@hasna/hooks 0.2.20 → 0.3.0

package/bin/index.js

@@ -861,7 +861,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this._exitCallback = (err) => {
           if (err.code !== "commander.executeSubCommandAsync") {
             throw err;
-          }
+          } else {}
         };
       }
       return this;
@@ -1942,6 +1942,16 @@ var init_registry = __esm(() => {
       matcher: "Write|Edit|NotebookEdit",
       tags: ["git", "snapshot", "rollback", "backup"]
     },
+    {
+      name: "worktree-guard",
+      displayName: "Worktree Guard",
+      description: "Warns on feature work outside managed repos worktrees and blocks commit/push from shared checkouts",
+      version: "0.1.0",
+      category: "Git Safety",
+      event: "PreToolUse",
+      matcher: "Bash|Write|Edit|MultiEdit|NotebookEdit",
+      tags: ["git", "worktree", "repos", "multi-agent", "safety"]
+    },
     {
       name: "checktests",
       displayName: "Check Tests",
@@ -2022,6 +2032,16 @@ var init_registry = __esm(() => {
       matcher: "Bash",
       tags: ["npm", "packages", "typosquatting", "supply-chain"]
     },
+    {
+      name: "pre-bash",
+      displayName: "Pre Bash",
+      description: "Codewith Bash gate for staged secrets scans before commit/push and comms rechecks before risky operations",
+      version: "0.1.0",
+      category: "Security",
+      event: "PreToolUse",
+      matcher: "Bash",
+      tags: ["codewith", "bash", "secrets", "gitleaks", "risky-ops"]
+    },
     {
       name: "phonenotify",
       displayName: "Phone Notify",
@@ -2132,6 +2152,16 @@ var init_registry = __esm(() => {
       matcher: "",
       tags: ["prompt", "injection", "security", "validation", "guard"]
     },
+    {
+      name: "prompt-guard",
+      displayName: "Prompt Guard (Codewith)",
+      description: "Codewith UserPromptSubmit guard for obvious pasted prompt-injection and fake policy/freeze instructions",
+      version: "0.1.0",
+      category: "Permissions",
+      event: "UserPromptSubmit",
+      matcher: "",
+      tags: ["codewith", "prompt", "injection", "policy", "freeze"]
+    },
     {
       name: "desktopnotify",
       displayName: "Desktop Notify",
@@ -2222,6 +2252,26 @@ var init_registry = __esm(() => {
       matcher: "",
       tags: ["tasks", "completion", "gate", "quality", "agent-teams"]
     },
+    {
+      name: "session-start",
+      displayName: "Session Start",
+      description: "Codewith SessionStart digest for blockers, announcements, identity registration, and heartbeat context",
+      version: "0.1.0",
+      category: "Agent Teams",
+      event: "SessionStart",
+      matcher: "",
+      tags: ["codewith", "session", "context", "conversations", "heartbeat"]
+    },
+    {
+      name: "stop-sync",
+      displayName: "Stop Sync",
+      description: "Codewith Stop turn-end heartbeat and best-effort task evidence helper",
+      version: "0.1.0",
+      category: "Agent Teams",
+      event: "Stop",
+      matcher: "",
+      tags: ["codewith", "stop", "heartbeat", "todos", "turn-end"]
+    },
     {
       name: "typecheck-gate",
       displayName: "Typecheck Gate",
@@ -2275,10 +2325,10 @@ var init_registry = __esm(() => {
     {
       name: "announce-start",
       displayName: "Announce Start",
-      description: "On session start, auto-registers agent, reads messages, and announces to space",
-      version: "0.1.0",
+      description: "On SessionStart, auto-registers agent, reads messages, and announces to space",
+      version: "0.2.0",
       category: "Agent Teams",
-      event: "Notification",
+      event: "SessionStart",
       matcher: "",
       tags: ["announcement", "start", "register", "messages", "agent-teams"]
     },
@@ -2301,6 +2351,36 @@ var init_registry = __esm(() => {
       event: "Notification",
       matcher: "",
       tags: ["messages", "dm", "context", "inject", "agent-teams"]
+    },
+    {
+      name: "fleet-catchup",
+      displayName: "Fleet Catchup",
+      description: "On SessionStart, injects unread blockers, channel notifications, and the announcements digest into context (deterministic CLI reads, fail-open)",
+      version: "0.1.0",
+      category: "Agent Teams",
+      event: "SessionStart",
+      matcher: "",
+      tags: ["fleet", "catchup", "blockers", "announcements", "context", "agent-teams"]
+    },
+    {
+      name: "agent-rules-version-check",
+      displayName: "Agent Rules Version Check",
+      description: "On SessionStart, compares the rendered hasna:agent-operating-rules sentinel version against configs state and warns on mismatch",
+      version: "0.1.0",
+      category: "Agent Teams",
+      event: "SessionStart",
+      matcher: "",
+      tags: ["fleet", "rules", "version", "sentinel", "configs", "drift", "agent-teams"]
+    },
+    {
+      name: "fleet-blockers-gate",
+      displayName: "Fleet Blockers Gate",
+      description: "Before tool calls, blocks mutating tools while an unread [FREEZE] blocker is active (TTL-cached conversations check, fail-open <500ms)",
+      version: "0.1.0",
+      category: "Agent Teams",
+      event: "PreToolUse",
+      matcher: "",
+      tags: ["fleet", "freeze", "blockers", "gate", "safety", "agent-teams"]
     }
   ];
 });
@@ -3954,28 +4034,39 @@ function normalizeHookName(name) {
   return name.startsWith("hook-") ? name : `hook-${name}`;
 }
 function shortHookName(name) {
-  return normalizeHookName(name).replace("hook-", "");
+  return name.startsWith("hook-") ? name.slice("hook-".length) : name;
 }
 function removeHookEntriesByName(entries, hookName) {
   return entries.filter((entry) => !entry.hooks?.some((h) => {
-    const match = h.command?.match(/^hooks run (\w+)/);
+    const match = h.command?.match(/^hooks run ([\w-]+)/);
     return match && match[1] === hookName;
   }));
 }
 function getTargetSettingsDir(target) {
+  if (target === "codewith")
+    return ".codewith";
   if (target === "gemini")
     return ".gemini";
   return ".claude";
 }
-function getSettingsPath(scope = "global", target = "claude") {
+function getSettingsPath(scope = "global", target = "claude", codewithConfigPath) {
+  if (target === "codewith" && codewithConfigPath)
+    return codewithConfigPath;
+  if (target === "codewith" && process.env.HASNA_HOOKS_CODEWITH_CONFIG_PATH) {
+    return process.env.HASNA_HOOKS_CODEWITH_CONFIG_PATH;
+  }
   const dir = getTargetSettingsDir(target);
   if (scope === "project") {
-    return join2(process.cwd(), dir, "settings.json");
+    return target === "codewith" ? join2(process.cwd(), dir, "config.toml") : join2(process.cwd(), dir, "settings.json");
   }
-  return join2(homedir2(), dir, "settings.json");
+  return target === "codewith" ? join2(homedir2(), dir, "config.toml") : join2(homedir2(), dir, "settings.json");
 }
 function getHookPath(name) {
-  return join2(HOOKS_DIR, normalizeHookName(name));
+  const shortName = shortHookName(name);
+  const direct = join2(HOOKS_DIR, shortName);
+  if (existsSync2(direct))
+    return direct;
+  return join2(HOOKS_DIR, normalizeHookName(shortName));
 }
 function hookExists(name) {
   return existsSync2(getHookPath(name));
@@ -4001,7 +4092,94 @@ function writeSettings(settings, scope = "global", target = "claude") {
 `);
 }
 function getTargetEventName(internalEvent, target) {
-  return EVENT_MAP[target]?.[internalEvent] || internalEvent;
+  return EVENT_MAP[target]?.[internalEvent] ?? null;
+}
+function isEventSupported(internalEvent, target) {
+  return getTargetEventName(internalEvent, target) !== null;
+}
+function tomlString(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+function codewithMatcher(matcher) {
+  if (!matcher)
+    return;
+  if (matcher.startsWith("^"))
+    return matcher;
+  if (matcher.includes("|"))
+    return `^(${matcher})$`;
+  return `^${matcher}$`;
+}
+function codewithTimeout(name) {
+  switch (name) {
+    case "session-start":
+      return 8;
+    case "pre-bash":
+      return 20;
+    case "prompt-guard":
+      return 3;
+    case "worktree-guard":
+    case "stop-sync":
+      return 5;
+    default:
+      return 10;
+  }
+}
+function codewithStatusMessage(name) {
+  switch (name) {
+    case "session-start":
+      return "Checking Hasna session context";
+    case "pre-bash":
+      return "Checking Bash safety";
+    case "prompt-guard":
+      return "Checking prompt safety";
+    case "worktree-guard":
+      return "Checking worktree safety";
+    case "stop-sync":
+      return "Syncing turn-end heartbeat";
+    default:
+      return `Running ${name}`;
+  }
+}
+function buildCodewithTomlFragment(name, profile) {
+  const shortName = shortHookName(name);
+  const meta = getHook(shortName);
+  if (!meta)
+    throw new Error(`Hook '${shortName}' not found`);
+  const eventKey = getTargetEventName(meta.event, "codewith");
+  if (!eventKey) {
+    throw new Error(`Hook '${shortName}' uses event '${meta.event}', which is not supported by the Codewith target`);
+  }
+  const command = profile ? `hooks run ${shortName} --profile ${profile}` : `hooks run ${shortName}`;
+  const matcher = codewithMatcher(meta.matcher);
+  const lines = [
+    `[[hooks.${eventKey}]]`
+  ];
+  if (matcher)
+    lines.push(`matcher = ${tomlString(matcher)}`);
+  lines.push("", `[[hooks.${eventKey}.hooks]]`, `type = "command"`, `command = ${tomlString(command)}`, `timeout = ${codewithTimeout(shortName)}`, `statusMessage = ${tomlString(codewithStatusMessage(shortName))}`);
+  return `${lines.join(`
+`)}
+`;
+}
+function readCodewithConfig(scope, configPath) {
+  const path = getSettingsPath(scope, "codewith", configPath);
+  try {
+    return existsSync2(path) ? readFileSync(path, "utf-8") : "";
+  } catch {
+    return "";
+  }
+}
+function appendCodewithFragment(fragment, scope, configPath) {
+  const path = getSettingsPath(scope, "codewith", configPath);
+  const dir = dirname(path);
+  if (!existsSync2(dir))
+    mkdirSync(dir, { recursive: true });
+  const existing = existsSync2(path) ? readFileSync(path, "utf-8") : "";
+  const sep = existing.trim() ? `
+
+` : "";
+  writeFileSync(path, `${existing.replace(/\s*$/, "")}${sep}${fragment}`);
+  return path;
 }
 function detectConflict(name, scope, target) {
   const meta = getHook(name);
@@ -4022,11 +4200,60 @@ function detectConflict(name, scope, target) {
   }
   return;
 }
-function installForTarget(name, scope, overwrite, target, profile) {
+function installForTarget(name, scope, overwrite, target, profile, codewithMode = "fragment", codewithConfigPath) {
   const shortName = shortHookName(name);
   if (!hookExists(shortName)) {
     return { hook: shortName, success: false, error: `Hook '${shortName}' not found`, target };
   }
+  if (target === "codewith") {
+    try {
+      const fragment = buildCodewithTomlFragment(shortName, profile);
+      if (codewithMode !== "write") {
+        return {
+          hook: shortName,
+          success: true,
+          scope,
+          target,
+          fragment,
+          applied: false,
+          note: "Codewith install is fragment-only by default; open-configs should own applying this TOML."
