@hasna/hooks 0.6.6 → 0.6.8

package/bin/index.js

@@ -47,7 +47,7 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
-// node_modules/commander/lib/error.js
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/error.js
 var require_error = __commonJS((exports) => {
   class CommanderError extends Error {
     constructor(exitCode, code, message) {
@@ -71,7 +71,7 @@ var require_error = __commonJS((exports) => {
   exports.InvalidArgumentError = InvalidArgumentError;
 });
 
-// node_modules/commander/lib/argument.js
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/argument.js
 var require_argument = __commonJS((exports) => {
   var { InvalidArgumentError } = require_error();
 
@@ -150,7 +150,7 @@ var require_argument = __commonJS((exports) => {
   exports.humanReadableArgName = humanReadableArgName;
 });
 
-// node_modules/commander/lib/help.js
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/help.js
 var require_help = __commonJS((exports) => {
   var { humanReadableArgName } = require_argument();
 
@@ -399,7 +399,7 @@ var require_help = __commonJS((exports) => {
   exports.Help = Help;
 });
 
-// node_modules/commander/lib/option.js
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/option.js
 var require_option = __commonJS((exports) => {
   var { InvalidArgumentError } = require_error();
 
@@ -550,7 +550,7 @@ var require_option = __commonJS((exports) => {
   exports.DualOptions = DualOptions;
 });
 
-// node_modules/commander/lib/suggestSimilar.js
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/suggestSimilar.js
 var require_suggestSimilar = __commonJS((exports) => {
   var maxDistance = 3;
   function editDistance(a, b) {
@@ -623,7 +623,7 @@ var require_suggestSimilar = __commonJS((exports) => {
   exports.suggestSimilar = suggestSimilar;
 });
 
-// node_modules/commander/lib/command.js
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/command.js
 var require_command = __commonJS((exports) => {
   var EventEmitter = __require("events").EventEmitter;
   var childProcess = __require("child_process");
@@ -1866,7 +1866,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
   exports.Command = Command;
 });
 
-// node_modules/commander/index.js
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/index.js
 var require_commander = __commonJS((exports) => {
   var { Argument } = require_argument();
   var { Command } = require_command();
@@ -2419,7 +2419,7 @@ var init_registry = __esm(() => {
   ];
 });
 
-// node_modules/cli-spinners/spinners.json
+// ../../node_modules/.bun/cli-spinners@2.9.2/node_modules/cli-spinners/spinners.json
 var require_spinners = __commonJS((exports, module) => {
   module.exports = {
     dots: {
@@ -4045,7 +4045,7 @@ var require_spinners = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/cli-spinners/index.js
+// ../../node_modules/.bun/cli-spinners@2.9.2/node_modules/cli-spinners/index.js
 var require_cli_spinners = __commonJS((exports, module) => {
   var spinners = Object.assign({}, require_spinners());
   var spinnersList = Object.keys(spinners);
@@ -4125,9 +4125,9 @@ function resolveApiKey() {
 var init_config = () => {};
 
 // src/lib/semver.ts
-var SEMVER_PATTERN;
+var NUMERIC_ID = "(0|[1-9]\\d{0,15})", ALNUM_ID = "\\d*[A-Za-z-][0-9A-Za-z-]*", SEMVER_PATTERN;
 var init_semver = __esm(() => {
-  SEMVER_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/;
+  SEMVER_PATTERN = new RegExp(`^${NUMERIC_ID}\\.${NUMERIC_ID}\\.${NUMERIC_ID}` + `(?:-(?:${NUMERIC_ID}|${ALNUM_ID})(?:\\.(?:${NUMERIC_ID}|${ALNUM_ID}))*)?` + `(?:\\+[0-9A-Za-z.-]+)?$`);
 });
 
 // src/lib/manifest.ts
@@ -4289,7 +4289,8 @@ var init_manifest = __esm(() => {
     script: z.string().min(1, "script must name a relative path or inline content"),
     script_kind: z.enum(["inline", "file"]).optional(),
     args: z.array(z.string()).optional(),
-    timeout_ms: z.number().int().positive().optional()
+    timeout_ms: z.number().int().positive().optional(),
+    env: z.record(z.string(), z.string()).optional()
   });
   ScriptContainmentError = class ScriptContainmentError extends Error {
     constructor(path, hookDir, raw) {
@@ -5921,6 +5922,8 @@ var init_db_writer = __esm(() => {
 });
 
