const octet = Number(part);
+    if (octet > 255)
+      return;
+    value = value << 8 | octet;
+  }
+  return value >>> 0;
+}
+function ipv4IntToString(integer3) {
+  return [
+    integer3 >>> 24 & 255,
+    integer3 >>> 16 & 255,
+    integer3 >>> 8 & 255,
+    integer3 & 255
+  ].join(".");
+}
+function ipv6Groups(address) {
+  const raw = stripZoneId(address);
+  const doubleColon = raw.indexOf("::");
+  const headText = doubleColon === -1 ? raw : raw.slice(0, doubleColon);
+  const tailText = doubleColon === -1 ? "" : raw.slice(doubleColon + 2);
+  const parseGroups = (text3) => {
+    if (text3 === "")
+      return [];
+    const out = [];
+    for (const part of text3.split(":")) {
+      if (part.includes(".")) {
+        const v4 = ipv4ToInt(part);
+        if (v4 === undefined)
+          return;
+        out.push(v4 >>> 16 & 65535, v4 & 65535);
+      } else {
+        if (!/^[0-9a-fA-F]{1,4}$/.test(part))
+          return;
+        out.push(parseInt(part, 16));
+      }
+    }
+    return out;
+  };
+  const head = parseGroups(headText);
+  if (!head)
+    return;
+  const tail = parseGroups(tailText);
+  if (!tail)
+    return;
+  const total = head.length + tail.length;
+  if (doubleColon === -1) {
+    return total === 8 ? head : undefined;
+  }
+  if (total >= 8)
+    return;
+  return [...head, ...new Array(8 - total).fill(0), ...tail];
+}
+function ipv6MatchesPrefix(groups, prefixGroups, prefixBits) {
+  let remaining = prefixBits;
+  for (let index = 0;index < prefixGroups.length && remaining > 0; index += 1) {
+    const take = Math.min(16, remaining);
+    const mask = 65535 << 16 - take & 65535;
+    if ((groups[index] & mask) !== (prefixGroups[index] & mask))
+      return false;
+    remaining -= take;
+  }
+  return true;
+}
 function now() {
   return new Date().toISOString();
 }
@@ -44068,9 +44375,18 @@ function buildWebhookRequest(event, channel, options = {}) {
   }
   return { body, headers };
 }
+function normalizeWebhookUrl(raw) {
+  const url2 = new URL(raw);
+  if (url2.username !== "" || url2.password !== "") {
+    url2.username = "";
+    url2.password = "";
+  }
+  return url2.toString();
+}
 async function dispatchWebhook(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
+  const webhookUrl = normalizeWebhookUrl(channel.webhook.url);
   const startedAt = now();
   let secret = channel.webhook.secret;
   if (channel.webhook.secretRef) {
@@ -44087,10 +44403,14 @@ async function dispatchWebhook(event, channel, options = {}) {
   }
   const timestamp = (options.now?.() ?? new Date).toISOString();
   const { body, headers } = buildWebhookRequest(event, channel, { secret, timestamp });
+  const validateTargets = options.webhookTargetPolicy !== undefined || options.fetchImpl === undefined;
+  if (validateTargets) {
+    return dispatchValidatedWebhook(event, channel, { body, headers, startedAt, options });
+  }
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
   try {
-    const response = await (options.fetchImpl ?? fetch)(channel.webhook.url, {
+    const response = await (options.fetchImpl ?? fetch)(webhookUrl, {
       method: "POST",
       headers,
       body,
@@ -44118,6 +44438,130 @@ async function dispatchWebhook(event, channel, options = {}) {
     clearTimeout(timeout);
   }
 }
+function isRedirectStatus(status) {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function redirectKeepsBody(status) {
+  return status === 307 || status === 308;
+}
+async function pinnedNativeRequest(target, addresses, method, headers, body, signal, tls) {
+  const isHttps = target.protocol === "https:";
+  if (!isHttps && target.protocol !== "http:") {
+    throw new Error(`Webhook target uses unsupported protocol ${target.protocol}`);
+  }
+  const defaultPort = isHttps ? 443 : 80;
+  const port = target.port ? Number(target.port) : defaultPort;
+  const requestOptions = {
+    hostname: target.hostname,
+    port,
