@hasna/hooks 0.6.1 → 0.6.3

package/bin/index.js

@@ -4288,10 +4288,18 @@ __export(exports_resolve, {
   resolveScriptPath: () => resolveScriptPath,
   resolveHookMeta: () => resolveHookMeta,
   resolveHookDir: () => resolveHookDir,
-  resolveHook: () => resolveHook
+  resolveHook: () => resolveHook,
+  resolveBundledHooksDir: () => resolveBundledHooksDir
 });
-import { join as join4 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 import { existsSync as existsSync4 } from "fs";
+import { fileURLToPath } from "url";
+function resolveBundledHooksDir(moduleDir = dirname2(fileURLToPath(import.meta.url))) {
+  const sourceLayout = join4(moduleDir, "..", "..", "hooks");
+  if (existsSync4(join4(sourceLayout, "hook-gitguard")))
+    return sourceLayout;
+  return join4(moduleDir, "..", "hooks");
+}
 function resolveHookDir(name) {
   const custom = readCustomManifest(name);
   if (custom)
@@ -4300,7 +4308,7 @@ function resolveHookDir(name) {
   if (!meta)
     return;
   const short = shortManifestName(name);
-  const bundledBase = join4(__dirname, "..", "..", "hooks");
+  const bundledBase = resolveBundledHooksDir();
   const direct = join4(bundledBase, short);
   if (existsSync4(direct))
     return direct;
@@ -4363,7 +4371,6 @@ function resolveHook(name) {
     meta
   };
 }
-var __dirname = "/home/hasna/.hasna/repos/worktrees/hasna-apps/workspace-repos-guard/apps/hooks/src/lib";
 var init_resolve = __esm(() => {
   init_registry();
   init_manifest();
@@ -4371,9 +4378,9 @@ var init_resolve = __esm(() => {
 
 // src/lib/installer.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join5, dirname as dirname2 } from "path";
+import { join as join5, dirname as dirname3 } from "path";
 import { homedir as homedir3 } from "os";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 function normalizeHookName(name) {
   return name.startsWith("hook-") ? name : `hook-${name}`;
 }
@@ -4438,7 +4445,7 @@ function readSettings(scope = "global", target = "claude") {
 }
 function writeSettings(settings, scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
-  const dir = dirname2(path);
+  const dir = dirname3(path);
   if (!existsSync5(dir)) {
     mkdirSync3(dir, { recursive: true });
   }
@@ -4535,7 +4542,7 @@ function readCodewithConfig(scope, configPath) {
 }
 function appendCodewithFragment(fragment, scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
-  const dir = dirname2(path);
+  const dir = dirname3(path);
   if (!existsSync5(dir))
     mkdirSync3(dir, { recursive: true });
   const existing = existsSync5(path) ? readFileSync3(path, "utf-8") : "";
@@ -4786,7 +4793,7 @@ var __dirname2, HOOKS_DIR, EVENT_MAP, getInstalledHooks;
 var init_installer = __esm(() => {
   init_registry();
   init_resolve();
-  __dirname2 = dirname2(fileURLToPath(import.meta.url));
+  __dirname2 = dirname3(fileURLToPath2(import.meta.url));
   HOOKS_DIR = existsSync5(join5(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join5(__dirname2, "..", "..", "hooks") : join5(__dirname2, "..", "hooks");
   EVENT_MAP = {
     claude: {
@@ -4823,6 +4830,35 @@ var init_installer = __esm(() => {
   getInstalledHooks = getRegisteredHooks;
 });
 
