@hasna/hooks 0.11.4 → 0.11.5

package/bin/hooks-mcp.js

@@ -1419,7 +1419,7 @@ var init_redact = __esm(() => {
   ];
 });
 
-// ../../../../codex0157-source-repair/isolated-build/repo/apps/hooks/node_modules/@hasna/contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.2.2+944b86d8024e79fa/node_modules/@hasna/contracts/dist/client/transport.js
 import { isIP } from "net";
 import { spawnSync } from "child_process";
 import { closeSync as closeSync22, fstatSync as fstatSync22, openSync as openSync22, readFileSync as readFileSync22 } from "fs";
@@ -3342,7 +3342,7 @@ function writeHookSettingsPreimage(path, settings, before) {
 // src/lib/claude-skills-coordination.ts
 import { createHash as createHash6 } from "crypto";
 
-// ../../../../../../../../.bun/install/cache/@hasna/skills@0.9.17@@@1/dist/index.js
+// ../../node_modules/.bun/@hasna+skills@0.9.17+a00d3064559565bb/node_modules/@hasna/skills/dist/index.js
 import { existsSync as existsSync10 } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join9, resolve as resolve3 } from "path";

package/bin/index.js

@@ -2520,7 +2520,7 @@ var init_codex_settings = __esm(() => {
   snapshots = new WeakMap;
 });
 
-// ../../../../../../../../.bun/install/cache/@hasna/skills@0.9.17@@@1/dist/index.js
+// ../../node_modules/.bun/@hasna+skills@0.9.17+a00d3064559565bb/node_modules/@hasna/skills/dist/index.js
 import { existsSync as existsSync10 } from "fs";
 import { homedir as homedir6 } from "os";
 import { join as join10, resolve as resolve4 } from "path";
@@ -35495,7 +35495,7 @@ var init_codex_safety_trust = __esm(() => {
   };
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/commander@12.1.0/node_modules/commander/lib/error.js
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/error.js
 var require_error = __commonJS((exports) => {
   class CommanderError extends Error {
     constructor(exitCode, code2, message) {
@@ -35519,7 +35519,7 @@ var require_error = __commonJS((exports) => {
   exports.InvalidArgumentError = InvalidArgumentError;
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/commander@12.1.0/node_modules/commander/lib/argument.js
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/argument.js
 var require_argument = __commonJS((exports) => {
   var { InvalidArgumentError } = require_error();
 
@@ -35598,7 +35598,7 @@ var require_argument = __commonJS((exports) => {
   exports.humanReadableArgName = humanReadableArgName;
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/commander@12.1.0/node_modules/commander/lib/help.js
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/help.js
 var require_help = __commonJS((exports) => {
   var { humanReadableArgName } = require_argument();
 
@@ -35847,7 +35847,7 @@ var require_help = __commonJS((exports) => {
   exports.Help = Help;
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/commander@12.1.0/node_modules/commander/lib/option.js
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/option.js
 var require_option = __commonJS((exports) => {
   var { InvalidArgumentError } = require_error();
 
@@ -35998,7 +35998,7 @@ var require_option = __commonJS((exports) => {
   exports.DualOptions = DualOptions;
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/commander@12.1.0/node_modules/commander/lib/suggestSimilar.js
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/suggestSimilar.js
 var require_suggestSimilar = __commonJS((exports) => {
   var maxDistance = 3;
   function editDistance(a, b) {
@@ -36071,7 +36071,7 @@ var require_suggestSimilar = __commonJS((exports) => {
   exports.suggestSimilar = suggestSimilar;
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/commander@12.1.0/node_modules/commander/lib/command.js
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/command.js
 var require_command = __commonJS((exports) => {
   var EventEmitter = __require("events").EventEmitter;
   var childProcess = __require("child_process");
@@ -37314,7 +37314,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
   exports.Command = Command;
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/commander@12.1.0/node_modules/commander/index.js
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/index.js
 var require_commander = __commonJS((exports) => {
   var { Argument } = require_argument();
   var { Command } = require_command();
@@ -37334,7 +37334,7 @@ var require_commander = __commonJS((exports) => {
   exports.InvalidOptionArgumentError = InvalidArgumentError;
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/cli-spinners@2.9.2/node_modules/cli-spinners/spinners.json
+// ../../node_modules/.bun/cli-spinners@2.9.2/node_modules/cli-spinners/spinners.json
 var require_spinners = __commonJS((exports, module) => {
   module.exports = {
     dots: {
@@ -38960,7 +38960,7 @@ var require_spinners = __commonJS((exports, module) => {
   };
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/cli-spinners@2.9.2/node_modules/cli-spinners/index.js
+// ../../node_modules/.bun/cli-spinners@2.9.2/node_modules/cli-spinners/index.js
 var require_cli_spinners = __commonJS((exports, module) => {
   var spinners = Object.assign({}, require_spinners());
   var spinnersList = Object.keys(spinners);
@@ -39144,7 +39144,7 @@ var init_profiles = __esm(() => {
   init_app_home();
 });
 
