@hasna/hooks 0.6.5 → 0.6.8

package/bin/serve.js

@@ -4518,22 +4518,27 @@ function getLockPath() {
     return explicit;
   return join(getHooksDataDir(), "hooks.lock");
 }
-function resolveApiKey(flagKey) {
-  if (flagKey && flagKey.length > 0)
-    return flagKey;
+function resolveApiKey() {
   return process.env.HASNA_HOOKS_API_KEY ?? process.env.HOOKS_API_KEY;
 }
 
+// src/lib/semver.ts
+var NUMERIC_ID = "(0|[1-9]\\d{0,15})";
+var ALNUM_ID = "\\d*[A-Za-z-][0-9A-Za-z-]*";
+var SEMVER_PATTERN = new RegExp(`^${NUMERIC_ID}\\.${NUMERIC_ID}\\.${NUMERIC_ID}` + `(?:-(?:${NUMERIC_ID}|${ALNUM_ID})(?:\\.(?:${NUMERIC_ID}|${ALNUM_ID}))*)?` + `(?:\\+[0-9A-Za-z.-]+)?$`);
+
 // src/lib/manifest.ts
 var HOOK_NAME_RE = /^[\w-]+$/;
 var manifestSchema = exports_external.object({
   name: exports_external.string().regex(HOOK_NAME_RE, "hook name must be /^[\\w-]+$/"),
-  version: exports_external.string().regex(/^\d+\.\d+\.\d+/, "version must be semver (e.g. 1.2.3)"),
+  version: exports_external.string().regex(SEMVER_PATTERN, "version must be full semver (e.g. 1.2.3 or 1.2.3-beta.1)"),
   description: exports_external.string().optional(),
   events: exports_external.array(exports_external.string()).min(1, "at least one event is required"),
   script: exports_external.string().min(1, "script must name a relative path or inline content"),
+  script_kind: exports_external.enum(["inline", "file"]).optional(),
   args: exports_external.array(exports_external.string()).optional(),
-  timeout_ms: exports_external.number().int().positive().optional()
+  timeout_ms: exports_external.number().int().positive().optional(),
+  env: exports_external.record(exports_external.string(), exports_external.string()).optional()
 });
 function parseManifest(json) {
   const parsed = JSON.parse(json);
@@ -4584,16 +4589,25 @@ function assertContained(target, root, raw) {
   assertContainedReal(root, lexical, raw);
   return lexical;
 }
-function resolveScript(manifest, manifestDir) {
-  if (manifest.script.includes(`
-`)) {
+function isInlineScript(manifest) {
+  return manifest.script_kind === "inline" || manifest.script_kind === undefined && manifest.script.includes(`
+`);
+}
+function scriptRelFor(manifest) {
+  if (isInlineScript(manifest)) {
     const ext = manifest.script.trim().startsWith("#!") ? ".sh" : ".ts";
-    return { path: `script${ext}`, content: manifest.script };
+    return `script${ext}`;
   }
   const rel = normalize(manifest.script);
   if (isAbsolute(rel)) {
     throw new Error(`manifest script must be relative or inline, got absolute path '${manifest.script}'`);
   }
+  return rel;
+}
+function resolveScript(manifest, manifestDir) {
+  if (isInlineScript(manifest))
+    return { path: scriptRelFor(manifest), content: manifest.script };
+  const rel = scriptRelFor(manifest);
   const resolved = assertContained(join2(manifestDir, rel), manifestDir, manifest.script);
   if (!existsSync(resolved)) {
     throw new Error(`manifest script file not found: ${resolved}`);
@@ -4611,8 +4625,8 @@ function readCustomManifest(name) {
   try {
     const manifest = parseManifest(readFileSync(manifestPath, "utf-8"));
     const script = resolveScript(manifest, dir);
-    return { manifest, scriptPath: join2(dir, script.path), scriptContent: script.content, scriptIsInline: manifest.script.includes(`
-`) };
+    const scriptIsInline = isInlineScript(manifest);
+    return { manifest, scriptPath: join2(dir, script.path), scriptContent: script.content, scriptIsInline };
   } catch (err) {
     if (err instanceof ScriptContainmentError)
       throw err;
@@ -4641,7 +4655,7 @@ function readdirSafe(dir) {
 
 // src/lib/store.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2, renameSync } from "fs";
 import { readFile } from "fs/promises";
 
