@hasna/hooks 0.12.2 → 0.12.3

package/README.md

@@ -309,9 +309,11 @@ Known limits of the native entry:
   harness environment are outside it (details in the guard's README).
 - Codex's input into a running unified exec session (`write_stdin`) has not
   been verified to pass through PreToolUse.
-- The repository guard still reads a here-document body line by line, so prose
-  in a `--body "$(cat <<'EOF' … EOF)"` body that mentions a delete command
-  beside an unbalanced quote can still be refused by that guard.
+- The repository guard reads a here-document body as data only when every
+  command word of the command is a data command such as `cat`, `git commit`
+  or `gh pr` (the list is in the guard's README). With any other command word
+  it reads the body line by line, so prose in such a body that mentions a
+  delete command can still be refused inside a protected checkout.
 
 ## Codex safety readiness
 
@@ -331,8 +333,8 @@ architecture (arm64 or x64); script launchers are refused before execution. When
 Codex is installed through npm, pass the platform package's native binary rather
 than its JavaScript launcher. Executable ownership, permissions, ancestry and
 bytes are checked. Supported protocol versions are 0.153.0, 0.154.0,
-0.154.0-alpha.6.1, 0.155.0, 0.155.1, 0.156.1, 0.157.0, 0.157.1, 0.158.0, 0.159.0, 0.159.2
-and 0.159.3;
+0.154.0-alpha.6.1, 0.155.0, 0.155.1, 0.156.1, 0.157.0, 0.157.1, 0.158.0, 0.159.0, 0.159.2,
+0.159.3 and 0.160.0;
 other versions refuse pending compatibility validation. Updating Codex can
 therefore require a compatible Hooks release before native safety verification
 and trust provisioning succeed. Keep existing hook definitions and trust intact

package/bin/index.js

@@ -35391,7 +35391,7 @@ var init_codex_safety_check = __esm(() => {
   init_native_readiness_command();
   init_native_safety2();
   init_native_readiness();
-  SUPPORTED_CODEX_SAFETY_VERSIONS = ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.154.0-alpha.6.1", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1", "codex-cli 0.158.0", "codex-cli 0.159.0", "codex-cli 0.159.2", "codex-cli 0.159.3"];
+  SUPPORTED_CODEX_SAFETY_VERSIONS = ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.154.0-alpha.6.1", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1", "codex-cli 0.158.0", "codex-cli 0.159.0", "codex-cli 0.159.2", "codex-cli 0.159.3", "codex-cli 0.160.0"];
   versions = new Set(SUPPORTED_CODEX_SAFETY_VERSIONS);
   CodexSafetyError = class CodexSafetyError extends Error {
     code;
@@ -39289,7 +39289,7 @@ import { closeSync as closeSync22, fstatSync as fstatSync22, openSync as openSyn
 import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";
 import { hostname as osHostname } from "os";
 import { isAbsolute as isAbsolute21, join as join28 } from "path";
-import { createRequire as createRequire3 } from "module";
+import { createRequire as createRequire2 } from "module";
 import { fileURLToPath as fileURLToPath22 } from "url";
 import { closeSync as closeSync20, fstatSync as fstatSync19, lstatSync as lstatSync24, openSync as openSync20, readFileSync as readFileSync20, realpathSync as realpathSync12, statSync as statSync2 } from "fs";
 import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
@@ -39372,7 +39372,7 @@ function entryPoint(directory2) {
   let pkg;
   try {
     const stat2 = fstatSync19(fd);
-    if (!stat2.isFile() || stat2.size > MAX_PACKAGE_BYTES3)
+    if (!stat2.isFile() || stat2.size > MAX_PACKAGE_BYTES2)
       throw new Error("Invalid Secrets package metadata");
     pkg = JSON.parse(readFileSync20(fd, "utf8"));
   } finally {
@@ -39519,7 +39519,7 @@ function readAppConfigFile(path) {
     const uid2 = process.getuid?.() ?? process.geteuid?.();
     if (uid2 !== undefined && before.uid !== uid2)
       unsafe("the file is not owned by the current user");
-    if (before.size > MAX_CREDENTIAL_FILE_BYTES3)
+    if (before.size > MAX_CREDENTIAL_FILE_BYTES2)
       unsafe("the file exceeds the size limit");
     const bytes = readFileSync22(fd);
     const after = fstatSync22(fd);
@@ -39611,13 +39611,13 @@ function sealCredential(fields) {
       configurable: false
     });
   }
-  Object.defineProperty(sealed, INSPECT_CUSTOM3, {
+  Object.defineProperty(sealed, INSPECT_CUSTOM2, {
     value: () => ({ ...visible, apiKey: "[redacted]" }),
     enumerable: false,
     writable: false,
     configurable: false
   });
-  Object.defineProperty(sealed, CREDENTIAL_SEAL3, {
+  Object.defineProperty(sealed, CREDENTIAL_SEAL2, {
     value: true,
     enumerable: false,
     writable: false,
@@ -39648,7 +39648,7 @@ function firstEnvValue(env, keys2) {
   return null;
 }
 function isAmbientEnvironment(env) {
-  return env === process.env || env[AMBIENT_ENVIRONMENT3] === true;
+  return env === process.env || env[AMBIENT_ENVIRONMENT2] === true;
 }
 function defaultKeychainRunner(argv) {
   const result = spawnSync2(KEYCHAIN_SECURITY_BIN, [...argv], {
@@ -39742,7 +39742,7 @@ function snapshotClientEnvironment(name, env) {
     snapshot2[key] = descriptor.value;
   }
   if (ambient) {
-    Object.defineProperty(snapshot2, AMBIENT_ENVIRONMENT3, {
+    Object.defineProperty(snapshot2, AMBIENT_ENVIRONMENT2, {
       value: true,
       enumerable: false,
       writable: false,
@@ -39915,7 +39915,7 @@ async function completePointerCredential(name, pointerResolution, env = process.
   let secretsSdk;
   try {
     const sdkUrl = resolveInstalledSecrets(import.meta.url);
-    secretsSdk = requireSecretsSdk3(fileURLToPath22(sdkUrl));
+    secretsSdk = requireSecretsSdk2(fileURLToPath22(sdkUrl));
   } catch {
     throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets SDK (@hasna/secrets) is not installed ` + `in this process. A vault pointer is TERMINAL: install @hasna/secrets to resolve it, or unset ${pointerEnvKey}.`, [pointerEnvKey]);
   }
@@ -40151,9 +40151,9 @@ function credentialDiskSourcesForMessage(name, env) {
   const paths = credentialDiskSources(name, env);
   return paths.length > 0 ? paths.join(" or ") : "<no HOME or HASNA_HOME set in this environment, so no credential file was consulted>";
 }
-var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", PACKAGE = "@hasna/secrets", MAX_PACKAGE_BYTES3, CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES3, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM3, CREDENTIAL_SEAL3, AMBIENT_ENVIRONMENT3, requireSecretsSdk3, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", DEFAULT_AUTHORITY_SOURCE = "default", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, ClientTransportConfigurationError, IDEMPOTENT_METHODS3, AUTHORITY_OVERRIDE_HEADERS3;
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", PACKAGE = "@hasna/secrets", MAX_PACKAGE_BYTES2, CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES2, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM2, CREDENTIAL_SEAL2, AMBIENT_ENVIRONMENT2, requireSecretsSdk2, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", DEFAULT_AUTHORITY_SOURCE = "default", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, ClientTransportConfigurationError, IDEMPOTENT_METHODS2, AUTHORITY_OVERRIDE_HEADERS2;
 var init_transport = __esm(() => {
-  MAX_PACKAGE_BYTES3 = 1024 * 1024;
+  MAX_PACKAGE_BYTES2 = 1024 * 1024;
   CredentialResolutionError = class CredentialResolutionError extends Error {
     appName;
     attempted;
@@ -40172,16 +40172,16 @@ var init_transport = __esm(() => {
       this.path = path;
     }
   };
-  MAX_CREDENTIAL_FILE_BYTES3 = 64 * 1024;
+  MAX_CREDENTIAL_FILE_BYTES2 = 64 * 1024;
   SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
   SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
   ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
   VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
   CREDENTIAL_SHAPED_KEY = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)(?:_|$)/;
-  INSPECT_CUSTOM3 = Symbol.for("nodejs.util.inspect.custom");
-  CREDENTIAL_SEAL3 = Symbol.for("hasna:contracts:sealedCredential");
-  AMBIENT_ENVIRONMENT3 = Symbol.for("hasna:contracts:ambientClientEnvironment");
-  requireSecretsSdk3 = createRequire3(import.meta.url);
+  INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
+  CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
+  AMBIENT_ENVIRONMENT2 = Symbol.for("hasna:contracts:ambientClientEnvironment");
+  requireSecretsSdk2 = createRequire2(import.meta.url);
   ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
   DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
   ClientTransportConfigurationError = class ClientTransportConfigurationError extends Error {
@@ -40194,8 +40194,8 @@ var init_transport = __esm(() => {
       this.sources = Object.freeze([...sources]);
     }
   };
-  IDEMPOTENT_METHODS3 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
-  AUTHORITY_OVERRIDE_HEADERS3 = new Set([
+  IDEMPOTENT_METHODS2 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+  AUTHORITY_OVERRIDE_HEADERS2 = new Set([
     "host",
     ":authority",
     "forwarded",
@@ -43772,7 +43772,7 @@ async function verifyClaudeSafetyConfiguration(options = {}, dependencies = {})
 // src/cli/index.tsx
 init_codex_safety_trust();
 