-// ../../../../codex0157-source-repair/isolated-build/repo/apps/hooks/node_modules/@hasna/contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.2.2+944b86d8024e79fa/node_modules/@hasna/contracts/dist/client/transport.js
 import { isIP as isIP2 } from "net";
 import { spawnSync as spawnSync2 } from "child_process";
 import { closeSync as closeSync22, fstatSync as fstatSync22, openSync as openSync22, readFileSync as readFileSync22 } from "fs";
@@ -43633,7 +43633,7 @@ async function verifyClaudeSafetyConfiguration(options = {}, dependencies = {})
 // src/cli/index.tsx
 init_codex_safety_trust();
 
-// ../../../../../../../repos/clones/hasna/apps/apps/events/dist/commander.js
+// ../events/dist/commander.js
 import { chmod, mkdir, readFile as readFile2, rename, writeFile } from "fs/promises";
 import { Buffer as Buffer2 } from "buffer";
 import { existsSync as existsSync22 } from "fs";
@@ -45289,7 +45289,7 @@ function replaySummary(events2, deliveries, nextCursor) {
 // src/cli/index.tsx
 import { render } from "ink";
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/commander@12.1.0/node_modules/commander/esm.mjs
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
 var {
   program: program2,
@@ -45315,11 +45315,11 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 import { useState as useState7 } from "react";
 import { Box as Box8, Text as Text10, useApp, useInput as useInput5 } from "ink";
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Indicator.js
+// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Indicator.js
 import React from "react";
 import { Box, Text } from "ink";
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/is-unicode-supported@2.1.0/node_modules/is-unicode-supported/index.js
+// ../../node_modules/.bun/is-unicode-supported@2.1.0/node_modules/is-unicode-supported/index.js
 import process3 from "process";
 function isUnicodeSupported() {
   const { env } = process3;
@@ -45330,7 +45330,7 @@ function isUnicodeSupported() {
   return Boolean(env.WT_SESSION) || Boolean(env.TERMINUS_SUBLIME) || env.ConEmuTask === "{cmd::Cmder}" || TERM_PROGRAM === "Terminus-Sublime" || TERM_PROGRAM === "vscode" || TERM === "xterm-256color" || TERM === "alacritty" || TERM === "rxvt-unicode" || TERM === "rxvt-unicode-256color" || env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/figures@6.1.0/node_modules/figures/index.js
+// ../../node_modules/.bun/figures@6.1.0/node_modules/figures/index.js
 var common2 = {
   circleQuestionMark: "(?)",
   questionMarkPrefix: "(?)",
@@ -45606,23 +45606,23 @@ var figures = shouldUseMain ? mainSymbols : fallbackSymbols;
 var figures_default = figures;
 var replacements = Object.entries(specialMainSymbols);
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Indicator.js
+// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Indicator.js
 function Indicator({ isSelected = false }) {
   return React.createElement(Box, { marginRight: 1 }, isSelected ? React.createElement(Text, { color: "blue" }, figures_default.pointer) : React.createElement(Text, null, " "));
 }
 var Indicator_default = Indicator;
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Item.js
+// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Item.js
 import * as React2 from "react";
 import { Text as Text2 } from "ink";
 function Item({ isSelected = false, label }) {
   return React2.createElement(Text2, { color: isSelected ? "blue" : undefined }, label);
 }
 var Item_default = Item;
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/SelectInput.js
+// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/SelectInput.js
 import { isDeepStrictEqual } from "util";
 import React3, { useState, useEffect, useRef, useCallback } from "react";
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/to-rotated@1.0.0/node_modules/to-rotated/index.js
+// ../../node_modules/.bun/to-rotated@1.0.0/node_modules/to-rotated/index.js
 function toRotated(array3, steps) {
   if (!Array.isArray(array3)) {
     throw new TypeError(`Expected an array, got \`${typeof array3}\`.`);
@@ -45644,7 +45644,7 @@ function toRotated(array3, steps) {
   ];
 }
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/SelectInput.js
+// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/SelectInput.js
 import { Box as Box2, useInput } from "ink";
 function SelectInput({ items = [], isFocused = true, initialIndex = 0, indicatorComponent = Indicator_default, itemComponent = Item_default, limit: customLimit, onSelect, onHighlight }) {
   const hasLimit = typeof customLimit === "number" && items.length > customLimit;
@@ -45940,7 +45940,7 @@ function HookSelect({
 import { useState as useState4, useEffect as useEffect3 } from "react";
 import { Box as Box6, Text as Text7, useInput as useInput4 } from "ink";
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/ink-text-input@6.0.0+fa875fef9f949ebd/node_modules/ink-text-input/build/index.js
+// ../../node_modules/.bun/ink-text-input@6.0.0+fa875fef9f949ebd/node_modules/ink-text-input/build/index.js
 import React5, { useState as useState3, useEffect as useEffect2 } from "react";
 import { Text as Text6, useInput as useInput3 } from "ink";
 import chalk from "chalk";
@@ -46118,7 +46118,7 @@ function SearchView({
 import { useState as useState6, useEffect as useEffect5 } from "react";
 import { Box as Box7, Text as Text9 } from "ink";
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/ink-spinner@5.0.0+fa875fef9f949ebd/node_modules/ink-spinner/build/index.js
+// ../../node_modules/.bun/ink-spinner@5.0.0+fa875fef9f949ebd/node_modules/ink-spinner/build/index.js
 var import_cli_spinners = __toESM(require_cli_spinners(), 1);
 import React7, { useState as useState5, useEffect as useEffect4 } from "react";
 import { Text as Text8 } from "ink";