+// src/lib/registration.ts
+function safeMatcherTest(pattern, value) {
+  try {
+    return new RegExp(pattern).test(value);
+  } catch {
+    return false;
+  }
+}
+function hookRegisteredInSettings(settings, name, eventSpec, hookMatcher) {
+  const separator = eventSpec.indexOf(":");
+  const eventName = separator === -1 ? eventSpec : eventSpec.slice(0, separator);
+  const specMatcher = separator === -1 ? "" : eventSpec.slice(separator + 1);
+  const matcher = specMatcher || hookMatcher || "";
+  const hooks = settings.hooks?.[eventName];
+  if (!Array.isArray(hooks))
+    return false;
+  return hooks.some((entry) => entry?.hooks?.some((h) => {
+    const match = h?.command?.match(/^hooks run ([\w-]+)/);
+    if (!match || match[1] !== name)
+      return false;
+    if (!matcher)
+      return true;
+    const entryMatcher = typeof entry.matcher === "string" ? entry.matcher : "";
+    if (!entryMatcher)
+      return true;
+    return entryMatcher === matcher || safeMatcherTest(entryMatcher, matcher) || safeMatcherTest(matcher, entryMatcher);
+  }));
+}
+
 // src/lib/profiles.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4, readdirSync as readdirSync2, rmSync, cpSync } from "fs";
 import { join as join6 } from "path";
@@ -5460,18 +5496,49 @@ __export(exports_run, {
 });
 import { randomBytes } from "crypto";
 import { rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute2, join as join9 } from "path";
+import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute2, join as join9 } from "path";
 function extensionOf(scriptPath) {
   const base = basename2(scriptPath);
   const dot = base.lastIndexOf(".");
   return dot > 0 ? base.slice(dot + 1) : "ts";
 }
+function shebangInterpreter(firstLine) {
+  if (!firstLine.startsWith("#!"))
+    return null;
+  const rest = firstLine.slice(2).trim();
+  if (!rest)
+    return null;
+  const parts = rest.split(/\s+/);
+  if (parts[0] === "env" || parts[0] === "/usr/bin/env") {
+    return parts[1] && parts[1] !== "-S" ? basename2(parts[1]) : parts[2] ? basename2(parts[2]) : null;
+  }
+  return basename2(parts[0]);
+}
+function interpreterFor(name, scriptPath, content) {
+  const ext = extensionOf(scriptPath);
+  const firstLine = content.subarray(0, 512).toString("utf8").split(`
+`, 1)[0] ?? "";
+  const interp = shebangInterpreter(firstLine);
+  if (interp) {
+    if (interp === "bash" || interp === "sh")
+      return { command: ["/bin/bash"], tempExt: "sh" };
+    if (interp === "node" || interp === "bun")
+      return { command: ["bun", "run"], tempExt: BUN_EXTENSIONS.has(ext) ? ext : "ts" };
+    throw new Error(`Refusing to run hook '${name}': shebang '${firstLine}' is not a recognized interpreter (supported: bash/sh, node/bun)`);
+  }
+  if (BASH_EXTENSIONS.has(ext))
+    return { command: ["/bin/bash"], tempExt: "sh" };
+  if (BUN_EXTENSIONS.has(ext))
+    return { command: ["bun", "run"], tempExt: ext };
+  throw new Error(`Refusing to run hook '${name}': unsupported script extension '.${ext}' (supported: .sh .bash .ts .tsx .js .jsx .mjs .cjs .mts .cts, or a recognized shebang)`);
+}
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname3(options.scriptPath);
-  const tempPath = join9(scriptDir, `.hooks-verified-${randomBytes(12).toString("hex")}.${extensionOf(options.scriptPath)}`);
+  const scriptDir = dirname4(options.scriptPath);
+  const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
+  const tempPath = join9(scriptDir, `.hooks-verified-${randomBytes(12).toString("hex")}.${interpreter.tempExt}`);
   try {
     writeFileSync6(tempPath, options.content, { flag: "wx", mode: 384 });
-    const proc = Bun.spawn(["bun", "run", isAbsolute2(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
+    const proc = Bun.spawn([...interpreter.command, isAbsolute2(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
       stdin: new Response(options.stdin),
       stdout: "pipe",
       stderr: "pipe",
@@ -5490,7 +5557,11 @@ async function executeVerifiedScript(options) {
     } catch {}
   }
 }
-var init_run = () => {};
+var BASH_EXTENSIONS, BUN_EXTENSIONS;
+var init_run = __esm(() => {
+  BASH_EXTENSIONS = new Set(["sh", "bash"]);
+  BUN_EXTENSIONS = new Set(["ts", "tsx", "js", "jsx", "mjs", "cjs", "mts", "cts"]);
+});
 
 // src/lib/custom-install.ts
 var exports_custom_install = {};
@@ -6036,6 +6107,19 @@ var init_storage = __esm(() => {
   init_pg_migrations();
 });
 