 // src/lib/hook-env.ts
+import { dirname as dirname4, isAbsolute as isAbsolute2 } from "path";
+import { existsSync as existsSync10, statSync } from "fs";
 function isDeniedEnvName(name) {
   const upper = name.toUpperCase();
   if (DENY_PREFIXES.some((prefix) => upper.startsWith(prefix)))
@@ -5929,13 +5932,74 @@ function isDeniedEnvName(name) {
     return true;
   return DENY_CONTAINS.some((token) => upper.includes(token));
 }
+function isInterpreterInjectionEnvName(name) {
+  if (INTERPRETER_INJECTION.has(name))
+    return true;
+  return INTERPRETER_INJECTION_PREFIXES.some((prefix) => name.startsWith(prefix));
+}
+function isBashFunctionEnvName(name) {
+  return name.startsWith("BASH_FUNC_");
+}
+function isUnsafePathEntry(entry, home) {
+  if (entry === "" || !isAbsolute2(entry))
+    return true;
+  if (home && (entry === home || entry.startsWith(home + "/")))
+    return true;
+  if (entry === "/tmp" || entry.startsWith("/tmp/"))
+    return true;
+  if (entry === "/var/tmp" || entry.startsWith("/var/tmp/"))
+    return true;
+  try {
+    if ((statSync(entry).mode & 2) !== 0)
+      return true;
+  } catch {}
+  return false;
+}
+function sanitizeHookPath(pathValue, home) {
+  const baseline = PATH_BASELINE.slice();
+  if (process.platform === "darwin" && existsSync10("/opt/homebrew/bin"))
+    baseline.push("/opt/homebrew/bin");
+  const bunDir = dirname4(process.execPath);
+  const seen = new Set;
+  const out = [];
+  for (const dir of baseline) {
+    if (seen.has(dir))
+      continue;
+    seen.add(dir);
+    out.push(dir);
+  }
+  if (!seen.has(bunDir)) {
+    seen.add(bunDir);
+    out.push(bunDir);
+  }
+  for (const entry of pathValue.split(":")) {
+    if (seen.has(entry))
+      continue;
+    if (isUnsafePathEntry(entry, home))
+      continue;
+    seen.add(entry);
+    out.push(entry);
+  }
+  return out.join(":");
+}
 function buildHookEnv(source, extra) {
   const out = {};
   for (const name of ALLOWLIST) {
+    if (name === "PATH")
+      continue;
     const value = source[name] ?? extra?.[name];
     if (value !== undefined && value !== null)
       out[name] = value;
   }
+  const pathOverride = extra?.PATH;
+  if (pathOverride !== undefined && pathOverride !== null) {
+    out.PATH = pathOverride;
+  } else {
+    const parentPath = source.PATH;
+    if (parentPath !== undefined && parentPath !== null) {
+      out.PATH = sanitizeHookPath(parentPath, source.HOME ?? extra?.HOME);
+    }
+  }
   for (const [from, to] of CONFIG_PROJECTIONS) {
     const value = source[from] ?? extra?.[from];
     if (value !== undefined && value !== null)
@@ -5947,14 +6011,44 @@ function buildHookEnv(source, extra) {
       continue;
     if (isDeniedEnvName(name))
       continue;
+    if (isInterpreterInjectionEnvName(name))
+      continue;
+    if (isBashFunctionEnvName(name))
+      continue;
     if (value !== undefined && value !== null)
       out[name] = value;
   }
   return out;
 }
-var ALLOWLIST, DENY_SUFFIXES, DENY_PREFIXES, DENY_CONTAINS, CONFIG_PROJECTIONS;
+var ALLOWLIST, INTERPRETER_INJECTION, INTERPRETER_INJECTION_PREFIXES, DENY_SUFFIXES, DENY_PREFIXES, DENY_CONTAINS, PATH_BASELINE, CONFIG_PROJECTIONS;
 var init_hook_env = __esm(() => {
   ALLOWLIST = new Set(["PATH", "HOME", "LANG", "TZ", "SHELL", "TERM", "USER", "PWD"]);
+  INTERPRETER_INJECTION = new Set([
+    "BASH_ENV",
+    "ENV",
+    "BASHOPTS",
+    "SHELLOPTS",
+    "NODE_OPTIONS",
+    "NODE_PATH",
+    "PYTHONSTARTUP",
+    "PYTHONINSPECT",
+    "PYTHONPATH",
+    "PYTHONHOME",
+    "LD_PRELOAD",
+    "LD_LIBRARY_PATH",
+    "GCONV_PATH",
+    "LOCPATH",
+    "PERL5OPT",
+    "RUBYOPT",
+    "NODE_EXTRA_CA_CERTS",
+    "NODE_TLS_REJECT_UNAUTHORIZED",
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
+    "CURL_CA_BUNDLE",
+    "GIT_SSL_CAINFO",
+    "AWS_CA_BUNDLE"
+  ]);
+  INTERPRETER_INJECTION_PREFIXES = ["GIT_CONFIG_"];
   DENY_SUFFIXES = ["KEY", "TOKEN", "SECRET", "PASSWORD", "PASSWD", "CREDENTIAL", "CREDENTIALS", "URL", "URI"];
   DENY_PREFIXES = [
     "HASNA_",
@@ -5972,6 +6066,7 @@ var init_hook_env = __esm(() => {
     "MEMENTOS_"
   ];
   DENY_CONTAINS = ["DATABASE_URL"];
+  PATH_BASELINE = ["/usr/bin", "/bin", "/usr/local/bin", "/sbin", "/usr/sbin"];
   CONFIG_PROJECTIONS = [
     ["HASNA_HOOKS_DATA_DIR", "HOOKS_DATA_DIR"],
     ["HASNA_HOOKS_DB_PATH", "HOOKS_DB_PATH"],
@@ -5988,7 +6083,7 @@ __export(exports_run, {
 });
 import { randomBytes as randomBytes2 } from "crypto";
 import { rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute2, join as join9 } from "path";
+import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute3, join as join9 } from "path";
 function extensionOf(scriptPath) {
   const base = basename2(scriptPath);
   const dot = base.lastIndexOf(".");
@@ -6015,13 +6110,13 @@ function interpreterFor(name, scriptPath, content) {
     if (interp === "bash" || interp === "sh")
       return { command: ["/bin/bash"], tempExt: "sh" };
     if (interp === "node" || interp === "bun")
-      return { command: ["bun", "run"], tempExt: BUN_EXTENSIONS.has(ext) ? ext : "ts" };
+      return { command: [process.execPath, "run"], tempExt: BUN_EXTENSIONS.has(ext) ? ext : "ts" };
     throw new Error(`Refusing to run hook '${name}': shebang '${firstLine}' is not a recognized interpreter (supported: bash/sh, node/bun)`);
   }
   if (BASH_EXTENSIONS.has(ext))
     return { command: ["/bin/bash"], tempExt: "sh" };
   if (BUN_EXTENSIONS.has(ext))
-    return { command: ["bun", "run"], tempExt: ext };
+    return { command: [process.execPath, "run"], tempExt: ext };
   throw new Error(`Refusing to run hook '${name}': unsupported script extension '.${ext}' (supported: .sh .bash .ts .tsx .js .jsx .mjs .cjs .mts .cts, or a recognized shebang)`);
 }
 async function readPipeWithDeadline(stream, deadlineMs) {
@@ -6057,7 +6152,7 @@ async function readPipeWithDeadline(stream, deadlineMs) {
   return chunks.join("");
 }
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname4(options.scriptPath);
+  const scriptDir = dirname5(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
   const tempPath = join9(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
@@ -6068,7 +6163,7 @@ async function executeVerifiedScript(options) {
   }, options.timeout) : null;
   try {
     writeFileSync6(tempPath, options.content, { flag: "wx", mode: 384 });
