@hasna/hooks 0.6.2 → 0.6.4

package/bin/index.js

@@ -4354,7 +4354,8 @@ function resolveHook(name) {
       events: custom.manifest.events,
       description: custom.manifest.description ?? "Custom hook",
       scriptPath: custom.scriptPath,
-      meta: meta2
+      meta: meta2,
+      timeoutMs: custom.manifest.timeout_ms ?? null
     };
   }
   const meta = getHook(shortManifestName(name));
@@ -4368,7 +4369,8 @@ function resolveHook(name) {
     events: meta.events && meta.events.length > 0 ? meta.events : [meta.event],
     description: meta.description,
     scriptPath,
-    meta
+    meta,
+    timeoutMs: null
   };
 }
 var init_resolve = __esm(() => {
@@ -4376,1157 +4378,1549 @@ var init_resolve = __esm(() => {
   init_manifest();
 });
 
-// src/lib/installer.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join5, dirname as dirname3 } from "path";
-import { homedir as homedir3 } from "os";
-import { fileURLToPath as fileURLToPath2 } from "url";
-function normalizeHookName(name) {
-  return name.startsWith("hook-") ? name : `hook-${name}`;
-}
-function shortHookName(name) {
-  return name.startsWith("hook-") ? name.slice("hook-".length) : name;
+// src/db/schema.ts
+var CREATE_HOOK_EVENTS_TABLE = `
+  CREATE TABLE IF NOT EXISTS hook_events (
+    id           TEXT PRIMARY KEY,
+    timestamp    TEXT NOT NULL,
+    session_id   TEXT NOT NULL,
+    hook_name    TEXT NOT NULL,
+    event_type   TEXT NOT NULL CHECK (event_type IN ('PreToolUse', 'PostToolUse', 'Stop', 'Notification', 'SessionStart', 'SessionEnd', 'UserPromptSubmit', 'SubagentStart')),
+    tool_name    TEXT,
+    tool_input   TEXT,
+    result       TEXT CHECK (result IN ('continue', 'block', NULL)),
+    error        TEXT,
+    duration_ms  INTEGER,
+    project_dir  TEXT,
+    metadata     TEXT
+  )
+`, CREATE_INDEXES;
+var init_schema = __esm(() => {
+  CREATE_INDEXES = [
+    `CREATE INDEX IF NOT EXISTS idx_hook_events_timestamp  ON hook_events (timestamp)`,
+    `CREATE INDEX IF NOT EXISTS idx_hook_events_session_id ON hook_events (session_id)`,
+    `CREATE INDEX IF NOT EXISTS idx_hook_events_hook_name  ON hook_events (hook_name)`,
+    `CREATE INDEX IF NOT EXISTS idx_hook_events_event_type ON hook_events (event_type)`,
+    `CREATE INDEX IF NOT EXISTS idx_hook_events_errors     ON hook_events (timestamp) WHERE error IS NOT NULL`
+  ];
+});
+
+// src/db/migrations/001_initial.ts
+function up(db) {
+  db.exec(CREATE_HOOK_EVENTS_TABLE);
+  for (const idx of CREATE_INDEXES) {
+    db.exec(idx);
+  }
 }
-function removeHookEntriesByName(entries, hookName) {
-  return entries.filter((entry) => !entry.hooks?.some((h) => {
-    const match = h.command?.match(/^hooks run ([\w-]+)/);
-    return match && match[1] === hookName;
-  }));
+var init_001_initial = __esm(() => {
+  init_schema();
+});
+
+// src/db/migrations/002_session_events.ts
+function up2(db) {
+  const row = db.query("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?").get("hook_events");
+  if (!row?.sql)
+    return;
+  if (row.sql.includes("SessionStart"))
+    return;
+  db.exec("BEGIN");
+  try {
+    db.exec("ALTER TABLE hook_events RENAME TO hook_events_old");
+    db.exec(CREATE_HOOK_EVENTS_TABLE);
+    db.exec(`INSERT INTO hook_events
+         (id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata)
+       SELECT id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata
+       FROM hook_events_old`);
+    db.exec("DROP TABLE hook_events_old");
+    for (const idx of CREATE_INDEXES) {
+      db.exec(idx);
+    }
+    db.exec("COMMIT");
+  } catch (err) {
+    db.exec("ROLLBACK");
+    throw err;
+  }
 }
-function getTargetSettingsDir(target) {
-  if (target === "codewith")
-    return ".codewith";
-  if (target === "gemini")
-    return ".gemini";
-  return ".claude";
+var init_002_session_events = __esm(() => {
+  init_schema();
+});
+
+// src/db/migrations/003_user_prompt_submit_event.ts
+function up3(db) {
+  const row = db.query("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?").get("hook_events");
+  if (!row?.sql)
+    return;
+  if (row.sql.includes("UserPromptSubmit"))
+    return;
+  db.exec("BEGIN");
+  try {
+    db.exec("ALTER TABLE hook_events RENAME TO hook_events_old");
+    db.exec(CREATE_HOOK_EVENTS_TABLE);
+    db.exec(`INSERT INTO hook_events
+         (id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata)
+       SELECT id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata
+       FROM hook_events_old`);
+    db.exec("DROP TABLE hook_events_old");
+    for (const idx of CREATE_INDEXES) {
+      db.exec(idx);
+    }
+    db.exec("COMMIT");
+  } catch (err) {
+    db.exec("ROLLBACK");
+    throw err;
+  }
 }
-function getGlobalSettingsPathOverride(target) {
-  if (target === "claude")
-    return process.env.HASNA_HOOKS_CLAUDE_SETTINGS_PATH;
-  if (target === "gemini")
-    return process.env.HASNA_HOOKS_GEMINI_SETTINGS_PATH;
-  return;
+var init_003_user_prompt_submit_event = __esm(() => {
+  init_schema();
+});
+
+// src/db/migrations/004_hooks_table.ts
+function up4(db) {
+  db.exec(CREATE_HOOKS_TABLE);
+  for (const idx of CREATE_HOOKS_INDEXES) {
+    db.exec(idx);
+  }
 }
-function getSettingsPath(scope = "global", target = "claude", codewithConfigPath) {
-  if (target === "codewith" && codewithConfigPath)
-    return codewithConfigPath;
-  if (target === "codewith" && process.env.HASNA_HOOKS_CODEWITH_CONFIG_PATH) {
-    return process.env.HASNA_HOOKS_CODEWITH_CONFIG_PATH;
+var CREATE_HOOKS_TABLE = `
+  CREATE TABLE IF NOT EXISTS hooks (
+    id               TEXT PRIMARY KEY,
+    name             TEXT NOT NULL,
+    version          TEXT NOT NULL,
+    sha256           TEXT NOT NULL,
+    source_type      TEXT NOT NULL,
+    source_ref       TEXT,
+    installed_at     TEXT NOT NULL,
+    enabled          INTEGER NOT NULL DEFAULT 1,
+    last_verified_at TEXT
+  )
+`, CREATE_HOOKS_INDEXES;
+var init_004_hooks_table = __esm(() => {
+  CREATE_HOOKS_INDEXES = [
+    `CREATE INDEX IF NOT EXISTS idx_hooks_name ON hooks (name)`
+  ];
+});
+
+// src/db/migrations/005_subagent_start_event.ts
+function up5(db) {
+  const row = db.query("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?").get("hook_events");
+  if (!row?.sql)
+    return;
+  if (row.sql.includes("SubagentStart"))
+    return;
+  db.exec("BEGIN");
+  try {
+    db.exec("ALTER TABLE hook_events RENAME TO hook_events_old");
+    db.exec(CREATE_HOOK_EVENTS_TABLE);
+    db.exec(`INSERT INTO hook_events
+         (id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata)
+       SELECT id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata
+       FROM hook_events_old`);
+    db.exec("DROP TABLE hook_events_old");
+    for (const idx of CREATE_INDEXES) {
+      db.exec(idx);
+    }
+    db.exec("COMMIT");
+  } catch (err) {
+    db.exec("ROLLBACK");
+    throw err;
   }
-  const globalOverride = scope === "global" ? getGlobalSettingsPathOverride(target) : undefined;
-  if (globalOverride)
-    return globalOverride;
-  const dir = getTargetSettingsDir(target);
-  if (scope === "project") {
-    return target === "codewith" ? join5(process.cwd(), dir, "config.toml") : join5(process.cwd(), dir, "settings.json");
+}
+var init_005_subagent_start_event = __esm(() => {
+  init_schema();
+});
+
+// src/db/migrations/index.ts
+function ensureMigrationsTable(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS schema_migrations (
+      version    TEXT PRIMARY KEY,
+      applied_at TEXT NOT NULL
+    )
+  `);
+}
+function getApplied(db) {
+  const rows = db.query("SELECT version FROM schema_migrations").all();
+  return new Set(rows.map((r) => r.version));
+}
+function runMigrations(db) {
+  ensureMigrationsTable(db);
+  const applied = getApplied(db);
+  for (const migration of MIGRATIONS) {
+    if (applied.has(migration.version))
+      continue;
+    migration.up(db);
+    db.run("INSERT INTO schema_migrations (version, applied_at) VALUES (?, ?)", [
+      migration.version,
+      new Date().toISOString()
+    ]);
   }
-  return target === "codewith" ? join5(homedir3(), dir, "config.toml") : join5(homedir3(), dir, "settings.json");
 }
-function getHookPath(name) {
-  const shortName = shortHookName(name);
-  const resolved = resolveHookDir(shortName);
-  if (resolved)
-    return resolved;
-  return join5(HOOKS_DIR, normalizeHookName(shortName));
+var MIGRATIONS;
+var init_migrations = __esm(() => {
+  init_001_initial();
+  init_002_session_events();
+  init_003_user_prompt_submit_event();
+  init_004_hooks_table();
+  init_005_subagent_start_event();
+  MIGRATIONS = [
+    { version: "001_initial", up },
+    { version: "002_session_events", up: up2 },
+    { version: "003_user_prompt_submit_event", up: up3 },
+    { version: "004_hooks_table", up: up4 },
+    { version: "005_subagent_start_event", up: up5 }
+  ];
+});
+
+// src/db/legacy-import.ts
+import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join5 } from "path";
+import { homedir as homedir3 } from "os";
+function ensureMetaTable(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS _meta (
+      key   TEXT PRIMARY KEY,
+      value TEXT NOT NULL
+    )
+  `);
 }
-function hookExists(name) {
-  return existsSync5(getHookPath(name));
+function isAlreadyDone(db) {
+  ensureMetaTable(db);
+  const row = db.query("SELECT value FROM _meta WHERE key = ?").get(META_KEY);
+  return row?.value === "1";
 }
-function readSettings(scope = "global", target = "claude") {
-  const path = getSettingsPath(scope, target);
+function markDone(db) {
+  db.run("INSERT OR REPLACE INTO _meta (key, value) VALUES (?, ?)", [META_KEY, "1"]);
+}
+function nanoid() {
+  return crypto.randomUUID().replace(/-/g, "").slice(0, 21);
+}
+function importJsonlFile(db, filePath) {
+  let count = 0;
+  try {
+    const lines = readFileSync3(filePath, "utf-8").split(`
+`).filter(Boolean);
+    for (const line of lines) {
+      try {
+        const entry = JSON.parse(line);
+        db.run(`INSERT OR IGNORE INTO hook_events
+            (id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, project_dir)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [
+          nanoid(),
+          entry.timestamp ?? new Date().toISOString(),
+          entry.session_id ?? "legacy",
+          "sessionlog",
+          "PostToolUse",
+          entry.tool_name ?? null,
+          entry.tool_input ? String(entry.tool_input).slice(0, 500) : null,
+          null
+        ]);
+        count++;
+      } catch {}
+    }
+  } catch {}
+  return count;
+}
+function importErrorsLog(db, filePath) {
+  let count = 0;
   try {
-    if (existsSync5(path)) {
-      return JSON.parse(readFileSync3(path, "utf-8"));
+    const lines = readFileSync3(filePath, "utf-8").split(`
+`).filter(Boolean);
+    const linePattern = /^\[(.+?)\]\s+(?:\[session:(\S+)\]\s+)?(.+?)\s+\u2014\s+(.+)$/;
+    for (const line of lines) {
+      try {
+        const m = line.match(linePattern);
+        if (!m)
+          continue;
+        const [, timestamp, sessionPrefix, , errorMsg] = m;
+        db.run(`INSERT OR IGNORE INTO hook_events
+            (id, timestamp, session_id, hook_name, event_type, error)
+           VALUES (?, ?, ?, ?, ?, ?)`, [
+          nanoid(),
+          timestamp,
+          sessionPrefix ? `legacy-${sessionPrefix}` : "legacy",
+          "errornotify",
+          "PostToolUse",
+          errorMsg.slice(0, 500)
+        ]);
+        count++;
+      } catch {}
     }
-  } catch (error) {
-    console.warn(`[hooks] Failed to read settings at ${path}: ${error instanceof Error ? error.message : String(error)}`);
+  } catch {}
+  return count;
+}
+function runLegacyImport(db, homeDir = homedir3()) {
+  try {
+    if (isAlreadyDone(db))
+      return;
+    let total = 0;
+    const claudeProjectsDir = join5(homeDir, ".claude", "projects");
+    if (existsSync5(claudeProjectsDir)) {
+      try {
+        const projectDirs = readdirSync2(claudeProjectsDir);
+        for (const dir of projectDirs) {
+          const projectDir = join5(claudeProjectsDir, dir);
+          try {
+            const files = readdirSync2(projectDir);
+            for (const file of files) {
+              if (file.match(/^session-log-\d{4}-\d{2}-\d{2}\.jsonl$/)) {
+                total += importJsonlFile(db, join5(projectDir, file));
+              }
+              if (file === "errors.log") {
+                total += importErrorsLog(db, join5(projectDir, file));
+              }
+            }
+          } catch {}
+        }
+      } catch {}
+    }
+    markDone(db);
+    if (total > 0) {
+      process.stderr.write(`[hooks] Imported ${total} legacy log entries into SQLite.
+`);
+    }
+  } catch (err) {
+    process.stderr.write(`[hooks] Legacy import failed (non-fatal): ${err}
+`);
   }
-  return {};
 }
-function writeSettings(settings, scope = "global", target = "claude") {
-  const path = getSettingsPath(scope, target);
-  const dir = dirname3(path);
-  if (!existsSync5(dir)) {
+var META_KEY = "legacy_import_done";
+var init_legacy_import = () => {};
+
+// src/db/retention.ts
+function runRetention(db, days) {
+  const envDays = parseInt(process.env.HOOKS_RETENTION_DAYS ?? "30");
+  const retentionDays = days ?? (isNaN(envDays) || envDays <= 0 ? 30 : envDays);
+  const cutoff = new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1000).toISOString();
+  try {
+    db.run("DELETE FROM hook_events WHERE timestamp < ?", [cutoff]);
+    const changes = db.query("SELECT changes() as changes").get()?.changes ?? 0;
+    return changes;
+  } catch {
+    return 0;
+  }
+}
+
+// src/db/index.ts
+var exports_db = {};
+__export(exports_db, {
+  getDbPath: () => getDbPath,
+  getDb: () => getDb,
+  createTestDb: () => createTestDb,
+  closeDb: () => closeDb
+});
+import { Database } from "bun:sqlite";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, cpSync } from "fs";
+import { join as join6 } from "path";
+import { homedir as homedir4 } from "os";
+function resolveDataDir() {
+  const explicit = process.env.HASNA_HOOKS_DATA_DIR ?? process.env.HOOKS_DATA_DIR;
+  if (explicit)
+    return explicit;
+  const newDir = join6(homedir4(), ".hasna", "hooks");
+  const oldDir = join6(homedir4(), ".hooks");
+  if (!existsSync6(newDir) && existsSync6(oldDir)) {
+    mkdirSync3(join6(homedir4(), ".hasna"), { recursive: true });
+    cpSync(oldDir, newDir, { recursive: true });
+  }
+  return newDir;
+}
+function getDbPath() {
+  const explicitDb = process.env.HASNA_HOOKS_DB_PATH ?? process.env.HOOKS_DB_PATH;
+  if (explicitDb)
+    return explicitDb;
+  const dataDir = resolveDataDir();
+  return join6(dataDir, "hooks.db");
+}
+function ensureDir(dbPath) {
+  const dir = dbPath.substring(0, dbPath.lastIndexOf("/"));
+  if (dir && !existsSync6(dir)) {
     mkdirSync3(dir, { recursive: true });
   }
-  writeFileSync3(path, JSON.stringify(settings, null, 2) + `
-`);
 }
-function getTargetEventName(internalEvent, target) {
-  return EVENT_MAP[target]?.[internalEvent] ?? null;
+function getDb() {
+  if (instance)
+    return instance;
+  const dbPath = getDbPath();
+  const isNew = dbPath === ":memory:" || !existsSync6(dbPath);
+  ensureDir(dbPath);
+  instance = new Database(dbPath);
+  instance.exec("PRAGMA busy_timeout=5000");
+  instance.exec("PRAGMA journal_mode=WAL");
+  instance.exec("PRAGMA foreign_keys=ON");
+  runMigrations(instance);
+  runRetention(instance);
+  instance.exec(`CREATE TABLE IF NOT EXISTS feedback (
+    id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),
+    message TEXT NOT NULL,
+    email TEXT,
+    category TEXT DEFAULT 'general',
+    version TEXT,
+    machine_id TEXT,
+    created_at TEXT NOT NULL DEFAULT (datetime('now'))
+  )`);
+  if (isNew) {
+    runLegacyImport(instance);
+  }
+  return instance;
+}
+function closeDb() {
+  if (instance) {
+    instance.close();
+    instance = null;
+  }
+}
+function createTestDb() {
+  const db = new Database(":memory:");
+  db.exec("PRAGMA journal_mode=WAL");
+  db.exec("PRAGMA foreign_keys=ON");
+  return db;
 }
-function isEventSupported(internalEvent, target) {
-  return getTargetEventName(internalEvent, target) !== null;
+var instance = null;
+var init_db = __esm(() => {
+  init_migrations();
+  init_legacy_import();
+});
+
+// src/lib/store.ts
+var exports_store = {};
+__export(exports_store, {
+  writeLock: () => writeLock,
+  verifyScriptHash: () => verifyScriptHash,
+  upsertHookRecord: () => upsertHookRecord,
+  sha256Of: () => sha256Of,
+  sha256File: () => sha256File,
+  setPinnedHook: () => setPinnedHook,
+  retrustHook: () => retrustHook,
+  removePinnedHook: () => removePinnedHook,
+  removeHookRecord: () => removeHookRecord,
+  removeHookFromStore: () => removeHookFromStore,
+  readLock: () => readLock,
+  pinInstalledHook: () => pinInstalledHook,
+  listHookRecords: () => listHookRecords,
+  getPinnedHook: () => getPinnedHook,
+  getHookRecord: () => getHookRecord,
+  checkScriptHash: () => checkScriptHash
+});
+import { createHash } from "crypto";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { readFile as readFile2 } from "fs/promises";
+function sha256Of(input) {
+  return createHash("sha256").update(input).digest("hex");
 }
-function tomlString(value) {
-  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+async function sha256File(path) {
+  const buf = await readFile2(path);
+  return sha256Of(buf);
 }
-function codewithMatcher(matcher) {
-  if (!matcher)
-    return;
-  if (matcher.startsWith("^"))
-    return matcher;
-  if (matcher.includes("|"))
-    return `^(${matcher})$`;
-  return `^${matcher}$`;
+function getHookRecord(db, name) {
+  return db.query("SELECT * FROM hooks WHERE name = ?").get(name);
 }
-function codewithTimeout(name) {
-  switch (name) {
-    case "knowledge-context":
-      return 6;
-    case "session-start":
-      return 8;
-    case "pre-bash":
-      return 20;
-    case "prompt-guard":
-      return 3;
-    case "worktree-guard":
-    case "stop-sync":
-      return 5;
-    default:
-      return 10;
-  }
+function listHookRecords(db) {
+  return db.query("SELECT * FROM hooks ORDER BY name").all();
 }
-function codewithStatusMessage(name) {
-  switch (name) {
-    case "knowledge-context":
-      return "Loading Knowledge context";
-    case "session-start":
-      return "Checking Hasna session context";
-    case "pre-bash":
-      return "Checking Bash safety";
-    case "prompt-guard":
-      return "Checking prompt safety";
-    case "worktree-guard":
-      return "Checking worktree safety";
-    case "stop-sync":
-      return "Syncing turn-end heartbeat";
-    default:
-      return `Running ${name}`;
-  }
+function upsertHookRecord(db, record) {
+  const existing = getHookRecord(db, record.name);
+  const id = existing?.id ?? record.name;
+  const installedAt = existing?.installed_at ?? new Date().toISOString();
+  const enabled = record.enabled ?? existing?.enabled ?? 1;
+  db.run(`INSERT INTO hooks (id, name, version, sha256, source_type, source_ref, installed_at, enabled, last_verified_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(id) DO UPDATE SET
+       version = excluded.version,
+       sha256 = excluded.sha256,
+       source_type = excluded.source_type,
+       source_ref = excluded.source_ref,
+       enabled = excluded.enabled,
+       last_verified_at = excluded.last_verified_at`, [
+    id,
+    record.name,
+    record.version,
+    record.sha256,
+    record.source_type,
+    record.source_ref ?? existing?.source_ref ?? null,
+    installedAt,
+    enabled,
+    record.last_verified_at ?? null
+  ]);
 }
-function buildCodewithTomlFragment(name, profile) {
-  const shortName = shortHookName(name);
-  const meta = resolveHookMeta(shortName);
-  if (!meta)
-    throw new Error(`Hook '${shortName}' not found`);
-  const command = profile ? `hooks run ${shortName} --profile ${profile}` : `hooks run ${shortName}`;
-  const matcher = codewithMatcher(meta.matcher);
-  const fragments = [];
-  for (const event of getHookEvents(meta)) {
-    const eventKey = getTargetEventName(event, "codewith");
-    if (!eventKey) {
-      throw new Error(`Hook '${shortName}' uses event '${event}', which is not supported by the Codewith target`);
-    }
-    const lines = [
-      `[[hooks.${eventKey}]]`
-    ];
-    if (matcher)
-      lines.push(`matcher = ${tomlString(matcher)}`);
-    lines.push("", `[[hooks.${eventKey}.hooks]]`, `type = "command"`, `command = ${tomlString(command)}`, `timeout = ${codewithTimeout(shortName)}`, `statusMessage = ${tomlString(codewithStatusMessage(shortName))}`);
-    fragments.push(lines.join(`
-`));
-  }
-  return `${fragments.join(`
-
-`)}
-`;
+function removeHookRecord(db, name) {
+  const res = db.run("DELETE FROM hooks WHERE name = ?", [name]);
+  return res.changes > 0;
 }
-function readCodewithConfig(scope, configPath) {
-  const path = getSettingsPath(scope, "codewith", configPath);
+function readLock() {
   try {
-    return existsSync5(path) ? readFileSync3(path, "utf-8") : "";
+    const path = getLockPath();
+    if (!existsSync7(path))
+      return { hooks: {} };
+    const parsed = JSON.parse(readFileSync4(path, "utf-8"));
+    return { hooks: parsed.hooks ?? {} };
   } catch {
-    return "";
+    return { hooks: {} };
   }
 }
-function appendCodewithFragment(fragment, scope, configPath) {
-  const path = getSettingsPath(scope, "codewith", configPath);
-  const dir = dirname3(path);
-  if (!existsSync5(dir))
-    mkdirSync3(dir, { recursive: true });
-  const existing = existsSync5(path) ? readFileSync3(path, "utf-8") : "";
-  const sep2 = existing.trim() ? `
-
-` : "";
-  writeFileSync3(path, `${existing.replace(/\s*$/, "")}${sep2}${fragment}`);
+function writeLock(lock) {
+  const path = getLockPath();
+  mkdirSync4(path.substring(0, path.lastIndexOf("/")) || ".", { recursive: true });
+  const sorted = {};
+  for (const name of Object.keys(lock.hooks).sort()) {
+    sorted[name] = lock.hooks[name];
+  }
+  writeFileSync3(path, JSON.stringify({ hooks: sorted }, null, 2) + `
+`, "utf-8");
   return path;
 }
-function detectConflict(name, scope, target) {
-  const meta = resolveHookMeta(name);
-  if (!meta || !meta.matcher)
-    return;
-  const events = new Set(getHookEvents(meta));
-  const registered = getRegisteredHooksForTarget(scope, target);
-  for (const existingName of registered) {
-    if (existingName === name)
-      continue;
-    const existing = getHook(existingName);
-    if (!existing || !existing.matcher)
-      continue;
-    if (!getHookEvents(existing).some((event) => events.has(event)))
-      continue;
-    const a = meta.matcher.toLowerCase();
-    const b = existing.matcher.toLowerCase();
-    if (a === b || a.includes(b) || b.includes(a)) {
-      return `conflicts with '${existingName}' (same event ${meta.event}, overlapping matcher '${existing.matcher}')`;
-    }
-  }
-  return;
+function setPinnedHook(name, entry) {
+  const lock = readLock();
+  lock.hooks[name] = entry;
+  return writeLock(lock);
 }
-function installForTarget(name, scope, overwrite, target, profile, codewithMode = "fragment", codewithConfigPath) {
-  const shortName = shortHookName(name);
-  if (!hookExists(shortName)) {
-    return { hook: shortName, success: false, error: `Hook '${shortName}' not found`, target };
-  }
-  if (target === "codewith") {
-    try {
-      const fragment = buildCodewithTomlFragment(shortName, profile);
-      if (codewithMode !== "write") {
-        return {
-          hook: shortName,
-          success: true,
-          scope,
-          target,
-          fragment,
-          applied: false,
-          note: "Codewith install is fragment-only by default; open-configs should own applying this TOML."
-        };
-      }
-      if (!codewithConfigPath) {
-        return {
-          hook: shortName,
-          success: false,
-          error: "Direct Codewith writes require an explicit --codewith-config path; refusing to write default ~/.codewith/config.toml.",
-          scope,
-          target,
-          fragment,
-          applied: false
-        };
-      }
-      const existing = readCodewithConfig(scope, codewithConfigPath);
-      if (!overwrite && new RegExp(`command\\s*=\\s*["']hooks run ${shortName}(?:\\s|["'])`).test(existing)) {
-        return { hook: shortName, success: false, error: "Already installed. Use --overwrite to append another fragment.", scope, target };
-      }
-      const path = appendCodewithFragment(fragment, scope, codewithConfigPath);
-      return {
-        hook: shortName,
-        success: true,
-        scope,
-        target,
-        fragment,
-        applied: true,
-        configPath: path,
-        note: "Direct Codewith config write was explicitly requested; prefer open-configs for managed machines."
-      };
-    } catch (error) {
-      return {
-        hook: shortName,
-        success: false,
-        error: error instanceof Error ? error.message : "Unknown error",
-        target
-      };
-    }
-  }
-  const registered = getRegisteredHooksForTarget(scope, target);
-  if (registered.includes(shortName) && !overwrite) {
-    return { hook: shortName, success: false, error: "Already installed. Use --overwrite to replace.", scope, target };
+function getPinnedHook(name) {
+  return readLock().hooks[name];
+}
+function removePinnedHook(name) {
+  const lock = readLock();
+  if (!(name in lock.hooks))
+    return false;
+  delete lock.hooks[name];
+  writeLock(lock);
+  return true;
+}
+function pinInstalledHook(name, version, sha256, source, sourceRef) {
+  const now2 = new Date().toISOString();
+  const db = getDb();
+  upsertHookRecord(db, {
+    name,
+    version,
+    sha256,
+    source_type: source,
+    source_ref: sourceRef ?? null,
+    last_verified_at: now2
+  });
+  setPinnedHook(name, { version, sha256, source });
+}
+function removeHookFromStore(name) {
+  const removedPin = removePinnedHook(name);
+  const db = getDb();
+  const removedRecord = removeHookRecord(db, name);
+  return { removedPin, removedRecord };
+}
+function checkScriptHash(name, actual) {
+  const db = getDb();
+  const record = getHookRecord(db, name);
+  const pin = getPinnedHook(name);
+  const expected = record?.sha256 ?? pin?.sha256 ?? null;
+  if (expected !== null && expected !== actual) {
+    return { ok: false, pinned: true, expected, actual, name };
   }
-  const conflict = detectConflict(shortName, scope, target);
-  try {
-    registerHook(shortName, scope, target, profile);
-    return { hook: shortName, success: true, scope, target, ...conflict ? { conflict } : {} };
-  } catch (error) {
-    return {
-      hook: shortName,
-      success: false,
-      error: error instanceof Error ? error.message : "Unknown error",
-      target
-    };
+  if (expected === null) {
+    const now3 = new Date().toISOString();
+    const version = pin?.version ?? record?.version ?? "0.0.0";
+    const source = pin?.source ?? record?.source_type ?? "local";
+    upsertHookRecord(db, {
+      name,
+      version,
+      sha256: actual,
+      source_type: source,
+      last_verified_at: now3
+    });
+    setPinnedHook(name, { version, sha256: actual, source });
+    return { ok: true, pinned: false, expected: null, actual, name };
   }
+  const now2 = new Date().toISOString();
+  upsertHookRecord(db, {
+    name,
+    version: record?.version ?? pin?.version ?? "0.0.0",
+    sha256: expected,
+    source_type: record?.source_type ?? pin?.source ?? "local",
+    last_verified_at: now2
+  });
+  return { ok: true, pinned: true, expected, actual, name };
 }
-function installHook(name, options = {}) {
-  const { scope = "global", overwrite = false, target = "claude", profile, codewithMode = "fragment", codewithConfigPath } = options;
-  if (target === "all") {
-    const shortName = shortHookName(name);
-    const meta = resolveHookMeta(shortName);
-    if (meta) {
-      const unsupportedTargets = ["claude", "codewith"].filter((agentTarget) => getHookEvents(meta).some((event) => !isEventSupported(event, agentTarget)));
-      if (unsupportedTargets.length > 0) {
-        return {
-          hook: shortName,
-          success: false,
-          error: `Event(s) '${getHookEvents(meta).join(", ")}' are not supported by target(s): ${unsupportedTargets.join(", ")}`,
-          target: "all"
-        };
-      }
-    }
-    const claudeResult = installForTarget(name, scope, overwrite, "claude", profile);
-    if (!claudeResult.success) {
-      return {
-        ...claudeResult,
-        error: `Failed for target 'claude': ${claudeResult.error}`,
-        target: "all"
-      };
-    }
-    const codewithResult = installForTarget(name, scope, overwrite, "codewith", profile, codewithMode, codewithConfigPath);
-    if (!codewithResult.success) {
-      return {
-        ...codewithResult,
-        error: `Failed for target 'codewith': ${codewithResult.error}`,
-        target: "all"
-      };
-    }
-    return { ...claudeResult, target: "all" };
-  }
-  return installForTarget(name, scope, overwrite, target, profile, codewithMode, codewithConfigPath);
+async function verifyScriptHash(name, scriptPath) {
+  return checkScriptHash(name, await sha256File(scriptPath));
 }
-function registerHook(name, scope = "global", target = "claude", profile) {
-  const meta = resolveHookMeta(name);
-  if (!meta)
-    return;
-  const eventKeys = getHookEvents(meta).map((event) => {
-    const eventKey = getTargetEventName(event, target);
-    if (eventKey === null) {
-      throw new Error(`Event '${event}' is not supported by target '${target}'`);
-    }
-    return eventKey;
+function retrustHook(name, scriptPath, version, source) {
+  const actual = sha256Of(readFileSync4(scriptPath));
+  const db = getDb();
+  upsertHookRecord(db, {
+    name,
+    version,
+    sha256: actual,
+    source_type: source,
+    last_verified_at: new Date().toISOString()
   });
-  const uniqueEventKeys = [...new Set(eventKeys)];
-  if (uniqueEventKeys.length === 0) {
-    throw new Error(`Hook '${name}' has no installable events for target '${target}'`);
+  setPinnedHook(name, { version, sha256: actual, source });
+  return { ok: true, pinned: true, expected: actual, actual, name };
+}
+var init_store = __esm(() => {
+  init_db();
+  init_config();
+});
+
+// src/lib/installer.ts
+var exports_installer = {};
+__export(exports_installer, {
+  uninstallHook: () => uninstallHook,
+  removeHook: () => removeHook,
+  removeCodewithHookEntry: () => removeCodewithHookEntry,
+  isEventSupported: () => isEventSupported,
+  installHooks: () => installHooks,
+  installHook: () => installHook,
+  hookExists: () => hookExists,
+  getSettingsPath: () => getSettingsPath,
+  getRegisteredHooksForTarget: () => getRegisteredHooksForTarget,
+  getRegisteredHooks: () => getRegisteredHooks,
+  getInstalledHooks: () => getInstalledHooks,
+  getHookPath: () => getHookPath,
+  buildCodewithTomlFragment: () => buildCodewithTomlFragment
+});
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync4 } from "fs";
+import { join as join7, dirname as dirname3 } from "path";
+import { homedir as homedir5 } from "os";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function normalizeHookName(name) {
+  return name.startsWith("hook-") ? name : `hook-${name}`;
+}
+function shortHookName(name) {
+  return name.startsWith("hook-") ? name.slice("hook-".length) : name;
+}
+function removeHookEntriesByName(entries, hookName) {
+  return entries.filter((entry) => !entry.hooks?.some((h) => {
+    const match = h.command?.match(/^hooks run ([\w-]+)/);
+    return match && match[1] === hookName;
+  }));
+}
+function getTargetSettingsDir(target) {
+  if (target === "codewith")
+    return ".codewith";
+  if (target === "gemini")
+    return ".gemini";
+  return ".claude";
+}
+function getGlobalSettingsPathOverride(target) {
+  if (target === "claude")
+    return process.env.HASNA_HOOKS_CLAUDE_SETTINGS_PATH;
+  if (target === "gemini")
+    return process.env.HASNA_HOOKS_GEMINI_SETTINGS_PATH;
+  return;
+}
+function getSettingsPath(scope = "global", target = "claude", codewithConfigPath) {
+  if (target === "codewith" && codewithConfigPath)
+    return codewithConfigPath;
+  if (target === "codewith" && process.env.HASNA_HOOKS_CODEWITH_CONFIG_PATH) {
+    return process.env.HASNA_HOOKS_CODEWITH_CONFIG_PATH;
   }
-  const settings = readSettings(scope, target);
-  if (!settings.hooks)
-    settings.hooks = {};
-  removeHookFromAllEvents(settings, name);
-  const hookCommand = profile ? `hooks run ${name} --profile ${profile}` : `hooks run ${name}`;
-  for (const eventKey of uniqueEventKeys) {
-    if (!settings.hooks[eventKey])
-      settings.hooks[eventKey] = [];
-    const entry = {
-      hooks: [{ type: "command", command: hookCommand }]
-    };
-    if (meta.matcher) {
-      entry.matcher = meta.matcher;
-    }
-    settings.hooks[eventKey].push(entry);
+  const globalOverride = scope === "global" ? getGlobalSettingsPathOverride(target) : undefined;
+  if (globalOverride)
+    return globalOverride;
+  const dir = getTargetSettingsDir(target);
+  if (scope === "project") {
+    return target === "codewith" ? join7(process.cwd(), dir, "config.toml") : join7(process.cwd(), dir, "settings.json");
   }
-  writeSettings(settings, scope, target);
+  return target === "codewith" ? join7(homedir5(), dir, "config.toml") : join7(homedir5(), dir, "settings.json");
 }
-function removeHookFromAllEvents(settings, name) {
-  if (!settings.hooks)
-    return;
-  for (const key of Object.keys(settings.hooks)) {
-    settings.hooks[key] = removeHookEntriesByName(settings.hooks[key], name);
-    if (settings.hooks[key].length === 0) {
-      delete settings.hooks[key];
-    }
-  }
+function getHookPath(name) {
+  const shortName = shortHookName(name);
+  const resolved = resolveHookDir(shortName);
+  if (resolved)
+    return resolved;
+  return join7(HOOKS_DIR, normalizeHookName(shortName));
 }
-function unregisterHook(name, scope = "global", target = "claude") {
-  const meta = resolveHookMeta(name);
-  if (!meta)
-    return;
-  const settings = readSettings(scope, target);
-  if (!settings.hooks)
-    return;
-  removeHookFromAllEvents(settings, name);
-  if (Object.keys(settings.hooks).length === 0) {
-    delete settings.hooks;
-  }
-  writeSettings(settings, scope, target);
+function hookExists(name) {
+  return existsSync8(getHookPath(name));
 }
-function getRegisteredHooksForTarget(scope = "global", target = "claude") {
-  if (target === "codewith") {
-    const config = readCodewithConfig(scope);
-    const registered2 = [];
-    const re = /command\s*=\s*["']hooks run ([\w-]+)(?:\s+--profile\s+[\w-]+)?["']/g;
-    let match;
-    while (match = re.exec(config)) {
-      registered2.push(match[1]);
+function readSettings(scope = "global", target = "claude") {
+  const path = getSettingsPath(scope, target);
+  try {
+    if (existsSync8(path)) {
+      return JSON.parse(readFileSync5(path, "utf-8"));
     }
-    return [...new Set(registered2)];
+  } catch (error) {
+    console.warn(`[hooks] Failed to read settings at ${path}: ${error instanceof Error ? error.message : String(error)}`);
   }
-  const settings = readSettings(scope, target);
-  if (!settings.hooks)
-    return [];
-  const registered = [];
-  for (const eventKey of Object.keys(settings.hooks)) {
-    for (const entry of settings.hooks[eventKey]) {
-      for (const hook of entry.hooks || []) {
-        const newMatch = hook.command?.match(/^hooks run ([\w-]+)(?:\s+--profile\s+[\w-]+)?$/);
-        const oldMatch = hook.command?.match(/^hook-([\w-]+)$/);
-        const match = newMatch || oldMatch;
-        if (match) {
-          registered.push(match[1]);
-        }
-      }
-    }
+  return {};
+}
+function writeSettings(settings, scope = "global", target = "claude") {
+  const path = getSettingsPath(scope, target);
+  const dir = dirname3(path);
+  if (!existsSync8(dir)) {
+    mkdirSync5(dir, { recursive: true });
   }
-  return [...new Set(registered)];
+  writeFileSync4(path, JSON.stringify(settings, null, 2) + `
+`);
 }
-function getRegisteredHooks(scope = "global") {
-  return getRegisteredHooksForTarget(scope, "claude");
+function getTargetEventName(internalEvent, target) {
+  return EVENT_MAP[target]?.[internalEvent] ?? null;
+}
+function isEventSupported(internalEvent, target) {
+  return getTargetEventName(internalEvent, target) !== null;
+}
+function tomlString(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+function codewithMatcher(matcher) {
+  if (!matcher)
+    return;
+  if (matcher.startsWith("^"))
+    return matcher;
+  if (matcher.includes("|"))
+    return `^(${matcher})$`;
+  return `^${matcher}$`;
 }
-function removeHook(name, scope = "global", target = "claude") {
-  const shortName = shortHookName(name);
-  if (target === "all") {
-    const claudeRemoved = removeHookForTarget(shortName, scope, "claude");
-    const geminiRemoved = removeHookForTarget(shortName, scope, "gemini");
-    return claudeRemoved || geminiRemoved;
-  }
-  if (target === "codewith") {
-    return false;
+function codewithTimeout(name) {
+  switch (name) {
+    case "knowledge-context":
+      return 6;
+    case "session-start":
+      return 8;
+    case "pre-bash":
+      return 20;
+    case "prompt-guard":
+      return 3;
+    case "worktree-guard":
+    case "stop-sync":
+      return 5;
+    default:
+      return 10;
   }
-  return removeHookForTarget(shortName, scope, target);
 }
-function removeHookForTarget(name, scope, target) {
-  const registered = getRegisteredHooksForTarget(scope, target);
-  if (!registered.includes(name)) {
-    return false;
+function codewithStatusMessage(name) {
+  switch (name) {
+    case "knowledge-context":
+      return "Loading Knowledge context";
+    case "session-start":
+      return "Checking Hasna session context";
+    case "pre-bash":
+      return "Checking Bash safety";
+    case "prompt-guard":
+      return "Checking prompt safety";
+    case "worktree-guard":
+      return "Checking worktree safety";
+    case "stop-sync":
+      return "Syncing turn-end heartbeat";
+    default:
+      return `Running ${name}`;
   }
-  unregisterHook(name, scope, target);
-  return true;
 }
-var __dirname2, HOOKS_DIR, EVENT_MAP, getInstalledHooks;
-var init_installer = __esm(() => {
-  init_registry();
-  init_resolve();
-  __dirname2 = dirname3(fileURLToPath2(import.meta.url));
-  HOOKS_DIR = existsSync5(join5(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join5(__dirname2, "..", "..", "hooks") : join5(__dirname2, "..", "hooks");
-  EVENT_MAP = {
-    claude: {
-      PreToolUse: "PreToolUse",
-      PostToolUse: "PostToolUse",
-      Stop: "Stop",
-      Notification: "Notification",
-      SessionStart: "SessionStart",
-      SessionEnd: "SessionEnd",
-      UserPromptSubmit: null,
-      SubagentStart: null
-    },
-    gemini: {
-      PreToolUse: "BeforeTool",
-      PostToolUse: "AfterTool",
-      Stop: "AfterAgent",
-      Notification: "Notification",
-      SessionStart: null,
-      SessionEnd: null,
-      UserPromptSubmit: null,
-      SubagentStart: null
-    },
-    codewith: {
-      PreToolUse: "PreToolUse",
-      PostToolUse: "PostToolUse",
-      Stop: "Stop",
-      Notification: null,
-      SessionStart: "SessionStart",
-      SessionEnd: null,
-      UserPromptSubmit: "UserPromptSubmit",
-      SubagentStart: "SubagentStart"
+function buildCodewithTomlFragment(name, profile) {
+  const shortName = shortHookName(name);
+  const meta = resolveHookMeta(shortName);
+  if (!meta)
+    throw new Error(`Hook '${shortName}' not found`);
+  const command = profile ? `hooks run ${shortName} --profile ${profile}` : `hooks run ${shortName}`;
+  const matcher = codewithMatcher(meta.matcher);
+  const fragments = [];
+  for (const event of getHookEvents(meta)) {
+    const eventKey = getTargetEventName(event, "codewith");
+    if (!eventKey) {
+      throw new Error(`Hook '${shortName}' uses event '${event}', which is not supported by the Codewith target`);
     }
-  };
-  getInstalledHooks = getRegisteredHooks;
-});
+    const lines = [
+      `[[hooks.${eventKey}]]`
+    ];
+    if (matcher)
+      lines.push(`matcher = ${tomlString(matcher)}`);
+    lines.push("", `[[hooks.${eventKey}.hooks]]`, `type = "command"`, `command = ${tomlString(command)}`, `timeout = ${codewithTimeout(shortName)}`, `statusMessage = ${tomlString(codewithStatusMessage(shortName))}`);
+    fragments.push(lines.join(`
+`));
+  }
+  return `${fragments.join(`
 
-// src/lib/registration.ts
-function safeMatcherTest(pattern, value) {
+`)}
+`;
+}
+function readCodewithConfig(scope, configPath) {
+  const path = getSettingsPath(scope, "codewith", configPath);
   try {
-    return new RegExp(pattern).test(value);
+    return existsSync8(path) ? readFileSync5(path, "utf-8") : "";
   } catch {
-    return false;
+    return "";
   }
 }
-function hookRegisteredInSettings(settings, name, eventSpec, hookMatcher) {
-  const separator = eventSpec.indexOf(":");
-  const eventName = separator === -1 ? eventSpec : eventSpec.slice(0, separator);
-  const specMatcher = separator === -1 ? "" : eventSpec.slice(separator + 1);
-  const matcher = specMatcher || hookMatcher || "";
-  const hooks = settings.hooks?.[eventName];
-  if (!Array.isArray(hooks))
-    return false;
-  return hooks.some((entry) => entry?.hooks?.some((h) => {
-    const match = h?.command?.match(/^hooks run ([\w-]+)/);
-    if (!match || match[1] !== name)
-      return false;
-    if (!matcher)
-      return true;
-    const entryMatcher = typeof entry.matcher === "string" ? entry.matcher : "";
-    if (!entryMatcher)
-      return true;
-    return entryMatcher === matcher || safeMatcherTest(entryMatcher, matcher) || safeMatcherTest(matcher, entryMatcher);
-  }));
-}
+function appendCodewithFragment(fragment, scope, configPath) {
+  const path = getSettingsPath(scope, "codewith", configPath);
+  const dir = dirname3(path);
+  if (!existsSync8(dir))
+    mkdirSync5(dir, { recursive: true });
+  const existing = existsSync8(path) ? readFileSync5(path, "utf-8") : "";
+  const sep2 = existing.trim() ? `
 
-// src/lib/profiles.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4, readdirSync as readdirSync2, rmSync, cpSync } from "fs";
-import { join as join6 } from "path";
-import { homedir as homedir4 } from "os";
-function resolveProfilesDir() {
-  const newDir = join6(homedir4(), ".hasna", "hooks", "profiles");
-  const oldDir = join6(homedir4(), ".hooks", "profiles");
-  if (!existsSync6(newDir) && existsSync6(oldDir)) {
-    mkdirSync4(join6(homedir4(), ".hasna", "hooks"), { recursive: true });
-    cpSync(oldDir, newDir, { recursive: true });
-  }
-  return newDir;
+` : "";
+  writeFileSync4(path, `${existing.replace(/\s*$/, "")}${sep2}${fragment}`);
+  return path;
 }
-function ensureProfilesDir() {
-  if (!existsSync6(PROFILES_DIR)) {
-    mkdirSync4(PROFILES_DIR, { recursive: true });
+function detectConflict(name, scope, target) {
+  const meta = resolveHookMeta(name);
+  if (!meta || !meta.matcher)
+    return;
+  const events = new Set(getHookEvents(meta));
+  const registered = getRegisteredHooksForTarget(scope, target);
+  for (const existingName of registered) {
+    if (existingName === name)
+      continue;
+    const existing = getHook(existingName);
+    if (!existing || !existing.matcher)
+      continue;
+    if (!getHookEvents(existing).some((event) => events.has(event)))
+      continue;
+    const a = meta.matcher.toLowerCase();
+    const b = existing.matcher.toLowerCase();
+    if (a === b || a.includes(b) || b.includes(a)) {
+      return `conflicts with '${existingName}' (same event ${meta.event}, overlapping matcher '${existing.matcher}')`;
+    }
   }
+  return;
 }
-function profilePath(id) {
-  return join6(PROFILES_DIR, `${id}.json`);
-}
-function shortUuid() {
-  return crypto.randomUUID().slice(0, 8);
-}
-function createProfile(input) {
-  ensureProfilesDir();
-  const id = shortUuid();
-  const now2 = new Date().toISOString();
-  const profile = {
-    agent_id: id,
-    agent_type: input.agent_type,
-    created_at: now2,
-    last_seen_at: now2,
-    preferences: {}
-  };
-  if (input.name) {
-    profile.name = input.name;
+function installForTarget(name, scope, overwrite, target, profile, codewithMode = "fragment", codewithConfigPath) {
+  const shortName = shortHookName(name);
+  if (!hookExists(shortName)) {
+    return { hook: shortName, success: false, error: `Hook '${shortName}' not found`, target };
   }
-  writeFileSync4(profilePath(id), JSON.stringify(profile, null, 2) + `
-`);
-  return profile;
-}
-function getProfile(id) {
-  const path = profilePath(id);
+  if (target === "codewith") {
+    try {
+      const fragment = buildCodewithTomlFragment(shortName, profile);
+      if (codewithMode !== "write") {
+        return {
+          hook: shortName,
+          success: true,
+          scope,
+          target,
+          fragment,
+          applied: false,
+          note: "Codewith install is fragment-only by default; open-configs should own applying this TOML."
+        };
+      }
+      if (!codewithConfigPath) {
+        return {
+          hook: shortName,
+          success: false,
+          error: "Direct Codewith writes require an explicit --codewith-config path; refusing to write default ~/.codewith/config.toml.",
+          scope,
+          target,
+          fragment,
+          applied: false
+        };
+      }
+      const existing = readCodewithConfig(scope, codewithConfigPath);
+      if (!overwrite && new RegExp(`command\\s*=\\s*["']hooks run ${shortName}(?:\\s|["'])`).test(existing)) {
+        return { hook: shortName, success: false, error: "Already installed. Use --overwrite to append another fragment.", scope, target };
+      }
+      const path = appendCodewithFragment(fragment, scope, codewithConfigPath);
+      return {
+        hook: shortName,
+        success: true,
+        scope,
+        target,
+        fragment,
+        applied: true,
+        configPath: path,
+        note: "Direct Codewith config write was explicitly requested; prefer open-configs for managed machines."
+      };
+    } catch (error) {
+      return {
+        hook: shortName,
+        success: false,
+        error: error instanceof Error ? error.message : "Unknown error",
+        target
+      };
+    }
+  }
+  const registered = getRegisteredHooksForTarget(scope, target);
+  if (registered.includes(shortName) && !overwrite) {
+    return { hook: shortName, success: false, error: "Already installed. Use --overwrite to replace.", scope, target };
+  }
+  const conflict = detectConflict(shortName, scope, target);
   try {
-    if (!existsSync6(path))
-      return null;
-    return JSON.parse(readFileSync4(path, "utf-8"));
-  } catch {
-    return null;
+    registerHook(shortName, scope, target, profile);
+    return { hook: shortName, success: true, scope, target, ...conflict ? { conflict } : {} };
+  } catch (error) {
+    return {
+      hook: shortName,
+      success: false,
+      error: error instanceof Error ? error.message : "Unknown error",
+      target
+    };
   }
 }
-function listProfiles() {
-  if (!existsSync6(PROFILES_DIR))
-    return [];
-  try {
-    const files = readdirSync2(PROFILES_DIR).filter((f) => f.endsWith(".json"));
-    const profiles = [];
-    for (const file of files) {
-      try {
-        const content = readFileSync4(join6(PROFILES_DIR, file), "utf-8");
-        profiles.push(JSON.parse(content));
-      } catch {}
+function installHook(name, options = {}) {
+  const { scope = "global", overwrite = false, target = "claude", profile, codewithMode = "fragment", codewithConfigPath } = options;
+  if (target === "all") {
+    const shortName = shortHookName(name);
+    const meta = resolveHookMeta(shortName);
+    if (meta) {
+      const unsupportedTargets = ["claude", "codewith"].filter((agentTarget) => getHookEvents(meta).some((event) => !isEventSupported(event, agentTarget)));
+      if (unsupportedTargets.length > 0) {
+        return {
+          hook: shortName,
+          success: false,
+          error: `Event(s) '${getHookEvents(meta).join(", ")}' are not supported by target(s): ${unsupportedTargets.join(", ")}`,
+          target: "all"
+        };
+      }
     }
-    return profiles.sort((a, b) => new Date(a.created_at).getTime() - new Date(b.created_at).getTime());
-  } catch {
-    return [];
+    const claudeResult = installForTarget(name, scope, overwrite, "claude", profile);
+    if (!claudeResult.success) {
+      return {
+        ...claudeResult,
+        error: `Failed for target 'claude': ${claudeResult.error}`,
+        target: "all"
+      };
+    }
+    const codewithResult = installForTarget(name, scope, overwrite, "codewith", profile, codewithMode, codewithConfigPath);
+    if (!codewithResult.success) {
+      return {
+        ...codewithResult,
+        error: `Failed for target 'codewith': ${codewithResult.error}`,
+        target: "all"
+      };
+    }
+    return { ...claudeResult, target: "all" };
   }
+  return installForTarget(name, scope, overwrite, target, profile, codewithMode, codewithConfigPath);
 }
-function touchProfile(id) {
-  const profile = getProfile(id);
-  if (!profile)
+function registerHook(name, scope = "global", target = "claude", profile) {
+  const meta = resolveHookMeta(name);
+  if (!meta)
     return;
-  profile.last_seen_at = new Date().toISOString();
-  writeFileSync4(profilePath(id), JSON.stringify(profile, null, 2) + `
-`);
-}
-function exportProfiles() {
-  return listProfiles();
-}
-function importProfiles(profiles) {
-  ensureProfilesDir();
-  let imported = 0;
-  let skipped = 0;
-  for (const profile of profiles) {
-    if (!profile.agent_id || !profile.agent_type) {
-      skipped++;
-      continue;
-    }
-    const path = profilePath(profile.agent_id);
-    if (existsSync6(path)) {
-      skipped++;
-      continue;
+  const eventKeys = getHookEvents(meta).map((event) => {
+    const eventKey = getTargetEventName(event, target);
+    if (eventKey === null) {
+      throw new Error(`Event '${event}' is not supported by target '${target}'`);
     }
-    writeFileSync4(path, JSON.stringify(profile, null, 2) + `
-`);
-    imported++;
+    return eventKey;
+  });
+  const uniqueEventKeys = [...new Set(eventKeys)];
+  if (uniqueEventKeys.length === 0) {
+    throw new Error(`Hook '${name}' has no installable events for target '${target}'`);
   }
-  return { imported, skipped };
-}
-var PROFILES_DIR;
-var init_profiles = __esm(() => {
-  PROFILES_DIR = resolveProfilesDir();
-});
-
-// src/db/schema.ts
-var CREATE_HOOK_EVENTS_TABLE = `
-  CREATE TABLE IF NOT EXISTS hook_events (
-    id           TEXT PRIMARY KEY,
-    timestamp    TEXT NOT NULL,
-    session_id   TEXT NOT NULL,
-    hook_name    TEXT NOT NULL,
-    event_type   TEXT NOT NULL CHECK (event_type IN ('PreToolUse', 'PostToolUse', 'Stop', 'Notification', 'SessionStart', 'SessionEnd', 'UserPromptSubmit')),
-    tool_name    TEXT,
-    tool_input   TEXT,
-    result       TEXT CHECK (result IN ('continue', 'block', NULL)),
-    error        TEXT,
-    duration_ms  INTEGER,
-    project_dir  TEXT,
-    metadata     TEXT
-  )
-`, CREATE_INDEXES;
-var init_schema = __esm(() => {
-  CREATE_INDEXES = [
-    `CREATE INDEX IF NOT EXISTS idx_hook_events_timestamp  ON hook_events (timestamp)`,
-    `CREATE INDEX IF NOT EXISTS idx_hook_events_session_id ON hook_events (session_id)`,
-    `CREATE INDEX IF NOT EXISTS idx_hook_events_hook_name  ON hook_events (hook_name)`,
-    `CREATE INDEX IF NOT EXISTS idx_hook_events_event_type ON hook_events (event_type)`,
-    `CREATE INDEX IF NOT EXISTS idx_hook_events_errors     ON hook_events (timestamp) WHERE error IS NOT NULL`
-  ];
-});
-
-// src/db/migrations/001_initial.ts
-function up(db) {
-  db.exec(CREATE_HOOK_EVENTS_TABLE);
-  for (const idx of CREATE_INDEXES) {
-    db.exec(idx);
+  const settings = readSettings(scope, target);
+  if (!settings.hooks)
+    settings.hooks = {};
+  removeHookFromAllEvents(settings, name);
+  const hookCommand = profile ? `hooks run ${name} --profile ${profile}` : `hooks run ${name}`;
+  for (const eventKey of uniqueEventKeys) {
+    if (!settings.hooks[eventKey])
+      settings.hooks[eventKey] = [];
+    const entry = {
+      hooks: [{ type: "command", command: hookCommand }]
+    };
+    if (meta.matcher) {
+      entry.matcher = meta.matcher;
+    }
+    settings.hooks[eventKey].push(entry);
   }
+  writeSettings(settings, scope, target);
 }
-var init_001_initial = __esm(() => {
-  init_schema();
-});
-
-// src/db/migrations/002_session_events.ts
-function up2(db) {
-  const row = db.query("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?").get("hook_events");
-  if (!row?.sql)
-    return;
-  if (row.sql.includes("SessionStart"))
+function removeHookFromAllEvents(settings, name) {
+  if (!settings.hooks)
     return;
-  db.exec("BEGIN");
-  try {
-    db.exec("ALTER TABLE hook_events RENAME TO hook_events_old");
-    db.exec(CREATE_HOOK_EVENTS_TABLE);
-    db.exec(`INSERT INTO hook_events
-         (id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata)
-       SELECT id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata
-       FROM hook_events_old`);
-    db.exec("DROP TABLE hook_events_old");
-    for (const idx of CREATE_INDEXES) {
-      db.exec(idx);
+  for (const key of Object.keys(settings.hooks)) {
+    settings.hooks[key] = removeHookEntriesByName(settings.hooks[key], name);
+    if (settings.hooks[key].length === 0) {
+      delete settings.hooks[key];
     }
-    db.exec("COMMIT");
-  } catch (err) {
-    db.exec("ROLLBACK");
-    throw err;
   }
 }
-var init_002_session_events = __esm(() => {
-  init_schema();
-});
-
-// src/db/migrations/003_user_prompt_submit_event.ts
-function up3(db) {
-  const row = db.query("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?").get("hook_events");
-  if (!row?.sql)
-    return;
-  if (row.sql.includes("UserPromptSubmit"))
+function unregisterHook(name, scope = "global", target = "claude") {
+  const settings = readSettings(scope, target);
+  if (!settings.hooks)
     return;
-  db.exec("BEGIN");
-  try {
-    db.exec("ALTER TABLE hook_events RENAME TO hook_events_old");
-    db.exec(CREATE_HOOK_EVENTS_TABLE);
-    db.exec(`INSERT INTO hook_events
-         (id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata)
-       SELECT id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata
-       FROM hook_events_old`);
-    db.exec("DROP TABLE hook_events_old");
-    for (const idx of CREATE_INDEXES) {
-      db.exec(idx);
+  removeHookFromAllEvents(settings, name);
+  if (Object.keys(settings.hooks).length === 0) {
+    delete settings.hooks;
+  }
+  writeSettings(settings, scope, target);
+}
+function installHooks(names, options = {}) {
+  return names.map((name) => installHook(name, options));
+}
+function getRegisteredHooksForTarget(scope = "global", target = "claude") {
+  if (target === "codewith") {
+    const config = readCodewithConfig(scope);
+    const registered2 = [];
+    const re = /command\s*=\s*["']hooks run ([\w-]+)(?:\s+--profile\s+[\w-]+)?["']/g;
+    let match;
+    while (match = re.exec(config)) {
+      registered2.push(match[1]);
     }
-    db.exec("COMMIT");
-  } catch (err) {
-    db.exec("ROLLBACK");
-    throw err;
+    return [...new Set(registered2)];
+  }
+  const settings = readSettings(scope, target);
+  if (!settings.hooks)
+    return [];
+  const registered = [];
+  for (const eventKey of Object.keys(settings.hooks)) {
+    for (const entry of settings.hooks[eventKey]) {
+      for (const hook of entry.hooks || []) {
+        const newMatch = hook.command?.match(/^hooks run ([\w-]+)(?:\s+--profile\s+[\w-]+)?$/);
+        const oldMatch = hook.command?.match(/^hook-([\w-]+)$/);
+        const match = newMatch || oldMatch;
+        if (match) {
+          registered.push(match[1]);
+        }
+      }
+    }
+  }
+  return [...new Set(registered)];
+}
+function getRegisteredHooks(scope = "global") {
+  return getRegisteredHooksForTarget(scope, "claude");
+}
+function removeHook(name, scope = "global", target = "claude") {
+  const shortName = shortHookName(name);
+  if (target === "all") {
+    const claudeRemoved = removeHookForTarget(shortName, scope, "claude");
+    const geminiRemoved = removeHookForTarget(shortName, scope, "gemini");
+    return claudeRemoved || geminiRemoved;
+  }
+  if (target === "codewith") {
+    return false;
   }
+  return removeHookForTarget(shortName, scope, target);
 }
-var init_003_user_prompt_submit_event = __esm(() => {
-  init_schema();
-});
-
-// src/db/migrations/004_hooks_table.ts
-function up4(db) {
-  db.exec(CREATE_HOOKS_TABLE);
-  for (const idx of CREATE_HOOKS_INDEXES) {
-    db.exec(idx);
+function removeHookForTarget(name, scope, target) {
+  const registered = getRegisteredHooksForTarget(scope, target);
+  if (!registered.includes(name)) {
+    return false;
   }
+  unregisterHook(name, scope, target);
+  return true;
 }
-var CREATE_HOOKS_TABLE = `
-  CREATE TABLE IF NOT EXISTS hooks (
-    id               TEXT PRIMARY KEY,
-    name             TEXT NOT NULL,
-    version          TEXT NOT NULL,
-    sha256           TEXT NOT NULL,
-    source_type      TEXT NOT NULL,
-    source_ref       TEXT,
-    installed_at     TEXT NOT NULL,
-    enabled          INTEGER NOT NULL DEFAULT 1,
-    last_verified_at TEXT
-  )
-`, CREATE_HOOKS_INDEXES;
-var init_004_hooks_table = __esm(() => {
-  CREATE_HOOKS_INDEXES = [
-    `CREATE INDEX IF NOT EXISTS idx_hooks_name ON hooks (name)`
-  ];
-});
-
-// src/db/migrations/index.ts
-function ensureMigrationsTable(db) {
-  db.exec(`
-    CREATE TABLE IF NOT EXISTS schema_migrations (
-      version    TEXT PRIMARY KEY,
-      applied_at TEXT NOT NULL
-    )
-  `);
-}
-function getApplied(db) {
-  const rows = db.query("SELECT version FROM schema_migrations").all();
-  return new Set(rows.map((r) => r.version));
-}
-function runMigrations(db) {
-  ensureMigrationsTable(db);
-  const applied = getApplied(db);
-  for (const migration of MIGRATIONS) {
-    if (applied.has(migration.version))
+function removeCodewithHookEntry(configText, name) {
+  const sections = configText.split(/\n\s*\n/);
+  const nameRe = new RegExp(`^command\\s*=\\s*"hooks run ${escapeRegExp(name)}(?:\\s+--profile\\s+[\\w-]+)?"$`);
+  const entryHeaderRe = /^\[\[hooks\.([\w]+)\.hooks\]\]$/;
+  const eventHeaderRe = /^\[\[hooks\.([\w]+)\]\]$/;
+  const eventsWithEntries = new Set;
+  const kept = [];
+  let removed = false;
+  for (const section of sections) {
+    const lines = section.split(`
+`);
+    const entryMatch = entryHeaderRe.exec(lines[0] ?? "");
+    if (entryMatch) {
+      const event = entryMatch[1];
+      eventsWithEntries.add(event);
+      if (lines.some((line) => nameRe.test(line.trim()))) {
+        removed = true;
+        continue;
+      }
+      kept.push({ text: section });
       continue;
-    migration.up(db);
-    db.run("INSERT INTO schema_migrations (version, applied_at) VALUES (?, ?)", [
-      migration.version,
-      new Date().toISOString()
-    ]);
+    }
+    const eventMatch = eventHeaderRe.exec(lines[0] ?? "");
+    kept.push({ text: section, eventHeaderFor: eventMatch ? eventMatch[1] : undefined });
   }
-}
-var MIGRATIONS;
-var init_migrations = __esm(() => {
-  init_001_initial();
-  init_002_session_events();
-  init_003_user_prompt_submit_event();
-  init_004_hooks_table();
-  MIGRATIONS = [
-    { version: "001_initial", up },
-    { version: "002_session_events", up: up2 },
-    { version: "003_user_prompt_submit_event", up: up3 },
-    { version: "004_hooks_table", up: up4 }
-  ];
-});
+  const keptEntriesByEvent = new Set;
+  for (const item of kept) {
+    const m = entryHeaderRe.exec(item.text.split(`
+`)[0] ?? "");
+    if (m)
+      keptEntriesByEvent.add(m[1]);
+  }
+  const finalSections = kept.filter((item) => {
+    if (item.eventHeaderFor === undefined)
+      return true;
+    if (!eventsWithEntries.has(item.eventHeaderFor))
+      return true;
+    return keptEntriesByEvent.has(item.eventHeaderFor);
+  }).map((item) => item.text);
+  return {
+    text: finalSections.join(`
 
-// src/db/legacy-import.ts
-import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync5 } from "fs";
-import { join as join7 } from "path";
-import { homedir as homedir5 } from "os";
-function ensureMetaTable(db) {
-  db.exec(`
-    CREATE TABLE IF NOT EXISTS _meta (
-      key   TEXT PRIMARY KEY,
-      value TEXT NOT NULL
-    )
-  `);
-}
-function isAlreadyDone(db) {
-  ensureMetaTable(db);
-  const row = db.query("SELECT value FROM _meta WHERE key = ?").get(META_KEY);
-  return row?.value === "1";
+`) + (configText.endsWith(`
+`) ? `
+` : ""),
+    removed
+  };
 }
-function markDone(db) {
-  db.run("INSERT OR REPLACE INTO _meta (key, value) VALUES (?, ?)", [META_KEY, "1"]);
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function nanoid() {
-  return crypto.randomUUID().replace(/-/g, "").slice(0, 21);
+function codewithHasHookEntryInText(configText, name) {
+  return new RegExp(`hooks run ${escapeRegExp(name)}(?:\\s+--profile\\s+[\\w-]+)?(?:$|\\s|")`).test(configText);
 }
-function importJsonlFile(db, filePath) {
-  let count = 0;
+function codewithHasHookEntry(name) {
+  const path = getSettingsPath("global", "codewith");
+  if (!existsSync8(path))
+    return false;
   try {
-    const lines = readFileSync5(filePath, "utf-8").split(`
-`).filter(Boolean);
-    for (const line of lines) {
-      try {
-        const entry = JSON.parse(line);
-        db.run(`INSERT OR IGNORE INTO hook_events
-            (id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, project_dir)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [
-          nanoid(),
-          entry.timestamp ?? new Date().toISOString(),
-          entry.session_id ?? "legacy",
-          "sessionlog",
-          "PostToolUse",
-          entry.tool_name ?? null,
-          entry.tool_input ? String(entry.tool_input).slice(0, 500) : null,
-          null
-        ]);
-        count++;
-      } catch {}
-    }
-  } catch {}
-  return count;
+    return codewithHasHookEntryInText(readFileSync5(path, "utf-8"), name);
+  } catch {
+    return false;
+  }
 }
-function importErrorsLog(db, filePath) {
-  let count = 0;
-  try {
-    const lines = readFileSync5(filePath, "utf-8").split(`
-`).filter(Boolean);
-    const linePattern = /^\[(.+?)\]\s+(?:\[session:(\S+)\]\s+)?(.+?)\s+\u2014\s+(.+)$/;
-    for (const line of lines) {
-      try {
-        const m = line.match(linePattern);
-        if (!m)
-          continue;
-        const [, timestamp, sessionPrefix, , errorMsg] = m;
-        db.run(`INSERT OR IGNORE INTO hook_events
-            (id, timestamp, session_id, hook_name, event_type, error)
-           VALUES (?, ?, ?, ?, ?, ?)`, [
-          nanoid(),
-          timestamp,
-          sessionPrefix ? `legacy-${sessionPrefix}` : "legacy",
-          "errornotify",
-          "PostToolUse",
-          errorMsg.slice(0, 500)
-        ]);
-        count++;
-      } catch {}
+function uninstallHook(name, scope = "global", target = "claude") {
+  const shortName = shortHookName(name);
+  const custom = readCustomManifest(shortName);
+  const bundledMeta = custom ? undefined : getHook(shortName);
+  const existsInTarget = (t) => getRegisteredHooksForTarget("global", t).includes(shortName) || getRegisteredHooksForTarget("project", t).includes(shortName);
+  const registeredClaudeOrGemini = target === "all" ? existsInTarget("claude") || existsInTarget("gemini") : false;
+  const registeredGlobal = registeredClaudeOrGemini || getRegisteredHooksForTarget("global", target === "all" ? "claude" : target).includes(shortName);
+  const registeredProject = registeredClaudeOrGemini || getRegisteredHooksForTarget("project", target === "all" ? "claude" : target).includes(shortName);
+  const codewithOnly = (target === "codewith" || target === "all") && codewithHasHookEntry(shortName);
+  if (!custom && !bundledMeta && !registeredGlobal && !registeredProject && !codewithOnly) {
+    return { name: shortName, removed: false, source: null, settingsScopes: [], storeDirRemoved: false, pinRemoved: false, dbRecordRemoved: false, registrationsRemaining: [], error: `Hook '${shortName}' not found` };
+  }
+  const writableTargets = target === "all" ? ["claude", "gemini"] : target === "codewith" ? [] : [target];
+  const scopes = [];
+  for (const s of ["global", "project"]) {
+    for (const t of writableTargets) {
+      if (getRegisteredHooksForTarget(s, t).includes(shortName)) {
+        unregisterHook(shortName, s, t);
+        if (!scopes.includes(s))
+          scopes.push(s);
+      }
     }
-  } catch {}
-  return count;
-}
-function runLegacyImport(db, homeDir = homedir5()) {
-  try {
-    if (isAlreadyDone(db))
-      return;
-    let total = 0;
-    const claudeProjectsDir = join7(homeDir, ".claude", "projects");
-    if (existsSync7(claudeProjectsDir)) {
-      try {
-        const projectDirs = readdirSync3(claudeProjectsDir);
-        for (const dir of projectDirs) {
-          const projectDir = join7(claudeProjectsDir, dir);
-          try {
-            const files = readdirSync3(projectDir);
-            for (const file of files) {
-              if (file.match(/^session-log-\d{4}-\d{2}-\d{2}\.jsonl$/)) {
-                total += importJsonlFile(db, join7(projectDir, file));
-              }
-              if (file === "errors.log") {
-                total += importErrorsLog(db, join7(projectDir, file));
-              }
-            }
-          } catch {}
-        }
-      } catch {}
+  }
+  const registrationsRemaining = [];
+  if (target === "codewith" || target === "all") {
+    const codewithPath = getSettingsPath("global", "codewith");
+    if (existsSync8(codewithPath)) {
+      const before = readFileSync5(codewithPath, "utf-8");
+      const after = removeCodewithHookEntry(before, shortName);
+      if (after.removed) {
+        writeFileSync4(codewithPath, after.text, "utf-8");
+      }
+      if (codewithHasHookEntryInText(after.removed ? after.text : before, shortName)) {
+        registrationsRemaining.push("codewith");
+      }
     }
-    markDone(db);
-    if (total > 0) {
-      process.stderr.write(`[hooks] Imported ${total} legacy log entries into SQLite.
-`);
+  }
+  if (custom) {
+    try {
+      rmSync(customHookDir(shortName), { recursive: true, force: true });
+    } catch {
+      return {
+        name: shortName,
+        removed: false,
+        source: "custom",
+        settingsScopes: scopes,
+        storeDirRemoved: false,
+        pinRemoved: false,
+        dbRecordRemoved: false,
+        registrationsRemaining,
+        error: `Hook '${shortName}' store directory could not be removed; trust records preserved (no fail-open)`
+      };
     }
-  } catch (err) {
-    process.stderr.write(`[hooks] Legacy import failed (non-fatal): ${err}
-`);
   }
+  const { removedPin, removedRecord } = removeHookFromStore(shortName);
+  return {
+    name: shortName,
+    removed: true,
+    source: custom ? "custom" : bundledMeta ? "bundled" : "registered-only",
+    settingsScopes: scopes,
+    storeDirRemoved: custom ? true : false,
+    pinRemoved: removedPin,
+    dbRecordRemoved: removedRecord,
+    registrationsRemaining
+  };
 }
-var META_KEY = "legacy_import_done";
-var init_legacy_import = () => {};
+var __dirname2, HOOKS_DIR, EVENT_MAP, getInstalledHooks;
+var init_installer = __esm(() => {
+  init_registry();
+  init_resolve();
+  init_manifest();
+  init_store();
+  __dirname2 = dirname3(fileURLToPath2(import.meta.url));
+  HOOKS_DIR = existsSync8(join7(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join7(__dirname2, "..", "..", "hooks") : join7(__dirname2, "..", "hooks");
+  EVENT_MAP = {
+    claude: {
+      PreToolUse: "PreToolUse",
+      PostToolUse: "PostToolUse",
+      Stop: "Stop",
+      Notification: "Notification",
+      SessionStart: "SessionStart",
+      SessionEnd: "SessionEnd",
+      UserPromptSubmit: null,
+      SubagentStart: null
+    },
+    gemini: {
+      PreToolUse: "BeforeTool",
+      PostToolUse: "AfterTool",
+      Stop: "AfterAgent",
+      Notification: "Notification",
+      SessionStart: null,
+      SessionEnd: null,
+      UserPromptSubmit: null,
+      SubagentStart: null
+    },
+    codewith: {
+      PreToolUse: "PreToolUse",
+      PostToolUse: "PostToolUse",
+      Stop: "Stop",
+      Notification: null,
+      SessionStart: "SessionStart",
+      SessionEnd: null,
+      UserPromptSubmit: "UserPromptSubmit",
+      SubagentStart: "SubagentStart"
+    }
+  };
+  getInstalledHooks = getRegisteredHooks;
+});
 
-// src/db/retention.ts
-function runRetention(db, days) {
-  const envDays = parseInt(process.env.HOOKS_RETENTION_DAYS ?? "30");
-  const retentionDays = days ?? (isNaN(envDays) || envDays <= 0 ? 30 : envDays);
-  const cutoff = new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1000).toISOString();
+// src/lib/registration.ts
+function safeMatcherTest(pattern, value) {
   try {
-    db.run("DELETE FROM hook_events WHERE timestamp < ?", [cutoff]);
-    const changes = db.query("SELECT changes() as changes").get()?.changes ?? 0;
-    return changes;
+    return new RegExp(pattern).test(value);
   } catch {
-    return 0;
+    return false;
   }
 }
+function hookRegisteredInSettings(settings, name, eventSpec, hookMatcher) {
+  const separator = eventSpec.indexOf(":");
+  const eventName = separator === -1 ? eventSpec : eventSpec.slice(0, separator);
+  const specMatcher = separator === -1 ? "" : eventSpec.slice(separator + 1);
+  const matcher = specMatcher || hookMatcher || "";
+  const hooks = settings.hooks?.[eventName];
+  if (!Array.isArray(hooks))
+    return false;
+  return hooks.some((entry) => entry?.hooks?.some((h) => {
+    const match = h?.command?.match(/^hooks run ([\w-]+)/);
+    if (!match || match[1] !== name)
+      return false;
+    if (!matcher)
+      return true;
+    const entryMatcher = typeof entry.matcher === "string" ? entry.matcher : "";
+    if (!entryMatcher)
+      return true;
+    return entryMatcher === matcher || safeMatcherTest(entryMatcher, matcher) || safeMatcherTest(matcher, entryMatcher);
+  }));
+}
 
-// src/db/index.ts
-var exports_db = {};
-__export(exports_db, {
-  getDbPath: () => getDbPath,
-  getDb: () => getDb,
-  createTestDb: () => createTestDb,
-  closeDb: () => closeDb
-});
-import { Database } from "bun:sqlite";
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, cpSync as cpSync2 } from "fs";
+// src/lib/profiles.ts
+import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5, readdirSync as readdirSync3, rmSync as rmSync2, cpSync as cpSync2 } from "fs";
 import { join as join8 } from "path";
 import { homedir as homedir6 } from "os";
-function resolveDataDir() {
-  const explicit = process.env.HASNA_HOOKS_DATA_DIR ?? process.env.HOOKS_DATA_DIR;
-  if (explicit)
-    return explicit;
-  const newDir = join8(homedir6(), ".hasna", "hooks");
-  const oldDir = join8(homedir6(), ".hooks");
-  if (!existsSync8(newDir) && existsSync8(oldDir)) {
-    mkdirSync5(join8(homedir6(), ".hasna"), { recursive: true });
+function resolveProfilesDir() {
+  const newDir = join8(homedir6(), ".hasna", "hooks", "profiles");
+  const oldDir = join8(homedir6(), ".hooks", "profiles");
+  if (!existsSync9(newDir) && existsSync9(oldDir)) {
+    mkdirSync6(join8(homedir6(), ".hasna", "hooks"), { recursive: true });
     cpSync2(oldDir, newDir, { recursive: true });
   }
   return newDir;
 }
-function getDbPath() {
-  const explicitDb = process.env.HASNA_HOOKS_DB_PATH ?? process.env.HOOKS_DB_PATH;
-  if (explicitDb)
-    return explicitDb;
-  const dataDir = resolveDataDir();
-  return join8(dataDir, "hooks.db");
-}
-function ensureDir(dbPath) {
-  const dir = dbPath.substring(0, dbPath.lastIndexOf("/"));
-  if (dir && !existsSync8(dir)) {
-    mkdirSync5(dir, { recursive: true });
-  }
-}
-function getDb() {
-  if (instance)
-    return instance;
-  const dbPath = getDbPath();
-  const isNew = dbPath === ":memory:" || !existsSync8(dbPath);
-  ensureDir(dbPath);
-  instance = new Database(dbPath);
-  instance.exec("PRAGMA journal_mode=WAL");
-  instance.exec("PRAGMA foreign_keys=ON");
-  runMigrations(instance);
-  runRetention(instance);
-  instance.exec(`CREATE TABLE IF NOT EXISTS feedback (
-    id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),
-    message TEXT NOT NULL,
-    email TEXT,
-    category TEXT DEFAULT 'general',
-    version TEXT,
-    machine_id TEXT,
-    created_at TEXT NOT NULL DEFAULT (datetime('now'))
-  )`);
-  if (isNew) {
-    runLegacyImport(instance);
-  }
-  return instance;
-}
-function closeDb() {
-  if (instance) {
-    instance.close();
-    instance = null;
+function ensureProfilesDir() {
+  if (!existsSync9(PROFILES_DIR)) {
+    mkdirSync6(PROFILES_DIR, { recursive: true });
   }
 }
-function createTestDb() {
-  const db = new Database(":memory:");
-  db.exec("PRAGMA journal_mode=WAL");
-  db.exec("PRAGMA foreign_keys=ON");
-  return db;
-}
-var instance = null;
-var init_db = __esm(() => {
-  init_migrations();
-  init_legacy_import();
-});
-
-// src/lib/store.ts
-var exports_store = {};
-__export(exports_store, {
-  writeLock: () => writeLock,
-  verifyScriptHash: () => verifyScriptHash,
-  upsertHookRecord: () => upsertHookRecord,
-  sha256Of: () => sha256Of,
-  sha256File: () => sha256File,
-  setPinnedHook: () => setPinnedHook,
-  retrustHook: () => retrustHook,
-  removePinnedHook: () => removePinnedHook,
-  removeHookRecord: () => removeHookRecord,
-  readLock: () => readLock,
-  listHookRecords: () => listHookRecords,
-  getPinnedHook: () => getPinnedHook,
-  getHookRecord: () => getHookRecord,
-  checkScriptHash: () => checkScriptHash
-});
-import { createHash } from "crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
-import { readFile as readFile2 } from "fs/promises";
-function sha256Of(input) {
-  return createHash("sha256").update(input).digest("hex");
-}
-async function sha256File(path) {
-  const buf = await readFile2(path);
-  return sha256Of(buf);
-}
-function getHookRecord(db, name) {
-  return db.query("SELECT * FROM hooks WHERE name = ?").get(name);
-}
-function listHookRecords(db) {
-  return db.query("SELECT * FROM hooks ORDER BY name").all();
+function profilePath(id) {
+  return join8(PROFILES_DIR, `${id}.json`);
 }
-function upsertHookRecord(db, record) {
-  const existing = getHookRecord(db, record.name);
-  const id = existing?.id ?? record.name;
-  const installedAt = existing?.installed_at ?? new Date().toISOString();
-  const enabled = record.enabled ?? existing?.enabled ?? 1;
-  db.run(`INSERT INTO hooks (id, name, version, sha256, source_type, source_ref, installed_at, enabled, last_verified_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-     ON CONFLICT(id) DO UPDATE SET
-       version = excluded.version,
-       sha256 = excluded.sha256,
-       source_type = excluded.source_type,
-       source_ref = excluded.source_ref,
-       enabled = excluded.enabled,
-       last_verified_at = excluded.last_verified_at`, [
-    id,
-    record.name,
-    record.version,
-    record.sha256,
-    record.source_type,
-    record.source_ref ?? existing?.source_ref ?? null,
-    installedAt,
-    enabled,
-    record.last_verified_at ?? null
-  ]);
+function shortUuid() {
+  return crypto.randomUUID().slice(0, 8);
 }
-function removeHookRecord(db, name) {
-  const res = db.run("DELETE FROM hooks WHERE name = ?", [name]);
-  return res.changes > 0;
+function createProfile(input) {
+  ensureProfilesDir();
+  const id = shortUuid();
+  const now2 = new Date().toISOString();
+  const profile = {
+    agent_id: id,
+    agent_type: input.agent_type,
+    created_at: now2,
+    last_seen_at: now2,
+    preferences: {}
+  };
+  if (input.name) {
+    profile.name = input.name;
+  }
+  writeFileSync5(profilePath(id), JSON.stringify(profile, null, 2) + `
+`);
+  return profile;
 }
-function readLock() {
+function getProfile(id) {
+  const path = profilePath(id);
   try {
-    const path = getLockPath();
     if (!existsSync9(path))
-      return { hooks: {} };
-    const parsed = JSON.parse(readFileSync6(path, "utf-8"));
-    return { hooks: parsed.hooks ?? {} };
+      return null;
+    return JSON.parse(readFileSync6(path, "utf-8"));
   } catch {
-    return { hooks: {} };
+    return null;
   }
 }
-function writeLock(lock) {
-  const path = getLockPath();
-  mkdirSync6(path.substring(0, path.lastIndexOf("/")) || ".", { recursive: true });
-  const sorted = {};
-  for (const name of Object.keys(lock.hooks).sort()) {
-    sorted[name] = lock.hooks[name];
+function listProfiles() {
+  if (!existsSync9(PROFILES_DIR))
+    return [];
+  try {
+    const files = readdirSync3(PROFILES_DIR).filter((f) => f.endsWith(".json"));
+    const profiles = [];
+    for (const file of files) {
+      try {
+        const content = readFileSync6(join8(PROFILES_DIR, file), "utf-8");
+        profiles.push(JSON.parse(content));
+      } catch {}
+    }
+    return profiles.sort((a, b) => new Date(a.created_at).getTime() - new Date(b.created_at).getTime());
+  } catch {
+    return [];
   }
-  writeFileSync5(path, JSON.stringify({ hooks: sorted }, null, 2) + `
-`, "utf-8");
-  return path;
-}
-function setPinnedHook(name, entry) {
-  const lock = readLock();
-  lock.hooks[name] = entry;
-  return writeLock(lock);
 }
-function getPinnedHook(name) {
-  return readLock().hooks[name];
+function touchProfile(id) {
+  const profile = getProfile(id);
+  if (!profile)
+    return;
+  profile.last_seen_at = new Date().toISOString();
+  writeFileSync5(profilePath(id), JSON.stringify(profile, null, 2) + `
+`);
 }
-function removePinnedHook(name) {
-  const lock = readLock();
-  if (!(name in lock.hooks))
-    return false;
-  delete lock.hooks[name];
-  writeLock(lock);
-  return true;
+function exportProfiles() {
+  return listProfiles();
 }
-function checkScriptHash(name, actual) {
-  const db = getDb();
-  const record = getHookRecord(db, name);
-  const pin = getPinnedHook(name);
-  const expected = record?.sha256 ?? pin?.sha256 ?? null;
-  if (expected !== null && expected !== actual) {
-    return { ok: false, pinned: true, expected, actual, name };
-  }
-  if (expected === null) {
-    const now3 = new Date().toISOString();
-    const version = pin?.version ?? record?.version ?? "0.0.0";
-    const source = pin?.source ?? record?.source_type ?? "local";
-    upsertHookRecord(db, {
-      name,
-      version,
-      sha256: actual,
-      source_type: source,
-      last_verified_at: now3
-    });
-    setPinnedHook(name, { version, sha256: actual, source });
-    return { ok: true, pinned: false, expected: null, actual, name };
+function importProfiles(profiles) {
+  ensureProfilesDir();
+  let imported = 0;
+  let skipped = 0;
+  for (const profile of profiles) {
+    if (!profile.agent_id || !profile.agent_type) {
+      skipped++;
+      continue;
+    }
+    const path = profilePath(profile.agent_id);
+    if (existsSync9(path)) {
+      skipped++;
+      continue;
+    }
+    writeFileSync5(path, JSON.stringify(profile, null, 2) + `
+`);
+    imported++;
   }
-  const now2 = new Date().toISOString();
-  upsertHookRecord(db, {
-    name,
-    version: record?.version ?? pin?.version ?? "0.0.0",
-    sha256: expected,
-    source_type: record?.source_type ?? pin?.source ?? "local",
-    last_verified_at: now2
-  });
-  return { ok: true, pinned: true, expected, actual, name };
+  return { imported, skipped };
+}
+var PROFILES_DIR;
+var init_profiles = __esm(() => {
+  PROFILES_DIR = resolveProfilesDir();
+});
+
+// src/lib/db-writer.ts
+var exports_db_writer = {};
+__export(exports_db_writer, {
+  writeHookEvent: () => writeHookEvent,
+  resolveEventType: () => resolveEventType,
+  recordHookRun: () => recordHookRun,
+  normalizeEventType: () => normalizeEventType
+});
+function nanoid2() {
+  return crypto.randomUUID().replace(/-/g, "").slice(0, 21);
 }
-async function verifyScriptHash(name, scriptPath) {
-  return checkScriptHash(name, await sha256File(scriptPath));
+function writeHookEvent(event) {
+  try {
+    const db = getDb();
+    const id = nanoid2();
+    const timestamp = event.timestamp ?? new Date().toISOString();
+    db.run(`INSERT INTO hook_events
+        (id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+      id,
+      timestamp,
+      event.session_id,
+      event.hook_name,
+      event.event_type,
+      event.tool_name ?? null,
+      event.tool_input ? event.tool_input.slice(0, 500) : null,
+      event.result ?? null,
+      event.error ?? null,
+      event.duration_ms ?? null,
+      event.project_dir ?? null,
+      event.metadata ?? null
+    ]);
+  } catch (err) {
+    process.stderr.write(`[hooks db-writer] failed to write event: ${err}
+`);
+  }
 }
-function retrustHook(name, scriptPath, version, source) {
-  const actual = sha256Of(readFileSync6(scriptPath));
-  const db = getDb();
-  upsertHookRecord(db, {
-    name,
-    version,
-    sha256: actual,
-    source_type: source,
-    last_verified_at: new Date().toISOString()
+function normalizeEventType(value) {
+  if (typeof value !== "string")
+    return null;
+  if (ALLOWED_EVENT_TYPES.has(value))
+    return value;
+  const bare = value.split(":")[0] ?? "";
+  return ALLOWED_EVENT_TYPES.has(bare) ? bare : null;
+}
+function resolveEventType(inputEvent, fallbackEvent) {
+  const fromInput = normalizeEventType(inputEvent);
+  if (fromInput)
+    return fromInput;
+  return normalizeEventType(fallbackEvent ?? null);
+}
+function recordHookRun(record) {
+  const eventType = record.eventType ? normalizeEventType(record.eventType) : null;
+  if (!eventType) {
+    process.stderr.write(`[hooks db-writer] skipped event for '${record.hookName}': unsupported event type '${String(record.eventType)}'
+`);
+    return;
+  }
+  const metadata = {
+    ...record.metadata ?? {},
+    version: record.version ?? null,
+    sha256: record.sha256 ?? null,
+    exit_code: record.exitCode
+  };
+  writeHookEvent({
+    session_id: record.sessionId ?? "cli",
+    hook_name: record.hookName,
+    event_type: eventType,
+    tool_name: record.toolName ?? null,
+    tool_input: record.toolInput !== undefined ? JSON.stringify(record.toolInput) : null,
+    result: record.result ?? null,
+    error: record.error ?? null,
+    duration_ms: record.durationMs,
+    project_dir: record.projectDir ?? null,
+    metadata: JSON.stringify(metadata)
   });
-  setPinnedHook(name, { version, sha256: actual, source });
-  return { ok: true, pinned: true, expected: actual, actual, name };
 }
-var init_store = __esm(() => {
+var ALLOWED_EVENT_TYPES;
+var init_db_writer = __esm(() => {
   init_db();
-  init_config();
+  ALLOWED_EVENT_TYPES = new Set([
+    "PreToolUse",
+    "PostToolUse",
+    "Stop",
+    "Notification",
+    "SessionStart",
+    "SessionEnd",
+    "UserPromptSubmit",
+    "SubagentStart"
+  ]);
 });
 
 // src/lib/run.ts
 var exports_run = {};
 __export(exports_run, {
-  executeVerifiedScript: () => executeVerifiedScript
+  executeVerifiedScript: () => executeVerifiedScript,
+  HookTimeoutError: () => HookTimeoutError
 });
 import { randomBytes } from "crypto";
-import { rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
