@hasna/hooks 0.11.7 → 0.12.1

package/bin/serve.js

@@ -131,6 +131,7 @@ function getExplicitDbPath(env = process.env) {
 }
 
 // src/lib/registry.ts
+var CLAUDE_TRASH_GUARD_MATCHER = "^(Bash|Monitor|apply_patch|ApplyPatch|functions\\.apply_patch)$";
 var HOOKS = [
   {
     name: "gitguard",
@@ -181,6 +182,8 @@ var HOOKS = [
     category: "Git Safety",
     event: "PreToolUse",
     matcher: "^(Bash|Write|Edit|MultiEdit|NotebookEdit|apply_patch|ApplyPatch|functions\\.apply_patch)$",
+    targetMatchers: { claude: "^(Bash|Monitor|Write|Edit|MultiEdit|NotebookEdit|apply_patch|ApplyPatch|functions\\.apply_patch)$" },
+    legacyMatchers: ["^(Bash|Write|Edit|MultiEdit|NotebookEdit|apply_patch|ApplyPatch|functions\\.apply_patch)$"],
     tags: ["workspace", "repos", "structure", "guard", "safety", "orgs", "multi-agent"]
   },
   {
@@ -191,6 +194,8 @@ var HOOKS = [
     category: "Git Safety",
     event: "PreToolUse",
     matcher: "^(Bash|apply_patch|ApplyPatch|functions\\.apply_patch)$",
+    targetMatchers: { claude: CLAUDE_TRASH_GUARD_MATCHER },
+    legacyMatchers: ["^(Bash|apply_patch|ApplyPatch|functions\\.apply_patch)$"],
     tags: ["rm", "delete", "trash", "recoverable", "guard", "safety", "bash"],
     rewritesInput: true,
     timeoutSeconds: 10
@@ -295,6 +300,28 @@ var HOOKS = [
     matcher: "Bash",
     tags: ["security", "credentials", "secrets", "detection", "audit"]
   },
+  {
+    name: "signed-link-guard",
+    displayName: "Signed Link Guard",
+    description: "Refuses gh reads that would print composite GitHub content (bodies, comments, reviews, commit messages, check links and details, raw issue/PR/check API objects) where signed action links appear; bounded scalar projections, diffs, lists and writes pass",
+    version: "0.1.0",
+    category: "Security",
+    event: "PreToolUse",
+    matcher: "^(Bash|Monitor)$",
+    tags: ["github", "gh", "signed-links", "capabilities", "transcript", "guard", "security"],
+    timeoutSeconds: 10
+  },
+  {
+    name: "signed-link-output",
+    displayName: "Signed Link Output",
+    description: "Claude PostToolUse backstop: replaces signed-link URLs in tool output with a redaction marker (updatedToolOutput, where the running Claude Code supports it) and tells the model not to repeat or store the link. It runs after the tool, so it cannot undo display or other persistence",
+    version: "0.1.0",
+    category: "Security",
+    event: "PostToolUse",
+    matcher: "^(Bash|WebFetch|mcp__.*)$",
+    tags: ["github", "signed-links", "capabilities", "redaction", "transcript", "security"],
+    timeoutSeconds: 10
+  },
   {
     name: "phonenotify",
     displayName: "Phone Notify",
@@ -676,7 +703,7 @@ function getHook(name) {
 import { existsSync as existsSync2, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "fs";
 import { basename, dirname, isAbsolute, join as join3, normalize, resolve as resolve2, sep } from "path";
 
-// ../../../../validation/build/apps/hooks/node_modules/zod/v3/external.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
   void: () => voidType,
@@ -788,7 +815,7 @@ __export(exports_external, {
   BRAND: () => BRAND
 });
 
-// ../../../../validation/build/apps/hooks/node_modules/zod/v3/helpers/util.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
   util2.assertEqual = (_) => {};
@@ -919,7 +946,7 @@ var getParsedType = (data) => {
   }
 };
 
-// ../../../../validation/build/apps/hooks/node_modules/zod/v3/ZodError.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode = util.arrayToEnum([
   "invalid_type",
   "invalid_literal",
@@ -1038,7 +1065,7 @@ ZodError.create = (issues) => {
   return error;
 };
 
-// ../../../../validation/build/apps/hooks/node_modules/zod/v3/locales/en.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -1141,7 +1168,7 @@ var errorMap = (issue, _ctx) => {
 };
 var en_default = errorMap;
 