+// src/lib/secure-compare.ts
+function secureEqual(a, b) {
+  const enc = new TextEncoder;
+  const ab = enc.encode(a);
+  const bb = enc.encode(b);
+  let diff = ab.length ^ bb.length;
+  const n = Math.max(ab.length, bb.length);
+  for (let i = 0;i < n; i++) {
+    diff |= (ab[i] ?? 0) ^ (bb[i] ?? 0);
+  }
+  return diff === 0;
+}
+
 // src/serve.ts
 var exports_serve = {};
 __export(exports_serve, {
@@ -6097,8 +6181,8 @@ function authorized(req, apiKey) {
     return false;
   const header = req.headers.get("authorization") ?? "";
   if (header.startsWith("Bearer "))
-    return header.slice("Bearer ".length) === apiKey;
-  return req.headers.get("x-api-key") === apiKey;
+    return secureEqual(header.slice("Bearer ".length), apiKey);
+  return secureEqual(req.headers.get("x-api-key") ?? "", apiKey);
 }
 function json(body, status = 200, headers = {}) {
   return new Response(JSON.stringify(body), {
@@ -6200,10 +6284,17 @@ function collectBundledCatalog() {
   return out;
 }
 async function fetchJson(base, path) {
+  const headers = { accept: "application/json" };
+  const apiKey = resolveApiKey();
+  if (apiKey)
+    headers["x-api-key"] = apiKey;
   const res = await fetch(`${base}${path}`, {
-    headers: { accept: "application/json" },
+    headers,
     signal: AbortSignal.timeout(15000)
   });
+  if (res.status === 401) {
+    throw new Error("registry requires API key \u2014 set HASNA_HOOKS_API_KEY or HOOKS_API_KEY (vault-delivered, never stored)");
+  }
   if (!res.ok) {
     throw new Error(`GET ${path} failed with status ${res.status}`);
   }
@@ -6418,8 +6509,8 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z as z2 } from "zod";
 import { createServer } from "http";
 import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
-import { join as join11, dirname as dirname4 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { join as join11, dirname as dirname5 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 async function runVerifiedHook(name, scriptPath, stdin, timeoutMs) {
   const content = readFileSync9(scriptPath);
   const check = checkScriptHash(name, sha256Of(content));
@@ -6594,13 +6685,9 @@ function createHooksServer() {
       if (meta && settingsExist) {
         try {
           const settings = JSON.parse(readFileSync9(settingsPath, "utf-8"));
-          const eventHooks = settings.hooks?.[meta.event] || [];
-          const found = eventHooks.some((entry) => entry.hooks?.some((h) => {
-            const match = h.command?.match(/^hooks run ([\w-]+)/);
-            return match && match[1] === name;
-          }));
-          if (!found) {
-            issues.push({ hook: name, issue: `Not registered under correct event (${meta.event})`, severity: "error" });
+          if (!hookRegisteredInSettings(settings, name, meta.event, meta.matcher)) {
+            const eventName = meta.event.split(":")[0];
+            issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
             hookHealthy = false;
           }
         } catch {}
@@ -6957,8 +7044,8 @@ function createHooksServer() {
       disabled.push(name);
     settings.hooks.__disabled = disabled;
     const { writeFileSync: writeFileSync7, mkdirSync: mkdirSync8 } = await import("fs");
-    const { dirname: dirname5 } = await import("path");
-    mkdirSync8(dirname5(settingsPath), { recursive: true });
+    const { dirname: dirname6 } = await import("path");
+    mkdirSync8(dirname6(settingsPath), { recursive: true });
     writeFileSync7(settingsPath, JSON.stringify(settings, null, 2) + `
 `);
     return { content: [{ type: "text", text: JSON.stringify({ hook: name, disabled: true, scope }) }] };
@@ -7290,7 +7377,7 @@ var init_server = __esm(() => {
   init_resolve();
   init_store();
   init_storage();
-  __dirname3 = dirname4(fileURLToPath2(import.meta.url));
+  __dirname3 = dirname5(fileURLToPath3(import.meta.url));
   pkg = { name: "@hasna/hooks", version: "0.0.0" };
   try {
     for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
@@ -8567,8 +8654,8 @@ var {
 // src/cli/index.tsx
 import chalk2 from "chalk";
 import { existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
-import { join as join12, dirname as dirname5 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { join as join12, dirname as dirname6 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 
 // src/cli/components/App.tsx
 import { useState as useState7 } from "react";
@@ -9746,7 +9833,7 @@ init_profiles();
 init_manifest();
 init_resolve();
 import { jsxDEV as jsxDEV8 } from "react/jsx-dev-runtime";
-var __dirname4 = dirname5(fileURLToPath3(import.meta.url));
+var __dirname4 = dirname6(fileURLToPath4(import.meta.url));
 var pkgPath = existsSync12(join12(__dirname4, "..", "package.json")) ? join12(__dirname4, "..", "package.json") : join12(__dirname4, "..", "..", "package.json");
 var pkg2 = JSON.parse(readFileSync10(pkgPath, "utf-8"));
 var program2 = new Command;
@@ -10312,13 +10399,9 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
     if (meta && settingsExist) {
       try {
         const settings = JSON.parse(readFileSync10(settingsPath, "utf-8"));
-        const eventHooks = settings.hooks?.[meta.event] || [];
-        const found = eventHooks.some((entry) => entry.hooks?.some((h) => {
-          const match = h.command?.match(/^hooks run ([\w-]+)/);
-          return match && match[1] === name;
-        }));
-        if (!found) {
-          issues.push({ hook: name, issue: `Not registered under correct event (${meta.event})`, severity: "error" });
+        if (!hookRegisteredInSettings(settings, name, meta.event, meta.matcher)) {
+          const eventName = meta.event.split(":")[0];
+          issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
           hookHealthy = false;
         }
       } catch {}

package/bin/serve.js

@@ -5051,9 +5051,15 @@ function retrustHook(name, scriptPath, version, source) {
 }
 
 // src/lib/resolve.ts
-import { join as join5 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 import { existsSync as existsSync5 } from "fs";
-var __dirname = "/home/hasna/.hasna/repos/worktrees/hasna-apps/workspace-repos-guard/apps/hooks/src/lib";
+import { fileURLToPath } from "url";
+function resolveBundledHooksDir(moduleDir = dirname2(fileURLToPath(import.meta.url))) {
+  const sourceLayout = join5(moduleDir, "..", "..", "hooks");
+  if (existsSync5(join5(sourceLayout, "hook-gitguard")))
+    return sourceLayout;
+  return join5(moduleDir, "..", "hooks");
+}
 function resolveHookDir(name) {
   const custom2 = readCustomManifest(name);
   if (custom2)
@@ -5062,7 +5068,7 @@ function resolveHookDir(name) {
   if (!meta)
     return;
   const short = shortManifestName(name);
-  const bundledBase = join5(__dirname, "..", "..", "hooks");
+  const bundledBase = resolveBundledHooksDir();
   const direct = join5(bundledBase, short);
   if (existsSync5(direct))
     return direct;
@@ -5126,6 +5132,19 @@ function resolveHook(name) {
   };
 }
 
+// src/lib/secure-compare.ts
+function secureEqual(a, b) {
+  const enc = new TextEncoder;
+  const ab = enc.encode(a);
+  const bb = enc.encode(b);
+  let diff = ab.length ^ bb.length;
+  const n = Math.max(ab.length, bb.length);
+  for (let i = 0;i < n; i++) {
+    diff |= (ab[i] ?? 0) ^ (bb[i] ?? 0);
+  }
+  return diff === 0;
+}
+
 // src/serve.ts
 var DEFAULT_SERVE_PORT = 39428;
 var SERVE_HOST = "127.0.0.1";
@@ -5182,8 +5201,8 @@ function authorized(req, apiKey) {
     return false;
   const header = req.headers.get("authorization") ?? "";
   if (header.startsWith("Bearer "))
-    return header.slice("Bearer ".length) === apiKey;
-  return req.headers.get("x-api-key") === apiKey;
+    return secureEqual(header.slice("Bearer ".length), apiKey);
+  return secureEqual(req.headers.get("x-api-key") ?? "", apiKey);
 }
 function json(body, status = 200, headers = {}) {
   return new Response(JSON.stringify(body), {

