@hasna/hooks 0.6.0 → 0.6.2

package/bin/index.js

@@ -1955,6 +1955,16 @@ var init_registry = __esm(() => {
       matcher: "^(Bash|Write|Edit|MultiEdit|NotebookEdit|apply_patch|ApplyPatch|functions\\.apply_patch|mcp__.*)$",
       tags: ["git", "worktree", "repos", "multi-agent", "safety", "dangerous-ops"]
     },
+    {
+      name: "workspace-repos-guard",
+      displayName: "Workspace Repos Guard",
+      description: "Blocks writes and deletes that break the ~/workspace/repos structure: writes to the repos root, top-level entry creation, non-org folders, and any delete under repos",
+      version: "0.1.0",
+      category: "Git Safety",
+      event: "PreToolUse",
+      matcher: "^(Bash|Write|Edit|MultiEdit|NotebookEdit|apply_patch|ApplyPatch|functions\\.apply_patch)$",
+      tags: ["workspace", "repos", "structure", "guard", "safety", "orgs", "multi-agent"]
+    },
     {
       name: "checktests",
       displayName: "Check Tests",
@@ -4278,10 +4288,18 @@ __export(exports_resolve, {
   resolveScriptPath: () => resolveScriptPath,
   resolveHookMeta: () => resolveHookMeta,
   resolveHookDir: () => resolveHookDir,
-  resolveHook: () => resolveHook
+  resolveHook: () => resolveHook,
+  resolveBundledHooksDir: () => resolveBundledHooksDir
 });
-import { join as join4 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 import { existsSync as existsSync4 } from "fs";
+import { fileURLToPath } from "url";
+function resolveBundledHooksDir(moduleDir = dirname2(fileURLToPath(import.meta.url))) {
+  const sourceLayout = join4(moduleDir, "..", "..", "hooks");
+  if (existsSync4(join4(sourceLayout, "hook-gitguard")))
+    return sourceLayout;
+  return join4(moduleDir, "..", "hooks");
+}
 function resolveHookDir(name) {
   const custom = readCustomManifest(name);
   if (custom)
@@ -4290,7 +4308,7 @@ function resolveHookDir(name) {
   if (!meta)
     return;
   const short = shortManifestName(name);
-  const bundledBase = join4(__dirname, "..", "..", "hooks");
+  const bundledBase = resolveBundledHooksDir();
   const direct = join4(bundledBase, short);
   if (existsSync4(direct))
     return direct;
@@ -4353,7 +4371,6 @@ function resolveHook(name) {
     meta
   };
 }
-var __dirname = "/home/hasna/.hasna/repos/worktrees/apps/1ec6ba31-cdbc-42ea-8b1e-705e4198abbf/apps/hooks/src/lib";
 var init_resolve = __esm(() => {
   init_registry();
   init_manifest();
@@ -4361,9 +4378,9 @@ var init_resolve = __esm(() => {
 
 // src/lib/installer.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join5, dirname as dirname2 } from "path";
+import { join as join5, dirname as dirname3 } from "path";
 import { homedir as homedir3 } from "os";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 function normalizeHookName(name) {
   return name.startsWith("hook-") ? name : `hook-${name}`;
 }
@@ -4428,7 +4445,7 @@ function readSettings(scope = "global", target = "claude") {
 }
 function writeSettings(settings, scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
-  const dir = dirname2(path);
+  const dir = dirname3(path);
   if (!existsSync5(dir)) {
     mkdirSync3(dir, { recursive: true });
   }
@@ -4525,7 +4542,7 @@ function readCodewithConfig(scope, configPath) {
 }
 function appendCodewithFragment(fragment, scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
-  const dir = dirname2(path);
+  const dir = dirname3(path);
   if (!existsSync5(dir))
     mkdirSync3(dir, { recursive: true });
   const existing = existsSync5(path) ? readFileSync3(path, "utf-8") : "";
@@ -4776,7 +4793,7 @@ var __dirname2, HOOKS_DIR, EVENT_MAP, getInstalledHooks;
 var init_installer = __esm(() => {
   init_registry();
   init_resolve();
-  __dirname2 = dirname2(fileURLToPath(import.meta.url));
+  __dirname2 = dirname3(fileURLToPath2(import.meta.url));
   HOOKS_DIR = existsSync5(join5(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join5(__dirname2, "..", "..", "hooks") : join5(__dirname2, "..", "hooks");
   EVENT_MAP = {
     claude: {
@@ -4813,6 +4830,35 @@ var init_installer = __esm(() => {
   getInstalledHooks = getRegisteredHooks;
 });
 
+// src/lib/registration.ts
+function safeMatcherTest(pattern, value) {
+  try {
+    return new RegExp(pattern).test(value);
+  } catch {
+    return false;
+  }
+}
+function hookRegisteredInSettings(settings, name, eventSpec, hookMatcher) {
+  const separator = eventSpec.indexOf(":");
+  const eventName = separator === -1 ? eventSpec : eventSpec.slice(0, separator);
+  const specMatcher = separator === -1 ? "" : eventSpec.slice(separator + 1);
+  const matcher = specMatcher || hookMatcher || "";
+  const hooks = settings.hooks?.[eventName];
+  if (!Array.isArray(hooks))
+    return false;
+  return hooks.some((entry) => entry?.hooks?.some((h) => {
+    const match = h?.command?.match(/^hooks run ([\w-]+)/);
+    if (!match || match[1] !== name)
+      return false;
+    if (!matcher)
+      return true;
+    const entryMatcher = typeof entry.matcher === "string" ? entry.matcher : "";
+    if (!entryMatcher)
+      return true;
+    return entryMatcher === matcher || safeMatcherTest(entryMatcher, matcher) || safeMatcherTest(matcher, entryMatcher);
+  }));
+}
+
 // src/lib/profiles.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4, readdirSync as readdirSync2, rmSync, cpSync } from "fs";
 import { join as join6 } from "path";
@@ -5450,14 +5496,14 @@ __export(exports_run, {
 });
 import { randomBytes } from "crypto";
 import { rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute2, join as join9 } from "path";
+import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute2, join as join9 } from "path";
 function extensionOf(scriptPath) {
   const base = basename2(scriptPath);
   const dot = base.lastIndexOf(".");
   return dot > 0 ? base.slice(dot + 1) : "ts";
 }
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname3(options.scriptPath);
+  const scriptDir = dirname4(options.scriptPath);
   const tempPath = join9(scriptDir, `.hooks-verified-${randomBytes(12).toString("hex")}.${extensionOf(options.scriptPath)}`);
   try {
     writeFileSync6(tempPath, options.content, { flag: "wx", mode: 384 });
@@ -6026,6 +6072,19 @@ var init_storage = __esm(() => {
   init_pg_migrations();
 });
 
+// src/lib/secure-compare.ts
+function secureEqual(a, b) {
+  const enc = new TextEncoder;
+  const ab = enc.encode(a);
+  const bb = enc.encode(b);
+  let diff = ab.length ^ bb.length;
+  const n = Math.max(ab.length, bb.length);
+  for (let i = 0;i < n; i++) {
+    diff |= (ab[i] ?? 0) ^ (bb[i] ?? 0);
+  }
+  return diff === 0;
+}
+
 // src/serve.ts
 var exports_serve = {};
 __export(exports_serve, {
@@ -6087,8 +6146,8 @@ function authorized(req, apiKey) {
     return false;
   const header = req.headers.get("authorization") ?? "";
   if (header.startsWith("Bearer "))
-    return header.slice("Bearer ".length) === apiKey;
-  return req.headers.get("x-api-key") === apiKey;
+    return secureEqual(header.slice("Bearer ".length), apiKey);
+  return secureEqual(req.headers.get("x-api-key") ?? "", apiKey);
 }
 function json(body, status = 200, headers = {}) {
   return new Response(JSON.stringify(body), {
@@ -6190,10 +6249,17 @@ function collectBundledCatalog() {
   return out;
 }
 async function fetchJson(base, path) {
+  const headers = { accept: "application/json" };
+  const apiKey = resolveApiKey();
+  if (apiKey)
+    headers["x-api-key"] = apiKey;
   const res = await fetch(`${base}${path}`, {
-    headers: { accept: "application/json" },
+    headers,
     signal: AbortSignal.timeout(15000)
   });
+  if (res.status === 401) {
+    throw new Error("registry requires API key \u2014 set HASNA_HOOKS_API_KEY or HOOKS_API_KEY (vault-delivered, never stored)");
+  }
   if (!res.ok) {
     throw new Error(`GET ${path} failed with status ${res.status}`);
   }
@@ -6408,8 +6474,8 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z as z2 } from "zod";
 import { createServer } from "http";
 import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
-import { join as join11, dirname as dirname4 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { join as join11, dirname as dirname5 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 async function runVerifiedHook(name, scriptPath, stdin, timeoutMs) {
   const content = readFileSync9(scriptPath);
   const check = checkScriptHash(name, sha256Of(content));
@@ -6584,13 +6650,9 @@ function createHooksServer() {
       if (meta && settingsExist) {
         try {
           const settings = JSON.parse(readFileSync9(settingsPath, "utf-8"));
-          const eventHooks = settings.hooks?.[meta.event] || [];
-          const found = eventHooks.some((entry) => entry.hooks?.some((h) => {
-            const match = h.command?.match(/^hooks run ([\w-]+)/);
-            return match && match[1] === name;
-          }));
-          if (!found) {
-            issues.push({ hook: name, issue: `Not registered under correct event (${meta.event})`, severity: "error" });
+          if (!hookRegisteredInSettings(settings, name, meta.event, meta.matcher)) {
+            const eventName = meta.event.split(":")[0];
+            issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
             hookHealthy = false;
           }
         } catch {}
@@ -6947,8 +7009,8 @@ function createHooksServer() {
       disabled.push(name);
     settings.hooks.__disabled = disabled;
     const { writeFileSync: writeFileSync7, mkdirSync: mkdirSync8 } = await import("fs");
-    const { dirname: dirname5 } = await import("path");
-    mkdirSync8(dirname5(settingsPath), { recursive: true });
+    const { dirname: dirname6 } = await import("path");
+    mkdirSync8(dirname6(settingsPath), { recursive: true });
     writeFileSync7(settingsPath, JSON.stringify(settings, null, 2) + `
 `);
     return { content: [{ type: "text", text: JSON.stringify({ hook: name, disabled: true, scope }) }] };
@@ -7280,7 +7342,7 @@ var init_server = __esm(() => {
   init_resolve();
   init_store();
   init_storage();
-  __dirname3 = dirname4(fileURLToPath2(import.meta.url));
+  __dirname3 = dirname5(fileURLToPath3(import.meta.url));
   pkg = { name: "@hasna/hooks", version: "0.0.0" };
   try {
     for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
@@ -8557,8 +8619,8 @@ var {
 // src/cli/index.tsx
 import chalk2 from "chalk";
 import { existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
-import { join as join12, dirname as dirname5 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { join as join12, dirname as dirname6 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 
 // src/cli/components/App.tsx
 import { useState as useState7 } from "react";
@@ -9736,7 +9798,7 @@ init_profiles();
 init_manifest();
 init_resolve();
 import { jsxDEV as jsxDEV8 } from "react/jsx-dev-runtime";
-var __dirname4 = dirname5(fileURLToPath3(import.meta.url));
+var __dirname4 = dirname6(fileURLToPath4(import.meta.url));
 var pkgPath = existsSync12(join12(__dirname4, "..", "package.json")) ? join12(__dirname4, "..", "package.json") : join12(__dirname4, "..", "..", "package.json");
 var pkg2 = JSON.parse(readFileSync10(pkgPath, "utf-8"));
 var program2 = new Command;
@@ -10302,13 +10364,9 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
     if (meta && settingsExist) {
       try {
         const settings = JSON.parse(readFileSync10(settingsPath, "utf-8"));
-        const eventHooks = settings.hooks?.[meta.event] || [];
-        const found = eventHooks.some((entry) => entry.hooks?.some((h) => {
-          const match = h.command?.match(/^hooks run ([\w-]+)/);
-          return match && match[1] === name;
-        }));
-        if (!found) {
-          issues.push({ hook: name, issue: `Not registered under correct event (${meta.event})`, severity: "error" });
+        if (!hookRegisteredInSettings(settings, name, meta.event, meta.matcher)) {
+          const eventName = meta.event.split(":")[0];
+          issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
           hookHealthy = false;
         }
       } catch {}

package/bin/serve.js

@@ -57,6 +57,16 @@ var HOOKS = [
     matcher: "^(Bash|Write|Edit|MultiEdit|NotebookEdit|apply_patch|ApplyPatch|functions\\.apply_patch|mcp__.*)$",
     tags: ["git", "worktree", "repos", "multi-agent", "safety", "dangerous-ops"]
   },
+  {
+    name: "workspace-repos-guard",
+    displayName: "Workspace Repos Guard",
+    description: "Blocks writes and deletes that break the ~/workspace/repos structure: writes to the repos root, top-level entry creation, non-org folders, and any delete under repos",
+    version: "0.1.0",
+    category: "Git Safety",
+    event: "PreToolUse",
+    matcher: "^(Bash|Write|Edit|MultiEdit|NotebookEdit|apply_patch|ApplyPatch|functions\\.apply_patch)$",
+    tags: ["workspace", "repos", "structure", "guard", "safety", "orgs", "multi-agent"]
+  },
   {
     name: "checktests",
     displayName: "Check Tests",
@@ -5041,9 +5051,15 @@ function retrustHook(name, scriptPath, version, source) {
 }
 
 // src/lib/resolve.ts
-import { join as join5 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 import { existsSync as existsSync5 } from "fs";
-var __dirname = "/home/hasna/.hasna/repos/worktrees/apps/1ec6ba31-cdbc-42ea-8b1e-705e4198abbf/apps/hooks/src/lib";
+import { fileURLToPath } from "url";
+function resolveBundledHooksDir(moduleDir = dirname2(fileURLToPath(import.meta.url))) {
+  const sourceLayout = join5(moduleDir, "..", "..", "hooks");
+  if (existsSync5(join5(sourceLayout, "hook-gitguard")))
+    return sourceLayout;
+  return join5(moduleDir, "..", "hooks");
+}
 function resolveHookDir(name) {
   const custom2 = readCustomManifest(name);
   if (custom2)
@@ -5052,7 +5068,7 @@ function resolveHookDir(name) {
   if (!meta)
     return;
   const short = shortManifestName(name);
-  const bundledBase = join5(__dirname, "..", "..", "hooks");
+  const bundledBase = resolveBundledHooksDir();
   const direct = join5(bundledBase, short);
   if (existsSync5(direct))
     return direct;
@@ -5116,6 +5132,19 @@ function resolveHook(name) {
   };
 }
 