+        };
+      }
+      if (!codewithConfigPath) {
+        return {
+          hook: shortName,
+          success: false,
+          error: "Direct Codewith writes require an explicit --codewith-config path; refusing to write default ~/.codewith/config.toml.",
+          scope,
+          target,
+          fragment,
+          applied: false
+        };
+      }
+      const existing = readCodewithConfig(scope, codewithConfigPath);
+      if (!overwrite && new RegExp(`command\\s*=\\s*["']hooks run ${shortName}(?:\\s|["'])`).test(existing)) {
+        return { hook: shortName, success: false, error: "Already installed. Use --overwrite to append another fragment.", scope, target };
+      }
+      const path = appendCodewithFragment(fragment, scope, codewithConfigPath);
+      return {
+        hook: shortName,
+        success: true,
+        scope,
+        target,
+        fragment,
+        applied: true,
+        configPath: path,
+        note: "Direct Codewith config write was explicitly requested; prefer open-configs for managed machines."
+      };
+    } catch (error) {
+      return {
+        hook: shortName,
+        success: false,
+        error: error instanceof Error ? error.message : "Unknown error",
+        target
+      };
+    }
+  }
   const registered = getRegisteredHooksForTarget(scope, target);
   if (registered.includes(shortName) && !overwrite) {
     return { hook: shortName, success: false, error: "Already installed. Use --overwrite to replace.", scope, target };
@@ -4045,25 +4272,63 @@ function installForTarget(name, scope, overwrite, target, profile) {
   }
 }
 function installHook(name, options = {}) {
-  const { scope = "global", overwrite = false, target = "claude", profile } = options;
+  const { scope = "global", overwrite = false, target = "claude", profile, codewithMode = "fragment", codewithConfigPath } = options;
   if (target === "all") {
+    const shortName = shortHookName(name);
+    const meta = getHook(shortName);
+    if (meta) {
+      const unsupportedTargets = ["claude", "gemini", "codewith"].filter((agentTarget) => !isEventSupported(meta.event, agentTarget));
+      if (unsupportedTargets.length > 0) {
+        return {
+          hook: shortName,
+          success: false,
+          error: `Event '${meta.event}' is not supported by target(s): ${unsupportedTargets.join(", ")}`,
+          target: "all"
+        };
+      }
+    }
     const claudeResult = installForTarget(name, scope, overwrite, "claude", profile);
-    installForTarget(name, scope, overwrite, "gemini", profile);
+    if (!claudeResult.success) {
+      return {
+        ...claudeResult,
+        error: `Failed for target 'claude': ${claudeResult.error}`,
+        target: "all"
+      };
+    }
+    const geminiResult = installForTarget(name, scope, overwrite, "gemini", profile);
+    if (!geminiResult.success) {
+      return {
+        ...geminiResult,
+        error: `Failed for target 'gemini': ${geminiResult.error}`,
+        target: "all"
+      };
+    }
+    const codewithResult = installForTarget(name, scope, overwrite, "codewith", profile, codewithMode, codewithConfigPath);
+    if (!codewithResult.success) {
+      return {
+        ...codewithResult,
+        error: `Failed for target 'codewith': ${codewithResult.error}`,
+        target: "all"
+      };
+    }
     return { ...claudeResult, target: "all" };
   }
-  return installForTarget(name, scope, overwrite, target, profile);
+  return installForTarget(name, scope, overwrite, target, profile, codewithMode, codewithConfigPath);
 }
 function registerHook(name, scope = "global", target = "claude", profile) {
   const meta = getHook(name);
   if (!meta)
     return;
+  const eventKey = getTargetEventName(meta.event, target);
+  if (eventKey === null) {
+    throw new Error(`Event '${meta.event}' is not supported by target '${target}'`);
+  }
   const settings = readSettings(scope, target);
   if (!settings.hooks)
     settings.hooks = {};
-  const eventKey = getTargetEventName(meta.event, target);
+  removeHookFromAllEvents(settings, name);
   if (!settings.hooks[eventKey])
     settings.hooks[eventKey] = [];
-  settings.hooks[eventKey] = removeHookEntriesByName(settings.hooks[eventKey], name);
   const hookCommand = profile ? `hooks run ${name} --profile ${profile}` : `hooks run ${name}`;
   const entry = {
     hooks: [{ type: "command", command: hookCommand }]
@@ -4074,6 +4339,16 @@ function registerHook(name, scope = "global", target = "claude", profile) {
   settings.hooks[eventKey].push(entry);
   writeSettings(settings, scope, target);
 }
+function removeHookFromAllEvents(settings, name) {
+  if (!settings.hooks)
+    return;
+  for (const key of Object.keys(settings.hooks)) {
+    settings.hooks[key] = removeHookEntriesByName(settings.hooks[key], name);
+    if (settings.hooks[key].length === 0) {
+      delete settings.hooks[key];
+    }
+  }
+}
 function unregisterHook(name, scope = "global", target = "claude") {
   const meta = getHook(name);
   if (!meta)
@@ -4081,19 +4356,23 @@ function unregisterHook(name, scope = "global", target = "claude") {
   const settings = readSettings(scope, target);
   if (!settings.hooks)
     return;
-  const eventKey = getTargetEventName(meta.event, target);
-  if (!settings.hooks[eventKey])
-    return;
-  settings.hooks[eventKey] = removeHookEntriesByName(settings.hooks[eventKey], name);
-  if (settings.hooks[eventKey].length === 0) {
-    delete settings.hooks[eventKey];
-  }
+  removeHookFromAllEvents(settings, name);
   if (Object.keys(settings.hooks).length === 0) {
     delete settings.hooks;
   }
   writeSettings(settings, scope, target);
 }
 function getRegisteredHooksForTarget(scope = "global", target = "claude") {
+  if (target === "codewith") {
+    const config = readCodewithConfig(scope);
+    const registered2 = [];
+    const re = /command\s*=\s*["']hooks run ([\w-]+)(?:\s+--profile\s+[\w-]+)?["']/g;
+    let match;
+    while (match = re.exec(config)) {
+      registered2.push(match[1]);
+    }
+    return [...new Set(registered2)];
+  }
   const settings = readSettings(scope, target);
   if (!settings.hooks)
     return [];
@@ -4101,8 +4380,8 @@ function getRegisteredHooksForTarget(scope = "global", target = "claude") {
   for (const eventKey of Object.keys(settings.hooks)) {
     for (const entry of settings.hooks[eventKey]) {
       for (const hook of entry.hooks || []) {
-        const newMatch = hook.command?.match(/^hooks run (\w+)(?:\s+--profile\s+\w+)?$/);
-        const oldMatch = hook.command?.match(/^hook-(\w+)$/);
+        const newMatch = hook.command?.match(/^hooks run ([\w-]+)(?:\s+--profile\s+[\w-]+)?$/);
+        const oldMatch = hook.command?.match(/^hook-([\w-]+)$/);
         const match = newMatch || oldMatch;
         if (match) {
           registered.push(match[1]);
@@ -4122,6 +4401,9 @@ function removeHook(name, scope = "global", target = "claude") {
     const geminiRemoved = removeHookForTarget(shortName, scope, "gemini");
     return claudeRemoved || geminiRemoved;
   }
+  if (target === "codewith") {
+    return false;
+  }
   return removeHookForTarget(shortName, scope, target);
 }
 function removeHookForTarget(name, scope, target) {
@@ -4142,13 +4424,28 @@ var init_installer = __esm(() => {
       PreToolUse: "PreToolUse",