 // src/db/index.ts
@@ -5002,6 +5016,7 @@ function getDb() {
 }
 
 // src/lib/store.ts
+import { randomBytes } from "crypto";
 function sha256Of(input) {
   return createHash("sha256").update(input).digest("hex");
 }
@@ -5037,16 +5052,45 @@ function upsertHookRecord(db, record) {
     record.last_verified_at ?? null
   ]);
 }
+class LockFileError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "LockFileError";
+  }
+}
+function assertLockShape(parsed, path) {
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new LockFileError(`hooks.lock (${path}) is malformed: expected a JSON object with a "hooks" map. ` + `Repair: fix the file by hand, or if it is unrecoverable move it aside and run 'hooks sync' to rebuild it. ` + `Nothing was trusted or rewritten \u2014 hooks are left in the refuse-to-run state until the lock is repaired.`);
+  }
+  const hooks = parsed.hooks;
+  if (hooks === null || typeof hooks !== "object" || Array.isArray(hooks)) {
+    throw new LockFileError(`hooks.lock (${path}) is malformed: missing or invalid "hooks" map. ` + `Repair: fix the file by hand, or if it is unrecoverable move it aside and run 'hooks sync' to rebuild it. ` + `Nothing was trusted or rewritten \u2014 hooks are left in the refuse-to-run state until the lock is repaired.`);
+  }
+  for (const [name, entry] of Object.entries(hooks)) {
+    const e = entry;
+    if (e === null || typeof e !== "object" || typeof e.version !== "string" || typeof e.sha256 !== "string") {
+      throw new LockFileError(`hooks.lock (${path}) is malformed: entry for '${name}' is not a valid pin (version and sha256 strings required). ` + `Repair: fix the file by hand, or if it is unrecoverable move it aside and run 'hooks sync' to rebuild it.`);
+    }
+  }
+}
 function readLock() {
+  const path = getLockPath();
+  if (!existsSync4(path))
+    return { hooks: {} };
+  let raw;
   try {
-    const path = getLockPath();
-    if (!existsSync4(path))
-      return { hooks: {} };
-    const parsed = JSON.parse(readFileSync3(path, "utf-8"));
-    return { hooks: parsed.hooks ?? {} };
+    raw = readFileSync3(path, "utf-8");
   } catch {
-    return { hooks: {} };
+    throw new LockFileError(`hooks.lock (${path}) could not be read. Repair: fix permissions or move the file aside and run 'hooks sync'.`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new LockFileError(`hooks.lock (${path}) is malformed: not valid JSON (${String((raw ?? "").slice(0, 80))}). ` + `Repair: fix the file by hand, or if it is unrecoverable move it aside and run 'hooks sync' to rebuild it. ` + `Nothing was trusted or rewritten \u2014 hooks are left in the refuse-to-run state until the lock is repaired.`);
   }
+  assertLockShape(parsed, path);
+  return parsed;
 }
 function writeLock(lock) {
   const path = getLockPath();
@@ -5055,8 +5099,10 @@ function writeLock(lock) {
   for (const name of Object.keys(lock.hooks).sort()) {
     sorted[name] = lock.hooks[name];
   }
-  writeFileSync2(path, JSON.stringify({ hooks: sorted }, null, 2) + `
+  const tmp = `${path}.tmp-${randomBytes(8).toString("hex")}`;
+  writeFileSync2(tmp, JSON.stringify({ hooks: sorted }, null, 2) + `
 `, "utf-8");
+  renameSync(tmp, path);
   return path;
 }
 function setPinnedHook(name, entry) {
@@ -5185,24 +5231,29 @@ async function buildCatalog() {
     const scriptPath = resolveHook(meta.name)?.scriptPath;
     if (!scriptPath)
       continue;
+    const sha = await sha256File(scriptPath);
     byName.set(meta.name, {
       name: meta.name,
       version: meta.version,
-      sha256: await sha256File(scriptPath),
+      sha256: sha,
       events: meta.events && meta.events.length > 0 ? meta.events : [meta.event],
       description: meta.description,
-      source: "bundled"
+      source: "bundled",
+      versions: [meta.version]
     });
   }
   for (const custom2 of listCustomHooks()) {
     const name = shortManifestName(custom2.manifest.name);
+    const sha = await sha256File(custom2.scriptPath);
+    const existing = byName.get(name);
     byName.set(name, {
       name,
       version: custom2.manifest.version,
-      sha256: await sha256File(custom2.scriptPath),
+      sha256: sha,
       events: custom2.manifest.events,
       description: custom2.manifest.description ?? "Custom hook",
-      source: byName.has(name) ? "custom-overrides-bundled" : "custom"
+      source: existing ? "custom-overrides-bundled" : "custom",
+      versions: existing ? [...new Set([...existing.versions, custom2.manifest.version])] : [custom2.manifest.version]
     });
   }
   return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
@@ -5220,6 +5271,7 @@ async function artifactFor(name, version) {
     description: resolved.description,
     events: resolved.events,
     script: custom2 ? custom2.manifest.script : `src/hook.ts`,
+    script_kind: custom2?.manifest.script_kind,
     args: custom2?.manifest.args,
     timeout_ms: custom2?.manifest.timeout_ms
   };
@@ -5249,11 +5301,32 @@ function handleServeRequest(req, apiKey) {
     return buildCatalog().then((catalog) => json({ hooks: catalog }));
   }
   if (url.pathname === "/api/v1/lock" && req.method === "GET") {
-    return Promise.resolve(json(readLock()));
+    return buildCatalog().then((catalog) => {
+      const lock = readLock();
+      const byVersion = {};
+      for (const entry of catalog)
+        byVersion[entry.name] = entry.versions;
+      const hooks = {};
+      for (const [name, pin] of Object.entries(lock.hooks)) {
+        hooks[name] = { ...pin, versions: byVersion[name] ?? [pin.version] };
+      }
+      return json({ hooks });
+    });
   }
-  const artifactMatch = /^\/api\/v1\/hooks\/([\w-]+)\/(\d+\.\d+\.\d+)$/.exec(url.pathname);
+  const artifactMatch = /^\/api\/v1\/hooks\/([\w-]+)\/([0-9A-Za-z.%+_-]+)$/.exec(url.pathname);
   if (artifactMatch && req.method === "GET") {
-    const [, name, version] = artifactMatch;
+    const [, rawName, rawVersion] = artifactMatch;
+    let name;
+    let version;
+    try {
+      name = decodeURIComponent(rawName);
+      version = decodeURIComponent(rawVersion);
+    } catch {
+      return Promise.resolve(json({ error: "invalid URL encoding" }, 400));
+    }
+    if (!SEMVER_PATTERN.test(version)) {
+      return Promise.resolve(json({ error: `invalid semver version '${version}'` }, 400));
+    }
     return artifactFor(name, version).then(async (artifact) => {
       if (!artifact)
         return json({ error: `Hook '${name}@${version}' not found locally` }, 404);
@@ -5284,7 +5357,7 @@ function handleServeRequest(req, apiKey) {
 function startServeServer(options) {
   const port = options.port ?? DEFAULT_SERVE_PORT;
   const host = options.host ?? SERVE_HOST;
-  const apiKey = resolveApiKey(options.apiKey);
+  const apiKey = resolveApiKey();
   const server = Bun.serve({
     hostname: host,
     port,
@@ -5296,7 +5369,17 @@ function startServeServer(options) {
   return server;
 }
 if (import.meta.main) {
-  startServeServer({});
+  const argv = process.argv.slice(2);
+  const flagValue = (name) => {
+    const idx = argv.indexOf(name);
+    return idx >= 0 && argv[idx + 1] ? argv[idx + 1] : undefined;
+  };
+  const portArg = flagValue("--port");
+  const hostArg = flagValue("--host");
+  startServeServer({
+    port: portArg ? parseInt(portArg, 10) : undefined,
+    host: hostArg
+  });
 }
 export {
   startServeServer,