+// src/lib/secure-compare.ts
+function secureEqual(a, b) {
+  const enc = new TextEncoder;
+  const ab = enc.encode(a);
+  const bb = enc.encode(b);
+  let diff = ab.length ^ bb.length;
+  const n = Math.max(ab.length, bb.length);
+  for (let i = 0;i < n; i++) {
+    diff |= (ab[i] ?? 0) ^ (bb[i] ?? 0);
+  }
+  return diff === 0;
+}
+
 // src/serve.ts
 var DEFAULT_SERVE_PORT = 39428;
 var SERVE_HOST = "127.0.0.1";
@@ -5172,8 +5201,8 @@ function authorized(req, apiKey) {
     return false;
   const header = req.headers.get("authorization") ?? "";
   if (header.startsWith("Bearer "))
-    return header.slice("Bearer ".length) === apiKey;
-  return req.headers.get("x-api-key") === apiKey;
+    return secureEqual(header.slice("Bearer ".length), apiKey);
+  return secureEqual(req.headers.get("x-api-key") ?? "", apiKey);
 }
 function json(body, status = 200, headers = {}) {
   return new Response(JSON.stringify(body), {

package/dist/index.js

@@ -4849,14 +4849,14 @@ __export(exports_run, {
 });
 import { randomBytes } from "crypto";
 import { rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute2, join as join9 } from "path";
+import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute2, join as join9 } from "path";
 function extensionOf(scriptPath) {
   const base = basename2(scriptPath);
   const dot = base.lastIndexOf(".");
   return dot > 0 ? base.slice(dot + 1) : "ts";
 }
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname3(options.scriptPath);
+  const scriptDir = dirname4(options.scriptPath);
   const tempPath = join9(scriptDir, `.hooks-verified-${randomBytes(12).toString("hex")}.${extensionOf(options.scriptPath)}`);
   try {
     writeFileSync6(tempPath, options.content, { flag: "wx", mode: 384 });
@@ -5336,6 +5336,16 @@ var HOOKS = [
     matcher: "^(Bash|Write|Edit|MultiEdit|NotebookEdit|apply_patch|ApplyPatch|functions\\.apply_patch|mcp__.*)$",
     tags: ["git", "worktree", "repos", "multi-agent", "safety", "dangerous-ops"]
   },
+  {
+    name: "workspace-repos-guard",
+    displayName: "Workspace Repos Guard",
+    description: "Blocks writes and deletes that break the ~/workspace/repos structure: writes to the repos root, top-level entry creation, non-org folders, and any delete under repos",
+    version: "0.1.0",
+    category: "Git Safety",
+    event: "PreToolUse",
+    matcher: "^(Bash|Write|Edit|MultiEdit|NotebookEdit|apply_patch|ApplyPatch|functions\\.apply_patch)$",
+    tags: ["workspace", "repos", "structure", "guard", "safety", "orgs", "multi-agent"]
+  },
   {
     name: "checktests",
     displayName: "Check Tests",
@@ -5803,15 +5813,21 @@ function getHook(name) {
 }
 // src/lib/installer.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { join as join6, dirname as dirname2 } from "path";
+import { join as join6, dirname as dirname3 } from "path";
 import { homedir as homedir4 } from "os";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/lib/resolve.ts
-import { join as join5 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 import { existsSync as existsSync5 } from "fs";
+import { fileURLToPath } from "url";
 init_manifest();
-var __dirname = "/home/hasna/.hasna/repos/worktrees/apps/1ec6ba31-cdbc-42ea-8b1e-705e4198abbf/apps/hooks/src/lib";
+function resolveBundledHooksDir(moduleDir = dirname2(fileURLToPath(import.meta.url))) {
+  const sourceLayout = join5(moduleDir, "..", "..", "hooks");
+  if (existsSync5(join5(sourceLayout, "hook-gitguard")))
+    return sourceLayout;
+  return join5(moduleDir, "..", "hooks");
+}
 function resolveHookDir(name) {
   const custom2 = readCustomManifest(name);
   if (custom2)
@@ -5820,7 +5836,7 @@ function resolveHookDir(name) {
   if (!meta)
     return;
   const short = shortManifestName(name);
-  const bundledBase = join5(__dirname, "..", "..", "hooks");
+  const bundledBase = resolveBundledHooksDir();
   const direct = join5(bundledBase, short);
   if (existsSync5(direct))
     return direct;
@@ -5885,7 +5901,7 @@ function resolveHook(name) {
 }
 
 // src/lib/installer.ts
-var __dirname2 = dirname2(fileURLToPath(import.meta.url));
+var __dirname2 = dirname3(fileURLToPath2(import.meta.url));
 var HOOKS_DIR = existsSync6(join6(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join6(__dirname2, "..", "..", "hooks") : join6(__dirname2, "..", "hooks");
 function normalizeHookName(name) {
   return name.startsWith("hook-") ? name : `hook-${name}`;
@@ -5983,7 +5999,7 @@ function readSettings(scope = "global", target = "claude") {
 }
 function writeSettings(settings, scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
-  const dir = dirname2(path);
+  const dir = dirname3(path);
   if (!existsSync6(dir)) {
     mkdirSync4(dir, { recursive: true });
   }
@@ -6080,7 +6096,7 @@ function readCodewithConfig(scope, configPath) {
 }
 function appendCodewithFragment(fragment, scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
-  const dir = dirname2(path);
+  const dir = dirname3(path);
   if (!existsSync6(dir))
     mkdirSync4(dir, { recursive: true });
   const existing = existsSync6(path) ? readFileSync4(path, "utf-8") : "";
@@ -6466,10 +6482,17 @@ function collectBundledCatalog() {
   return out;
 }
 async function fetchJson(base, path) {
+  const headers = { accept: "application/json" };
+  const apiKey = resolveApiKey();
+  if (apiKey)
+    headers["x-api-key"] = apiKey;
   const res = await fetch(`${base}${path}`, {
-    headers: { accept: "application/json" },
+    headers,
     signal: AbortSignal.timeout(15000)
   });
+  if (res.status === 401) {
+    throw new Error("registry requires API key \u2014 set HASNA_HOOKS_API_KEY or HOOKS_API_KEY (vault-delivered, never stored)");
+  }
   if (!res.ok) {
     throw new Error(`GET ${path} failed with status ${res.status}`);
   }
@@ -6584,6 +6607,21 @@ async function syncHooks(options = {}) {
 init_manifest();
 init_store();
 init_config();
+
+// src/lib/secure-compare.ts
+function secureEqual(a, b) {
+  const enc = new TextEncoder;
+  const ab = enc.encode(a);
+  const bb = enc.encode(b);
+  let diff = ab.length ^ bb.length;
+  const n = Math.max(ab.length, bb.length);
+  for (let i = 0;i < n; i++) {
+    diff |= (ab[i] ?? 0) ^ (bb[i] ?? 0);
+  }
+  return diff === 0;
+}
+
+// src/serve.ts
 var DEFAULT_SERVE_PORT = 39428;
 var SERVE_HOST = "127.0.0.1";
 var SERVE_SERVICE_NAME = "hooks-registry";
@@ -6639,8 +6677,8 @@ function authorized(req, apiKey) {
     return false;
   const header = req.headers.get("authorization") ?? "";
   if (header.startsWith("Bearer "))
-    return header.slice("Bearer ".length) === apiKey;
-  return req.headers.get("x-api-key") === apiKey;
+    return secureEqual(header.slice("Bearer ".length), apiKey);
+  return secureEqual(req.headers.get("x-api-key") ?? "", apiKey);
 }
 function json(body, status = 200, headers = {}) {
   return new Response(JSON.stringify(body), {