package/bin/native-safety-entry.js

@@ -292,7 +292,7 @@ var REFUSED_VERBS = {
   unlink: "`unlink` is a delete that trash-guard does not rewrite. Re-run it as `rm -- <path>` and it is redirected into trash.",
   shred: "`shred` destroys content irrecoverably and is never allowed. Re-run it as `rm -- <path>` and it is redirected into trash."
 };
-var OPAQUE_COMMANDS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "eval", "source", ".", "su", "runuser"]);
+var OPAQUE_COMMANDS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "eval", "source", ".", "su", "runuser", "env"]);
 var WRAPPERS = {
   sudo: ["-u", "--user", "-g", "--group", "-p", "--prompt", "-C", "--chdir", "-h", "--host", "-r", "--role", "-t", "--type", "-U", "--other-user"],
   doas: ["-u", "-C"],
@@ -306,7 +306,7 @@ var WRAPPERS = {
   setsid: [],
   command: [],
   builtin: [],
-  exec: []
+  exec: ["-a"]
 };
 var WRAPPER_POSITIONALS = {
   timeout: 1
@@ -318,6 +318,9 @@ var DELETE_VERB_WORD_RE = /(^|[^A-Za-z0-9_.-])(rm|rmdir|unlink|shred)(?![A-Za-z0
 function mentionsDeleteVerb(text) {
   return DELETE_VERB_WORD_RE.test(decodeWord(text));
 }
+function envSplitCommandText(words) {
+  return words.map((word) => word.replace(/^-[iv0]*S|^--split-string=/, " ")).join(" ");
+}
 var ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
 function baseVerb(word) {
   const slash = word.lastIndexOf("/");
@@ -340,8 +343,8 @@ function lexCommand(command) {
       if (pendingRedirect)
         redirects.add(index);
       wordStart = -1;
+      pendingRedirect = false;
     }
-    pendingRedirect = false;
   };
   const closeSegment = (end) => {
     closeWord(end);
@@ -349,6 +352,7 @@ function lexCommand(command) {
       segments.push({ words, redirects });
     words = [];
     redirects = new Set;
+    pendingRedirect = false;
   };
   const scanSingle = (from) => {
     const end = command.indexOf("'", from + 1);
@@ -495,9 +499,13 @@ function lexCommand(command) {
       continue;
     }
     if (ch === ">" || ch === "<") {
+      if (wordStart >= 0 && /^\d+$/.test(command.slice(wordStart, i)))
+        wordStart = -1;
       closeWord(i);
       pendingRedirect = true;
-      i += command[i + 1] === ch && ch === ">" ? 2 : 1;
+      i++;
+      if (command[i] === ch || command[i] === "&" || ch === ">" && command[i] === "|" || ch === "<" && command[i] === ">")
+        i++;
       continue;
     }
     if (ch === "'") {
@@ -626,6 +634,10 @@ function commandWordIndex(segment) {
   let index = 0;
   let guard = 0;
   while (index < segment.words.length && guard++ < 32) {
+    if (segment.redirects.has(index)) {
+      index++;
+      continue;
+    }
     const raw = segment.words[index].text;
     const decoded = decodeWord(raw);
     if (ASSIGNMENT_RE.test(decoded) && !decoded.startsWith("-")) {
@@ -636,10 +648,25 @@ function commandWordIndex(segment) {
       index++;
       continue;
     }
-    const wrapperValues = WRAPPERS[decoded];
+    const wrapper = baseVerb(decoded);
+    if (wrapper === "command") {
+      for (const word of segment.words.filter((_, at) => at > index && !segment.redirects.has(at))) {
+        const option = decodeWord(word.text);
+        if (option === "--" || !option.startsWith("-"))
+          break;
+        if (/^-[pvV]*[vV][pvV]*$/.test(option))
+          return -1;
+      }
+    }
+    const wrapperValues = WRAPPERS[wrapper];
     if (wrapperValues) {
+      const wrapperIndex = index;
       index++;
       while (index < segment.words.length) {
+        if (segment.redirects.has(index)) {
+          index++;
+          continue;
+        }
         const option = decodeWord(segment.words[index].text);
         if (!option.startsWith("-") || option === "-")
           break;
@@ -647,11 +674,16 @@ function commandWordIndex(segment) {
           index++;
           break;
         }
+        if (wrapper === "env" && (/^-[iv0]*S/.test(option) || /^--split-string(?:=|$)/.test(option)))
+          return wrapperIndex;
         index++;
-        if (wrapperValues.includes(option))