+    path: `${target.pathname}${target.search}`,
+    method,
+    headers,
+    ...tls?.ca ? { ca: tls.ca } : {},
+    lookup: (hostname3, _options, callback) => {
+      const entries = addresses.map((address) => ({
+        address,
+        family: address.includes(":") ? 6 : 4
+      }));
+      callback(null, entries);
+    }
+  };
+  return new Promise((resolve23, reject) => {
+    const request = isHttps ? nodeHttpsRequest(requestOptions, onResponse) : nodeHttpRequest(requestOptions, onResponse);
+    const onAbort = () => {
+      const error61 = new Error("The operation was aborted.");
+      error61.name = "AbortError";
+      request.destroy(error61);
+    };
+    if (signal.aborted)
+      onAbort();
+    else
+      signal.addEventListener("abort", onAbort, { once: true });
+    request.on("error", reject);
+    if (body !== undefined)
+      request.write(body);
+    request.end();
+    function onResponse(response) {
+      const chunks = [];
+      response.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+      response.on("error", reject);
+      response.on("end", () => {
+        const headersRecord = {};
+        for (const [name, value] of Object.entries(response.headers)) {
+          if (typeof value === "string")
+            headersRecord[name] = value;
+          else if (Array.isArray(value))
+            headersRecord[name] = value.join(", ");
+        }
+        resolve23(new Response(Buffer.concat(chunks), { status: response.statusCode ?? 200, headers: headersRecord }));
+      });
+    }
+  });
+}
+async function dispatchValidatedWebhook(event, channel, input2) {
+  const { body, headers, startedAt, options } = input2;
+  const webhook = channel.webhook;
+  if (!webhook)
+    throw new Error(`Channel ${channel.id} has no webhook config`);
+  const policy = options.webhookTargetPolicy ?? {};
+  const maxRedirects = normalizeMaxRedirects(policy.maxRedirects);
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), webhook.timeoutMs ?? 15000);
+  try {
+    let target = new URL(normalizeWebhookUrl(webhook.url));
+    let requestHeaders = headers;
+    let method = "POST";
+    let requestBody = body;
+    let redirectsFollowed = 0;
+    for (;; ) {
+      const resolved = await resolveWebhookTarget(target, policy).catch((error61) => {
+        throw new Error(`Webhook target rejected by SSRF guard: ${error61.message}`);
+      });
+      const response = options.fetchImpl ? await options.fetchImpl(target, {
+        method,
+        headers: requestHeaders,
+        body: requestBody,
+        signal: controller.signal,
+        redirect: "manual"
+      }) : await pinnedNativeRequest(target, resolved.addresses, method, requestHeaders, requestBody, controller.signal, options.tls);
+      const location = response.headers.get("location");
+      if (isRedirectStatus(response.status) && location) {
+        if (redirectsFollowed >= maxRedirects) {
+          return failedAttempt(startedAt, `Webhook target exceeded ${maxRedirects} redirects`);
+        }
+        redirectsFollowed += 1;
+        const next = new URL(location, target);
+        target = next;
+        if (!redirectKeepsBody(response.status)) {
+          method = "GET";
+          requestBody = undefined;
+          requestHeaders = Object.fromEntries(Object.entries(requestHeaders).filter(([name]) => name.toLowerCase() !== "content-type" && name.toLowerCase() !== "content-length"));
+        }
+        continue;
+      }
+      const responseBody = truncate(await response.text());
+      return {
+        attempt: 1,
+        status: response.ok ? "success" : "failed",
+        startedAt,
+        completedAt: now(),
+        responseStatus: response.status,
+        responseBody,
+        error: response.ok ? undefined : `Webhook returned HTTP ${response.status}`
+      };
+    }
+  } catch (error61) {
+    return {
+      attempt: 1,
+      status: "failed",