package/dist/lib/resolve.d.ts

@@ -13,6 +13,14 @@ export interface ResolvedHook {
     scriptPath: string;
     meta: HookMeta;
 }
+/**
+ * Locate the bundled hooks directory at runtime from the executing module's
+ * own location. A bare `__dirname` is baked to the builder's path at bundle
+ * time, so bundled hooks resolve only on the machine that built the package
+ * (0.6.0/0.6.1 regression); `import.meta.url` is preserved at runtime by the
+ * bun build target, so resolution follows the installed package instead.
+ */
+export declare function resolveBundledHooksDir(moduleDir?: string): string;
 export declare function resolveHookDir(name: string): string | undefined;
 export declare function resolveScriptPath(name: string): string | undefined;
 export declare function resolveHookMeta(name: string): HookMeta | undefined;

package/dist/lib/secure-compare.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Constant-time string comparison for API-key checks.
+ *
+ * The loop always runs over the longer input and the result accumulates
+ * XORs, so the timing does not reveal where or whether the values differ.
+ * Available on both the bun/node and workerd runtimes.
+ */
+export declare function secureEqual(a: string, b: string): boolean;

package/hooks/hook-workspace-repos-guard/README.md

@@ -0,0 +1,63 @@
+# workspace-repos-guard
+
+Codewith-native hook installed as `hooks run workspace-repos-guard`.
+
+PreToolUse guard for the canonical workspace structure (knowledge
+`k_mssu9jdq_dgnnu2`): `$HOME/workspace` contains ONLY `repos/` + `scratch/` +
+`AGENTS.md`, and `repos/` contains ONLY GitHub-org folders. Checkouts at
+`$HOME/workspace/repos/<org>/<repo>/` are read/context only.
+
+## What it blocks
+
+- Any write to `$HOME/workspace/repos` itself (file tools and Bash).
+- Any write that would create a top-level entry directly under `repos/`
+  (depth 1 — a stray folder or file at the org level).
+- Any write whose second path segment is not an allowed GitHub org.
+- Any delete (`rm`, `rmdir`, `git clean`, `git rm`, `unlink`, `shred`,
+  `trash`, ...) anywhere under `$HOME/workspace/repos`, at any depth,
+  including deep inside org checkouts.
+
+## What it allows
+
+- Reads, always.
+- Writes deeper inside an allowed org folder
+  (`repos/<org>/<repo>/...`). Structure only: it deliberately does NOT
+  duplicate the `worktree-guard` hook, which owns edits-in-shared-checkouts
+  semantics.
+
+Home spellings (`~`, `$HOME`, `${HOME}`, quoted or not, including split-quote
+forms like `"$HOME"/workspace/repos`, which Bash treats identically to the
+unquoted spelling) are expanded before classification; `apply_patch` tools
+are inspected through their `Add File` / `Update File` / `Delete File`
+markers; Bash relative operands are resolved against the command's cwd when
+it sits under `repos/`; parenthesized command groups
+(`(cd ... && rm -rf ...)`) are unwrapped.
+
+## Configuration
+
+Allowed orgs default to `hasna,hasnaxyz,hasna-internal,hasna-products` and
+are overridable with the `WORKSPACE_REPOS_GUARD_ORGS` env var
+(comma-separated). The home directory is resolved with `os.homedir()` —
+never hardcoded.
+
+## Failure mode
+
+Fail-open: on any parse or evaluation error the hook responds `continue` so a
+guard defect can never wedge the agent.
+
+## Known limitation
+
+The guard is a best-effort **structural** guard, not an execution sandbox.
+Variable indirection cannot be caught by pre-expansion inspection: a command
+that builds its target dynamically (`R=...; rm -rf $R`, loops over computed
+paths, scripts downloaded and executed at runtime) is undetectable at hook
+time. The hook inspects literal spellings of the protected path (`~/...`,
+`$HOME/...`, `${HOME}/...`, split-quote forms such as `"$HOME"/...`, the
+resolved absolute home) and relative operands resolved from the command's
+cwd, so anything the shell would expand or indirect through a variable is
+outside its reach. Because it also fails open, it must never be relied on as
+the only protection layer.
+
+## License
+
+Apache-2.0

package/hooks/hook-workspace-repos-guard/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "workspace-repos-guard",
+  "version": "0.1.0",
+  "description": "Codewith-native Workspace Repos Guard hook for @hasna/hooks",
+  "type": "module",
+  "main": "./src/hook.ts",
+  "scripts": {
+    "typecheck": "tsc --noEmit"
+  },
+  "author": "Hasna",
+  "license": "Apache-2.0"
+}

