@hasna/hooks 0.6.6 → 0.7.0

package/bin/index.js

@@ -20,12 +20,14 @@ var __toESM = (mod, isNodeMode, target) => {
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
-        enumerable: true
-      });
+  if (mod && typeof mod === "object" || typeof mod === "function") {
+    for (let key of __getOwnPropNames(mod))
+      if (!__hasOwnProp.call(to, key))
+        __defProp(to, key, {
+          get: __accessProp.bind(mod, key),
+          enumerable: true
+        });
+  }
   if (canCache)
     cache.set(mod, to);
   return to;
@@ -47,8 +49,8 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
-// node_modules/commander/lib/error.js
-var require_error = __commonJS((exports) => {
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/error.js
+var require_error = __commonJS(function(exports) {
   class CommanderError extends Error {
     constructor(exitCode, code, message) {
       super(message);
@@ -71,8 +73,8 @@ var require_error = __commonJS((exports) => {
   exports.InvalidArgumentError = InvalidArgumentError;
 });
 
-// node_modules/commander/lib/argument.js
-var require_argument = __commonJS((exports) => {
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/argument.js
+var require_argument = __commonJS(function(exports) {
   var { InvalidArgumentError } = require_error();
 
   class Argument {
@@ -150,8 +152,8 @@ var require_argument = __commonJS((exports) => {
   exports.humanReadableArgName = humanReadableArgName;
 });
 
-// node_modules/commander/lib/help.js
-var require_help = __commonJS((exports) => {
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/help.js
+var require_help = __commonJS(function(exports) {
   var { humanReadableArgName } = require_argument();
 
   class Help {
@@ -399,8 +401,8 @@ var require_help = __commonJS((exports) => {
   exports.Help = Help;
 });
 
-// node_modules/commander/lib/option.js
-var require_option = __commonJS((exports) => {
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/option.js
+var require_option = __commonJS(function(exports) {
   var { InvalidArgumentError } = require_error();
 
   class Option {
@@ -550,8 +552,8 @@ var require_option = __commonJS((exports) => {
   exports.DualOptions = DualOptions;
 });
 
-// node_modules/commander/lib/suggestSimilar.js
-var require_suggestSimilar = __commonJS((exports) => {
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/suggestSimilar.js
+var require_suggestSimilar = __commonJS(function(exports) {
   var maxDistance = 3;
   function editDistance(a, b) {
     if (Math.abs(a.length - b.length) > maxDistance)
@@ -623,8 +625,8 @@ var require_suggestSimilar = __commonJS((exports) => {
   exports.suggestSimilar = suggestSimilar;
 });
 
-// node_modules/commander/lib/command.js
-var require_command = __commonJS((exports) => {
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/command.js
+var require_command = __commonJS(function(exports) {
   var EventEmitter = __require("events").EventEmitter;
   var childProcess = __require("child_process");
   var path = __require("path");
@@ -1866,8 +1868,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
   exports.Command = Command;
 });
 
-// node_modules/commander/index.js
-var require_commander = __commonJS((exports) => {
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/index.js
+var require_commander = __commonJS(function(exports) {
   var { Argument } = require_argument();
   var { Command } = require_command();
   var { CommanderError, InvalidArgumentError } = require_error();
@@ -2266,6 +2268,16 @@ var init_registry = __esm(() => {
       matcher: "",
       tags: ["errors", "failures", "logging", "debugging"]
     },
+    {
+      name: "spiral-detector",
+      displayName: "Spiral Detector",
+      description: "Interrupts sessions after five consecutive identical command failures",
+      version: "0.1.0",
+      category: "Observability",
+      event: "PostToolUse",
+      matcher: "",
+      tags: ["spiral", "failures", "retries", "safety", "interrupt"]
+    },
     {
       name: "stylescheck",
       displayName: "Styles Check",
@@ -2419,8 +2431,8 @@ var init_registry = __esm(() => {
   ];
 });
 
-// node_modules/cli-spinners/spinners.json
-var require_spinners = __commonJS((exports, module) => {
+// ../../node_modules/.bun/cli-spinners@2.9.2/node_modules/cli-spinners/spinners.json
+var require_spinners = __commonJS(function(exports, module) {
   module.exports = {
     dots: {
       interval: 80,
@@ -4045,8 +4057,8 @@ var require_spinners = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/cli-spinners/index.js
-var require_cli_spinners = __commonJS((exports, module) => {
+// ../../node_modules/.bun/cli-spinners@2.9.2/node_modules/cli-spinners/index.js
+var require_cli_spinners = __commonJS(function(exports, module) {
   var spinners = Object.assign({}, require_spinners());
   var spinnersList = Object.keys(spinners);
   Object.defineProperty(spinners, "random", {
@@ -4059,55 +4071,329 @@ var require_cli_spinners = __commonJS((exports, module) => {
   module.exports = spinners;
 });
 
+// ../contracts/dist/client/transport.js
+import { readFileSync, statSync } from "fs";
+import { join as join2 } from "path";
+function envToken(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function clientTransportEnvKeys(name) {
+  const envSegment = envToken(name);
+  return {
+    apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
+    apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
+  };
+}
+function credentialOverrideEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
+}
+function homeDir(env) {
+  const home = env.HOME?.trim();
+  return home ? home : null;
+}
+function credentialDiskSources(name, env) {
+  return profileDiskSources(name, env, null);
+}
+function profileDiskSources(name, env, profile) {
+  const home = homeDir(env);
+  if (!home || !SAFE_APP_SLUG.test(name))
+    return [];
+  const stem = profile ? `${name}.${profile}` : name;
+  const configStem = profile ? `${name}-${profile}` : name;
+  return [
+    join2(home, HASNA_STATE_DIR, FLEET_CREDENTIAL_DIR, `${stem}.env`),
+    join2(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}-cloud.env`)
+  ];
+}
+function parseEnvFile(text) {
+  const values = new Map;
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#"))
+      continue;
+    const withoutExport = line.startsWith("export ") ? line.slice("export ".length).trim() : line;
+    const equals = withoutExport.indexOf("=");
+    if (equals <= 0)
+      continue;
+    const key = withoutExport.slice(0, equals).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+      continue;
+    let value = withoutExport.slice(equals + 1).trim();
+    const quote = value[0];
+    if (quote === '"' || quote === "'") {
+      if (value.length < 2 || !value.endsWith(quote))
+        continue;
+      value = value.slice(1, -1);
+    }
+    if (value.length === 0)
+      continue;
+    values.set(key, value);
+  }
+  return values;
+}
+function readAppConfigFile(path) {
+  let text;
+  try {
+    const stats = statSync(path);
+    if (!stats.isFile() || stats.size > MAX_CREDENTIAL_FILE_BYTES)
+      return null;
+    text = readFileSync(path, "utf8");
+  } catch {
+    return null;
+  }
+  return parseEnvFile(text);
+}
+function readCredentialFile(path, apiKeyKeys) {
+  const values = readAppConfigFile(path);
+  if (!values)
+    return null;
+  for (const key of apiKeyKeys) {
+    const value = values.get(key)?.trim();
+    if (value)
+      return value;
+  }
+  return null;
+}
+function assertUsableCredential(appName, source, value) {
+  if (!ILLEGAL_IN_HEADER_VALUE.test(value))
+    return;
+  throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
+}
+function sealCredential(fields) {
+  const { apiKey } = fields;
+  const visible = {
+    tier: fields.tier,
+    source: fields.source,
+    deliberate: fields.deliberate,
+    deprecated: fields.deprecated,
+    diskCandidates: Object.freeze([...fields.diskCandidates]),
+    warning: fields.warning
+  };
+  const sealed = { ...visible };
+  Object.defineProperty(sealed, "apiKey", {
+    value: apiKey,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  Object.defineProperty(sealed, INSPECT_CUSTOM, {
+    value: () => ({ ...visible, apiKey: "[redacted]" }),
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  Object.defineProperty(sealed, CREDENTIAL_SEAL, {
+    value: true,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  return Object.freeze(sealed);
+}
+function firstEnvValue(env, keys) {
+  for (const key of keys) {
+    const value = env[key]?.trim();
+    if (value)
+      return { key, value };
+  }
+  return null;
+}
+function deprecationNotified() {
+  const host = globalThis;
+  const existing = host[DEPRECATION_REGISTRY];
+  if (existing instanceof Set)
+    return existing;
+  const created = new Set;
+  host[DEPRECATION_REGISTRY] = created;
+  return created;
+}
+function defaultDeprecationSink(message) {
+  if (typeof process !== "undefined" && process.stderr) {
+    process.stderr.write(`${message}
+`);
+  }
+}
+function resolveCredential(name, env, options = {}) {
+  const { apiKeyKeys } = clientTransportEnvKeys(name);
+  const diskPaths = credentialDiskSources(name, env);
+  const explicitKey = options.apiKey?.trim();
+  if (explicitKey) {
+    assertUsableCredential(name, "the explicit apiKey argument", explicitKey);
+    return sealCredential({
+      apiKey: explicitKey,
+      tier: "argument",
+      source: "explicit apiKey argument",
+      deliberate: true,
+      deprecated: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const overrideKeyName = credentialOverrideEnvKey(name);
+  const overrideRaw = env[overrideKeyName];
+  if (overrideRaw !== undefined) {
+    const override = overrideRaw.trim();
+    if (!override) {
+      throw new CredentialResolutionError(name, `${overrideKeyName} is set but empty. It is a deliberate override, so it is not resolved around: ` + `either give it a real key or unset it to fall back to the credential on disk.`, [overrideKeyName]);
+    }
+    assertUsableCredential(name, overrideKeyName, override);
+    return sealCredential({
+      apiKey: override,
+      tier: "override",
+      source: overrideKeyName,
+      deliberate: true,
+      deprecated: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const profile = options.profile?.trim() || env[CREDENTIAL_PROFILE_ENV_KEY]?.trim();
+  if (profile) {
+    const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
+    if (!SAFE_PROFILE.test(profile)) {
+      throw new CredentialResolutionError(name, `Profile name from ${profileSource} is not usable in a path. ` + `Use letters, digits, dot, dash, or underscore.`, [profileSource]);
+    }
+    const paths = profileDiskSources(name, env, profile);
+    for (const path of paths) {
+      const value = readCredentialFile(path, apiKeyKeys);
+      if (value) {
+        assertUsableCredential(name, path, value);
+        return sealCredential({
+          apiKey: value,
+          tier: "profile",
+          source: path,
+          deliberate: true,
+          deprecated: false,
+          diskCandidates: paths,
+          warning: null
+        });
+      }
+    }
+    throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
+  }
+  const diskHits = diskPaths.map((path) => ({ path, value: readCredentialFile(path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  if (diskHits.length > 0) {
+    const winner = diskHits[0];
+    assertUsableCredential(name, winner.path, winner.value);
+    const divergentSources = [
+      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.path),
+      ...(() => {
+        const legacyHit = firstEnvValue(env, apiKeyKeys);
+        return legacyHit && legacyHit.value !== winner.value ? [legacyHit.key] : [];
+      })()
+    ];
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential({
+      apiKey: winner.value,
+      tier: "disk",
+      source: winner.path,
+      deliberate: false,
+      deprecated: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  const legacy = firstEnvValue(env, apiKeyKeys);
+  if (legacy) {
+    assertUsableCredential(name, legacy.key, legacy.value);
+    const where = diskPaths.length > 0 ? `Put the current key in ${diskPaths[0]} \u2014 it is re-read on every call, so rotations take effect immediately.` : `This environment has no HOME, so no credential file could be consulted at all; the disk tier is ` + `unavailable here and this process will keep using the environment snapshot.`;
+    const message = `[${name}] DEPRECATED: the API key came from ${legacy.key} in this process's environment. ` + `Environment variables are a snapshot taken when this process started, so a shell that started ` + `before a key rotation keeps using the old key until it exits. ${where}`;
+    const sink = options.onDeprecation ?? defaultDeprecationSink;
+    const notified = deprecationNotified();
+    if (!notified.has(name)) {
+      notified.add(name);
+      sink(message);
+    }
+    return sealCredential({
+      apiKey: legacy.value,
+      tier: "legacy-env",
+      source: legacy.key,
+      deliberate: false,
+      deprecated: true,
+      diskCandidates: diskPaths,
+      warning: message
+    });
+  }
+  return null;
+}
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, HASNA_STATE_DIR = ".hasna", FLEET_CREDENTIAL_DIR = "cloud", CONFIG_DIR = ".config", CONFIG_NAMESPACE = "hasna", MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, INSPECT_CUSTOM, CREDENTIAL_SEAL, DEPRECATION_REGISTRY, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS;
+var init_transport = __esm(() => {
+  CredentialResolutionError = class CredentialResolutionError extends Error {
+    appName;
+    attempted;
+    constructor(appName, message, attempted) {
+      super(message);
+      this.name = "CredentialResolutionError";
+      this.appName = appName;
+      this.attempted = attempted;
+    }
+  };
+  MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
+  SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+  SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+  ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
+  INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+  CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
+  DEPRECATION_REGISTRY = Symbol.for("hasna:contracts:credentialDeprecationNotices");
+  IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+  AUTHORITY_OVERRIDE_HEADERS = new Set([
+    "host",
+    ":authority",
+    "forwarded",
+    "x-forwarded-host",
+    "x-original-host"
+  ]);
+});
+
 // src/config.ts
 var exports_config = {};
 __export(exports_config, {
-  writeConfig: () => writeConfig,
-  resolveApiUrl: () => resolveApiUrl,
-  resolveApiKey: () => resolveApiKey,
-  readConfig: () => readConfig,
-  getLockPath: () => getLockPath,
-  getHooksDataDir: () => getHooksDataDir,
+  getConfigPath: () => getConfigPath,
   getCustomHooksDir: () => getCustomHooksDir,
-  getConfigPath: () => getConfigPath
+  getHooksDataDir: () => getHooksDataDir,
+  getLockPath: () => getLockPath,
+  readConfig: () => readConfig,
+  resolveApiKey: () => resolveApiKey,
+  resolveApiUrl: () => resolveApiUrl,
+  writeConfig: () => writeConfig
 });
-import { existsSync as existsSync2, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { join as join3 } from "path";
 import { homedir as homedir2 } from "os";
 function getHooksDataDir() {
   const explicit = process.env.HASNA_HOOKS_DATA_DIR ?? process.env.HOOKS_DATA_DIR;
   if (explicit)
     return explicit;
-  return join2(homedir2(), ".hasna", "hooks");
+  return join3(homedir2(), ".hasna", "hooks");
 }
 function getCustomHooksDir() {
-  return join2(getHooksDataDir(), "hooks");
+  return join3(getHooksDataDir(), "hooks");
 }
 function getLockPath() {
   const explicit = process.env.HASNA_HOOKS_LOCK_PATH ?? process.env.HOOKS_LOCK_PATH;
   if (explicit)
     return explicit;
-  return join2(getHooksDataDir(), "hooks.lock");
+  return join3(getHooksDataDir(), "hooks.lock");
 }
 function getConfigPath() {
   const explicit = process.env.HASNA_HOOKS_CONFIG_PATH ?? process.env.HOOKS_CONFIG_PATH;
   if (explicit)
     return explicit;
-  return join2(getHooksDataDir(), "config.json");
+  return join3(getHooksDataDir(), "config.json");
 }
 function readConfig() {
   try {
     const path = getConfigPath();
     if (!existsSync2(path))
       return {};
-    return JSON.parse(readFileSync(path, "utf-8"));
+    return JSON.parse(readFileSync2(path, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeConfig(config) {
   const path = getConfigPath();
-  mkdirSync(join2(path, ".."), { recursive: true });
+  mkdirSync(join3(path, ".."), { recursive: true });
   writeFileSync(path, JSON.stringify(config, null, 2) + `
 `, "utf-8");
   return path;
@@ -4120,36 +4406,38 @@ function resolveApiUrl() {
   return cfg.api_url ? cfg.api_url.replace(/\/+$/, "") : undefined;
 }
 function resolveApiKey() {
-  return process.env.HASNA_HOOKS_API_KEY ?? process.env.HOOKS_API_KEY;
+  return resolveCredential("hooks", process.env)?.apiKey;
 }
-var init_config = () => {};
+var init_config = __esm(() => {
+  init_transport();
+});
 