       PostToolUse: "PostToolUse",
       Stop: "Stop",
-      Notification: "Notification"
+      Notification: "Notification",
+      SessionStart: "SessionStart",
+      SessionEnd: "SessionEnd",
+      UserPromptSubmit: null
     },
     gemini: {
       PreToolUse: "BeforeTool",
       PostToolUse: "AfterTool",
       Stop: "AfterAgent",
-      Notification: "Notification"
+      Notification: "Notification",
+      SessionStart: null,
+      SessionEnd: null,
+      UserPromptSubmit: null
+    },
+    codewith: {
+      PreToolUse: "PreToolUse",
+      PostToolUse: "PostToolUse",
+      Stop: "Stop",
+      Notification: null,
+      SessionStart: "SessionStart",
+      SessionEnd: null,
+      UserPromptSubmit: "UserPromptSubmit"
     }
   };
   getInstalledHooks = getRegisteredHooks;
@@ -4266,7 +4563,7 @@ var CREATE_HOOK_EVENTS_TABLE = `
     timestamp    TEXT NOT NULL,
     session_id   TEXT NOT NULL,
     hook_name    TEXT NOT NULL,
-    event_type   TEXT NOT NULL CHECK (event_type IN ('PreToolUse', 'PostToolUse', 'Stop', 'Notification')),
+    event_type   TEXT NOT NULL CHECK (event_type IN ('PreToolUse', 'PostToolUse', 'Stop', 'Notification', 'SessionStart', 'SessionEnd', 'UserPromptSubmit')),
     tool_name    TEXT,
     tool_input   TEXT,
     result       TEXT CHECK (result IN ('continue', 'block', NULL)),
@@ -4297,6 +4594,64 @@ var init_001_initial = __esm(() => {
   init_schema();
 });
 
+// src/db/migrations/002_session_events.ts
+function up2(db) {
+  const row = db.query("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?").get("hook_events");
+  if (!row?.sql)
+    return;
+  if (row.sql.includes("SessionStart"))
+    return;
+  db.exec("BEGIN");
+  try {
+    db.exec("ALTER TABLE hook_events RENAME TO hook_events_old");
+    db.exec(CREATE_HOOK_EVENTS_TABLE);
+    db.exec(`INSERT INTO hook_events
+         (id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata)
+       SELECT id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata
+       FROM hook_events_old`);
+    db.exec("DROP TABLE hook_events_old");
+    for (const idx of CREATE_INDEXES) {
+      db.exec(idx);
+    }
+    db.exec("COMMIT");
+  } catch (err) {
+    db.exec("ROLLBACK");
+    throw err;
+  }
+}
+var init_002_session_events = __esm(() => {
+  init_schema();
+});
+
+// src/db/migrations/003_user_prompt_submit_event.ts
+function up3(db) {
+  const row = db.query("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?").get("hook_events");
+  if (!row?.sql)
+    return;
+  if (row.sql.includes("UserPromptSubmit"))
+    return;
+  db.exec("BEGIN");
+  try {
+    db.exec("ALTER TABLE hook_events RENAME TO hook_events_old");
+    db.exec(CREATE_HOOK_EVENTS_TABLE);
+    db.exec(`INSERT INTO hook_events
+         (id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata)
+       SELECT id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata
+       FROM hook_events_old`);
+    db.exec("DROP TABLE hook_events_old");
+    for (const idx of CREATE_INDEXES) {
+      db.exec(idx);
+    }
+    db.exec("COMMIT");
+  } catch (err) {
+    db.exec("ROLLBACK");
+    throw err;
+  }
+}
+var init_003_user_prompt_submit_event = __esm(() => {
+  init_schema();
+});
+
 // src/db/migrations/index.ts
 function ensureMigrationsTable(db) {
   db.exec(`
@@ -4326,7 +4681,13 @@ function runMigrations(db) {
 var MIGRATIONS;
 var init_migrations = __esm(() => {
   init_001_initial();
-  MIGRATIONS = [{ version: "001_initial", up }];
+  init_002_session_events();
+  init_003_user_prompt_submit_event();
+  MIGRATIONS = [
+    { version: "001_initial", up },
+    { version: "002_session_events", up: up2 },
+    { version: "003_user_prompt_submit_event", up: up3 }
+  ];
 });
 
 // src/db/legacy-import.ts
@@ -4538,6 +4899,396 @@ var init_db = __esm(() => {
   init_legacy_import();
 });
 
+// src/db/pg-migrations.ts
+var PG_MIGRATIONS;
+var init_pg_migrations = __esm(() => {
+  PG_MIGRATIONS = [
+    `CREATE TABLE IF NOT EXISTS hook_events (
+    id           TEXT PRIMARY KEY,
+    timestamp    TEXT NOT NULL,
+    session_id   TEXT NOT NULL,
+    hook_name    TEXT NOT NULL,
+    event_type   TEXT NOT NULL CHECK (event_type IN ('PreToolUse', 'PostToolUse', 'Stop', 'Notification', 'SessionStart', 'SessionEnd', 'UserPromptSubmit')),
+    tool_name    TEXT,
+    tool_input   TEXT,
+    result       TEXT CHECK (result IN ('continue', 'block', NULL)),
+    error        TEXT,
+    duration_ms  INTEGER,
+    project_dir  TEXT,
+    metadata     TEXT
+  )`,
+    `CREATE INDEX IF NOT EXISTS idx_hook_events_timestamp  ON hook_events (timestamp)`,
+    `CREATE INDEX IF NOT EXISTS idx_hook_events_session_id ON hook_events (session_id)`,
+    `CREATE INDEX IF NOT EXISTS idx_hook_events_hook_name  ON hook_events (hook_name)`,
+    `CREATE INDEX IF NOT EXISTS idx_hook_events_event_type ON hook_events (event_type)`,
+    `CREATE INDEX IF NOT EXISTS idx_hook_events_errors     ON hook_events (timestamp) WHERE error IS NOT NULL`,
+    `CREATE TABLE IF NOT EXISTS schema_migrations (
+    version    TEXT PRIMARY KEY,
+    applied_at TEXT NOT NULL
+  )`,
+    `CREATE TABLE IF NOT EXISTS _meta (
+    key   TEXT PRIMARY KEY,
+    value TEXT NOT NULL
+  )`,
+    `CREATE TABLE IF NOT EXISTS feedback (
+    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+    message TEXT NOT NULL,
+    email TEXT,
+    category TEXT DEFAULT 'general',
+    version TEXT,
+    machine_id TEXT,
+    created_at TEXT NOT NULL DEFAULT NOW()::text
+  )`,
+    `ALTER TABLE hook_events DROP CONSTRAINT IF EXISTS hook_events_event_type_check`,
+    `ALTER TABLE hook_events ADD CONSTRAINT hook_events_event_type_check
+    CHECK (event_type IN ('PreToolUse', 'PostToolUse', 'Stop', 'Notification', 'SessionStart', 'SessionEnd', 'UserPromptSubmit'))`
+  ];
+});
+
+// src/db/remote-storage.ts
+import pg from "pg";
+function translatePlaceholders(sql) {
+  let index = 0;
+  return sql.replace(/\?/g, () => `$${++index}`);
+}
+function normalizeParams(params) {
+  const flat = params.length === 1 && Array.isArray(params[0]) ? params[0] : params;
+  return flat.map((value) => value === undefined ? null : value);
+}
+function sslConfigFor(connectionString) {
+  return connectionString.includes("sslmode=require") || connectionString.includes("ssl=true") ? { rejectUnauthorized: false } : undefined;
+}
+
+class PgAdapterAsync {
+  pool;
+  constructor(connectionString) {
+    this.pool = new pg.Pool({ connectionString, ssl: sslConfigFor(connectionString) });
+  }
+  async run(sql, ...params) {
+    const result = await this.pool.query(translatePlaceholders(sql), normalizeParams(params));
+    return { changes: result.rowCount ?? 0 };
+  }
+  async all(sql, ...params) {
+    const result = await this.pool.query(translatePlaceholders(sql), normalizeParams(params));
+    return result.rows;
+  }
+  async close() {
+    await this.pool.end();
+  }
+}
+var init_remote_storage = () => {};
+
+// src/db/storage-sync.ts
+function readEnv(name) {
+  const value = process.env[name]?.trim();
+  return value || undefined;
+}
+function normalizeStorageMode(value) {
+  const normalized = value?.trim().toLowerCase();
+  if (normalized === "local" || normalized === "hybrid" || normalized === "remote")
+    return normalized;
+  return;
+}
+function getStorageDatabaseEnvName() {