package/hooks/hook-workspace-repos-guard/src/hook.test.ts

@@ -0,0 +1,312 @@
+import { describe, test, expect } from "bun:test";
+import { homedir } from "os";
+import { join } from "path";
+import { evaluate, resolveAllowedOrgs } from "./hook";
+
+const HOME = homedir();
+const REPOS = join(HOME, "workspace", "repos");
+
+function preToolUse(tool_name: string, tool_input: Record<string, unknown>, cwd = join(REPOS, "hasna", "apps")) {
+  return { hook_event_name: "PreToolUse", tool_name, tool_input, cwd };
+}
+
+function isBlocked(result: { output: { decision?: string; reason?: string } }): string | null {
+  if (result.output.decision === "block") return result.output.reason ?? "blocked";
+  return null;
+}describe("hook-workspace-repos-guard", () => {
+  describe("resolveAllowedOrgs", () => {
+    test("defaults to the four canonical GitHub orgs", () => {
+      expect([...resolveAllowedOrgs({})].sort()).toEqual(["hasna", "hasna-internal", "hasna-products", "hasnaxyz"]);
+    });
+
+    test("parses comma-separated env override, trimming whitespace and empties", () => {
+      expect([...resolveAllowedOrgs({ WORKSPACE_REPOS_GUARD_ORGS: " hasna ,  myorg ,, " })].sort()).toEqual(["hasna", "myorg"]);
+    });
+  });
+
+  describe("positive controls — must continue", () => {
+    test("Write deep inside an allowed org checkout continues", () => {
+      const result = evaluate(preToolUse("Write", { file_path: join(REPOS, "hasna", "apps", "apps", "foo", "src", "index.ts") }));
+      expect(result.output.continue).toBe(true);
+      expect(isBlocked(result)).toBeNull();
+    });
+
+    test("Edit inside hasna-internal org continues", () => {
+      const result = evaluate(preToolUse("Edit", { file_path: join(REPOS, "hasna-internal", "platform", "docs", "readme.md") }));
+      expect(result.output.continue).toBe(true);
+    });
+
+    test("MultiEdit with relative file_path resolves against cwd and continues inside allowed org", () => {
+      const result = evaluate(preToolUse("MultiEdit", { file_path: "apps/hooks/src/lib/registry.ts" }));
+      expect(result.output.continue).toBe(true);
+    });
+
+    test("NotebookEdit inside allowed org continues", () => {
+      const result = evaluate(preToolUse("NotebookEdit", { notebook_path: join(REPOS, "hasnaxyz", "iapp-probe", "probe.ipynb") }));
+      expect(result.output.continue).toBe(true);
+    });
+
+    test("Bash read commands under repos are never blocked", () => {
+      const reads = [
+        `ls ${REPOS}`,
+        `cat ${join(REPOS, "hasna", "apps", "README.md")}`,
+        `git -C ${join(REPOS, "hasna", "apps")} status`,
+        `cd ${REPOS} && git pull`,
+        `find ${join(REPOS, "hasna")} -name AGENTS.md`,
+      ];
+      for (const command of reads) {
+        const result = evaluate(preToolUse("Bash", { command }));
+        expect(result.output.continue).toBe(true);
+      }
+    });
+
+    test("Bash write deep inside an allowed org checkout continues", () => {
+      const commands = [
+        `echo note > ${join(REPOS, "hasna", "apps", "scratch.md")}`,
+        `touch ${join(REPOS, "hasna", "apps", "apps", "foo", "x.txt")}`,
+        `git clone https://github.com/hasna/foo.git ${join(REPOS, "hasna", "foo")}`,
+        `mkdir -p ${join(REPOS, "hasna-internal", "platform", "apps")}`,
+      ];
+      for (const command of commands) {
+        const result = evaluate(preToolUse("Bash", { command }));
+        expect(result.output.continue).toBe(true);
+      }
+    });
+
+    test("tilde/$HOME spellings of deep allowed-org writes continue", () => {
+      const commands = [
+        `touch ~/workspace/repos/hasna/apps/foo.md`,
+        `echo x > ~/workspace/repos/hasnaxyz/iapp-probe/notes.md`,
+        `mkdir -p "${HOME}/workspace/repos/hasna-internal/platform/apps"`,
+        `touch "$HOME"/workspace/repos/hasna/apps/x.txt`,
+        `echo x > "\${HOME}"/workspace/repos/hasnaxyz/iapp-probe/notes.md`,
+      ];
+      for (const command of commands) {
+        const result = evaluate(preToolUse("Bash", { command }));
+        expect(result.output.continue).toBe(true);
+      }
+    });
+
+    test("file-tool tilde/$HOME paths deep inside an allowed org continue", () => {
+      const results = [
+        evaluate(preToolUse("Write", { file_path: `~/workspace/repos/hasna/apps/src/x.ts` })),
+        evaluate(preToolUse("Edit", { file_path: `$HOME/workspace/repos/hasnaxyz/iapp-probe/n.ipynb` })),
+        evaluate(preToolUse("Write", { file_path: `"${HOME}/workspace/repos/hasna/apps/notes.md"` })),
+        evaluate(preToolUse("Write", { file_path: `"$HOME"/workspace/repos/hasna/apps/notes2.md` })),
+      ];
+      for (const result of results) {
+        expect(result.output.continue).toBe(true);
+      }
+    });
+
+    test("apply_patch Add/Update File deep inside an allowed org continues", () => {
+      const result = evaluate(
+        preToolUse("apply_patch", {
+          patch: `*** Begin Patch\n*** Add File: apps/hooks/src/lib/registry.ts\n+export const x = 1;\n*** End Patch`,
+        })
+      );
+      expect(result.output.continue).toBe(true);
+    });
+
+    test("non-mutating sed without -i, and interpreter without a path, continue", () => {
+      const commands = [
+        `sed 's/a/b/' ${join(REPOS, "hasna", "apps", "README.md")}`,
+        `node -e "console.log('no path here')"`,
+        `python3 -c "print('no path here')"`,
+      ];
+      for (const command of commands) {
+        const result = evaluate(preToolUse("Bash", { command }));
+        expect(result.output.continue).toBe(true);
+      }
+    });
+
+    test("non-PreToolUse events and non-file tools are ignored", () => {
+      const result = evaluate({ hook_event_name: "PostToolUse", tool_name: "Write", tool_input: { file_path: join(REPOS, "hasna", "x.ts") } });
+      expect(result.output.continue).toBe(true);
+      const read = evaluate(preToolUse("Read", { file_path: join(REPOS, "hasna", "apps", "README.md") }));
+      expect(read.output.continue).toBe(true);
+    });
+  });
+
+  describe("negative controls — must block", () => {
+    test("Write to ~/workspace/repos itself is blocked", () => {
+      const result = evaluate(preToolUse("Write", { file_path: join(REPOS, "stray.txt") }));
+      const reason = isBlocked(result);
+      expect(reason).not.toBeNull();
+      expect(reason).toContain("workspace-repos-guard");
+    });
+
+    test("Write to the repos root directory entry is blocked", () => {
+      const result = evaluate(preToolUse("Edit", { file_path: REPOS }));
+      expect(isBlocked(result)).not.toBeNull();
+    });
+
+    test("Write whose second segment is not an allowed org is blocked", () => {
+      const result = evaluate(preToolUse("Write", { file_path: join(REPOS, "notanorg", "x", "file.ts") }));
+      const reason = isBlocked(result);
+      expect(reason).not.toBeNull();
+      expect(reason).toContain("notanorg");
+    });
+
+    test("Write creating a top-level entry under repos (org-level, no deeper path) is blocked", () => {
+      const result = evaluate(preToolUse("Write", { file_path: join(REPOS, "hasna") }));
