@hasna/hooks 0.11.3 → 0.11.5

package/bin/native-readiness-entry.js

@@ -143,6 +143,8 @@ function runReadinessProcess(command, args, options) {
 var import_node_fs = require("node:fs");
 var import_node_os = require("node:os");
 var import_node_path = require("node:path");
+var TRASH_READINESS_MAX_TIMEOUT_MS = 60000;
+var TRASH_READINESS_NATIVE_TIMEOUT_SECONDS = TRASH_READINESS_MAX_TIMEOUT_MS / 1000 + 5;
 
 class ReadinessError extends Error {
   code;
@@ -171,7 +173,7 @@ function inside(home, path) {
 function parseTrashReadinessBinding(input, provider, home) {
   const b = input;
   need(isReadinessProvider(provider) && absolute(home), "binding_invalid");
-  need(keys(b, ["schema", "provider", "home", "runtime", "trash", "plan", "timeoutMs"]) && b.schema === "hasna.hooks.trash-readiness/v1" && b.provider === provider && b.home === home && pin(b.runtime) && pin(b.plan) && keys(b.trash, ["root", "version", "cliSha256"]) && absolute(b.trash.root) && typeof b.trash.version === "string" && b.trash.version.length <= 128 && /^\d+\.\d+\.\d+$/.test(b.trash.version) && digest(b.trash.cliSha256) && Number.isInteger(b.timeoutMs) && b.timeoutMs >= 1000 && b.timeoutMs <= 15000 && inside(home, b.plan.path) && inside(home, b.trash.root), "binding_invalid");
+  need(keys(b, ["schema", "provider", "home", "runtime", "trash", "plan", "timeoutMs"]) && b.schema === "hasna.hooks.trash-readiness/v1" && b.provider === provider && b.home === home && pin(b.runtime) && pin(b.plan) && keys(b.trash, ["root", "version", "cliSha256"]) && absolute(b.trash.root) && typeof b.trash.version === "string" && b.trash.version.length <= 128 && /^\d+\.\d+\.\d+$/.test(b.trash.version) && digest(b.trash.cliSha256) && Number.isInteger(b.timeoutMs) && b.timeoutMs >= 1000 && b.timeoutMs <= TRASH_READINESS_MAX_TIMEOUT_MS && inside(home, b.plan.path) && inside(home, b.trash.root), "binding_invalid");
   return structuredClone(b);
 }
 function trashReadinessBindingPath(provider, home = import_node_os.homedir()) {