-    proc = Bun.spawn([...interpreter.command, isAbsolute2(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
+    proc = Bun.spawn([...interpreter.command, isAbsolute3(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
       stdin: new Response(options.stdin),
       stdout: "pipe",
       stderr: "pipe",
@@ -6150,12 +6245,12 @@ __export(exports_custom_install, {
   installCustomSource: () => installCustomSource,
   ensureCustomDir: () => ensureCustomDir
 });
-import { existsSync as existsSync10, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync4 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync4 } from "fs";
 import { join as join10 } from "path";
 import { tmpdir } from "os";
 function manifestAt(dir) {
   const path = join10(dir, "manifest.json");
-  if (!existsSync10(path))
+  if (!existsSync11(path))
     return;
   try {
     return parseManifest(readFileSync7(path, "utf-8"));
@@ -6201,7 +6296,7 @@ function isCustomSource(value) {
     return true;
   if (value.startsWith("http://") || value.startsWith("https://"))
     return true;
-  return existsSync10(value);
+  return existsSync11(value);
 }
 async function installCustomSource(source) {
   if (isGitUrl(source)) {
@@ -6215,7 +6310,7 @@ async function installCustomSource(source) {
   if (source.startsWith("http://") || source.startsWith("https://")) {
     return installManifestUrl(source);
   }
-  if (!existsSync10(source)) {
+  if (!existsSync11(source)) {
     throw new Error(`No such local path: ${source}`);
   }
   if (source.endsWith("manifest.json")) {
@@ -7278,14 +7373,14 @@ import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z as z2 } from "zod";
 import { createServer } from "http";
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
-import { join as join11, dirname as dirname5 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
+import { join as join11, dirname as dirname6 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 async function runVerifiedHook(name, stdin, timeoutMs) {
   const { resolveHook: resolveHook2, resolveScriptPath: resolveScriptPath2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
   const resolved = resolveHook2(name);
   const hookScript = resolveScriptPath2(name);
-  if (!resolved || !hookScript || !existsSync11(hookScript)) {
+  if (!resolved || !hookScript || !existsSync12(hookScript)) {
     throw new Error(`Hook '${name}' not found`);
   }
   const content = readFileSync9(hookScript);
@@ -7493,7 +7588,7 @@ function createHooksServer() {
     const settingsPath = getSettingsPath(scope);
     const issues = [];
     const healthy = [];
-    const settingsExist = existsSync11(settingsPath);
+    const settingsExist = existsSync12(settingsPath);
     if (!settingsExist) {
       issues.push({ hook: "(settings)", issue: `${settingsPath} not found`, severity: "warning" });
     }
@@ -7503,7 +7598,7 @@ function createHooksServer() {
       const meta = custom ? resolveHookMeta(name) : getHook(name);
       let hookHealthy = true;
       if (custom) {
-        if (!existsSync11(custom.scriptPath)) {
+        if (!existsSync12(custom.scriptPath)) {
           issues.push({ hook: name, issue: `Custom hook script missing: ${custom.scriptPath}`, severity: "error" });
           hookHealthy = false;
         }
@@ -7513,7 +7608,7 @@ function createHooksServer() {
           continue;
         }
         const hookDir = getHookPath(name);
-        if (!existsSync11(join11(hookDir, "src", "hook.ts"))) {
+        if (!existsSync12(join11(hookDir, "src", "hook.ts"))) {
           issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
           hookHealthy = false;
         }
@@ -7552,7 +7647,7 @@ function createHooksServer() {
       const hookPath = getHookPath(name);
       const readmePath = join11(hookPath, "README.md");
       let readme = "";
-      if (existsSync11(readmePath)) {
+      if (existsSync12(readmePath)) {
         readme = readFileSync9(readmePath, "utf-8");
       }
       if (verbose) {
@@ -7736,7 +7831,7 @@ function createHooksServer() {
     const ctx = {
       scope,
       settings_path: settingsPath,
-      settings_exists: existsSync11(settingsPath),
+      settings_exists: existsSync12(settingsPath),
       registered_hooks: hooks,
       hook_count: hooks.length,
       healthy,
@@ -7882,7 +7977,7 @@ function createHooksServer() {
     const settingsPath = getSettingsPath(scope);
     let settings = {};
     try {
-      if (existsSync11(settingsPath))
+      if (existsSync12(settingsPath))
         settings = JSON.parse(readFileSync9(settingsPath, "utf-8"));
     } catch {}
     if (!settings.hooks)
@@ -7892,8 +7987,8 @@ function createHooksServer() {
       disabled.push(name);
     settings.hooks.__disabled = disabled;
     const { writeFileSync: writeFileSync7, mkdirSync: mkdirSync8 } = await import("fs");
-    const { dirname: dirname6 } = await import("path");
-    mkdirSync8(dirname6(settingsPath), { recursive: true });
+    const { dirname: dirname7 } = await import("path");
+    mkdirSync8(dirname7(settingsPath), { recursive: true });
     writeFileSync7(settingsPath, JSON.stringify(settings, null, 2) + `
 `);
     return { content: [{ type: "text", text: JSON.stringify({ hook: name, disabled: true, scope }) }] };
@@ -7905,7 +8000,7 @@ function createHooksServer() {
     const settingsPath = getSettingsPath(scope);
     let settings = {};
     try {
-      if (existsSync11(settingsPath))
+      if (existsSync12(settingsPath))
         settings = JSON.parse(readFileSync9(settingsPath, "utf-8"));
     } catch {}
     if (settings.hooks?.__disabled) {
@@ -8266,12 +8361,12 @@ var init_server = __esm(() => {
   init_store();
   init_redact();
   init_storage();
-  __dirname3 = dirname5(fileURLToPath3(import.meta.url));
+  __dirname3 = dirname6(fileURLToPath3(import.meta.url));
   pkg = { name: "@hasna/hooks", version: "0.0.0" };
   try {
     for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
       const p = join11(__dirname3, rel);
-      if (existsSync11(p)) {
+      if (existsSync12(p)) {
         pkg = JSON.parse(readFileSync9(p, "utf-8"));
         break;
       }
@@ -8340,7 +8435,7 @@ function startMcpHttpServer(options) {
 var DEFAULT_MCP_HTTP_PORT = 8847, MCP_HTTP_HOST = "127.0.0.1", MCP_SERVICE_NAME = "hooks";
 var init_http = () => {};
 
-// node_modules/@hasna/events/dist/commander.js
+// ../events/dist/commander.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { Buffer as Buffer2 } from "buffer";
 import { existsSync } from "fs";
@@ -9525,7 +9620,7 @@ function replaySummary(events, deliveries, nextCursor) {
 // src/cli/index.tsx
 import { render } from "ink";
 
-// node_modules/commander/esm.mjs
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
 var {
   program,
@@ -9543,19 +9638,19 @@ var {
 
 // src/cli/index.tsx
 import chalk2 from "chalk";
-import { existsSync as existsSync12, readFileSync as readFileSync10, rmSync as rmSync5 } from "fs";
-import { join as join12, dirname as dirname6 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync10, rmSync as rmSync5 } from "fs";
+import { join as join12, dirname as dirname7 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 
 // src/cli/components/App.tsx
 import { useState as useState7 } from "react";
 import { Box as Box8, Text as Text10, useApp, useInput as useInput5 } from "ink";
 
-// node_modules/ink-select-input/build/Indicator.js
+// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Indicator.js
 import React from "react";
 import { Box, Text } from "ink";
 
-// node_modules/is-unicode-supported/index.js
+// ../../node_modules/.bun/is-unicode-supported@2.1.0/node_modules/is-unicode-supported/index.js
 import process2 from "process";
 function isUnicodeSupported() {
   const { env } = process2;
@@ -9566,7 +9661,7 @@ function isUnicodeSupported() {
   return Boolean(env.WT_SESSION) || Boolean(env.TERMINUS_SUBLIME) || env.ConEmuTask === "{cmd::Cmder}" || TERM_PROGRAM === "Terminus-Sublime" || TERM_PROGRAM === "vscode" || TERM === "xterm-256color" || TERM === "alacritty" || TERM === "rxvt-unicode" || TERM === "rxvt-unicode-256color" || env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
 
-// node_modules/figures/index.js
+// ../../node_modules/.bun/figures@6.1.0/node_modules/figures/index.js
 var common = {
   circleQuestionMark: "(?)",
   questionMarkPrefix: "(?)",
@@ -9842,23 +9937,23 @@ var figures = shouldUseMain ? mainSymbols : fallbackSymbols;
 var figures_default = figures;
 var replacements = Object.entries(specialMainSymbols);
 
-// node_modules/ink-select-input/build/Indicator.js
+// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Indicator.js
 function Indicator({ isSelected = false }) {
   return React.createElement(Box, { marginRight: 1 }, isSelected ? React.createElement(Text, { color: "blue" }, figures_default.pointer) : React.createElement(Text, null, " "));
 }
 var Indicator_default = Indicator;
-// node_modules/ink-select-input/build/Item.js
+// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Item.js
 import * as React2 from "react";
 import { Text as Text2 } from "ink";
 function Item({ isSelected = false, label }) {
   return React2.createElement(Text2, { color: isSelected ? "blue" : undefined }, label);
 }
 var Item_default = Item;
-// node_modules/ink-select-input/build/SelectInput.js
+// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/SelectInput.js
 import { isDeepStrictEqual } from "util";
 import React3, { useState, useEffect, useRef, useCallback } from "react";
 
-// node_modules/to-rotated/index.js
+// ../../node_modules/.bun/to-rotated@1.0.0/node_modules/to-rotated/index.js
 function toRotated(array, steps) {
   if (!Array.isArray(array)) {
     throw new TypeError(`Expected an array, got \`${typeof array}\`.`);
@@ -9880,7 +9975,7 @@ function toRotated(array, steps) {
   ];
 }
 
-// node_modules/ink-select-input/build/SelectInput.js
+// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/SelectInput.js
 import { Box as Box2, useInput } from "ink";
 function SelectInput({ items = [], isFocused = true, initialIndex = 0, indicatorComponent = Indicator_default, itemComponent = Item_default, limit: customLimit, onSelect, onHighlight }) {
   const hasLimit = typeof customLimit === "number" && items.length > customLimit;
@@ -10176,7 +10271,7 @@ function HookSelect({
 import { useState as useState4, useEffect as useEffect3 } from "react";
 import { Box as Box6, Text as Text7, useInput as useInput4 } from "ink";
 
-// node_modules/ink-text-input/build/index.js
+// ../../node_modules/.bun/ink-text-input@6.0.0+fa875fef9f949ebd/node_modules/ink-text-input/build/index.js
 import React5, { useState as useState3, useEffect as useEffect2 } from "react";
 import { Text as Text6, useInput as useInput3 } from "ink";
 import chalk from "chalk";
@@ -10354,7 +10449,7 @@ function SearchView({
 import { useState as useState6, useEffect as useEffect5 } from "react";
 import { Box as Box7, Text as Text9 } from "ink";
 
-// node_modules/ink-spinner/build/index.js
+// ../../node_modules/.bun/ink-spinner@5.0.0+fa875fef9f949ebd/node_modules/ink-spinner/build/index.js
 var import_cli_spinners = __toESM(require_cli_spinners(), 1);
 import React7, { useState as useState5, useEffect as useEffect4 } from "react";
 import { Text as Text8 } from "ink";
@@ -10726,8 +10821,8 @@ init_resolve();
 init_store();
 init_semver();
 import { jsxDEV as jsxDEV8 } from "react/jsx-dev-runtime";
-var __dirname4 = dirname6(fileURLToPath4(import.meta.url));
-var pkgPath = existsSync12(join12(__dirname4, "..", "package.json")) ? join12(__dirname4, "..", "package.json") : join12(__dirname4, "..", "..", "package.json");
+var __dirname4 = dirname7(fileURLToPath4(import.meta.url));
+var pkgPath = existsSync13(join12(__dirname4, "..", "package.json")) ? join12(__dirname4, "..", "package.json") : join12(__dirname4, "..", "..", "package.json");
 var pkg2 = JSON.parse(readFileSync10(pkgPath, "utf-8"));
 var program2 = new Command;
 function resolveScope(options) {
@@ -10895,7 +10990,7 @@ program2.command("run").argument("<hook>", "Hook to run").option("--profile <id>
     process.exit(1);
   }
   const hookScript = resolveScriptPath2(hook);
-  if (!hookScript || !existsSync12(hookScript)) {
+  if (!hookScript || !existsSync13(hookScript)) {
     console.error(JSON.stringify({ error: `Hook script not found: ${hookScript ?? hook}` }));
     process.exit(1);
   }
@@ -11467,7 +11562,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
   const settingsPath = getSettingsPath(scope);
   const issues = [];
   const healthy = [];
-  const settingsExist = existsSync12(settingsPath);
+  const settingsExist = existsSync13(settingsPath);
   if (!settingsExist) {
     issues.push({ hook: "(settings)", issue: `${settingsPath} not found`, severity: "warning" });
   }
@@ -11484,7 +11579,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
     const meta = custom ? resolveHookMeta(name) : getHook(name);
     let hookHealthy = true;
     if (custom) {
-      if (!existsSync12(custom.scriptPath)) {
+      if (!existsSync13(custom.scriptPath)) {
         issues.push({ hook: name, issue: `Custom hook script missing: ${custom.scriptPath}`, severity: "error" });
         hookHealthy = false;
       }
@@ -11496,7 +11591,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
       }
       const hookDir = getHookPath(name);
       const hookScript = join12(hookDir, "src", "hook.ts");
-      if (!existsSync12(hookScript)) {
+      if (!existsSync13(hookScript)) {
         issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
         hookHealthy = false;
       }
@@ -11672,7 +11767,7 @@ program2.command("docs").argument("[hook]", "Hook name (shows general docs if om
     const hookPath = getHookPath(hook);
     const readmePath = join12(hookPath, "README.md");
     let readme = "";
-    if (existsSync12(readmePath)) {
+    if (existsSync13(readmePath)) {
       readme = readFileSync10(readmePath, "utf-8");
     }
     if (options.json) {