+      expect(isBlocked(result)).not.toBeNull();
+    });
+
+    test("rm -rf deep inside an allowed org checkout is blocked", () => {
+      const result = evaluate(preToolUse("Bash", { command: `rm -rf ${join(REPOS, "hasna", "apps", ".git")}` }));
+      const reason = isBlocked(result);
+      expect(reason).not.toBeNull();
+      expect(reason).toContain("delete");
+    });
+
+    test("rmdir of an org folder is blocked", () => {
+      const result = evaluate(preToolUse("Bash", { command: `rmdir ${join(REPOS, "oldorg")}` }));
+      expect(isBlocked(result)).not.toBeNull();
+    });
+
+    test("git clean inside a checkout is blocked", () => {
+      const result = evaluate(preToolUse("Bash", { command: `git -C ${join(REPOS, "hasna", "apps")} clean -fd` }));
+      expect(isBlocked(result)).not.toBeNull();
+    });
+
+    test("rm -rf of the repos root itself is blocked", () => {
+      const result = evaluate(preToolUse("Bash", { command: `rm -rf ${REPOS}` }));
+      expect(isBlocked(result)).not.toBeNull();
+    });
+
+    test("cd into repos followed by rm -rf . is blocked via relative resolution", () => {
+      const result = evaluate(preToolUse("Bash", { command: `cd ${REPOS} && rm -rf .` }));
+      expect(isBlocked(result)).not.toBeNull();
+    });
+
+    test("top-level non-org folder creation via Bash is blocked", () => {
+      const commands = [
+        `mkdir -p ${join(REPOS, "notanorg")}`,
+        `mkdir -p ${join(REPOS, "notanorg", "sub")}`,
+        `touch ${join(REPOS, "neworg", "x")}`,
+        `mv ${join(REPOS, "hasna", "apps", "a")} ${join(REPOS, "anotherorg")}`,
+      ];
+      for (const command of commands) {
+        const result = evaluate(preToolUse("Bash", { command }));
+        expect(isBlocked(result)).not.toBeNull();
+      }
+    });
+
+    test("Bash write into a non-allowed org folder is blocked", () => {
+      const result = evaluate(preToolUse("Bash", { command: `echo x > ${join(REPOS, "notanorg", "deep", "f.ts")}` }));
+      const reason = isBlocked(result);
+      expect(reason).not.toBeNull();
+      expect(reason).toContain("notanorg");
+    });
+
+    test("delete via git rm is blocked", () => {
+      const result = evaluate(preToolUse("Bash", { command: `git -C ${join(REPOS, "hasna", "apps")} rm src/foo.ts` }));
+      expect(isBlocked(result)).not.toBeNull();
+    });
+
+    test("tilde/$HOME spellings of the protected path are blocked", () => {
+      const commands = [
+        `rm -rf ~/workspace/repos`,
+        `rm -rf ~/workspace/repos/hasna/apps`,
+        `rm -rf $HOME/workspace/repos/hasna`,
+        `rm -rf "${HOME}/workspace/repos"`,
+        `rm -rf "$HOME"/workspace/repos`,
+        `rm -rf "$HOME"/workspace/repos/hasna/apps`,
+        `rm -rf "\${HOME}"/workspace/repos/hasna`,
+        `rm -rf "${HOME}"/workspace/repos/hasna`,
+        `touch ~/workspace/repos/stray.txt`,
+        `mkdir -p ~/workspace/repos/notanorg`,
+        `echo x > ~/workspace/repos/notanorg/f.ts`,
+        `mv /tmp/x ~/workspace/repos`,
+        `truncate -s 0 ~/workspace/repos/stray.log`,
+        `rsync -a /tmp/x ~/workspace/repos/`,
+        `scp f.txt ~/workspace/repos/`,
+      ];
+      for (const command of commands) {
+        const result = evaluate(preToolUse("Bash", { command }));
+        expect(isBlocked(result), `expected BLOCK for: ${command}`).not.toBeNull();
+      }
+    });
+
+    test("file-tool tilde/$HOME spellings are blocked", () => {
+      const results = [
+        evaluate(preToolUse("Write", { file_path: `~/workspace/repos/stray.txt` })),
+        evaluate(preToolUse("Write", { file_path: `$HOME/workspace/repos/notanorg/f.ts` })),
+        evaluate(preToolUse("Edit", { file_path: `~/workspace/repos/hasna` })),
+        evaluate(preToolUse("Write", { file_path: `~/workspace/repos` })),
+        evaluate(preToolUse("Write", { file_path: `"$HOME"/workspace/repos/stray.txt` })),
+      ];
+      for (const result of results) {
+        expect(isBlocked(result)).not.toBeNull();
+      }
+    });
+
+    test("subshell-grouped cd + rm is blocked", () => {
+      const commands = [
+        `(cd ~/workspace/repos && rm -rf hasna)`,
+        `(cd ${REPOS} && rm -rf hasna)`,
+        `( cd ${REPOS} && touch stray.txt )`,
+      ];
+      for (const command of commands) {
+        const result = evaluate(preToolUse("Bash", { command }));
+        expect(isBlocked(result), `expected BLOCK for: ${command}`).not.toBeNull();
+      }
+    });
+
+    test("cwd-relative deletes without an explicit cd are blocked", () => {
+      const fromCheckout = evaluate(preToolUse("Bash", { command: `rm -rf ../` }, join(REPOS, "hasna", "apps")));
+      expect(isBlocked(fromCheckout)).not.toBeNull();
+      const fromRoot = evaluate(preToolUse("Bash", { command: `mkdir -p notanorg` }, REPOS));
+      expect(isBlocked(fromRoot)).not.toBeNull();
+      const bareRm = evaluate(preToolUse("Bash", { command: `rm -rf .` }, join(REPOS, "hasnaxyz")));
+      expect(isBlocked(bareRm)).not.toBeNull();
+    });
+
+    test("mutating verbs writing under the protected root are blocked", () => {
+      const commands = [
+        `sed -i 's/x/y/' ~/workspace/repos/stray.txt`,
+        `rsync -a ${join(REPOS, "hasna")} /tmp/out`,
+        `scp -r ${join(REPOS, "hasna")} other:/tmp/`,
+        `truncate -s 0 ${join(REPOS, "notanorg", "f.ts")}`,
+        `python3 -c "open('~/workspace/repos/stray.txt','w')"`,
+        `node -e "require('fs').writeFileSync('${join(REPOS, "notanorg", "f.ts")}','x')"`,
+      ];
+      for (const command of commands) {
+        const result = evaluate(preToolUse("Bash", { command }));
+        expect(isBlocked(result), `expected BLOCK for: ${command}`).not.toBeNull();
+      }
+    });
+
+    test("apply_patch Delete File and shallow Add File are blocked", () => {
+      const del = evaluate(
+        preToolUse("ApplyPatch", {
+          patch: `*** Begin Patch\n*** Delete File: src/foo.ts\n*** End Patch`,
+        })
+      );
+      expect(isBlocked(del)).not.toBeNull();
+      const shallow = evaluate(
+        preToolUse("functions.apply_patch", {
+          patch: `*** Begin Patch\n*** Add File: ../../stray.txt\n+x\n*** End Patch`,
+        })
+      );
+      expect(isBlocked(shallow)).not.toBeNull();
+    });
+  });
+
+  describe("orgs env override", () => {
+    test("override widens and narrows the allowed set", () => {
+      const previous = process.env.WORKSPACE_REPOS_GUARD_ORGS;
+      try {
+        process.env.WORKSPACE_REPOS_GUARD_ORGS = "hasna,myorg";
+        const allowed = evaluate(preToolUse("Write", { file_path: join(REPOS, "myorg", "proj", "f.ts") }));
+        expect(allowed.output.continue).toBe(true);
+        const narrowed = evaluate(preToolUse("Write", { file_path: join(REPOS, "hasnaxyz", "iapp-x", "f.ts") }));
+        expect(isBlocked(narrowed)).not.toBeNull();
+      } finally {
+        if (previous === undefined) delete process.env.WORKSPACE_REPOS_GUARD_ORGS;
+        else process.env.WORKSPACE_REPOS_GUARD_ORGS = previous;
+      }
+    });
+  });
+});