+        if (wrapperValues.includes(option) || wrapper === "exec" && /^-[cl]*a$/.test(option)) {
+          while (segment.redirects.has(index))
+            index++;
           index++;
+        }
       }
-      let positionals = WRAPPER_POSITIONALS[decoded] ?? 0;
+      let positionals = WRAPPER_POSITIONALS[wrapper] ?? 0;
       while (positionals > 0 && index < segment.words.length) {
         const positional = decodeWord(segment.words[index].text);
         if (positional.startsWith("-") && positional !== "-")
@@ -862,7 +894,8 @@ function scanCommand(command, options) {
       });
       continue;
     }
-    if (OPAQUE_COMMANDS.has(verb) && mentionsDeleteVerb(segmentText(segment))) {
+    const opaqueText = verb === "env" ? envSplitCommandText(segment.words.map((word) => decodeWord(word.text))) : segmentText(segment);
+    if (OPAQUE_COMMANDS.has(verb) && mentionsDeleteVerb(opaqueText)) {
       result.refusals.push({
         reason: `\`${verb}\` runs a command string this hook cannot rewrite in place. Run the delete directly as \`rm -- <path>\` (intercepted and redirected into trash), or as a script that uses \`trash guard\` itself.`
       });
@@ -1305,6 +1338,61 @@ function shellWords(command) {
   return words;
 }
 function segmentOperation(segment) {
+  const trimmed = segment.trim();
+  if (!trimmed)
+    return "read";
+  const parsed = lexCommand(trimmed);
+  if (!parsed.trustworthy || parsed.substitutions.length || /\$\{[^}]*[|;()]|[<>]\(/.test(trimmed))
+    return opaqueOperation(trimmed);
+  const operations = parsed.segments.map((part) => {
+    const index = commandWordIndex(part);
+    if (index < 0)
+      return "read";
+    const words = part.words.filter((_, at) => at >= index && !part.redirects.has(at)).map((word) => decodeWord(word.text));
+    const tool = words[0].split("/").pop();
+    if (["rm", "rmdir", "unlink", "shred", "rmtree", "del"].includes(tool ?? ""))
+      return "delete";
+    if (tool === "trash") {
+      let at = 1;
+      while (at < words.length && words[at].startsWith("-")) {
+        const flag = words[at++];
+        if (["--help", "-h", "--version", "-V", "--identity"].includes(flag))
+          return "read";
+        if (["--agent", "--spool", "--files", "--info", "--config"].includes(flag))
+          at++;
+        else if (!["--json", "--local"].includes(flag))
+          return "delete";
+      }
+      if (at === words.length || ["status", "doctor", "list", "info", "get", "pending", "station", "setup", "backup", "storage", "retrieval", "backup-storage", "backup-inspect", "backup-refresh", "help"].includes(words[at]))
+        return "read";
+      if (["restore", "restore-capsule"].includes(words[at]))
+        return "write";
+      return "delete";
+    }
+    if (tool === "git") {
+      const sub = gitSubcommand(part, index);
+      if (sub === "clean" || sub === "rm")
+        return "delete";
+      return sub === "clone" || sub === "init" ? "write" : "read";
+    }
+    if (tool === "env" && mentionsDeleteVerb(envSplitCommandText(words)))
+      return "delete";
+    if (["sh", "bash", "zsh", "dash", "ksh", "ash", "eval", "source", ".", "su", "runuser", "env", "xargs", "find", "busybox", "toybox"].includes(tool ?? "")) {
+      return opaqueOperation(words.join(" "));
+    }
+    if (["mkdir", "mkfile", "touch", "mv", "cp", "ln", "tee", "install", "dd", "rsync", "scp", "truncate"].includes(tool ?? ""))
+      return "write";
+    if (tool === "curl" || tool === "wget")
+      return WRITE_FLAGS.test(words.join(" ")) ? "write" : "read";
+    if (tool === "sed" && words.slice(1).some((word) => /^-i|^--in-place(?:=|$)/.test(word)))
+      return "write";
+    if (["python", "python3", "node", "bun"].includes(tool ?? "") && words.some((word) => word === "-c" || word === "-e"))
+      return "write";
+    return "read";
+  });
+  return operations.includes("delete") ? "delete" : operations.includes("write") ? "write" : "read";
+}
+function opaqueOperation(segment) {
   const trimmed = segment.trim();
   if (!trimmed)
     return "read";