package/bin/serve.js

@@ -527,7 +527,7 @@ function getHook(name) {
 import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "fs";
 import { basename, dirname, isAbsolute, join as join2, normalize, resolve, sep } from "path";
 
-// node_modules/zod/v3/external.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
   void: () => voidType,
@@ -639,7 +639,7 @@ __export(exports_external, {
   BRAND: () => BRAND
 });
 
-// node_modules/zod/v3/helpers/util.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
   util2.assertEqual = (_) => {};
@@ -770,7 +770,7 @@ var getParsedType = (data) => {
   }
 };
 
-// node_modules/zod/v3/ZodError.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode = util.arrayToEnum([
   "invalid_type",
   "invalid_literal",
@@ -889,7 +889,7 @@ ZodError.create = (issues) => {
   return error;
 };
 
-// node_modules/zod/v3/locales/en.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -992,7 +992,7 @@ var errorMap = (issue, _ctx) => {
 };
 var en_default = errorMap;
 
-// node_modules/zod/v3/errors.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
 var overrideErrorMap = en_default;
 function setErrorMap(map) {
   overrideErrorMap = map;
@@ -1000,7 +1000,7 @@ function setErrorMap(map) {
 function getErrorMap() {
   return overrideErrorMap;
 }
-// node_modules/zod/v3/helpers/parseUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
   const { data, path, errorMaps, issueData } = params;
   const fullPath = [...path, ...issueData.path || []];
@@ -1106,14 +1106,14 @@ var isAborted = (x) => x.status === "aborted";
 var isDirty = (x) => x.status === "dirty";
 var isValid = (x) => x.status === "valid";
 var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
-// node_modules/zod/v3/helpers/errorUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
   errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
   errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
 })(errorUtil || (errorUtil = {}));
 
-// node_modules/zod/v3/types.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
 class ParseInputLazyPath {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -4523,7 +4523,9 @@ function resolveApiKey() {
 }
 
 // src/lib/semver.ts
-var SEMVER_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/;
+var NUMERIC_ID = "(0|[1-9]\\d{0,15})";
+var ALNUM_ID = "\\d*[A-Za-z-][0-9A-Za-z-]*";
+var SEMVER_PATTERN = new RegExp(`^${NUMERIC_ID}\\.${NUMERIC_ID}\\.${NUMERIC_ID}` + `(?:-(?:${NUMERIC_ID}|${ALNUM_ID})(?:\\.(?:${NUMERIC_ID}|${ALNUM_ID}))*)?` + `(?:\\+[0-9A-Za-z.-]+)?$`);
 
 // src/lib/manifest.ts
 var HOOK_NAME_RE = /^[\w-]+$/;
@@ -4535,7 +4537,8 @@ var manifestSchema = exports_external.object({
   script: exports_external.string().min(1, "script must name a relative path or inline content"),
   script_kind: exports_external.enum(["inline", "file"]).optional(),
   args: exports_external.array(exports_external.string()).optional(),
-  timeout_ms: exports_external.number().int().positive().optional()
+  timeout_ms: exports_external.number().int().positive().optional(),
+  env: exports_external.record(exports_external.string(), exports_external.string()).optional()
 });
 function parseManifest(json) {
   const parsed = JSON.parse(json);

package/dist/index.js

@@ -453,7 +453,7 @@ var init_redact = __esm(() => {
   ];
 });
 
-// node_modules/zod/v3/helpers/util.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType = (data) => {
   const t = typeof data;
   switch (t) {
@@ -584,7 +584,7 @@ var init_util = __esm(() => {
   ]);
 });
 
-// node_modules/zod/v3/ZodError.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode, quotelessJson = (obj) => {
   const json = JSON.stringify(obj, null, 2);
   return json.replace(/"([^"]+)":/g, "$1:");
@@ -705,7 +705,7 @@ var init_ZodError = __esm(() => {
   };
 });
 
-// node_modules/zod/v3/locales/en.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -812,7 +812,7 @@ var init_en = __esm(() => {
   en_default = errorMap;
 });
 
-// node_modules/zod/v3/errors.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
 function setErrorMap(map) {
   overrideErrorMap = map;
 }
@@ -825,7 +825,7 @@ var init_errors = __esm(() => {
   overrideErrorMap = en_default;
 });
 
-// node_modules/zod/v3/helpers/parseUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 function addIssueToContext(ctx, issueData) {
   const overrideMap = getErrorMap();
   const issue = makeIssue({
@@ -930,10 +930,10 @@ var init_parseUtil = __esm(() => {
   });
 });
 
-// node_modules/zod/v3/helpers/typeAliases.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/typeAliases.js
 var init_typeAliases = () => {};
 
-// node_modules/zod/v3/helpers/errorUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 var init_errorUtil = __esm(() => {
   (function(errorUtil2) {
@@ -942,7 +942,7 @@ var init_errorUtil = __esm(() => {
   })(errorUtil || (errorUtil = {}));
 });
 
-// node_modules/zod/v3/types.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
 class ParseInputLazyPath {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -4293,7 +4293,7 @@ var init_types = __esm(() => {
   NEVER = INVALID;
 });
 
-// node_modules/zod/v3/external.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
   void: () => voidType,
@@ -4413,7 +4413,7 @@ var init_external = __esm(() => {
   init_ZodError();
 });
 
-// node_modules/zod/index.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/index.js
 var init_zod = __esm(() => {
   init_external();
   init_external();
@@ -4474,9 +4474,9 @@ function resolveApiKey() {
 var init_config = () => {};
 
 // src/lib/semver.ts
-var SEMVER_PATTERN;
+var NUMERIC_ID = "(0|[1-9]\\d{0,15})", ALNUM_ID = "\\d*[A-Za-z-][0-9A-Za-z-]*", SEMVER_PATTERN;
 var init_semver = __esm(() => {
-  SEMVER_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/;
+  SEMVER_PATTERN = new RegExp(`^${NUMERIC_ID}\\.${NUMERIC_ID}\\.${NUMERIC_ID}` + `(?:-(?:${NUMERIC_ID}|${ALNUM_ID})(?:\\.(?:${NUMERIC_ID}|${ALNUM_ID}))*)?` + `(?:\\+[0-9A-Za-z.-]+)?$`);
 });
 
 // src/lib/manifest.ts
@@ -4638,7 +4638,8 @@ var init_manifest = __esm(() => {
     script: exports_external.string().min(1, "script must name a relative path or inline content"),
     script_kind: exports_external.enum(["inline", "file"]).optional(),
     args: exports_external.array(exports_external.string()).optional(),
-    timeout_ms: exports_external.number().int().positive().optional()
+    timeout_ms: exports_external.number().int().positive().optional(),
+    env: exports_external.record(exports_external.string(), exports_external.string()).optional()
   });
   ScriptContainmentError = class ScriptContainmentError extends Error {
     constructor(path, hookDir, raw) {
@@ -5001,6 +5002,8 @@ var init_profiles = __esm(() => {
 });
 
 // src/lib/hook-env.ts
+import { dirname as dirname4, isAbsolute as isAbsolute2 } from "path";
+import { existsSync as existsSync10, statSync } from "fs";
 function isDeniedEnvName(name) {
   const upper = name.toUpperCase();
   if (DENY_PREFIXES.some((prefix) => upper.startsWith(prefix)))
@@ -5009,13 +5012,74 @@ function isDeniedEnvName(name) {
     return true;
   return DENY_CONTAINS.some((token) => upper.includes(token));
 }
+function isInterpreterInjectionEnvName(name) {
+  if (INTERPRETER_INJECTION.has(name))
+    return true;
+  return INTERPRETER_INJECTION_PREFIXES.some((prefix) => name.startsWith(prefix));
+}
+function isBashFunctionEnvName(name) {
+  return name.startsWith("BASH_FUNC_");
+}
+function isUnsafePathEntry(entry, home) {
+  if (entry === "" || !isAbsolute2(entry))
+    return true;
+  if (home && (entry === home || entry.startsWith(home + "/")))
+    return true;
+  if (entry === "/tmp" || entry.startsWith("/tmp/"))
+    return true;
+  if (entry === "/var/tmp" || entry.startsWith("/var/tmp/"))
+    return true;
+  try {
+    if ((statSync(entry).mode & 2) !== 0)
+      return true;
+  } catch {}
+  return false;
+}
+function sanitizeHookPath(pathValue, home) {
+  const baseline = PATH_BASELINE.slice();
+  if (process.platform === "darwin" && existsSync10("/opt/homebrew/bin"))
+    baseline.push("/opt/homebrew/bin");
+  const bunDir = dirname4(process.execPath);
+  const seen = new Set;
+  const out = [];
+  for (const dir of baseline) {
+    if (seen.has(dir))
+      continue;
+    seen.add(dir);
+    out.push(dir);
+  }
+  if (!seen.has(bunDir)) {
+    seen.add(bunDir);
+    out.push(bunDir);
+  }
+  for (const entry of pathValue.split(":")) {
+    if (seen.has(entry))
+      continue;
+    if (isUnsafePathEntry(entry, home))
+      continue;
+    seen.add(entry);
+    out.push(entry);
+  }
+  return out.join(":");
+}
 function buildHookEnv(source, extra) {
   const out = {};
   for (const name of ALLOWLIST) {
+    if (name === "PATH")
+      continue;
     const value = source[name] ?? extra?.[name];
     if (value !== undefined && value !== null)
       out[name] = value;
   }
+  const pathOverride = extra?.PATH;
+  if (pathOverride !== undefined && pathOverride !== null) {
+    out.PATH = pathOverride;
+  } else {
+    const parentPath = source.PATH;
+    if (parentPath !== undefined && parentPath !== null) {
+      out.PATH = sanitizeHookPath(parentPath, source.HOME ?? extra?.HOME);
+    }
+  }
   for (const [from, to] of CONFIG_PROJECTIONS) {
     const value = source[from] ?? extra?.[from];
     if (value !== undefined && value !== null)
@@ -5027,14 +5091,44 @@ function buildHookEnv(source, extra) {
       continue;
     if (isDeniedEnvName(name))
       continue;
+    if (isInterpreterInjectionEnvName(name))
+      continue;