-// ../../../../validation/build/apps/hooks/node_modules/zod/v3/errors.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
 var overrideErrorMap = en_default;
 function setErrorMap(map) {
   overrideErrorMap = map;
@@ -1149,7 +1176,7 @@ function setErrorMap(map) {
 function getErrorMap() {
   return overrideErrorMap;
 }
-// ../../../../validation/build/apps/hooks/node_modules/zod/v3/helpers/parseUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
   const { data, path, errorMaps, issueData } = params;
   const fullPath = [...path, ...issueData.path || []];
@@ -1255,14 +1282,14 @@ var isAborted = (x) => x.status === "aborted";
 var isDirty = (x) => x.status === "dirty";
 var isValid = (x) => x.status === "valid";
 var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
-// ../../../../validation/build/apps/hooks/node_modules/zod/v3/helpers/errorUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
   errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
   errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
 })(errorUtil || (errorUtil = {}));
 
-// ../../../../validation/build/apps/hooks/node_modules/zod/v3/types.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
 class ParseInputLazyPath {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -5362,7 +5389,7 @@ import { readFileSync as readFileSync5 } from "fs";
 import { dirname as dirname4, join as join8 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 
-// ../../../../validation/build/apps/hooks/node_modules/@hasna/contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.2.2+944b86d8024e79fa/node_modules/@hasna/contracts/dist/client/transport.js
 import { spawnSync } from "child_process";
 import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync22 } from "fs";
 import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";

package/dist/index.js

@@ -581,7 +581,7 @@ var init_redact = __esm(() => {
   ];
 });
 
-// ../../../../validation/build/apps/hooks/node_modules/zod/v3/helpers/util.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType = (data) => {
   const t = typeof data;
   switch (t) {
@@ -712,7 +712,7 @@ var init_util = __esm(() => {
   ]);
 });
 
-// ../../../../validation/build/apps/hooks/node_modules/zod/v3/ZodError.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode, quotelessJson = (obj) => {
   const json = JSON.stringify(obj, null, 2);
   return json.replace(/"([^"]+)":/g, "$1:");
@@ -833,7 +833,7 @@ var init_ZodError = __esm(() => {
   };
 });
 
-// ../../../../validation/build/apps/hooks/node_modules/zod/v3/locales/en.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -940,7 +940,7 @@ var init_en = __esm(() => {
   en_default = errorMap;
 });
 
-// ../../../../validation/build/apps/hooks/node_modules/zod/v3/errors.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
 function setErrorMap(map) {
   overrideErrorMap = map;
 }
@@ -953,7 +953,7 @@ var init_errors = __esm(() => {
   overrideErrorMap = en_default;
 });
 
-// ../../../../validation/build/apps/hooks/node_modules/zod/v3/helpers/parseUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 function addIssueToContext(ctx, issueData) {
   const overrideMap = getErrorMap();
   const issue = makeIssue({
@@ -1058,10 +1058,10 @@ var init_parseUtil = __esm(() => {
   });
 });
 
-// ../../../../validation/build/apps/hooks/node_modules/zod/v3/helpers/typeAliases.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/typeAliases.js
 var init_typeAliases = () => {};
 
-// ../../../../validation/build/apps/hooks/node_modules/zod/v3/helpers/errorUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 var init_errorUtil = __esm(() => {
   (function(errorUtil2) {
@@ -1070,7 +1070,7 @@ var init_errorUtil = __esm(() => {
   })(errorUtil || (errorUtil = {}));
 });
 
-// ../../../../validation/build/apps/hooks/node_modules/zod/v3/types.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
 class ParseInputLazyPath {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -4421,7 +4421,7 @@ var init_types = __esm(() => {
   NEVER = INVALID;
 });
 
-// ../../../../validation/build/apps/hooks/node_modules/zod/v3/external.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
   void: () => voidType,
@@ -4541,7 +4541,7 @@ var init_external = __esm(() => {
   init_ZodError();
 });
 
-// ../../../../validation/build/apps/hooks/node_modules/zod/index.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/index.js
 var init_zod = __esm(() => {
   init_external();
   init_external();
@@ -5101,7 +5101,7 @@ var init_profiles = __esm(() => {
   init_app_home();
 });
 