package/bin/native-safety-entry.js

@@ -292,7 +292,7 @@ var REFUSED_VERBS = {
   unlink: "`unlink` is a delete that trash-guard does not rewrite. Re-run it as `rm -- <path>` and it is redirected into trash.",
   shred: "`shred` destroys content irrecoverably and is never allowed. Re-run it as `rm -- <path>` and it is redirected into trash."
 };
-var OPAQUE_COMMANDS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "eval", "source", ".", "su", "runuser"]);
+var OPAQUE_COMMANDS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "eval", "source", ".", "su", "runuser", "env"]);
 var WRAPPERS = {
   sudo: ["-u", "--user", "-g", "--group", "-p", "--prompt", "-C", "--chdir", "-h", "--host", "-r", "--role", "-t", "--type", "-U", "--other-user"],
   doas: ["-u", "-C"],
@@ -306,7 +306,7 @@ var WRAPPERS = {
   setsid: [],
   command: [],
   builtin: [],
-  exec: []
+  exec: ["-a"]
 };
 var WRAPPER_POSITIONALS = {
   timeout: 1
@@ -318,6 +318,9 @@ var DELETE_VERB_WORD_RE = /(^|[^A-Za-z0-9_.-])(rm|rmdir|unlink|shred)(?![A-Za-z0
 function mentionsDeleteVerb(text) {
   return DELETE_VERB_WORD_RE.test(decodeWord(text));
 }
+function envSplitCommandText(words) {
+  return words.map((word) => word.replace(/^-[iv0]*S|^--split-string=/, " ")).join(" ");
+}
 var ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
 function baseVerb(word) {
   const slash = word.lastIndexOf("/");
@@ -340,8 +343,8 @@ function lexCommand(command) {
       if (pendingRedirect)
         redirects.add(index);
       wordStart = -1;
+      pendingRedirect = false;
     }
-    pendingRedirect = false;
   };
   const closeSegment = (end) => {
     closeWord(end);
@@ -349,6 +352,7 @@ function lexCommand(command) {
       segments.push({ words, redirects });
     words = [];
     redirects = new Set;
+    pendingRedirect = false;
   };
   const scanSingle = (from) => {
     const end = command.indexOf("'", from + 1);
@@ -495,9 +499,13 @@ function lexCommand(command) {
       continue;
     }
     if (ch === ">" || ch === "<") {
+      if (wordStart >= 0 && /^\d+$/.test(command.slice(wordStart, i)))
+        wordStart = -1;
       closeWord(i);
       pendingRedirect = true;
-      i += command[i + 1] === ch && ch === ">" ? 2 : 1;
+      i++;
+      if (command[i] === ch || command[i] === "&" || ch === ">" && command[i] === "|" || ch === "<" && command[i] === ">")
+        i++;
       continue;
     }
     if (ch === "'") {
@@ -626,6 +634,10 @@ function commandWordIndex(segment) {
   let index = 0;
   let guard = 0;
   while (index < segment.words.length && guard++ < 32) {
+    if (segment.redirects.has(index)) {
+      index++;
+      continue;
+    }
     const raw = segment.words[index].text;
     const decoded = decodeWord(raw);
     if (ASSIGNMENT_RE.test(decoded) && !decoded.startsWith("-")) {
@@ -636,10 +648,25 @@ function commandWordIndex(segment) {
       index++;
       continue;
     }
-    const wrapperValues = WRAPPERS[decoded];
+    const wrapper = baseVerb(decoded);
+    if (wrapper === "command") {
+      for (const word of segment.words.filter((_, at) => at > index && !segment.redirects.has(at))) {
+        const option = decodeWord(word.text);
+        if (option === "--" || !option.startsWith("-"))
+          break;
+        if (/^-[pvV]*[vV][pvV]*$/.test(option))
+          return -1;
+      }
+    }
+    const wrapperValues = WRAPPERS[wrapper];
     if (wrapperValues) {
+      const wrapperIndex = index;
       index++;
       while (index < segment.words.length) {
+        if (segment.redirects.has(index)) {
+          index++;
+          continue;
+        }
         const option = decodeWord(segment.words[index].text);
         if (!option.startsWith("-") || option === "-")
           break;
@@ -647,11 +674,16 @@ function commandWordIndex(segment) {
           index++;
           break;
         }
+        if (wrapper === "env" && (/^-[iv0]*S/.test(option) || /^--split-string(?:=|$)/.test(option)))
+          return wrapperIndex;
         index++;
-        if (wrapperValues.includes(option))
+        if (wrapperValues.includes(option) || wrapper === "exec" && /^-[cl]*a$/.test(option)) {
+          while (segment.redirects.has(index))
+            index++;
           index++;
+        }
       }
-      let positionals = WRAPPER_POSITIONALS[decoded] ?? 0;
+      let positionals = WRAPPER_POSITIONALS[wrapper] ?? 0;
       while (positionals > 0 && index < segment.words.length) {
         const positional = decodeWord(segment.words[index].text);
         if (positional.startsWith("-") && positional !== "-")
@@ -862,7 +894,8 @@ function scanCommand(command, options) {
       });
       continue;
     }
-    if (OPAQUE_COMMANDS.has(verb) && mentionsDeleteVerb(segmentText(segment))) {
+    const opaqueText = verb === "env" ? envSplitCommandText(segment.words.map((word) => decodeWord(word.text))) : segmentText(segment);
+    if (OPAQUE_COMMANDS.has(verb) && mentionsDeleteVerb(opaqueText)) {
       result.refusals.push({
         reason: `\`${verb}\` runs a command string this hook cannot rewrite in place. Run the delete directly as \`rm -- <path>\` (intercepted and redirected into trash), or as a script that uses \`trash guard\` itself.`
       });
@@ -1305,6 +1338,61 @@ function shellWords(command) {
   return words;
 }
 function segmentOperation(segment) {
+  const trimmed = segment.trim();
+  if (!trimmed)
+    return "read";
+  const parsed = lexCommand(trimmed);
+  if (!parsed.trustworthy || parsed.substitutions.length || /\$\{[^}]*[|;()]|[<>]\(/.test(trimmed))
+    return opaqueOperation(trimmed);
+  const operations = parsed.segments.map((part) => {
+    const index = commandWordIndex(part);
+    if (index < 0)
+      return "read";
+    const words = part.words.filter((_, at) => at >= index && !part.redirects.has(at)).map((word) => decodeWord(word.text));
+    const tool = words[0].split("/").pop();
+    if (["rm", "rmdir", "unlink", "shred", "rmtree", "del"].includes(tool ?? ""))
+      return "delete";
+    if (tool === "trash") {
+      let at = 1;
+      while (at < words.length && words[at].startsWith("-")) {
+        const flag = words[at++];
+        if (["--help", "-h", "--version", "-V", "--identity"].includes(flag))
+          return "read";
+        if (["--agent", "--spool", "--files", "--info", "--config"].includes(flag))
+          at++;
+        else if (!["--json", "--local"].includes(flag))
+          return "delete";
+      }
+      if (at === words.length || ["status", "doctor", "list", "info", "get", "pending", "station", "setup", "backup", "storage", "retrieval", "backup-storage", "backup-inspect", "backup-refresh", "help"].includes(words[at]))
+        return "read";
+      if (["restore", "restore-capsule"].includes(words[at]))
+        return "write";
+      return "delete";
+    }
+    if (tool === "git") {
+      const sub = gitSubcommand(part, index);
+      if (sub === "clean" || sub === "rm")
+        return "delete";
+      return sub === "clone" || sub === "init" ? "write" : "read";
+    }
+    if (tool === "env" && mentionsDeleteVerb(envSplitCommandText(words)))
+      return "delete";
+    if (["sh", "bash", "zsh", "dash", "ksh", "ash", "eval", "source", ".", "su", "runuser", "env", "xargs", "find", "busybox", "toybox"].includes(tool ?? "")) {
+      return opaqueOperation(words.join(" "));
+    }
+    if (["mkdir", "mkfile", "touch", "mv", "cp", "ln", "tee", "install", "dd", "rsync", "scp", "truncate"].includes(tool ?? ""))
+      return "write";
+    if (tool === "curl" || tool === "wget")
+      return WRITE_FLAGS.test(words.join(" ")) ? "write" : "read";
+    if (tool === "sed" && words.slice(1).some((word) => /^-i|^--in-place(?:=|$)/.test(word)))
+      return "write";
+    if (["python", "python3", "node", "bun"].includes(tool ?? "") && words.some((word) => word === "-c" || word === "-e"))
+      return "write";
+    return "read";
+  });
+  return operations.includes("delete") ? "delete" : operations.includes("write") ? "write" : "read";
+}
+function opaqueOperation(segment) {
   const trimmed = segment.trim();
   if (!trimmed)
     return "read";