 // src/lib/semver.ts
-var SEMVER_PATTERN;
+var NUMERIC_ID = "(0|[1-9]\\d{0,15})", ALNUM_ID = "\\d*[A-Za-z-][0-9A-Za-z-]*", SEMVER_PATTERN;
 var init_semver = __esm(() => {
-  SEMVER_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/;
+  SEMVER_PATTERN = new RegExp(`^${NUMERIC_ID}\\.${NUMERIC_ID}\\.${NUMERIC_ID}` + `(?:-(?:${NUMERIC_ID}|${ALNUM_ID})(?:\\.(?:${NUMERIC_ID}|${ALNUM_ID}))*)?` + `(?:\\+[0-9A-Za-z.-]+)?$`);
 });
 
 // src/lib/manifest.ts
 var exports_manifest = {};
 __export(exports_manifest, {
-  writeCustomHook: () => writeCustomHook,
-  shortManifestName: () => shortManifestName,
-  scriptRelFor: () => scriptRelFor,
-  resolveScript: () => resolveScript,
-  readCustomManifest: () => readCustomManifest,
-  parseManifest: () => parseManifest,
-  normalizeManifestName: () => normalizeManifestName,
-  manifestSchema: () => manifestSchema,
-  listCustomHooks: () => listCustomHooks,
-  isInlineScript: () => isInlineScript,
-  customHookDir: () => customHookDir,
-  assertContained: () => assertContained,
+  HOOK_NAME_RE: () => HOOK_NAME_RE,
   ScriptContainmentError: () => ScriptContainmentError,
-  HOOK_NAME_RE: () => HOOK_NAME_RE
+  assertContained: () => assertContained,
+  customHookDir: () => customHookDir,
+  isInlineScript: () => isInlineScript,
+  listCustomHooks: () => listCustomHooks,
+  manifestSchema: () => manifestSchema,
+  normalizeManifestName: () => normalizeManifestName,
+  parseManifest: () => parseManifest,
+  readCustomManifest: () => readCustomManifest,
+  resolveScript: () => resolveScript,
+  scriptRelFor: () => scriptRelFor,
+  shortManifestName: () => shortManifestName,
+  writeCustomHook: () => writeCustomHook
 });
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync, realpathSync, writeFileSync as writeFileSync2 } from "fs";
-import { basename, dirname, isAbsolute, join as join3, normalize, resolve, sep } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync, realpathSync, writeFileSync as writeFileSync2 } from "fs";
+import { basename, dirname, isAbsolute, join as join4, normalize, resolve, sep } from "path";
 import { z } from "zod";
 function parseManifest(json) {
   const parsed = JSON.parse(json);
@@ -4182,7 +4470,7 @@ function realpathNearest(path) {
     tail.unshift(basename(cur));
     cur = parent;
   }
-  return join3(realpathSync(cur), ...tail);
+  return join4(realpathSync(cur), ...tail);
 }
 function assertContainedReal(root, target, raw) {
   const rootReal = realpathSync(root);
@@ -4215,25 +4503,25 @@ function resolveScript(manifest, manifestDir) {
   if (isInlineScript(manifest))
     return { path: scriptRelFor(manifest), content: manifest.script };
   const rel = scriptRelFor(manifest);
-  const resolved = assertContained(join3(manifestDir, rel), manifestDir, manifest.script);
+  const resolved = assertContained(join4(manifestDir, rel), manifestDir, manifest.script);
   if (!existsSync3(resolved)) {
     throw new Error(`manifest script file not found: ${resolved}`);
   }
-  return { path: rel, content: readFileSync2(resolved, "utf-8") };
+  return { path: rel, content: readFileSync3(resolved, "utf-8") };
 }
 function customHookDir(name) {
-  return join3(getCustomHooksDir(), shortManifestName(name));
+  return join4(getCustomHooksDir(), shortManifestName(name));
 }
 function readCustomManifest(name) {
   const dir = customHookDir(name);
-  const manifestPath = join3(dir, "manifest.json");
+  const manifestPath = join4(dir, "manifest.json");
   if (!existsSync3(manifestPath))
     return;
   try {
-    const manifest = parseManifest(readFileSync2(manifestPath, "utf-8"));
+    const manifest = parseManifest(readFileSync3(manifestPath, "utf-8"));
     const script = resolveScript(manifest, dir);
     const scriptIsInline = isInlineScript(manifest);
-    return { manifest, scriptPath: join3(dir, script.path), scriptContent: script.content, scriptIsInline };
+    return { manifest, scriptPath: join4(dir, script.path), scriptContent: script.content, scriptIsInline };
   } catch (err) {
     if (err instanceof ScriptContainmentError)
       throw err;
@@ -4257,7 +4545,7 @@ function writeCustomHook(name, manifest, scriptContent, scriptRelPath) {
   if (isAbsolute(scriptRelPath)) {
     throw new ScriptContainmentError(scriptRelPath, dir);
   }
-  const scriptPath = scriptRelPath.includes("/") ? join3(dir, scriptRelPath) : join3(dir, scriptRelPath);
+  const scriptPath = scriptRelPath.includes("/") ? join4(dir, scriptRelPath) : join4(dir, scriptRelPath);
   assertContainedLexical(scriptPath, dir, scriptRelPath);
   mkdirSync2(dir, { recursive: true });
   assertContainedReal(dir, scriptPath, scriptRelPath);
@@ -4265,7 +4553,7 @@ function writeCustomHook(name, manifest, scriptContent, scriptRelPath) {
   if (scriptDir !== dir)
     mkdirSync2(scriptDir, { recursive: true });
   writeFileSync2(scriptPath, scriptContent, "utf-8");
-  writeFileSync2(join3(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + `
+  writeFileSync2(join4(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + `
 `, "utf-8");
   return { dir, scriptPath };
 }
@@ -4289,7 +4577,8 @@ var init_manifest = __esm(() => {
     script: z.string().min(1, "script must name a relative path or inline content"),
     script_kind: z.enum(["inline", "file"]).optional(),
     args: z.array(z.string()).optional(),
-    timeout_ms: z.number().int().positive().optional()
+    timeout_ms: z.number().int().positive().optional(),
+    env: z.record(z.string(), z.string()).optional()
   });
   ScriptContainmentError = class ScriptContainmentError extends Error {
     constructor(path, hookDir, raw) {
@@ -4302,20 +4591,20 @@ var init_manifest = __esm(() => {
 // src/lib/resolve.ts
 var exports_resolve = {};
 __export(exports_resolve, {
-  resolveScriptPath: () => resolveScriptPath,
-  resolveHookMeta: () => resolveHookMeta,
-  resolveHookDir: () => resolveHookDir,
+  resolveBundledHooksDir: () => resolveBundledHooksDir,
   resolveHook: () => resolveHook,
-  resolveBundledHooksDir: () => resolveBundledHooksDir
+  resolveHookDir: () => resolveHookDir,
+  resolveHookMeta: () => resolveHookMeta,
+  resolveScriptPath: () => resolveScriptPath
 });
-import { dirname as dirname2, join as join4 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 import { existsSync as existsSync4 } from "fs";
 import { fileURLToPath } from "url";
 function resolveBundledHooksDir(moduleDir = dirname2(fileURLToPath(import.meta.url))) {
-  const sourceLayout = join4(moduleDir, "..", "..", "hooks");
-  if (existsSync4(join4(sourceLayout, "hook-gitguard")))
+  const sourceLayout = join5(moduleDir, "..", "..", "hooks");
+  if (existsSync4(join5(sourceLayout, "hook-gitguard")))
     return sourceLayout;
-  return join4(moduleDir, "..", "hooks");
+  return join5(moduleDir, "..", "hooks");
 }
 function resolveHookDir(name) {
   const custom = readCustomManifest(name);
@@ -4326,10 +4615,10 @@ function resolveHookDir(name) {
     return;
   const short = shortManifestName(name);
   const bundledBase = resolveBundledHooksDir();
-  const direct = join4(bundledBase, short);
+  const direct = join5(bundledBase, short);
   if (existsSync4(direct))
     return direct;
-  const prefixed = join4(bundledBase, `hook-${short}`);
+  const prefixed = join5(bundledBase, `hook-${short}`);
   return existsSync4(prefixed) ? prefixed : undefined;
 }
 function resolveScriptPath(name) {
@@ -4339,7 +4628,7 @@ function resolveScriptPath(name) {
   const dir = resolveHookDir(name);
   if (!dir)
     return;
-  const script = join4(dir, "src", "hook.ts");
+  const script = join5(dir, "src", "hook.ts");
   return existsSync4(script) ? script : undefined;
 }
 function resolveHookMeta(name) {
@@ -4429,7 +4718,7 @@ function up(db) {
     db.exec(idx);
   }
 }
-var init_001_initial = __esm(() => {
+var init__001_initial = __esm(() => {
   init_schema();
 });
 
@@ -4458,7 +4747,7 @@ function up2(db) {
     throw err;
   }
 }
-var init_002_session_events = __esm(() => {
+var init__002_session_events = __esm(() => {
   init_schema();
 });
 
@@ -4487,7 +4776,7 @@ function up3(db) {
     throw err;
   }
 }
-var init_003_user_prompt_submit_event = __esm(() => {
+var init__003_user_prompt_submit_event = __esm(() => {
   init_schema();
 });
 
@@ -4511,7 +4800,7 @@ var CREATE_HOOKS_TABLE = `
     last_verified_at TEXT
   )
 `, CREATE_HOOKS_INDEXES;
-var init_004_hooks_table = __esm(() => {
+var init__004_hooks_table = __esm(() => {
   CREATE_HOOKS_INDEXES = [
     `CREATE INDEX IF NOT EXISTS idx_hooks_name ON hooks (name)`
   ];
@@ -4542,7 +4831,7 @@ function up5(db) {
     throw err;
   }
 }
-var init_005_subagent_start_event = __esm(() => {
+var init__005_subagent_start_event = __esm(() => {
   init_schema();
 });
 
@@ -4574,11 +4863,11 @@ function runMigrations(db) {
 }
 var MIGRATIONS;
 var init_migrations = __esm(() => {
-  init_001_initial();
-  init_002_session_events();
-  init_003_user_prompt_submit_event();
-  init_004_hooks_table();
-  init_005_subagent_start_event();
+  init__001_initial();
+  init__002_session_events();
+  init__003_user_prompt_submit_event();
+  init__004_hooks_table();
+  init__005_subagent_start_event();
   MIGRATIONS = [
     { version: "001_initial", up },
     { version: "002_session_events", up: up2 },
@@ -4589,8 +4878,8 @@ var init_migrations = __esm(() => {
 });
 
 // src/db/legacy-import.ts
-import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import { join as join6 } from "path";
 import { homedir as homedir3 } from "os";
 function ensureMetaTable(db) {
   db.exec(`
@@ -4614,7 +4903,7 @@ function nanoid() {
 function importJsonlFile(db, filePath) {
   let count = 0;
   try {
-    const lines = readFileSync3(filePath, "utf-8").split(`
+    const lines = readFileSync4(filePath, "utf-8").split(`
 `).filter(Boolean);
     for (const line of lines) {
       try {
@@ -4640,7 +4929,7 @@ function importJsonlFile(db, filePath) {
 function importErrorsLog(db, filePath) {
   let count = 0;
   try {
-    const lines = readFileSync3(filePath, "utf-8").split(`
+    const lines = readFileSync4(filePath, "utf-8").split(`
 `).filter(Boolean);
     const linePattern = /^\[(.+?)\]\s+(?:\[session:(\S+)\]\s+)?(.+?)\s+\u2014\s+(.+)$/;
     for (const line of lines) {
@@ -4665,25 +4954,25 @@ function importErrorsLog(db, filePath) {
   } catch {}
   return count;
 }
-function runLegacyImport(db, homeDir = homedir3()) {
+function runLegacyImport(db, homeDir2 = homedir3()) {
   try {
     if (isAlreadyDone(db))
       return;
     let total = 0;
-    const claudeProjectsDir = join5(homeDir, ".claude", "projects");
+    const claudeProjectsDir = join6(homeDir2, ".claude", "projects");
     if (existsSync5(claudeProjectsDir)) {
       try {
         const projectDirs = readdirSync2(claudeProjectsDir);
         for (const dir of projectDirs) {
-          const projectDir = join5(claudeProjectsDir, dir);
+          const projectDir = join6(claudeProjectsDir, dir);
           try {
             const files = readdirSync2(projectDir);
             for (const file of files) {
               if (file.match(/^session-log-\d{4}-\d{2}-\d{2}\.jsonl$/)) {
-                total += importJsonlFile(db, join5(projectDir, file));
+                total += importJsonlFile(db, join6(projectDir, file));
               }
               if (file === "errors.log") {
-                total += importErrorsLog(db, join5(projectDir, file));
+                total += importErrorsLog(db, join6(projectDir, file));
               }
             }
           } catch {}
@@ -4720,23 +5009,23 @@ function runRetention(db, days) {
 // src/db/index.ts
 var exports_db = {};
 __export(exports_db, {
-  getDbPath: () => getDbPath,
-  getDb: () => getDb,
+  closeDb: () => closeDb,
   createTestDb: () => createTestDb,
-  closeDb: () => closeDb
+  getDb: () => getDb,
+  getDbPath: () => getDbPath
 });
 import { Database } from "bun:sqlite";
 import { existsSync as existsSync6, mkdirSync as mkdirSync3, cpSync } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { homedir as homedir4 } from "os";
 function resolveDataDir() {
   const explicit = process.env.HASNA_HOOKS_DATA_DIR ?? process.env.HOOKS_DATA_DIR;
   if (explicit)
     return explicit;
-  const newDir = join6(homedir4(), ".hasna", "hooks");
-  const oldDir = join6(homedir4(), ".hooks");
+  const newDir = join7(homedir4(), ".hasna", "hooks");
+  const oldDir = join7(homedir4(), ".hooks");
   if (!existsSync6(newDir) && existsSync6(oldDir)) {
-    mkdirSync3(join6(homedir4(), ".hasna"), { recursive: true });
+    mkdirSync3(join7(homedir4(), ".hasna"), { recursive: true });
     cpSync(oldDir, newDir, { recursive: true });
   }
   return newDir;
@@ -4746,7 +5035,7 @@ function getDbPath() {
   if (explicitDb)
     return explicitDb;
   const dataDir = resolveDataDir();
-  return join6(dataDir, "hooks.db");
+  return join7(dataDir, "hooks.db");
 }
 function ensureDir(dbPath) {
   const dir = dbPath.substring(0, dbPath.lastIndexOf("/"));
@@ -4801,26 +5090,26 @@ var init_db = __esm(() => {
 // src/lib/store.ts
 var exports_store = {};
 __export(exports_store, {
-  writeLock: () => writeLock,
-  verifyScriptHash: () => verifyScriptHash,
-  upsertHookRecord: () => upsertHookRecord,
-  sha256Of: () => sha256Of,
-  sha256File: () => sha256File,
-  setPinnedHook: () => setPinnedHook,
-  retrustHook: () => retrustHook,
-  removePinnedHook: () => removePinnedHook,
-  removeHookRecord: () => removeHookRecord,
-  removeHookFromStore: () => removeHookFromStore,
-  readLock: () => readLock,
-  pinInstalledHook: () => pinInstalledHook,
-  listHookRecords: () => listHookRecords,
-  getPinnedHook: () => getPinnedHook,
-  getHookRecord: () => getHookRecord,
+  LockFileError: () => LockFileError,
   checkScriptHash: () => checkScriptHash,
-  LockFileError: () => LockFileError
+  getHookRecord: () => getHookRecord,
+  getPinnedHook: () => getPinnedHook,
+  listHookRecords: () => listHookRecords,
+  pinInstalledHook: () => pinInstalledHook,
+  readLock: () => readLock,
+  removeHookFromStore: () => removeHookFromStore,
+  removeHookRecord: () => removeHookRecord,
+  removePinnedHook: () => removePinnedHook,
+  retrustHook: () => retrustHook,
+  setPinnedHook: () => setPinnedHook,
+  sha256File: () => sha256File,
+  sha256Of: () => sha256Of,
+  upsertHookRecord: () => upsertHookRecord,
+  verifyScriptHash: () => verifyScriptHash,
+  writeLock: () => writeLock
 });
 import { createHash } from "crypto";
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3, renameSync } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3, renameSync } from "fs";
 import { readFile as readFile2 } from "fs/promises";
 import { randomBytes } from "crypto";
 function sha256Of(input) {
@@ -4886,7 +5175,7 @@ function readLock() {
     return { hooks: {} };
   let raw;
   try {
-    raw = readFileSync4(path, "utf-8");
+    raw = readFileSync5(path, "utf-8");
   } catch {
     throw new LockFileError(`hooks.lock (${path}) could not be read. Repair: fix permissions or move the file aside and run 'hooks sync'.`);
   }
@@ -4983,7 +5272,7 @@ async function verifyScriptHash(name, scriptPath) {
   return checkScriptHash(name, await sha256File(scriptPath));
 }
 function retrustHook(name, scriptPath, version, source) {
-  const actual = sha256Of(readFileSync4(scriptPath));
+  const actual = sha256Of(readFileSync5(scriptPath));
   const db = getDb();
   upsertHookRecord(db, {
     name,
@@ -5010,22 +5299,22 @@ var init_store = __esm(() => {
 // src/lib/installer.ts
 var exports_installer = {};
 __export(exports_installer, {
-  uninstallHook: () => uninstallHook,
-  removeHook: () => removeHook,
-  removeCodewithHookEntry: () => removeCodewithHookEntry,
-  isEventSupported: () => isEventSupported,
-  installHooks: () => installHooks,
-  installHook: () => installHook,
-  hookExists: () => hookExists,
-  getSettingsPath: () => getSettingsPath,
-  getRegisteredHooksForTarget: () => getRegisteredHooksForTarget,
-  getRegisteredHooks: () => getRegisteredHooks,
-  getInstalledHooks: () => getInstalledHooks,
+  buildCodewithTomlFragment: () => buildCodewithTomlFragment,
   getHookPath: () => getHookPath,
-  buildCodewithTomlFragment: () => buildCodewithTomlFragment
+  getInstalledHooks: () => getInstalledHooks,
+  getRegisteredHooks: () => getRegisteredHooks,
+  getRegisteredHooksForTarget: () => getRegisteredHooksForTarget,
+  getSettingsPath: () => getSettingsPath,
+  hookExists: () => hookExists,
+  installHook: () => installHook,
+  installHooks: () => installHooks,
+  isEventSupported: () => isEventSupported,
+  removeCodewithHookEntry: () => removeCodewithHookEntry,
+  removeHook: () => removeHook,
+  uninstallHook: () => uninstallHook
 });
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync4 } from "fs";
-import { join as join7, dirname as dirname3 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync4 } from "fs";
+import { join as join8, dirname as dirname3 } from "path";
 import { homedir as homedir5 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function normalizeHookName(name) {
@@ -5065,16 +5354,16 @@ function getSettingsPath(scope = "global", target = "claude", codewithConfigPath
     return globalOverride;
   const dir = getTargetSettingsDir(target);
   if (scope === "project") {
-    return target === "codewith" ? join7(process.cwd(), dir, "config.toml") : join7(process.cwd(), dir, "settings.json");
+    return target === "codewith" ? join8(process.cwd(), dir, "config.toml") : join8(process.cwd(), dir, "settings.json");
   }
-  return target === "codewith" ? join7(homedir5(), dir, "config.toml") : join7(homedir5(), dir, "settings.json");
+  return target === "codewith" ? join8(homedir5(), dir, "config.toml") : join8(homedir5(), dir, "settings.json");
 }
 function getHookPath(name) {
   const shortName = shortHookName(name);
   const resolved = resolveHookDir(shortName);
   if (resolved)
     return resolved;
-  return join7(HOOKS_DIR, normalizeHookName(shortName));
+  return join8(HOOKS_DIR, normalizeHookName(shortName));
 }
 function hookExists(name) {
   return existsSync8(getHookPath(name));
@@ -5083,7 +5372,7 @@ function readSettings(scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
   try {
     if (existsSync8(path)) {
-      return JSON.parse(readFileSync5(path, "utf-8"));
+      return JSON.parse(readFileSync6(path, "utf-8"));
     }
   } catch (error) {
     console.warn(`[hooks] Failed to read settings at ${path}: ${error instanceof Error ? error.message : String(error)}`);
@@ -5182,7 +5471,7 @@ function buildCodewithTomlFragment(name, profile) {
 function readCodewithConfig(scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
   try {
-    return existsSync8(path) ? readFileSync5(path, "utf-8") : "";
+    return existsSync8(path) ? readFileSync6(path, "utf-8") : "";
   } catch {
     return "";
   }
@@ -5192,7 +5481,7 @@ function appendCodewithFragment(fragment, scope, configPath) {
   const dir = dirname3(path);
   if (!existsSync8(dir))
     mkdirSync5(dir, { recursive: true });
-  const existing = existsSync8(path) ? readFileSync5(path, "utf-8") : "";
+  const existing = existsSync8(path) ? readFileSync6(path, "utf-8") : "";
   const sep2 = existing.trim() ? `
 
 ` : "";
@@ -5237,7 +5526,7 @@ function installForTarget(name, scope, overwrite, target, profile, codewithMode
           target,
           fragment,
           applied: false,
-          note: "Codewith install is fragment-only by default; open-configs should own applying this TOML."
+          note: "Codewith install is fragment-only by default; configs should own applying this TOML."
         };
       }
       if (!codewithConfigPath) {
@@ -5264,7 +5553,7 @@ function installForTarget(name, scope, overwrite, target, profile, codewithMode
         fragment,
         applied: true,
         configPath: path,
-        note: "Direct Codewith config write was explicitly requested; prefer open-configs for managed machines."
+        note: "Direct Codewith config write was explicitly requested; prefer configs for managed machines."
       };
     } catch (error) {
       return {
@@ -5495,7 +5784,7 @@ function codewithHasHookEntry(name, scope = "global") {
   if (!existsSync8(path))
     return false;
   try {
-    return codewithHasHookEntryInText(readFileSync5(path, "utf-8"), name);
+    return codewithHasHookEntryInText(readFileSync6(path, "utf-8"), name);
   } catch {
     return false;
   }
@@ -5527,7 +5816,7 @@ function uninstallHook(name, scope = "global", target = "claude") {
   if (target === "codewith" || target === "all") {
     const codewithPath = getSettingsPath(scope, "codewith");
     if (existsSync8(codewithPath)) {
-      const before = readFileSync5(codewithPath, "utf-8");
+      const before = readFileSync6(codewithPath, "utf-8");
       const after = removeCodewithHookEntry(before, shortName);
       if (after.removed) {
         writeFileSync4(codewithPath, after.text, "utf-8");
@@ -5573,7 +5862,7 @@ var init_installer = __esm(() => {
   init_manifest();
   init_store();
   __dirname2 = dirname3(fileURLToPath2(import.meta.url));
-  HOOKS_DIR = existsSync8(join7(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join7(__dirname2, "..", "..", "hooks") : join7(__dirname2, "..", "hooks");
+  HOOKS_DIR = existsSync8(join8(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join8(__dirname2, "..", "..", "hooks") : join8(__dirname2, "..", "hooks");
   EVENT_MAP = {
     claude: {
       PreToolUse: "PreToolUse",
@@ -5720,14 +6009,14 @@ var init_redact = __esm(() => {
 });
 
 // src/lib/profiles.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5, readdirSync as readdirSync3, rmSync as rmSync2, cpSync as cpSync2 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync5, readdirSync as readdirSync3, rmSync as rmSync2, cpSync as cpSync2 } from "fs";
+import { join as join9 } from "path";
 import { homedir as homedir6 } from "os";
 function resolveProfilesDir() {
-  const newDir = join8(homedir6(), ".hasna", "hooks", "profiles");
-  const oldDir = join8(homedir6(), ".hooks", "profiles");
+  const newDir = join9(homedir6(), ".hasna", "hooks", "profiles");
+  const oldDir = join9(homedir6(), ".hooks", "profiles");
   if (!existsSync9(newDir) && existsSync9(oldDir)) {
-    mkdirSync6(join8(homedir6(), ".hasna", "hooks"), { recursive: true });
+    mkdirSync6(join9(homedir6(), ".hasna", "hooks"), { recursive: true });
     cpSync2(oldDir, newDir, { recursive: true });
   }
   return newDir;
@@ -5738,7 +6027,7 @@ function ensureProfilesDir() {
   }
 }
 function profilePath(id) {
-  return join8(PROFILES_DIR, `${id}.json`);
+  return join9(PROFILES_DIR, `${id}.json`);
 }
 function shortUuid() {
   return crypto.randomUUID().slice(0, 8);
@@ -5766,7 +6055,7 @@ function getProfile(id) {
   try {
     if (!existsSync9(path))
       return null;
-    return JSON.parse(readFileSync6(path, "utf-8"));
+    return JSON.parse(readFileSync7(path, "utf-8"));
   } catch {
     return null;
   }
@@ -5779,7 +6068,7 @@ function listProfiles() {
     const profiles = [];
     for (const file of files) {
       try {
-        const content = readFileSync6(join8(PROFILES_DIR, file), "utf-8");
+        const content = readFileSync7(join9(PROFILES_DIR, file), "utf-8");
         profiles.push(JSON.parse(content));
       } catch {}
     }
@@ -5827,10 +6116,10 @@ var init_profiles = __esm(() => {
 // src/lib/db-writer.ts
 var exports_db_writer = {};
 __export(exports_db_writer, {
-  writeHookEvent: () => writeHookEvent,
-  resolveEventType: () => resolveEventType,
+  normalizeEventType: () => normalizeEventType,
   recordHookRun: () => recordHookRun,
-  normalizeEventType: () => normalizeEventType
+  resolveEventType: () => resolveEventType,
+  writeHookEvent: () => writeHookEvent
 });
 function nanoid2() {
   return crypto.randomUUID().replace(/-/g, "").slice(0, 21);
@@ -5921,6 +6210,8 @@ var init_db_writer = __esm(() => {
 });
 