+  for (const name of STORAGE_DATABASE_ENV) {
+    if (readEnv(name))
+      return name;
+  }
+  return null;
+}
+function getStorageDatabaseEnv() {
+  const name = getStorageDatabaseEnvName();
+  return name ? { name } : null;
+}
+function getStorageDatabaseUrl() {
+  const env = getStorageDatabaseEnv();
+  return env ? readEnv(env.name) ?? null : null;
+}
+function getStorageMode() {
+  const mode = normalizeStorageMode(readEnv(HOOKS_STORAGE_MODE_ENV)) ?? normalizeStorageMode(readEnv(HOOKS_STORAGE_MODE_FALLBACK_ENV));
+  if (mode)
+    return mode;
+  return getStorageDatabaseUrl() ? "hybrid" : "local";
+}
+async function getStoragePg() {
+  const url = getStorageDatabaseUrl();
+  if (!url) {
+    throw new Error("Missing HASNA_HOOKS_DATABASE_URL or HOOKS_DATABASE_URL");
+  }
+  return new PgAdapterAsync(url);
+}
+async function runStorageMigrations(remote) {
+  await remote.run("CREATE EXTENSION IF NOT EXISTS pgcrypto");
+  for (const sql of PG_MIGRATIONS)
+    await remote.run(sql);
+}
+async function storagePush(options) {
+  const remote = await getStoragePg();
+  const db = getDb();
+  try {
+    await runStorageMigrations(remote);
+    const results = [];
+    for (const table of resolveTables(options?.tables)) {
+      results.push(await pushTable(db, remote, table));
+    }
+    recordSyncMeta(db, "push", results);
+    return results;
+  } finally {
+    await remote.close();
+  }
+}
+async function storagePull(options) {
+  const remote = await getStoragePg();
+  const db = getDb();
+  try {
+    await runStorageMigrations(remote);
+    const results = [];
+    for (const table of resolveTables(options?.tables)) {
+      results.push(await pullTable(remote, db, table));
+    }
+    recordSyncMeta(db, "pull", results);
+    return results;
+  } finally {
+    await remote.close();
+  }
+}
+async function storageSync(options) {
+  const pull = await storagePull(options);
+  const push = await storagePush(options);
+  return { pull, push };
+}
+function getSyncMetaAll() {
+  const db = getDb();
+  ensureSyncMetaTable(db);
+  return db.query("SELECT table_name, last_synced_at, direction FROM _hooks_sync_meta ORDER BY table_name, direction").all();
+}
+function getStorageStatus() {
+  const activeEnv = getStorageDatabaseEnv();
+  return {
+    configured: Boolean(activeEnv),
+    mode: getStorageMode(),
+    env: STORAGE_DATABASE_ENV,
+    activeEnv: activeEnv?.name ?? null,
+    service: "hooks",
+    tables: STORAGE_TABLES,
+    sync: getSyncMetaAll()
+  };
+}
+function resolveTables(tables) {
+  if (!tables || tables.length === 0)
+    return [...STORAGE_TABLES];
+  const allowed = new Set(STORAGE_TABLES);
+  const requested = tables.map((table) => table.trim()).filter(Boolean);
+  const invalid = requested.filter((table) => !allowed.has(table));
+  if (invalid.length > 0)
+    throw new Error(`Unknown hooks sync table(s): ${invalid.join(", ")}`);
+  return requested;
+}
+function parseStorageTables(value) {
+  if (!value)
+    return;
+  return resolveTables(Array.isArray(value) ? value : value.split(","));
+}
+async function pushTable(db, remote, table) {
+  const result = { table, rowsRead: 0, rowsWritten: 0, errors: [] };
+  try {
+    if (!tableExists(db, table))
+      return result;
+    const rows = db.query(`SELECT * FROM ${quoteIdent(table)}`).all();
+    result.rowsRead = rows.length;
+    if (rows.length === 0)
+      return result;
+    const remoteColumns = await getRemoteColumns(remote, table);
+    const columns = filterRemoteColumns(remoteColumns, Object.keys(rows[0]));
+    result.rowsWritten = await upsertPg(remote, table, columns, rows, remoteColumns);
+  } catch (error) {
+    result.errors.push(error instanceof Error ? error.message : String(error));
+  }
+  return result;
+}
+async function pullTable(remote, db, table) {
+  const result = { table, rowsRead: 0, rowsWritten: 0, errors: [] };
+  try {
+    if (!tableExists(db, table))
+      return result;
+    const rows = await remote.all(`SELECT * FROM ${quoteIdent(table)}`);
+    result.rowsRead = rows.length;
+    if (rows.length === 0)
+      return result;
+    const columns = filterLocalColumns(db, table, Object.keys(rows[0]));
+    result.rowsWritten = upsertSqlite(db, table, columns, rows);
+  } catch (error) {
+    result.errors.push(error instanceof Error ? error.message : String(error));
+  }
+  return result;
+}
+async function getRemoteColumns(remote, table) {
+  const rows = await remote.all("SELECT column_name, data_type FROM information_schema.columns WHERE table_schema = 'public' AND table_name = ?", table);
+  return new Map(rows.map((row) => [row.column_name, row.data_type]));
+}
+function filterRemoteColumns(remoteColumns, columns) {
+  if (remoteColumns.size === 0)
+    return columns;
+  return columns.filter((column) => remoteColumns.has(column));
+}
+function filterLocalColumns(db, table, columns) {
+  const rows = db.query(`PRAGMA table_info(${quoteIdent(table)})`).all();
+  const allowed = new Set(rows.map((row) => row.name));
+  return columns.filter((column) => allowed.has(column));
+}
+async function upsertPg(remote, table, columns, rows, remoteColumns) {
+  if (columns.length === 0)
+    return 0;
+  const primaryKeys = PRIMARY_KEYS[table];
+  const columnList = columns.map(quoteIdent).join(", ");
+  const placeholders = columns.map(() => "?").join(", ");
+  const keyList = primaryKeys.map(quoteIdent).join(", ");
+  const updateColumns = columns.filter((column) => !primaryKeys.includes(column));
+  const fallbackKey = primaryKeys[0];
+  const setClause = updateColumns.length > 0 ? updateColumns.map((column) => `${quoteIdent(column)} = EXCLUDED.${quoteIdent(column)}`).join(", ") : `${quoteIdent(fallbackKey)} = EXCLUDED.${quoteIdent(fallbackKey)}`;
+  for (const row of rows) {
+    await remote.run(`INSERT INTO ${quoteIdent(table)} (${columnList}) VALUES (${placeholders})
+       ON CONFLICT (${keyList}) DO UPDATE SET ${setClause}`, ...columns.map((column) => coerceForPg(row[column], remoteColumns.get(column))));
+  }
+  return rows.length;
+}
+function upsertSqlite(db, table, columns, rows) {
+  if (columns.length === 0)
+    return 0;
+  const primaryKeys = PRIMARY_KEYS[table];
+  const columnList = columns.map(quoteIdent).join(", ");
+  const placeholders = columns.map(() => "?").join(", ");
+  const keyList = primaryKeys.map(quoteIdent).join(", ");
+  const updateColumns = columns.filter((column) => !primaryKeys.includes(column));
+  const fallbackKey = primaryKeys[0];
+  const setClause = updateColumns.length > 0 ? updateColumns.map((column) => `${quoteIdent(column)} = excluded.${quoteIdent(column)}`).join(", ") : `${quoteIdent(fallbackKey)} = excluded.${quoteIdent(fallbackKey)}`;
+  const statement = db.query(`INSERT INTO ${quoteIdent(table)} (${columnList}) VALUES (${placeholders})
+     ON CONFLICT (${keyList}) DO UPDATE SET ${setClause}`);
+  const insert = db.transaction((batch) => {
+    for (const row of batch)
+      statement.run(...columns.map((column) => coerceForSqlite(row[column])));
+  });
+  insert(rows);
+  return rows.length;
+}
+function recordSyncMeta(db, direction, results) {
+  ensureSyncMetaTable(db);
+  const now2 = new Date().toISOString();
+  const statement = db.query(`
+    INSERT INTO _hooks_sync_meta (table_name, last_synced_at, direction)
+    VALUES (?, ?, ?)
