@hasna/hooks 0.11.7 → 0.12.0

package/hooks/hook-signed-link-guard/src/links.ts

@@ -0,0 +1,136 @@
+/**
+ * Signed-link shapes in text.
+ *
+ * The same shape the in-process harness redaction uses for this class: an
+ * absolute http(s) URL whose query or fragment carries a capability-class
+ * parameter. The measured signed action links carry `expires`, `pr_number`,
+ * `repository`, `return_to` and `signature`; `signature` is the discriminating
+ * parameter, and the other capability names below are the same class.
+ *
+ * A match is replaced by the URL's origin plus `/[redacted signed link]`, so a
+ * reader keeps the host for diagnosis and nothing else. The matched text is
+ * never returned, logged or echoed by anything in this module.
+ */
+
+/** Query or fragment parameter names that mark a URL as a signed capability. */
+export const SIGNED_LINK_PARAMS: readonly string[] = [
+  "signature",
+  "sig",
+  "x-amz-signature",
+  "x-goog-signature",
+  "x-ms-signature",
+  "hmac",
+  "token",
+];
+
+/** Cheap pre-filter: any absolute URL. (A keyword pre-filter would miss percent- or entity-encoded names.) */
+const HINT = /https?:\/\//i;
+
+/**
+ * Bounded absolute URL: stops at whitespace, quotes, angle brackets,
+ * parentheses and backticks, and at a backslash unless it starts a JSON
+ * `\u0026` (`&`), `\u003d` (`=`), `\u003f` (`?`) or `\u0023` (`#`) escape, so a
+ * link embedded in escaped JSON or HTML is matched whole.
+ */
+const URL_PATTERN = /https?:\/\/(?:[^\s"'<>()`\\]|\\u00(?:26|3[dDfF]|23))+/gi;
+
+const TRAILING_PUNCTUATION = /[.,;:!?]+$/;
+
+export const REDACTION_MARKER = "[redacted signed link]";
+
+/**
+ * Undo the encodings a separator survives in: JSON `\u0026`-style escapes,
+ * HTML entities (`&amp;`, repeated as `&amp;amp;`, and `&#38;` / `&#x26;`),
+ * so `?a=1&amp;signature=x` is read as `?a=1&signature=x`.
+ */
+function decodeSeparators(url: string): string {
+  let text = url
+    .replace(/\\u0026/gi, "&").replace(/\\u003d/gi, "=").replace(/\\u003f/gi, "?").replace(/\\u0023/gi, "#");
+  for (let guard = 0; guard < 8; guard++) {
+    const next = text
+      .replace(/&amp;/gi, "&").replace(/&#0*38;/g, "&").replace(/&#x0*26;/gi, "&")
+      .replace(/&#0*61;/g, "=").replace(/&#x0*3d;/gi, "=").replace(/&equals;/gi, "=")
+      .replace(/&#0*63;/g, "?").replace(/&#x0*3f;/gi, "?").replace(/&quest;/gi, "?");
+    if (next === text) break;
+    text = next;
+  }
+  return text;
+}
+
+/** True when a URL carries a signature-class query or fragment parameter. */
+export function hasSignatureParameter(url: string): boolean {
+  const decoded = decodeSeparators(url);
+  const query = decoded.indexOf("?");
+  const hash = decoded.indexOf("#");
+  const chunks: string[] = [];
+  if (query >= 0) chunks.push(decoded.slice(query + 1).split("#")[0] ?? "");
+  if (hash >= 0) chunks.push(decoded.slice(hash + 1));
+  for (const chunk of chunks) {
+    for (const pair of chunk.split(/[&;]/)) {
+      let key = (pair.split("=", 1)[0] ?? "").trim();
+      try { key = decodeURIComponent(key); } catch { /* keep the raw key */ }
+      if (SIGNED_LINK_PARAMS.includes(key.toLowerCase())) return true;
+    }
+  }
+  return false;
+}
+
+/** Number of signed-link URLs in `text`. */
+export function countSignedLinks(text: string): number {
+  if (typeof text !== "string" || !text || !HINT.test(text)) return 0;
+  let count = 0;
+  for (const match of text.matchAll(URL_PATTERN)) {
+    const url = match[0].replace(TRAILING_PUNCTUATION, "");
+    if (hasSignatureParameter(url)) count++;
+  }
+  return count;
+}
+
+/** Replace every signed-link URL in `text` with `<origin>/[redacted signed link]`. */
+export function redactSignedLinks(text: string): string {
+  if (typeof text !== "string" || !text || !HINT.test(text)) return text;
+  return text.replace(URL_PATTERN, (match) => {
+    const trailing = match.match(TRAILING_PUNCTUATION)?.[0] ?? "";
+    const url = trailing ? match.slice(0, -trailing.length) : match;
+    if (!hasSignatureParameter(url)) return match;
+    const origin = url.match(/^https?:\/\/[^/?#]+/i)?.[0];
+    return origin ? `${origin}/${REDACTION_MARKER}${trailing}` : `${REDACTION_MARKER}${trailing}`;
+  });
+}
+
+const MAX_DEPTH = 2_000;
+const MAX_NODES = 1_000_000;
+
+/**
+ * A deep copy of `value` with every signed link in every string replaced, and
+ * how many strings changed. Structure, key order and non-string values are
+ * preserved exactly, so the copy keeps the tool's output shape. `complete` is
+ * false only when the value is too large or too deep to copy; then `links`
+ * reports whether a bounded scan of its serialized text found a link at all,
+ * and a caller that finds none has nothing to report.
+ */
+export function redactValue(value: unknown): { value: unknown; changed: number; complete: boolean; links: number } {
+  let changed = 0;
+  let nodes = 0;
+  let complete = true;
+  const visit = (current: unknown, depth: number): unknown => {
+    if (!complete) return current;
+    if (++nodes > MAX_NODES || depth > MAX_DEPTH) { complete = false; return current; }
+    if (typeof current === "string") {
+      const next = redactSignedLinks(current);
+      if (next !== current) changed++;
+      return next;
+    }
+    if (!current || typeof current !== "object") return current;
+    if (Array.isArray(current)) return current.map((item) => visit(item, depth + 1));
+    const out: Record<string, unknown> = {};
+    for (const [key, item] of Object.entries(current as Record<string, unknown>)) out[key] = visit(item, depth + 1);
+    return out;
+  };
+  const result = visit(value, 0);
+  if (complete) return { value: result, changed, complete, links: changed };
+  let serialized = "";
+  try { serialized = JSON.stringify(value) ?? ""; } catch { serialized = ""; }
+  // JSON doubles backslashes; undo that so escaped separators still read as separators.
+  return { value, changed: 0, complete: false, links: countSignedLinks(serialized.replace(/\\\\/g, "\\")) };
+}