+import { rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
 import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute2, join as join9 } from "path";
 function extensionOf(scriptPath) {
   const base = basename2(scriptPath);
   const dot = base.lastIndexOf(".");
   return dot > 0 ? base.slice(dot + 1) : "ts";
 }
+function shebangInterpreter(firstLine) {
+  if (!firstLine.startsWith("#!"))
+    return null;
+  const rest = firstLine.slice(2).trim();
+  if (!rest)
+    return null;
+  const parts = rest.split(/\s+/);
+  if (parts[0] === "env" || parts[0] === "/usr/bin/env") {
+    return parts[1] && parts[1] !== "-S" ? basename2(parts[1]) : parts[2] ? basename2(parts[2]) : null;
+  }
+  return basename2(parts[0]);
+}
+function interpreterFor(name, scriptPath, content) {
+  const ext = extensionOf(scriptPath);
+  const firstLine = content.subarray(0, 512).toString("utf8").split(`
+`, 1)[0] ?? "";
+  const interp = shebangInterpreter(firstLine);
+  if (interp) {
+    if (interp === "bash" || interp === "sh")
+      return { command: ["/bin/bash"], tempExt: "sh" };
+    if (interp === "node" || interp === "bun")
+      return { command: ["bun", "run"], tempExt: BUN_EXTENSIONS.has(ext) ? ext : "ts" };
+    throw new Error(`Refusing to run hook '${name}': shebang '${firstLine}' is not a recognized interpreter (supported: bash/sh, node/bun)`);
+  }
+  if (BASH_EXTENSIONS.has(ext))
+    return { command: ["/bin/bash"], tempExt: "sh" };
+  if (BUN_EXTENSIONS.has(ext))
+    return { command: ["bun", "run"], tempExt: ext };
+  throw new Error(`Refusing to run hook '${name}': unsupported script extension '.${ext}' (supported: .sh .bash .ts .tsx .js .jsx .mjs .cjs .mts .cts, or a recognized shebang)`);
+}
+async function readPipeWithDeadline(stream, deadlineMs) {
+  const reader = stream.getReader();
+  const chunks = [];
+  const deadline = Date.now() + deadlineMs;
+  try {
+    while (true) {
+      const remaining = deadline - Date.now();
+      if (remaining <= 0)
+        break;
+      let result;
+      try {
+        result = await Promise.race([
+          reader.read(),
+          new Promise((_, reject) => {
+            const t = setTimeout(() => reject(new Error("pipe-drain-deadline")), remaining);
+            t.unref?.();
+          })
+        ]);
+      } catch {
+        break;
+      }
+      if (result.done)
+        break;
+      chunks.push(new TextDecoder().decode(result.value));
+    }
+  } finally {
+    try {
+      await reader.cancel();
+    } catch {}
+  }
+  return chunks.join("");
+}
 async function executeVerifiedScript(options) {
   const scriptDir = dirname4(options.scriptPath);
-  const tempPath = join9(scriptDir, `.hooks-verified-${randomBytes(12).toString("hex")}.${extensionOf(options.scriptPath)}`);
+  const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
+  const tempPath = join9(scriptDir, `.hooks-verified-${randomBytes(12).toString("hex")}.${interpreter.tempExt}`);
+  let proc = null;
+  let timedOut = false;
+  const timeoutTimer = options.timeout ? setTimeout(() => {
+    timedOut = true;
+    killGroup(proc);
+  }, options.timeout) : null;
   try {
     writeFileSync6(tempPath, options.content, { flag: "wx", mode: 384 });
-    const proc = Bun.spawn(["bun", "run", isAbsolute2(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
+    proc = Bun.spawn([...interpreter.command, isAbsolute2(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
       stdin: new Response(options.stdin),
       stdout: "pipe",
       stderr: "pipe",
       env: options.env ?? process.env,
-      ...options.timeout ? { timeout: options.timeout } : {}
+      detached: true
     });
-    const [stdoutText, stderrText, exitCode] = await Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text(),
-      proc.exited
+    const exitCode = await proc.exited;
+    if (timedOut) {
+      throw new HookTimeoutError(options.timeout);
+    }
+    const [stdoutText, stderrText] = await Promise.all([
+      readPipeWithDeadline(proc.stdout, 750),
+      readPipeWithDeadline(proc.stderr, 750)
     ]);
+    killGroup(proc);
     return { stdout: stdoutText, stderr: stderrText, exitCode };
   } finally {
+    if (timeoutTimer)
+      clearTimeout(timeoutTimer);
+    try {
+      rmSync3(tempPath, { force: true });
+    } catch {}
+  }
+}
+function killGroup(proc) {
+  if (!proc)
+    return;
+  try {
+    process.kill(-proc.pid, "SIGKILL");
+  } catch {
     try {
-      rmSync2(tempPath, { force: true });
+      process.kill(proc.pid, "SIGKILL");
     } catch {}
   }
 }
-var init_run = () => {};
+var HookTimeoutError, BASH_EXTENSIONS, BUN_EXTENSIONS;
+var init_run = __esm(() => {
+  HookTimeoutError = class HookTimeoutError extends Error {
+    timeoutMs;
+    constructor(timeoutMs) {
+      super(`Hook timed out after ${timeoutMs}ms (process group killed)`);
+      this.name = "HookTimeoutError";
+      this.timeoutMs = timeoutMs;
+    }
+  };
+  BASH_EXTENSIONS = new Set(["sh", "bash"]);
+  BUN_EXTENSIONS = new Set(["ts", "tsx", "js", "jsx", "mjs", "cjs", "mts", "cts"]);
+});
 
 // src/lib/custom-install.ts
 var exports_custom_install = {};
@@ -5535,7 +5929,7 @@ __export(exports_custom_install, {
   installCustomSource: () => installCustomSource,
   ensureCustomDir: () => ensureCustomDir
 });
-import { existsSync as existsSync10, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync4 } from "fs";
 import { join as join10 } from "path";
 import { tmpdir } from "os";
 function manifestAt(dir) {
@@ -5573,7 +5967,7 @@ async function cloneToTemp(gitUrl) {
     proc.exited
   ]);
   if (exitCode !== 0) {
-    rmSync3(tmp, { recursive: true, force: true });
+    rmSync4(tmp, { recursive: true, force: true });
     throw new Error(`git clone failed (${exitCode}): ${stderr.trim()}`);
   }
   return join10(tmp, "repo");
@@ -5588,58 +5982,275 @@ function isCustomSource(value) {
     return true;
   return existsSync10(value);
 }
-async function installCustomSource(source) {
-  if (isGitUrl(source)) {
-    const repoDir = await cloneToTemp(source);
-    try {
-      return copyManifestDir(repoDir, source, "git");
-    } finally {
-      rmSync3(repoDir, { recursive: true, force: true });
-    }
+async function installCustomSource(source) {
+  if (isGitUrl(source)) {
+    const repoDir = await cloneToTemp(source);
+    try {
+      return copyManifestDir(repoDir, source, "git");
+    } finally {
+      rmSync4(repoDir, { recursive: true, force: true });
+    }
+  }
+  if (source.startsWith("http://") || source.startsWith("https://")) {
+    return installManifestUrl(source);
+  }
+  if (!existsSync10(source)) {
+    throw new Error(`No such local path: ${source}`);
+  }
+  if (source.endsWith("manifest.json")) {
+    const manifest = parseManifest(readFileSync7(source, "utf-8"));
+    return writeFromManifest(manifest, source.substring(0, source.lastIndexOf("/")), source, "local");
+  }
+  return copyManifestDir(source, source, "local");
+}
+async function installManifestUrl(url) {
+  const res = await fetch(url, { redirect: "follow" });
+  if (!res.ok) {
+    throw new Error(`Failed to fetch manifest (${res.status}): ${url}`);
+  }
+  const manifest = parseManifest(await res.text());
+  let script;
+  if (manifest.script.includes(`
+`)) {
+    script = { path: "script.ts", content: manifest.script };
+  } else {
+    const base = url.substring(0, url.lastIndexOf("/"));
+    const scriptUrl = `${base}/${manifest.script}`;
+    const scriptRes = await fetch(scriptUrl, { redirect: "follow" });
+    if (!scriptRes.ok) {
+      throw new Error(`Failed to fetch script (${scriptRes.status}): ${scriptUrl}`);
+    }
+    script = { path: manifest.script, content: await scriptRes.text() };
+  }
+  const name = shortManifestName(manifest.name);
+  const { dir, scriptPath } = writeCustomHook(name, manifest, script.content, script.path);
+  return { name, version: manifest.version, kind: "url", source: url, dir, scriptPath };
+}
+function ensureCustomDir() {
+  const dir = getCustomHooksDir();
+  mkdirSync7(dir, { recursive: true });
+  return dir;
+}
+var init_custom_install = __esm(() => {
+  init_config();
+  init_manifest();
+});
+
+// src/lib/sync.ts
+var exports_sync = {};
+__export(exports_sync, {
+  syncHooks: () => syncHooks,
+  planSync: () => planSync,
+  fetchPinnedHook: () => fetchPinnedHook
+});
+import { createHash as createHash2 } from "crypto";
+import { readFileSync as readFileSync8 } from "fs";
+function sha256OfText(text) {
+  return createHash2("sha256").update(text).digest("hex");
+}
+function sha256OfPath(path) {
+  return createHash2("sha256").update(readFileSync8(path)).digest("hex");
+}
+function collectBundledCatalog() {
+  const out = [];
+  for (const meta of HOOKS) {
+    const scriptPath = resolveScriptPath(meta.name);
+    if (!scriptPath)
+      continue;
+    out.push({
+      name: meta.name,
+      version: meta.version,
+      sha256: sha256OfPath(scriptPath)
+    });
+  }
+  return out;
+}
+async function fetchJson(base, path) {
+  const headers = { accept: "application/json" };
+  const apiKey = resolveApiKey();
+  if (apiKey)
+    headers["x-api-key"] = apiKey;
+  const res = await fetch(`${base}${path}`, {
+    headers,
+    redirect: "error",
+    signal: AbortSignal.timeout(15000)
+  });
+  if (res.status === 401) {
+    throw new Error("registry requires API key \u2014 set HASNA_HOOKS_API_KEY or HOOKS_API_KEY (vault-delivered, never stored)");
+  }
+  if (!res.ok) {
+    throw new Error(`GET ${path} failed with status ${res.status}`);
+  }
+  return res.json();
+}
+async function fetchRemoteState(apiUrl) {
+  const catalog = await fetchJson(apiUrl, "/api/v1/catalog");
+  const remoteLock = await fetchJson(apiUrl, "/api/v1/lock");
+  if (!catalog.hooks || !Array.isArray(catalog.hooks)) {
+    throw new Error("remote catalog is malformed: missing hooks array");
+  }
+  if (!remoteLock.hooks || typeof remoteLock.hooks !== "object") {
+    throw new Error("remote lock is malformed: missing hooks map");
+  }
+  return { catalog: catalog.hooks, remoteLock };
+}
+function computeDiff(catalog, remoteLock) {
+  const local = readLock();
+  const diff = { added: [], updated: [], unchanged: [], skipped: [] };
+  for (const entry of catalog) {
+    if (!entry.name || !entry.version || !entry.sha256)
+      continue;
+    const pin = local.hooks[entry.name];
+    const remotePin = remoteLock ? remoteLock.hooks[entry.name] : entry;
+    if (remoteLock && !remotePin) {
+      diff.skipped.push(entry.name);
+      continue;
+    }
+    const pinnedLocally = pin && pin.version === entry.version && pin.sha256 === entry.sha256;
+    if (pinnedLocally) {
+      diff.unchanged.push(entry.name);
+    } else if (pin) {
+      diff.updated.push(entry.name);
+    } else {
+      diff.added.push(entry.name);
+    }
+  }
+  return diff;
+}
+async function planSync() {
+  const apiUrl = resolveApiUrl();
+  if (apiUrl) {
+    const { catalog, remoteLock } = await fetchRemoteState(apiUrl);
+    return { apiUrl, dryRun: false, diff: computeDiff(catalog, remoteLock) };
+  }
+  const diff = computeDiff(collectBundledCatalog(), null);
+  return { apiUrl: null, dryRun: false, diff };
+}
+async function syncHooks(options = {}) {
+  const apiUrl = resolveApiUrl();
+  const plan = await planSync();
+  if (options.dryRun)
+    return { ...plan, dryRun: true };
+  if (!apiUrl) {
+    const db2 = getDb();
+    for (const entry of collectBundledCatalog()) {
+      setPinnedHook(entry.name, { version: entry.version, sha256: entry.sha256, source: "bundled" });
+      upsertHookRecord(db2, {
+        name: entry.name,
+        version: entry.version,
+        sha256: entry.sha256,
+        source_type: "bundled",
+        source_ref: "apps/hooks/hooks",
+        last_verified_at: new Date().toISOString()
+      });
+    }
+    return plan;
+  }
+  const { catalog, remoteLock } = await fetchRemoteState(apiUrl);
+  const diff = computeDiff(catalog, remoteLock);
+  const toFetch = [...diff.added, ...diff.updated];
+  const artifacts = new Map;
+  for (const name of toFetch) {
+    const entry = remoteLock.hooks[name];
+    if (!entry)
+      continue;
+    const artifact = await fetchJson(apiUrl, `/api/v1/hooks/${name}/${entry.version}`);
+    if (!artifact.manifest || typeof artifact.script !== "string") {
+      throw new Error(`artifact for '${name}@${entry.version}' is malformed`);
+    }
+    const actualSha = sha256OfText(artifact.script);
+    if (actualSha !== entry.sha256) {
+      throw new Error(`sha256 mismatch for '${name}@${entry.version}': lock says ${entry.sha256}, artifact has ${actualSha}`);
+    }
+    artifacts.set(name, artifact);
+  }
+  const db = getDb();
+  for (const name of toFetch) {
+    const artifact = artifacts.get(name);
+    const entry = remoteLock.hooks[name];
+    if (!artifact || !entry)
+      continue;
+    const manifest = parseManifest(JSON.stringify({ ...artifact.manifest, name: shortManifestName(artifact.manifest.name || name) }));
+    const scriptRel = artifact.manifest.script.includes(`
+`) ? "script.ts" : artifact.manifest.script;
+    writeCustomHook(name, manifest, artifact.script, scriptRel);
+    const scriptPath = resolveScriptPath(name);
+    const actual = await sha256File(scriptPath);
+    if (actual !== entry.sha256) {
+      throw new Error(`sha256 mismatch after write for '${name}@${entry.version}': lock says ${entry.sha256}, on disk ${actual}`);
+    }
+    setPinnedHook(name, { version: entry.version, sha256: entry.sha256, source: entry.source ?? "remote" });
+    upsertHookRecord(db, {
+      name,
+      version: entry.version,
+      sha256: entry.sha256,
+      source_type: entry.source ?? "remote",
+      source_ref: apiUrl,
+      last_verified_at: new Date().toISOString()
+    });
+  }
+  return { apiUrl, dryRun: false, diff };
+}
+async function fetchPinnedHook(name, version, apiUrl) {
+  const remoteLock = await fetchJson(apiUrl, "/api/v1/lock");
+  const entry = remoteLock.hooks?.[name];
+  if (!entry) {
+    throw new Error(`Hook '${name}' is not in the remote registry lock`);
   }
-  if (source.startsWith("http://") || source.startsWith("https://")) {
-    return installManifestUrl(source);
+  if (entry.version !== version) {
+    throw new Error(`Hook '${name}' version ${version} is not in the remote registry (available: ${entry.version})`);
   }
-  if (!existsSync10(source)) {
-    throw new Error(`No such local path: ${source}`);
+  const artifact = await fetchJson(apiUrl, `/api/v1/hooks/${name}/${version}`);
+  if (!artifact.manifest || typeof artifact.script !== "string") {
+    throw new Error(`artifact for '${name}@${version}' is malformed`);
   }
-  if (source.endsWith("manifest.json")) {
-    const manifest = parseManifest(readFileSync7(source, "utf-8"));
-    return writeFromManifest(manifest, source.substring(0, source.lastIndexOf("/")), source, "local");
+  const manifestName = shortManifestName(artifact.manifest.name ?? name);
+  if (manifestName !== name) {
+    throw new Error(`artifact for '${name}@${version}' declares a different hook name ('${manifestName}')`);
   }
-  return copyManifestDir(source, source, "local");
-}
-async function installManifestUrl(url) {
-  const res = await fetch(url, { redirect: "follow" });
-  if (!res.ok) {
-    throw new Error(`Failed to fetch manifest (${res.status}): ${url}`);
+  if (artifact.manifest.version !== version) {
+    throw new Error(`artifact for '${name}@${version}' declares a different version ('${artifact.manifest.version}')`);
   }
-  const manifest = parseManifest(await res.text());
-  let script;
-  if (manifest.script.includes(`
-`)) {
-    script = { path: "script.ts", content: manifest.script };
-  } else {
-    const base = url.substring(0, url.lastIndexOf("/"));
-    const scriptUrl = `${base}/${manifest.script}`;
-    const scriptRes = await fetch(scriptUrl, { redirect: "follow" });
-    if (!scriptRes.ok) {
-      throw new Error(`Failed to fetch script (${scriptRes.status}): ${scriptUrl}`);
-    }
-    script = { path: manifest.script, content: await scriptRes.text() };
+  const actualSha = sha256OfText(artifact.script);
+  if (actualSha !== entry.sha256) {
+    throw new Error(`sha256 mismatch for '${name}@${version}': lock says ${entry.sha256}, artifact has ${actualSha}`);
   }
-  const name = shortManifestName(manifest.name);
-  const { dir, scriptPath } = writeCustomHook(name, manifest, script.content, script.path);
-  return { name, version: manifest.version, kind: "url", source: url, dir, scriptPath };
-}
-function ensureCustomDir() {
-  const dir = getCustomHooksDir();
-  mkdirSync7(dir, { recursive: true });
-  return dir;
+  const manifest = parseManifest(JSON.stringify({ ...artifact.manifest, name: shortManifestName(artifact.manifest.name || name) }));
+  const scriptRel = artifact.manifest.script.includes(`
+`) ? "script.ts" : artifact.manifest.script;
+  writeCustomHook(name, manifest, artifact.script, scriptRel);
+  const scriptPath = resolveScriptPath(name);
+  const actual = await sha256File(scriptPath);
+  if (actual !== entry.sha256) {
+    throw new Error(`sha256 mismatch after write for '${name}@${version}': lock says ${entry.sha256}, on disk ${actual}`);
+  }
+  const db = getDb();
+  setPinnedHook(name, { version, sha256: entry.sha256, source: entry.source ?? "remote" });
+  upsertHookRecord(db, {
+    name,
+    version,
+    sha256: entry.sha256,
+    source_type: entry.source ?? "remote",
+    source_ref: apiUrl,
+    last_verified_at: new Date().toISOString()
+  });
+  return {
+    name,
+    version,
+    sha256: entry.sha256,
+    source: entry.source ?? "remote",
+    source_ref: apiUrl,
+    artifact,
+    scriptPath
+  };
 }
-var init_custom_install = __esm(() => {
+var init_sync = __esm(() => {
+  init_registry();
   init_config();
+  init_db();
+  init_store();
   init_manifest();
+  init_resolve();
 });
 
 // src/db/pg-migrations.ts
@@ -6149,234 +6760,75 @@ function authorized(req, apiKey) {
     return secureEqual(header.slice("Bearer ".length), apiKey);
   return secureEqual(req.headers.get("x-api-key") ?? "", apiKey);
 }
-function json(body, status = 200, headers = {}) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json", ...headers }
-  });
-}
-function handleServeRequest(req, apiKey) {
-  const url = new URL(req.url);
-  if (url.pathname === "/health" && req.method === "GET") {
-    return Promise.resolve(json({ status: "ok", name: SERVE_SERVICE_NAME }));
-  }
-  if (url.pathname === "/api/v1/catalog" && req.method === "GET") {
-    return buildCatalog().then((catalog) => json({ hooks: catalog }));
-  }
-  if (url.pathname === "/api/v1/lock" && req.method === "GET") {
-    return Promise.resolve(json(readLock()));
-  }
-  const artifactMatch = /^\/api\/v1\/hooks\/([\w-]+)\/(\d+\.\d+\.\d+)$/.exec(url.pathname);
-  if (artifactMatch && req.method === "GET") {
-    const [, name, version] = artifactMatch;
-    return artifactFor(name, version).then(async (artifact) => {
-      if (!artifact)
-        return json({ error: `Hook '${name}@${version}' not found locally` }, 404);
-      const resolved = resolveHook(name);
-      const sha = resolved ? await sha256File(resolved.scriptPath) : artifact.manifest.name;
-      return json(artifact, 200, { "x-hook-sha256": sha });
-    });
-  }
-  if (url.pathname === "/api/v1/hooks" && req.method === "PUT") {
-    if (!authorized(req, apiKey)) {
-      return Promise.resolve(json({ error: "unauthorized: valid API key required to publish" }, 401));
-    }
-    return req.json().then((body) => {
-      const name = body.name ?? "";
-      const version = body.version ?? "";
-      const resolved = resolveHook(name);
-      if (!resolved)
-        return json({ error: `Hook '${name}' not found in local store` }, 404);
-      if (version && version !== resolved.version) {
-        return json({ error: `Version mismatch: local '${name}' is ${resolved.version}, requested ${version}` }, 409);