package/bin/serve.js

@@ -676,7 +676,7 @@ function getHook(name) {
 import { existsSync as existsSync2, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "fs";
 import { basename, dirname, isAbsolute, join as join3, normalize, resolve as resolve2, sep } from "path";
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
   void: () => voidType,
@@ -788,7 +788,7 @@ __export(exports_external, {
   BRAND: () => BRAND
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
   util2.assertEqual = (_) => {};
@@ -919,7 +919,7 @@ var getParsedType = (data) => {
   }
 };
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode = util.arrayToEnum([
   "invalid_type",
   "invalid_literal",
@@ -1038,7 +1038,7 @@ ZodError.create = (issues) => {
   return error;
 };
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -1141,7 +1141,7 @@ var errorMap = (issue, _ctx) => {
 };
 var en_default = errorMap;
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
 var overrideErrorMap = en_default;
 function setErrorMap(map) {
   overrideErrorMap = map;
@@ -1149,7 +1149,7 @@ function setErrorMap(map) {
 function getErrorMap() {
   return overrideErrorMap;
 }
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
   const { data, path, errorMaps, issueData } = params;
   const fullPath = [...path, ...issueData.path || []];
@@ -1255,14 +1255,14 @@ var isAborted = (x) => x.status === "aborted";
 var isDirty = (x) => x.status === "dirty";
 var isValid = (x) => x.status === "valid";
 var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
   errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
   errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
 })(errorUtil || (errorUtil = {}));
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
 class ParseInputLazyPath {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -5362,7 +5362,7 @@ import { readFileSync as readFileSync5 } from "fs";
 import { dirname as dirname4, join as join8 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 
-// ../../../../codex0157-source-repair/isolated-build/repo/apps/hooks/node_modules/@hasna/contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.2.2+944b86d8024e79fa/node_modules/@hasna/contracts/dist/client/transport.js
 import { spawnSync } from "child_process";
 import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync22 } from "fs";
 import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";