package/hooks/hook-workspace-repos-guard/src/hook.ts

@@ -0,0 +1,352 @@
+#!/usr/bin/env bun
+
+/**
+ * PreToolUse hook: workspace-repos-guard
+ *
+ * Guards the canonical workspace structure (knowledge k_mssu9jdq_dgnnu2):
+ * $HOME/workspace contains ONLY repos/ + scratch/ + AGENTS.md, and repos/
+ * contains ONLY GitHub-org folders. Checkouts at
+ * $HOME/workspace/repos/<org>/<repo>/ are read/context only.
+ *
+ * Structure-only guard — it deliberately does NOT duplicate the worktree-guard
+ * hook, which owns edits-in-shared-checkouts semantics.
+ *
+ * BLOCKS:
+ *   - any write to $HOME/workspace/repos itself (file tools and Bash),
+ *   - any write that would create a top-level entry under repos/ (depth <= 1),
+ *   - any write whose second path segment is not an allowed GitHub org,
+ *   - any delete (rm, rmdir, git clean, git rm, unlink, shred, trash, ...)
+ *     anywhere under $HOME/workspace/repos, at any depth.
+ *
+ * ALLOWS (structure only):
+ *   - reads, always,
+ *   - writes deeper inside an allowed org folder (repos/<org>/<repo>/...).
+ *
+ * Home spellings (~, $HOME, ${HOME}, including quoted forms) are expanded
+ * before classification in Bash targets, file-tool paths, cd operands and
+ * apply_patch file markers. Bash relative operands (`.`, `..`, bare names)
+ * are resolved against the command's cwd when it sits under the repos root,
+ * and against an explicit `cd` into the root when one is present. apply_patch
+ * tools are inspected through their `*** Add File:` / `*** Update File:` /
+ * `*** Delete File:` markers. Parenthesized command groups are unwrapped.
+ *
+ * Allowed orgs default to hasna,hasnaxyz,hasna-internal,hasna-products and are
+ * overridable with the WORKSPACE_REPOS_GUARD_ORGS env var (comma-separated).
+ * Home is resolved with os.homedir(); never hardcoded. Fail-open on any parse
+ * or evaluation error so a guard defect cannot wedge the agent.
+ */
+
+import { homedir } from "os";
+import { isAbsolute, join, normalize, relative, resolve, sep } from "path";
+import {
+  getCommand,
+  readInput,
+  respond,
+  warn,
+  type CodewithHookInput,
+  type CodewithHookOutput,
+} from "../../codewith-native-common";
+
+const FILE_WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
+
+const PATCH_TOOLS = new Set(["apply_patch", "ApplyPatch", "functions.apply_patch"]);
+
+const DEFAULT_ORGS = ["hasna", "hasnaxyz", "hasna-internal", "hasna-products"];
+
+const RULE = "workspace-repos-guard";
+
+function reposRoot(home: string): string {
+  return join(home, "workspace", "repos");
+}
+
+export function resolveAllowedOrgs(env: NodeJS.ProcessEnv = process.env): Set<string> {
+  const raw = env.WORKSPACE_REPOS_GUARD_ORGS;
+  if (typeof raw !== "string" || !raw.trim()) return new Set(DEFAULT_ORGS);
+  return new Set(
+    raw
+      .split(",")
+      .map((s) => s.trim())
+      .filter(Boolean)
+  );
+}
+
+type Operation = "read" | "write" | "delete";
+
+interface Verdict {
+  blocked: boolean;
+  reason?: string;
+}
+
+/**
+ * Classify a single absolute target path against the repos root. Structure
+ * only: a write at depth >= 2 inside an allowed org passes, and anything else
+ * (deletes at any depth, writes at the root or org level, writes into a
+ * non-allowed org) is blocked. Paths outside the repos root are not this
+ * hook's concern and pass.
+ */
+export function classifyPath(target: string, root: string, orgs: Set<string>, op: Operation): Verdict {
+  if (op === "read") return { blocked: false };
+  let rel = relative(root, target);
+  if (rel === "") {
+    if (op === "delete") return { blocked: true, reason: `[${RULE}] delete of the repos root is forbidden: ${root}` };
+    return { blocked: true, reason: `[${RULE}] writes directly to the repos root are forbidden: ${root}` };
+  }
+  if (rel.startsWith(`..${sep}`) || rel === ".." || isAbsolute(rel)) {
+    return { blocked: false };
+  }
+  const segments = rel.split(sep).filter(Boolean);
+
+  if (op === "delete") {
+    return { blocked: true, reason: `[${RULE}] delete under ~/workspace/repos is forbidden at any depth: ${target}` };
+  }
+
+  if (segments.length <= 1) {
+    return {
+      blocked: true,
+      reason: `[${RULE}] writing would create a top-level entry directly under repos/; only GitHub-org folders belong there: ${target}`,
+    };
+  }
+
+  const org = segments[0];
+  if (!orgs.has(org)) {
+    return {
+      blocked: true,
+      reason: `[${RULE}] '${org}' is not an allowed GitHub org under ~/workspace/repos (allowed: ${[...orgs].join(", ")}): ${target}`,
+    };
+  }
+
+  return { blocked: false };
+}
+
+const WRITE_FLAGS = /\b(?:-o|--output|-O|--output-document|-out)\b/;
+
+/**
+ * Classify the operation of one command segment (a `&&`/`||`/`;`-delimited
+ * unit). Git is handled by its subcommand: clean|rm delete, clone|init write,
+ * everything else (status/pull/fetch/log/diff/...) is read. Sed without an
+ * in-place flag is a stream filter (redirection is caught separately);
+ * rsync/scp/truncate and inline interpreters (python3 -c, node -e, bun -e)
+ * are treated as writes — conservative: they only matter when a path under
+ * the protected root is also present.
+ */
+function segmentOperation(segment: string): Operation {
+  const trimmed = segment.trim();
+  if (!trimmed) return "read";
+
+  if (/(?:^|\s)(?:rm|rmdir|unlink|shred|trash|rmtree|del)(?:\s|$)/.test(trimmed)) return "delete";
+  if (/\bgit\b/.test(trimmed)) {
+    if (/\bgit\b[^;&|]*\b(?:clean|rm)\b/.test(trimmed)) return "delete";
+    if (/\bgit\b[^;&|]*\b(?:clone|init)\b/.test(trimmed)) return "write";
+    return "read";
+  }
+  if (/(?:^|\s)(?:mkdir|mkfile|touch|mv|cp|ln|tee|install|dd)(?:\s|$)/.test(trimmed)) return "write";
+  if (/\b(?:curl|wget)\b/.test(trimmed)) {
+    if (WRITE_FLAGS.test(trimmed)) return "write";
+    return "read";
+  }
+  if (/\bsed\b/.test(trimmed)) {
+    if (/(?:^|\s)-i\S*(?:\s|$)|--in-place(?:\s|$)/.test(trimmed)) return "write";
+    // sed without -i is a filter; `>` redirection is caught by the check below.
+  } else if (/\b(?:rsync|scp|truncate)\b/.test(trimmed)) {
+    return "write";
+  } else if (/(?:^|\s)(?:python3?|node|bun)\b[^;&|]*\s+-[ce](?:\s|$)/.test(trimmed)) {
+    return "write";
+  }
+  if (/(?:^|[;&|])\s*echo\b/.test(trimmed) || /[>&]/.test(trimmed)) return "write";
+  return "read";
+}
+
+interface PathTarget {
+  path: string;
+  op: Operation;
+}
+
+/**
+ * Expand one token's home spelling (`~`, `~/...`, `$HOME`, `$HOME/...`,
+ * `${HOME}`, `${HOME}/...`) to the resolved home, tolerating a single layer
+ * of wrapping single/double quotes and a closing quote between the home
+ * token and its path suffix (`"$HOME"/x`, `"${HOME}"/x` — Bash treats these
+ * identically to the unquoted form, because double quotes allow parameter
+ * expansion and adjacent quoted/unquoted parts concatenate into one word).
+ * Non-home spellings are returned unchanged.
+ */
+export function expandHomeSpelling(token: string, home: string): string {
+  let body = token.trim();
+  const quoted = body.match(/^(['"])([\s\S]*)\1$/);
+  if (quoted) body = quoted[2];
+  // Split-quote forms — `"$HOME"/x`, `"${HOME}"/x`, `"/home/hasna"/x`: the
+  // quotes wrap only the home token, and Bash concatenates the adjacent
+  // quoted and unquoted parts into the same word as the unquoted spelling.