+      startedAt,
+      completedAt: now(),
+      error: error61 instanceof Error ? error61.message : String(error61)
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 function failedAttempt(startedAt, error61) {
   return {
     attempt: 1,
@@ -44146,7 +44590,7 @@ async function dispatchCommand(event, channel) {
     HASNA_EVENT_SCHEMA_VERSION: event.schemaVersion,
     HASNA_EVENT_JSON: eventJson
   };
-  return new Promise((resolve16) => {
+  return new Promise((resolve23) => {
     const child = spawn3(channel.command.command, channel.command.args ?? [], {
       cwd: channel.command.cwd,
       env,
@@ -44164,7 +44608,7 @@ async function dispatchCommand(event, channel) {
     });
     child.on("error", (error61) => {
       clearTimeout(timeout);
-      resolve16({
+      resolve23({
         attempt: 1,
         status: "failed",
         startedAt,
@@ -44177,7 +44621,7 @@ async function dispatchCommand(event, channel) {
     child.on("close", (code2, signal) => {
       clearTimeout(timeout);
       const success2 = code2 === 0;
-      resolve16({
+      resolve23({
         attempt: 1,
         status: success2 ? "success" : "failed",
         startedAt,
@@ -44299,6 +44743,22 @@ function setPath(input2, path, replacement) {
   if (last && last in cursor)
     cursor[last] = replacement;
 }
+var MAX_PACKAGE_BYTES2 = 1024 * 1024;
+var MAX_CREDENTIAL_FILE_BYTES2 = 64 * 1024;
+var INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
+var CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
+var AMBIENT_ENVIRONMENT2 = Symbol.for("hasna:contracts:ambientClientEnvironment");
+var requireSecretsSdk2 = createRequire2(import.meta.url);
+var IDEMPOTENT_METHODS2 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+var AUTHORITY_OVERRIDE_HEADERS2 = new Set([
+  "host",
+  ":authority",
+  "forwarded",
+  "x-forwarded-host",
+  "x-original-host"
+]);
+var MAX_ENVELOPE_BYTES = 256 * 1024;
+var MAX_REQUEST_BYTES = MAX_ENVELOPE_BYTES * 2 + 8192;
 function createEvent(input2) {
   return {
     id: input2.id ?? randomUUID22(),
@@ -44327,7 +44787,9 @@ class EventsClient {
     this.transportOptions = {
       fetchImpl: options.fetchImpl,
       secretResolver: options.secretResolver,
-      now: options.now
+      now: options.now,
+      tls: options.tls,
+      webhookTargetPolicy: options.webhookTargetPolicy
     };
     this.catalog = options.catalog ?? defaultEventTypeCatalog;
     this.validateCatalogTypes = options.validateCatalogTypes ?? false;
@@ -44614,6 +45076,13 @@ function parseMatcherExpression(value, label) {
     negated: false
   };
 }
+function webhookTargetPolicyFromEnv() {
+  const value = process.env.HASNA_EVENTS_ALLOW_PRIVATE_WEBHOOK_TARGETS;
+  if (!value)
+    return;
+  const hosts = value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+  return hosts.length > 0 ? { allowPrivateHosts: hosts } : undefined;
+}
 var DEFAULT_EVENT_LIST_LIMIT = 100;
 function parseJsonObject(value, fallback) {
   if (!value)
@@ -44639,7 +45108,7 @@ function parseHeaders(values) {
 function createClient(options) {
   if (options.createClient)
     return options.createClient();
-  return new EventsClient({ store: new JsonEventsStore(options.dataDir) });
+  return new EventsClient({ store: new JsonEventsStore(options.dataDir), webhookTargetPolicy: webhookTargetPolicyFromEnv() });
 }
 function print(value, json2, text3) {
   if (json2)
@@ -44720,6 +45189,8 @@ function registerChannelCommands(program2, options) {
         metadata: parseJsonObject(actionOptions.metadata, {})
       }, { honorFilters: actionOptions.honorFilters });
       print(result, json2, `${result.status}: ${result.channelId}`);
+      if (result.status === "failed")
+        process.exitCode = 1;
     } catch (error61) {
       fail(error61, json2);
     }
@@ -44812,7 +45283,7 @@ function replaySummary(events2, deliveries, nextCursor) {
 // src/cli/index.tsx
 import { render } from "ink";
 