 // src/lib/hook-env.ts
+import { dirname as dirname4, isAbsolute as isAbsolute2 } from "path";
+import { existsSync as existsSync10, statSync as statSync2 } from "fs";
 function isDeniedEnvName(name) {
   const upper = name.toUpperCase();
   if (DENY_PREFIXES.some((prefix) => upper.startsWith(prefix)))
@@ -5929,13 +6220,74 @@ function isDeniedEnvName(name) {
     return true;
   return DENY_CONTAINS.some((token) => upper.includes(token));
 }
+function isInterpreterInjectionEnvName(name) {
+  if (INTERPRETER_INJECTION.has(name))
+    return true;
+  return INTERPRETER_INJECTION_PREFIXES.some((prefix) => name.startsWith(prefix));
+}
+function isBashFunctionEnvName(name) {
+  return name.startsWith("BASH_FUNC_");
+}
+function isUnsafePathEntry(entry, home) {
+  if (entry === "" || !isAbsolute2(entry))
+    return true;
+  if (home && (entry === home || entry.startsWith(home + "/")))
+    return true;
+  if (entry === "/tmp" || entry.startsWith("/tmp/"))
+    return true;
+  if (entry === "/var/tmp" || entry.startsWith("/var/tmp/"))
+    return true;
+  try {
+    if ((statSync2(entry).mode & 2) !== 0)
+      return true;
+  } catch {}
+  return false;
+}
+function sanitizeHookPath(pathValue, home) {
+  const baseline = PATH_BASELINE.slice();
+  if (process.platform === "darwin" && existsSync10("/opt/homebrew/bin"))
+    baseline.push("/opt/homebrew/bin");
+  const bunDir = dirname4(process.execPath);
+  const seen = new Set;
+  const out = [];
+  for (const dir of baseline) {
+    if (seen.has(dir))
+      continue;
+    seen.add(dir);
+    out.push(dir);
+  }
+  if (!seen.has(bunDir)) {
+    seen.add(bunDir);
+    out.push(bunDir);
+  }
+  for (const entry of pathValue.split(":")) {
+    if (seen.has(entry))
+      continue;
+    if (isUnsafePathEntry(entry, home))
+      continue;
+    seen.add(entry);
+    out.push(entry);
+  }
+  return out.join(":");
+}
 function buildHookEnv(source, extra) {
   const out = {};
   for (const name of ALLOWLIST) {
+    if (name === "PATH")
+      continue;
     const value = source[name] ?? extra?.[name];
     if (value !== undefined && value !== null)
       out[name] = value;
   }
+  const pathOverride = extra?.PATH;
+  if (pathOverride !== undefined && pathOverride !== null) {
+    out.PATH = pathOverride;
+  } else {
+    const parentPath = source.PATH;
+    if (parentPath !== undefined && parentPath !== null) {
+      out.PATH = sanitizeHookPath(parentPath, source.HOME ?? extra?.HOME);
+    }
+  }
   for (const [from, to] of CONFIG_PROJECTIONS) {
     const value = source[from] ?? extra?.[from];
     if (value !== undefined && value !== null)
@@ -5947,14 +6299,44 @@ function buildHookEnv(source, extra) {
       continue;
     if (isDeniedEnvName(name))
       continue;
+    if (isInterpreterInjectionEnvName(name))
+      continue;
+    if (isBashFunctionEnvName(name))
+      continue;
     if (value !== undefined && value !== null)
       out[name] = value;
   }
   return out;
 }
-var ALLOWLIST, DENY_SUFFIXES, DENY_PREFIXES, DENY_CONTAINS, CONFIG_PROJECTIONS;
+var ALLOWLIST, INTERPRETER_INJECTION, INTERPRETER_INJECTION_PREFIXES, DENY_SUFFIXES, DENY_PREFIXES, DENY_CONTAINS, PATH_BASELINE, CONFIG_PROJECTIONS;
 var init_hook_env = __esm(() => {
   ALLOWLIST = new Set(["PATH", "HOME", "LANG", "TZ", "SHELL", "TERM", "USER", "PWD"]);
+  INTERPRETER_INJECTION = new Set([
+    "BASH_ENV",
+    "ENV",
+    "BASHOPTS",
+    "SHELLOPTS",
+    "NODE_OPTIONS",
+    "NODE_PATH",
+    "PYTHONSTARTUP",
+    "PYTHONINSPECT",
+    "PYTHONPATH",
+    "PYTHONHOME",
+    "LD_PRELOAD",
+    "LD_LIBRARY_PATH",
+    "GCONV_PATH",
+    "LOCPATH",
+    "PERL5OPT",
+    "RUBYOPT",
+    "NODE_EXTRA_CA_CERTS",
+    "NODE_TLS_REJECT_UNAUTHORIZED",
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
+    "CURL_CA_BUNDLE",
+    "GIT_SSL_CAINFO",
+    "AWS_CA_BUNDLE"
+  ]);
+  INTERPRETER_INJECTION_PREFIXES = ["GIT_CONFIG_"];
   DENY_SUFFIXES = ["KEY", "TOKEN", "SECRET", "PASSWORD", "PASSWD", "CREDENTIAL", "CREDENTIALS", "URL", "URI"];
   DENY_PREFIXES = [
     "HASNA_",
@@ -5972,6 +6354,7 @@ var init_hook_env = __esm(() => {
     "MEMENTOS_"
   ];
   DENY_CONTAINS = ["DATABASE_URL"];
+  PATH_BASELINE = ["/usr/bin", "/bin", "/usr/local/bin", "/sbin", "/usr/sbin"];
   CONFIG_PROJECTIONS = [
     ["HASNA_HOOKS_DATA_DIR", "HOOKS_DATA_DIR"],
     ["HASNA_HOOKS_DB_PATH", "HOOKS_DB_PATH"],
@@ -5983,12 +6366,12 @@ var init_hook_env = __esm(() => {
 // src/lib/run.ts
 var exports_run = {};
 __export(exports_run, {
-  executeVerifiedScript: () => executeVerifiedScript,
-  HookTimeoutError: () => HookTimeoutError
+  HookTimeoutError: () => HookTimeoutError,
+  executeVerifiedScript: () => executeVerifiedScript
 });
 import { randomBytes as randomBytes2 } from "crypto";
 import { rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute2, join as join9 } from "path";
+import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute3, join as join10 } from "path";
 function extensionOf(scriptPath) {
   const base = basename2(scriptPath);
   const dot = base.lastIndexOf(".");
@@ -6015,13 +6398,13 @@ function interpreterFor(name, scriptPath, content) {
     if (interp === "bash" || interp === "sh")
       return { command: ["/bin/bash"], tempExt: "sh" };
     if (interp === "node" || interp === "bun")
-      return { command: ["bun", "run"], tempExt: BUN_EXTENSIONS.has(ext) ? ext : "ts" };
+      return { command: [process.execPath, "run"], tempExt: BUN_EXTENSIONS.has(ext) ? ext : "ts" };
     throw new Error(`Refusing to run hook '${name}': shebang '${firstLine}' is not a recognized interpreter (supported: bash/sh, node/bun)`);
   }
   if (BASH_EXTENSIONS.has(ext))
     return { command: ["/bin/bash"], tempExt: "sh" };
   if (BUN_EXTENSIONS.has(ext))
-    return { command: ["bun", "run"], tempExt: ext };
+    return { command: [process.execPath, "run"], tempExt: ext };
   throw new Error(`Refusing to run hook '${name}': unsupported script extension '.${ext}' (supported: .sh .bash .ts .tsx .js .jsx .mjs .cjs .mts .cts, or a recognized shebang)`);
 }
 async function readPipeWithDeadline(stream, deadlineMs) {
@@ -6057,9 +6440,9 @@ async function readPipeWithDeadline(stream, deadlineMs) {
   return chunks.join("");
 }
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname4(options.scriptPath);
+  const scriptDir = dirname5(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
-  const tempPath = join9(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
+  const tempPath = join10(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
   let timedOut = false;
   const timeoutTimer = options.timeout ? setTimeout(() => {
@@ -6068,7 +6451,7 @@ async function executeVerifiedScript(options) {
   }, options.timeout) : null;
   try {
     writeFileSync6(tempPath, options.content, { flag: "wx", mode: 384 });
-    proc = Bun.spawn([...interpreter.command, isAbsolute2(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
+    proc = Bun.spawn([...interpreter.command, isAbsolute3(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
       stdin: new Response(options.stdin),
       stdout: "pipe",
       stderr: "pipe",
@@ -6146,19 +6529,19 @@ var init_run = __esm(() => {
 // src/lib/custom-install.ts
 var exports_custom_install = {};
 __export(exports_custom_install, {
-  isCustomSource: () => isCustomSource,
+  ensureCustomDir: () => ensureCustomDir,
   installCustomSource: () => installCustomSource,
-  ensureCustomDir: () => ensureCustomDir
+  isCustomSource: () => isCustomSource
 });
-import { existsSync as existsSync10, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync4 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync8, rmSync as rmSync4 } from "fs";
+import { join as join11 } from "path";
 import { tmpdir } from "os";
 function manifestAt(dir) {
-  const path = join10(dir, "manifest.json");
-  if (!existsSync10(path))
+  const path = join11(dir, "manifest.json");
+  if (!existsSync11(path))
     return;
   try {
-    return parseManifest(readFileSync7(path, "utf-8"));
+    return parseManifest(readFileSync8(path, "utf-8"));
   } catch {
     return;
   }
@@ -6177,8 +6560,8 @@ function writeFromManifest(manifest, srcDir, source, kind) {
   return { name, version: manifest.version, kind, source, dir, scriptPath };
 }
 async function cloneToTemp(gitUrl) {
-  const tmp = mkdtempSync(join10(tmpdir(), "hooks-install-"));
-  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join10(tmp, "repo")], {
+  const tmp = mkdtempSync(join11(tmpdir(), "hooks-install-"));
+  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join11(tmp, "repo")], {
     stdout: "pipe",
     stderr: "pipe"
   });
@@ -6191,7 +6574,7 @@ async function cloneToTemp(gitUrl) {
     rmSync4(tmp, { recursive: true, force: true });
     throw new Error(`git clone failed (${exitCode}): ${stderr.trim()}`);
   }
-  return join10(tmp, "repo");
+  return join11(tmp, "repo");
 }
 function isGitUrl(value) {
   return value.startsWith("git@") || value.startsWith("ssh://") || value.startsWith("file://") || value.endsWith(".git");
@@ -6201,7 +6584,7 @@ function isCustomSource(value) {
     return true;
   if (value.startsWith("http://") || value.startsWith("https://"))
     return true;
-  return existsSync10(value);
+  return existsSync11(value);
 }
 async function installCustomSource(source) {
   if (isGitUrl(source)) {
@@ -6215,11 +6598,11 @@ async function installCustomSource(source) {
   if (source.startsWith("http://") || source.startsWith("https://")) {
     return installManifestUrl(source);
   }
-  if (!existsSync10(source)) {
+  if (!existsSync11(source)) {
     throw new Error(`No such local path: ${source}`);
   }
   if (source.endsWith("manifest.json")) {
-    const manifest = parseManifest(readFileSync7(source, "utf-8"));
+    const manifest = parseManifest(readFileSync8(source, "utf-8"));
     return writeFromManifest(manifest, source.substring(0, source.lastIndexOf("/")), source, "local");
   }
   return copyManifestDir(source, source, "local");
@@ -6261,19 +6644,19 @@ var init_custom_install = __esm(() => {
 // src/lib/sync.ts
 var exports_sync = {};
 __export(exports_sync, {
-  syncHooks: () => syncHooks,
-  stageSyncArtifacts: () => stageSyncArtifacts,
-  planSync: () => planSync,
+  commitSyncArtifacts: () => commitSyncArtifacts,
   fetchPinnedHook: () => fetchPinnedHook,
-  commitSyncArtifacts: () => commitSyncArtifacts
+  planSync: () => planSync,
+  stageSyncArtifacts: () => stageSyncArtifacts,
+  syncHooks: () => syncHooks
 });
 import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 function sha256OfText(text) {
   return createHash2("sha256").update(text).digest("hex");
 }
 function sha256OfPath(path) {
-  return createHash2("sha256").update(readFileSync8(path)).digest("hex");
+  return createHash2("sha256").update(readFileSync9(path)).digest("hex");
 }
 function collectBundledCatalog() {
   const out = [];
@@ -6974,31 +7357,31 @@ var init_storage_sync = __esm(() => {
 // src/storage.ts
 var exports_storage = {};
 __export(exports_storage, {
-  storageSync: () => storageSync,
-  storagePush: () => storagePush,
-  storagePull: () => storagePull,
-  runStorageMigrations: () => runStorageMigrations,
-  resolveTables: () => resolveTables,
-  parseStorageTables: () => parseStorageTables,
-  getSyncMetaAll: () => getSyncMetaAll,
-  getStorageStatus: () => getStorageStatus,
-  getStoragePg: () => getStoragePg,
-  getStorageDatabaseUrl: () => getStorageDatabaseUrl,
-  getStorageDatabaseEnvName: () => getStorageDatabaseEnvName,
-  getStorageDatabaseEnv: () => getStorageDatabaseEnv,
-  getStorageBackend: () => getStorageBackend,
-  STORAGE_TABLES: () => STORAGE_TABLES,
-  STORAGE_DATABASE_ENV: () => STORAGE_DATABASE_ENV,
-  STORAGE_BACKEND_ENV: () => STORAGE_BACKEND_ENV,
-  STORAGE_BACKENDS: () => STORAGE_BACKENDS,
-  RETIRED_STORAGE_MODE_ENV: () => RETIRED_STORAGE_MODE_ENV,
-  PgAdapterAsync: () => PgAdapterAsync,
-  PG_MIGRATIONS: () => PG_MIGRATIONS,
-  HOOKS_STORAGE_TABLES: () => HOOKS_STORAGE_TABLES,
-  HOOKS_STORAGE_FALLBACK_ENV: () => HOOKS_STORAGE_FALLBACK_ENV,
-  HOOKS_STORAGE_ENV: () => HOOKS_STORAGE_ENV,
+  HOOKS_STORAGE_BACKEND_ENV: () => HOOKS_STORAGE_BACKEND_ENV,
   HOOKS_STORAGE_BACKEND_FALLBACK_ENV: () => HOOKS_STORAGE_BACKEND_FALLBACK_ENV,
-  HOOKS_STORAGE_BACKEND_ENV: () => HOOKS_STORAGE_BACKEND_ENV
+  HOOKS_STORAGE_ENV: () => HOOKS_STORAGE_ENV,
+  HOOKS_STORAGE_FALLBACK_ENV: () => HOOKS_STORAGE_FALLBACK_ENV,
+  HOOKS_STORAGE_TABLES: () => HOOKS_STORAGE_TABLES,
+  PG_MIGRATIONS: () => PG_MIGRATIONS,
+  PgAdapterAsync: () => PgAdapterAsync,
+  RETIRED_STORAGE_MODE_ENV: () => RETIRED_STORAGE_MODE_ENV,
+  STORAGE_BACKENDS: () => STORAGE_BACKENDS,
+  STORAGE_BACKEND_ENV: () => STORAGE_BACKEND_ENV,
+  STORAGE_DATABASE_ENV: () => STORAGE_DATABASE_ENV,
+  STORAGE_TABLES: () => STORAGE_TABLES,
+  getStorageBackend: () => getStorageBackend,
+  getStorageDatabaseEnv: () => getStorageDatabaseEnv,
+  getStorageDatabaseEnvName: () => getStorageDatabaseEnvName,
+  getStorageDatabaseUrl: () => getStorageDatabaseUrl,
+  getStoragePg: () => getStoragePg,
+  getStorageStatus: () => getStorageStatus,
+  getSyncMetaAll: () => getSyncMetaAll,
+  parseStorageTables: () => parseStorageTables,
+  resolveTables: () => resolveTables,
+  runStorageMigrations: () => runStorageMigrations,
+  storagePull: () => storagePull,
+  storagePush: () => storagePush,
+  storageSync: () => storageSync
 });
 var init_storage = __esm(() => {
   init_storage_sync();
@@ -7019,15 +7402,180 @@ function secureEqual(a, b) {
   return diff === 0;
 }
 