package/bin/serve.js

@@ -676,7 +676,7 @@ function getHook(name) {
 import { existsSync as existsSync2, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "fs";
 import { basename, dirname, isAbsolute, join as join3, normalize, resolve as resolve2, sep } from "path";
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
   void: () => voidType,
@@ -788,7 +788,7 @@ __export(exports_external, {
   BRAND: () => BRAND
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
   util2.assertEqual = (_) => {};
@@ -919,7 +919,7 @@ var getParsedType = (data) => {
   }
 };
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode = util.arrayToEnum([
   "invalid_type",
   "invalid_literal",
@@ -1038,7 +1038,7 @@ ZodError.create = (issues) => {
   return error;
 };
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -1141,7 +1141,7 @@ var errorMap = (issue, _ctx) => {
 };
 var en_default = errorMap;
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
 var overrideErrorMap = en_default;
 function setErrorMap(map) {
   overrideErrorMap = map;
@@ -1149,7 +1149,7 @@ function setErrorMap(map) {
 function getErrorMap() {
   return overrideErrorMap;
 }
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
   const { data, path, errorMaps, issueData } = params;
   const fullPath = [...path, ...issueData.path || []];
@@ -1255,14 +1255,14 @@ var isAborted = (x) => x.status === "aborted";
 var isDirty = (x) => x.status === "dirty";
 var isValid = (x) => x.status === "valid";
 var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
   errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
   errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
 })(errorUtil || (errorUtil = {}));
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
 class ParseInputLazyPath {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -5362,7 +5362,7 @@ import { readFileSync as readFileSync5 } from "fs";
 import { dirname as dirname4, join as join8 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 
-// ../../../../codex0157-source-repair/isolated-build/repo/apps/hooks/node_modules/@hasna/contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.2.2+944b86d8024e79fa/node_modules/@hasna/contracts/dist/client/transport.js
 import { spawnSync } from "child_process";
 import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync22 } from "fs";
 import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";