-// ../../../../validation/build/apps/hooks/node_modules/@hasna/contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.2.2+944b86d8024e79fa/node_modules/@hasna/contracts/dist/client/transport.js
 import { isIP } from "net";
 import { spawnSync } from "child_process";
 import { closeSync as closeSync22, fstatSync as fstatSync22, openSync as openSync22, readFileSync as readFileSync22 } from "fs";
@@ -6979,6 +6979,10 @@ var HOOK_EVENTS = [
   "UserPromptSubmit",
   "SubagentStart"
 ];
+var CLAUDE_TRASH_GUARD_MATCHER = "^(Bash|Monitor|apply_patch|ApplyPatch|functions\\.apply_patch)$";
+function matcherFor(meta, target) {
+  return meta.targetMatchers?.[target] ?? meta.matcher;
+}
 var CATEGORIES = [
   "Git Safety",
   "Code Quality",
@@ -7041,6 +7045,8 @@ var HOOKS = [
     category: "Git Safety",
     event: "PreToolUse",
     matcher: "^(Bash|Write|Edit|MultiEdit|NotebookEdit|apply_patch|ApplyPatch|functions\\.apply_patch)$",
+    targetMatchers: { claude: "^(Bash|Monitor|Write|Edit|MultiEdit|NotebookEdit|apply_patch|ApplyPatch|functions\\.apply_patch)$" },
+    legacyMatchers: ["^(Bash|Write|Edit|MultiEdit|NotebookEdit|apply_patch|ApplyPatch|functions\\.apply_patch)$"],
     tags: ["workspace", "repos", "structure", "guard", "safety", "orgs", "multi-agent"]
   },
   {
@@ -7051,6 +7057,8 @@ var HOOKS = [
     category: "Git Safety",
     event: "PreToolUse",
     matcher: "^(Bash|apply_patch|ApplyPatch|functions\\.apply_patch)$",
+    targetMatchers: { claude: CLAUDE_TRASH_GUARD_MATCHER },
+    legacyMatchers: ["^(Bash|apply_patch|ApplyPatch|functions\\.apply_patch)$"],
     tags: ["rm", "delete", "trash", "recoverable", "guard", "safety", "bash"],
     rewritesInput: true,
     timeoutSeconds: 10
@@ -7155,6 +7163,28 @@ var HOOKS = [
     matcher: "Bash",
     tags: ["security", "credentials", "secrets", "detection", "audit"]
   },
+  {
+    name: "signed-link-guard",
+    displayName: "Signed Link Guard",
+    description: "Refuses gh reads that would print composite GitHub content (bodies, comments, reviews, commit messages, check links and details, raw issue/PR/check API objects) where signed action links appear; bounded scalar projections, diffs, lists and writes pass",
+    version: "0.1.0",
+    category: "Security",
+    event: "PreToolUse",
+    matcher: "^(Bash|Monitor)$",
+    tags: ["github", "gh", "signed-links", "capabilities", "transcript", "guard", "security"],
+    timeoutSeconds: 10
+  },
+  {
+    name: "signed-link-output",
+    displayName: "Signed Link Output",
+    description: "Claude PostToolUse backstop: replaces signed-link URLs in tool output with a redaction marker (updatedToolOutput, where the running Claude Code supports it) and tells the model not to repeat or store the link. It runs after the tool, so it cannot undo display or other persistence",
+    version: "0.1.0",
+    category: "Security",
+    event: "PostToolUse",
+    matcher: "^(Bash|WebFetch|mcp__.*)$",
+    tags: ["github", "signed-links", "capabilities", "redaction", "transcript", "security"],
+    timeoutSeconds: 10
+  },
   {
     name: "phonenotify",
     displayName: "Phone Notify",
@@ -8106,7 +8136,7 @@ function writeHookSettingsPreimage(path, settings, before) {
 // src/lib/claude-skills-coordination.ts
 import { createHash as createHash6 } from "crypto";
 