-// node_modules/commander/esm.mjs
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/commander@12.1.0/node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
 var {
   program: program2,
@@ -44831,18 +45302,18 @@ var {
 // src/cli/index.tsx
 import chalk2 from "chalk";
 import { existsSync as existsSync18, readFileSync as readFileSync27, rmSync as rmSync6 } from "fs";
-import { join as join35, dirname as dirname28 } from "path";
+import { join as join36, dirname as dirname28 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 
 // src/cli/components/App.tsx
 import { useState as useState7 } from "react";
 import { Box as Box8, Text as Text10, useApp, useInput as useInput5 } from "ink";
 
-// node_modules/ink-select-input/build/Indicator.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Indicator.js
 import React from "react";
 import { Box, Text } from "ink";
 
-// node_modules/is-unicode-supported/index.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/is-unicode-supported@2.1.0/node_modules/is-unicode-supported/index.js
 import process3 from "process";
 function isUnicodeSupported() {
   const { env } = process3;
@@ -44853,7 +45324,7 @@ function isUnicodeSupported() {
   return Boolean(env.WT_SESSION) || Boolean(env.TERMINUS_SUBLIME) || env.ConEmuTask === "{cmd::Cmder}" || TERM_PROGRAM === "Terminus-Sublime" || TERM_PROGRAM === "vscode" || TERM === "xterm-256color" || TERM === "alacritty" || TERM === "rxvt-unicode" || TERM === "rxvt-unicode-256color" || env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
 
-// node_modules/figures/index.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/figures@6.1.0/node_modules/figures/index.js
 var common2 = {
   circleQuestionMark: "(?)",
   questionMarkPrefix: "(?)",
@@ -45129,23 +45600,23 @@ var figures = shouldUseMain ? mainSymbols : fallbackSymbols;
 var figures_default = figures;
 var replacements = Object.entries(specialMainSymbols);
 
-// node_modules/ink-select-input/build/Indicator.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Indicator.js
 function Indicator({ isSelected = false }) {
   return React.createElement(Box, { marginRight: 1 }, isSelected ? React.createElement(Text, { color: "blue" }, figures_default.pointer) : React.createElement(Text, null, " "));
 }
 var Indicator_default = Indicator;
-// node_modules/ink-select-input/build/Item.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Item.js
 import * as React2 from "react";
 import { Text as Text2 } from "ink";
 function Item({ isSelected = false, label }) {
   return React2.createElement(Text2, { color: isSelected ? "blue" : undefined }, label);
 }
 var Item_default = Item;
-// node_modules/ink-select-input/build/SelectInput.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/SelectInput.js
 import { isDeepStrictEqual } from "util";
 import React3, { useState, useEffect, useRef, useCallback } from "react";
 
-// node_modules/to-rotated/index.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/to-rotated@1.0.0/node_modules/to-rotated/index.js
 function toRotated(array3, steps) {
   if (!Array.isArray(array3)) {
     throw new TypeError(`Expected an array, got \`${typeof array3}\`.`);
@@ -45167,7 +45638,7 @@ function toRotated(array3, steps) {
   ];
 }
 
-// node_modules/ink-select-input/build/SelectInput.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/SelectInput.js
 import { Box as Box2, useInput } from "ink";
 function SelectInput({ items = [], isFocused = true, initialIndex = 0, indicatorComponent = Indicator_default, itemComponent = Item_default, limit: customLimit, onSelect, onHighlight }) {
   const hasLimit = typeof customLimit === "number" && items.length > customLimit;
@@ -45463,7 +45934,7 @@ function HookSelect({
 import { useState as useState4, useEffect as useEffect3 } from "react";
 import { Box as Box6, Text as Text7, useInput as useInput4 } from "ink";
 
-// node_modules/ink-text-input/build/index.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/ink-text-input@6.0.0+fa875fef9f949ebd/node_modules/ink-text-input/build/index.js
 import React5, { useState as useState3, useEffect as useEffect2 } from "react";
 import { Text as Text6, useInput as useInput3 } from "ink";
 import chalk from "chalk";
@@ -45641,7 +46112,7 @@ function SearchView({
 import { useState as useState6, useEffect as useEffect5 } from "react";
 import { Box as Box7, Text as Text9 } from "ink";
 
-// node_modules/ink-spinner/build/index.js
+// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/ink-spinner@5.0.0+fa875fef9f949ebd/node_modules/ink-spinner/build/index.js
 var import_cli_spinners = __toESM(require_cli_spinners(), 1);
 import React7, { useState as useState5, useEffect as useEffect4 } from "react";
 import { Text as Text8 } from "ink";
@@ -46008,10 +46479,10 @@ init_native_safety();
 
 // src/lib/sumi-binding.ts
 import { homedir as homedir14 } from "os";
-import { join as join24, sep as sep3 } from "path";
+import { join as join27, sep as sep3 } from "path";
 