package/dist/index.js

@@ -581,7 +581,7 @@ var init_redact = __esm(() => {
   ];
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType = (data) => {
   const t = typeof data;
   switch (t) {
@@ -712,7 +712,7 @@ var init_util = __esm(() => {
   ]);
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode, quotelessJson = (obj) => {
   const json = JSON.stringify(obj, null, 2);
   return json.replace(/"([^"]+)":/g, "$1:");
@@ -833,7 +833,7 @@ var init_ZodError = __esm(() => {
   };
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -940,7 +940,7 @@ var init_en = __esm(() => {
   en_default = errorMap;
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
 function setErrorMap(map) {
   overrideErrorMap = map;
 }
@@ -953,7 +953,7 @@ var init_errors = __esm(() => {
   overrideErrorMap = en_default;
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 function addIssueToContext(ctx, issueData) {
   const overrideMap = getErrorMap();
   const issue = makeIssue({
@@ -1058,10 +1058,10 @@ var init_parseUtil = __esm(() => {
   });
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/typeAliases.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/typeAliases.js
 var init_typeAliases = () => {};
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 var init_errorUtil = __esm(() => {
   (function(errorUtil2) {
@@ -1070,7 +1070,7 @@ var init_errorUtil = __esm(() => {
   })(errorUtil || (errorUtil = {}));
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
 class ParseInputLazyPath {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -4421,7 +4421,7 @@ var init_types = __esm(() => {
   NEVER = INVALID;
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
   void: () => voidType,
@@ -4541,7 +4541,7 @@ var init_external = __esm(() => {
   init_ZodError();
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/index.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/index.js
 var init_zod = __esm(() => {
   init_external();
   init_external();
@@ -5101,7 +5101,7 @@ var init_profiles = __esm(() => {
   init_app_home();
 });
 