-// ../../../../validation/build/apps/hooks/node_modules/@hasna/skills/dist/index.js
+// ../../node_modules/.bun/@hasna+skills@0.9.17+a00d3064559565bb/node_modules/@hasna/skills/dist/index.js
 import { existsSync as existsSync10 } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join9, resolve as resolve3 } from "path";
@@ -39789,6 +39819,7 @@ function registerHook(name, scope = "global", target = "claude", profile, mement
   if (uniqueEventKeys.length === 0) {
     throw new Error(`Hook '${name}' has no installable events for target '${target}'`);
   }
+  const matcher = matcherFor(meta3, target);
   const settings = readSettings2(scope, target);
   if (!settings.hooks)
     settings.hooks = {};
@@ -39823,10 +39854,12 @@ function registerHook(name, scope = "global", target = "claude", profile, mement
       }
     }
     if (positions.length) {
-      if (positions.length !== uniqueEventKeys.length || uniqueEventKeys.some((event) => positions.filter((position) => position.event === event).length !== 1) || positions.some((position) => (position.entry.matcher ?? "") !== (meta3.matcher ?? ""))) {
+      if (positions.length !== uniqueEventKeys.length || uniqueEventKeys.some((event) => positions.filter((position) => position.event === event).length !== 1) || positions.some((position) => (position.entry.matcher ?? "") !== matcher && !(meta3.legacyMatchers ?? []).includes(position.entry.matcher ?? ""))) {
         throw new Error("Codex hook events, matchers or duplicate registrations require explicit reconciliation; no settings were changed.");
       }
       for (const { entry, index } of positions) {
+        if (matcher)
+          entry.matcher = matcher;
         entry.hooks[index] = { ...entry.hooks[index], type: "command", command: hookCommand };
         if (typeof meta3.timeoutSeconds === "number" && meta3.timeoutSeconds > 0)
           entry.hooks[index].timeout = meta3.timeoutSeconds;
@@ -39846,8 +39879,8 @@ function registerHook(name, scope = "global", target = "claude", profile, mement
     const entry = {
       hooks: [hookEntry]
     };
-    if (meta3.matcher) {
-      entry.matcher = meta3.matcher;
+    if (matcher) {
+      entry.matcher = matcher;
     }
     settings.hooks[eventKey].push(entry);
   }
@@ -41351,7 +41384,8 @@ async function verifyNativeSafetyCommand(command, home = homedir7()) {
 }
 
 // src/lib/codex-safety-check.ts
-var versions = new Set(["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.154.0-alpha.6.1", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1", "codex-cli 0.158.0", "codex-cli 0.159.0"]);
+var SUPPORTED_CODEX_SAFETY_VERSIONS = ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.154.0-alpha.6.1", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1", "codex-cli 0.158.0", "codex-cli 0.159.0", "codex-cli 0.159.2"];
+var versions = new Set(SUPPORTED_CODEX_SAFETY_VERSIONS);
 var matcher = "^(Bash|apply_patch|ApplyPatch|functions\\.apply_patch)$";
 
 class CodexSafetyError extends Error {
@@ -41896,7 +41930,7 @@ async function verifyClaudeSafetyConfiguration(options = {}, dependencies = {})
           need8(!/^(?:hooks run trash-guard|hook-trash-guard)(?:\s|$)/.test(handler.command.trim()), "guard_definition_invalid");
           if (binding?.name !== "trash-guard")
             continue;
-          need8(binding.home === home && event === "PreToolUse" && handler.type === "command" && group.matcher === "^(Bash|apply_patch|ApplyPatch|functions\\.apply_patch)$" && handler.timeout === 10 && (handler.async === undefined || handler.async === false) && handler.asyncRewake !== true, "guard_definition_invalid");
+          need8(binding.home === home && event === "PreToolUse" && handler.type === "command" && group.matcher === CLAUDE_TRASH_GUARD_MATCHER && handler.timeout === 10 && (handler.async === undefined || handler.async === false) && handler.asyncRewake !== true, "guard_definition_invalid");
           guards.push({ command: handler.command, path: file2.path });
         }
       }

package/dist/lib/codex-safety-check.d.ts

@@ -1,4 +1,7 @@
 import { verifyNativeSafetyCommand } from "../native-safety.js";
+/** Exact `codex --version` outputs whose app-server protocol was measured
+ * against the real native binary. Anything else refuses as native_unsupported. */
+export declare const SUPPORTED_CODEX_SAFETY_VERSIONS: readonly ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.154.0-alpha.6.1", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1", "codex-cli 0.158.0", "codex-cli 0.159.0", "codex-cli 0.159.2"];
 export type CodexSafetyCode = "native_unavailable" | "native_unsafe_executable" | "native_executable_required" | "native_unsupported" | "native_failed" | "native_discovery_failed" | "hooks_disabled" | "guard_missing" | "guard_ambiguous" | "guard_definition_invalid" | "guard_disabled" | "guard_untrusted" | "guard_changed" | "guard_failed";
 export declare class CodexSafetyError extends Error {
     readonly code: CodexSafetyCode;