+    ON CONFLICT(table_name, direction) DO UPDATE SET last_synced_at = excluded.last_synced_at
+  `);
+  for (const result of results) {
+    if (result.errors.length > 0)
+      continue;
+    statement.run(result.table, now2, direction);
+  }
+}
+function ensureSyncMetaTable(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS _hooks_sync_meta (
+      table_name TEXT NOT NULL,
+      last_synced_at TEXT,
+      direction TEXT NOT NULL CHECK(direction IN ('push', 'pull')),
+      PRIMARY KEY (table_name, direction)
+    )
+  `);
+}
+function tableExists(db, table) {
+  const row = db.query("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?").get(table);
+  return Boolean(row);
+}
+function quoteIdent(identifier) {
+  return `"${identifier.replace(/"/g, '""')}"`;
+}
+function coerceForPg(value, dataType) {
+  if (value === undefined || value === null)
+    return null;
+  if (dataType === "boolean") {
+    if (typeof value === "boolean")
+      return value;
+    if (typeof value === "number")
+      return value !== 0;
+    if (typeof value === "string")
+      return value === "1" || value.toLowerCase() === "true";
+  }
+  if (value instanceof Date)
+    return value.toISOString();
+  if (Buffer.isBuffer(value) || value instanceof Uint8Array)
+    return value;
+  if (typeof value === "object")
+    return JSON.stringify(value);
+  return value;
+}
+function coerceForSqlite(value) {
+  if (value === undefined || value === null)
+    return null;
+  if (typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean")
+    return value;
+  if (value instanceof Date)
+    return value.toISOString();
+  if (Buffer.isBuffer(value) || value instanceof Uint8Array)
+    return value;
+  if (typeof value === "object")
+    return JSON.stringify(value);
+  return String(value);
+}
+var STORAGE_TABLES, HOOKS_STORAGE_TABLES, HOOKS_STORAGE_ENV = "HASNA_HOOKS_DATABASE_URL", HOOKS_STORAGE_FALLBACK_ENV = "HOOKS_DATABASE_URL", HOOKS_STORAGE_MODE_ENV = "HASNA_HOOKS_STORAGE_MODE", HOOKS_STORAGE_MODE_FALLBACK_ENV = "HOOKS_STORAGE_MODE", STORAGE_DATABASE_ENV, STORAGE_MODE_ENV, PRIMARY_KEYS;
+var init_storage_sync = __esm(() => {
+  init_db();
+  init_pg_migrations();
+  init_remote_storage();
+  STORAGE_TABLES = [
+    "hook_events",
+    "schema_migrations",
+    "_meta",
+    "feedback"
+  ];
+  HOOKS_STORAGE_TABLES = STORAGE_TABLES;
+  STORAGE_DATABASE_ENV = [HOOKS_STORAGE_ENV, HOOKS_STORAGE_FALLBACK_ENV];
+  STORAGE_MODE_ENV = [HOOKS_STORAGE_MODE_ENV, HOOKS_STORAGE_MODE_FALLBACK_ENV];
+  PRIMARY_KEYS = {
+    hook_events: ["id"],
+    schema_migrations: ["version"],
+    _meta: ["key"],
+    feedback: ["id"]
+  };
+});
+
+// src/storage.ts
+var exports_storage = {};
+__export(exports_storage, {
+  storageSync: () => storageSync,
+  storagePush: () => storagePush,
+  storagePull: () => storagePull,
+  runStorageMigrations: () => runStorageMigrations,
+  resolveTables: () => resolveTables,
+  parseStorageTables: () => parseStorageTables,
+  getSyncMetaAll: () => getSyncMetaAll,
+  getStorageStatus: () => getStorageStatus,
+  getStoragePg: () => getStoragePg,
+  getStorageMode: () => getStorageMode,
+  getStorageDatabaseUrl: () => getStorageDatabaseUrl,
+  getStorageDatabaseEnvName: () => getStorageDatabaseEnvName,
+  getStorageDatabaseEnv: () => getStorageDatabaseEnv,
+  STORAGE_TABLES: () => STORAGE_TABLES,
+  STORAGE_MODE_ENV: () => STORAGE_MODE_ENV,
+  STORAGE_DATABASE_ENV: () => STORAGE_DATABASE_ENV,
+  PgAdapterAsync: () => PgAdapterAsync,
+  PG_MIGRATIONS: () => PG_MIGRATIONS,
+  HOOKS_STORAGE_TABLES: () => HOOKS_STORAGE_TABLES,
+  HOOKS_STORAGE_MODE_FALLBACK_ENV: () => HOOKS_STORAGE_MODE_FALLBACK_ENV,
+  HOOKS_STORAGE_MODE_ENV: () => HOOKS_STORAGE_MODE_ENV,
+  HOOKS_STORAGE_FALLBACK_ENV: () => HOOKS_STORAGE_FALLBACK_ENV,
+  HOOKS_STORAGE_ENV: () => HOOKS_STORAGE_ENV
+});
+var init_storage = __esm(() => {
+  init_storage_sync();
+  init_remote_storage();
+  init_pg_migrations();
+});
+
 // src/mcp/server.ts
 var exports_server = {};
 __export(exports_server, {
@@ -4671,7 +5422,7 @@ function createHooksServer() {
           const settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
           const eventHooks = settings.hooks?.[meta.event] || [];
           const found = eventHooks.some((entry) => entry.hooks?.some((h) => {
-            const match = h.command?.match(/^hooks run (\w+)/);
+            const match = h.command?.match(/^hooks run ([\w-]+)/);
             return match && match[1] === name;
           }));
           if (!found) {
@@ -4714,8 +5465,10 @@ function createHooksServer() {
           events: {
             PreToolUse: "Fires before a tool executes. Can block the operation.",
             PostToolUse: "Fires after a tool executes. Runs asynchronously.",
-            Stop: "Fires when a session ends. Useful for notifications.",
-            Notification: "Fires on notification events like context compaction."
+            Stop: "Fires when the agent finishes responding. Useful for notifications.",
+            Notification: "Fires on notification events like context compaction.",
+            SessionStart: "Fires when a session starts or resumes. Can inject context.",
+            SessionEnd: "Fires when a session terminates. Useful for cleanup and final announcements."
           },
           commands: {
             install: "hooks install <name>",
@@ -5129,6 +5882,10 @@ function createHooksServer() {
       }]
     };
   });
+  server.tool("storage_status", "Show hooks storage sync configuration and local sync history.", {}, async () => ({ content: [{ type: "text", text: JSON.stringify(getStorageStatus()) }] }));
+  server.tool("storage_push", "Push local hook data to storage PostgreSQL.", { tables: z.array(z.string()).optional() }, async (params) => ({ content: [{ type: "text", text: JSON.stringify(await storagePush(params.tables ? { tables: params.tables } : undefined)) }] }));
+  server.tool("storage_pull", "Pull hook data from storage PostgreSQL to local SQLite.", { tables: z.array(z.string()).optional() }, async (params) => ({ content: [{ type: "text", text: JSON.stringify(await storagePull(params.tables ? { tables: params.tables } : undefined)) }] }));
+  server.tool("storage_sync", "Bidirectional hooks storage sync: pull then push.", { tables: z.array(z.string()).optional() }, async (params) => ({ content: [{ type: "text", text: JSON.stringify(await storageSync(params.tables ? { tables: params.tables } : undefined)) }] }));
   server.tool("send_feedback", "Send feedback about this service", {
     message: z.string(),
     email: z.string().optional(),
@@ -5236,6 +5993,7 @@ var init_server = __esm(() => {
   init_registry();
   init_installer();
   init_profiles();
+  init_storage();
   __dirname3 = dirname2(fileURLToPath2(import.meta.url));
   pkg = { name: "@hasna/hooks", version: "0.0.0" };
   try {
@@ -5326,29 +6084,83 @@ function getPathValue(input, path) {
     return;
   }, input);
 }
-function wildcardToRegExp(pattern) {
-  const escaped = pattern.replace(/[|\\{}()[\]^$+?.]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`);
+function getFieldValues(input, path) {
+  const values = [];
+  const push = (value) => {
+    if (!values.some((item) => Object.is(item, value)))
+      values.push(value);
+  };
+  if (path.includes(".") && path in input)
+    push(input[path]);
+  const nestedValue = getPathValue(input, path);
+  if (nestedValue !== undefined || !path.includes("."))
+    push(nestedValue);
+  return values;
 }
-function matchString(value, matcher) {
+function wildcardToRegExp(pattern, options = {}) {
+  let body = "";
+  for (let index = 0;index < pattern.length; index += 1) {
+    const char = pattern[index];
+    if (char === "*") {
+      if (pattern[index + 1] === "*") {
+        body += ".*";
+        index += 1;
+      } else {
+        body += options.segmentSafe ? "[^/]*" : ".*";
+      }
+    } else {
+      body += char.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${body}$`);
+}
+function matchString(value, matcher, options = {}) {
   if (matcher === undefined)
     return true;
   if (value === undefined)
     return false;
   const matchers = Array.isArray(matcher) ? matcher : [matcher];
-  return matchers.some((item) => wildcardToRegExp(item).test(value));
+  return matchers.some((item) => wildcardToRegExp(item, options).test(value));
 }
 function matchRecord(input, matcher) {
   if (!matcher)
     return true;
   return Object.entries(matcher).every(([path, expected]) => {
-    const actual = getPathValue(input, path);
-    if (typeof expected === "string" || Array.isArray(expected)) {
-      return matchString(actual === undefined ? undefined : String(actual), expected);
-    }
-    return actual === expected;
+    const actualValues = getFieldValues(input, path);
+    return matchField(actualValues, expected, path);
   });
 }
+function matchField(actualValues, expected, path) {
+  if (isNegativeMatcher(expected)) {
+    return !actualValues.some((actual) => matchPositiveField(actual, expected.not, path));
+  }
+  return actualValues.some((actual) => matchPositiveField(actual, expected, path));
+}
+function matchPositiveField(actual, expected, path) {
+  if (typeof expected === "string" || Array.isArray(expected)) {
+    return stringCandidates(actual).some((candidate) => matchString(candidate, expected, {
+      segmentSafe: path.endsWith("_path") || path.endsWith(".path")
+    }));
+  }
+  if (Array.isArray(actual)) {
+    return actual.some((item) => item === expected);
+  }
+  return actual === expected;
+}
+function stringCandidates(actual) {
+  if (actual === undefined)
+    return [];
+  if (Array.isArray(actual)) {
+    return actual.flatMap((item) => isPrimitiveFieldValue(item) ? [String(item)] : []);
+  }
+  return [String(actual)];
+}
+function isPrimitiveFieldValue(value) {
+  return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function isNegativeMatcher(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value) && "not" in value);
+}
 function eventMatchesFilter(event, filter) {
   return matchString(event.source, filter.source) && matchString(event.type, filter.type) && matchString(event.subject, filter.subject) && matchString(event.severity, filter.severity) && matchRecord(event.data, filter.data) && matchRecord(event.metadata, filter.metadata);
 }
@@ -5364,6 +6176,13 @@ var HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME";
 function getEventsDataDir(override) {
   return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join(homedir(), ".hasna", "events");
 }
+function getActiveEventsDirEnv() {
+  if (process.env[HASNA_EVENTS_DIR_ENV])
+    return HASNA_EVENTS_DIR_ENV;
+  if (process.env[HASNA_EVENTS_HOME_ENV])
+    return HASNA_EVENTS_HOME_ENV;