 // hooks/hook-trash-guard/src/binary.ts
-import { dirname as dirname21, isAbsolute as isAbsolute20, join as join22, resolve as resolve20 } from "path";
+import { dirname as dirname21, isAbsolute as isAbsolute20, join as join24, resolve as resolve21 } from "path";
 import { accessSync, closeSync as closeSync19, constants as constants18, fstatSync as fstatSync18, lstatSync as lstatSync23, openSync as openSync19, readFileSync as readFileSync17, readlinkSync as readlinkSync3, readSync as readSync3, realpathSync as realpathSync11, statSync } from "fs";
 import { spawnSync } from "child_process";
 function trustedOwner(uid2) {
@@ -46033,7 +46504,7 @@ function safeExecutableFile(path, systemBinAlias = false) {
         parent = dirname21(parent);
         continue;
       }
-      const next = join22(parent, part), info2 = lstatSync23(next);
+      const next = join24(parent, part), info2 = lstatSync23(next);
       if (systemBinAlias && next === "/bin" && info2.isSymbolicLink() && info2.uid === 0) {
         const target = realpathSync11(next);
         if (!safeBinaryDirectory(target))
@@ -46045,7 +46516,7 @@ function safeExecutableFile(path, systemBinAlias = false) {
         return false;
       parent = next;
     }
-    const candidate = join22(parent, name), info = lstatSync23(candidate);
+    const candidate = join24(parent, name), info = lstatSync23(candidate);
     if (!trustedOwner(info.uid))
       return false;
     if (info.isSymbolicLink()) {
@@ -46058,9 +46529,9 @@ function safeExecutableFile(path, systemBinAlias = false) {
   return false;
 }
 function safeInterpreterSearchDirectory(path) {
-  if (!isAbsolute20(path) || resolve20(path) !== (path.replace(/\/+$/, "") || "/"))
+  if (!isAbsolute20(path) || resolve21(path) !== (path.replace(/\/+$/, "") || "/"))
     return false;
-  for (let cursor = resolve20(path);; cursor = dirname21(cursor)) {
+  for (let cursor = resolve21(path);; cursor = dirname21(cursor)) {
     try {
       lstatSync23(cursor);
       return safeBinaryDirectory(cursor);
@@ -46092,7 +46563,7 @@ function safeScriptInterpreter(executable2, pathValue) {
   for (const dir of pathValue.split(":").slice(0, 64)) {
     if (!safeInterpreterSearchDirectory(dir))
       return false;
-    const interpreter = resolve20(dir, "bun");
+    const interpreter = resolve21(dir, "bun");
     try {
       if (!statSync(interpreter).isFile())
         continue;
@@ -46127,7 +46598,7 @@ function inspectTrashBinary(env = process.env) {
   for (const dir of pathValue.split(":").slice(0, 64)) {
     if (!isAbsolute20(dir) || Date.now() >= deadline)
       continue;
-    const candidate = resolve20(dir, "trash");
+    const candidate = resolve21(dir, "trash");
     try {
       const stat2 = statSync(candidate);
       if (!stat2.isFile() || !trustedOwner(stat2.uid) || (stat2.mode & 73) === 0 || (stat2.mode & 18) !== 0) {
@@ -46135,7 +46606,7 @@ function inspectTrashBinary(env = process.env) {
         continue;
       }
       const executable2 = realpathSync11(candidate);
-      if (!safeBinaryDirectory(resolve20(dir)) || !safeBinaryDirectory(dirname21(executable2))) {
+      if (!safeBinaryDirectory(resolve21(dir)) || !safeBinaryDirectory(dirname21(executable2))) {
         reject("unsafe_directory");
         continue;
       }
@@ -46143,15 +46614,15 @@ function inspectTrashBinary(env = process.env) {
         reject("unsafe_directory");
         continue;
       }
-      const packageRoot = resolve20(dirname21(executable2), "../..");
-      const manifestPath = join22(packageRoot, "package.json");
+      const packageRoot = resolve21(dirname21(executable2), "../..");
+      const manifestPath = join24(packageRoot, "package.json");
       const manifestStat = statSync(manifestPath);
       if (!manifestStat.isFile() || !trustedOwner(manifestStat.uid) || manifestStat.size > 16384 || (manifestStat.mode & 18) !== 0 || lstatSync23(manifestPath).isSymbolicLink()) {
         reject("unsafe_manifest");
         continue;
       }
       const manifest = JSON.parse(readFileSync17(manifestPath, "utf8"));
-      if (manifest.name !== "@hasna/trash" || typeof manifest.version !== "string" || typeof manifest.bin?.trash !== "string" || realpathSync11(resolve20(packageRoot, manifest.bin.trash)) !== executable2) {
+      if (manifest.name !== "@hasna/trash" || typeof manifest.version !== "string" || typeof manifest.bin?.trash !== "string" || realpathSync11(resolve21(packageRoot, manifest.bin.trash)) !== executable2) {
         reject("unrecognized_package");
         continue;
       }
@@ -46196,7 +46667,7 @@ function failure(code2, reason) {
   return { ok: false, target: "sumi", code: code2, ...reason ? { reason: reason.slice(0, 300) } : {} };
 }
 function nativeSafetyBindingDurable(worker, home) {
-  return !(worker.startsWith(join24(home, ".bun") + sep3) || worker.includes(`${sep3}node_modules${sep3}.bun${sep3}`));
+  return !(worker.startsWith(join27(home, ".bun") + sep3) || worker.includes(`${sep3}node_modules${sep3}.bun${sep3}`));
 }
 async function provisionSumiSafetyBinding(options = {}) {
   const home = options.home ?? homedir14();
@@ -46271,7 +46742,7 @@ init_transport2();
 init_db();
 import { jsxDEV as jsxDEV8 } from "react/jsx-dev-runtime";
 var __dirname4 = dirname28(fileURLToPath6(import.meta.url));
-var pkgPath = existsSync18(join35(__dirname4, "..", "package.json")) ? join35(__dirname4, "..", "package.json") : join35(__dirname4, "..", "..", "package.json");
+var pkgPath = existsSync18(join36(__dirname4, "..", "package.json")) ? join36(__dirname4, "..", "package.json") : join36(__dirname4, "..", "..", "package.json");
 var pkg2 = JSON.parse(readFileSync27(pkgPath, "utf-8"));
 var program3 = new Command;
 function resolveScope(options) {
@@ -46504,7 +46975,7 @@ program3.command("init").description("Register a new agent profile with a unique
   if (profile.name) {
     console.log(`  ${chalk2.dim("Name:")}       ${profile.name}`);
   }
-  console.log(`  ${chalk2.dim("Profile:")}    ${join35(getProfilesDir(), `${profile.agent_id}.json`)}`);
+  console.log(`  ${chalk2.dim("Profile:")}    ${join36(getProfilesDir(), `${profile.agent_id}.json`)}`);
   console.log();
   console.log(chalk2.dim("  Install hooks with this profile:"));
   console.log(`    hooks install gitguard --profile ${profile.agent_id}`);
@@ -47159,7 +47630,7 @@ program3.command("doctor").option("-g, --global", "Check global settings", false
         continue;
       }
       const hookDir = getHookPath(name);
-      const hookScript = join35(hookDir, "src", "hook.ts");
+      const hookScript = join36(hookDir, "src", "hook.ts");
       if (!existsSync18(hookScript)) {
         issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
         hookHealthy = false;
@@ -47370,7 +47841,7 @@ program3.command("docs").argument("[hook]", "Hook name (shows general docs if om
       return;
     }
     const hookPath = getHookPath(hook);
-    const readmePath = join35(hookPath, "README.md");
+    const readmePath = join36(hookPath, "README.md");
     let readme = "";
     if (existsSync18(readmePath)) {
       readme = readFileSync27(readmePath, "utf-8");
@@ -48168,7 +48639,7 @@ safety.command("verify").requiredOption("--target <target>", "sumi, codex or cla
         throw new ClaudeSafetyError("settings_invalid");
       console.log(JSON.stringify(await verifyClaudeSafetyConfiguration({
         cwd: options.cwd,
-        ...process.env.CLAUDE_CONFIG_DIR ? { userSettingsPath: resolve21(process.env.CLAUDE_CONFIG_DIR, "settings.json") } : {}
+        ...process.env.CLAUDE_CONFIG_DIR ? { userSettingsPath: resolve23(process.env.CLAUDE_CONFIG_DIR, "settings.json") } : {}
       })));
     } catch (error61) {
       console.log(JSON.stringify({ ok: false, target: "claude", code: error61 instanceof ClaudeSafetyError ? error61.code : "settings_invalid", nativeAdoptionVerified: false }));