package/hooks/hook-signed-link-output/README.md

@@ -0,0 +1,47 @@
+# signed-link-output
+
+Claude Code PostToolUse hook, installed as `hooks run signed-link-output`
+(matcher `Bash`, `WebFetch` and MCP tools). It is the backstop behind the
+`signed-link-guard` PreToolUse guard.
+
+When a tool result contains a signed-link URL — an absolute `http(s)` URL whose
+query or fragment carries `signature`, `sig`, `x-amz-signature`,
+`x-goog-signature`, `x-ms-signature`, `hmac` or `token` — it returns the two
+fields below. Separators are recognised in their encoded forms too: `&`
+(also repeated, `&`), `&`, `&`, the JSON escape `\u0026` and
+percent-encoded parameter names. A result with no such link gets no output at
+all, however large it is.
+
+- `hookSpecificOutput.updatedToolOutput`: the same tool result with each such
+  URL replaced by `<origin>/[redacted signed link]`. Keys, order and
+  non-string values are kept, so the result keeps the tool's output shape.
+- `hookSpecificOutput.additionalContext`: a notice that the output contained a
+  signed link the model must not repeat, store or try to recover, and should
+  report under the incident path (naming the command, never the link).
+
+It never blocks, and it never prints, logs or stores a matched URL.
+
+## What it can and cannot do
+
+- Output replacement depends on the running Claude Code build. The 2.1.285
+  build accepts `updatedToolOutput` on PostToolUse for every tool, checks it
+  against the tool's output schema, and uses the original output (with a hook
+  error) when the check fails. Older builds may ignore or reject the field.
+- It runs after the tool has run. The command already executed, the terminal
+  may already have shown the output, and files the command or the harness
+  wrote (including a spill file for large output) keep the link. Whether the
+  on-disk transcript stores the original or the replacement is not verified.
+- PostToolUse hooks run in parallel on the original output and the last
+  rewrite wins, so another rewriting hook can undo this one. This hook returns
+  a rewrite only when it changed something.
+- A URL that carries its capability in the path, with no capability-named
+  parameter, is not recognised.
+- Output larger than its copy bound (1,000,000 JSON nodes or 2,000 levels
+  deep) is still scanned for links; when one is found the notice is added but
+  the output is not rewritten, because a partial copy would change the
+  tool's output shape.
+- Claude Code's `Monitor` tool delivers each later stdout line to the model
+  as a notification rather than in its tool result, so this hook is not known
+  to see those lines. For Monitor, rely on the PreToolUse guard.
+
+Prevention is the PreToolUse guard's job; this hook narrows what slips past it.