-// ../../../../codex0157-source-repair/isolated-build/repo/apps/hooks/node_modules/@hasna/contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.2.2+944b86d8024e79fa/node_modules/@hasna/contracts/dist/client/transport.js
 import { isIP } from "net";
 import { spawnSync } from "child_process";
 import { closeSync as closeSync22, fstatSync as fstatSync22, openSync as openSync22, readFileSync as readFileSync22 } from "fs";
@@ -7547,6 +7547,66 @@ import { join as join10, dirname as dirname7, basename as basename3, resolve as
 import { homedir as homedir6 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
+// src/lib/readiness-process.ts
+var supervisor = String.raw`
+  const {spawn}=require("node:child_process");
+  const spec=JSON.parse(process.argv.at(-1));
+  // This runtime was created detached and is its group's live leader. Its
+  // independent timer and parent pipe remain effective if the observer exits
+  // or its event loop stops responding. Only this freshly created tree is hit.
+  const cleanup=()=>{try{process.kill(-process.pid,"SIGKILL")}catch{process.exit(1)}};
+  setTimeout(cleanup,spec.timeout);
+  process.stdin.once("end",cleanup);
+  process.stdin.once("error",cleanup);
+  process.stdin.on("data",cleanup);
+  process.stdin.resume();
+  for(const signal of ["SIGTERM","SIGINT","SIGHUP"])process.once(signal,cleanup);
+  let done=false, out=Buffer.alloc(0), err=Buffer.alloc(0);
+  function report(status,error){
+    if(done)return; done=true;
+    process.stdout.write(JSON.stringify({status,error,stdout:out.toString("utf8"),stderr:err.toString("utf8")})+"\n");
+  }
+  const child=spawn(spec.command,spec.args,{stdio:["ignore","pipe","pipe"],env:process.env});
+  for(const [stream,name] of [[child.stdout,"stdout"],[child.stderr,"stderr"]]){
+    stream.on("data",bytes=>{
+      if(done)return;
+      const before=name==="stdout"?out:err;
+      if(before.length+bytes.length>spec.maxBuffer){report(null,{code:"ENOBUFS"});return}
+      if(name==="stdout")out=Buffer.concat([out,bytes]);else err=Buffer.concat([err,bytes]);
+    });
+    stream.on("error",()=>report(null,{code:"ECHILD"}));
+  }
+  child.on("error",()=>report(null,{code:"ECHILD"}));
+  // A successful observation includes complete streams. A nested client that
+  // keeps them open after its parent exits is a failure requiring group cleanup.
+  child.on("exit",()=>setTimeout(()=>report(null,{code:"ECHILD"}),100));
+  child.on("close",(status,signal)=>report(status,signal?{code:"ECHILD"}:undefined));
+`;
+
+// src/native-readiness.ts
+var TRASH_READINESS_MAX_TIMEOUT_MS = 60000;
+var TRASH_READINESS_NATIVE_TIMEOUT_SECONDS = TRASH_READINESS_MAX_TIMEOUT_MS / 1000 + 5;
+function isReadinessProvider(value) {
+  return value === "claude" || value === "codex" || value === "sumi";
+}
+var safeFailureCodes = new Set([
+  "unsupported_platform",
+  "station_detection_failed",
+  "station_mismatch",
+  "hosted_unavailable",
+  "authentication_refused",
+  "station_setup_required",
+  "invalid_status",
+  "deadline_exceeded",
+  "retention_mismatch",
+  "managed_instructions_refused",
+  "removal_instruction_missing",
+  "instructions_changed",
+  "native_config_changed",
+  "guard_refused",
+  "owner_refused"
+]);
+
 // src/lib/resolve.ts
 import { dirname as dirname2, join as join6 } from "path";
 import { existsSync as existsSync5 } from "fs";
@@ -7774,66 +7834,6 @@ import { createHash as createHash2 } from "crypto";
 import { constants as constants2, closeSync as closeSync2, existsSync as existsSync7, fstatSync as fstatSync2, lstatSync as lstatSync2, openSync as openSync2, readFileSync as readFileSync4, realpathSync as realpathSync3 } from "fs";
 import { dirname as dirname4, isAbsolute as isAbsolute3, join as join8 } from "path";
 import { homedir as homedir4 } from "os";
-
-// src/lib/readiness-process.ts
-var supervisor = String.raw`
-  const {spawn}=require("node:child_process");
-  const spec=JSON.parse(process.argv.at(-1));
-  // This runtime was created detached and is its group's live leader. Its
-  // independent timer and parent pipe remain effective if the observer exits
-  // or its event loop stops responding. Only this freshly created tree is hit.
-  const cleanup=()=>{try{process.kill(-process.pid,"SIGKILL")}catch{process.exit(1)}};
-  setTimeout(cleanup,spec.timeout);
-  process.stdin.once("end",cleanup);
-  process.stdin.once("error",cleanup);
-  process.stdin.on("data",cleanup);
-  process.stdin.resume();
-  for(const signal of ["SIGTERM","SIGINT","SIGHUP"])process.once(signal,cleanup);
-  let done=false, out=Buffer.alloc(0), err=Buffer.alloc(0);
-  function report(status,error){
-    if(done)return; done=true;
-    process.stdout.write(JSON.stringify({status,error,stdout:out.toString("utf8"),stderr:err.toString("utf8")})+"\n");
-  }
-  const child=spawn(spec.command,spec.args,{stdio:["ignore","pipe","pipe"],env:process.env});
-  for(const [stream,name] of [[child.stdout,"stdout"],[child.stderr,"stderr"]]){
-    stream.on("data",bytes=>{
-      if(done)return;
-      const before=name==="stdout"?out:err;
-      if(before.length+bytes.length>spec.maxBuffer){report(null,{code:"ENOBUFS"});return}
-      if(name==="stdout")out=Buffer.concat([out,bytes]);else err=Buffer.concat([err,bytes]);
-    });
-    stream.on("error",()=>report(null,{code:"ECHILD"}));
-  }
-  child.on("error",()=>report(null,{code:"ECHILD"}));
-  // A successful observation includes complete streams. A nested client that
-  // keeps them open after its parent exits is a failure requiring group cleanup.
-  child.on("exit",()=>setTimeout(()=>report(null,{code:"ECHILD"}),100));
-  child.on("close",(status,signal)=>report(status,signal?{code:"ECHILD"}:undefined));
-`;
-
-// src/native-readiness.ts
-function isReadinessProvider(value) {
-  return value === "claude" || value === "codex" || value === "sumi";
-}
-var safeFailureCodes = new Set([
-  "unsupported_platform",
-  "station_detection_failed",
-  "station_mismatch",
-  "hosted_unavailable",
-  "authentication_refused",
-  "station_setup_required",
-  "invalid_status",
-  "deadline_exceeded",
-  "retention_mismatch",
-  "managed_instructions_refused",
-  "removal_instruction_missing",
-  "instructions_changed",
-  "native_config_changed",
-  "guard_refused",
-  "owner_refused"
-]);
-
-// src/lib/native-readiness-command.ts
 var quote2 = (value) => "'" + value.replaceAll("'", "'\\''") + "'";
 var bootstrap = String.raw`/* hasna-native-readiness-v1 */ (() => {
   const fs = require("node:fs"), path = require("node:path"), crypto = require("node:crypto");
@@ -8106,7 +8106,7 @@ function writeHookSettingsPreimage(path, settings, before) {
 // src/lib/claude-skills-coordination.ts
 import { createHash as createHash6 } from "crypto";
 