+// src/openapi.ts
+var openApiDocument;
+var init_openapi = __esm(() => {
+  openApiDocument = {
+    openapi: "3.1.0",
+    info: {
+      title: "Hooks Registry API",
+      version: "0.1.0",
+      description: "Local registry HTTP API for @hasna/hooks: catalog, lock, and artifact reads are open; publishing (PUT /api/v1/hooks) requires the API key (authorization: Bearer or x-api-key)."
+    },
+    servers: [{ url: "/" }],
+    paths: {
+      "/health": {
+        get: {
+          summary: "Liveness probe",
+          operationId: "getHealth",
+          responses: {
+            "200": {
+              description: "Service is alive",
+              content: {
+                "application/json": {
+                  schema: { type: "object", additionalProperties: true }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/ready": {
+        get: {
+          summary: "Readiness probe \u2014 the hooks.lock store is readable",
+          operationId: "getReady",
+          responses: {
+            "200": { description: "Lock store is readable" },
+            "503": { description: "Lock store is not readable" }
+          }
+        }
+      },
+      "/version": {
+        get: {
+          summary: "Package version",
+          operationId: "getVersion",
+          responses: {
+            "200": {
+              description: "The installed @hasna/hooks version",
+              content: {
+                "application/json": {
+                  schema: { type: "object", properties: { version: { type: "string" } } }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/openapi.json": {
+        get: {
+          summary: "This OpenAPI document",
+          operationId: "getOpenApi",
+          responses: { "200": { description: "OpenAPI 3.1 document" } }
+        }
+      },
+      "/api/v1/catalog": {
+        get: {
+          summary: "List the full hook catalog with versions and sha256",
+          operationId: "getCatalog",
+          responses: {
+            "200": {
+              description: "Catalog entries",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    properties: {
+                      hooks: {
+                        type: "array",
+                        items: {
+                          type: "object",
+                          properties: {
+                            name: { type: "string" },
+                            version: { type: "string" },
+                            sha256: { type: "string" },
+                            events: { type: "array", items: { type: "string" } }
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/api/v1/lock": {
+        get: {
+          summary: "Read the published hooks.lock with per-hook versions",
+          operationId: "getLock",
+          responses: { "200": { description: "The lock file" } }
+        }
+      },
+      "/api/v1/hooks/{name}/{version}": {
+        get: {
+          summary: "Fetch one hook's manifest and script",
+          operationId: "getHookArtifact",
+          parameters: [
+            { name: "name", in: "path", required: true, schema: { type: "string" } },
+            { name: "version", in: "path", required: true, schema: { type: "string" } }
+          ],
+          responses: {
+            "200": {
+              description: "Hook artifact; x-hook-sha256 header carries the script hash"
+            },
+            "400": { description: "Invalid URL encoding or semver version" },
+            "404": { description: "Hook not found locally" }
+          }
+        }
+      },
+      "/api/v1/hooks": {
+        put: {
+          summary: "Publish/retrust a hook (requires the API key)",
+          operationId: "putHook",
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: { name: { type: "string" }, version: { type: "string" } }
+                }
+              }
+            }
+          },
+          responses: {
+            "200": { description: "Hook retrusted and pin updated" },
+            "401": { description: "Missing or invalid API key" },
+            "404": { description: "Hook not found in local store" },
+            "409": { description: "Version mismatch with the local store" }
+          },
+          security: [{ apiKey: [] }]
+        }
+      }
+    },
+    components: {
+      securitySchemes: {
+        apiKey: {
+          type: "http",
+          scheme: "bearer",
+          description: "The registry API key (HASNA_HOOKS_API_KEY / HOOKS_API_KEY)."
+        }
+      }
+    }
+  };
+});
+
 // src/serve.ts
 var exports_serve = {};
 __export(exports_serve, {
-  startServeServer: () => startServeServer,
-  handleServeRequest: () => handleServeRequest,
-  SERVE_SERVICE_NAME: () => SERVE_SERVICE_NAME,
+  DEFAULT_SERVE_PORT: () => DEFAULT_SERVE_PORT,
   SERVE_HOST: () => SERVE_HOST,
-  DEFAULT_SERVE_PORT: () => DEFAULT_SERVE_PORT
+  SERVE_SERVICE_NAME: () => SERVE_SERVICE_NAME,
+  handleServeRequest: () => handleServeRequest,
+  startServeServer: () => startServeServer
 });
+import { readFileSync as readFileSync10 } from "fs";
+import { dirname as dirname6, join as join12 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+function packageVersion() {
+  try {
+    const pkgPath = join12(dirname6(fileURLToPath3(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync10(pkgPath, "utf-8")).version || "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
 async function buildCatalog() {
   const byName = new Map;
   for (const meta of HOOKS) {
@@ -7100,6 +7648,20 @@ function handleServeRequest(req, apiKey) {
   if (url.pathname === "/health" && req.method === "GET") {
     return Promise.resolve(json({ status: "ok", name: SERVE_SERVICE_NAME }));
   }
+  if (url.pathname === "/ready" && req.method === "GET") {
+    try {
+      readLock();
+      return Promise.resolve(json({ status: "ready", name: SERVE_SERVICE_NAME }));
+    } catch {
+      return Promise.resolve(json({ status: "not-ready", name: SERVE_SERVICE_NAME }, 503));
+    }
+  }
+  if (url.pathname === "/version" && req.method === "GET") {
+    return Promise.resolve(json({ version: packageVersion() }));
+  }
+  if (url.pathname === "/openapi.json" && req.method === "GET") {
+    return Promise.resolve(json(openApiDocument));
+  }
   if (url.pathname === "/api/v1/catalog" && req.method === "GET") {
     return buildCatalog().then((catalog) => json({ hooks: catalog }));
   }
@@ -7178,6 +7740,7 @@ var init_serve = __esm(() => {
   init_store();
   init_resolve();
   init_config();
+  init_openapi();
   init_semver();
   if (false) {}
 });
@@ -7266,29 +7829,29 @@ var CF_API = "https://api.cloudflare.com/client/v4";
 // src/mcp/server.ts
 var exports_server = {};
 __export(exports_server, {
-  startStdioServer: () => startStdioServer,
-  startSSEServer: () => startSSEServer,
-  sseAuthToken: () => sseAuthToken,
-  createHooksServer: () => createHooksServer,
+  MCP_PORT: () => MCP_PORT,
   MCP_SSE_HOST: () => MCP_SSE_HOST,
-  MCP_PORT: () => MCP_PORT
+  createHooksServer: () => createHooksServer,
+  sseAuthToken: () => sseAuthToken,
+  startSSEServer: () => startSSEServer,
+  startStdioServer: () => startStdioServer
 });
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z as z2 } from "zod";
 import { createServer } from "http";
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
-import { join as join11, dirname as dirname5 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
+import { join as join13, dirname as dirname7 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 async function runVerifiedHook(name, stdin, timeoutMs) {
   const { resolveHook: resolveHook2, resolveScriptPath: resolveScriptPath2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
   const resolved = resolveHook2(name);
   const hookScript = resolveScriptPath2(name);
-  if (!resolved || !hookScript || !existsSync11(hookScript)) {
+  if (!resolved || !hookScript || !existsSync12(hookScript)) {
     throw new Error(`Hook '${name}' not found`);
   }
-  const content = readFileSync9(hookScript);
+  const content = readFileSync11(hookScript);
   const sha = sha256Of(content);
   const check = checkScriptHash(name, sha);
   if (!check.ok) {
@@ -7493,7 +8056,7 @@ function createHooksServer() {
     const settingsPath = getSettingsPath(scope);
     const issues = [];
     const healthy = [];
-    const settingsExist = existsSync11(settingsPath);
+    const settingsExist = existsSync12(settingsPath);
     if (!settingsExist) {
       issues.push({ hook: "(settings)", issue: `${settingsPath} not found`, severity: "warning" });
     }
@@ -7503,7 +8066,7 @@ function createHooksServer() {
       const meta = custom ? resolveHookMeta(name) : getHook(name);
       let hookHealthy = true;
       if (custom) {
-        if (!existsSync11(custom.scriptPath)) {
+        if (!existsSync12(custom.scriptPath)) {
           issues.push({ hook: name, issue: `Custom hook script missing: ${custom.scriptPath}`, severity: "error" });
           hookHealthy = false;
         }
@@ -7513,14 +8076,14 @@ function createHooksServer() {
           continue;
         }
         const hookDir = getHookPath(name);
-        if (!existsSync11(join11(hookDir, "src", "hook.ts"))) {
+        if (!existsSync12(join13(hookDir, "src", "hook.ts"))) {
           issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
           hookHealthy = false;
         }
       }
       if (meta && settingsExist) {
         try {
-          const settings = JSON.parse(readFileSync9(settingsPath, "utf-8"));
+          const settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
           if (!hookRegisteredInSettings(settings, name, meta.event, meta.matcher)) {
             const eventName = meta.event.split(":")[0];
             issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
@@ -7550,10 +8113,10 @@ function createHooksServer() {
         return { content: [{ type: "text", text: JSON.stringify({ error: `Hook '${name}' not found` }) }] };
       }
       const hookPath = getHookPath(name);
-      const readmePath = join11(hookPath, "README.md");
+      const readmePath = join13(hookPath, "README.md");
       let readme = "";
-      if (existsSync11(readmePath)) {
-        readme = readFileSync9(readmePath, "utf-8");
+      if (existsSync12(readmePath)) {
+        readme = readFileSync11(readmePath, "utf-8");
       }
       if (verbose) {
         return { content: [{ type: "text", text: JSON.stringify({ ...meta, readme }) }] };
@@ -7736,7 +8299,7 @@ function createHooksServer() {
     const ctx = {
       scope,
       settings_path: settingsPath,
-      settings_exists: existsSync11(settingsPath),
+      settings_exists: existsSync12(settingsPath),
       registered_hooks: hooks,
       hook_count: hooks.length,
       healthy,
@@ -7882,8 +8445,8 @@ function createHooksServer() {
     const settingsPath = getSettingsPath(scope);
     let settings = {};
     try {
-      if (existsSync11(settingsPath))
-        settings = JSON.parse(readFileSync9(settingsPath, "utf-8"));
+      if (existsSync12(settingsPath))
+        settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
     } catch {}
     if (!settings.hooks)
       settings.hooks = {};
@@ -7892,8 +8455,8 @@ function createHooksServer() {
       disabled.push(name);
     settings.hooks.__disabled = disabled;
     const { writeFileSync: writeFileSync7, mkdirSync: mkdirSync8 } = await import("fs");
-    const { dirname: dirname6 } = await import("path");
-    mkdirSync8(dirname6(settingsPath), { recursive: true });
+    const { dirname: dirname8 } = await import("path");
+    mkdirSync8(dirname8(settingsPath), { recursive: true });
     writeFileSync7(settingsPath, JSON.stringify(settings, null, 2) + `
 `);
     return { content: [{ type: "text", text: JSON.stringify({ hook: name, disabled: true, scope }) }] };
@@ -7905,8 +8468,8 @@ function createHooksServer() {
     const settingsPath = getSettingsPath(scope);
     let settings = {};
     try {
-      if (existsSync11(settingsPath))
-        settings = JSON.parse(readFileSync9(settingsPath, "utf-8"));
+      if (existsSync12(settingsPath))
+        settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
     } catch {}
     if (settings.hooks?.__disabled) {
       settings.hooks.__disabled = settings.hooks.__disabled.filter((n) => n !== name);
@@ -8266,13 +8829,13 @@ var init_server = __esm(() => {
   init_store();
   init_redact();
   init_storage();
-  __dirname3 = dirname5(fileURLToPath3(import.meta.url));
+  __dirname3 = dirname7(fileURLToPath4(import.meta.url));
   pkg = { name: "@hasna/hooks", version: "0.0.0" };
   try {
     for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
-      const p = join11(__dirname3, rel);
-      if (existsSync11(p)) {
-        pkg = JSON.parse(readFileSync9(p, "utf-8"));
+      const p = join13(__dirname3, rel);
+      if (existsSync12(p)) {
+        pkg = JSON.parse(readFileSync11(p, "utf-8"));
         break;
       }
     }
@@ -8284,14 +8847,14 @@ var init_server = __esm(() => {
 // src/mcp/http.ts
 var exports_http = {};
 __export(exports_http, {
-  startMcpHttpServer: () => startMcpHttpServer,
-  resolveMcpHttpPort: () => resolveMcpHttpPort,
-  isHttpMode: () => isHttpMode,
-  healthPayload: () => healthPayload,
-  handleMcpRequest: () => handleMcpRequest,
-  MCP_SERVICE_NAME: () => MCP_SERVICE_NAME,
+  DEFAULT_MCP_HTTP_PORT: () => DEFAULT_MCP_HTTP_PORT,
   MCP_HTTP_HOST: () => MCP_HTTP_HOST,
-  DEFAULT_MCP_HTTP_PORT: () => DEFAULT_MCP_HTTP_PORT
+  MCP_SERVICE_NAME: () => MCP_SERVICE_NAME,
+  handleMcpRequest: () => handleMcpRequest,
+  healthPayload: () => healthPayload,
+  isHttpMode: () => isHttpMode,
+  resolveMcpHttpPort: () => resolveMcpHttpPort,
+  startMcpHttpServer: () => startMcpHttpServer
 });
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 function isHttpMode(args) {
@@ -8340,7 +8903,7 @@ function startMcpHttpServer(options) {
 var DEFAULT_MCP_HTTP_PORT = 8847, MCP_HTTP_HOST = "127.0.0.1", MCP_SERVICE_NAME = "hooks";
 var init_http = () => {};
 
-// node_modules/@hasna/events/dist/commander.js
+// ../events/dist/commander.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { Buffer as Buffer2 } from "buffer";
 import { existsSync } from "fs";
@@ -9525,7 +10088,7 @@ function replaySummary(events, deliveries, nextCursor) {
 // src/cli/index.tsx
 import { render } from "ink";
 
-// node_modules/commander/esm.mjs
+// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
 var {
   program,
@@ -9543,19 +10106,19 @@ var {
 
 // src/cli/index.tsx
 import chalk2 from "chalk";
-import { existsSync as existsSync12, readFileSync as readFileSync10, rmSync as rmSync5 } from "fs";
-import { join as join12, dirname as dirname6 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { existsSync as existsSync13, readFileSync as readFileSync12, rmSync as rmSync5 } from "fs";
+import { join as join14, dirname as dirname8 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
 
 // src/cli/components/App.tsx
 import { useState as useState7 } from "react";
 import { Box as Box8, Text as Text10, useApp, useInput as useInput5 } from "ink";
 
-// node_modules/ink-select-input/build/Indicator.js
+// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Indicator.js
 import React from "react";
 import { Box, Text } from "ink";
 
-// node_modules/is-unicode-supported/index.js
+// ../../node_modules/.bun/is-unicode-supported@2.1.0/node_modules/is-unicode-supported/index.js
 import process2 from "process";
 function isUnicodeSupported() {
   const { env } = process2;
@@ -9566,7 +10129,7 @@ function isUnicodeSupported() {
   return Boolean(env.WT_SESSION) || Boolean(env.TERMINUS_SUBLIME) || env.ConEmuTask === "{cmd::Cmder}" || TERM_PROGRAM === "Terminus-Sublime" || TERM_PROGRAM === "vscode" || TERM === "xterm-256color" || TERM === "alacritty" || TERM === "rxvt-unicode" || TERM === "rxvt-unicode-256color" || env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
 
-// node_modules/figures/index.js
+// ../../node_modules/.bun/figures@6.1.0/node_modules/figures/index.js
 var common = {
   circleQuestionMark: "(?)",
   questionMarkPrefix: "(?)",
@@ -9842,23 +10405,23 @@ var figures = shouldUseMain ? mainSymbols : fallbackSymbols;
 var figures_default = figures;
 var replacements = Object.entries(specialMainSymbols);
 
-// node_modules/ink-select-input/build/Indicator.js
+// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Indicator.js
 function Indicator({ isSelected = false }) {
   return React.createElement(Box, { marginRight: 1 }, isSelected ? React.createElement(Text, { color: "blue" }, figures_default.pointer) : React.createElement(Text, null, " "));
 }
 var Indicator_default = Indicator;
-// node_modules/ink-select-input/build/Item.js
+// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Item.js
 import * as React2 from "react";
 import { Text as Text2 } from "ink";
 function Item({ isSelected = false, label }) {
   return React2.createElement(Text2, { color: isSelected ? "blue" : undefined }, label);
 }
 var Item_default = Item;
-// node_modules/ink-select-input/build/SelectInput.js
+// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/SelectInput.js
 import { isDeepStrictEqual } from "util";
 import React3, { useState, useEffect, useRef, useCallback } from "react";
 
-// node_modules/to-rotated/index.js
+// ../../node_modules/.bun/to-rotated@1.0.0/node_modules/to-rotated/index.js
 function toRotated(array, steps) {
   if (!Array.isArray(array)) {
     throw new TypeError(`Expected an array, got \`${typeof array}\`.`);
@@ -9880,7 +10443,7 @@ function toRotated(array, steps) {
   ];
 }
 
-// node_modules/ink-select-input/build/SelectInput.js
+// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/SelectInput.js
 import { Box as Box2, useInput } from "ink";
 function SelectInput({ items = [], isFocused = true, initialIndex = 0, indicatorComponent = Indicator_default, itemComponent = Item_default, limit: customLimit, onSelect, onHighlight }) {
   const hasLimit = typeof customLimit === "number" && items.length > customLimit;
@@ -9956,29 +10519,29 @@ function SelectInput({ items = [], isFocused = true, initialIndex = 0, indicator
 var SelectInput_default = SelectInput;
 // src/cli/components/Header.tsx
 import { Box as Box3, Text as Text3 } from "ink";
-import { jsxDEV } from "react/jsx-dev-runtime";
+import { jsx, jsxs } from "react/jsx-runtime";
 function Header({ title = "Hooks", subtitle }) {
-  return /* @__PURE__ */ jsxDEV(Box3, {
+  return /* @__PURE__ */ jsxs(Box3, {
     flexDirection: "column",
     marginBottom: 1,
     children: [
-      /* @__PURE__ */ jsxDEV(Text3, {
+      /* @__PURE__ */ jsx(Text3, {
         bold: true,
         color: "cyan",
         children: title
-      }, undefined, false, undefined, this),
-      subtitle && /* @__PURE__ */ jsxDEV(Text3, {
+      }),
+      subtitle && /* @__PURE__ */ jsx(Text3, {
         dimColor: true,
         children: subtitle
-      }, undefined, false, undefined, this)
+      })
     ]
-  }, undefined, true, undefined, this);
+  });
 }
 
 // src/cli/components/CategorySelect.tsx
 import { Box as Box4, Text as Text4 } from "ink";
 init_registry();
-import { jsxDEV as jsxDEV2 } from "react/jsx-dev-runtime";
+import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
 function CategorySelect({ onSelect, onBack }) {
   const items = CATEGORIES.map((cat) => ({
     label: `${cat} (${getHooksByCategory(cat).length})`,
@@ -9994,28 +10557,28 @@ function CategorySelect({ onSelect, onBack }) {
       onSelect(item.value);
     }
   };
-  return /* @__PURE__ */ jsxDEV2(Box4, {
+  return /* @__PURE__ */ jsxs2(Box4, {
     flexDirection: "column",
     children: [
-      /* @__PURE__ */ jsxDEV2(Box4, {
+      /* @__PURE__ */ jsx2(Box4, {
         marginBottom: 1,
-        children: /* @__PURE__ */ jsxDEV2(Text4, {
+        children: /* @__PURE__ */ jsx2(Text4, {
           bold: true,
           children: "Select a category:"
-        }, undefined, false, undefined, this)
-      }, undefined, false, undefined, this),
-      /* @__PURE__ */ jsxDEV2(SelectInput_default, {
+        })
+      }),
+      /* @__PURE__ */ jsx2(SelectInput_default, {
         items,
         onSelect: handleSelect
-      }, undefined, false, undefined, this)
+      })
     ]
-  }, undefined, true, undefined, this);
+  });
 }
 
 // src/cli/components/DataTable.tsx
 import { useState as useState2 } from "react";
 import { Box as Box5, Text as Text5, useInput as useInput2 } from "ink";
-import { jsxDEV as jsxDEV3 } from "react/jsx-dev-runtime";
+import { jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
 var COL_CHECK = 5;
 var COL_NAME = 18;
 var COL_VERSION = 9;
@@ -10050,18 +10613,18 @@ function DataTable({
       onBack();
     }
   });
-  return /* @__PURE__ */ jsxDEV3(Box5, {
+  return /* @__PURE__ */ jsxs3(Box5, {
     flexDirection: "column",
     children: [
-      /* @__PURE__ */ jsxDEV3(Box5, {
+      /* @__PURE__ */ jsx3(Box5, {
         marginBottom: 1,
-        children: /* @__PURE__ */ jsxDEV3(Text5, {
+        children: /* @__PURE__ */ jsx3(Text5, {
           bold: true,
           children: "Select hooks (up/down to navigate, space/enter to toggle, esc to go back):"
-        }, undefined, false, undefined, this)
-      }, undefined, false, undefined, this),
-      /* @__PURE__ */ jsxDEV3(Box5, {
-        children: /* @__PURE__ */ jsxDEV3(Text5, {
+        })
+      }),
+      /* @__PURE__ */ jsx3(Box5, {
+        children: /* @__PURE__ */ jsxs3(Text5, {
           dimColor: true,
           children: [
             pad("", COL_CHECK),
@@ -10070,11 +10633,11 @@ function DataTable({
             pad("Event", COL_EVENT),
             "Description"
           ]
-        }, undefined, true, undefined, this)
-      }, undefined, false, undefined, this),
-      /* @__PURE__ */ jsxDEV3(Box5, {
+        })
+      }),
+      /* @__PURE__ */ jsx3(Box5, {
         marginBottom: 0,
-        children: /* @__PURE__ */ jsxDEV3(Text5, {
+        children: /* @__PURE__ */ jsxs3(Text5, {
           dimColor: true,
           children: [
             pad("\u2500".repeat(COL_CHECK - 1), COL_CHECK),
@@ -10083,14 +10646,14 @@ function DataTable({
             pad("\u2500".repeat(COL_EVENT - 1), COL_EVENT),
             "\u2500".repeat(COL_DESC)
           ]
-        }, undefined, true, undefined, this)
-      }, undefined, false, undefined, this),
+        })
+      }),
       hooks.map((hook, i) => {
         const isHighlighted = i === cursor;
         const isSelected = selected.has(hook.name);
         const check = isSelected ? "[x]" : "[ ]";
-        return /* @__PURE__ */ jsxDEV3(Box5, {
-          children: /* @__PURE__ */ jsxDEV3(Text5, {
+        return /* @__PURE__ */ jsx3(Box5, {
+          children: /* @__PURE__ */ jsxs3(Text5, {
             bold: isHighlighted,
             inverse: isHighlighted,
             children: [
@@ -10100,62 +10663,62 @@ function DataTable({
               pad(hook.event, COL_EVENT),
               truncate2(hook.description, COL_DESC)
             ]
-          }, undefined, true, undefined, this)
-        }, hook.name, false, undefined, this);
+          })
+        }, hook.name);
       }),
-      /* @__PURE__ */ jsxDEV3(Box5, {
+      /* @__PURE__ */ jsxs3(Box5, {
         marginTop: 1,
         flexDirection: "row",
         gap: 2,
         children: [
-          /* @__PURE__ */ jsxDEV3(Text5, {
+          /* @__PURE__ */ jsx3(Text5, {
             dimColor: true,
             children: "[esc] Back"
-          }, undefined, false, undefined, this),
-          selected.size > 0 && /* @__PURE__ */ jsxDEV3(Text5, {
+          }),
+          selected.size > 0 && /* @__PURE__ */ jsxs3(Text5, {
             color: "green",
             bold: true,
             children: [
               selected.size,
               " selected"
             ]
-          }, undefined, true, undefined, this)
+          })
         ]
-      }, undefined, true, undefined, this),
-      selected.size > 0 && /* @__PURE__ */ jsxDEV3(Box5, {
+      }),
+      selected.size > 0 && /* @__PURE__ */ jsx3(Box5, {
         marginTop: 0,
-        children: /* @__PURE__ */ jsxDEV3(Text5, {
+        children: /* @__PURE__ */ jsxs3(Text5, {
           dimColor: true,
           children: [
             "Selected: ",
             Array.from(selected).join(", ")
           ]
-        }, undefined, true, undefined, this)
-      }, undefined, false, undefined, this),
-      selected.size > 0 && /* @__PURE__ */ jsxDEV3(Box5, {
+        })
+      }),
+      selected.size > 0 && /* @__PURE__ */ jsx3(Box5, {
         marginTop: 1,
-        children: /* @__PURE__ */ jsxDEV3(Text5, {
+        children: /* @__PURE__ */ jsxs3(Text5, {
           children: [
             "Press",
             " ",
-            /* @__PURE__ */ jsxDEV3(Text5, {
+            /* @__PURE__ */ jsx3(Text5, {
               bold: true,
               color: "cyan",
               children: "i"
-            }, undefined, false, undefined, this),
+            }),
             " ",
             "to install selected (",
             selected.size,
             ")"
           ]
-        }, undefined, true, undefined, this)
-      }, undefined, false, undefined, this)
+        })
+      })
     ]
-  }, undefined, true, undefined, this);
+  });
 }
 
 // src/cli/components/HookSelect.tsx
-import { jsxDEV as jsxDEV4 } from "react/jsx-dev-runtime";
+import { jsx as jsx4 } from "react/jsx-runtime";
 function HookSelect({
   hooks,
   selected,
@@ -10163,20 +10726,20 @@ function HookSelect({
   onConfirm,
   onBack
 }) {
-  return /* @__PURE__ */ jsxDEV4(DataTable, {
+  return /* @__PURE__ */ jsx4(DataTable, {
     hooks,
     selected,
     onToggle,
     onConfirm,
     onBack
-  }, undefined, false, undefined, this);
+  });
 }
 
 // src/cli/components/SearchView.tsx
 import { useState as useState4, useEffect as useEffect3 } from "react";
 import { Box as Box6, Text as Text7, useInput as useInput4 } from "ink";
 
-// node_modules/ink-text-input/build/index.js
+// ../../node_modules/.bun/ink-text-input@6.0.0+fa875fef9f949ebd/node_modules/ink-text-input/build/index.js
 import React5, { useState as useState3, useEffect as useEffect2 } from "react";
 import { Text as Text6, useInput as useInput3 } from "ink";
 import chalk from "chalk";
@@ -10270,7 +10833,7 @@ var build_default = TextInput;
 
 // src/cli/components/SearchView.tsx
 init_registry();
-import { jsxDEV as jsxDEV5 } from "react/jsx-dev-runtime";
+import { jsx as jsx5, jsxs as jsxs4 } from "react/jsx-runtime";
 function SearchView({
   selected,
   onToggle,
@@ -10299,62 +10862,62 @@ function SearchView({
       setMode("select");
     }
   });
-  return /* @__PURE__ */ jsxDEV5(Box6, {
+  return /* @__PURE__ */ jsxs4(Box6, {
     flexDirection: "column",
     children: [
-      /* @__PURE__ */ jsxDEV5(Box6, {
+      /* @__PURE__ */ jsxs4(Box6, {
         marginBottom: 1,
         children: [
-          /* @__PURE__ */ jsxDEV5(Text7, {
+          /* @__PURE__ */ jsx5(Text7, {
             bold: true,
             children: "Search: "
-          }, undefined, false, undefined, this),
-          mode === "search" && /* @__PURE__ */ jsxDEV5(build_default, {
+          }),
+          mode === "search" && /* @__PURE__ */ jsx5(build_default, {
             value: query,
             onChange: setQuery,
             placeholder: "Type to search hooks..."
-          }, undefined, false, undefined, this),
-          mode === "select" && /* @__PURE__ */ jsxDEV5(Text7, {
+          }),
+          mode === "select" && /* @__PURE__ */ jsx5(Text7, {
             children: query
-          }, undefined, false, undefined, this)
+          })
         ]
-      }, undefined, true, undefined, this),
-      query.length < 2 && /* @__PURE__ */ jsxDEV5(Text7, {
+      }),
+      query.length < 2 && /* @__PURE__ */ jsx5(Text7, {
         dimColor: true,
         children: "Type at least 2 characters to search"
-      }, undefined, false, undefined, this),
-      query.length >= 2 && results.length === 0 && /* @__PURE__ */ jsxDEV5(Text7, {
+      }),
+      query.length >= 2 && results.length === 0 && /* @__PURE__ */ jsxs4(Text7, {
         dimColor: true,
         children: [
           'No hooks found for "',
           query,
           '"'
         ]
-      }, undefined, true, undefined, this),
-      results.length > 0 && mode === "search" && /* @__PURE__ */ jsxDEV5(Text7, {
+      }),
+      results.length > 0 && mode === "search" && /* @__PURE__ */ jsxs4(Text7, {
         dimColor: true,
         children: [
           "Found ",
           results.length,
           " hook(s) \u2014 press down arrow to browse results"
         ]
-      }, undefined, true, undefined, this),
-      results.length > 0 && mode === "select" && /* @__PURE__ */ jsxDEV5(DataTable, {
+      }),
+      results.length > 0 && mode === "select" && /* @__PURE__ */ jsx5(DataTable, {
         hooks: results,
         selected,
         onToggle,
         onConfirm,
         onBack: () => setMode("search")
-      }, undefined, false, undefined, this)
+      })
     ]
-  }, undefined, true, undefined, this);
+  });
 }
 
 // src/cli/components/InstallProgress.tsx
 import { useState as useState6, useEffect as useEffect5 } from "react";
 import { Box as Box7, Text as Text9 } from "ink";
 
-// node_modules/ink-spinner/build/index.js
+// ../../node_modules/.bun/ink-spinner@5.0.0+fa875fef9f949ebd/node_modules/ink-spinner/build/index.js
 var import_cli_spinners = __toESM(require_cli_spinners(), 1);
 import React7, { useState as useState5, useEffect as useEffect4 } from "react";
 import { Text as Text8 } from "ink";
@@ -10379,7 +10942,7 @@ var build_default2 = Spinner;
 // src/cli/components/InstallProgress.tsx
 init_installer();
 init_registry();
-import { jsxDEV as jsxDEV6 } from "react/jsx-dev-runtime";
+import { jsx as jsx6, jsxs as jsxs5 } from "react/jsx-runtime";
 function InstallProgress({
   hooks,
   overwrite = false,
@@ -10403,55 +10966,55 @@ function InstallProgress({
     };
     install();
   }, [hooks, overwrite]);
-  return /* @__PURE__ */ jsxDEV6(Box7, {
+  return /* @__PURE__ */ jsxs5(Box7, {
     flexDirection: "column",
     children: [
-      /* @__PURE__ */ jsxDEV6(Box7, {
+      /* @__PURE__ */ jsx6(Box7, {
         marginBottom: 1,
-        children: /* @__PURE__ */ jsxDEV6(Text9, {
+        children: /* @__PURE__ */ jsx6(Text9, {
           bold: true,
           children: installing ? `Installing hooks (${current + 1}/${hooks.length})...` : "Installation complete!"
-        }, undefined, false, undefined, this)
-      }, undefined, false, undefined, this),
+        })
+      }),
       hooks.map((name, i) => {
         const result = results[i];
         const isCurrent = i === current && installing;
         const meta = getHook(name);
-        return /* @__PURE__ */ jsxDEV6(Box7, {
+        return /* @__PURE__ */ jsxs5(Box7, {
           flexDirection: "column",
           children: [
-            isCurrent && !result && /* @__PURE__ */ jsxDEV6(Text9, {
+            isCurrent && !result && /* @__PURE__ */ jsxs5(Text9, {
               color: "cyan",
               children: [
-                /* @__PURE__ */ jsxDEV6(build_default2, {
+                /* @__PURE__ */ jsx6(build_default2, {
                   type: "dots"
-                }, undefined, false, undefined, this),
+                }),
                 " ",
                 name
               ]
-            }, undefined, true, undefined, this),
-            result?.success && /* @__PURE__ */ jsxDEV6(Box7, {
+            }),
+            result?.success && /* @__PURE__ */ jsxs5(Box7, {
               flexDirection: "column",
               children: [
-                /* @__PURE__ */ jsxDEV6(Text9, {
+                /* @__PURE__ */ jsxs5(Text9, {
                   color: "green",
                   children: [
                     "\u2713",
                     " ",
                     name
                   ]
-                }, undefined, true, undefined, this),
-                meta && /* @__PURE__ */ jsxDEV6(Text9, {
+                }),
+                meta && /* @__PURE__ */ jsxs5(Text9, {
                   dimColor: true,
                   children: [
                     "  ",
                     meta.event,
                     meta.matcher ? ` [${meta.matcher}]` : ""
                   ]
-                }, undefined, true, undefined, this)
+                })
               ]
-            }, undefined, true, undefined, this),
-            result && !result.success && /* @__PURE__ */ jsxDEV6(Text9, {
+            }),
+            result && !result.success && /* @__PURE__ */ jsxs5(Text9, {
               color: "red",
               children: [
                 "\u2717",
@@ -10460,54 +11023,54 @@ function InstallProgress({
                 " - ",
                 result.error
               ]
-            }, undefined, true, undefined, this),
-            !isCurrent && !result && /* @__PURE__ */ jsxDEV6(Text9, {
+            }),
+            !isCurrent && !result && /* @__PURE__ */ jsxs5(Text9, {
               dimColor: true,
               children: [
                 "\u25CB",
                 " ",
                 name
               ]
-            }, undefined, true, undefined, this)
+            })
           ]
-        }, name, true, undefined, this);
+        }, name);
       }),
-      !installing && /* @__PURE__ */ jsxDEV6(Box7, {
+      !installing && /* @__PURE__ */ jsxs5(Box7, {
         marginTop: 1,
         flexDirection: "column",
         children: [
-          /* @__PURE__ */ jsxDEV6(Text9, {
+          /* @__PURE__ */ jsxs5(Text9, {
             children: [
-              /* @__PURE__ */ jsxDEV6(Text9, {
+              /* @__PURE__ */ jsxs5(Text9, {
                 color: "green",
                 children: [
                   results.filter((r) => r.success).length,
                   " installed"
                 ]
-              }, undefined, true, undefined, this),
-              results.some((r) => !r.success) && /* @__PURE__ */ jsxDEV6(Text9, {
+              }),
+              results.some((r) => !r.success) && /* @__PURE__ */ jsxs5(Text9, {
                 color: "red",
                 children: [
                   ", ",
                   results.filter((r) => !r.success).length,
                   " failed"
                 ]
-              }, undefined, true, undefined, this)
+              })
             ]
-          }, undefined, true, undefined, this),
-          /* @__PURE__ */ jsxDEV6(Text9, {
+          }),
+          /* @__PURE__ */ jsx6(Text9, {
             dimColor: true,
             children: "Hooks installed to .hooks/ and registered in ~/.claude/settings.json"
-          }, undefined, false, undefined, this)
+          })
         ]
-      }, undefined, true, undefined, this)
+      })
     ]
-  }, undefined, true, undefined, this);
+  });
 }
 
 // src/cli/components/App.tsx
 init_registry();
-import { jsxDEV as jsxDEV7 } from "react/jsx-dev-runtime";
+import { jsx as jsx7, jsxs as jsxs6 } from "react/jsx-runtime";
 function App({ initialHooks, overwrite = false }) {
   const { exit } = useApp();
   const [view, setView] = useState7(initialHooks?.length ? "installing" : "main");
@@ -10554,44 +11117,44 @@ function App({ initialHooks, overwrite = false }) {
       setView(item.value);
     }
   };
-  return /* @__PURE__ */ jsxDEV7(Box8, {
+  return /* @__PURE__ */ jsxs6(Box8, {
     flexDirection: "column",
     padding: 1,
     children: [
-      /* @__PURE__ */ jsxDEV7(Header, {
+      /* @__PURE__ */ jsx7(Header, {
         title: "Hooks",
         subtitle: "Install Claude Code hooks for your project"
-      }, undefined, false, undefined, this),
-      view === "main" && /* @__PURE__ */ jsxDEV7(Box8, {
+      }),
+      view === "main" && /* @__PURE__ */ jsxs6(Box8, {
         flexDirection: "column",
         children: [
-          /* @__PURE__ */ jsxDEV7(Box8, {
+          /* @__PURE__ */ jsx7(Box8, {
             marginBottom: 1,
-            children: /* @__PURE__ */ jsxDEV7(Text10, {
+            children: /* @__PURE__ */ jsx7(Text10, {
               children: "What would you like to do?"
-            }, undefined, false, undefined, this)
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV7(SelectInput_default, {
+            })
+          }),
+          /* @__PURE__ */ jsx7(SelectInput_default, {
             items: mainMenuItems,
             onSelect: handleMainSelect
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV7(Box8, {
+          }),
+          /* @__PURE__ */ jsx7(Box8, {
             marginTop: 1,
-            children: /* @__PURE__ */ jsxDEV7(Text10, {
+            children: /* @__PURE__ */ jsx7(Text10, {
               dimColor: true,
               children: "Press q to quit"
-            }, undefined, false, undefined, this)
-          }, undefined, false, undefined, this)
+            })
+          })
         ]
-      }, undefined, true, undefined, this),
-      view === "browse" && !category && /* @__PURE__ */ jsxDEV7(CategorySelect, {
+      }),
+      view === "browse" && !category && /* @__PURE__ */ jsx7(CategorySelect, {
         onSelect: (cat) => {
           setCategory(cat);
           setView("hooks");
         },
         onBack: () => setView("main")
-      }, undefined, false, undefined, this),
-      view === "hooks" && category && /* @__PURE__ */ jsxDEV7(HookSelect, {
+      }),
+      view === "hooks" && category && /* @__PURE__ */ jsx7(HookSelect, {
         hooks: getHooksByCategory(category),
         selected,
         onToggle: handleToggle,
@@ -10600,57 +11163,57 @@ function App({ initialHooks, overwrite = false }) {
           setCategory(null);
           setView("browse");
         }
-      }, undefined, false, undefined, this),
-      view === "search" && /* @__PURE__ */ jsxDEV7(SearchView, {
+      }),
+      view === "search" && /* @__PURE__ */ jsx7(SearchView, {
         selected,
         onToggle: handleToggle,
         onConfirm: handleConfirm,
         onBack: () => setView("main")
-      }, undefined, false, undefined, this),
-      view === "installing" && /* @__PURE__ */ jsxDEV7(InstallProgress, {
+      }),
+      view === "installing" && /* @__PURE__ */ jsx7(InstallProgress, {
         hooks: Array.from(selected),
         overwrite,
         onComplete: handleComplete
-      }, undefined, false, undefined, this),
-      view === "done" && /* @__PURE__ */ jsxDEV7(Box8, {
+      }),
+      view === "done" && /* @__PURE__ */ jsxs6(Box8, {
         flexDirection: "column",
         children: [
-          /* @__PURE__ */ jsxDEV7(Box8, {
+          /* @__PURE__ */ jsx7(Box8, {
             marginBottom: 1,
-            children: /* @__PURE__ */ jsxDEV7(Text10, {
+            children: /* @__PURE__ */ jsx7(Text10, {
               bold: true,
               color: "green",
               children: "Installation complete!"
-            }, undefined, false, undefined, this)
-          }, undefined, false, undefined, this),
-          results.filter((r) => r.success).length > 0 && /* @__PURE__ */ jsxDEV7(Box8, {
+            })
+          }),
+          results.filter((r) => r.success).length > 0 && /* @__PURE__ */ jsxs6(Box8, {
             flexDirection: "column",
             marginBottom: 1,
             children: [
-              /* @__PURE__ */ jsxDEV7(Text10, {
+              /* @__PURE__ */ jsx7(Text10, {
                 bold: true,
                 children: "Installed:"
-              }, undefined, false, undefined, this),
-              results.filter((r) => r.success).map((r) => /* @__PURE__ */ jsxDEV7(Text10, {
+              }),
+              results.filter((r) => r.success).map((r) => /* @__PURE__ */ jsxs6(Text10, {
                 color: "green",
                 children: [
                   "\u2713",
                   " ",
                   r.hook
                 ]
-              }, r.hook, true, undefined, this))
+              }, r.hook))
             ]
-          }, undefined, true, undefined, this),
-          results.filter((r) => !r.success).length > 0 && /* @__PURE__ */ jsxDEV7(Box8, {
+          }),
+          results.filter((r) => !r.success).length > 0 && /* @__PURE__ */ jsxs6(Box8, {
             flexDirection: "column",
             marginBottom: 1,
             children: [
-              /* @__PURE__ */ jsxDEV7(Text10, {
+              /* @__PURE__ */ jsx7(Text10, {
                 bold: true,
                 color: "red",
                 children: "Failed:"
-              }, undefined, false, undefined, this),
-              results.filter((r) => !r.success).map((r) => /* @__PURE__ */ jsxDEV7(Text10, {
+              }),
+              results.filter((r) => !r.success).map((r) => /* @__PURE__ */ jsxs6(Text10, {
                 color: "red",
                 children: [
                   "\u2717",
@@ -10659,61 +11222,61 @@ function App({ initialHooks, overwrite = false }) {
                   ": ",
                   r.error
                 ]
-              }, r.hook, true, undefined, this))
+              }, r.hook))
             ]
-          }, undefined, true, undefined, this),
-          /* @__PURE__ */ jsxDEV7(Box8, {
+          }),
+          /* @__PURE__ */ jsxs6(Box8, {
             marginTop: 1,
             flexDirection: "column",
             children: [
-              /* @__PURE__ */ jsxDEV7(Text10, {
+              /* @__PURE__ */ jsx7(Text10, {
                 bold: true,
                 children: "What happened:"
-              }, undefined, false, undefined, this),
-              /* @__PURE__ */ jsxDEV7(Text10, {
+              }),
+              /* @__PURE__ */ jsx7(Text10, {
                 children: "1. Hook source copied to .hooks/"
-              }, undefined, false, undefined, this),
-              /* @__PURE__ */ jsxDEV7(Text10, {
+              }),
+              /* @__PURE__ */ jsx7(Text10, {
                 children: "2. Hook registered in ~/.claude/settings.json"
-              }, undefined, false, undefined, this),
-              /* @__PURE__ */ jsxDEV7(Text10, {
+              }),
+              /* @__PURE__ */ jsx7(Text10, {
                 children: "3. Ready to use in Claude Code sessions"
-              }, undefined, false, undefined, this)
+              })
             ]
-          }, undefined, true, undefined, this),
-          /* @__PURE__ */ jsxDEV7(Box8, {
+          }),
+          /* @__PURE__ */ jsxs6(Box8, {
             marginTop: 1,
             flexDirection: "column",
             children: [
-              /* @__PURE__ */ jsxDEV7(Text10, {
+              /* @__PURE__ */ jsx7(Text10, {
                 bold: true,
                 children: "Next steps:"
-              }, undefined, false, undefined, this),
-              /* @__PURE__ */ jsxDEV7(Text10, {
+              }),
+              /* @__PURE__ */ jsx7(Text10, {
                 dimColor: true,
                 children: "  hooks list --registered  Check active hooks"
-              }, undefined, false, undefined, this),
-              /* @__PURE__ */ jsxDEV7(Text10, {
+              }),
+              /* @__PURE__ */ jsxs6(Text10, {
                 dimColor: true,
                 children: [
                   "  hooks info ",
                   "<name>",
                   "       View hook details"
                 ]
-              }, undefined, true, undefined, this)
+              })
             ]
-          }, undefined, true, undefined, this),
-          /* @__PURE__ */ jsxDEV7(Box8, {
+          }),
+          /* @__PURE__ */ jsx7(Box8, {
             marginTop: 1,
-            children: /* @__PURE__ */ jsxDEV7(Text10, {
+            children: /* @__PURE__ */ jsx7(Text10, {
               dimColor: true,
               children: "Press q to exit"
-            }, undefined, false, undefined, this)
-          }, undefined, false, undefined, this)
+            })
+          })
         ]
-      }, undefined, true, undefined, this)
+      })
     ]
-  }, undefined, true, undefined, this);
+  });
 }
 