package/dist/lib/native-safety-registration.d.ts

@@ -7,9 +7,12 @@ export declare class NativeRegistrationError extends Error {
 export interface NativeRegistrationOptions {
     target: "codex" | "claude";
 }
+export interface NativeReadinessRegistrationOptions {
+    target: "codex" | "claude" | "sumi";
+}
 export interface NativeRegistrationPlan {
     schema: "hasna.hooks.native-safety-registration/v1" | "hasna.hooks.native-readiness-registration/v1";
-    target: "codex" | "claude";
+    target: "codex" | "claude" | "sumi";
     settingsPath: string;
     resolvedPath: string;
     beforeSHA256: string;
@@ -24,6 +27,21 @@ export interface NativeRegistrationPlan {
 interface Dependencies {
     verify?: typeof verifyNativeSafetyCommand;
 }
+/** Sumi observes startup inside its own process through the bundled
+ * `@hasna/hooks/native-readiness` SDK, enabled by Sumi's own
+ * `experimental.trash_readiness` setting, so there is no startup command to
+ * write into a harness settings file. The Hooks-owned Sumi registration is the
+ * native guard record `~/.hasna/hooks/native/sumi-trash-guard.json`: it pins a
+ * Hooks runtime and worker, and Sumi's startup check requires it (Trash runs
+ * `hooks safety verify --target sumi --execution`). Planning re-points that
+ * record at this installed package without writing. Applying requires the exact
+ * plan digest, keeps the previous record as `<path>.before-<sha256>` and journals
+ * the operation. Sumi's own configuration is never read or written here. */
+export interface SumiRegistrationDependencies {
+    home?: string;
+    command?: string;
+    verify?: typeof verifyNativeSafetyCommand;
+}
 export declare const planNativeSafetyRegistration: (options: NativeRegistrationOptions, dependencies?: Dependencies) => Promise<NativeRegistrationPlan>;
 export declare const applyNativeSafetyRegistration: (options: NativeRegistrationOptions & {
     expectedPlanDigest: string;
@@ -38,7 +56,7 @@ export declare const applyNativeSafetyRegistration: (options: NativeRegistration
     guardVerified: boolean;
 } | {
     schema: "hasna.hooks.native-safety-registration/v1" | "hasna.hooks.native-readiness-registration/v1";
-    target: "codex" | "claude";
+    target: "codex" | "claude" | "sumi";
     settingsPath: string;
     resolvedPath: string;
     beforeSHA256: string;
@@ -52,10 +70,11 @@ export declare const applyNativeSafetyRegistration: (options: NativeRegistration
     ok: boolean;
     changed: boolean;
 }>;
-export declare const planNativeReadinessRegistration: (options: NativeRegistrationOptions) => Promise<NativeRegistrationPlan>;
-export declare const applyNativeReadinessRegistration: (options: NativeRegistrationOptions & {
+/** `sumiDependencies` is a test seam for the Sumi target only. */
+export declare const planNativeReadinessRegistration: (options: NativeReadinessRegistrationOptions, sumiDependencies?: SumiRegistrationDependencies) => Promise<NativeRegistrationPlan>;
+export declare const applyNativeReadinessRegistration: (options: NativeReadinessRegistrationOptions & {
     expectedPlanDigest: string;
-}) => Promise<{
+}, sumiDependencies?: SumiRegistrationDependencies) => Promise<{
     nativeAdoptionVerified: boolean;
     readinessRunnerVerified?: boolean | undefined;
     ok: boolean;
@@ -66,7 +85,31 @@ export declare const applyNativeReadinessRegistration: (options: NativeRegistrat
     guardVerified: boolean;
 } | {
     schema: "hasna.hooks.native-safety-registration/v1" | "hasna.hooks.native-readiness-registration/v1";
-    target: "codex" | "claude";
+    target: "codex" | "claude" | "sumi";
+    settingsPath: string;
+    resolvedPath: string;
+    beforeSHA256: string;
+    desiredSHA256: string;
+    commandSHA256: string;
+    action: "unchanged" | "register";
+    planDigest: string;
+    guardVerified: boolean;
+    readinessRunnerVerified?: true;
+    nativeAdoptionVerified: false;
+    ok: boolean;
+    changed: boolean;
+}> | Promise<{
+    nativeAdoptionVerified: boolean;
+    backup?: string | undefined;
+    ok: boolean;
+    changed: boolean;
+    operationId: `${string}-${string}-${string}-${string}-${string}`;
+    planDigest: string;
+    settingsSHA256: string;
+    guardVerified: boolean;
+} | {
+    schema: "hasna.hooks.native-safety-registration/v1" | "hasna.hooks.native-readiness-registration/v1";
+    target: "codex" | "claude" | "sumi";
     settingsPath: string;
     resolvedPath: string;
     beforeSHA256: string;