-      }
-      const check = retrustHook(name, resolved.scriptPath, resolved.version, "serve");
-      return json({ ok: true, hook: { name, version: resolved.version, sha256: check.actual } });
-    }, () => json({ error: "invalid JSON body" }, 400));
-  }
-  return Promise.resolve(json({ error: "Not Found" }, 404));
-}
-function startServeServer(options) {
-  const port = options.port ?? DEFAULT_SERVE_PORT;
-  const host = options.host ?? SERVE_HOST;
-  const apiKey = resolveApiKey(options.apiKey);
-  const server = Bun.serve({
-    hostname: host,
-    port,
-    async fetch(req) {
-      return handleServeRequest(req, apiKey);
-    }
-  });
-  console.error(`hooks registry listening on http://${host}:${port} (publish requires an API key)`);
-  return server;
-}
-var DEFAULT_SERVE_PORT = 39428, SERVE_HOST = "127.0.0.1", SERVE_SERVICE_NAME = "hooks-registry";
-var init_serve = __esm(() => {
-  init_registry();
-  init_manifest();
-  init_store();
-  init_resolve();
-  init_config();
-  if (false) {}
-});
-
-// src/lib/sync.ts
-var exports_sync = {};
-__export(exports_sync, {
-  syncHooks: () => syncHooks,
-  planSync: () => planSync
-});
-import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync8 } from "fs";
-function sha256OfText(text) {
-  return createHash2("sha256").update(text).digest("hex");
-}
-function sha256OfPath(path) {
-  return createHash2("sha256").update(readFileSync8(path)).digest("hex");
-}
-function collectBundledCatalog() {
-  const out = [];
-  for (const meta of HOOKS) {
-    const scriptPath = resolveScriptPath(meta.name);
-    if (!scriptPath)
-      continue;
-    out.push({
-      name: meta.name,
-      version: meta.version,
-      sha256: sha256OfPath(scriptPath)
-    });
-  }
-  return out;
-}
-async function fetchJson(base, path) {
-  const headers = { accept: "application/json" };
-  const apiKey = resolveApiKey();
-  if (apiKey)
-    headers["x-api-key"] = apiKey;
-  const res = await fetch(`${base}${path}`, {
-    headers,
-    signal: AbortSignal.timeout(15000)
-  });
-  if (res.status === 401) {
-    throw new Error("registry requires API key \u2014 set HASNA_HOOKS_API_KEY or HOOKS_API_KEY (vault-delivered, never stored)");
-  }
-  if (!res.ok) {
-    throw new Error(`GET ${path} failed with status ${res.status}`);
-  }
-  return res.json();
-}
-async function fetchRemoteState(apiUrl) {
-  const catalog = await fetchJson(apiUrl, "/api/v1/catalog");
-  const remoteLock = await fetchJson(apiUrl, "/api/v1/lock");
-  if (!catalog.hooks || !Array.isArray(catalog.hooks)) {
-    throw new Error("remote catalog is malformed: missing hooks array");
-  }
-  if (!remoteLock.hooks || typeof remoteLock.hooks !== "object") {
-    throw new Error("remote lock is malformed: missing hooks map");
-  }
-  return { catalog: catalog.hooks, remoteLock };
-}
-function computeDiff(catalog, remoteLock) {
-  const local = readLock();
-  const diff = { added: [], updated: [], unchanged: [], skipped: [] };
-  for (const entry of catalog) {
-    if (!entry.name || !entry.version || !entry.sha256)
-      continue;
-    const pin = local.hooks[entry.name];
-    const remotePin = remoteLock ? remoteLock.hooks[entry.name] : entry;
-    if (remoteLock && !remotePin) {
-      diff.skipped.push(entry.name);
-      continue;
-    }
-    const pinnedLocally = pin && pin.version === entry.version && pin.sha256 === entry.sha256;
-    if (pinnedLocally) {
-      diff.unchanged.push(entry.name);
-    } else if (pin) {
-      diff.updated.push(entry.name);
-    } else {
-      diff.added.push(entry.name);
-    }
-  }
-  return diff;
-}
-async function planSync() {
-  const apiUrl = resolveApiUrl();
-  if (apiUrl) {
-    const { catalog, remoteLock } = await fetchRemoteState(apiUrl);
-    return { apiUrl, dryRun: false, diff: computeDiff(catalog, remoteLock) };
-  }
-  const diff = computeDiff(collectBundledCatalog(), null);
-  return { apiUrl: null, dryRun: false, diff };
-}
-async function syncHooks(options = {}) {
-  const apiUrl = resolveApiUrl();
-  const plan = await planSync();
-  if (options.dryRun)
-    return { ...plan, dryRun: true };
-  if (!apiUrl) {
-    const db2 = getDb();
-    for (const entry of collectBundledCatalog()) {
-      setPinnedHook(entry.name, { version: entry.version, sha256: entry.sha256, source: "bundled" });
-      upsertHookRecord(db2, {
-        name: entry.name,
-        version: entry.version,
-        sha256: entry.sha256,
-        source_type: "bundled",
-        source_ref: "apps/hooks/hooks",
-        last_verified_at: new Date().toISOString()
-      });
-    }
-    return plan;
-  }
-  const { catalog, remoteLock } = await fetchRemoteState(apiUrl);
-  const diff = computeDiff(catalog, remoteLock);
-  const toFetch = [...diff.added, ...diff.updated];
-  const artifacts = new Map;
-  for (const name of toFetch) {
-    const entry = remoteLock.hooks[name];
-    if (!entry)
-      continue;
-    const artifact = await fetchJson(apiUrl, `/api/v1/hooks/${name}/${entry.version}`);
-    if (!artifact.manifest || typeof artifact.script !== "string") {
-      throw new Error(`artifact for '${name}@${entry.version}' is malformed`);
-    }
-    const actualSha = sha256OfText(artifact.script);
-    if (actualSha !== entry.sha256) {
-      throw new Error(`sha256 mismatch for '${name}@${entry.version}': lock says ${entry.sha256}, artifact has ${actualSha}`);
-    }
-    artifacts.set(name, artifact);
+function json(body, status = 200, headers = {}) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json", ...headers }
+  });
+}
+function handleServeRequest(req, apiKey) {
+  const url = new URL(req.url);
+  if (url.pathname === "/health" && req.method === "GET") {
+    return Promise.resolve(json({ status: "ok", name: SERVE_SERVICE_NAME }));
   }
-  const db = getDb();
-  for (const name of toFetch) {
-    const artifact = artifacts.get(name);
-    const entry = remoteLock.hooks[name];
-    if (!artifact || !entry)
-      continue;
-    const manifest = parseManifest(JSON.stringify({ ...artifact.manifest, name: shortManifestName(artifact.manifest.name || name) }));
-    const scriptRel = artifact.manifest.script.includes(`
-`) ? "script.ts" : artifact.manifest.script;
-    writeCustomHook(name, manifest, artifact.script, scriptRel);
-    const scriptPath = resolveScriptPath(name);
-    const actual = await sha256File(scriptPath);
-    setPinnedHook(name, { version: entry.version, sha256: actual, source: entry.source ?? "remote" });
-    upsertHookRecord(db, {
-      name,
-      version: entry.version,
-      sha256: actual,
-      source_type: entry.source ?? "remote",
-      source_ref: apiUrl,
-      last_verified_at: new Date().toISOString()
+  if (url.pathname === "/api/v1/catalog" && req.method === "GET") {
+    return buildCatalog().then((catalog) => json({ hooks: catalog }));
+  }
+  if (url.pathname === "/api/v1/lock" && req.method === "GET") {
+    return Promise.resolve(json(readLock()));
+  }
+  const artifactMatch = /^\/api\/v1\/hooks\/([\w-]+)\/(\d+\.\d+\.\d+)$/.exec(url.pathname);
+  if (artifactMatch && req.method === "GET") {
+    const [, name, version] = artifactMatch;
+    return artifactFor(name, version).then(async (artifact) => {
+      if (!artifact)
+        return json({ error: `Hook '${name}@${version}' not found locally` }, 404);
+      const resolved = resolveHook(name);
+      const sha = resolved ? await sha256File(resolved.scriptPath) : artifact.manifest.name;
+      return json(artifact, 200, { "x-hook-sha256": sha });
     });
   }
-  return { apiUrl, dryRun: false, diff };
+  if (url.pathname === "/api/v1/hooks" && req.method === "PUT") {
+    if (!authorized(req, apiKey)) {
+      return Promise.resolve(json({ error: "unauthorized: valid API key required to publish" }, 401));
+    }
+    return req.json().then((body) => {
+      const name = body.name ?? "";
+      const version = body.version ?? "";
+      const resolved = resolveHook(name);
+      if (!resolved)
+        return json({ error: `Hook '${name}' not found in local store` }, 404);
+      if (version && version !== resolved.version) {
+        return json({ error: `Version mismatch: local '${name}' is ${resolved.version}, requested ${version}` }, 409);
+      }
+      const check = retrustHook(name, resolved.scriptPath, resolved.version, "serve");
+      return json({ ok: true, hook: { name, version: resolved.version, sha256: check.actual } });
+    }, () => json({ error: "invalid JSON body" }, 400));
+  }
+  return Promise.resolve(json({ error: "Not Found" }, 404));
 }
-var init_sync = __esm(() => {
+function startServeServer(options) {
+  const port = options.port ?? DEFAULT_SERVE_PORT;
+  const host = options.host ?? SERVE_HOST;
+  const apiKey = resolveApiKey(options.apiKey);
+  const server = Bun.serve({
+    hostname: host,
+    port,
+    async fetch(req) {
+      return handleServeRequest(req, apiKey);
+    }
+  });
+  console.error(`hooks registry listening on http://${host}:${port} (publish requires an API key)`);
+  return server;
+}
+var DEFAULT_SERVE_PORT = 39428, SERVE_HOST = "127.0.0.1", SERVE_SERVICE_NAME = "hooks-registry";
+var init_serve = __esm(() => {
   init_registry();
-  init_config();
-  init_db();
-  init_store();
   init_manifest();
+  init_store();
   init_resolve();
+  init_config();
+  if (false) {}
 });
 
 // src/cf/provision.ts
@@ -6476,14 +6928,77 @@ import { createServer } from "http";
 import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
 import { join as join11, dirname as dirname5 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
-async function runVerifiedHook(name, scriptPath, stdin, timeoutMs) {
-  const content = readFileSync9(scriptPath);
-  const check = checkScriptHash(name, sha256Of(content));
+async function runVerifiedHook(name, stdin, timeoutMs) {
+  const { resolveHook: resolveHook2, resolveScriptPath: resolveScriptPath2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
+  const resolved = resolveHook2(name);
+  const hookScript = resolveScriptPath2(name);
+  if (!resolved || !hookScript || !existsSync11(hookScript)) {
+    throw new Error(`Hook '${name}' not found`);
+  }
+  const content = readFileSync9(hookScript);
+  const sha = sha256Of(content);
+  const check = checkScriptHash(name, sha);
   if (!check.ok) {
     throw new Error(`Hook '${name}' script changed since it was trusted (sha256 ${check.expected} != ${check.actual}). Run 'hooks trust ${name}' to trust the new content.`);
   }
-  const { executeVerifiedScript: executeVerifiedScript2 } = await Promise.resolve().then(() => (init_run(), exports_run));
-  return executeVerifiedScript2({ name, scriptPath, content, stdin, env: process.env, timeout: timeoutMs });
+  const { executeVerifiedScript: executeVerifiedScript2, HookTimeoutError: HookTimeoutError2 } = await Promise.resolve().then(() => (init_run(), exports_run));
+  const started = Date.now();
+  let ran;
+  try {
+    ran = await executeVerifiedScript2({ name, scriptPath: hookScript, content, stdin, env: process.env, timeout: timeoutMs });
+  } catch (err) {
+    try {
+      const { recordHookRun: recordHookRun2, resolveEventType: resolveEventType2 } = await Promise.resolve().then(() => (init_db_writer(), exports_db_writer));
+      let inputJson = {};
+      try {
+        inputJson = JSON.parse(stdin);
+      } catch {}
+      recordHookRun2({
+        hookName: name,
+        eventType: resolveEventType2(inputJson.hook_event_name, resolved.events[0] ?? "PostToolUse"),
+        version: resolved.version,
+        sha256: sha,
+        sessionId: typeof inputJson.session_id === "string" ? inputJson.session_id : null,
+        toolName: typeof inputJson.tool_name === "string" ? inputJson.tool_name : null,
+        toolInput: inputJson.tool_input,
+        error: err instanceof Error ? err.message.slice(0, 500) : String(err),
+        exitCode: -1,
+        durationMs: Date.now() - started,
+        projectDir: process.cwd()
+      });
+    } catch {}
+    if (err instanceof HookTimeoutError2)
+      throw err;
+    throw err;
+  }
+  const durationMs = Date.now() - started;
+  try {
+    const { recordHookRun: recordHookRun2, resolveEventType: resolveEventType2 } = await Promise.resolve().then(() => (init_db_writer(), exports_db_writer));
+    let inputJson = {};
+    try {
+      inputJson = JSON.parse(stdin);
+    } catch {}
+    let outputJson = {};
+    try {
+      outputJson = JSON.parse(ran.stdout);
+    } catch {}
+    const blocked = outputJson.decision === "block" || outputJson.continue === false;
+    recordHookRun2({
+      hookName: name,
+      eventType: resolveEventType2(inputJson.hook_event_name, resolved.events[0] ?? "PostToolUse"),
+      version: resolved.version,
+      sha256: sha,
+      sessionId: typeof inputJson.session_id === "string" ? inputJson.session_id : null,
+      toolName: typeof inputJson.tool_name === "string" ? inputJson.tool_name : null,
+      toolInput: inputJson.tool_input,
+      result: blocked ? "block" : "continue",
+      error: ran.exitCode !== 0 ? (ran.stderr || `hook exited with code ${ran.exitCode}`).slice(0, 500) : null,
+      exitCode: ran.exitCode,
+      durationMs,
+      projectDir: process.cwd()
+    });
+  } catch {}
+  return ran;
 }
 function formatInstallResults(results, extra) {
   const installed = results.filter((r) => r.success).map((r) => r.hook);
@@ -6765,17 +7280,14 @@ function createHooksServer() {
     name: z2.string().describe("Hook name (e.g. 'gitguard', 'checkpoint')"),
     input: z2.record(z2.string(), z2.unknown()).default(() => ({})).describe("Hook input as JSON object (HookInput)"),
     profile: z2.string().optional().describe("Agent profile ID to inject into hook input"),
-    timeout_ms: z2.number().default(1e4).describe("Timeout in milliseconds (default: 10000)")
+    timeout_ms: z2.number().int().positive().max(600000).optional().describe("Timeout in milliseconds (default: the hook's manifest timeout_ms or 10000)")
   }, async ({ name, input, profile, timeout_ms }) => {
-    const meta = getHook(name);
-    if (!meta) {
+    const { resolveHook: resolveHook2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
+    const resolved = resolveHook2(name);
+    if (!resolved) {
       return { content: [{ type: "text", text: JSON.stringify({ error: `Hook '${name}' not found` }) }] };
     }
-    const hookDir = getHookPath(name);
-    const hookScript = join11(hookDir, "src", "hook.ts");
-    if (!existsSync11(hookScript)) {
-      return { content: [{ type: "text", text: JSON.stringify({ error: `Hook script not found: ${hookScript}` }) }] };
-    }
+    const effectiveTimeout = timeout_ms ?? resolved.timeoutMs ?? 1e4;
     let hookInput = { ...input };
     if (profile) {
       const p = getProfile(profile);
@@ -6788,13 +7300,38 @@ function createHooksServer() {
         };
       }
     }
-    let ran = null;
     try {
-      ran = await Promise.race([
-        runVerifiedHook(name, hookScript, JSON.stringify(hookInput), timeout_ms),
-        new Promise((resolve2) => setTimeout(() => resolve2(null), timeout_ms))
-      ]);
+      const ran = await runVerifiedHook(name, JSON.stringify(hookInput), effectiveTimeout);
+      const stdoutText = ran.stdout;
+      const stderrText = ran.stderr;
+      let output = {};
+      try {
+        output = JSON.parse(stdoutText);
+      } catch {
+        output = stdoutText ? { raw: stdoutText } : {};
+      }
+      return {
+        content: [{
+          type: "text",
+          text: JSON.stringify({
+            hook: name,
+            output,
+            stderr: stderrText || undefined,
+            exitCode: ran.exitCode,
+            timeout_ms: effectiveTimeout
+          })
+        }]
+      };
     } catch (err) {
+      const { HookTimeoutError: HookTimeoutError2 } = await Promise.resolve().then(() => (init_run(), exports_run));
+      if (err instanceof HookTimeoutError2) {
+        return {
+          content: [{
+            type: "text",
+            text: JSON.stringify({ hook: name, timedOut: true, timeout_ms: effectiveTimeout, error: err.message })
+          }]
+        };
+      }
       return {
         content: [{
           type: "text",
@@ -6802,27 +7339,6 @@ function createHooksServer() {
         }]
       };
     }
-    const timedOut = ran === null;
-    const stdoutText = ran?.stdout ?? "";
-    const stderrText = ran?.stderr ?? "";
-    let output = {};
-    try {
-      output = JSON.parse(stdoutText);
-    } catch {
-      output = stdoutText ? { raw: stdoutText } : {};
-    }
-    return {
-      content: [{
-        type: "text",
-        text: JSON.stringify({
-          hook: name,
-          output,
-          stderr: stderrText || undefined,
-          exitCode: ran?.exitCode ?? -1,
-          ...timedOut ? { timedOut: true, timeout_ms } : {}
-        })
-      }]
-    };
   });
   defineTool("hooks_update", "Re-register installed hooks to pick up new package version (reinstalls with overwrite)", {
     hooks: z2.array(z2.string()).optional().describe("Hook names to update (omit to update all installed hooks)"),
@@ -6883,11 +7399,11 @@ function createHooksServer() {
     tool_name: z2.string().describe("Tool name to simulate (e.g. 'Bash', 'Write', 'Edit')"),
     tool_input: z2.record(z2.string(), z2.unknown()).default(() => ({})).describe("Tool input to pass to matching hooks"),
     scope: z2.enum(["global", "project"]).default("global").describe("Scope to check"),
-    timeout_ms: z2.number().default(5000).describe("Per-hook timeout in milliseconds")
+    timeout_ms: z2.number().int().positive().max(600000).optional().describe("Per-hook timeout in milliseconds (default: the hook's manifest timeout_ms or 5000)")
   }, async ({ tool_name, tool_input, scope, timeout_ms }) => {
     const registered = getRegisteredHooks(scope);
     const matchingHooks = registered.filter((name) => {
-      const meta = getHook(name);
+      const meta = resolveHookMeta(name) ?? getHook(name);
       if (!meta || meta.event !== "PreToolUse")
         return false;
       if (!meta.matcher)
@@ -6903,26 +7419,23 @@ function createHooksServer() {
     }
     const input = { tool_name, tool_input };
     const results = await Promise.all(matchingHooks.map(async (name) => {
-      const hookDir = getHookPath(name);
-      const hookScript = join11(hookDir, "src", "hook.ts");
-      if (!existsSync11(hookScript))
-        return { name, decision: "approve", error: "script not found" };
-      let ran = null;
+      const { resolveHook: resolveHook2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
+      const resolved = resolveHook2(name);
+      const effectiveTimeout = timeout_ms ?? resolved?.timeoutMs ?? 5000;
       try {
-        ran = await Promise.race([
-          runVerifiedHook(name, hookScript, JSON.stringify(input), timeout_ms),
-          new Promise((r) => setTimeout(() => r(null), timeout_ms))
-        ]);
+        const ran = await runVerifiedHook(name, JSON.stringify(input), effectiveTimeout);
+        let output = {};
+        try {
+          output = JSON.parse(ran.stdout);
+        } catch {}
+        return { name, decision: output.decision ?? "approve", reason: output.reason, raw: output };
       } catch (err) {
+        const { HookTimeoutError: HookTimeoutError2 } = await Promise.resolve().then(() => (init_run(), exports_run));
+        if (err instanceof HookTimeoutError2) {
+          return { name, decision: "approve", timedOut: true, timeout_ms: effectiveTimeout };
+        }
         return { name, decision: "block", error: err instanceof Error ? err.message : String(err) };
       }
-      if (ran === null)
-        return { name, decision: "approve", timedOut: true };
-      let output = {};
-      try {
-        output = JSON.parse(ran.stdout);
-      } catch {}
-      return { name, decision: output.decision ?? "approve", reason: output.reason, raw: output };
