@hasna/hooks 0.4.0 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/README.md +15 -4
  2. package/hooks/codewith-native-common.test.ts +1870 -13
  3. package/hooks/codewith-native-common.ts +2039 -61
  4. package/hooks/pre-bash/README.md +72 -2
  5. package/hooks/worktree-guard/README.md +53 -2
  6. package/hooks/worktree-guard/src/hook.ts +50 -8
  7. package/package.json +1 -1
package/README.md CHANGED
@@ -67,10 +67,21 @@ hooks install session-start prompt-guard pre-bash worktree-guard stop-sync knowl
67
67
  ```
68
68
 
69
69
  The scoped destructive-operation guard does not block every cleanup command. It
70
- blocks resolved shell/file-tool targets that threaten `~/.hasna`, configured
71
- workspace roots, Hasna division/scope roots, or active repo/worktree roots,
72
- including recursive `rm`, `rsync --delete`, destructive `find`, and destructive
73
- `git clean` / `git reset --hard` forms.
70
+ blocks resolved shell/file-tool targets that threaten `/` or a system root
71
+ (`/usr`, `/etc`, `/bin`, `/lib`, `/var`, `/boot`, `/home`, `/Users`, and the
72
+ other FHS and macOS equivalents), `~/.hasna`, configured workspace roots, Hasna
73
+ division/scope roots, or active repo/worktree roots, including recursive `rm`,
74
+ `rsync --delete`, destructive `find`, and destructive `git clean` / `git reset
75
+ --hard` forms.
76
+
77
+ It also blocks by *shape*: a destructive target containing a command
78
+ substitution or variable expansion immediately followed by `/` is checked as the
79
+ shell would render it if that expansion returned empty, so
80
+ `rm -rf "$(anything)"/*` and `rm -rf "$VAR"/*` are refused whatever the
81
+ expansion is. Wrapped forms (`bash -c`, `su -c`, `eval`, `ssh host '…'`) are
82
+ unwrapped first. See [`hooks/pre-bash/README.md`](hooks/pre-bash/README.md) for
83
+ the full rules, the deliberate exemptions (`${VAR:?}`, bare `"$(cmd)"` with no
84
+ trailing separator), and the recommended safe form.
74
85
 
75
86
  Apply that fragment through `open-configs` or the managed config renderer. A
76
87
  direct write path exists only for explicit local/test use: