@hasna/hooks 0.6.1 → 0.6.2

package/bin/index.js

@@ -4288,10 +4288,18 @@ __export(exports_resolve, {
   resolveScriptPath: () => resolveScriptPath,
   resolveHookMeta: () => resolveHookMeta,
   resolveHookDir: () => resolveHookDir,
-  resolveHook: () => resolveHook
+  resolveHook: () => resolveHook,
+  resolveBundledHooksDir: () => resolveBundledHooksDir
 });
-import { join as join4 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 import { existsSync as existsSync4 } from "fs";
+import { fileURLToPath } from "url";
+function resolveBundledHooksDir(moduleDir = dirname2(fileURLToPath(import.meta.url))) {
+  const sourceLayout = join4(moduleDir, "..", "..", "hooks");
+  if (existsSync4(join4(sourceLayout, "hook-gitguard")))
+    return sourceLayout;
+  return join4(moduleDir, "..", "hooks");
+}
 function resolveHookDir(name) {
   const custom = readCustomManifest(name);
   if (custom)
@@ -4300,7 +4308,7 @@ function resolveHookDir(name) {
   if (!meta)
     return;
   const short = shortManifestName(name);
-  const bundledBase = join4(__dirname, "..", "..", "hooks");
+  const bundledBase = resolveBundledHooksDir();
   const direct = join4(bundledBase, short);
   if (existsSync4(direct))
     return direct;
@@ -4363,7 +4371,6 @@ function resolveHook(name) {
     meta
   };
 }
-var __dirname = "/home/hasna/.hasna/repos/worktrees/hasna-apps/workspace-repos-guard/apps/hooks/src/lib";
 var init_resolve = __esm(() => {
   init_registry();
   init_manifest();
@@ -4371,9 +4378,9 @@ var init_resolve = __esm(() => {
 
 // src/lib/installer.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join5, dirname as dirname2 } from "path";
+import { join as join5, dirname as dirname3 } from "path";
 import { homedir as homedir3 } from "os";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 function normalizeHookName(name) {
   return name.startsWith("hook-") ? name : `hook-${name}`;
 }
@@ -4438,7 +4445,7 @@ function readSettings(scope = "global", target = "claude") {
 }
 function writeSettings(settings, scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
-  const dir = dirname2(path);
+  const dir = dirname3(path);
   if (!existsSync5(dir)) {
     mkdirSync3(dir, { recursive: true });
   }
@@ -4535,7 +4542,7 @@ function readCodewithConfig(scope, configPath) {
 }
 function appendCodewithFragment(fragment, scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
-  const dir = dirname2(path);
+  const dir = dirname3(path);
   if (!existsSync5(dir))
     mkdirSync3(dir, { recursive: true });
   const existing = existsSync5(path) ? readFileSync3(path, "utf-8") : "";
@@ -4786,7 +4793,7 @@ var __dirname2, HOOKS_DIR, EVENT_MAP, getInstalledHooks;
 var init_installer = __esm(() => {
   init_registry();
   init_resolve();
-  __dirname2 = dirname2(fileURLToPath(import.meta.url));
+  __dirname2 = dirname3(fileURLToPath2(import.meta.url));
   HOOKS_DIR = existsSync5(join5(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join5(__dirname2, "..", "..", "hooks") : join5(__dirname2, "..", "hooks");
   EVENT_MAP = {
     claude: {
@@ -4823,6 +4830,35 @@ var init_installer = __esm(() => {
   getInstalledHooks = getRegisteredHooks;
 });
 