package/dist/index.js

@@ -581,7 +581,7 @@ var init_redact = __esm(() => {
   ];
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType = (data) => {
   const t = typeof data;
   switch (t) {
@@ -712,7 +712,7 @@ var init_util = __esm(() => {
   ]);
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode, quotelessJson = (obj) => {
   const json = JSON.stringify(obj, null, 2);
   return json.replace(/"([^"]+)":/g, "$1:");
@@ -833,7 +833,7 @@ var init_ZodError = __esm(() => {
   };
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -940,7 +940,7 @@ var init_en = __esm(() => {
   en_default = errorMap;
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
 function setErrorMap(map) {
   overrideErrorMap = map;
 }
@@ -953,7 +953,7 @@ var init_errors = __esm(() => {
   overrideErrorMap = en_default;
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 function addIssueToContext(ctx, issueData) {
   const overrideMap = getErrorMap();
   const issue = makeIssue({
@@ -1058,10 +1058,10 @@ var init_parseUtil = __esm(() => {
   });
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/typeAliases.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/typeAliases.js
 var init_typeAliases = () => {};
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 var init_errorUtil = __esm(() => {
   (function(errorUtil2) {
@@ -1070,7 +1070,7 @@ var init_errorUtil = __esm(() => {
   })(errorUtil || (errorUtil = {}));
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
 class ParseInputLazyPath {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -4421,7 +4421,7 @@ var init_types = __esm(() => {
   NEVER = INVALID;
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
   void: () => voidType,
@@ -4541,7 +4541,7 @@ var init_external = __esm(() => {
   init_ZodError();
 });
 
-// ../../../../../../../repos/clones/hasna/apps/node_modules/.bun/zod@3.25.76/node_modules/zod/index.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/index.js
 var init_zod = __esm(() => {
   init_external();
   init_external();
@@ -5101,7 +5101,7 @@ var init_profiles = __esm(() => {
   init_app_home();
 });
 
-// ../../../../codex0157-source-repair/isolated-build/repo/apps/hooks/node_modules/@hasna/contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.2.2+944b86d8024e79fa/node_modules/@hasna/contracts/dist/client/transport.js
 import { isIP } from "net";
 import { spawnSync } from "child_process";
 import { closeSync as closeSync22, fstatSync as fstatSync22, openSync as openSync22, readFileSync as readFileSync22 } from "fs";
@@ -8106,7 +8106,7 @@ function writeHookSettingsPreimage(path, settings, before) {
 // src/lib/claude-skills-coordination.ts
 import { createHash as createHash6 } from "crypto";
 
-// ../../../../../../../../.bun/install/cache/@hasna/skills@0.9.17@@@1/dist/index.js
+// ../../node_modules/.bun/@hasna+skills@0.9.17+a00d3064559565bb/node_modules/@hasna/skills/dist/index.js
 import { existsSync as existsSync10 } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join9, resolve as resolve3 } from "path";

package/dist/sdk/index.js

@@ -1,5 +1,5 @@
 // @bun
-// ../../../../codex0157-source-repair/isolated-build/repo/apps/hooks/node_modules/@hasna/contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.2.2+944b86d8024e79fa/node_modules/@hasna/contracts/dist/client/transport.js
 import { isIP } from "net";
 import { spawnSync } from "child_process";
 import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync2 } from "fs";

package/hooks/hook-trash-guard/src/hook.ts

@@ -103,7 +103,7 @@ const REFUSED_VERBS: Record<string, string> = {
  * place. When one of these is in command position and the command mentions a
  * delete verb, the command is refused rather than guessed at.
  */
-const OPAQUE_COMMANDS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "eval", "source", ".", "su", "runuser"]);
+const OPAQUE_COMMANDS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "eval", "source", ".", "su", "runuser", "env"]);
 
 /** Wrapper commands whose real command follows them (with their value-taking options). */
 const WRAPPERS: Record<string, string[]> = {
@@ -119,7 +119,7 @@ const WRAPPERS: Record<string, string[]> = {
   setsid: [],
   command: [],
   builtin: [],
-  exec: [],
+  exec: ["-a"],
 };
 
 /**
@@ -156,6 +156,12 @@ export function mentionsDeleteVerb(text: string): boolean {
   return DELETE_VERB_WORD_RE.test(decodeWord(text));
 }
 
+/** env's split-string value may be attached to its option. This text is used
+ * only to refuse an opaque delete, never as executable text or a rewrite. */
+export function envSplitCommandText(words: string[]): string {
+  return words.map((word) => word.replace(/^-[iv0]*S|^--split-string=/, " ")).join(" ");
+}
+
 const ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
 