package/dist/lib/registry.d.ts

@@ -21,6 +21,17 @@ export interface HookMeta {
      * reports it.
      */
     rewritesInput?: boolean;
+    /**
+     * A different matcher for one harness. Claude Code's `Monitor` tool runs a
+     * shell command and streams its stdout to the model, so the bundled guards
+     * add it on Claude; Codex has no such tool and keeps its verified matcher.
+     */
+    targetMatchers?: Partial<Record<"claude" | "codex", string>>;
+    /**
+     * Earlier matchers of an installed native registration that an in-place
+     * update may replace with the current one.
+     */
+    legacyMatchers?: string[];
     /**
      * Timeout (seconds) written into the agent's settings entry for this hook.
      * The harness default is 600s, and a TIMED-OUT HOOK DOES NOT BLOCK: a guard
@@ -28,6 +39,10 @@ export interface HookMeta {
      */
     timeoutSeconds?: number;
 }
+/** The Claude Code matcher of the bundled Trash guard registration (Bash, Monitor and patch tools). */
+export declare const CLAUDE_TRASH_GUARD_MATCHER = "^(Bash|Monitor|apply_patch|ApplyPatch|functions\\.apply_patch)$";
+/** The matcher a hook is registered with for one harness. */
+export declare function matcherFor(meta: HookMeta, target: string): string;
 export declare const CATEGORIES: readonly ["Git Safety", "Code Quality", "Security", "Notifications", "Context Management", "Workflow Automation", "Environment", "Permissions", "Observability", "Agent Teams"];
 export type Category = (typeof CATEGORIES)[number];
 export declare const HOOKS: HookMeta[];

package/dist/native-safety.d.ts

@@ -38,10 +38,14 @@ export type NativeSafetyRecord = {
     harness: "sumi";
     command: string;
 };
+/** The exact bytes every writer stores for a Sumi guard record. Planners use
+ * the same bytes to compute a desired digest before any write. */
+export declare function nativeSafetyRecordText(command: string): string;
 export declare function readNativeSafetyRegistration(home?: string): {
     record: NativeSafetyRecord;
     sha256: string;
     path: string;
+    text: string;
 };
 /** Bounded, non-leaking explanation for a refused binding: which integrity
  * property the saved record fails. A binding that a third party could rewrite

package/dist/native-safety.js

@@ -199,11 +199,16 @@ function syncDirectory(path) {
     closeSync2(fd);
   }
 }
+function nativeSafetyRecordText(command) {
+  const record = { schema: "hasna.hooks.native-safety.v1", harness: "sumi", command };
+  return JSON.stringify(record) + `
+`;
+}
 function readNativeSafetyRegistration(home = homedir2()) {
   try {
     home = canonicalHome(home);
     const path = join2(home, ".hasna/hooks/native", filename), text = readOwned(path);
-    return { record: parseRecord(text, home), sha256: hash(text), path };
+    return { record: parseRecord(text, home), sha256: hash(text), path, text };
   } catch (error) {
     if (error instanceof NativeSafetyError)
       throw error;
@@ -229,9 +234,7 @@ function nativeSafetyBindingIntegrityReason(home = homedir2()) {
 }
 function registerNativeSafety(options = {}) {
   const home = canonicalHome(options.home ?? homedir2());
-  const record = { schema: "hasna.hooks.native-safety.v1", harness: "sumi", command: options.command ?? installedNativeSafetyCommand("trash-guard") };
-  const text = JSON.stringify(record) + `
-`;
+  const text = nativeSafetyRecordText(options.command ?? installedNativeSafetyCommand("trash-guard"));
   parseRecord(text, home);
   for (const dir of [join2(home, ".hasna"), join2(home, ".hasna/hooks"), join2(home, ".hasna/hooks/native")]) {
     try {
@@ -412,6 +415,7 @@ export {
   verifyNativeSafetyCommand,
   registerNativeSafety,
   readNativeSafetyRegistration,
+  nativeSafetyRecordText,
   nativeSafetyBindingIntegrityReason,
   evaluateNativeSafetyForExecution,
   evaluateNativeSafety,

package/dist/sdk/index.js

@@ -1,5 +1,5 @@
 // @bun
-// ../../../../validation/build/apps/hooks/node_modules/@hasna/contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.2.2+944b86d8024e79fa/node_modules/@hasna/contracts/dist/client/transport.js
 import { isIP } from "net";
 import { spawnSync } from "child_process";
 import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync2 } from "fs";