+// src/lib/registration.ts
+function safeMatcherTest(pattern, value) {
+  try {
+    return new RegExp(pattern).test(value);
+  } catch {
+    return false;
+  }
+}
+function hookRegisteredInSettings(settings, name, eventSpec, hookMatcher) {
+  const separator = eventSpec.indexOf(":");
+  const eventName = separator === -1 ? eventSpec : eventSpec.slice(0, separator);
+  const specMatcher = separator === -1 ? "" : eventSpec.slice(separator + 1);
+  const matcher = specMatcher || hookMatcher || "";
+  const hooks = settings.hooks?.[eventName];
+  if (!Array.isArray(hooks))
+    return false;
+  return hooks.some((entry) => entry?.hooks?.some((h) => {
+    const match = h?.command?.match(/^hooks run ([\w-]+)/);
+    if (!match || match[1] !== name)
+      return false;
+    if (!matcher)
+      return true;
+    const entryMatcher = typeof entry.matcher === "string" ? entry.matcher : "";
+    if (!entryMatcher)
+      return true;
+    return entryMatcher === matcher || safeMatcherTest(entryMatcher, matcher) || safeMatcherTest(matcher, entryMatcher);
+  }));
+}
+
 // src/lib/profiles.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4, readdirSync as readdirSync2, rmSync, cpSync } from "fs";
 import { join as join6 } from "path";
@@ -5460,14 +5496,14 @@ __export(exports_run, {
 });
 import { randomBytes } from "crypto";
 import { rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute2, join as join9 } from "path";
+import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute2, join as join9 } from "path";
 function extensionOf(scriptPath) {
   const base = basename2(scriptPath);
   const dot = base.lastIndexOf(".");
   return dot > 0 ? base.slice(dot + 1) : "ts";
 }
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname3(options.scriptPath);
+  const scriptDir = dirname4(options.scriptPath);
   const tempPath = join9(scriptDir, `.hooks-verified-${randomBytes(12).toString("hex")}.${extensionOf(options.scriptPath)}`);
   try {
     writeFileSync6(tempPath, options.content, { flag: "wx", mode: 384 });
@@ -6036,6 +6072,19 @@ var init_storage = __esm(() => {
   init_pg_migrations();
 });
 