+    if (isBashFunctionEnvName(name))
+      continue;
     if (value !== undefined && value !== null)
       out[name] = value;
   }
   return out;
 }
-var ALLOWLIST, DENY_SUFFIXES, DENY_PREFIXES, DENY_CONTAINS, CONFIG_PROJECTIONS;
+var ALLOWLIST, INTERPRETER_INJECTION, INTERPRETER_INJECTION_PREFIXES, DENY_SUFFIXES, DENY_PREFIXES, DENY_CONTAINS, PATH_BASELINE, CONFIG_PROJECTIONS;
 var init_hook_env = __esm(() => {
   ALLOWLIST = new Set(["PATH", "HOME", "LANG", "TZ", "SHELL", "TERM", "USER", "PWD"]);
+  INTERPRETER_INJECTION = new Set([
+    "BASH_ENV",
+    "ENV",
+    "BASHOPTS",
+    "SHELLOPTS",
+    "NODE_OPTIONS",
+    "NODE_PATH",
+    "PYTHONSTARTUP",
+    "PYTHONINSPECT",
+    "PYTHONPATH",
+    "PYTHONHOME",
+    "LD_PRELOAD",
+    "LD_LIBRARY_PATH",
+    "GCONV_PATH",
+    "LOCPATH",
+    "PERL5OPT",
+    "RUBYOPT",
+    "NODE_EXTRA_CA_CERTS",
+    "NODE_TLS_REJECT_UNAUTHORIZED",
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
+    "CURL_CA_BUNDLE",
+    "GIT_SSL_CAINFO",
+    "AWS_CA_BUNDLE"
+  ]);
+  INTERPRETER_INJECTION_PREFIXES = ["GIT_CONFIG_"];
   DENY_SUFFIXES = ["KEY", "TOKEN", "SECRET", "PASSWORD", "PASSWD", "CREDENTIAL", "CREDENTIALS", "URL", "URI"];
   DENY_PREFIXES = [
     "HASNA_",
@@ -5052,6 +5146,7 @@ var init_hook_env = __esm(() => {
     "MEMENTOS_"
   ];
   DENY_CONTAINS = ["DATABASE_URL"];
+  PATH_BASELINE = ["/usr/bin", "/bin", "/usr/local/bin", "/sbin", "/usr/sbin"];
   CONFIG_PROJECTIONS = [
     ["HASNA_HOOKS_DATA_DIR", "HOOKS_DATA_DIR"],
     ["HASNA_HOOKS_DB_PATH", "HOOKS_DB_PATH"],
@@ -5068,7 +5163,7 @@ __export(exports_run, {
 });
 import { randomBytes as randomBytes2 } from "crypto";
 import { rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute2, join as join9 } from "path";
+import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute3, join as join9 } from "path";
 function extensionOf(scriptPath) {
   const base = basename2(scriptPath);
   const dot = base.lastIndexOf(".");
@@ -5095,13 +5190,13 @@ function interpreterFor(name, scriptPath, content) {
     if (interp === "bash" || interp === "sh")
       return { command: ["/bin/bash"], tempExt: "sh" };
     if (interp === "node" || interp === "bun")
-      return { command: ["bun", "run"], tempExt: BUN_EXTENSIONS.has(ext) ? ext : "ts" };
+      return { command: [process.execPath, "run"], tempExt: BUN_EXTENSIONS.has(ext) ? ext : "ts" };
     throw new Error(`Refusing to run hook '${name}': shebang '${firstLine}' is not a recognized interpreter (supported: bash/sh, node/bun)`);
   }
   if (BASH_EXTENSIONS.has(ext))
     return { command: ["/bin/bash"], tempExt: "sh" };
   if (BUN_EXTENSIONS.has(ext))
-    return { command: ["bun", "run"], tempExt: ext };
+    return { command: [process.execPath, "run"], tempExt: ext };
   throw new Error(`Refusing to run hook '${name}': unsupported script extension '.${ext}' (supported: .sh .bash .ts .tsx .js .jsx .mjs .cjs .mts .cts, or a recognized shebang)`);
 }
 async function readPipeWithDeadline(stream, deadlineMs) {
@@ -5137,7 +5232,7 @@ async function readPipeWithDeadline(stream, deadlineMs) {
   return chunks.join("");
 }
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname4(options.scriptPath);
+  const scriptDir = dirname5(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
   const tempPath = join9(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
@@ -5148,7 +5243,7 @@ async function executeVerifiedScript(options) {
   }, options.timeout) : null;
   try {
     writeFileSync6(tempPath, options.content, { flag: "wx", mode: 384 });
-    proc = Bun.spawn([...interpreter.command, isAbsolute2(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
+    proc = Bun.spawn([...interpreter.command, isAbsolute3(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
       stdin: new Response(options.stdin),
       stdout: "pipe",
       stderr: "pipe",
@@ -6964,7 +7059,7 @@ init_profiles();
 init_config();
 init_store();
 init_manifest();
-import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
 