 /**
@@ -238,8 +244,8 @@ export function lexCommand(command: string): LexResult {
       words.push({ text: command.slice(wordStart, end), start: wordStart, end });
       if (pendingRedirect) redirects.add(index);
       wordStart = -1;
+      pendingRedirect = false;
     }
-    pendingRedirect = false;
   };
 
   const closeSegment = (end: number): void => {
@@ -247,6 +253,7 @@ export function lexCommand(command: string): LexResult {
     if (words.length > 0) segments.push({ words, redirects });
     words = [];
     redirects = new Set<number>();
+    pendingRedirect = false;
   };
 
   const scanSingle = (from: number): number => {
@@ -390,9 +397,13 @@ export function lexCommand(command: string): LexResult {
       continue;
     }
     if (ch === ">" || ch === "<") {
+      // An unquoted adjacent descriptor number belongs to the redirect, not
+      // the command. Its following operand is also never an executable.
+      if (wordStart >= 0 && /^\d+$/.test(command.slice(wordStart, i))) wordStart = -1;
       closeWord(i);
       pendingRedirect = true;
-      i += command[i + 1] === ch && ch === ">" ? 2 : 1;
+      i++;
+      if (command[i] === ch || command[i] === "&" || (ch === ">" && command[i] === "|") || (ch === "<" && command[i] === ">")) i++;
       continue;
     }
     if (ch === "'") {
@@ -521,10 +532,11 @@ export function decodeWord(text: string): string {
  * command wrappers — NOT any word that happens to read like a verb, so
  * `printf '%s\n' rm` is not a delete.
  */
-function commandWordIndex(segment: Segment): number {
+export function commandWordIndex(segment: Segment): number {
   let index = 0;
   let guard = 0;
   while (index < segment.words.length && guard++ < 32) {
+    if (segment.redirects.has(index)) { index++; continue; }
     const raw = segment.words[index].text;
     const decoded = decodeWord(raw);
     if (ASSIGNMENT_RE.test(decoded) && !decoded.startsWith("-")) {
@@ -535,20 +547,37 @@ function commandWordIndex(segment: Segment): number {
       index++;
       continue;
     }
-    const wrapperValues = WRAPPERS[decoded];
+    const wrapper = baseVerb(decoded);
+    // command -v/-V looks up every following name without executing one.
+    if (wrapper === "command") {
+      for (const word of segment.words.filter((_, at) => at > index && !segment.redirects.has(at))) {
+        const option = decodeWord(word.text);
+        if (option === "--" || !option.startsWith("-")) break;
+        if (/^-[pvV]*[vV][pvV]*$/.test(option)) return -1;
+      }
+    }
+    const wrapperValues = WRAPPERS[wrapper];
     if (wrapperValues) {
+      const wrapperIndex = index;
       index++;
       while (index < segment.words.length) {
+        if (segment.redirects.has(index)) { index++; continue; }
         const option = decodeWord(segment.words[index].text);
         if (!option.startsWith("-") || option === "-") break;
         if (option === "--") {
           index++;
           break;
         }
+        // env -S reparses its value as a command string. Retain env in
+        // command position so the opaque-command refusal owns this form.
+        if (wrapper === "env" && (/^-[iv0]*S/.test(option) || /^--split-string(?:=|$)/.test(option))) return wrapperIndex;
         index++;
-        if (wrapperValues.includes(option)) index++;
+        if (wrapperValues.includes(option) || (wrapper === "exec" && /^-[cl]*a$/.test(option))) {
+          while (segment.redirects.has(index)) index++;
+          index++;
+        }
       }
-      let positionals = WRAPPER_POSITIONALS[decoded] ?? 0;
+      let positionals = WRAPPER_POSITIONALS[wrapper] ?? 0;
       while (positionals > 0 && index < segment.words.length) {
         const positional = decodeWord(segment.words[index].text);
         if (positional.startsWith("-") && positional !== "-") break;
@@ -814,7 +843,8 @@ export function scanCommand(command: string, options: { cwd: string; home: strin
       continue;
     }
 
-    if (OPAQUE_COMMANDS.has(verb) && mentionsDeleteVerb(segmentText(segment))) {
+    const opaqueText = verb === "env" ? envSplitCommandText(segment.words.map((word) => decodeWord(word.text))) : segmentText(segment);
+    if (OPAQUE_COMMANDS.has(verb) && mentionsDeleteVerb(opaqueText)) {
       result.refusals.push({
         reason: `\`${verb}\` runs a command string this hook cannot rewrite in place. Run the delete directly as \`rm -- <path>\` (intercepted and redirected into trash), or as a script that uses \`trash guard\` itself.`,
       });
@@ -849,7 +879,7 @@ function segmentText(segment: Segment): string {
 }
 