+// src/lib/secure-compare.ts
+function secureEqual(a, b) {
+  const enc = new TextEncoder;
+  const ab = enc.encode(a);
+  const bb = enc.encode(b);
+  let diff = ab.length ^ bb.length;
+  const n = Math.max(ab.length, bb.length);
+  for (let i = 0;i < n; i++) {
+    diff |= (ab[i] ?? 0) ^ (bb[i] ?? 0);
+  }
+  return diff === 0;
+}
+
 // src/serve.ts
 var exports_serve = {};
 __export(exports_serve, {
@@ -6097,8 +6146,8 @@ function authorized(req, apiKey) {
     return false;
   const header = req.headers.get("authorization") ?? "";
   if (header.startsWith("Bearer "))
-    return header.slice("Bearer ".length) === apiKey;
-  return req.headers.get("x-api-key") === apiKey;
+    return secureEqual(header.slice("Bearer ".length), apiKey);
+  return secureEqual(req.headers.get("x-api-key") ?? "", apiKey);
 }
 function json(body, status = 200, headers = {}) {
   return new Response(JSON.stringify(body), {
@@ -6200,10 +6249,17 @@ function collectBundledCatalog() {
   return out;
 }
 async function fetchJson(base, path) {
+  const headers = { accept: "application/json" };
+  const apiKey = resolveApiKey();
+  if (apiKey)
+    headers["x-api-key"] = apiKey;
   const res = await fetch(`${base}${path}`, {
-    headers: { accept: "application/json" },
+    headers,
     signal: AbortSignal.timeout(15000)
   });
+  if (res.status === 401) {
+    throw new Error("registry requires API key \u2014 set HASNA_HOOKS_API_KEY or HOOKS_API_KEY (vault-delivered, never stored)");
+  }
   if (!res.ok) {
     throw new Error(`GET ${path} failed with status ${res.status}`);
   }
@@ -6418,8 +6474,8 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z as z2 } from "zod";
 import { createServer } from "http";
 import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
-import { join as join11, dirname as dirname4 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { join as join11, dirname as dirname5 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 async function runVerifiedHook(name, scriptPath, stdin, timeoutMs) {
   const content = readFileSync9(scriptPath);
   const check = checkScriptHash(name, sha256Of(content));
@@ -6594,13 +6650,9 @@ function createHooksServer() {
       if (meta && settingsExist) {
         try {
           const settings = JSON.parse(readFileSync9(settingsPath, "utf-8"));
-          const eventHooks = settings.hooks?.[meta.event] || [];
-          const found = eventHooks.some((entry) => entry.hooks?.some((h) => {
-            const match = h.command?.match(/^hooks run ([\w-]+)/);
-            return match && match[1] === name;
-          }));
-          if (!found) {
-            issues.push({ hook: name, issue: `Not registered under correct event (${meta.event})`, severity: "error" });
+          if (!hookRegisteredInSettings(settings, name, meta.event, meta.matcher)) {
+            const eventName = meta.event.split(":")[0];
+            issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
             hookHealthy = false;
           }
         } catch {}
@@ -6957,8 +7009,8 @@ function createHooksServer() {
       disabled.push(name);
     settings.hooks.__disabled = disabled;
     const { writeFileSync: writeFileSync7, mkdirSync: mkdirSync8 } = await import("fs");
-    const { dirname: dirname5 } = await import("path");
-    mkdirSync8(dirname5(settingsPath), { recursive: true });
+    const { dirname: dirname6 } = await import("path");
+    mkdirSync8(dirname6(settingsPath), { recursive: true });
     writeFileSync7(settingsPath, JSON.stringify(settings, null, 2) + `
 `);
     return { content: [{ type: "text", text: JSON.stringify({ hook: name, disabled: true, scope }) }] };
@@ -7290,7 +7342,7 @@ var init_server = __esm(() => {
   init_resolve();
   init_store();
   init_storage();
-  __dirname3 = dirname4(fileURLToPath2(import.meta.url));
+  __dirname3 = dirname5(fileURLToPath3(import.meta.url));
   pkg = { name: "@hasna/hooks", version: "0.0.0" };
   try {
     for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
@@ -8567,8 +8619,8 @@ var {
 // src/cli/index.tsx
 import chalk2 from "chalk";
 import { existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
-import { join as join12, dirname as dirname5 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { join as join12, dirname as dirname6 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 
 // src/cli/components/App.tsx
 import { useState as useState7 } from "react";
@@ -9746,7 +9798,7 @@ init_profiles();
 init_manifest();
 init_resolve();
 import { jsxDEV as jsxDEV8 } from "react/jsx-dev-runtime";
-var __dirname4 = dirname5(fileURLToPath3(import.meta.url));
+var __dirname4 = dirname6(fileURLToPath4(import.meta.url));
 var pkgPath = existsSync12(join12(__dirname4, "..", "package.json")) ? join12(__dirname4, "..", "package.json") : join12(__dirname4, "..", "..", "package.json");
 var pkg2 = JSON.parse(readFileSync10(pkgPath, "utf-8"));
 var program2 = new Command;
@@ -10312,13 +10364,9 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
     if (meta && settingsExist) {
       try {
         const settings = JSON.parse(readFileSync10(settingsPath, "utf-8"));
-        const eventHooks = settings.hooks?.[meta.event] || [];
-        const found = eventHooks.some((entry) => entry.hooks?.some((h) => {
-          const match = h.command?.match(/^hooks run ([\w-]+)/);
-          return match && match[1] === name;
-        }));
-        if (!found) {
-          issues.push({ hook: name, issue: `Not registered under correct event (${meta.event})`, severity: "error" });
+        if (!hookRegisteredInSettings(settings, name, meta.event, meta.matcher)) {
+          const eventName = meta.event.split(":")[0];
+          issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
           hookHealthy = false;
         }
       } catch {}

package/bin/serve.js

@@ -5051,9 +5051,15 @@ function retrustHook(name, scriptPath, version, source) {
 }
 
 // src/lib/resolve.ts
-import { join as join5 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 import { existsSync as existsSync5 } from "fs";
-var __dirname = "/home/hasna/.hasna/repos/worktrees/hasna-apps/workspace-repos-guard/apps/hooks/src/lib";
+import { fileURLToPath } from "url";
+function resolveBundledHooksDir(moduleDir = dirname2(fileURLToPath(import.meta.url))) {
+  const sourceLayout = join5(moduleDir, "..", "..", "hooks");
+  if (existsSync5(join5(sourceLayout, "hook-gitguard")))
+    return sourceLayout;
+  return join5(moduleDir, "..", "hooks");
+}
 function resolveHookDir(name) {
   const custom2 = readCustomManifest(name);
   if (custom2)
@@ -5062,7 +5068,7 @@ function resolveHookDir(name) {
   if (!meta)
     return;
   const short = shortManifestName(name);
-  const bundledBase = join5(__dirname, "..", "..", "hooks");
+  const bundledBase = resolveBundledHooksDir();
   const direct = join5(bundledBase, short);
   if (existsSync5(direct))
     return direct;
@@ -5126,6 +5132,19 @@ function resolveHook(name) {
   };
 }
 