package/hooks/hook-signed-link-output/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "signed-link-output",
+  "version": "0.1.0",
+  "description": "PostToolUse Signed Link Output hook for @hasna/hooks",
+  "type": "module",
+  "main": "./src/hook.ts",
+  "scripts": {
+    "typecheck": "tsc --noEmit"
+  },
+  "author": "Hasna",
+  "license": "Apache-2.0"
+}

package/hooks/hook-signed-link-output/src/hook.ts

@@ -0,0 +1,111 @@
+#!/usr/bin/env bun
+
+/**
+ * PostToolUse hook: signed-link-output (Claude Code)
+ *
+ * The second layer behind signed-link-guard. When a tool result contains a
+ * signed-link URL (an absolute URL whose query or fragment carries a
+ * capability-class parameter such as `signature`), this hook:
+ *
+ *   1. returns `hookSpecificOutput.updatedToolOutput`: the same tool result
+ *      with each such URL replaced by `<origin>/[redacted signed link]`, and
+ *   2. returns `hookSpecificOutput.additionalContext`: a notice telling the
+ *      model the output contained a signed link that it must not repeat,
+ *      store or try to recover, and that it should report it under the
+ *      incident path.
+ *
+ * WHAT THIS CAN AND CANNOT DO (stated plainly; do not describe it as more):
+ *
+ *   - `updatedToolOutput` replaces the tool result "before it is sent to the
+ *     model" on Claude Code builds that implement it (verified by reading the
+ *     2.1.285 bundle: PostToolUse accepts `updatedToolOutput` for every tool,
+ *     validates it against the tool's output schema, and falls back to the
+ *     ORIGINAL output with an error when it does not match). The copy keeps
+ *     every key and non-string value, so it keeps the tool's shape.
+ *   - It runs after the tool ran. The command already executed, the terminal
+ *     may already have displayed the output, and anything the command wrote to
+ *     disk (including a harness's own spill file for large output) keeps the
+ *     link. Whether the harness's on-disk transcript records the original or
+ *     the replacement has not been verified here.
+ *   - PostToolUse hooks run in parallel on the ORIGINAL output and a later
+ *     rewrite wins, so another hook that rewrites the same result can undo
+ *     this redaction. This hook never returns an identity rewrite.
+ *   - Older Claude Code builds without `updatedToolOutput` may reject or
+ *     ignore the field; the notice is the only effect there, if any.
+ *   - It never blocks and never echoes, logs or stores the matched URL.
+ *
+ * The prevention layer is the PreToolUse guard, which stops the known reads
+ * before they run.
+ */
+
+import { readFileSync, writeSync } from "fs";
+import { redactValue } from "../../hook-signed-link-guard/src/links";
+
+export const SIGNED_LINK_NOTICE =
+  "This tool result contained a signed-link URL (a capability that cannot be revoked). " +
+  "Where this Claude Code build supports output replacement, the link was replaced with a redaction marker before you saw it. " +
+  "Do not repeat, quote, store, forward or try to recover the link, and do not re-run the command to see it. " +
+  "Report the exposure under the incident path, naming the command and the tool, never the link. " +
+  "Read GitHub content with bounded scalar projections (for example `gh pr view <n> --json number,state,headRefOid`).";
+
+export interface PostToolUseInput {
+  hook_event_name?: string;
+  tool_name?: string;
+  tool_response?: unknown;
+  /** Older catalog convention; Claude Code sends `tool_response`. */
+  tool_output?: unknown;
+}
+
+export interface PostToolUseOutput {
+  hookSpecificOutput?: {
+    hookEventName: "PostToolUse";
+    additionalContext: string;
+    updatedToolOutput?: unknown;
+  };
+}
+
+/** The hook's decision for one PostToolUse input. An empty object means "nothing to do". */
+export function evaluate(input: PostToolUseInput): PostToolUseOutput {
+  if (!input || input.hook_event_name !== "PostToolUse") return {};
+  const field = input.tool_response !== undefined ? "tool_response" : input.tool_output !== undefined ? "tool_output" : undefined;
+  if (!field) return {};
+  const redacted = redactValue(input[field]);
+  // No link found means nothing to report: never send the incident notice
+  // for output that is merely large or deep.
+  if (redacted.links === 0) return {};
+  const output: PostToolUseOutput = { hookSpecificOutput: { hookEventName: "PostToolUse", additionalContext: SIGNED_LINK_NOTICE } };
+  // Only a real change is returned as a rewrite: an identity rewrite would
+  // compete with, and could undo, another hook's redaction.
+  if (field === "tool_response" && redacted.complete && redacted.changed > 0) output.hookSpecificOutput!.updatedToolOutput = redacted.value;
+  return output;
+}
+
+export function run(): void {
+  let input: PostToolUseInput = {};
+  try {
+    const raw = readFileSync(0, "utf8");
+    if (raw.trim()) input = JSON.parse(raw) as PostToolUseInput;
+  } catch {
+    return; // Unreadable input: no decision, and nothing about it is printed.
+  }
+  let output: PostToolUseOutput = {};
+  try { output = evaluate(input); } catch { output = {}; }
+  if (output.hookSpecificOutput) writeAll(JSON.stringify(output) + "\n");
+}
+
+/** Synchronous and complete: an asynchronous pipe write can be cut off by process exit. */
+function writeAll(text: string): void {
+  const bytes = Buffer.from(text);
+  for (let offset = 0; offset < bytes.length;) {
+    try { offset += writeSync(1, bytes, offset, bytes.length - offset); }
+    catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "EAGAIN") throw error;
+      Bun.sleepSync(1);
+    }
+  }
+}
+
+if (import.meta.main) {
+  run();
+  process.exit(0);
+}

package/hooks/hook-trash-guard/src/hook.ts

@@ -221,6 +221,206 @@ export interface ScanResult {
 /* Lexer — source spans, not decoded tokens                            */
 /* ------------------------------------------------------------------ */
 
+/* Quote, substitution and here-document scanners over source text. Each
+ * returns the index just past the construct that starts at `from`, or -1 when
+ * the construct does not end (the caller then treats the command as not
+ * trustworthy). */
+
+function scanSingleAt(text: string, from: number): number {
+  const end = text.indexOf("'", from + 1);
+  return end === -1 ? -1 : end + 1;
+}
+
+function scanBacktickAt(text: string, from: number): number {
+  let j = from + 1;
+  while (j < text.length) {
+    if (text[j] === "\\") {
+      j += 2;
+      continue;
+    }
+    if (text[j] === "`") return j + 1;
+    j++;
+  }
+  return -1;
+}
+
+function scanDoubleAt(text: string, from: number): number {
+  let j = from + 1;
+  while (j < text.length) {
+    const c = text[j];
+    if (c === "\\") {
+      j += 2;
+      continue;
+    }
+    if (c === '"') return j + 1;
+    if (c === "`") {
+      const e = scanBacktickAt(text, j);
+      if (e < 0) return -1;
+      j = e;
+      continue;
+    }
+    if (c === "$" && text[j + 1] === "(") {
+      const e = scanParenAt(text, j + 1);
+      if (e < 0) return -1;
+      j = e;
+      continue;
+    }
+    j++;
+  }
+  return -1;
+}
+
+/** A here-document operator (`<<WORD`, `<<-WORD`, quoted or not) at `at`. */
+export interface HeredocMarker {
+  /** The delimiter after quote removal. */
+  delimiter: string;
+  /** `<<-`: leading tabs are stripped from body lines and the terminator. */
+  stripTabs: boolean;
+  /** Any quoting in the delimiter word: the body is literal (no expansion). */
+  quoted: boolean;
+  /** Index just past the delimiter word. */
+  end: number;
+}
+
+/**
+ * Parse the here-document operator starting at `at` (which must point at the
+ * first `<` of `<<`). Returns null for a here-string (`<<<`) or a missing word.
+ */
+export function heredocMarkerAt(text: string, at: number): HeredocMarker | null {
+  if (text[at] !== "<" || text[at + 1] !== "<" || text[at + 2] === "<") return null;
+  let j = at + 2;
+  const stripTabs = text[j] === "-";
+  if (stripTabs) j++;
+  while (text[j] === " " || text[j] === "\t") j++;
+  let delimiter = "";
+  let quoted = false;
+  while (j < text.length && !/[\s;|&<>()]/.test(text[j])) {
+    const c = text[j];
+    if (c === "'" || c === '"') {
+      const close = text.indexOf(c, j + 1);
+      if (close < 0) return null;
+      delimiter += text.slice(j + 1, close);
+      quoted = true;
+      j = close + 1;
+      continue;
+    }
+    if (c === "\\") {
+      if (j + 1 >= text.length) return null;
+      delimiter += text[j + 1];
+      quoted = true;
+      j += 2;
+      continue;
+    }
+    delimiter += c;
+    j++;
+  }
+  return delimiter ? { delimiter, stripTabs, quoted, end: j } : null;
+}
+
+/**
+ * Skip the bodies of `pending` here-documents, which start on the line after
+ * the newline at `newline`. Returns the index of the character that ends the
+ * last terminator line (its newline, or a `)` that closes an enclosing
+ * substitution on the terminator line), or -1 when a terminator is missing.