+  body = body.replace(/^"*\$HOME"*\//, "$HOME/");
+  body = body.replace(/^"*\$\{HOME\}"*\//, "${HOME}/");
+  if (body === "~") return home;
+  if (body.startsWith("~/")) return join(home, body.slice(2));
+  if (body === "$HOME" || body === "${HOME}") return home;
+  if (body.startsWith("$HOME/")) return join(home, body.slice("$HOME/".length));
+  if (body.startsWith("${HOME}/")) return join(home, body.slice("${HOME}/".length));
+  const homeMatch = body.match(new RegExp(`^"*${regexEscape(home)}"*/`));
+  if (homeMatch) return home + "/" + body.slice(homeMatch[0].length);
+  return token;
+}
+
+/**
+ * Strip one level of wrapping shell-group punctuation from a segment so a
+ * subshell group like `(cd ~/workspace/repos && rm -rf hasna)` is analysed as
+ * its parts after the `&&` split.
+ */
+function unwrapSegment(segment: string): string {
+  let s = segment.trim();
+  while (s.startsWith("(") || s.startsWith("{")) s = s.slice(1).trim();
+  while (s.endsWith(")") || s.endsWith("}")) s = s.slice(0, -1).trim();
+  return s;
+}
+
+function regexEscape(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/**
+ * Extract workspace-repos targets from a Bash command. Recognises explicit
+ * `~/...`, `$HOME/...`, `${HOME}/...` and literal-home references (expanded
+ * before classification), plus a trailing relative operand (`.`, `..`, a bare
+ * name) when the command `cd`s into the repos root or the command's cwd
+ * already sits under it. Tokens outside the repos root are ignored; reads are
+ * returned so callers can decide (they are never blocked).
+ */
+export function bashTargets(command: string, home: string, cwd: string): PathTarget[] {
+  if (!command) return [];
+  const root = reposRoot(home);
+  const segments = command.split(/\s*&&\s*|\s*\|\|\s*|;\s*|\n+/);
+
+  const targets: PathTarget[] = [];
+  let cwdUnderRepos: string | null = null;
+
+  for (const rawSegment of segments) {
+    const segment = unwrapSegment(rawSegment);
+    const op = segmentOperation(segment);
+
+    const cdMatch = segment.match(/(?:^|\s)cd(?:\s+(?:-[A-Za-z]+|--))*\s+([^\s;&|<>()\x60]+)/);
+    if (cdMatch) {
+      const cdTarget = expandHomeSpelling(cdMatch[1], home);
+      if (cdTarget && (cdTarget === root || cdTarget.startsWith(`${root}${sep}`))) cwdUnderRepos = cdTarget;
+    }
+
+    const homeLiteral = regexEscape(home);
+    const prefixRe = new RegExp(`(?:~|\\$HOME"*|\\$\\{HOME\\}"*|${homeLiteral}"*)/workspace/repos`);
+    const re = new RegExp(`(${prefixRe.source})([^\\s"';&|<>()\x60]*|$)`, "g");
+    let m: RegExpExecArray | null;
+    let foundExplicit = false;
+    while ((m = re.exec(segment)) !== null) {
+      foundExplicit = true;
+      const expanded = expandHomeSpelling(m[0], home);
+      targets.push({ path: normalize(expanded).replace(/\/+$/, ""), op });
+    }
+
+    if (!foundExplicit && (op === "delete" || op === "write")) {
+      const base =
+        cwdUnderRepos ?? (cwd === root || cwd.startsWith(`${root}${sep}`) ? cwd : null);
+      if (base) {
+        const relMatch = segment.match(/(?:^|\s)(\.\.?|[^\s"';&|<>()\x60/]+(?:\/[^\s"';&|<>()\x60]*)?)\s*$/);
+        if (relMatch) {
+          targets.push({ path: normalize(resolve(base, relMatch[1])), op });
+        }
+      }
+    }
+  }
+
+  return targets;
+}
+
+const PATCH_FILE_RE = /^\s*\*\*\*\s+(Add File|Update File|Delete File):\s+(\S+)\s*$/gm;
+
+/**
+ * Extract targets from an apply_patch payload: the `*** Add File:` /
+ * `*** Update File:` / `*** Delete File:` markers, resolved against cwd.
+ * Add/Update classify as write; Delete classifies as delete.
+ */
+export function patchTargets(patch: string, cwd: string): PathTarget[] {
+  const targets: PathTarget[] = [];
+  let m: RegExpExecArray | null;
+  while ((m = PATCH_FILE_RE.exec(patch)) !== null) {
+    const op: Operation = m[1] === "Delete File" ? "delete" : "write";
+    targets.push({ path: normalize(resolve(cwd, m[2])), op });
+  }
+  return targets;
+}
+
+export function evaluate(input: CodewithHookInput): { output: CodewithHookOutput; warnings: string[] } {
+  const warnings: string[] = [];
+  if (input.hook_event_name !== "PreToolUse") return { output: { continue: true }, warnings };
+
+  const tool = typeof input.tool_name === "string" ? input.tool_name : "";
+  const home = homedir();
+  const root = reposRoot(home);
+  const orgs = resolveAllowedOrgs();
+
+  if (tool === "Bash") {
+    const command = getCommand(input);
+    if (!command) return { output: { continue: true }, warnings };
+    const cwd = typeof input.cwd === "string" && input.cwd ? input.cwd : process.cwd();
+    const targets = bashTargets(command, home, cwd);
+    for (const target of targets) {
+      const verdict = classifyPath(target.path, root, orgs, target.op);
+      if (verdict.blocked) {
+        return { output: { decision: "block", reason: verdict.reason }, warnings };
+      }
+    }
+    return { output: { continue: true }, warnings };
+  }
+
+  const toolInput = input.tool_input ?? {};
+  const cwd = typeof input.cwd === "string" && input.cwd ? input.cwd : process.cwd();
+
+  if (PATCH_TOOLS.has(tool)) {
+    const patch = typeof toolInput.patch === "string" ? toolInput.patch : "";
+    if (!patch) return { output: { continue: true }, warnings };
+    const targets = patchTargets(patch, cwd);
+    for (const target of targets) {
+      const verdict = classifyPath(target.path, root, orgs, target.op);
+      if (verdict.blocked) {
+        return { output: { decision: "block", reason: verdict.reason }, warnings };
+      }
+    }
+    return { output: { continue: true }, warnings };
+  }
+
+  if (!FILE_WRITE_TOOLS.has(tool)) return { output: { continue: true }, warnings };
+
+  const raw =
+    typeof toolInput.file_path === "string"
+      ? toolInput.file_path
+      : typeof toolInput.path === "string"
+        ? toolInput.path
+        : typeof toolInput.notebook_path === "string"
+          ? toolInput.notebook_path
+          : null;
+  if (!raw) return { output: { continue: true }, warnings };
+
+  const expanded = expandHomeSpelling(raw, home);
+  const target = isAbsolute(expanded) ? normalize(expanded) : resolve(cwd, expanded);
+  const verdict = classifyPath(target, root, orgs, "write");
+  if (verdict.blocked) {
+    return { output: { decision: "block", reason: verdict.reason }, warnings };
+  }
+  return { output: { continue: true }, warnings };
+}
+
+export async function run(): Promise<void> {
+  const input = readInput();
+  try {
+    const { output, warnings } = evaluate(input);
+    for (const message of warnings) warn(message);
+    respond(output);
+  } catch (error) {
+    warn(`${RULE} failed open: ${error instanceof Error ? error.message : String(error)}`);
+    respond({ continue: true });
+  }
+}
+
+if (import.meta.main) {
+  await run();
+  process.exit(0);
+}

package/hooks/hook-workspace-repos-guard/tsconfig.json

@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "module": "ESNext",
+    "lib": ["ESNext"],
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "types": ["bun-types"]
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/hooks",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Open source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command",
   "type": "module",
   "bin": {