-// ../../../../../../../../.bun/install/cache/@hasna/skills@0.9.17@@@1/dist/index.js
+// ../../node_modules/.bun/@hasna+skills@0.9.17+a00d3064559565bb/node_modules/@hasna/skills/dist/index.js
 import { existsSync as existsSync10 } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join9, resolve as resolve3 } from "path";
@@ -39769,7 +39769,7 @@ function registerHook(name, scope = "global", target = "claude", profile, mement
     name,
     event: "SessionStart",
     matcher: "^(startup|resume|clear|fork)$",
-    timeoutSeconds: 20,
+    timeoutSeconds: TRASH_READINESS_NATIVE_TIMEOUT_SECONDS,
     displayName: "Trash Readiness",
     description: "Read-only native startup readiness",
     version: "0.1.0",
@@ -41563,7 +41563,7 @@ function selectCodexSafety(discovery, configuration, home, cwd, featureEnabled,
   need5(selected.length !== 0, "guard_missing");
   need5(selected.length === 1, "guard_ambiguous");
   const hook = selected[0], binding = readiness ? nativeReadinessCommandBinding(hook.command) : nativeSafetyCommandBinding(hook.command);
-  need5(binding.home === home && (!readiness || binding?.provider === "codex") && hook.eventName === (readiness ? "sessionStart" : "preToolUse") && hook.handlerType === "command" && hook.matcher === (readiness ? "^(startup|resume|clear|fork)$" : matcher) && hook.timeoutSec === (readiness ? 20 : 10) && hook.async === false && hook.statusMessage === null && hook.additionalContextLimit === null && typeof hook.key === "string" && hook.key.length <= 4096 && typeof hook.sourcePath === "string" && isAbsolute17(hook.sourcePath) && hook.pluginId === null && hook.isManaged === false && ["user", "project"].includes(hook.source) && typeof hook.currentHash === "string" && /^sha256:[a-f0-9]{64}$/.test(hook.currentHash), "guard_definition_invalid");
+  need5(binding.home === home && (!readiness || binding?.provider === "codex") && hook.eventName === (readiness ? "sessionStart" : "preToolUse") && hook.handlerType === "command" && hook.matcher === (readiness ? "^(startup|resume|clear|fork)$" : matcher) && hook.timeoutSec === (readiness ? TRASH_READINESS_NATIVE_TIMEOUT_SECONDS : 10) && hook.async === false && hook.statusMessage === null && hook.additionalContextLimit === null && typeof hook.key === "string" && hook.key.length <= 4096 && typeof hook.sourcePath === "string" && isAbsolute17(hook.sourcePath) && hook.pluginId === null && hook.isManaged === false && ["user", "project"].includes(hook.source) && typeof hook.currentHash === "string" && /^sha256:[a-f0-9]{64}$/.test(hook.currentHash), "guard_definition_invalid");
   need5(typeof hook.enabled === "boolean" && ["trusted", "untrusted", "modified"].includes(hook.trustStatus), "guard_definition_invalid");
   if (requireReady) {
     need5(hook.enabled === true, "guard_disabled");