+ */
+export function skipHeredocBodies(text: string, newline: number, pending: HeredocMarker[]): number {
+  let lineStart = newline + 1;
+  for (const marker of pending) {
+    for (;;) {
+      if (lineStart > text.length) return -1;
+      const lineEnd = text.indexOf("\n", lineStart);
+      const stop = lineEnd === -1 ? text.length : lineEnd;
+      let line = text.slice(lineStart, stop);
+      if (line.endsWith("\r")) line = line.slice(0, -1);
+      const offset = marker.stripTabs ? line.length - line.replace(/^\t+/, "").length : 0;
+      if (marker.stripTabs) line = line.slice(offset);
+      if (line === marker.delimiter) {
+        lineStart = stop + 1;
+        break;
+      }
+      // Inside a substitution, bash also ends the body at `DELIM)`.
+      if (line.startsWith(marker.delimiter) && /^\s*\)/.test(line.slice(marker.delimiter.length))) {
+        if (marker === pending[pending.length - 1]) return lineStart + offset + marker.delimiter.length;
+        return -1;
+      }
+      if (lineEnd === -1) return -1;
+      lineStart = lineEnd + 1;
+    }
+  }
+  return lineStart - 1;
+}
+
+/**
+ * Index just past the `)` that closes the `(` at `from` (the `(` of `$(`,
+ * `<(`, `>(` or a subshell), or -1. Quotes, backticks and nested
+ * parentheses are followed; here-document bodies are skipped as data (their
+ * quotes and parentheses are not shell syntax), and so are `#` comments.
+ */
+export function scanParenAt(text: string, from: number): number {
+  const n = text.length;
+  // `$((` arithmetic: `<<` is a shift and `#` a base prefix, not syntax.
+  const arithmetic = text[from + 1] === "(";
+  let depth = 0;
+  let j = from;
+  let pending: HeredocMarker[] = [];
+  while (j < n) {
+    const c = text[j];
+    if (c === "\\") {
+      j += 2;
+      continue;
+    }
+    if (c === "'") {
+      const e = scanSingleAt(text, j);
+      if (e < 0) return -1;
+      j = e;
+      continue;
+    }
+    if (c === '"') {
+      const e = scanDoubleAt(text, j);
+      if (e < 0) return -1;
+      j = e;
+      continue;
+    }
+    if (c === "`") {
+      const e = scanBacktickAt(text, j);
+      if (e < 0) return -1;
+      j = e;
+      continue;
+    }
+    if (!arithmetic && c === "<" && text[j + 1] === "<") {
+      if (text[j + 2] === "<") {
+        j += 3;
+        continue;
+      }
+      const marker = heredocMarkerAt(text, j);
+      if (!marker) return -1;
+      pending.push(marker);
+      j = marker.end;
+      continue;
+    }
+    if (c === "\n" && pending.length > 0) {
+      const e = skipHeredocBodies(text, j, pending);
+      if (e < 0) return -1;
+      pending = [];
+      j = e;
+      continue;
+    }
+    if (!arithmetic && c === "#" && /[\s;&|(]/.test(text[j - 1])) {
+      const e = text.indexOf("\n", j);
+      if (e < 0) return -1;
+      j = e;
+      continue;
+    }
+    if (c === "(") depth++;
+    else if (c === ")") {
+      depth--;
+      if (depth === 0) return pending.length > 0 ? -1 : j + 1;
+    }
+    j++;
+  }
+  return -1;
+}
+
 /**
  * Split a command string into segments and words while recording each word's
  * byte span in the ORIGINAL string. Quoting is tracked rather than decoded so
@@ -256,86 +456,10 @@ export function lexCommand(command: string): LexResult {
     pendingRedirect = false;
   };
 