+  return null;
+}
 
 class JsonEventsStore {
   dataDir;
@@ -5476,6 +6295,52 @@ class JsonEventsStore {
     });
   }
 }
+async function getEventsStatus(dataDir) {
+  const store = new JsonEventsStore(dataDir);
+  await store.init();
+  const [channels, events, deliveries] = await Promise.all([
+    store.listChannels(),
+    store.listEvents(),
+    store.listDeliveries()
+  ]);
+  const transports = channels.reduce((counts, channel) => {
+    counts[channel.transport] = (counts[channel.transport] ?? 0) + 1;
+    return counts;
+  }, {});
+  return {
+    service: "events",
+    schemaVersion: "1.0",
+    dataDir: store.dataDir,
+    env: {
+      primary: HASNA_EVENTS_DIR_ENV,
+      fallback: HASNA_EVENTS_HOME_ENV,
+      active: getActiveEventsDirEnv()
+    },
+    files: {
+      channels: statusFile(store.dataDir, "channels.json", channels.length),
+      events: statusFile(store.dataDir, "events.json", events.length),
+      deliveries: statusFile(store.dataDir, "deliveries.json", deliveries.length)
+    },
+    counts: {
+      channels: channels.length,
+      enabledChannels: channels.filter((channel) => channel.enabled).length,
+      disabledChannels: channels.filter((channel) => !channel.enabled).length,
+      events: events.length,
+      deliveries: deliveries.length
+    },
+    transports,
+    safety: {
+      includesEventPayloads: false,
+      includesWebhookSecrets: false,
+      listOutputsRedactSecrets: true,
+      statusOutputIsMetadataOnly: true
+    }
+  };
+}
+function statusFile(dataDir, fileName, records) {
+  const path = join(dataDir, fileName);
+  return { path, exists: existsSync(path), records };
+}
 var DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
 function buildSignatureBase(timestamp, body) {
   return `${timestamp}.${body}`;
@@ -5701,7 +6566,7 @@ class EventsClient {
     }
     return deliveries;
   }
-  async testChannel(id, input = {}) {
+  async matchChannel(id, input = {}) {
     const channel = await this.store.getChannel(id);
     if (!channel)
       throw new Error(`Channel not found: ${id}`);
@@ -5718,6 +6583,34 @@ class EventsClient {
       time: input.time,
       id: input.id
     });
+    const matched = channelMatchesEvent(channel, event);
+    return {
+      channelId: channel.id,
+      matched,
+      event,
+      filters: channel.filters,
+      reason: matched ? undefined : channel.enabled ? "event did not match channel filters" : "channel is disabled"
+    };
+  }
+  async testChannel(id, input = {}, options = {}) {
+    const channel = await this.store.getChannel(id);
+    if (!channel)
+      throw new Error(`Channel not found: ${id}`);
+    const match = await this.matchChannel(id, input);
+    const event = match.event;
+    if (options.honorFilters && !match.matched) {
+      const timestamp = new Date().toISOString();
+      const result2 = createDeliveryResult(event, channel, [{
+        attempt: 1,
+        status: "skipped",
+        startedAt: timestamp,
+        completedAt: timestamp,
+        error: match.reason
+      }]);
+      result2.metadata = { reason: "filter_mismatch" };
+      await this.store.appendDelivery(result2);
+      return result2;
+    }
     const eventForChannel = await this.applyRedaction(event, channel);
     const result = await this.deliverWithRetry(eventForChannel, channel);
     await this.store.appendDelivery(result);
@@ -5828,6 +6721,76 @@ function normalizeRetryPolicy(policy) {
     multiplier: Math.max(1, policy?.multiplier ?? 2)
   };
 }
+function parseFieldMatchers(values, label, typed = false) {
+  if (!values?.length)
+    return;
+  const result = {};
+  for (const value of values) {
+    const parsed = parseMatcherExpression(value, label);
+    const path = parsed.path;
+    if (path in result)
+      throw new Error(`Duplicate ${label} filter path: ${path}`);
+    const matcherValue = typed ? parseTypedMatcherValue(parsed.rawValue, label) : parsed.rawValue;
+    result[path] = parsed.negated ? { not: matcherValue } : matcherValue;
+  }
+  return result;
+}
+function parseFilterOptions(options) {
+  const filter2 = {};
+  if (options.source)
+    filter2.source = options.source;
+  if (options.type)
+    filter2.type = options.type;
+  if (options.subject)
+    filter2.subject = options.subject;
+  if (options.severity)
+    filter2.severity = options.severity;
+  const data = mergeMatchers(parseFieldMatchers(options.data, "data"), parseFieldMatchers(options.dataJson, "data-json", true));
+  const metadata = mergeMatchers(parseFieldMatchers(options.metadata, "metadata"), parseFieldMatchers(options.metadataJson, "metadata-json", true));
+  if (Object.keys(data).length > 0)
+    filter2.data = data;
+  if (Object.keys(metadata).length > 0)
+    filter2.metadata = metadata;
+  return Object.keys(filter2).length > 0 ? [filter2] : undefined;
+}
+function mergeMatchers(...records) {
+  const result = {};
+  for (const record of records) {
+    if (!record)
+      continue;
+    for (const [path, value] of Object.entries(record)) {
+      if (path in result)
+        throw new Error(`Duplicate filter path: ${path}`);
+      result[path] = value;
+    }
+  }
+  return result;
+}
+function parseTypedMatcherValue(value, label) {
+  const parsed = JSON.parse(value);
+  if (parsed === null || typeof parsed === "string" || typeof parsed === "number" || typeof parsed === "boolean" || Array.isArray(parsed) && parsed.every((item) => typeof item === "string")) {
+    return parsed;
+  }
+  throw new Error(`${label} filter JSON values must be string, string[], number, boolean, or null`);
+}
+function parseMatcherExpression(value, label) {
+  const negativeSeparator = value.indexOf("!=");
+  if (negativeSeparator > 0) {
+    return {
+      path: value.slice(0, negativeSeparator),
+      rawValue: value.slice(negativeSeparator + 2),
+      negated: true
+    };
+  }
+  const separator = value.indexOf("=");
+  if (separator <= 0)
+    throw new Error(`Invalid ${label} filter, expected path=value or path!=value: ${value}`);
+  return {
+    path: value.slice(0, separator),
+    rawValue: value.slice(separator + 1),
+    negated: false
+  };
+}
 function parseJsonObject(value, fallback) {
   if (!value)
     return fallback;
@@ -5849,18 +6812,6 @@ function parseHeaders(values) {
   }
   return headers;
 }
-function parseFilter(options) {
-  const filter2 = {};
-  if (options.source)
-    filter2.source = options.source;
-  if (options.type)
-    filter2.type = options.type;
-  if (options.subject)
-    filter2.subject = options.subject;
-  if (options.severity)
-    filter2.severity = options.severity;
-  return Object.keys(filter2).length > 0 ? [filter2] : undefined;
-}
 function createClient(options) {
   if (options.createClient)
     return options.createClient();
@@ -5878,16 +6829,16 @@ function hasJsonOption(options) {
 function wantsJson(actionOptions, command) {
   return hasJsonOption(actionOptions) || hasJsonOption(command);
 }
-function registerWebhookCommands(program, options) {
-  const webhooks = program.command(options.webhooksCommandName ?? "webhooks").description("Manage Hasna event webhook subscriptions");
-  webhooks.command("add").description("Add or replace a webhook or command subscription").argument("<target>", "Webhook URL or command binary").requiredOption("--id <id>", "Subscription/channel identifier").option("--transport <kind>", "Transport kind: webhook or command", "webhook").option("--name <name>", "Display name").option("--type <pattern>", "Event type filter, e.g. todos.task.*").option("--source <pattern>", "Event source filter").option("--subject <pattern>", "Event subject filter").option("--severity <pattern>", "Event severity filter").option("--secret <secret>", "Webhook HMAC secret").option("--header <name=value...>", "Webhook header", collectValues, []).option("--arg <arg...>", "Command argument", collectValues, []).option("--timeout-ms <ms>", "Transport timeout in milliseconds", parseNumber).option("--retry-attempts <n>", "Maximum delivery attempts", parseNumber).option("--retry-backoff-ms <ms>", "Initial retry backoff in milliseconds", parseNumber).option("--redact <path...>", "Event field path to redact before delivery", collectValues, []).option("--disabled", "Create channel disabled", false).option("-j, --json", "Print JSON output", false).action(async (target, actionOptions, command) => {
+function registerChannelCommands(program, options) {
+  const channels = program.command(options.channelsCommandName ?? "channels").description("Manage Hasna event channels");
+  channels.command("add").description("Add or replace a channel").argument("<target>", "Webhook URL or command binary").requiredOption("--id <id>", "Channel identifier").option("--transport <kind>", "Transport kind: webhook or command", "webhook").option("--name <name>", "Display name").option("--type <pattern>", "Event type filter, e.g. todos.task.*").option("--source <pattern>", "Event source filter").option("--subject <pattern>", "Event subject filter").option("--severity <pattern>", "Event severity filter").option("--data <path=value...>", "Event data field filter; string values, path!=value negatives, array-member matching, dot paths, * segment wildcard, ** recursive wildcard", collectValues, []).option("--metadata <path=value...>", "Event metadata field filter; string values, path!=value negatives, array-member matching, dot paths, * segment wildcard, ** recursive wildcard", collectValues, []).option("--data-json <path=json...>", "Event data field filter with typed JSON value; path!=json negatives supported", collectValues, []).option("--metadata-json <path=json...>", "Event metadata field filter with typed JSON value; path!=json negatives supported", collectValues, []).option("--secret <secret>", "Webhook HMAC secret").option("--header <name=value...>", "Webhook header", collectValues, []).option("--arg <arg...>", "Command argument", collectValues, []).option("--timeout-ms <ms>", "Transport timeout in milliseconds", parseNumber).option("--retry-attempts <n>", "Maximum delivery attempts", parseNumber).option("--retry-backoff-ms <ms>", "Initial retry backoff in milliseconds", parseNumber).option("--redact <path...>", "Event field path to redact before delivery", collectValues, []).option("--disabled", "Create channel disabled", false).option("-j, --json", "Print JSON output", false).action(async (target, actionOptions, command) => {
     const timestamp = new Date().toISOString();
     const channel = {
       id: actionOptions.id,
       name: actionOptions.name,
       enabled: !actionOptions.disabled,
       transport: actionOptions.transport,
-      filters: parseFilter(actionOptions),
+      filters: parseFilterOptions(actionOptions),