+// src/lib/secure-compare.ts
+function secureEqual(a, b) {
+  const enc = new TextEncoder;
+  const ab = enc.encode(a);
+  const bb = enc.encode(b);
+  let diff = ab.length ^ bb.length;
+  const n = Math.max(ab.length, bb.length);
+  for (let i = 0;i < n; i++) {
+    diff |= (ab[i] ?? 0) ^ (bb[i] ?? 0);
+  }
+  return diff === 0;
+}
+
 // src/serve.ts
 var DEFAULT_SERVE_PORT = 39428;
 var SERVE_HOST = "127.0.0.1";
@@ -5182,8 +5201,8 @@ function authorized(req, apiKey) {
     return false;
   const header = req.headers.get("authorization") ?? "";
   if (header.startsWith("Bearer "))
-    return header.slice("Bearer ".length) === apiKey;
-  return req.headers.get("x-api-key") === apiKey;
+    return secureEqual(header.slice("Bearer ".length), apiKey);
+  return secureEqual(req.headers.get("x-api-key") ?? "", apiKey);
 }
 function json(body, status = 200, headers = {}) {
   return new Response(JSON.stringify(body), {

package/dist/index.js

@@ -4849,14 +4849,14 @@ __export(exports_run, {
 });
 import { randomBytes } from "crypto";
 import { rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute2, join as join9 } from "path";
+import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute2, join as join9 } from "path";
 function extensionOf(scriptPath) {
   const base = basename2(scriptPath);
   const dot = base.lastIndexOf(".");
   return dot > 0 ? base.slice(dot + 1) : "ts";
 }
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname3(options.scriptPath);
+  const scriptDir = dirname4(options.scriptPath);
   const tempPath = join9(scriptDir, `.hooks-verified-${randomBytes(12).toString("hex")}.${extensionOf(options.scriptPath)}`);
   try {
     writeFileSync6(tempPath, options.content, { flag: "wx", mode: 384 });
@@ -5813,15 +5813,21 @@ function getHook(name) {
 }
 // src/lib/installer.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { join as join6, dirname as dirname2 } from "path";
+import { join as join6, dirname as dirname3 } from "path";
 import { homedir as homedir4 } from "os";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/lib/resolve.ts
-import { join as join5 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 import { existsSync as existsSync5 } from "fs";
+import { fileURLToPath } from "url";
 init_manifest();
-var __dirname = "/home/hasna/.hasna/repos/worktrees/hasna-apps/workspace-repos-guard/apps/hooks/src/lib";
+function resolveBundledHooksDir(moduleDir = dirname2(fileURLToPath(import.meta.url))) {
+  const sourceLayout = join5(moduleDir, "..", "..", "hooks");
+  if (existsSync5(join5(sourceLayout, "hook-gitguard")))
+    return sourceLayout;
+  return join5(moduleDir, "..", "hooks");
+}
 function resolveHookDir(name) {
   const custom2 = readCustomManifest(name);
   if (custom2)
@@ -5830,7 +5836,7 @@ function resolveHookDir(name) {
   if (!meta)
     return;
   const short = shortManifestName(name);
-  const bundledBase = join5(__dirname, "..", "..", "hooks");
+  const bundledBase = resolveBundledHooksDir();
   const direct = join5(bundledBase, short);
   if (existsSync5(direct))
     return direct;
@@ -5895,7 +5901,7 @@ function resolveHook(name) {
 }
 
