@hasna/hooks 0.11.3 → 0.11.5

package/hooks/hook-trash-guard/src/hook.ts

@@ -103,7 +103,7 @@ const REFUSED_VERBS: Record<string, string> = {
  * place. When one of these is in command position and the command mentions a
  * delete verb, the command is refused rather than guessed at.
  */
-const OPAQUE_COMMANDS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "eval", "source", ".", "su", "runuser"]);
+const OPAQUE_COMMANDS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "eval", "source", ".", "su", "runuser", "env"]);
 
 /** Wrapper commands whose real command follows them (with their value-taking options). */
 const WRAPPERS: Record<string, string[]> = {
@@ -119,7 +119,7 @@ const WRAPPERS: Record<string, string[]> = {
   setsid: [],
   command: [],
   builtin: [],
-  exec: [],
+  exec: ["-a"],
 };
 
 /**
@@ -156,6 +156,12 @@ export function mentionsDeleteVerb(text: string): boolean {
   return DELETE_VERB_WORD_RE.test(decodeWord(text));
 }
 
+/** env's split-string value may be attached to its option. This text is used
+ * only to refuse an opaque delete, never as executable text or a rewrite. */
+export function envSplitCommandText(words: string[]): string {
+  return words.map((word) => word.replace(/^-[iv0]*S|^--split-string=/, " ")).join(" ");
+}
+
 const ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
 
 /**
@@ -238,8 +244,8 @@ export function lexCommand(command: string): LexResult {
       words.push({ text: command.slice(wordStart, end), start: wordStart, end });
       if (pendingRedirect) redirects.add(index);
       wordStart = -1;
+      pendingRedirect = false;
     }
-    pendingRedirect = false;
   };
 
   const closeSegment = (end: number): void => {
@@ -247,6 +253,7 @@ export function lexCommand(command: string): LexResult {
     if (words.length > 0) segments.push({ words, redirects });
     words = [];
     redirects = new Set<number>();
+    pendingRedirect = false;
   };
 
   const scanSingle = (from: number): number => {
@@ -390,9 +397,13 @@ export function lexCommand(command: string): LexResult {
       continue;
     }
     if (ch === ">" || ch === "<") {
+      // An unquoted adjacent descriptor number belongs to the redirect, not
+      // the command. Its following operand is also never an executable.
+      if (wordStart >= 0 && /^\d+$/.test(command.slice(wordStart, i))) wordStart = -1;
       closeWord(i);
       pendingRedirect = true;
-      i += command[i + 1] === ch && ch === ">" ? 2 : 1;
+      i++;
+      if (command[i] === ch || command[i] === "&" || (ch === ">" && command[i] === "|") || (ch === "<" && command[i] === ">")) i++;
       continue;
     }
     if (ch === "'") {
@@ -521,10 +532,11 @@ export function decodeWord(text: string): string {
  * command wrappers — NOT any word that happens to read like a verb, so
  * `printf '%s\n' rm` is not a delete.
  */
-function commandWordIndex(segment: Segment): number {
+export function commandWordIndex(segment: Segment): number {
   let index = 0;
   let guard = 0;
   while (index < segment.words.length && guard++ < 32) {
+    if (segment.redirects.has(index)) { index++; continue; }
     const raw = segment.words[index].text;
     const decoded = decodeWord(raw);
     if (ASSIGNMENT_RE.test(decoded) && !decoded.startsWith("-")) {
@@ -535,20 +547,37 @@ function commandWordIndex(segment: Segment): number {
       index++;
       continue;
     }
-    const wrapperValues = WRAPPERS[decoded];
+    const wrapper = baseVerb(decoded);
+    // command -v/-V looks up every following name without executing one.
+    if (wrapper === "command") {
+      for (const word of segment.words.filter((_, at) => at > index && !segment.redirects.has(at))) {
+        const option = decodeWord(word.text);
+        if (option === "--" || !option.startsWith("-")) break;
+        if (/^-[pvV]*[vV][pvV]*$/.test(option)) return -1;
+      }
+    }
+    const wrapperValues = WRAPPERS[wrapper];
     if (wrapperValues) {
+      const wrapperIndex = index;
       index++;
       while (index < segment.words.length) {
+        if (segment.redirects.has(index)) { index++; continue; }
         const option = decodeWord(segment.words[index].text);
         if (!option.startsWith("-") || option === "-") break;
         if (option === "--") {
           index++;
           break;
         }
+        // env -S reparses its value as a command string. Retain env in
+        // command position so the opaque-command refusal owns this form.
+        if (wrapper === "env" && (/^-[iv0]*S/.test(option) || /^--split-string(?:=|$)/.test(option))) return wrapperIndex;
         index++;
-        if (wrapperValues.includes(option)) index++;
+        if (wrapperValues.includes(option) || (wrapper === "exec" && /^-[cl]*a$/.test(option))) {
+          while (segment.redirects.has(index)) index++;
+          index++;
+        }
       }
-      let positionals = WRAPPER_POSITIONALS[decoded] ?? 0;
+      let positionals = WRAPPER_POSITIONALS[wrapper] ?? 0;
       while (positionals > 0 && index < segment.words.length) {
         const positional = decodeWord(segment.words[index].text);
         if (positional.startsWith("-") && positional !== "-") break;
@@ -814,7 +843,8 @@ export function scanCommand(command: string, options: { cwd: string; home: strin
       continue;
     }
 