package/dist/index.js

@@ -4849,18 +4849,49 @@ __export(exports_run, {
 });
 import { randomBytes } from "crypto";
 import { rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute2, join as join9 } from "path";
+import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute2, join as join9 } from "path";
 function extensionOf(scriptPath) {
   const base = basename2(scriptPath);
   const dot = base.lastIndexOf(".");
   return dot > 0 ? base.slice(dot + 1) : "ts";
 }
+function shebangInterpreter(firstLine) {
+  if (!firstLine.startsWith("#!"))
+    return null;
+  const rest = firstLine.slice(2).trim();
+  if (!rest)
+    return null;
+  const parts = rest.split(/\s+/);
+  if (parts[0] === "env" || parts[0] === "/usr/bin/env") {
+    return parts[1] && parts[1] !== "-S" ? basename2(parts[1]) : parts[2] ? basename2(parts[2]) : null;
+  }
+  return basename2(parts[0]);
+}
+function interpreterFor(name, scriptPath, content) {
+  const ext = extensionOf(scriptPath);
+  const firstLine = content.subarray(0, 512).toString("utf8").split(`
+`, 1)[0] ?? "";
+  const interp = shebangInterpreter(firstLine);
+  if (interp) {
+    if (interp === "bash" || interp === "sh")
+      return { command: ["/bin/bash"], tempExt: "sh" };
+    if (interp === "node" || interp === "bun")
+      return { command: ["bun", "run"], tempExt: BUN_EXTENSIONS.has(ext) ? ext : "ts" };
+    throw new Error(`Refusing to run hook '${name}': shebang '${firstLine}' is not a recognized interpreter (supported: bash/sh, node/bun)`);
+  }
+  if (BASH_EXTENSIONS.has(ext))
+    return { command: ["/bin/bash"], tempExt: "sh" };
+  if (BUN_EXTENSIONS.has(ext))
+    return { command: ["bun", "run"], tempExt: ext };
+  throw new Error(`Refusing to run hook '${name}': unsupported script extension '.${ext}' (supported: .sh .bash .ts .tsx .js .jsx .mjs .cjs .mts .cts, or a recognized shebang)`);
+}
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname3(options.scriptPath);
-  const tempPath = join9(scriptDir, `.hooks-verified-${randomBytes(12).toString("hex")}.${extensionOf(options.scriptPath)}`);
+  const scriptDir = dirname4(options.scriptPath);
+  const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
+  const tempPath = join9(scriptDir, `.hooks-verified-${randomBytes(12).toString("hex")}.${interpreter.tempExt}`);
   try {
     writeFileSync6(tempPath, options.content, { flag: "wx", mode: 384 });
-    const proc = Bun.spawn(["bun", "run", isAbsolute2(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
+    const proc = Bun.spawn([...interpreter.command, isAbsolute2(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
       stdin: new Response(options.stdin),
       stdout: "pipe",
       stderr: "pipe",
@@ -4879,7 +4910,11 @@ async function executeVerifiedScript(options) {
     } catch {}
   }
 }
-var init_run = () => {};
+var BASH_EXTENSIONS, BUN_EXTENSIONS;
+var init_run = __esm(() => {
+  BASH_EXTENSIONS = new Set(["sh", "bash"]);
+  BUN_EXTENSIONS = new Set(["ts", "tsx", "js", "jsx", "mjs", "cjs", "mts", "cts"]);
+});
 
 // src/db/storage-sync.ts
 init_db();
@@ -5813,15 +5848,21 @@ function getHook(name) {
 }
 // src/lib/installer.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { join as join6, dirname as dirname2 } from "path";
+import { join as join6, dirname as dirname3 } from "path";
 import { homedir as homedir4 } from "os";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/lib/resolve.ts
-import { join as join5 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 import { existsSync as existsSync5 } from "fs";
+import { fileURLToPath } from "url";
 init_manifest();
-var __dirname = "/home/hasna/.hasna/repos/worktrees/hasna-apps/workspace-repos-guard/apps/hooks/src/lib";
+function resolveBundledHooksDir(moduleDir = dirname2(fileURLToPath(import.meta.url))) {
+  const sourceLayout = join5(moduleDir, "..", "..", "hooks");
+  if (existsSync5(join5(sourceLayout, "hook-gitguard")))
+    return sourceLayout;
+  return join5(moduleDir, "..", "hooks");
+}
 function resolveHookDir(name) {
   const custom2 = readCustomManifest(name);
   if (custom2)
@@ -5830,7 +5871,7 @@ function resolveHookDir(name) {
   if (!meta)
     return;
   const short = shortManifestName(name);
-  const bundledBase = join5(__dirname, "..", "..", "hooks");
+  const bundledBase = resolveBundledHooksDir();
   const direct = join5(bundledBase, short);
   if (existsSync5(direct))
     return direct;
@@ -5895,7 +5936,7 @@ function resolveHook(name) {
 }
 