 // src/lib/installer.ts
-var __dirname2 = dirname2(fileURLToPath(import.meta.url));
+var __dirname2 = dirname3(fileURLToPath2(import.meta.url));
 var HOOKS_DIR = existsSync6(join6(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join6(__dirname2, "..", "..", "hooks") : join6(__dirname2, "..", "hooks");
 function normalizeHookName(name) {
   return name.startsWith("hook-") ? name : `hook-${name}`;
@@ -5993,7 +5999,7 @@ function readSettings(scope = "global", target = "claude") {
 }
 function writeSettings(settings, scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
-  const dir = dirname2(path);
+  const dir = dirname3(path);
   if (!existsSync6(dir)) {
     mkdirSync4(dir, { recursive: true });
   }
@@ -6090,7 +6096,7 @@ function readCodewithConfig(scope, configPath) {
 }
 function appendCodewithFragment(fragment, scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
-  const dir = dirname2(path);
+  const dir = dirname3(path);
   if (!existsSync6(dir))
     mkdirSync4(dir, { recursive: true });
   const existing = existsSync6(path) ? readFileSync4(path, "utf-8") : "";
@@ -6476,10 +6482,17 @@ function collectBundledCatalog() {
   return out;
 }
 async function fetchJson(base, path) {
+  const headers = { accept: "application/json" };
+  const apiKey = resolveApiKey();
+  if (apiKey)
+    headers["x-api-key"] = apiKey;
   const res = await fetch(`${base}${path}`, {
-    headers: { accept: "application/json" },
+    headers,
     signal: AbortSignal.timeout(15000)
   });
+  if (res.status === 401) {
+    throw new Error("registry requires API key \u2014 set HASNA_HOOKS_API_KEY or HOOKS_API_KEY (vault-delivered, never stored)");
+  }
   if (!res.ok) {
     throw new Error(`GET ${path} failed with status ${res.status}`);
   }
@@ -6594,6 +6607,21 @@ async function syncHooks(options = {}) {
 init_manifest();
 init_store();
 init_config();
+
+// src/lib/secure-compare.ts
+function secureEqual(a, b) {
+  const enc = new TextEncoder;
+  const ab = enc.encode(a);
+  const bb = enc.encode(b);
+  let diff = ab.length ^ bb.length;
+  const n = Math.max(ab.length, bb.length);
+  for (let i = 0;i < n; i++) {
+    diff |= (ab[i] ?? 0) ^ (bb[i] ?? 0);
+  }
+  return diff === 0;
+}
+
+// src/serve.ts
 var DEFAULT_SERVE_PORT = 39428;
 var SERVE_HOST = "127.0.0.1";
 var SERVE_SERVICE_NAME = "hooks-registry";
@@ -6649,8 +6677,8 @@ function authorized(req, apiKey) {
     return false;
   const header = req.headers.get("authorization") ?? "";
   if (header.startsWith("Bearer "))
-    return header.slice("Bearer ".length) === apiKey;
-  return req.headers.get("x-api-key") === apiKey;
+    return secureEqual(header.slice("Bearer ".length), apiKey);
+  return secureEqual(req.headers.get("x-api-key") ?? "", apiKey);
 }
 function json(body, status = 200, headers = {}) {
   return new Response(JSON.stringify(body), {

package/dist/lib/resolve.d.ts

@@ -13,6 +13,14 @@ export interface ResolvedHook {
     scriptPath: string;
     meta: HookMeta;
 }
+/**
+ * Locate the bundled hooks directory at runtime from the executing module's
+ * own location. A bare `__dirname` is baked to the builder's path at bundle
+ * time, so bundled hooks resolve only on the machine that built the package
+ * (0.6.0/0.6.1 regression); `import.meta.url` is preserved at runtime by the
+ * bun build target, so resolution follows the installed package instead.
+ */
+export declare function resolveBundledHooksDir(moduleDir?: string): string;
 export declare function resolveHookDir(name: string): string | undefined;
 export declare function resolveScriptPath(name: string): string | undefined;
 export declare function resolveHookMeta(name: string): HookMeta | undefined;

package/dist/lib/secure-compare.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Constant-time string comparison for API-key checks.
+ *
+ * The loop always runs over the longer input and the result accumulates
+ * XORs, so the timing does not reveal where or whether the values differ.
+ * Available on both the bun/node and workerd runtimes.
+ */
+export declare function secureEqual(a: string, b: string): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/hooks",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "Open source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command",
   "type": "module",
   "bin": {