-  const scanSingle = (from: number): number => {
-    const end = command.indexOf("'", from + 1);
-    return end === -1 ? -1 : end + 1;
-  };
-
-  const scanBacktick = (from: number): number => {
-    let j = from + 1;
-    while (j < n) {
-      if (command[j] === "\\") {
-        j += 2;
-        continue;
-      }
-      if (command[j] === "`") return j + 1;
-      j++;
-    }
-    return -1;
-  };
-
-  const scanParen = (from: number): number => {
-    let depth = 0;
-    let j = from;
-    while (j < n) {
-      const c = command[j];
-      if (c === "\\") {
-        j += 2;
-        continue;
-      }
-      if (c === "'") {
-        const e = scanSingle(j);
-        if (e < 0) return -1;
-        j = e;
-        continue;
-      }
-      if (c === '"') {
-        const e = scanDouble(j);
-        if (e < 0) return -1;
-        j = e;
-        continue;
-      }
-      if (c === "`") {
-        const e = scanBacktick(j);
-        if (e < 0) return -1;
-        j = e;
-        continue;
-      }
-      if (c === "(") depth++;
-      else if (c === ")") {
-        depth--;
-        if (depth === 0) return j + 1;
-      }
-      j++;
-    }
-    return -1;
-  };
-
-  function scanDouble(from: number): number {
-    let j = from + 1;
-    while (j < n) {
-      const c = command[j];
-      if (c === "\\") {
-        j += 2;
-        continue;
-      }
-      if (c === '"') return j + 1;
-      if (c === "`") {
-        const e = scanBacktick(j);
-        if (e < 0) return -1;
-        j = e;
-        continue;
-      }
-      if (c === "$" && command[j + 1] === "(") {
-        const e = scanParen(j + 1);
-        if (e < 0) return -1;
-        j = e;
-        continue;
-      }
-      j++;
-    }
-    return -1;
-  }
+  const scanSingle = (from: number): number => scanSingleAt(command, from);
+  const scanBacktick = (from: number): number => scanBacktickAt(command, from);
+  const scanParen = (from: number): number => scanParenAt(command, from);
+  const scanDouble = (from: number): number => scanDoubleAt(command, from);
 
   while (i < n) {
     const ch = command[i];

package/hooks/native-safety-entry.ts

@@ -2,7 +2,8 @@ import { homedir } from "node:os";
 import { isAbsolute } from "node:path";
 import { evaluate as evaluateTrash, findTrashBinary, inspectTrashBinary, scanCommand } from "./hook-trash-guard/src/hook";
 import { evaluate as evaluateRepos } from "./hook-workspace-repos-guard/src/hook";
-import type { CodewithHookInput } from "./codewith-native-common";
+import { evaluate as evaluateSignedLinks } from "./hook-signed-link-guard/src/hook";
+import type { CodewithHookInput, CodewithHookOutput } from "./codewith-native-common";
 