 // src/lib/custom-install.ts
 init_config();
@@ -7594,7 +7689,7 @@ async function runHook(name, input, options = {}) {
     throw new Error(`Hook '${name}' not found`);
   const hookScript = getHookPath(name) + "/src/hook.ts";
   const resolvedScript = custom2?.scriptPath;
-  const script = resolvedScript ?? (existsSync10(hookScript) ? hookScript : undefined);
+  const script = resolvedScript ?? (existsSync11(hookScript) ? hookScript : undefined);
   if (!script)
     throw new Error(`Hook script not found: ${name}`);
   const { sha256Of: sha256Of2, checkScriptHash: checkScriptHash2 } = await Promise.resolve().then(() => (init_store(), exports_store));
@@ -7629,6 +7724,7 @@ async function runHook(name, input, options = {}) {
       scriptPath: script,
       content,
       args: custom2?.manifest.args ?? [],
+      env: custom2?.manifest.env,
       stdin: JSON.stringify(hookInput),
       timeout: effectiveTimeout ?? undefined
     }));

package/dist/lib/hook-env.d.ts

@@ -6,8 +6,10 @@
  * parent's process.env wholesale hands every credential the agent can reach
  * to arbitrary code. The child gets:
  *
- *   1. a fixed allowlist of non-secret session variables (PATH, HOME, LANG,
- *      TZ, SHELL, TERM, USER, PWD);
+ *   1. a fixed allowlist of non-secret session variables (HOME, LANG, TZ,
+ *      SHELL, TERM, USER, PWD) plus PATH — PATH rebuilt from a trusted
+ *      baseline with writable-directory entries removed (or a per-hook
+ *      manifest env.PATH override, verbatim);
  *   2. non-secret HOOKS_* projections of the parent's HASNA_HOOKS_* config
  *      (data dir, DB path, lock path, config path) so in-process DB/config
  *      resolution inside the hook still finds the store the parent configured;
@@ -24,6 +26,20 @@
  *            ANTHROPIC_, POSTGRES_, MYSQL_, REDIS_, MONGO_, MEMENTOS_
  *   contains: DATABASE_URL (any variant)
  *
+ * The deny list alone is NOT the whole boundary (bug cf99cf76): it strips
+ * credential-shaped NAMES from the parent env, but a credential can be
+ * re-imported from a FILE through interpreter machinery. BASH_ENV tells bash
+ * to source a file before running any non-interactive script, and ENV does
+ * the same for interactive shells — a parent whose BASH_ENV points at e.g.
+ * hasna-cloud-env.sh hands the hook child a process that re-exports the
+ * fleet credential env AFTER the deny list ran. The interpreter-injection
+ * set below strips every variable that makes a child interpreter run or
+ * source code the hook did not ask for (sourcing vectors, interpreter option
+ * lists, module/startup injection, dynamic-loader preloads, TLS-trust
+ * redirection, gconv/locale module injection). Exact case-sensitive names:
+ * POSIX interpreters read these literals, and a differently-cased variant is
+ * an inert, unrelated variable.
+ *
  * Names that merely resemble credentials (e.g. HOOKS_DATA_DIR) survive; a
  * path is not a credential.
  */
@@ -32,11 +48,51 @@
  * hook child process. Case-insensitive.
  */
 export declare function isDeniedEnvName(name: string): boolean;
+/**
+ * True when a variable NAME is interpreter-injection (bug cf99cf76): it can
+ * make a child interpreter run or source code the hook did not ask for.
+ * Exact case-sensitive match — interpreters read these literals verbatim.
+ */
+export declare function isInterpreterInjectionEnvName(name: string): boolean;
+/**
+ * True when a variable NAME is a bash exported-function entry
+ * (BASH_FUNC_<name>%%): bash imports EXPORTED FUNCTIONS from the environment
+ * into the child shell, where they shadow commands (env/cat/git/node) and
+ * run attacker code on the hook's first command. The %% suffix is bash's
+ * export encoding; the prefix test covers every form (%% , single %, none).
+ *
+ * Aliases are deliberately NOT denied: bash cannot import aliases from the
+ * environment (BASH_ALIASES is an associative array and is never exported) —
+ * functions are the only env-importable code vector for bash, so the strip
+ * is precisely the BASH_FUNC_* prefix.
+ */
+export declare function isBashFunctionEnvName(name: string): boolean;
+/**
+ * True when a PATH entry may hold attacker-controlled executables: an empty
+ * or relative entry (resolves against the child's cwd), an entry under the
+ * user's home, an entry under a shared tmp tree, or a world-writable
+ * directory (any user can drop a fake binary there).
+ */
+export declare function isUnsafePathEntry(entry: string, home: string | undefined): boolean;
+/**
+ * Rebuild a PATH for the hook child from a trusted baseline: the system
+ * directories (plus /opt/homebrew/bin on macOS when present) and the
+ * runner's own bun directory (the interpreter the hook runs under, trusted
+ * by definition even when it lives under $HOME). Parent entries are kept
+ * only when they do not live under $HOME, /tmp, /var/tmp, or a world-writable
+ * path — a fake `node`/`git` planted in a writable directory must never
+ * execute on the hook's first command. An explicit per-hook env.PATH
+ * (manifest) override bypasses this entirely: the hook author declares the
+ * complete PATH it needs.
+ */
+export declare function sanitizeHookPath(pathValue: string, home: string | undefined): string;
 /**
  * Build the sanitized environment for a hook child process.
  *
  * `source` is the parent's environment; `extra` is any caller-supplied env
- * the hook may need. The deny list applies to BOTH — a caller cannot
- * reintroduce a credential-bearing name.
+ * the hook may need. The deny list AND the interpreter-injection set apply
+ * to BOTH — a caller cannot reintroduce a credential-bearing name, and
+ * cannot reintroduce a variable that would make the child's interpreter
+ * source or run code (bug cf99cf76).
  */
 export declare function buildHookEnv(source: Record<string, string | undefined>, extra?: Record<string, string | undefined>): Record<string, string>;

package/dist/lib/manifest.d.ts

@@ -18,11 +18,21 @@ export declare const manifestSchema: z.ZodObject<{
     script_kind: z.ZodOptional<z.ZodEnum<["inline", "file"]>>;
     args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     timeout_ms: z.ZodOptional<z.ZodNumber>;
+    /**
+     * Per-hook environment passed to the hook child (reviewer efcad315).
+     * Every name is still filtered through the credential deny list and the
+     * interpreter-injection strip; `env.PATH` here is the documented way to
+     * override the sanitized default PATH — it is passed verbatim, bypassing
+     * PATH sanitization (the hook author declares the complete PATH the hook
+     * needs).
+     */
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, "strip", z.ZodTypeAny, {
     version: string;
     events: string[];
     name: string;
     script: string;
+    env?: Record<string, string> | undefined;
     description?: string | undefined;
     script_kind?: "inline" | "file" | undefined;
     args?: string[] | undefined;
@@ -32,6 +42,7 @@ export declare const manifestSchema: z.ZodObject<{
     events: string[];
     name: string;
     script: string;
+    env?: Record<string, string> | undefined;
     description?: string | undefined;
     script_kind?: "inline" | "file" | undefined;
     args?: string[] | undefined;

package/dist/lib/semver.d.ts

@@ -7,6 +7,13 @@
  * while the artifact routes demanded a bare `\d+\.\d+\.\d+` at the end of
  * the path, so a pinned prerelease install 404'd. This is the one pattern:
  * full semver with optional prerelease and build metadata.
+ *
+ * Numeric identifiers are STRICT (reviewer efcad315): per semver.org §2,
+ * numeric identifiers MUST NOT carry leading zeroes ("1.0.0-01" is not
+ * "1.0.0-1" — it is not semver at all), and identifiers longer than 16
+ * digits are rejected as invalid so no surface can ever store a version the
+ * comparator cannot order exactly (Number() precision ends at
+ * MAX_SAFE_INTEGER; the comparator itself uses BigInt, see compareVersions).
  */
 export declare const SEMVER_PATTERN: RegExp;
 /**
@@ -17,3 +24,23 @@ export declare const SEMVER_PATTERN: RegExp;
 export declare const SEMVER_PATH_SEGMENT = "[0-9A-Za-z.+_-]+";
 export declare function isValidSemver(value: string): boolean;
 export declare function semverError(value: string): string;
+/**
+ * Full semver precedence (semver.org §11), shared by every surface that
+ * must ORDER published versions — the registry latest pointer (bug
+ * 6e412e52) compares with this and nothing else.
+ *
+ * Returns <0 when a sorts before b, 0 when equal, >0 when a sorts after b.
+ * Build metadata never participates. Prerelease identifiers compare by the
+ * spec's rules: numeric identifiers numerically, numeric before alphanumeric,
+ * fewer identifiers before more, release before any prerelease.
+ *
+ * Numeric identifiers compare as BigInt (reviewer efcad315): Number()
+ * loses precision past MAX_SAFE_INTEGER, which made near-16-digit numeric
+ * identifiers compare equal and made "1.0.0-01" vs "1.0.0-1" compare >0 in
+ * BOTH directions (Number("01") === Number("1") while the strings differ).
+ * BigInt keeps the comparison exact and antisymmetric at any length; the
+ * validation pattern rejects leading-zero and >16-digit identifiers as
+ * invalid, and this comparator stays correct even if an old invalid value
+ * ever reaches it.
+ */
+export declare function compareVersions(a: string, b: string): number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/hooks",
-  "version": "0.6.6",
+  "version": "0.6.8",
   "description": "Open source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command",
   "type": "module",
   "bin": {