       retry: actionOptions.retryAttempts || actionOptions.retryBackoffMs ? { maxAttempts: actionOptions.retryAttempts, backoffMs: actionOptions.retryBackoffMs } : undefined,
       redact: actionOptions.redact?.length ? { paths: actionOptions.redact } : undefined,
       createdAt: timestamp,
@@ -5903,35 +6854,51 @@ function registerWebhookCommands(program, options) {
     const saved = await createClient(options).addChannel(channel);
     print(sanitizeChannelForOutput(saved), wantsJson(actionOptions, command), `Added ${saved.transport} channel ${saved.id}`);
   });
-  webhooks.command("list").description("List configured subscriptions").option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
-    const channels = await createClient(options).listChannels();
+  channels.command("list").description("List configured channels").option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
+    const channels2 = await createClient(options).listChannels();
     if (wantsJson(actionOptions, command)) {
-      console.log(JSON.stringify(sanitizeChannelsForOutput(channels), null, 2));
+      console.log(JSON.stringify(sanitizeChannelsForOutput(channels2), null, 2));
       return;
     }
-    if (!channels.length) {
+    if (!channels2.length) {
       console.log("No channels configured.");
       return;
     }
-    for (const channel of channels) {
+    for (const channel of channels2) {
       console.log(`${channel.id}	${channel.enabled ? "enabled" : "disabled"}	${channel.transport}	${channel.webhook?.url ?? channel.command?.command ?? channel.transport}`);
     }
   });
-  webhooks.command("remove").description("Remove a subscription").argument("<id>", "Subscription/channel identifier").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
+  channels.command("status").description("Show events channel storage status").option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
+    const status = await getEventsStatus(options.dataDir);
+    print(status, wantsJson(actionOptions, command), `events dataDir: ${status.dataDir}`);
+  });
+  channels.command("remove").description("Remove a channel").argument("<id>", "Channel identifier").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
     const removed = await createClient(options).removeChannel(id);
     print({ removed }, wantsJson(actionOptions, command), removed ? `Removed ${id}` : `Channel not found: ${id}`);
   });
-  webhooks.command("test").description("Send a test event to one subscription").argument("<id>", "Subscription/channel identifier").option("--type <type>", "Event type", "events.test").option("--subject <subject>", "Event subject").option("--message <message>", "Event message", "Hasna events test delivery").option("--data <json>", "Event data JSON object").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
+  channels.command("test").description("Send a test event to one channel").argument("<id>", "Channel identifier").option("--source <source>", "Event source override").option("--type <type>", "Event type", "events.test").option("--subject <subject>", "Event subject").option("--message <message>", "Event message", "Hasna events test delivery").option("--data <json>", "Event data JSON object").option("--metadata <json>", "Event metadata JSON object").option("--honor-filters", "Skip delivery when the sample event does not match channel filters", false).option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
     const result = await createClient(options).testChannel(id, {
-      source: options.source,
+      source: actionOptions.source ?? options.source,
       type: actionOptions.type,
       subject: actionOptions.subject ?? id,
       message: actionOptions.message,
-      data: parseJsonObject(actionOptions.data, { test: true })
-    });
+      data: parseJsonObject(actionOptions.data, { test: true }),
+      metadata: parseJsonObject(actionOptions.metadata, {})
+    }, { honorFilters: actionOptions.honorFilters });
     print(result, wantsJson(actionOptions, command), `${result.status}: ${result.channelId}`);
   });
-  return webhooks;
+  channels.command("match").description("Check whether a sample event matches one channel without delivering").argument("<id>", "Channel identifier").option("--source <source>", "Event source override").option("--type <type>", "Event type", "events.test").option("--subject <subject>", "Event subject").option("--message <message>", "Event message", "Hasna events match preview").option("--data <json>", "Event data JSON object").option("--metadata <json>", "Event metadata JSON object").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
+    const result = await createClient(options).matchChannel(id, {
+      source: actionOptions.source ?? options.source,
+      type: actionOptions.type,
+      subject: actionOptions.subject ?? id,
+      message: actionOptions.message,
+      data: parseJsonObject(actionOptions.data, { test: true }),
+      metadata: parseJsonObject(actionOptions.metadata, {})
+    });
+    print(result, wantsJson(actionOptions, command), `${result.matched ? "matched" : "skipped"}: ${result.channelId}`);
+  });
+  return channels;
 }
 function registerEventCommands(program, options) {
   const events = program.command(options.eventsCommandName ?? "events").description("Emit, list, and replay Hasna events");
@@ -5979,7 +6946,7 @@ function registerEventCommands(program, options) {
   return events;
 }
 function registerEventsCommands(program, options) {
-  registerWebhookCommands(program, options);
+  registerChannelCommands(program, options);
   registerEventCommands(program, options);
 }
 function parseNumber(value) {
@@ -7204,6 +8171,8 @@ function resolveScope(options) {
 function resolveTarget(options) {
   if (options.target === "gemini")
     return "gemini";
+  if (options.target === "codewith")
+    return "codewith";
   if (options.target === "all")
     return "all";
   return "claude";
@@ -7302,7 +8271,7 @@ program2.command("run").argument("<hook>", "Hook to run").option("--profile <id>
     process.stderr.write(stderr);
   process.exit(exitCode);
 });
-program2.command("install").alias("add").argument("[hooks...]", "Hooks to install").option("-o, --overwrite", "Overwrite existing hooks", false).option("-a, --all", "Install all available hooks", false).option("-c, --category <category>", "Install all hooks in a category").option("-g, --global", "Install globally (~/.claude/settings.json)", false).option("-p, --project", "Install for current project (.claude/settings.json)", false).option("-t, --target <target>", "Agent target: claude, gemini, all (default: claude)", "claude").option("--profile <id>", "Agent profile ID to scope hooks to").option("--dry-run", "Preview what would be installed without writing to settings", false).option("-j, --json", "Output as JSON", false).description("Install one or more hooks").action((hooks, options) => {
+program2.command("install").alias("add").argument("[hooks...]", "Hooks to install").option("-o, --overwrite", "Overwrite existing hooks", false).option("-a, --all", "Install all available hooks", false).option("-c, --category <category>", "Install all hooks in a category").option("-g, --global", "Install globally (~/.claude/settings.json)", false).option("-p, --project", "Install for current project (.claude/settings.json)", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith, all (default: claude)", "claude").option("--profile <id>", "Agent profile ID to scope hooks to").option("--dry-run", "Preview what would be installed without writing to settings", false).option("--apply-codewith", "Explicitly append Codewith TOML to a config file (prefer open-configs for managed configs)", false).option("--codewith-config <path>", "Explicit Codewith config path required with --apply-codewith").option("-j, --json", "Output as JSON", false).description("Install one or more hooks").action((hooks, options) => {
   const scope = resolveScope(options);
   const target = resolveTarget(options);
   let toInstall = hooks;
@@ -7325,11 +8294,20 @@ program2.command("install").alias("add").argument("[hooks...]", "Hooks to instal
     render(/* @__PURE__ */ jsxDEV8(App, {}, undefined, false, undefined, this));
     return;
   }
+  if (options.applyCodewith && (target === "codewith" || target === "all") && !options.codewithConfig) {
+    const message = "--apply-codewith requires --codewith-config <path>; refusing to write default ~/.codewith/config.toml.";
+    if (options.json) {
+      console.log(JSON.stringify({ error: message, scope, target, applied: false }));
+    } else {
+      console.log(chalk2.red(message));
+    }
+    return;
+  }
   if (options.dryRun) {
     const known = toInstall.filter((n) => getHook(n));
     const unknown = toInstall.filter((n) => !getHook(n));
     if (options.json) {
-      console.log(JSON.stringify({ dryRun: true, would_install: known, unknown, scope, target }));
+      console.log(JSON.stringify({ dryRun: true, would_install: known, unknown, scope, target, mode: target === "codewith" ? "fragment" : "write" }));
       return;
     }
     console.log(chalk2.bold(`
@@ -7356,21 +8334,30 @@ Dry run \u2014 would install (${scope}, ${target}):
       results.push({ hook: name, success: false, error: `Hook '${name}' not found${hint}` });
       continue;
     }
-    const result = installHook(name, { scope, overwrite: options.overwrite, target, profile: options.profile });
+    const result = installHook(name, {
+      scope,
+      overwrite: options.overwrite,
+      target,
+      profile: options.profile,
+      codewithMode: options.applyCodewith ? "write" : "fragment",
+      codewithConfigPath: options.codewithConfig
+    });
     results.push(result);
   }
   if (options.json) {
     console.log(JSON.stringify({
       installed: results.filter((r) => r.success).map((r) => r.hook),
       failed: results.filter((r) => !r.success).map((r) => ({ hook: r.hook, error: r.error })),
+      fragments: results.filter((r) => r.success && r.fragment).map((r) => ({ hook: r.hook, fragment: r.fragment, applied: r.applied, configPath: r.configPath, note: r.note })),
       total: results.length,
       success: results.filter((r) => r.success).length,
       scope,
-      target
+      target,
+      applied: results.some((r) => r.applied)
     }));
     return;
   }
-  const settingsFile = scope === "project" ? ".claude/settings.json" : "~/.claude/settings.json";
+  const settingsFile = target === "codewith" ? options.applyCodewith ? options.codewithConfig : "TOML fragment only (open-configs should apply)" : scope === "project" ? ".claude/settings.json" : "~/.claude/settings.json";
   console.log(chalk2.bold(`
 Installing hooks (${scope}, ${target})...