-    if (OPAQUE_COMMANDS.has(verb) && mentionsDeleteVerb(segmentText(segment))) {
+    const opaqueText = verb === "env" ? envSplitCommandText(segment.words.map((word) => decodeWord(word.text))) : segmentText(segment);
+    if (OPAQUE_COMMANDS.has(verb) && mentionsDeleteVerb(opaqueText)) {
       result.refusals.push({
         reason: `\`${verb}\` runs a command string this hook cannot rewrite in place. Run the delete directly as \`rm -- <path>\` (intercepted and redirected into trash), or as a script that uses \`trash guard\` itself.`,
       });
@@ -849,7 +879,7 @@ function segmentText(segment: Segment): string {
 }
 
 /** The git subcommand, skipping git's own value-taking global options. */
-function gitSubcommand(segment: Segment, verbIndex: number): string | null {
+export function gitSubcommand(segment: Segment, verbIndex: number): string | null {
   let index = verbIndex + 1;
   while (index < segment.words.length) {
     const option = decodeWord(segment.words[index].text);

package/hooks/hook-workspace-repos-guard/src/hook.ts

@@ -52,6 +52,7 @@
 import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, statSync } from "fs";
 import { homedir } from "os";
 import { dirname, isAbsolute, join, normalize, relative, resolve, sep } from "path";
+import { commandWordIndex, decodeWord, envSplitCommandText, gitSubcommand, lexCommand, mentionsDeleteVerb } from "../../hook-trash-guard/src/hook";
 import {
   getCommand,
   readInput,
@@ -364,6 +365,51 @@ function shellWords(command: string): ShellWord[] {
 function segmentOperation(segment: string): Operation {
   const trimmed = segment.trim();
   if (!trimmed) return "read";
+  const parsed = lexCommand(trimmed);
+  // Preserve conservative classification where the shell body is opaque.
+  if (!parsed.trustworthy || parsed.substitutions.length || /\$\{[^}]*[|;()]|[<>]\(/.test(trimmed)) return opaqueOperation(trimmed);
+  const operations = parsed.segments.map((part): Operation => {
+    const index = commandWordIndex(part);
+    if (index < 0) return "read";
+    const words = part.words.filter((_, at) => at >= index && !part.redirects.has(at)).map((word) => decodeWord(word.text));
+    const tool = words[0].split("/").pop();
+    if (["rm", "rmdir", "unlink", "shred", "rmtree", "del"].includes(tool ?? "")) return "delete";
+    if (tool === "trash") {
+      // Hasna metadata/setup verbs take identifiers, not paths to remove.
+      // Keep legacy positional Trash clients and capture verbs guarded.
+      let at = 1;
+      while (at < words.length && words[at].startsWith("-")) {
+        const flag = words[at++];
+        if (["--help", "-h", "--version", "-V", "--identity"].includes(flag)) return "read";
+        if (["--agent", "--spool", "--files", "--info", "--config"].includes(flag)) at++;
+        else if (!["--json", "--local"].includes(flag)) return "delete";
+      }
+      if (at === words.length || ["status", "doctor", "list", "info", "get", "pending", "station", "setup", "backup", "storage", "retrieval", "backup-storage", "backup-inspect", "backup-refresh", "help"].includes(words[at])) return "read";
+      if (["restore", "restore-capsule"].includes(words[at])) return "write";
+      return "delete";
+    }
+    if (tool === "git") {
+      const sub = gitSubcommand(part, index);
+      if (sub === "clean" || sub === "rm") return "delete";
+      return sub === "clone" || sub === "init" ? "write" : "read";
+    }
+    if (tool === "env" && mentionsDeleteVerb(envSplitCommandText(words))) return "delete";
+    if (["sh", "bash", "zsh", "dash", "ksh", "ash", "eval", "source", ".", "su", "runuser", "env", "xargs", "find", "busybox", "toybox"].includes(tool ?? "")) {
+      return opaqueOperation(words.join(" "));
+    }
+    if (["mkdir", "mkfile", "touch", "mv", "cp", "ln", "tee", "install", "dd", "rsync", "scp", "truncate"].includes(tool ?? "")) return "write";
+    if (tool === "curl" || tool === "wget") return WRITE_FLAGS.test(words.join(" ")) ? "write" : "read";
+    if (tool === "sed" && words.slice(1).some((word) => /^-i|^--in-place(?:=|$)/.test(word))) return "write";
+    if (["python", "python3", "node", "bun"].includes(tool ?? "") && words.some((word) => word === "-c" || word === "-e")) return "write";
+    return "read";
+  });
+  return operations.includes("delete") ? "delete" : operations.includes("write") ? "write" : "read";
+}
+
+// Retain the prior conservative behavior for embedded shell bodies.
+function opaqueOperation(segment: string): Operation {
+  const trimmed = segment.trim();
+  if (!trimmed) return "read";
 
   if (/(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:rm|rmdir|unlink|shred|trash|rmtree|del)(?:\s|$)/.test(trimmed)) return "delete";
   if (/\bgit\b/.test(trimmed)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/hooks",
-  "version": "0.11.3",
+  "version": "0.11.5",
   "description": "Open source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command",
   "type": "module",
   "bin": {