@hasna/hooks 0.6.2 → 0.6.4

package/dist/index.js

@@ -22,7 +22,7 @@ var CREATE_HOOK_EVENTS_TABLE = `
     timestamp    TEXT NOT NULL,
     session_id   TEXT NOT NULL,
     hook_name    TEXT NOT NULL,
-    event_type   TEXT NOT NULL CHECK (event_type IN ('PreToolUse', 'PostToolUse', 'Stop', 'Notification', 'SessionStart', 'SessionEnd', 'UserPromptSubmit')),
+    event_type   TEXT NOT NULL CHECK (event_type IN ('PreToolUse', 'PostToolUse', 'Stop', 'Notification', 'SessionStart', 'SessionEnd', 'UserPromptSubmit', 'SubagentStart')),
     tool_name    TEXT,
     tool_input   TEXT,
     result       TEXT CHECK (result IN ('continue', 'block', NULL)),
@@ -137,6 +137,35 @@ var init_004_hooks_table = __esm(() => {
   ];
 });
 
+// src/db/migrations/005_subagent_start_event.ts
+function up5(db) {
+  const row = db.query("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?").get("hook_events");
+  if (!row?.sql)
+    return;
+  if (row.sql.includes("SubagentStart"))
+    return;
+  db.exec("BEGIN");
+  try {
+    db.exec("ALTER TABLE hook_events RENAME TO hook_events_old");
+    db.exec(CREATE_HOOK_EVENTS_TABLE);
+    db.exec(`INSERT INTO hook_events
+         (id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata)
+       SELECT id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata
+       FROM hook_events_old`);
+    db.exec("DROP TABLE hook_events_old");
+    for (const idx of CREATE_INDEXES) {
+      db.exec(idx);
+    }
+    db.exec("COMMIT");
+  } catch (err) {
+    db.exec("ROLLBACK");
+    throw err;
+  }
+}
+var init_005_subagent_start_event = __esm(() => {
+  init_schema();
+});
+
 // src/db/migrations/index.ts
 function ensureMigrationsTable(db) {
   db.exec(`
@@ -169,11 +198,13 @@ var init_migrations = __esm(() => {
   init_002_session_events();
   init_003_user_prompt_submit_event();
   init_004_hooks_table();
+  init_005_subagent_start_event();
   MIGRATIONS = [
     { version: "001_initial", up },
     { version: "002_session_events", up: up2 },
     { version: "003_user_prompt_submit_event", up: up3 },
-    { version: "004_hooks_table", up: up4 }
+    { version: "004_hooks_table", up: up4 },
+    { version: "005_subagent_start_event", up: up5 }
   ];
 });
 
@@ -343,6 +374,7 @@ function getDb() {
   const isNew = dbPath === ":memory:" || !existsSync2(dbPath);
   ensureDir(dbPath);
   instance = new Database(dbPath);
+  instance.exec("PRAGMA busy_timeout=5000");
   instance.exec("PRAGMA journal_mode=WAL");
   instance.exec("PRAGMA foreign_keys=ON");
   runMigrations(instance);
@@ -4545,149 +4577,6 @@ var init_manifest = __esm(() => {
   };
 });
 
-// src/lib/profiles.ts
-var exports_profiles = {};
-__export(exports_profiles, {
-  updateProfile: () => updateProfile,
-  touchProfile: () => touchProfile,
-  listProfiles: () => listProfiles,
-  importProfiles: () => importProfiles,
-  getProfilesDir: () => getProfilesDir,
-  getProfile: () => getProfile,
-  exportProfiles: () => exportProfiles,
-  deleteProfile: () => deleteProfile,
-  createProfile: () => createProfile
-});
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4, readdirSync as readdirSync3, rmSync, cpSync as cpSync2 } from "fs";
-import { join as join7 } from "path";
-import { homedir as homedir5 } from "os";
-function resolveProfilesDir() {
-  const newDir = join7(homedir5(), ".hasna", "hooks", "profiles");
-  const oldDir = join7(homedir5(), ".hooks", "profiles");
-  if (!existsSync7(newDir) && existsSync7(oldDir)) {
-    mkdirSync5(join7(homedir5(), ".hasna", "hooks"), { recursive: true });
-    cpSync2(oldDir, newDir, { recursive: true });
-  }
-  return newDir;
-}
-function ensureProfilesDir() {
-  if (!existsSync7(PROFILES_DIR)) {
-    mkdirSync5(PROFILES_DIR, { recursive: true });
-  }
-}
-function profilePath(id) {
-  return join7(PROFILES_DIR, `${id}.json`);
-}
-function shortUuid() {
-  return crypto.randomUUID().slice(0, 8);
-}
-function getProfilesDir() {
-  return PROFILES_DIR;
-}
-function createProfile(input) {
-  ensureProfilesDir();
-  const id = shortUuid();
-  const now = new Date().toISOString();
-  const profile = {
-    agent_id: id,
-    agent_type: input.agent_type,
-    created_at: now,
-    last_seen_at: now,
-    preferences: {}
-  };
-  if (input.name) {
-    profile.name = input.name;
-  }
-  writeFileSync4(profilePath(id), JSON.stringify(profile, null, 2) + `
-`);
-  return profile;
-}
-function getProfile(id) {
-  const path = profilePath(id);
-  try {
-    if (!existsSync7(path))
-      return null;
-    return JSON.parse(readFileSync5(path, "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function listProfiles() {
-  if (!existsSync7(PROFILES_DIR))
-    return [];
-  try {
-    const files = readdirSync3(PROFILES_DIR).filter((f) => f.endsWith(".json"));
-    const profiles = [];
-    for (const file of files) {
-      try {
-        const content = readFileSync5(join7(PROFILES_DIR, file), "utf-8");
-        profiles.push(JSON.parse(content));
-      } catch {}
-    }
-    return profiles.sort((a, b) => new Date(a.created_at).getTime() - new Date(b.created_at).getTime());
-  } catch {
-    return [];
-  }
-}
-function updateProfile(id, data) {
-  const profile = getProfile(id);
-  if (!profile)
-    return null;
-  if (data.name !== undefined)
-    profile.name = data.name;
-  if (data.preferences !== undefined)
-    profile.preferences = data.preferences;
-  writeFileSync4(profilePath(id), JSON.stringify(profile, null, 2) + `
-`);
-  return profile;
-}
-function deleteProfile(id) {
-  const path = profilePath(id);
-  if (!existsSync7(path))
-    return false;
-  try {
-    rmSync(path);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function touchProfile(id) {
-  const profile = getProfile(id);
-  if (!profile)
-    return;
-  profile.last_seen_at = new Date().toISOString();
-  writeFileSync4(profilePath(id), JSON.stringify(profile, null, 2) + `
-`);
-}
-function exportProfiles() {
-  return listProfiles();
-}
-function importProfiles(profiles) {
-  ensureProfilesDir();
-  let imported = 0;
-  let skipped = 0;
-  for (const profile of profiles) {
-    if (!profile.agent_id || !profile.agent_type) {
-      skipped++;
-      continue;
-    }
-    const path = profilePath(profile.agent_id);
-    if (existsSync7(path)) {
-      skipped++;
-      continue;
-    }
-    writeFileSync4(path, JSON.stringify(profile, null, 2) + `
-`);
-    imported++;
-  }
-  return { imported, skipped };
-}
-var PROFILES_DIR;
-var init_profiles = __esm(() => {
-  PROFILES_DIR = resolveProfilesDir();
-});
-
 // src/lib/store.ts
 var exports_store = {};
 __export(exports_store, {
@@ -4700,14 +4589,16 @@ __export(exports_store, {
   retrustHook: () => retrustHook,
   removePinnedHook: () => removePinnedHook,
   removeHookRecord: () => removeHookRecord,
+  removeHookFromStore: () => removeHookFromStore,
   readLock: () => readLock,
+  pinInstalledHook: () => pinInstalledHook,
   listHookRecords: () => listHookRecords,
   getPinnedHook: () => getPinnedHook,
   getHookRecord: () => getHookRecord,
   checkScriptHash: () => checkScriptHash
 });
 import { createHash } from "crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { readFile } from "fs/promises";
 function sha256Of(input) {
   return createHash("sha256").update(input).digest("hex");
@@ -4754,9 +4645,9 @@ function removeHookRecord(db, name) {
 function readLock() {
   try {
     const path = getLockPath();
-    if (!existsSync8(path))
+    if (!existsSync6(path))
       return { hooks: {} };
-    const parsed = JSON.parse(readFileSync6(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync4(path, "utf-8"));
     return { hooks: parsed.hooks ?? {} };
   } catch {
     return { hooks: {} };
@@ -4764,12 +4655,12 @@ function readLock() {
 }
 function writeLock(lock) {
   const path = getLockPath();
-  mkdirSync6(path.substring(0, path.lastIndexOf("/")) || ".", { recursive: true });
+  mkdirSync4(path.substring(0, path.lastIndexOf("/")) || ".", { recursive: true });
   const sorted = {};
   for (const name of Object.keys(lock.hooks).sort()) {
     sorted[name] = lock.hooks[name];
   }
-  writeFileSync5(path, JSON.stringify({ hooks: sorted }, null, 2) + `
+  writeFileSync3(path, JSON.stringify({ hooks: sorted }, null, 2) + `
 `, "utf-8");
   return path;
 }
@@ -4789,6 +4680,25 @@ function removePinnedHook(name) {
   writeLock(lock);
   return true;
 }
+function pinInstalledHook(name, version, sha256, source, sourceRef) {
+  const now = new Date().toISOString();
+  const db = getDb();
+  upsertHookRecord(db, {
+    name,
+    version,
+    sha256,
+    source_type: source,
+    source_ref: sourceRef ?? null,
+    last_verified_at: now
+  });
+  setPinnedHook(name, { version, sha256, source });
+}
+function removeHookFromStore(name) {
+  const removedPin = removePinnedHook(name);
+  const db = getDb();
+  const removedRecord = removeHookRecord(db, name);
+  return { removedPin, removedRecord };
+}
 function checkScriptHash(name, actual) {
   const db = getDb();
   const record = getHookRecord(db, name);
@@ -4825,7 +4735,7 @@ async function verifyScriptHash(name, scriptPath) {
   return checkScriptHash(name, await sha256File(scriptPath));
 }
 function retrustHook(name, scriptPath, version, source) {
-  const actual = sha256Of(readFileSync6(scriptPath));
+  const actual = sha256Of(readFileSync4(scriptPath));
   const db = getDb();
   upsertHookRecord(db, {
     name,
@@ -4842,44 +4752,378 @@ var init_store = __esm(() => {
   init_config();
 });
 
+// src/lib/profiles.ts
+var exports_profiles = {};
+__export(exports_profiles, {
+  updateProfile: () => updateProfile,
+  touchProfile: () => touchProfile,
+  listProfiles: () => listProfiles,
+  importProfiles: () => importProfiles,
+  getProfilesDir: () => getProfilesDir,
+  getProfile: () => getProfile,
+  exportProfiles: () => exportProfiles,
+  deleteProfile: () => deleteProfile,
+  createProfile: () => createProfile
+});
+import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5, readdirSync as readdirSync3, rmSync as rmSync2, cpSync as cpSync2 } from "fs";
+import { join as join7 } from "path";
+import { homedir as homedir5 } from "os";
+function resolveProfilesDir() {
+  const newDir = join7(homedir5(), ".hasna", "hooks", "profiles");
+  const oldDir = join7(homedir5(), ".hooks", "profiles");
+  if (!existsSync8(newDir) && existsSync8(oldDir)) {
+    mkdirSync6(join7(homedir5(), ".hasna", "hooks"), { recursive: true });
+    cpSync2(oldDir, newDir, { recursive: true });
+  }
+  return newDir;
+}
+function ensureProfilesDir() {
+  if (!existsSync8(PROFILES_DIR)) {
+    mkdirSync6(PROFILES_DIR, { recursive: true });
+  }
+}
+function profilePath(id) {
+  return join7(PROFILES_DIR, `${id}.json`);
+}
+function shortUuid() {
+  return crypto.randomUUID().slice(0, 8);
+}
+function getProfilesDir() {
+  return PROFILES_DIR;
+}
+function createProfile(input) {
+  ensureProfilesDir();
+  const id = shortUuid();
+  const now = new Date().toISOString();
+  const profile = {
+    agent_id: id,
+    agent_type: input.agent_type,
+    created_at: now,
+    last_seen_at: now,
+    preferences: {}
+  };
+  if (input.name) {
+    profile.name = input.name;
+  }
+  writeFileSync5(profilePath(id), JSON.stringify(profile, null, 2) + `
+`);
+  return profile;
+}
+function getProfile(id) {
+  const path = profilePath(id);
+  try {
+    if (!existsSync8(path))
+      return null;
+    return JSON.parse(readFileSync6(path, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function listProfiles() {
+  if (!existsSync8(PROFILES_DIR))
+    return [];
+  try {
+    const files = readdirSync3(PROFILES_DIR).filter((f) => f.endsWith(".json"));
+    const profiles = [];
+    for (const file of files) {
+      try {
+        const content = readFileSync6(join7(PROFILES_DIR, file), "utf-8");
+        profiles.push(JSON.parse(content));
+      } catch {}
+    }
+    return profiles.sort((a, b) => new Date(a.created_at).getTime() - new Date(b.created_at).getTime());
+  } catch {
+    return [];
+  }
+}
+function updateProfile(id, data) {
+  const profile = getProfile(id);
+  if (!profile)
+    return null;
+  if (data.name !== undefined)
+    profile.name = data.name;
+  if (data.preferences !== undefined)
+    profile.preferences = data.preferences;
+  writeFileSync5(profilePath(id), JSON.stringify(profile, null, 2) + `
+`);
+  return profile;
+}
+function deleteProfile(id) {
+  const path = profilePath(id);
+  if (!existsSync8(path))
+    return false;
+  try {
+    rmSync2(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function touchProfile(id) {
+  const profile = getProfile(id);
+  if (!profile)
+    return;
+  profile.last_seen_at = new Date().toISOString();
+  writeFileSync5(profilePath(id), JSON.stringify(profile, null, 2) + `
+`);
+}
+function exportProfiles() {
+  return listProfiles();
+}
+function importProfiles(profiles) {
+  ensureProfilesDir();
+  let imported = 0;
+  let skipped = 0;
+  for (const profile of profiles) {
+    if (!profile.agent_id || !profile.agent_type) {
+      skipped++;
+      continue;
+    }
+    const path = profilePath(profile.agent_id);
+    if (existsSync8(path)) {
+      skipped++;
+      continue;
+    }
+    writeFileSync5(path, JSON.stringify(profile, null, 2) + `
+`);
+    imported++;
+  }
+  return { imported, skipped };
+}
+var PROFILES_DIR;
+var init_profiles = __esm(() => {
+  PROFILES_DIR = resolveProfilesDir();
+});
+
 // src/lib/run.ts
 var exports_run = {};
 __export(exports_run, {
-  executeVerifiedScript: () => executeVerifiedScript
+  executeVerifiedScript: () => executeVerifiedScript,
+  HookTimeoutError: () => HookTimeoutError
 });
 import { randomBytes } from "crypto";
-import { rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
+import { rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
 import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute2, join as join9 } from "path";
 function extensionOf(scriptPath) {
   const base = basename2(scriptPath);
   const dot = base.lastIndexOf(".");
   return dot > 0 ? base.slice(dot + 1) : "ts";
 }
+function shebangInterpreter(firstLine) {
+  if (!firstLine.startsWith("#!"))
+    return null;
+  const rest = firstLine.slice(2).trim();
+  if (!rest)
+    return null;
+  const parts = rest.split(/\s+/);
+  if (parts[0] === "env" || parts[0] === "/usr/bin/env") {
+    return parts[1] && parts[1] !== "-S" ? basename2(parts[1]) : parts[2] ? basename2(parts[2]) : null;
+  }
+  return basename2(parts[0]);
+}
+function interpreterFor(name, scriptPath, content) {
+  const ext = extensionOf(scriptPath);
+  const firstLine = content.subarray(0, 512).toString("utf8").split(`
+`, 1)[0] ?? "";
+  const interp = shebangInterpreter(firstLine);
+  if (interp) {
+    if (interp === "bash" || interp === "sh")
+      return { command: ["/bin/bash"], tempExt: "sh" };
+    if (interp === "node" || interp === "bun")
+      return { command: ["bun", "run"], tempExt: BUN_EXTENSIONS.has(ext) ? ext : "ts" };
+    throw new Error(`Refusing to run hook '${name}': shebang '${firstLine}' is not a recognized interpreter (supported: bash/sh, node/bun)`);
+  }
+  if (BASH_EXTENSIONS.has(ext))
+    return { command: ["/bin/bash"], tempExt: "sh" };
+  if (BUN_EXTENSIONS.has(ext))
+    return { command: ["bun", "run"], tempExt: ext };
+  throw new Error(`Refusing to run hook '${name}': unsupported script extension '.${ext}' (supported: .sh .bash .ts .tsx .js .jsx .mjs .cjs .mts .cts, or a recognized shebang)`);
+}
+async function readPipeWithDeadline(stream, deadlineMs) {
+  const reader = stream.getReader();
+  const chunks = [];
+  const deadline = Date.now() + deadlineMs;
+  try {
+    while (true) {
+      const remaining = deadline - Date.now();
+      if (remaining <= 0)
+        break;
+      let result;
+      try {
+        result = await Promise.race([
+          reader.read(),
+          new Promise((_, reject) => {
+            const t = setTimeout(() => reject(new Error("pipe-drain-deadline")), remaining);
+            t.unref?.();
+          })
+        ]);
+      } catch {
+        break;
+      }
+      if (result.done)
+        break;
+      chunks.push(new TextDecoder().decode(result.value));
+    }
+  } finally {
+    try {
+      await reader.cancel();
+    } catch {}
+  }
+  return chunks.join("");
+}
 async function executeVerifiedScript(options) {
   const scriptDir = dirname4(options.scriptPath);
-  const tempPath = join9(scriptDir, `.hooks-verified-${randomBytes(12).toString("hex")}.${extensionOf(options.scriptPath)}`);
+  const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
+  const tempPath = join9(scriptDir, `.hooks-verified-${randomBytes(12).toString("hex")}.${interpreter.tempExt}`);
+  let proc = null;
+  let timedOut = false;
+  const timeoutTimer = options.timeout ? setTimeout(() => {
+    timedOut = true;
+    killGroup(proc);
+  }, options.timeout) : null;
   try {
     writeFileSync6(tempPath, options.content, { flag: "wx", mode: 384 });
-    const proc = Bun.spawn(["bun", "run", isAbsolute2(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
+    proc = Bun.spawn([...interpreter.command, isAbsolute2(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
       stdin: new Response(options.stdin),
       stdout: "pipe",
       stderr: "pipe",
       env: options.env ?? process.env,
-      ...options.timeout ? { timeout: options.timeout } : {}
+      detached: true
     });
-    const [stdoutText, stderrText, exitCode] = await Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text(),
-      proc.exited
+    const exitCode = await proc.exited;
+    if (timedOut) {
+      throw new HookTimeoutError(options.timeout);
+    }
+    const [stdoutText, stderrText] = await Promise.all([
+      readPipeWithDeadline(proc.stdout, 750),
+      readPipeWithDeadline(proc.stderr, 750)
     ]);
+    killGroup(proc);
     return { stdout: stdoutText, stderr: stderrText, exitCode };
   } finally {
+    if (timeoutTimer)
+      clearTimeout(timeoutTimer);
+    try {
+      rmSync4(tempPath, { force: true });
+    } catch {}
+  }
+}
+function killGroup(proc) {
+  if (!proc)
+    return;
+  try {
+    process.kill(-proc.pid, "SIGKILL");
+  } catch {
     try {
-      rmSync3(tempPath, { force: true });
+      process.kill(proc.pid, "SIGKILL");
     } catch {}
   }
 }
-var init_run = () => {};
+var HookTimeoutError, BASH_EXTENSIONS, BUN_EXTENSIONS;
+var init_run = __esm(() => {
+  HookTimeoutError = class HookTimeoutError extends Error {
+    timeoutMs;
+    constructor(timeoutMs) {
+      super(`Hook timed out after ${timeoutMs}ms (process group killed)`);
+      this.name = "HookTimeoutError";
+      this.timeoutMs = timeoutMs;
+    }
+  };
+  BASH_EXTENSIONS = new Set(["sh", "bash"]);
+  BUN_EXTENSIONS = new Set(["ts", "tsx", "js", "jsx", "mjs", "cjs", "mts", "cts"]);
+});
+
+// src/lib/db-writer.ts
+var exports_db_writer = {};
+__export(exports_db_writer, {
+  writeHookEvent: () => writeHookEvent,
+  resolveEventType: () => resolveEventType,
+  recordHookRun: () => recordHookRun,
+  normalizeEventType: () => normalizeEventType
+});
+function nanoid2() {
+  return crypto.randomUUID().replace(/-/g, "").slice(0, 21);
+}
+function writeHookEvent(event) {
+  try {
+    const db = getDb();
+    const id = nanoid2();
+    const timestamp = event.timestamp ?? new Date().toISOString();
+    db.run(`INSERT INTO hook_events
+        (id, timestamp, session_id, hook_name, event_type, tool_name, tool_input, result, error, duration_ms, project_dir, metadata)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+      id,
+      timestamp,
+      event.session_id,
+      event.hook_name,
+      event.event_type,
+      event.tool_name ?? null,
+      event.tool_input ? event.tool_input.slice(0, 500) : null,
+      event.result ?? null,
+      event.error ?? null,
+      event.duration_ms ?? null,
+      event.project_dir ?? null,
+      event.metadata ?? null
+    ]);
+  } catch (err) {
+    process.stderr.write(`[hooks db-writer] failed to write event: ${err}
+`);
+  }
+}
+function normalizeEventType(value) {
+  if (typeof value !== "string")
+    return null;
+  if (ALLOWED_EVENT_TYPES.has(value))
+    return value;
+  const bare = value.split(":")[0] ?? "";
+  return ALLOWED_EVENT_TYPES.has(bare) ? bare : null;
+}
+function resolveEventType(inputEvent, fallbackEvent) {
+  const fromInput = normalizeEventType(inputEvent);
+  if (fromInput)
+    return fromInput;
+  return normalizeEventType(fallbackEvent ?? null);
+}
+function recordHookRun(record) {
+  const eventType = record.eventType ? normalizeEventType(record.eventType) : null;
+  if (!eventType) {
+    process.stderr.write(`[hooks db-writer] skipped event for '${record.hookName}': unsupported event type '${String(record.eventType)}'
+`);
+    return;
+  }
+  const metadata = {
+    ...record.metadata ?? {},
+    version: record.version ?? null,
+    sha256: record.sha256 ?? null,
+    exit_code: record.exitCode
+  };
+  writeHookEvent({
+    session_id: record.sessionId ?? "cli",
+    hook_name: record.hookName,
+    event_type: eventType,
+    tool_name: record.toolName ?? null,
+    tool_input: record.toolInput !== undefined ? JSON.stringify(record.toolInput) : null,
+    result: record.result ?? null,
+    error: record.error ?? null,
+    duration_ms: record.durationMs,
+    project_dir: record.projectDir ?? null,
+    metadata: JSON.stringify(metadata)
+  });
+}
+var ALLOWED_EVENT_TYPES;
+var init_db_writer = __esm(() => {
+  init_db();
+  ALLOWED_EVENT_TYPES = new Set([
+    "PreToolUse",
+    "PostToolUse",
+    "Stop",
+    "Notification",
+    "SessionStart",
+    "SessionEnd",
+    "UserPromptSubmit",
+    "SubagentStart"
+  ]);
+});
 
 // src/db/storage-sync.ts
 init_db();
@@ -5812,7 +6056,7 @@ function getHook(name) {
   return HOOKS.find((h) => h.name === name);
 }
 // src/lib/installer.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync4 } from "fs";
 import { join as join6, dirname as dirname3 } from "path";
 import { homedir as homedir4 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -5882,7 +6126,8 @@ function resolveHook(name) {
       events: custom2.manifest.events,
       description: custom2.manifest.description ?? "Custom hook",
       scriptPath: custom2.scriptPath,
-      meta: meta2
+      meta: meta2,
+      timeoutMs: custom2.manifest.timeout_ms ?? null
     };
   }
   const meta = getHook(shortManifestName(name));
@@ -5896,13 +6141,16 @@ function resolveHook(name) {
     events: meta.events && meta.events.length > 0 ? meta.events : [meta.event],
     description: meta.description,
     scriptPath,
-    meta
+    meta,
+    timeoutMs: null
   };
 }
 
 // src/lib/installer.ts
+init_manifest();
+init_store();
 var __dirname2 = dirname3(fileURLToPath2(import.meta.url));
-var HOOKS_DIR = existsSync6(join6(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join6(__dirname2, "..", "..", "hooks") : join6(__dirname2, "..", "hooks");
+var HOOKS_DIR = existsSync7(join6(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join6(__dirname2, "..", "..", "hooks") : join6(__dirname2, "..", "hooks");
 function normalizeHookName(name) {
   return name.startsWith("hook-") ? name : `hook-${name}`;
 }
@@ -5984,13 +6232,13 @@ function getHookPath(name) {
   return join6(HOOKS_DIR, normalizeHookName(shortName));
 }
 function hookExists(name) {
-  return existsSync6(getHookPath(name));
+  return existsSync7(getHookPath(name));
 }
 function readSettings(scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
   try {
-    if (existsSync6(path)) {
-      return JSON.parse(readFileSync4(path, "utf-8"));
+    if (existsSync7(path)) {
+      return JSON.parse(readFileSync5(path, "utf-8"));
     }
   } catch (error) {
     console.warn(`[hooks] Failed to read settings at ${path}: ${error instanceof Error ? error.message : String(error)}`);
@@ -6000,10 +6248,10 @@ function readSettings(scope = "global", target = "claude") {
 function writeSettings(settings, scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
   const dir = dirname3(path);
-  if (!existsSync6(dir)) {
-    mkdirSync4(dir, { recursive: true });
+  if (!existsSync7(dir)) {
+    mkdirSync5(dir, { recursive: true });
   }
-  writeFileSync3(path, JSON.stringify(settings, null, 2) + `
+  writeFileSync4(path, JSON.stringify(settings, null, 2) + `
 `);
 }
 function getTargetEventName(internalEvent, target) {
@@ -6089,7 +6337,7 @@ function buildCodewithTomlFragment(name, profile) {
 function readCodewithConfig(scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
   try {
-    return existsSync6(path) ? readFileSync4(path, "utf-8") : "";
+    return existsSync7(path) ? readFileSync5(path, "utf-8") : "";
   } catch {
     return "";
   }
@@ -6097,13 +6345,13 @@ function readCodewithConfig(scope, configPath) {
 function appendCodewithFragment(fragment, scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
   const dir = dirname3(path);
-  if (!existsSync6(dir))
-    mkdirSync4(dir, { recursive: true });
-  const existing = existsSync6(path) ? readFileSync4(path, "utf-8") : "";
+  if (!existsSync7(dir))
+    mkdirSync5(dir, { recursive: true });
+  const existing = existsSync7(path) ? readFileSync5(path, "utf-8") : "";
   const sep2 = existing.trim() ? `
 
 ` : "";
-  writeFileSync3(path, `${existing.replace(/\s*$/, "")}${sep2}${fragment}`);
+  writeFileSync4(path, `${existing.replace(/\s*$/, "")}${sep2}${fragment}`);
   return path;
 }
 function detectConflict(name, scope, target) {
@@ -6279,9 +6527,6 @@ function removeHookFromAllEvents(settings, name) {
   }
 }
 function unregisterHook(name, scope = "global", target = "claude") {
-  const meta = resolveHookMeta(name);
-  if (!meta)
-    return;
   const settings = readSettings(scope, target);
   if (!settings.hooks)
     return;
@@ -6347,6 +6592,136 @@ function removeHookForTarget(name, scope, target) {
   unregisterHook(name, scope, target);
   return true;
 }
+function removeCodewithHookEntry(configText, name) {
+  const sections = configText.split(/\n\s*\n/);
+  const nameRe = new RegExp(`^command\\s*=\\s*"hooks run ${escapeRegExp(name)}(?:\\s+--profile\\s+[\\w-]+)?"$`);
+  const entryHeaderRe = /^\[\[hooks\.([\w]+)\.hooks\]\]$/;
+  const eventHeaderRe = /^\[\[hooks\.([\w]+)\]\]$/;
+  const eventsWithEntries = new Set;
+  const kept = [];
+  let removed = false;
+  for (const section of sections) {
+    const lines = section.split(`
+`);
+    const entryMatch = entryHeaderRe.exec(lines[0] ?? "");
+    if (entryMatch) {
+      const event = entryMatch[1];
+      eventsWithEntries.add(event);
+      if (lines.some((line) => nameRe.test(line.trim()))) {
+        removed = true;
+        continue;
+      }
+      kept.push({ text: section });
+      continue;
+    }
+    const eventMatch = eventHeaderRe.exec(lines[0] ?? "");
+    kept.push({ text: section, eventHeaderFor: eventMatch ? eventMatch[1] : undefined });
+  }
+  const keptEntriesByEvent = new Set;
+  for (const item of kept) {
+    const m = entryHeaderRe.exec(item.text.split(`
+`)[0] ?? "");
+    if (m)
+      keptEntriesByEvent.add(m[1]);
+  }
+  const finalSections = kept.filter((item) => {
+    if (item.eventHeaderFor === undefined)
+      return true;
+    if (!eventsWithEntries.has(item.eventHeaderFor))
+      return true;
+    return keptEntriesByEvent.has(item.eventHeaderFor);
+  }).map((item) => item.text);
+  return {
+    text: finalSections.join(`
+
+`) + (configText.endsWith(`
+`) ? `
+` : ""),
+    removed
+  };
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function codewithHasHookEntryInText(configText, name) {
+  return new RegExp(`hooks run ${escapeRegExp(name)}(?:\\s+--profile\\s+[\\w-]+)?(?:$|\\s|")`).test(configText);
+}
+function codewithHasHookEntry(name) {
+  const path = getSettingsPath("global", "codewith");
+  if (!existsSync7(path))
+    return false;
+  try {
+    return codewithHasHookEntryInText(readFileSync5(path, "utf-8"), name);
+  } catch {
+    return false;
+  }
+}
+function uninstallHook(name, scope = "global", target = "claude") {
+  const shortName = shortHookName(name);
+  const custom2 = readCustomManifest(shortName);
+  const bundledMeta = custom2 ? undefined : getHook(shortName);
+  const existsInTarget = (t) => getRegisteredHooksForTarget("global", t).includes(shortName) || getRegisteredHooksForTarget("project", t).includes(shortName);
+  const registeredClaudeOrGemini = target === "all" ? existsInTarget("claude") || existsInTarget("gemini") : false;
+  const registeredGlobal = registeredClaudeOrGemini || getRegisteredHooksForTarget("global", target === "all" ? "claude" : target).includes(shortName);
+  const registeredProject = registeredClaudeOrGemini || getRegisteredHooksForTarget("project", target === "all" ? "claude" : target).includes(shortName);
+  const codewithOnly = (target === "codewith" || target === "all") && codewithHasHookEntry(shortName);
+  if (!custom2 && !bundledMeta && !registeredGlobal && !registeredProject && !codewithOnly) {
+    return { name: shortName, removed: false, source: null, settingsScopes: [], storeDirRemoved: false, pinRemoved: false, dbRecordRemoved: false, registrationsRemaining: [], error: `Hook '${shortName}' not found` };
+  }
+  const writableTargets = target === "all" ? ["claude", "gemini"] : target === "codewith" ? [] : [target];
+  const scopes = [];
+  for (const s of ["global", "project"]) {
+    for (const t of writableTargets) {
+      if (getRegisteredHooksForTarget(s, t).includes(shortName)) {
+        unregisterHook(shortName, s, t);
+        if (!scopes.includes(s))
+          scopes.push(s);
+      }
+    }
+  }
+  const registrationsRemaining = [];
+  if (target === "codewith" || target === "all") {
+    const codewithPath = getSettingsPath("global", "codewith");
+    if (existsSync7(codewithPath)) {
+      const before = readFileSync5(codewithPath, "utf-8");
+      const after = removeCodewithHookEntry(before, shortName);
+      if (after.removed) {
+        writeFileSync4(codewithPath, after.text, "utf-8");
+      }
+      if (codewithHasHookEntryInText(after.removed ? after.text : before, shortName)) {
+        registrationsRemaining.push("codewith");
+      }
+    }
+  }
+  if (custom2) {
+    try {
+      rmSync(customHookDir(shortName), { recursive: true, force: true });
+    } catch {
+      return {
+        name: shortName,
+        removed: false,
+        source: "custom",
+        settingsScopes: scopes,
+        storeDirRemoved: false,
+        pinRemoved: false,
+        dbRecordRemoved: false,
+        registrationsRemaining,
+        error: `Hook '${shortName}' store directory could not be removed; trust records preserved (no fail-open)`
+      };
+    }
+  }
+  const { removedPin, removedRecord } = removeHookFromStore(shortName);
+  return {
+    name: shortName,
+    removed: true,
+    source: custom2 ? "custom" : bundledMeta ? "bundled" : "registered-only",
+    settingsScopes: scopes,
+    storeDirRemoved: custom2 ? true : false,
+    pinRemoved: removedPin,
+    dbRecordRemoved: removedRecord,
+    registrationsRemaining
+  };
+}
 // src/index.ts
 init_profiles();
 init_config();
@@ -6357,7 +6732,7 @@ import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
 // src/lib/custom-install.ts
 init_config();
 init_manifest();
-import { existsSync as existsSync9, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
 import { join as join8 } from "path";
 import { tmpdir } from "os";
 function manifestAt(dir) {
@@ -6395,7 +6770,7 @@ async function cloneToTemp(gitUrl) {
     proc.exited
   ]);
   if (exitCode !== 0) {
-    rmSync2(tmp, { recursive: true, force: true });
+    rmSync3(tmp, { recursive: true, force: true });
     throw new Error(`git clone failed (${exitCode}): ${stderr.trim()}`);
   }
   return join8(tmp, "repo");
@@ -6416,7 +6791,7 @@ async function installCustomSource(source) {
     try {
       return copyManifestDir(repoDir, source, "git");
     } finally {
-      rmSync2(repoDir, { recursive: true, force: true });
+      rmSync3(repoDir, { recursive: true, force: true });
     }
   }
   if (source.startsWith("http://") || source.startsWith("https://")) {
@@ -6488,6 +6863,7 @@ async function fetchJson(base, path) {
     headers["x-api-key"] = apiKey;
   const res = await fetch(`${base}${path}`, {
     headers,
+    redirect: "error",
     signal: AbortSignal.timeout(15000)
   });
   if (res.status === 401) {
@@ -6591,11 +6967,14 @@ async function syncHooks(options = {}) {
     writeCustomHook(name, manifest, artifact.script, scriptRel);
     const scriptPath = resolveScriptPath(name);
     const actual = await sha256File(scriptPath);
-    setPinnedHook(name, { version: entry.version, sha256: actual, source: entry.source ?? "remote" });
+    if (actual !== entry.sha256) {
+      throw new Error(`sha256 mismatch after write for '${name}@${entry.version}': lock says ${entry.sha256}, on disk ${actual}`);
+    }
+    setPinnedHook(name, { version: entry.version, sha256: entry.sha256, source: entry.source ?? "remote" });
     upsertHookRecord(db, {
       name,
       version: entry.version,
-      sha256: actual,
+      sha256: entry.sha256,
       source_type: entry.source ?? "remote",
       source_ref: apiUrl,
       last_verified_at: new Date().toISOString()
@@ -6603,6 +6982,59 @@ async function syncHooks(options = {}) {
   }
   return { apiUrl, dryRun: false, diff };
 }
+async function fetchPinnedHook(name, version, apiUrl) {
+  const remoteLock = await fetchJson(apiUrl, "/api/v1/lock");
+  const entry = remoteLock.hooks?.[name];
+  if (!entry) {
+    throw new Error(`Hook '${name}' is not in the remote registry lock`);
+  }
+  if (entry.version !== version) {
+    throw new Error(`Hook '${name}' version ${version} is not in the remote registry (available: ${entry.version})`);
+  }
+  const artifact = await fetchJson(apiUrl, `/api/v1/hooks/${name}/${version}`);
+  if (!artifact.manifest || typeof artifact.script !== "string") {
+    throw new Error(`artifact for '${name}@${version}' is malformed`);
+  }
+  const manifestName = shortManifestName(artifact.manifest.name ?? name);
+  if (manifestName !== name) {
+    throw new Error(`artifact for '${name}@${version}' declares a different hook name ('${manifestName}')`);
+  }
+  if (artifact.manifest.version !== version) {
+    throw new Error(`artifact for '${name}@${version}' declares a different version ('${artifact.manifest.version}')`);
+  }
+  const actualSha = sha256OfText(artifact.script);
+  if (actualSha !== entry.sha256) {
+    throw new Error(`sha256 mismatch for '${name}@${version}': lock says ${entry.sha256}, artifact has ${actualSha}`);