 /** The git subcommand, skipping git's own value-taking global options. */
-function gitSubcommand(segment: Segment, verbIndex: number): string | null {
+export function gitSubcommand(segment: Segment, verbIndex: number): string | null {
   let index = verbIndex + 1;
   while (index < segment.words.length) {
     const option = decodeWord(segment.words[index].text);

package/hooks/hook-workspace-repos-guard/src/hook.ts

@@ -52,6 +52,7 @@
 import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, statSync } from "fs";
 import { homedir } from "os";
 import { dirname, isAbsolute, join, normalize, relative, resolve, sep } from "path";
+import { commandWordIndex, decodeWord, envSplitCommandText, gitSubcommand, lexCommand, mentionsDeleteVerb } from "../../hook-trash-guard/src/hook";
 import {
   getCommand,
   readInput,
@@ -364,6 +365,51 @@ function shellWords(command: string): ShellWord[] {
 function segmentOperation(segment: string): Operation {
   const trimmed = segment.trim();
   if (!trimmed) return "read";
+  const parsed = lexCommand(trimmed);
+  // Preserve conservative classification where the shell body is opaque.
+  if (!parsed.trustworthy || parsed.substitutions.length || /\$\{[^}]*[|;()]|[<>]\(/.test(trimmed)) return opaqueOperation(trimmed);
+  const operations = parsed.segments.map((part): Operation => {
+    const index = commandWordIndex(part);
+    if (index < 0) return "read";
+    const words = part.words.filter((_, at) => at >= index && !part.redirects.has(at)).map((word) => decodeWord(word.text));
+    const tool = words[0].split("/").pop();
+    if (["rm", "rmdir", "unlink", "shred", "rmtree", "del"].includes(tool ?? "")) return "delete";
+    if (tool === "trash") {
+      // Hasna metadata/setup verbs take identifiers, not paths to remove.
+      // Keep legacy positional Trash clients and capture verbs guarded.
+      let at = 1;
+      while (at < words.length && words[at].startsWith("-")) {
+        const flag = words[at++];
+        if (["--help", "-h", "--version", "-V", "--identity"].includes(flag)) return "read";
+        if (["--agent", "--spool", "--files", "--info", "--config"].includes(flag)) at++;
+        else if (!["--json", "--local"].includes(flag)) return "delete";
+      }
+      if (at === words.length || ["status", "doctor", "list", "info", "get", "pending", "station", "setup", "backup", "storage", "retrieval", "backup-storage", "backup-inspect", "backup-refresh", "help"].includes(words[at])) return "read";
+      if (["restore", "restore-capsule"].includes(words[at])) return "write";
+      return "delete";
+    }
+    if (tool === "git") {
+      const sub = gitSubcommand(part, index);
+      if (sub === "clean" || sub === "rm") return "delete";
+      return sub === "clone" || sub === "init" ? "write" : "read";
+    }
+    if (tool === "env" && mentionsDeleteVerb(envSplitCommandText(words))) return "delete";
+    if (["sh", "bash", "zsh", "dash", "ksh", "ash", "eval", "source", ".", "su", "runuser", "env", "xargs", "find", "busybox", "toybox"].includes(tool ?? "")) {
+      return opaqueOperation(words.join(" "));
+    }
+    if (["mkdir", "mkfile", "touch", "mv", "cp", "ln", "tee", "install", "dd", "rsync", "scp", "truncate"].includes(tool ?? "")) return "write";
+    if (tool === "curl" || tool === "wget") return WRITE_FLAGS.test(words.join(" ")) ? "write" : "read";
+    if (tool === "sed" && words.slice(1).some((word) => /^-i|^--in-place(?:=|$)/.test(word))) return "write";
+    if (["python", "python3", "node", "bun"].includes(tool ?? "") && words.some((word) => word === "-c" || word === "-e")) return "write";
+    return "read";
+  });
+  return operations.includes("delete") ? "delete" : operations.includes("write") ? "write" : "read";
+}
+
+// Retain the prior conservative behavior for embedded shell bodies.
+function opaqueOperation(segment: string): Operation {
+  const trimmed = segment.trim();
+  if (!trimmed) return "read";
 
   if (/(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:rm|rmdir|unlink|shred|trash|rmtree|del)(?:\s|$)/.test(trimmed)) return "delete";
   if (/\bgit\b/.test(trimmed)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/hooks",
-  "version": "0.11.4",
+  "version": "0.11.5",
   "description": "Open source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command",
   "type": "module",
   "bin": {