 `));
@@ -7384,6 +8371,14 @@ Installing hooks (${scope}, ${target})...
       if (result.conflict) {
         console.log(chalk2.yellow(`  \u26A0 Warning: ${result.conflict}`));
       }
+      if (result.fragment && target === "codewith") {
+        console.log(chalk2.dim("  Codewith TOML fragment:"));
+        console.log(chalk2.cyan(result.fragment.trimEnd().split(`
+`).map((line) => `    ${line}`).join(`
+`)));
+        if (result.note)
+          console.log(chalk2.yellow(`  \u26A0 ${result.note}`));
+      }
     } else {
       console.log(chalk2.red(`\u2717 ${result.hook}: ${result.error}`));
     }
@@ -7391,10 +8386,10 @@ Installing hooks (${scope}, ${target})...
   console.log(chalk2.dim(`
 Registered in ${settingsFile}`));
 });
-program2.command("list").alias("ls").option("-c, --category <category>", "Filter by category").option("-a, --all", "Show all available hooks", false).option("-i, --installed", "Show only installed hooks", false).option("-r, --registered", "Show registered hooks", false).option("-g, --global", "Check global settings", false).option("-p, --project", "Check project settings", false).option("-t, --target <target>", "Agent target: claude, gemini (default: claude)", "claude").option("-j, --json", "Output as JSON", false).description("List available or installed hooks").action((options) => {
+program2.command("list").alias("ls").option("-c, --category <category>", "Filter by category").option("-a, --all", "Show all available hooks", false).option("-i, --installed", "Show only installed hooks", false).option("-r, --registered", "Show registered hooks", false).option("-g, --global", "Check global settings", false).option("-p, --project", "Check project settings", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith (default: claude)", "claude").option("-j, --json", "Output as JSON", false).description("List available or installed hooks").action((options) => {
   const scope = resolveScope(options);
   if (options.registered || options.installed) {
-    const target = options.target === "gemini" ? "gemini" : "claude";
+    const target = options.target === "gemini" ? "gemini" : options.target === "codewith" ? "codewith" : "claude";
     const registered = getRegisteredHooksForTarget(scope, target);
     if (options.json) {
       console.log(JSON.stringify(registered.map((name) => {
@@ -7478,7 +8473,7 @@ Found ${results.length} hook(s):
     console.log(`    ${h.description}`);
   }
 });
-program2.command("remove").alias("rm").argument("<hook>", "Hook to remove").option("-g, --global", "Remove from global settings", false).option("-p, --project", "Remove from project settings", false).option("-t, --target <target>", "Agent target: claude, gemini, all (default: claude)", "claude").option("-j, --json", "Output as JSON", false).description("Remove an installed hook").action((hook, options) => {
+program2.command("remove").alias("rm").argument("<hook>", "Hook to remove").option("-g, --global", "Remove from global settings", false).option("-p, --project", "Remove from project settings", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith, all (default: claude)", "claude").option("-j, --json", "Output as JSON", false).description("Remove an installed hook").action((hook, options) => {
   const scope = resolveScope(options);
   const target = resolveTarget(options);
   if (!getHook(hook)) {
@@ -7589,7 +8584,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
         const settings = JSON.parse(readFileSync5(settingsPath, "utf-8"));
         const eventHooks = settings.hooks?.[meta.event] || [];
         const found = eventHooks.some((entry) => entry.hooks?.some((h) => {
-          const match = h.command?.match(/^hooks run (\w+)/);
+          const match = h.command?.match(/^hooks run ([\w-]+)/);
           return match && match[1] === name;
         }));
         if (!found) {
@@ -7720,14 +8715,18 @@ ${meta.displayName} v${meta.version}
   const generalDocs = {
     overview: "Hooks are scripts that run at specific points in an AI coding agent session. Install @hasna/hooks globally, then register hooks \u2014 no files are copied to your project.",
     events: {
+      SessionStart: "Fires when a session starts or resumes. Codewith can inject context via hookSpecificOutput.additionalContext.",
+      UserPromptSubmit: "Codewith-native event when a user prompt is submitted; can block obvious injection attempts.",
       PreToolUse: 'Fires before a tool executes. Can block the operation by returning { "decision": "block" }.',
       PostToolUse: "Fires after a tool executes. Runs asynchronously, cannot block.",
-      Stop: "Fires when a session ends. Useful for notifications and cleanup.",
-      Notification: "Fires on notification events like context compaction."
+      Stop: "Fires at turn end in Codewith and when other agents finish responding. Useful for notifications and cleanup.",
+      Notification: "Fires on notification events like context compaction.",
+      SessionEnd: "Fires when a session terminates. Useful for cleanup and final announcements."
     },
     installation: {
       global: "hooks install gitguard",
       project: "hooks install gitguard --project",
+      codewith: "hooks install session-start --target codewith  # emits TOML for open-configs to apply",
       category: 'hooks install --category "Git Safety"',
       all: "hooks install --all"
     },
@@ -7743,7 +8742,7 @@ ${meta.displayName} v${meta.version}
     },
     howItWorks: {
       install: "bun install -g @hasna/hooks",
-      register: "hooks install gitguard \u2192 writes to ~/.claude/settings.json",
+      register: "hooks install gitguard \u2192 writes to ~/.claude/settings.json; hooks install session-start --target codewith emits a TOML fragment",
       execution: "Agent runs 'hooks run gitguard' \u2192 executes hook from global package",
       noFileCopy: "No files are copied to your project. Hooks run from the global @hasna/hooks package."
     }
@@ -8050,6 +9049,80 @@ logCmd.command("clear").description("Delete hook event logs").option("--hook <na
   }
   console.log(chalk2.green(`\u2713 Cleared ${count} event(s).`));
 });
+var storageCmd = program2.command("storage").description("Sync local hook data with storage PostgreSQL");
+storageCmd.command("status").description("Show storage sync status").option("-j, --json", "Output as JSON", false).action(async (options) => {
+  const { getStorageStatus: getStorageStatus2 } = await Promise.resolve().then(() => (init_storage(), exports_storage));
+  const status = getStorageStatus2();
+  if (options.json) {
+    console.log(JSON.stringify(status, null, 2));
+    return;
+  }
+  console.log(chalk2.bold(`
+  Storage Status
+`));
+  console.log(`  Configured: ${status.configured ? chalk2.green(`yes (${status.activeEnv})`) : chalk2.red("no")}`);
+  console.log(`  Mode:       ${status.mode}`);
+  console.log(`  Tables:     ${status.tables.join(", ")}`);
+  console.log(`  Sync rows:  ${status.sync.length}`);
+});
+storageCmd.command("push").description("Push local hook data to storage PostgreSQL").option("-t, --tables <tables>", "Comma-separated table names").option("-j, --json", "Output as JSON", false).action(async (options) => {
+  try {
+    const { parseStorageTables: parseStorageTables2, storagePush: storagePush2 } = await Promise.resolve().then(() => (init_storage(), exports_storage));
+    const results = await storagePush2({ tables: parseStorageTables2(options.tables) });
+    if (options.json) {
+      console.log(JSON.stringify(results, null, 2));
+      return;
+    }
+    const written = results.reduce((sum, result) => sum + result.rowsWritten, 0);
+    console.log(chalk2.green(`\u2713 Pushed ${written} row(s)`));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (options.json)
+      console.log(JSON.stringify({ error: message }));
+    else
+      console.error(chalk2.red(`\u2717 ${message}`));
+    process.exitCode = 1;
+  }
+});
+storageCmd.command("pull").description("Pull hook data from storage PostgreSQL to local SQLite").option("-t, --tables <tables>", "Comma-separated table names").option("-j, --json", "Output as JSON", false).action(async (options) => {
+  try {
+    const { parseStorageTables: parseStorageTables2, storagePull: storagePull2 } = await Promise.resolve().then(() => (init_storage(), exports_storage));
+    const results = await storagePull2({ tables: parseStorageTables2(options.tables) });
+    if (options.json) {
+      console.log(JSON.stringify(results, null, 2));
+      return;
+    }
+    const written = results.reduce((sum, result) => sum + result.rowsWritten, 0);
+    console.log(chalk2.green(`\u2713 Pulled ${written} row(s)`));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (options.json)
+      console.log(JSON.stringify({ error: message }));
+    else
+      console.error(chalk2.red(`\u2717 ${message}`));
+    process.exitCode = 1;
+  }
+});
+storageCmd.command("sync").description("Bidirectional storage sync: pull then push").option("-t, --tables <tables>", "Comma-separated table names").option("-j, --json", "Output as JSON", false).action(async (options) => {
+  try {
+    const { parseStorageTables: parseStorageTables2, storageSync: storageSync2 } = await Promise.resolve().then(() => (init_storage(), exports_storage));
+    const result = await storageSync2({ tables: parseStorageTables2(options.tables) });
+    if (options.json) {
+      console.log(JSON.stringify(result, null, 2));
+      return;
+    }
+    const pulled = result.pull.reduce((sum, entry) => sum + entry.rowsWritten, 0);
+    const pushed = result.push.reduce((sum, entry) => sum + entry.rowsWritten, 0);
+    console.log(chalk2.green(`\u2713 Synced ${pulled} pulled row(s), ${pushed} pushed row(s)`));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (options.json)
+      console.log(JSON.stringify({ error: message }));
+    else
+      console.error(chalk2.red(`\u2717 ${message}`));
+    process.exitCode = 1;
+  }
+});
 program2.command("mcp").option("-s, --stdio", "Use stdio transport (one process per agent)", false).option("--sse", "Use legacy SSE transport (port 39427)", false).option("--http", "Use Streamable HTTP transport (explicit; this is also the default)", false).option("-p, --port <port>", "Port for HTTP/SSE transport (defaults to 8847 for HTTP, 39427 for SSE)").description("Start MCP server for AI agent integration (default: shared Streamable HTTP)").action(async (options) => {
   if (options.stdio) {
     const { startStdioServer: startStdioServer2 } = await Promise.resolve().then(() => (init_server(), exports_server));