+  }
+  const manifest = parseManifest(JSON.stringify({ ...artifact.manifest, name: shortManifestName(artifact.manifest.name || name) }));
+  const scriptRel = artifact.manifest.script.includes(`
+`) ? "script.ts" : artifact.manifest.script;
+  writeCustomHook(name, manifest, artifact.script, scriptRel);
+  const scriptPath = resolveScriptPath(name);
+  const actual = await sha256File(scriptPath);
+  if (actual !== entry.sha256) {
+    throw new Error(`sha256 mismatch after write for '${name}@${version}': lock says ${entry.sha256}, on disk ${actual}`);
+  }
+  const db = getDb();
+  setPinnedHook(name, { version, sha256: entry.sha256, source: entry.source ?? "remote" });
+  upsertHookRecord(db, {
+    name,
+    version,
+    sha256: entry.sha256,
+    source_type: entry.source ?? "remote",
+    source_ref: apiUrl,
+    last_verified_at: new Date().toISOString()
+  });
+  return {
+    name,
+    version,
+    sha256: entry.sha256,
+    source: entry.source ?? "remote",
+    source_ref: apiUrl,
+    artifact,
+    scriptPath
+  };
+}
 // src/serve.ts
 init_manifest();
 init_store();
@@ -6862,16 +7294,68 @@ async function runHook(name, input, options = {}) {
       };
     }
   }
-  const { executeVerifiedScript: executeVerifiedScript2 } = await Promise.resolve().then(() => (init_run(), exports_run));
-  const { stdout: stdoutText, stderr: stderrText, exitCode } = await executeVerifiedScript2({
-    name,
-    scriptPath: script,
-    content,
-    args: custom2?.manifest.args ?? [],
-    stdin: JSON.stringify(hookInput),
-    env: process.env,
-    timeout: custom2?.manifest.timeout_ms
-  });
+  const { executeVerifiedScript: executeVerifiedScript2, HookTimeoutError: HookTimeoutError2 } = await Promise.resolve().then(() => (init_run(), exports_run));
+  const manifestTimeout = custom2?.manifest.timeout_ms ?? null;
+  const effectiveTimeout = options.timeout !== undefined && options.timeout > 0 ? options.timeout : manifestTimeout ?? null;
+  const started = Date.now();
+  let stdoutText = "";
+  let stderrText = "";
+  let exitCode = 0;
+  try {
+    ({ stdout: stdoutText, stderr: stderrText, exitCode } = await executeVerifiedScript2({
+      name,
+      scriptPath: script,
+      content,
+      args: custom2?.manifest.args ?? [],
+      stdin: JSON.stringify(hookInput),
+      env: process.env,
+      timeout: effectiveTimeout ?? undefined
+    }));
+  } catch (err) {
+    if (err instanceof HookTimeoutError2) {
+      try {
+        const { recordHookRun: recordHookRun2, resolveEventType: resolveEventType2 } = await Promise.resolve().then(() => (init_db_writer(), exports_db_writer));
+        recordHookRun2({
+          hookName: name,
+          eventType: resolveEventType2(input.hook_event_name, custom2?.manifest.events[0] ?? "PostToolUse"),
+          version: custom2?.manifest.version,
+          sha256: sha256Of2(content),
+          sessionId: typeof input.session_id === "string" ? input.session_id : null,
+          toolName: typeof input.tool_name === "string" ? input.tool_name : null,
+          toolInput: input.tool_input,
+          error: err.message.slice(0, 500),
+          exitCode: -1,
+          durationMs: Date.now() - started,
+          projectDir: process.cwd()
+        });
+      } catch {}
+      throw err;
+    }
+    throw err;
+  }
+  const durationMs = Date.now() - started;
+  try {
+    const { recordHookRun: recordHookRun2, resolveEventType: resolveEventType2 } = await Promise.resolve().then(() => (init_db_writer(), exports_db_writer));
+    let outputJson = {};
+    try {
+      outputJson = JSON.parse(stdoutText);
+    } catch {}
+    const blocked = outputJson.decision === "block" || outputJson.continue === false;
+    recordHookRun2({
+      hookName: name,
+      eventType: resolveEventType2(input.hook_event_name, custom2?.manifest.events[0] ?? "PostToolUse"),
+      version: custom2?.manifest.version,
+      sha256: sha256Of2(content),
+      sessionId: typeof input.session_id === "string" ? input.session_id : null,
+      toolName: typeof input.tool_name === "string" ? input.tool_name : null,
+      toolInput: input.tool_input,
+      result: blocked ? "block" : "continue",
+      error: exitCode !== 0 ? (stderrText || `hook exited with code ${exitCode}`).slice(0, 500) : null,
+      exitCode,
+      durationMs,
+      projectDir: process.cwd()
+    });
+  } catch {}
   let output = {};
   try {
     output = JSON.parse(stdoutText);
@@ -6887,6 +7371,7 @@ export {
   verifyScriptHash,
   upsertHookRecord,
   updateProfile,
+  uninstallHook,
   touchProfile,
   syncHooks,
   storageSync,
@@ -6911,12 +7396,14 @@ export {
   removeProjectHook,
   removePinnedHook,
   removeHookRecord,
+  removeHookFromStore,
   removeHook,
   readLock,
   readCustomManifest,
   readConfig,
   provisionCloudflareResources,
   planSync,
+  pinInstalledHook,
   parseStorageTables,
   parseManifest,
   listProjectHooks,
@@ -6956,6 +7443,7 @@ export {
   getHook,
   getCustomHooksDir,
   getConfigPath,
+  fetchPinnedHook,
   exportProfiles,
   deleteProfile,
   createProfile,