 // src/cli/index.tsx
@@ -10725,10 +11288,10 @@ init_manifest();
 init_resolve();
 init_store();
 init_semver();
-import { jsxDEV as jsxDEV8 } from "react/jsx-dev-runtime";
-var __dirname4 = dirname6(fileURLToPath4(import.meta.url));
-var pkgPath = existsSync12(join12(__dirname4, "..", "package.json")) ? join12(__dirname4, "..", "package.json") : join12(__dirname4, "..", "..", "package.json");
-var pkg2 = JSON.parse(readFileSync10(pkgPath, "utf-8"));
+import { jsx as jsx8 } from "react/jsx-runtime";
+var __dirname4 = dirname8(fileURLToPath5(import.meta.url));
+var pkgPath = existsSync13(join14(__dirname4, "..", "package.json")) ? join14(__dirname4, "..", "package.json") : join14(__dirname4, "..", "..", "package.json");
+var pkg2 = JSON.parse(readFileSync12(pkgPath, "utf-8"));
 var program2 = new Command;
 function resolveScope(options) {
   if (options.project)
@@ -10762,7 +11325,7 @@ function projectLogRows2(rows) {
 function readToken(tokenFile) {
   if (tokenFile) {
     try {
-      return readFileSync10(tokenFile, "utf-8").trim();
+      return readFileSync12(tokenFile, "utf-8").trim();
     } catch {
       return;
     }
@@ -10823,7 +11386,7 @@ function suggestHooks(name, max = 3) {
 }
 program2.name("hooks").description("Install hooks for AI coding agents").version(pkg2.version);
 program2.command("interactive", { isDefault: true }).alias("i").description("Interactive hook browser").action(() => {
-  render(/* @__PURE__ */ jsxDEV8(App, {}, undefined, false, undefined, this));
+  render(/* @__PURE__ */ jsx8(App, {}));
 });
 program2.command("init").description("Register a new agent profile with a unique ID").option("-a, --agent <type>", "Agent type: claude, gemini, custom", "claude").option("-n, --name <name>", "Optional display name for the agent").option("-j, --json", "Output as JSON", false).option("--cloudflare", "Configure a remote registry (Cloudflare worker)", false).option("--api-url <url>", "Remote registry API URL (with --cloudflare)").option("--api-key <ref>", "Vault key NAME for the registry API key (never the value; with --cloudflare)").action(async (options) => {
   if (options.cloudflare) {
@@ -10895,11 +11458,11 @@ program2.command("run").argument("<hook>", "Hook to run").option("--profile <id>
     process.exit(1);
   }
   const hookScript = resolveScriptPath2(hook);
-  if (!hookScript || !existsSync12(hookScript)) {
+  if (!hookScript || !existsSync13(hookScript)) {
     console.error(JSON.stringify({ error: `Hook script not found: ${hookScript ?? hook}` }));
     process.exit(1);
   }
-  const content = readFileSync10(hookScript);
+  const content = readFileSync12(hookScript);
   const sha = sha256Of2(content);
   const check = checkScriptHash2(hook, sha);
   if (!check.ok) {
@@ -11005,7 +11568,7 @@ program2.command("run").argument("<hook>", "Hook to run").option("--profile <id>
     process.stderr.write(stderr);
   process.exit(exitCode);
 });
-program2.command("install").alias("add").argument("[hooks...]", "Hooks to install").option("-o, --overwrite", "Overwrite existing hooks", false).option("-a, --all", "Install all available hooks", false).option("-c, --category <category>", "Install all hooks in a category").option("-g, --global", "Install globally (~/.claude/settings.json)", false).option("-p, --project", "Install for current project (.claude/settings.json)", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith, all (default: claude)", "claude").option("--profile <id>", "Agent profile ID to scope hooks to").option("--dry-run", "Preview what would be installed without writing to settings", false).option("--apply-codewith", "Explicitly append Codewith TOML to a config file (prefer open-configs for managed configs)", false).option("--codewith-config <path>", "Explicit Codewith config path required with --apply-codewith").option("-j, --json", "Output as JSON", false).description("Install one or more hooks (registry names, local paths, git URLs, manifest URLs, or <name>@<version> pinned installs)").action(async (hooks, options) => {
+program2.command("install").alias("add").argument("[hooks...]", "Hooks to install").option("-o, --overwrite", "Overwrite existing hooks", false).option("-a, --all", "Install all available hooks", false).option("-c, --category <category>", "Install all hooks in a category").option("-g, --global", "Install globally (~/.claude/settings.json)", false).option("-p, --project", "Install for current project (.claude/settings.json)", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith, all (default: claude)", "claude").option("--profile <id>", "Agent profile ID to scope hooks to").option("--dry-run", "Preview what would be installed without writing to settings", false).option("--apply-codewith", "Explicitly append Codewith TOML to a config file (prefer configs for managed configs)", false).option("--codewith-config <path>", "Explicit Codewith config path required with --apply-codewith").option("-j, --json", "Output as JSON", false).description("Install one or more hooks (registry names, local paths, git URLs, manifest URLs, or <name>@<version> pinned installs)").action(async (hooks, options) => {
   const scope = resolveScope(options);
   const target = resolveTarget(options);
   let toInstall = hooks;
@@ -11026,7 +11589,7 @@ program2.command("install").alias("add").argument("[hooks...]", "Hooks to instal
     toInstall = getHooksByCategory(category).map((h) => h.name);
   }
   if (toInstall.length === 0) {
-    render(/* @__PURE__ */ jsxDEV8(App, {}, undefined, false, undefined, this));
+    render(/* @__PURE__ */ jsx8(App, {}));
     return;
   }
   if (options.applyCodewith && (target === "codewith" || target === "all") && !options.codewithConfig) {
@@ -11193,7 +11756,7 @@ Dry run \u2014 would install (${scope}, ${target}):
     return;
   }
   const successCount = results.filter((r) => r.success).length;
-  const settingsFile = target === "codewith" ? options.applyCodewith ? options.codewithConfig : "TOML fragment only (open-configs should apply)" : scope === "project" ? ".claude/settings.json" : "~/.claude/settings.json";
+  const settingsFile = target === "codewith" ? options.applyCodewith ? options.codewithConfig : "TOML fragment only (configs should apply)" : scope === "project" ? ".claude/settings.json" : "~/.claude/settings.json";
   console.log(chalk2.bold(`
 Installing hooks (${scope}, ${target})...
 `));
@@ -11467,7 +12030,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
   const settingsPath = getSettingsPath(scope);
   const issues = [];
   const healthy = [];
-  const settingsExist = existsSync12(settingsPath);
+  const settingsExist = existsSync13(settingsPath);
   if (!settingsExist) {
     issues.push({ hook: "(settings)", issue: `${settingsPath} not found`, severity: "warning" });
   }
@@ -11475,7 +12038,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
   let wiringCount = 0;
   if (settingsExist) {
     try {
-      const settings = JSON.parse(readFileSync10(settingsPath, "utf-8"));
+      const settings = JSON.parse(readFileSync12(settingsPath, "utf-8"));
       wiringCount = countSettingsWiring(settings);
     } catch {}
   }
@@ -11484,7 +12047,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
     const meta = custom ? resolveHookMeta(name) : getHook(name);
     let hookHealthy = true;
     if (custom) {
-      if (!existsSync12(custom.scriptPath)) {
+      if (!existsSync13(custom.scriptPath)) {
         issues.push({ hook: name, issue: `Custom hook script missing: ${custom.scriptPath}`, severity: "error" });
         hookHealthy = false;
       }
@@ -11495,15 +12058,15 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
         continue;
       }
       const hookDir = getHookPath(name);
-      const hookScript = join12(hookDir, "src", "hook.ts");
-      if (!existsSync12(hookScript)) {
+      const hookScript = join14(hookDir, "src", "hook.ts");
+      if (!existsSync13(hookScript)) {
         issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
         hookHealthy = false;
       }
     }
     if (meta && settingsExist) {
       try {
-        const settings = JSON.parse(readFileSync10(settingsPath, "utf-8"));
+        const settings = JSON.parse(readFileSync12(settingsPath, "utf-8"));
         if (!hookRegisteredInSettings(settings, name, meta.event, meta.matcher)) {
           const eventName = meta.event.split(":")[0];
           issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
@@ -11670,10 +12233,10 @@ program2.command("docs").argument("[hook]", "Hook name (shows general docs if om
       return;
     }
     const hookPath = getHookPath(hook);
-    const readmePath = join12(hookPath, "README.md");
+    const readmePath = join14(hookPath, "README.md");
     let readme = "";
-    if (existsSync12(readmePath)) {
-      readme = readFileSync10(readmePath, "utf-8");
+    if (existsSync13(readmePath)) {
+      readme = readFileSync12(readmePath, "utf-8");
     }
     if (options.json) {
       console.log(JSON.stringify({ ...meta, readme }));
@@ -11727,7 +12290,7 @@ ${meta.displayName} v${meta.version}
     installation: {
       global: "hooks install gitguard",
       project: "hooks install gitguard --project",
-      codewith: "hooks install session-start --target codewith  # emits TOML for open-configs to apply",
+      codewith: "hooks install session-start --target codewith  # emits TOML for configs to apply",
       category: 'hooks install --category "Git Safety"',
       all: "hooks install --all"
     },
@@ -11870,9 +12433,9 @@ program2.command("profile-import").argument("<file>", "JSON file to import profi
   if (file === "-") {
     raw = await new Response(Bun.stdin.stream()).text();
   } else {
-    const { readFileSync: readFileSync11 } = await import("fs");
+    const { readFileSync: readFileSync13 } = await import("fs");
     try {
-      raw = readFileSync11(file, "utf-8");
+      raw = readFileSync13(file, "utf-8");
     } catch {
       if (options.json) {
         console.log(JSON.stringify({ error: `Cannot read file: ${file}` }));