 // Bundled with import.meta.main=false, so the original standalone run wrappers
 // cannot swallow exceptions or emit a second response. Only this entry runs.
@@ -13,6 +14,9 @@ if (!input || Array.isArray(input) || input.hook_event_name !== "PreToolUse" ||
   || !input.tool_input || typeof input.tool_input !== "object" || Array.isArray(input.tool_input)
   || typeof input.cwd !== "string" || !isAbsolute(input.cwd)) throw new Error("Invalid safety input");
 if (input.tool_name === "Bash" && typeof input.tool_input.command !== "string") throw new Error("Invalid shell input");
+// Claude Code's Monitor runs a shell command and streams its stdout to the
+// model; a websocket Monitor carries `ws` and no command.
+if (input.tool_name === "Monitor" && input.tool_input.command !== undefined && typeof input.tool_input.command !== "string") throw new Error("Invalid monitor input");
 const requestedExecution = (input as CodewithHookInput & { hasna_execution?: { schema: string; agent: string } }).hasna_execution;
 if (requestedExecution !== undefined && (!requestedExecution || Object.keys(requestedExecution).sort().join() !== "agent,schema"
   || requestedExecution.schema !== "hasna.hooks.execution.v1" || typeof requestedExecution.agent !== "string"
@@ -27,10 +31,27 @@ if (["apply_patch", "ApplyPatch", "functions.apply_patch"].includes(input.tool_n
   if (typeof patch !== "string") throw new Error("Invalid patch input");
   input.tool_input = { ...input.tool_input, command: patch, patch };
 }
-const repos = evaluateRepos(input).output;
-const handoff = input.tool_name === "Bash" && scanCommand(input.tool_input.command as string, { home: homedir(), cwd: input.cwd }).handoffHits.length > 0;
-const verdict = repos.decision === "block"
-  ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: repos.reason } }
-  : handoff ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "[workspace-repos-guard] Deletion under a protected repository checkout is refused." } }
-  : name === "trash-guard" ? evaluateTrash(input, { home: homedir(), cwd: input.cwd, findTrash: findTrashBinary, inspectTrash: inspectTrashBinary, execution }) : { continue: true };
+// Every guard judges a Monitor command exactly as it judges the same Bash command.
+const monitor = input.tool_name === "Monitor";
+const shellCommand = input.tool_name === "Bash" || (monitor && typeof input.tool_input.command === "string");
+const evaluated: CodewithHookInput = monitor && shellCommand ? { ...input, tool_name: "Bash" } : input;
+const deny = (reason: string) => ({ hookSpecificOutput: { hookEventName: "PreToolUse" as const, permissionDecision: "deny" as const, permissionDecisionReason: reason } });
+const repos = evaluateRepos(evaluated).output;
+// Every shell command, whatever the capability name: the guard reaches each
+// registration of this entry. Its refusal outranks a Trash rewrite, because an
+// allowed rewrite would also run the composite gh read.
+const signedLinks = evaluateSignedLinks(evaluated);
+const handoff = shellCommand && scanCommand(evaluated.tool_input!.command as string, { home: homedir(), cwd: input.cwd }).handoffHits.length > 0;
+let trash: CodewithHookOutput = name === "trash-guard" && (!monitor || shellCommand)
+  ? evaluateTrash(evaluated, { home: homedir(), cwd: input.cwd, findTrash: findTrashBinary, inspectTrash: inspectTrashBinary, execution }) : { continue: true };
+// A Trash rewrite is proven only for Bash. Under Monitor the deletion is
+// refused rather than rewritten: a rewrite the harness dropped would run the
+// raw command.
+if (monitor && trash.hookSpecificOutput?.permissionDecision === "allow") {
+  trash = deny("[trash-guard] A deletion inside a Monitor command is refused; run it with the Bash tool, where it is redirected into trash.");
+}
+const verdict: CodewithHookOutput = repos.decision === "block" ? deny(repos.reason!)
+  : signedLinks.hookSpecificOutput ? signedLinks
+  : handoff ? deny("[workspace-repos-guard] Deletion under a protected repository checkout is refused.")
+  : trash;
 process.stdout.write(JSON.stringify({ verdict: "continue" in verdict ? null : verdict }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/hooks",
-  "version": "0.11.7",
+  "version": "0.12.0",
   "description": "Open source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command",
   "type": "module",
   "bin": {
@@ -45,7 +45,7 @@
     "postinstall": "node scripts/ensure-profiles-dir.mjs",
     "scan:artifact": "bun scripts/artifact-scan.ts",
     "prepack": "bun run build && bun run scan:artifact",
-    "build:native-safety": "bun build ./hooks/native-safety-entry.ts --outdir ./bin --target bun --define import.meta.main=false && bun build ./src/native-safety.ts --outdir ./dist --target bun && bun run build:native-readiness",
+    "build:native-safety": "bun build ./hooks/native-safety-entry.ts --outdir ./bin --target bun --minify --define import.meta.main=false && bun build ./src/native-safety.ts --outdir ./dist --target bun && bun run build:native-readiness",
     "build:native-readiness": "bun build ./hooks/native-readiness-entry.ts --outdir ./bin --target node --format=cjs && bun build ./src/native-readiness.ts --outdir ./dist --target bun"
   },
   "keywords": [