 // src/lib/installer.ts
-var __dirname2 = dirname2(fileURLToPath(import.meta.url));
+var __dirname2 = dirname3(fileURLToPath2(import.meta.url));
 var HOOKS_DIR = existsSync6(join6(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join6(__dirname2, "..", "..", "hooks") : join6(__dirname2, "..", "hooks");
 function normalizeHookName(name) {
   return name.startsWith("hook-") ? name : `hook-${name}`;
@@ -5993,7 +6034,7 @@ function readSettings(scope = "global", target = "claude") {
 }
 function writeSettings(settings, scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
-  const dir = dirname2(path);
+  const dir = dirname3(path);
   if (!existsSync6(dir)) {
     mkdirSync4(dir, { recursive: true });
   }
@@ -6090,7 +6131,7 @@ function readCodewithConfig(scope, configPath) {
 }
 function appendCodewithFragment(fragment, scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
-  const dir = dirname2(path);
+  const dir = dirname3(path);
   if (!existsSync6(dir))
     mkdirSync4(dir, { recursive: true });
   const existing = existsSync6(path) ? readFileSync4(path, "utf-8") : "";
@@ -6476,10 +6517,17 @@ function collectBundledCatalog() {
   return out;
 }
 async function fetchJson(base, path) {
+  const headers = { accept: "application/json" };
+  const apiKey = resolveApiKey();
+  if (apiKey)
+    headers["x-api-key"] = apiKey;
   const res = await fetch(`${base}${path}`, {
-    headers: { accept: "application/json" },
+    headers,
     signal: AbortSignal.timeout(15000)
   });
+  if (res.status === 401) {
+    throw new Error("registry requires API key \u2014 set HASNA_HOOKS_API_KEY or HOOKS_API_KEY (vault-delivered, never stored)");
+  }
   if (!res.ok) {
     throw new Error(`GET ${path} failed with status ${res.status}`);
   }
@@ -6594,6 +6642,21 @@ async function syncHooks(options = {}) {
 init_manifest();
 init_store();
 init_config();
+
+// src/lib/secure-compare.ts
+function secureEqual(a, b) {
+  const enc = new TextEncoder;
+  const ab = enc.encode(a);
+  const bb = enc.encode(b);
+  let diff = ab.length ^ bb.length;
+  const n = Math.max(ab.length, bb.length);
+  for (let i = 0;i < n; i++) {
+    diff |= (ab[i] ?? 0) ^ (bb[i] ?? 0);
+  }
+  return diff === 0;
+}
+
+// src/serve.ts
 var DEFAULT_SERVE_PORT = 39428;
 var SERVE_HOST = "127.0.0.1";
 var SERVE_SERVICE_NAME = "hooks-registry";
@@ -6649,8 +6712,8 @@ function authorized(req, apiKey) {
     return false;
   const header = req.headers.get("authorization") ?? "";
   if (header.startsWith("Bearer "))
-    return header.slice("Bearer ".length) === apiKey;
-  return req.headers.get("x-api-key") === apiKey;
+    return secureEqual(header.slice("Bearer ".length), apiKey);
+  return secureEqual(req.headers.get("x-api-key") ?? "", apiKey);
 }
 function json(body, status = 200, headers = {}) {
   return new Response(JSON.stringify(body), {

package/dist/lib/resolve.d.ts

@@ -13,6 +13,14 @@ export interface ResolvedHook {
     scriptPath: string;
     meta: HookMeta;
 }
+/**
+ * Locate the bundled hooks directory at runtime from the executing module's
+ * own location. A bare `__dirname` is baked to the builder's path at bundle
+ * time, so bundled hooks resolve only on the machine that built the package
+ * (0.6.0/0.6.1 regression); `import.meta.url` is preserved at runtime by the
+ * bun build target, so resolution follows the installed package instead.
+ */
+export declare function resolveBundledHooksDir(moduleDir?: string): string;
 export declare function resolveHookDir(name: string): string | undefined;
 export declare function resolveScriptPath(name: string): string | undefined;
 export declare function resolveHookMeta(name: string): HookMeta | undefined;

package/dist/lib/secure-compare.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Constant-time string comparison for API-key checks.
+ *
+ * The loop always runs over the longer input and the result accumulates
+ * XORs, so the timing does not reveal where or whether the values differ.
+ * Available on both the bun/node and workerd runtimes.
+ */
+export declare function secureEqual(a: string, b: string): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/hooks",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "description": "Open source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command",
   "type": "module",
   "bin": {