package/dist/native-readiness.d.ts

@@ -1,5 +1,8 @@
 import { type ReadinessChildResult, type ReadinessProcessOptions } from "./lib/readiness-process";
 export type ReadinessProvider = "claude" | "codex" | "sumi";
+export declare const TRASH_READINESS_DEFAULT_TIMEOUT_MS = 45000;
+export declare const TRASH_READINESS_MAX_TIMEOUT_MS = 60000;
+export declare const TRASH_READINESS_NATIVE_TIMEOUT_SECONDS: number;
 type Pin = {
     path: string;
     sha256: string;

package/dist/native-readiness.js

@@ -144,6 +144,9 @@ function runReadinessProcess(command, args, options) {
 import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync } from "fs";
 import { homedir } from "os";
 import { dirname, isAbsolute, join, relative, resolve } from "path";
+var TRASH_READINESS_DEFAULT_TIMEOUT_MS = 45000;
+var TRASH_READINESS_MAX_TIMEOUT_MS = 60000;
+var TRASH_READINESS_NATIVE_TIMEOUT_SECONDS = TRASH_READINESS_MAX_TIMEOUT_MS / 1000 + 5;
 
 class ReadinessError extends Error {
   code;
@@ -172,7 +175,7 @@ function inside(home, path) {
 function parseTrashReadinessBinding(input, provider, home) {
   const b = input;
   need(isReadinessProvider(provider) && absolute(home), "binding_invalid");
-  need(keys(b, ["schema", "provider", "home", "runtime", "trash", "plan", "timeoutMs"]) && b.schema === "hasna.hooks.trash-readiness/v1" && b.provider === provider && b.home === home && pin(b.runtime) && pin(b.plan) && keys(b.trash, ["root", "version", "cliSha256"]) && absolute(b.trash.root) && typeof b.trash.version === "string" && b.trash.version.length <= 128 && /^\d+\.\d+\.\d+$/.test(b.trash.version) && digest(b.trash.cliSha256) && Number.isInteger(b.timeoutMs) && b.timeoutMs >= 1000 && b.timeoutMs <= 15000 && inside(home, b.plan.path) && inside(home, b.trash.root), "binding_invalid");
+  need(keys(b, ["schema", "provider", "home", "runtime", "trash", "plan", "timeoutMs"]) && b.schema === "hasna.hooks.trash-readiness/v1" && b.provider === provider && b.home === home && pin(b.runtime) && pin(b.plan) && keys(b.trash, ["root", "version", "cliSha256"]) && absolute(b.trash.root) && typeof b.trash.version === "string" && b.trash.version.length <= 128 && /^\d+\.\d+\.\d+$/.test(b.trash.version) && digest(b.trash.cliSha256) && Number.isInteger(b.timeoutMs) && b.timeoutMs >= 1000 && b.timeoutMs <= TRASH_READINESS_MAX_TIMEOUT_MS && inside(home, b.plan.path) && inside(home, b.trash.root), "binding_invalid");
   return structuredClone(b);
 }
 function trashReadinessBindingPath(provider, home = homedir()) {
@@ -324,5 +327,8 @@ export {
   parseTrashReadinessBinding,
   isReadinessProvider,
   handleReadinessSessionStart,
-  checkTrashReadinessBinding
+  checkTrashReadinessBinding,
+  TRASH_READINESS_NATIVE_TIMEOUT_SECONDS,
+  TRASH_READINESS_MAX_TIMEOUT_MS,
+  TRASH_READINESS_DEFAULT_TIMEOUT_MS
 };

package/dist/sdk/index.js

@@ -1,5 +1,5 @@
 // @bun
-// ../../../../codex0157-source-repair/isolated-build/repo/apps/hooks/node_modules/@hasna/contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.2.2+944b86d8024e79fa/node_modules/@hasna/contracts/dist/client/transport.js
 import { isIP } from "net";
 import { spawnSync } from "child_process";
 import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync2 } from "fs";