package/dist/config.d.ts

@@ -15,4 +15,11 @@ export interface HooksConfig {
 export declare function readConfig(): HooksConfig;
 export declare function writeConfig(config: HooksConfig): string;
 export declare function resolveApiUrl(): string | undefined;
-export declare function resolveApiKey(flagKey?: string): string | undefined;
+/**
+ * P1-8: the registry API key resolves from the environment ONLY —
+ * HASNA_HOOKS_API_KEY / HOOKS_API_KEY. A secret-valued CLI flag is removed
+ * (a flag value is visible in process listings and shell history); the
+ * vault-key-NAME reference (config api_key_ref) is a name, not a value, and
+ * is untouched.
+ */
+export declare function resolveApiKey(): string | undefined;

package/dist/db/remote-storage.d.ts

@@ -1,3 +1,25 @@
+/**
+ * P1-5: verified TLS by default. `sslmode=require` / `ssl=true` previously
+ * produced `rejectUnauthorized: false` — TLS that verified nothing, so the
+ * "encrypted" channel was open to a MITM. The default is now
+ * `rejectUnauthorized: true`.
+ *
+ * Insecure verification exists ONLY through the explicit dev-only config key
+ * HASNA_HOOKS_PG_INSECURE_TLS=1 (or HOOKS_PG_INSECURE_TLS) and is refused
+ * under a production-shaped environment (NODE_ENV=production) — a dev key
+ * silently disabling verification in prod would be the exact failure this
+ * finding corrects.
+ *
+ * P3-12: sslmode/ssl are parsed from the connection-string QUERY, not by
+ * substring scan — `sslmode = require` (spaces around the separator), other
+ * casings and non-URL DSN forms are all resolved from the parameter value.
+ *
+ * Exported for tests; the connection-string forms are the documented
+ * sslmode values the pg client understands.
+ */
+export declare function sslConfigFor(connectionString: string): {
+    rejectUnauthorized: boolean;
+} | undefined;
 export declare class PgAdapterAsync {
     private readonly pool;
     constructor(connectionString: string);