-// ../events/dist/commander.js
+// ../../node_modules/.bun/@hasna+events@0.1.18/node_modules/@hasna/events/dist/commander.js
 import { chmod, mkdir, readFile as readFile2, rename, writeFile } from "fs/promises";
 import { Buffer as Buffer2 } from "buffer";
 import { existsSync as existsSync22 } from "fs";
@@ -43790,7 +43790,6 @@ import { spawn as spawn3 } from "child_process";
 import { request as nodeHttpRequest } from "http";
 import { request as nodeHttpsRequest } from "https";
 import { randomUUID as randomUUID22 } from "crypto";
-import { createRequire as createRequire2 } from "module";
 function getPathValue(input2, path) {
   return path.split(".").reduce((value, part) => {
     if (value && typeof value === "object" && part in value) {
@@ -44888,22 +44887,6 @@ function setPath(input2, path, replacement) {
   if (last && last in cursor)
     cursor[last] = replacement;
 }
-var MAX_PACKAGE_BYTES2 = 1024 * 1024;
-var MAX_CREDENTIAL_FILE_BYTES2 = 64 * 1024;
-var INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
-var CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
-var AMBIENT_ENVIRONMENT2 = Symbol.for("hasna:contracts:ambientClientEnvironment");
-var requireSecretsSdk2 = createRequire2(import.meta.url);
-var IDEMPOTENT_METHODS2 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
-var AUTHORITY_OVERRIDE_HEADERS2 = new Set([
-  "host",
-  ":authority",
-  "forwarded",
-  "x-forwarded-host",
-  "x-original-host"
-]);
-var MAX_ENVELOPE_BYTES = 256 * 1024;
-var MAX_REQUEST_BYTES = MAX_ENVELOPE_BYTES * 2 + 8192;
 function createEvent(input2) {
   return {
     id: input2.id ?? randomUUID22(),