     }));
     const blocked = results.find((r) => r.decision === "block");
     return {
@@ -6962,33 +7475,31 @@ function createHooksServer() {
       name: z2.string().describe("Hook name"),
       input: z2.record(z2.string(), z2.unknown()).default(() => ({})).describe("Hook input JSON")
     })).describe("List of hooks to run with their inputs"),
-    timeout_ms: z2.number().default(1e4).describe("Per-hook timeout in milliseconds")
+    timeout_ms: z2.number().int().positive().max(600000).optional().describe("Per-hook timeout in milliseconds (default: the hook's manifest timeout_ms or 10000)")
   }, async ({ hooks, timeout_ms }) => {
     const results = await Promise.all(hooks.map(async ({ name, input }) => {
-      const meta = getHook(name);
-      if (!meta)
+      const { resolveHook: resolveHook2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
+      const resolved = resolveHook2(name);
+      if (!resolved)
         return { name, error: `Hook '${name}' not found` };
-      const hookScript = join11(getHookPath(name), "src", "hook.ts");
-      if (!existsSync11(hookScript))
-        return { name, error: "script not found" };
-      let ran = null;
+      const effectiveTimeout = timeout_ms ?? resolved.timeoutMs ?? 1e4;
       try {
-        ran = await Promise.race([
-          runVerifiedHook(name, hookScript, JSON.stringify(input), timeout_ms),
-          new Promise((r) => setTimeout(() => r(null), timeout_ms))
-        ]);
+        const ran = await runVerifiedHook(name, JSON.stringify(input), effectiveTimeout);
+        const stdoutText = ran.stdout;
+        let output = {};
+        try {
+          output = JSON.parse(stdoutText);
+        } catch {
+          output = stdoutText ? { raw: stdoutText } : {};
+        }
+        return { name, output, exitCode: ran.exitCode, timeout_ms: effectiveTimeout };
       } catch (err) {
+        const { HookTimeoutError: HookTimeoutError2 } = await Promise.resolve().then(() => (init_run(), exports_run));
+        if (err instanceof HookTimeoutError2) {
+          return { name, error: err.message, timedOut: true, timeout_ms: effectiveTimeout };
+        }
         return { name, error: err instanceof Error ? err.message : String(err) };
       }
-      const stdoutText = ran?.stdout ?? "";
-      const timedOut = ran === null;
-      let output = {};
-      try {
-        output = JSON.parse(stdoutText);
-      } catch {
-        output = stdoutText ? { raw: stdoutText } : {};
-      }
-      return { name, output, exitCode: ran?.exitCode ?? -1, ...timedOut ? { timedOut: true } : {} };
     }));
     return { content: [{ type: "text", text: JSON.stringify({ results, count: results.length }) }] };
   });
@@ -8618,7 +9129,7 @@ var {
 
 // src/cli/index.tsx
 import chalk2 from "chalk";
-import { existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync10, rmSync as rmSync5 } from "fs";
 import { join as join12, dirname as dirname6 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 
@@ -9797,6 +10308,7 @@ init_installer();
 init_profiles();
 init_manifest();
 init_resolve();
+init_store();
 import { jsxDEV as jsxDEV8 } from "react/jsx-dev-runtime";
 var __dirname4 = dirname6(fileURLToPath4(import.meta.url));
 var pkgPath = existsSync12(join12(__dirname4, "..", "package.json")) ? join12(__dirname4, "..", "package.json") : join12(__dirname4, "..", "..", "package.json");
@@ -9849,6 +10361,22 @@ function hookSummaryLine(hook, options = {}) {
   const description = options.verbose ? ` - ${truncateText2(hook.description, 110)}` : "";
   return `  ${chalk2.cyan(hook.name.padEnd(17))} ${chalk2.dim(`[${hook.event}${matcher}]`)} ${chalk2.dim(hook.category)}${description}`;
 }
+function listStoreHooks() {
+  const out = [];
+  for (const parsed of listCustomHooks()) {
+    const name = parsed.manifest.name;
+    const pin = getPinnedHook(name);
+    const source = pin?.source === "remote" || pin?.source === "registry" ? "registry" : "custom";
+    const meta = resolveHookMeta(name);
+    if (!meta)
+      continue;
+    out.push({
+      meta: { ...meta, version: pin?.version ?? meta.version },
+      source
+    });
+  }
+  return out.sort((a, b) => a.meta.name.localeCompare(b.meta.name));
+}
 function printDisclosureHint(hidden, detailCommand, options = {}) {
   const rowControls = options.includeAll ? "--limit, --all, --verbose" : "--limit, --verbose";
   if (hidden > 0) {
@@ -9889,24 +10417,23 @@ program2.command("init").description("Register a new agent profile with a unique
         console.log(chalk2.red(message));
       return;
     }
-    const config = { api_url: options.apiUrl.replace(/\/+$/, ""), api_key_ref: options.apiKey };
+    const apiKeyRef = options.apiKey ?? "hasna/hooks/live/api-key";
+    const config = { api_url: options.apiUrl.replace(/\/+$/, ""), api_key_ref: apiKeyRef };
     const path = writeConfig2(config);
     if (options.json) {
-      console.log(JSON.stringify({ ok: true, api_url: config.api_url, api_key_ref: config.api_key_ref ?? null, config_path: path }));
+      console.log(JSON.stringify({ ok: true, api_url: config.api_url, api_key_ref: config.api_key_ref, config_path: path }));
       return;
     }
     console.log(chalk2.green(`
 \u2713 Remote registry configured
 `));
     console.log(`  ${chalk2.dim("API URL:")}    ${config.api_url}`);
-    console.log(`  ${chalk2.dim("API key ref:")} ${config.api_key_ref ?? "(none; serve will refuse publishes)"}`);
+    console.log(`  ${chalk2.dim("API key ref:")} ${config.api_key_ref}`);
     console.log(`  ${chalk2.dim("Config:")}      ${path}`);
     console.log();
     console.log(chalk2.dim("  Presence of an API URL selects the remote registry; absence means local."));
-    if (config.api_key_ref) {
-      console.log(chalk2.dim(`  Run the server with the key resolved from the vault, never the value:`));
-      console.log(`    secrets exec ${config.api_key_ref} --as HASNA_HOOKS_API_KEY -- hooks serve`);
-    }
+    console.log(chalk2.dim(`  Run the server with the key resolved from the vault, never the value:`));
+    console.log(`    secrets exec ${config.api_key_ref} --as HASNA_HOOKS_API_KEY -- hooks serve`);
     console.log();
     return;
   }
@@ -9942,6 +10469,7 @@ program2.command("init").description("Register a new agent profile with a unique
 program2.command("run").argument("<hook>", "Hook to run").option("--profile <id>", "Agent profile ID").description("Execute a hook (called by AI coding agents)").action(async (hook, options) => {
   const { resolveHook: resolveHook2, resolveScriptPath: resolveScriptPath2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
   const { sha256Of: sha256Of2, checkScriptHash: checkScriptHash2 } = await Promise.resolve().then(() => (init_store(), exports_store));
+  const { recordHookRun: recordHookRun2, resolveEventType: resolveEventType2 } = await Promise.resolve().then(() => (init_db_writer(), exports_db_writer));
   const resolved = resolveHook2(hook);
   if (!resolved) {
     console.error(JSON.stringify({ error: `Hook '${hook}' not found` }));
@@ -9953,7 +10481,8 @@ program2.command("run").argument("<hook>", "Hook to run").option("--profile <id>
     process.exit(1);
   }
   const content = readFileSync10(hookScript);
-  const check = checkScriptHash2(hook, sha256Of2(content));
+  const sha = sha256Of2(content);
+  const check = checkScriptHash2(hook, sha);
   if (!check.ok) {
     console.error(JSON.stringify({
       error: `Hook '${hook}' script changed since it was trusted (sha256 ${check.expected} != ${check.actual}). Run 'hooks trust ${hook}' to trust the new content.`,
@@ -9982,18 +10511,74 @@ program2.command("run").argument("<hook>", "Hook to run").option("--profile <id>
     }
   }
   const { readCustomManifest: readCustomManifest2 } = await Promise.resolve().then(() => (init_manifest(), exports_manifest));
-  const { executeVerifiedScript: executeVerifiedScript2 } = await Promise.resolve().then(() => (init_run(), exports_run));
+  const { executeVerifiedScript: executeVerifiedScript2, HookTimeoutError: HookTimeoutError2 } = await Promise.resolve().then(() => (init_run(), exports_run));
   const custom = readCustomManifest2(hook);
   const args = custom?.manifest.args ?? [];
   const timeout = custom?.manifest.timeout_ms;
-  const { stdout, stderr, exitCode } = await executeVerifiedScript2({
-    name: hook,
-    scriptPath: hookScript,
-    content,
-    args,
-    stdin: hookStdin,
-    env: process.env,
-    timeout
+  const started = Date.now();
+  let stdout = "";
+  let stderr = "";
+  let exitCode = 0;
+  try {
+    ({ stdout, stderr, exitCode } = await executeVerifiedScript2({
+      name: hook,
+      scriptPath: hookScript,
+      content,
+      args,
+      stdin: hookStdin,
+      env: process.env,
+      timeout
+    }));
+  } catch (err) {
+    if (err instanceof HookTimeoutError2) {
+      try {
+        const { recordHookRun: recordHookRun3, resolveEventType: resolveEventType3 } = await Promise.resolve().then(() => (init_db_writer(), exports_db_writer));
+        let inputJson2 = {};
+        try {
+          inputJson2 = JSON.parse(stdin);
+        } catch {}
+        recordHookRun3({
+          hookName: hook,
+          eventType: resolveEventType3(inputJson2.hook_event_name, resolved.events[0] ?? "PostToolUse"),
+          version: resolved.version,
+          sha256: sha,
+          sessionId: typeof inputJson2.session_id === "string" ? inputJson2.session_id : null,
+          toolName: typeof inputJson2.tool_name === "string" ? inputJson2.tool_name : null,
+          toolInput: inputJson2.tool_input,
+          error: err.message.slice(0, 500),
+          exitCode: -1,
+          durationMs: Date.now() - started,
+          projectDir: process.cwd()
+        });
+      } catch {}
+      console.error(JSON.stringify({ error: err.message, hook, timedOut: true, timeout_ms: timeout ?? null }));
+      process.exit(1);
+    }
+    throw err;
+  }
+  const durationMs = Date.now() - started;
+  let inputJson = {};
+  try {
+    inputJson = JSON.parse(stdin);
+  } catch {}
+  let outputJson = {};
+  try {
+    outputJson = JSON.parse(stdout);
+  } catch {}
+  const blocked = outputJson.decision === "block" || outputJson.continue === false;
+  recordHookRun2({
+    hookName: hook,
+    eventType: resolveEventType2(inputJson.hook_event_name, resolved.events[0] ?? "PostToolUse"),
+    version: resolved.version,
+    sha256: sha,
+    sessionId: typeof inputJson.session_id === "string" ? inputJson.session_id : null,
+    toolName: typeof inputJson.tool_name === "string" ? inputJson.tool_name : null,
+    toolInput: inputJson.tool_input,
+    result: blocked ? "block" : "continue",
+    error: exitCode !== 0 ? (stderr || `hook exited with code ${exitCode}`).slice(0, 500) : null,
+    exitCode,
+    durationMs,
+    projectDir: process.cwd()
   });
   if (stdout)
     process.stdout.write(stdout);
@@ -10001,7 +10586,7 @@ program2.command("run").argument("<hook>", "Hook to run").option("--profile <id>
     process.stderr.write(stderr);
   process.exit(exitCode);
 });
-program2.command("install").alias("add").argument("[hooks...]", "Hooks to install").option("-o, --overwrite", "Overwrite existing hooks", false).option("-a, --all", "Install all available hooks", false).option("-c, --category <category>", "Install all hooks in a category").option("-g, --global", "Install globally (~/.claude/settings.json)", false).option("-p, --project", "Install for current project (.claude/settings.json)", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith, all (default: claude)", "claude").option("--profile <id>", "Agent profile ID to scope hooks to").option("--dry-run", "Preview what would be installed without writing to settings", false).option("--apply-codewith", "Explicitly append Codewith TOML to a config file (prefer open-configs for managed configs)", false).option("--codewith-config <path>", "Explicit Codewith config path required with --apply-codewith").option("-j, --json", "Output as JSON", false).description("Install one or more hooks (registry names, local paths, git URLs, or manifest URLs)").action(async (hooks, options) => {
+program2.command("install").alias("add").argument("[hooks...]", "Hooks to install").option("-o, --overwrite", "Overwrite existing hooks", false).option("-a, --all", "Install all available hooks", false).option("-c, --category <category>", "Install all hooks in a category").option("-g, --global", "Install globally (~/.claude/settings.json)", false).option("-p, --project", "Install for current project (.claude/settings.json)", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith, all (default: claude)", "claude").option("--profile <id>", "Agent profile ID to scope hooks to").option("--dry-run", "Preview what would be installed without writing to settings", false).option("--apply-codewith", "Explicitly append Codewith TOML to a config file (prefer open-configs for managed configs)", false).option("--codewith-config <path>", "Explicit Codewith config path required with --apply-codewith").option("-j, --json", "Output as JSON", false).description("Install one or more hooks (registry names, local paths, git URLs, manifest URLs, or <name>@<version> pinned installs)").action(async (hooks, options) => {
   const scope = resolveScope(options);
   const target = resolveTarget(options);
   let toInstall = hooks;
@@ -10034,15 +10619,35 @@ program2.command("install").alias("add").argument("[hooks...]", "Hooks to instal
     return;
   }
   const { isCustomSource: isCustomSource2, installCustomSource: installCustomSource2 } = await Promise.resolve().then(() => (init_custom_install(), exports_custom_install));
+  const { readCustomManifest: readCustomManifest2, HOOK_NAME_RE: HOOK_NAME_RE2 } = await Promise.resolve().then(() => (init_manifest(), exports_manifest));
+  const { resolveApiUrl: resolveApiUrl2 } = await Promise.resolve().then(() => (init_config(), exports_config));
+  const { sha256Of: sha256Of2, pinInstalledHook: pinInstalledHook2 } = await Promise.resolve().then(() => (init_store(), exports_store));
+  const { readFileSync: readFileSyncFs } = await import("fs");
+  function parseNameVersion(arg) {
+    if (isCustomSource2(arg))
+      return null;
+    const at = arg.lastIndexOf("@");
+    if (at <= 0 || at === arg.length - 1)
+      return null;
+    const name = arg.slice(0, at);
+    const version = arg.slice(at + 1);
+    if (!HOOK_NAME_RE2.test(name))
+      return null;
+    if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(version))
+      return null;
+    return { name, version };
+  }
+  const pinnedRequests = toInstall.map((arg) => ({ arg, pinned: parseNameVersion(arg) })).filter((x) => x.pinned !== null);
   const customSources = toInstall.filter((n) => !getHook(n) && isCustomSource2(n));
   if (options.dryRun) {
     const known = toInstall.filter((n) => getHook(n));
-    const unknown = toInstall.filter((n) => !getHook(n) && !isCustomSource2(n));
+    const unknown = toInstall.filter((n) => !getHook(n) && !isCustomSource2(n) && !parseNameVersion(n) && !readCustomManifest2(n));
     if (options.json) {
       console.log(JSON.stringify({
         dryRun: true,
         would_install: known,
         custom_sources: customSources,
+        pinned: pinnedRequests.map((p) => `${p.pinned.name}@${p.pinned.version}`),
         unknown,
         scope,
         target,
@@ -10060,6 +10665,9 @@ Dry run \u2014 would install (${scope}, ${target}):
     for (const source of customSources) {
       console.log(chalk2.cyan(`  ${source}`) + chalk2.dim(" [custom source: would fetch and install]"));
     }
+    for (const p of pinnedRequests) {
+      console.log(chalk2.cyan(`  ${p.pinned.name}@${p.pinned.version}`) + chalk2.dim(" [pinned registry install]"));
+    }
     if (unknown.length > 0) {
       console.log();
       for (const name of unknown) {
@@ -10074,9 +10682,21 @@ Dry run \u2014 would install (${scope}, ${target}):
   for (const source of customSources) {
     try {
       const custom = await installCustomSource2(source);
+      try {
+        const scriptBytes = readFileSyncFs(custom.scriptPath);
+        pinInstalledHook2(custom.name, custom.version, sha256Of2(scriptBytes), "custom", source);
+      } catch (pinError) {
+        const { customHookDir: customHookDir2 } = await Promise.resolve().then(() => (init_manifest(), exports_manifest));
+        const { removeHookFromStore: removeHookFromStore2 } = await Promise.resolve().then(() => (init_store(), exports_store));
+        try {
+          rmSync5(customHookDir2(custom.name), { recursive: true, force: true });
+        } catch {}
+        removeHookFromStore2(custom.name);
+        throw pinError;
+      }
       installedCustom.push(custom.name);
       if (options.json) {
-        console.log(JSON.stringify({ custom: { source, name: custom.name, version: custom.version } }));
+        console.log(JSON.stringify({ custom: { source, name: custom.name, version: custom.version, pinned: true } }));
       } else {
         console.log(chalk2.green(`\u2713 Installed custom hook '${custom.name}' v${custom.version} from ${source}`));
       }
@@ -10090,9 +10710,37 @@ Dry run \u2014 would install (${scope}, ${target}):
       }
     }
   }
-  const namesToRegister = [...new Set([...toInstall.filter((n) => !isCustomSource2(n)), ...installedCustom])];
+  const installedPinned = [];
+  for (const { arg, pinned } of pinnedRequests) {
+    try {
+      const apiUrl = resolveApiUrl2();
+      if (!apiUrl)
+        throw new Error(`Cannot install '${arg}': no remote registry configured (set api_url or HASNA_HOOKS_API_URL)`);
+      const { fetchPinnedHook: fetchPinnedHook2 } = await Promise.resolve().then(() => (init_sync(), exports_sync));
+      const pinnedInstall = await fetchPinnedHook2(pinned.name, pinned.version, apiUrl);
+      installedPinned.push(pinnedInstall.name);
+      if (options.json) {
+        console.log(JSON.stringify({ pinned: { request: arg, name: pinnedInstall.name, version: pinnedInstall.version, sha256: pinnedInstall.sha256, source: pinnedInstall.source } }));
+      } else {
+        console.log(chalk2.green(`\u2713 Installed '${pinnedInstall.name}' v${pinnedInstall.version} from registry (sha256 ${pinnedInstall.sha256.slice(0, 12)}\u2026)`));
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      results.push({ hook: arg, success: false, error: message });
+      if (options.json) {
+        console.log(JSON.stringify({ error: `Pinned install failed for ${arg}: ${message}` }));
+      } else {
+        console.log(chalk2.red(`\u2717 ${message}`));
+      }
+    }
+  }
+  const namesToRegister = [...new Set([
+    ...toInstall.filter((n) => !isCustomSource2(n) && !parseNameVersion(n)),
+    ...installedCustom,
+    ...installedPinned
+  ])];
   for (const name of namesToRegister) {
-    if (!getHook(name) && !installedCustom.includes(name)) {
+    if (!getHook(name) && !installedCustom.includes(name) && !installedPinned.includes(name) && !readCustomManifest2(name)) {
       const suggestions = suggestHooks(name);
       const hint = suggestions.length ? ` \u2014 did you mean: ${suggestions.join(", ")}?` : "";
       results.push({ hook: name, success: false, error: `Hook '${name}' not found${hint}` });
@@ -10119,8 +10767,12 @@ Dry run \u2014 would install (${scope}, ${target}):
       target,
       applied: results.some((r) => r.applied)
     }));
+    if (results.length > 0 && results.every((r) => !r.success)) {
+      process.exitCode = 1;
+    }
     return;
   }
+  const successCount = results.filter((r) => r.success).length;
   const settingsFile = target === "codewith" ? options.applyCodewith ? options.codewithConfig : "TOML fragment only (open-configs should apply)" : scope === "project" ? ".claude/settings.json" : "~/.claude/settings.json";
   console.log(chalk2.bold(`
 Installing hooks (${scope}, ${target})...
@@ -10147,38 +10799,59 @@ Installing hooks (${scope}, ${target})...
       console.log(chalk2.red(`\u2717 ${result.hook}: ${result.error}`));
     }
   }
+  if (results.length > 0 && successCount === 0) {
+    console.log(chalk2.red(`
+\u2717 Nothing was registered \u2014 all ${results.length} hook(s) failed.`));
+    process.exitCode = 1;
+    return;
+  }
   console.log(chalk2.dim(`
 Registered in ${settingsFile}`));
 });
-program2.command("list").alias("ls").option("-c, --category <category>", "Filter by category").option("-a, --all", "Show all available hooks", false).option("-i, --installed", "Show only installed hooks", false).option("-r, --registered", "Show registered hooks", false).option("-g, --global", "Check global settings", false).option("-p, --project", "Check project settings", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith (default: claude)", "claude").option("-n, --limit <n>", "Max rows to show in compact output", "20").option("--verbose", "Show descriptions and full detail columns", false).option("-j, --json", "Output as JSON", false).description("List available or installed hooks").action((options) => {
+program2.command("list").alias("ls").option("-c, --category <category>", "Filter by category").option("-a, --all", "Show all available hooks", false).option("-i, --installed", "Show only installed hooks", false).option("-r, --registered", "Show registered hooks", false).option("-g, --global", "Check global settings", false).option("-p, --project", "Check project settings", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith (default: claude)", "claude").option("-n, --limit <n>", "Max rows to show in compact output", "20").option("--verbose", "Show descriptions and full detail columns", false).option("-j, --json", "Output as JSON", false).description("List available or installed hooks (bundled + custom/registry)").action((options) => {
   const scope = resolveScope(options);
   const limit = options.all ? Number.MAX_SAFE_INTEGER : parseLimit(options.limit, 20, 200);
+  const storeHooks = listStoreHooks();
   if (options.registered || options.installed) {
     const target = options.target === "gemini" ? "gemini" : options.target === "codewith" ? "codewith" : "claude";
     const registered = getRegisteredHooksForTarget(scope, target);
+    const installed = [...new Set([...registered, ...storeHooks.map((s) => s.meta.name)])];
+    const shown = options.registered ? registered : installed;
     if (options.json) {
-      console.log(JSON.stringify(registered.map((name) => {
-        const meta = getHook(name);
-        return { name, event: meta?.event, version: meta?.version, description: meta?.description, scope, target };
+      console.log(JSON.stringify(shown.map((name) => {
+        const store = storeHooks.find((s) => s.meta.name === name);
+        const meta = store?.meta ?? getHook(name);
+        return {
+          name,
+          event: meta?.event,
+          version: meta?.version,
+          description: meta?.description,
+          source: store?.source ?? (store ? "custom" : undefined),
+          scope,
+          target
+        };
       })));
       return;
     }
-    if (registered.length === 0) {
-      console.log(chalk2.dim(`No hooks registered (${scope}, ${target})`));
+    if (shown.length === 0) {
+      console.log(chalk2.dim(`No hooks ${options.registered ? "registered" : "installed"} (${scope}, ${target})`));
       return;
     }
-    const visible2 = registered.slice(0, limit);
+    const label = options.registered ? "Registered" : "Installed";
+    const visible2 = shown.slice(0, limit);
     console.log(chalk2.bold(`
-Registered hooks \u2014 ${scope}/${target} (${registered.length}, showing ${visible2.length}):
+${label} hooks \u2014 ${scope}/${target} (${shown.length}, showing ${visible2.length}):
 `));
     for (const name of visible2) {
-      const meta = getHook(name);
-      if (meta)
-        console.log(hookSummaryLine(meta, { verbose: options.verbose }));
-      else
+      const store = storeHooks.find((s) => s.meta.name === name);
+      const meta = store?.meta ?? getHook(name);
+      if (meta) {
+        console.log(hookSummaryLine(meta, { verbose: options.verbose }) + (store ? chalk2.dim(` (${store.source})`) : ""));
+      } else {
         console.log(`  ${chalk2.cyan(name)} ${chalk2.dim("[unknown]")}`);
+      }
     }
-    printDisclosureHint(registered.length - visible2.length, "hooks info <name>", { includeAll: true });
+    printDisclosureHint(shown.length - visible2.length, "hooks info <name>", { includeAll: true });
     return;
   }
   if (options.category) {
@@ -10211,6 +10884,18 @@ ${category} (${hooks.length}, showing ${visible2.length}):
     for (const category of CATEGORIES) {
       result[category] = getHooksByCategory(category);
     }
+    result["Custom / Registry"] = storeHooks.map((s) => ({
+      name: s.meta.name,
+      displayName: s.meta.displayName,
+      description: s.meta.description,
+      version: s.meta.version,
+      category: "Custom / Registry",
+      event: s.meta.event,
+      events: s.meta.events,
+      matcher: s.meta.matcher,
+      tags: [...new Set([...s.meta.tags, s.source])],
+      source: s.source
+    }));
     console.log(JSON.stringify(result));
     return;
   }
@@ -10221,6 +10906,16 @@ Available hooks (${HOOKS.length}, showing ${visible.length}):
   for (const h of visible)
     console.log(hookSummaryLine(h, { verbose: options.verbose }));
   printDisclosureHint(HOOKS.length - visible.length, "hooks info <name>", { includeAll: true });
+  if (storeHooks.length > 0) {
+    const storeVisible = storeHooks.slice(0, limit);
+    console.log(chalk2.bold(`
+Custom / Registry hooks (${storeHooks.length}, showing ${storeVisible.length}):
+`));
+    for (const s of storeVisible) {
+      console.log(hookSummaryLine(s.meta, { verbose: options.verbose }) + chalk2.dim(` (${s.source})`));
+    }
+    printDisclosureHint(storeHooks.length - storeVisible.length, "hooks info <name>", { includeAll: true });
+  }
 });
 program2.command("search").argument("<query>", "Search term").option("-n, --limit <n>", "Max rows to show in compact output", "10").option("--verbose", "Show descriptions for search results", false).option("-j, --json", "Output as JSON", false).description("Search for hooks").action((query, options) => {
   const results = searchHooks(query);
@@ -10241,28 +10936,40 @@ Found ${results.length} hook(s), showing ${visible.length}:
     console.log(hookSummaryLine(h, { verbose: options.verbose }));
   printDisclosureHint(results.length - visible.length, "hooks info <name>");
 });
-program2.command("remove").alias("rm").argument("<hook>", "Hook to remove").option("-g, --global", "Remove from global settings", false).option("-p, --project", "Remove from project settings", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith, all (default: claude)", "claude").option("-j, --json", "Output as JSON", false).description("Remove an installed hook").action((hook, options) => {
+program2.command("remove").alias("rm").argument("<hook>", "Hook to remove").option("-g, --global", "Remove from global settings", false).option("-p, --project", "Remove from project settings", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith, all (default: claude)", "claude").option("-j, --json", "Output as JSON", false).description("Remove an installed hook (settings registration + store + lock + DB)").action(async (hook, options) => {
   const scope = resolveScope(options);
   const target = resolveTarget(options);
-  if (!getHook(hook)) {
-    const suggestions = suggestHooks(hook);
-    const hint = suggestions.length ? ` \u2014 did you mean: ${suggestions.join(", ")}?` : "";
-    if (options.json) {
-      console.log(JSON.stringify({ hook, removed: false, scope, target, error: `Hook '${hook}' not found${hint}`, suggestions }));
-    } else {
-      console.log(chalk2.red(`\u2717 Hook '${hook}' not found${hint}`));
-    }
-    return;
+  const { uninstallHook: uninstallHook2 } = await Promise.resolve().then(() => (init_installer(), exports_installer));
+  const result = uninstallHook2(hook, scope, target);
+  if (!result.removed) {
+    process.exitCode = 1;
   }
-  const removed = removeHook(hook, scope, target);
   if (options.json) {
-    console.log(JSON.stringify({ hook, removed, scope, target }));
-    return;
-  }
-  if (removed) {
-    console.log(chalk2.green(`\u2713 Removed ${hook} (${scope}, ${target})`));
+    console.log(JSON.stringify({
+      hook: result.name,
+      removed: result.removed,
+      source: result.source,
+      settings_scopes: result.settingsScopes,
+      store_dir_removed: result.storeDirRemoved,
+      pin_removed: result.pinRemoved,
+      db_record_removed: result.dbRecordRemoved,
+      registrations_remaining: result.registrationsRemaining,
+      scope,
+      target,
+      ...result.error ? { error: result.error } : {}
+    }));
+  } else if (result.removed) {
+    console.log(chalk2.green(`\u2713 Removed ${result.name} (${scope}, ${target})`));
+    if (result.source === "custom" && result.storeDirRemoved) {
+      console.log(chalk2.dim(`  store dir removed; lock pin ${result.pinRemoved ? "removed" : "absent"}; DB record ${result.dbRecordRemoved ? "removed" : "absent"}`));
+    }
+    if (result.registrationsRemaining && result.registrationsRemaining.length > 0) {
+      console.log(chalk2.yellow(`  \u26A0 registrations remaining: ${result.registrationsRemaining.join(", ")} \u2014 remove them in that target's own config`));
+    }
   } else {
-    console.log(chalk2.red(`\u2717 ${hook} is not installed (${scope}, ${target})`));
+    const suggestions = suggestHooks(hook);
+    const hint = suggestions.length ? ` \u2014 did you mean: ${suggestions.join(", ")}?` : "";
+    console.log(chalk2.red(`\u2717 Hook '${hook}' not found${hint}`));
   }
 });
 program2.command("categories").option("-j, --json", "Output as JSON", false).description("List all categories").action((options) => {
@@ -10406,7 +11113,7 @@ Hook Health Check (${scope})
   }
   console.log();
 });
-program2.command("update").argument("[hooks...]", "Hooks to update (defaults to all installed)").option("-g, --global", "Update global hooks", false).option("-p, --project", "Update project hooks", false).option("-j, --json", "Output as JSON", false).description("Re-register hooks (picks up new package version) and refresh the lock pins").action(async (hooks, options) => {
+program2.command("update").argument("[hooks...]", "Hooks to update (defaults to all installed)").option("-g, --global", "Update global hooks", false).option("-p, --project", "Update project hooks", false).option("-j, --json", "Output as JSON", false).description("Re-register hooks (picks up new package version), refresh lock pins, or install a pinned registry version (<name>@<version>)").action(async (hooks, options) => {
   const scope = resolveScope(options);
   const installed = getInstalledHooks(scope);
   const toUpdate = hooks.length > 0 ? hooks : installed;
@@ -10416,19 +11123,60 @@ program2.command("update").argument("[hooks...]", "Hooks to update (defaults to
     } else {
       console.log(chalk2.dim("No hooks installed to update."));
     }
+    process.exitCode = 1;
     return;
   }
   const { resolveHook: resolveHook2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
   const { sha256File: sha256File2, setPinnedHook: setPinnedHook2, upsertHookRecord: upsertHookRecord2 } = await Promise.resolve().then(() => (init_store(), exports_store));
   const { getDb: getDb2 } = await Promise.resolve().then(() => (init_db(), exports_db));
+  const { resolveApiUrl: resolveApiUrl2 } = await Promise.resolve().then(() => (init_config(), exports_config));
+  const { isCustomSource: isCustomSource2 } = await Promise.resolve().then(() => (init_custom_install(), exports_custom_install));
+  const { HOOK_NAME_RE: HOOK_NAME_RE2 } = await Promise.resolve().then(() => (init_manifest(), exports_manifest));
+  function parseNameVersion(arg) {
+    if (isCustomSource2(arg))
+      return null;
+    const at = arg.lastIndexOf("@");
+    if (at <= 0 || at === arg.length - 1)
+      return null;
+    const name = arg.slice(0, at);
+    const version = arg.slice(at + 1);
+    if (!HOOK_NAME_RE2.test(name))
+      return null;
+    if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(version))
+      return null;
+    return { name, version };
+  }
   const results = [];
-  for (const name of toUpdate) {
-    if (!installed.includes(name)) {
-      results.push({ hook: name, success: false, error: "Not installed" });
+  for (const arg of toUpdate) {
+    const pinned = parseNameVersion(arg);
+    if (pinned) {
+      try {
+        const apiUrl = resolveApiUrl2();
+        if (!apiUrl)
+          throw new Error(`Cannot update '${arg}': no remote registry configured (set api_url or HASNA_HOOKS_API_URL)`);
+        const { fetchPinnedHook: fetchPinnedHook2 } = await Promise.resolve().then(() => (init_sync(), exports_sync));
+        const pinnedInstall = await fetchPinnedHook2(pinned.name, pinned.version, apiUrl);
+        const registered = installHook(pinnedInstall.name, { scope, overwrite: true });
+        if (!registered.success) {
+          results.push({ hook: arg, success: false, error: registered.error ?? "registration failed" });
+          continue;
+        }
+        results.push({
+          hook: pinnedInstall.name,
+          success: true,
+          pinned: { version: pinnedInstall.version, sha256: pinnedInstall.sha256, source: pinnedInstall.source }
+        });
+      } catch (error) {
+        results.push({ hook: arg, success: false, error: error instanceof Error ? error.message : String(error) });
+      }
       continue;
     }
-    const result = installHook(name, { scope, overwrite: true });
-    const resolved = resolveHook2(name);
+    if (!installed.includes(arg)) {
+      results.push({ hook: arg, success: false, error: "Not installed" });
+      continue;
+    }
+    const result = installHook(arg, { scope, overwrite: true });
+    const resolved = resolveHook2(arg);
     if (result.success && resolved) {
       const hash = await sha256File2(resolved.scriptPath);
       setPinnedHook2(resolved.name, { version: resolved.version, sha256: hash, source: resolved.source });
@@ -10449,6 +11197,9 @@ program2.command("update").argument("[hooks...]", "Hooks to update (defaults to
       updated: results.filter((r) => r.success).map((r) => r.hook),
       failed: results.filter((r) => !r.success).map((r) => ({ hook: r.hook, error: r.error }))
     }));
+    if (results.some((r) => !r.success)) {
+      process.exitCode = 1;
+    }
     return;
   }
   console.log(chalk2.bold(`
@@ -10461,6 +11212,9 @@ Updating hooks...
       console.log(chalk2.red(`\u2717 ${result.hook}: ${result.error}`));
     }
   }
+  if (results.some((r) => !r.success)) {
+    process.exitCode = 1;
+  }
 });
 program2.command("docs").argument("[hook]", "Hook name (shows general docs if omitted)").option("--verbose", "Print full hook README content", false).option("-j, --json", "Output as JSON", false).description("Show documentation for hooks").action((hook, options) => {
   if (hook) {