@hasna/hooks 0.6.8 → 0.7.2

package/bin/index.js

@@ -2266,6 +2266,16 @@ var init_registry = __esm(() => {
       matcher: "",
       tags: ["errors", "failures", "logging", "debugging"]
     },
+    {
+      name: "spiral-detector",
+      displayName: "Spiral Detector",
+      description: "Interrupts sessions after five consecutive identical command failures",
+      version: "0.1.0",
+      category: "Observability",
+      event: "PostToolUse",
+      matcher: "",
+      tags: ["spiral", "failures", "retries", "safety", "interrupt"]
+    },
     {
       name: "stylescheck",
       displayName: "Styles Check",
@@ -4059,6 +4069,280 @@ var require_cli_spinners = __commonJS((exports, module) => {
   module.exports = spinners;
 });
 
+// ../contracts/dist/client/transport.js
+import { readFileSync, statSync } from "fs";
+import { join as join2 } from "path";
+function envToken(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function clientTransportEnvKeys(name) {
+  const envSegment = envToken(name);
+  return {
+    apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
+    apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
+  };
+}
+function credentialOverrideEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
+}
+function homeDir(env) {
+  const home = env.HOME?.trim();
+  return home ? home : null;
+}
+function credentialDiskSources(name, env) {
+  return profileDiskSources(name, env, null);
+}
+function profileDiskSources(name, env, profile) {
+  const home = homeDir(env);
+  if (!home || !SAFE_APP_SLUG.test(name))
+    return [];
+  const stem = profile ? `${name}.${profile}` : name;
+  const configStem = profile ? `${name}-${profile}` : name;
+  return [
+    join2(home, HASNA_STATE_DIR, FLEET_CREDENTIAL_DIR, `${stem}.env`),
+    join2(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}-cloud.env`)
+  ];
+}
+function parseEnvFile(text) {
+  const values = new Map;
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#"))
+      continue;
+    const withoutExport = line.startsWith("export ") ? line.slice("export ".length).trim() : line;
+    const equals = withoutExport.indexOf("=");
+    if (equals <= 0)
+      continue;
+    const key = withoutExport.slice(0, equals).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+      continue;
+    let value = withoutExport.slice(equals + 1).trim();
+    const quote = value[0];
+    if (quote === '"' || quote === "'") {
+      if (value.length < 2 || !value.endsWith(quote))
+        continue;
+      value = value.slice(1, -1);
+    }
+    if (value.length === 0)
+      continue;
+    values.set(key, value);
+  }
+  return values;
+}
+function readAppConfigFile(path) {
+  let text;
+  try {
+    const stats = statSync(path);
+    if (!stats.isFile() || stats.size > MAX_CREDENTIAL_FILE_BYTES)
+      return null;
+    text = readFileSync(path, "utf8");
+  } catch {
+    return null;
+  }
+  return parseEnvFile(text);
+}
+function readCredentialFile(path, apiKeyKeys) {
+  const values = readAppConfigFile(path);
+  if (!values)
+    return null;
+  for (const key of apiKeyKeys) {
+    const value = values.get(key)?.trim();
+    if (value)
+      return value;
+  }
+  return null;
+}
+function assertUsableCredential(appName, source, value) {
+  if (!ILLEGAL_IN_HEADER_VALUE.test(value))
+    return;
+  throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
+}
+function sealCredential(fields) {
+  const { apiKey } = fields;
+  const visible = {
+    tier: fields.tier,
+    source: fields.source,
+    deliberate: fields.deliberate,
+    deprecated: fields.deprecated,
+    diskCandidates: Object.freeze([...fields.diskCandidates]),
+    warning: fields.warning
+  };
+  const sealed = { ...visible };
+  Object.defineProperty(sealed, "apiKey", {
+    value: apiKey,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  Object.defineProperty(sealed, INSPECT_CUSTOM, {
+    value: () => ({ ...visible, apiKey: "[redacted]" }),
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  Object.defineProperty(sealed, CREDENTIAL_SEAL, {
+    value: true,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  return Object.freeze(sealed);
+}
+function firstEnvValue(env, keys) {
+  for (const key of keys) {
+    const value = env[key]?.trim();
+    if (value)
+      return { key, value };
+  }
+  return null;
+}
+function deprecationNotified() {
+  const host = globalThis;
+  const existing = host[DEPRECATION_REGISTRY];
+  if (existing instanceof Set)
+    return existing;
+  const created = new Set;
+  host[DEPRECATION_REGISTRY] = created;
+  return created;
+}
+function defaultDeprecationSink(message) {
+  if (typeof process !== "undefined" && process.stderr) {
+    process.stderr.write(`${message}
+`);
+  }
+}
+function resolveCredential(name, env, options = {}) {
+  const { apiKeyKeys } = clientTransportEnvKeys(name);
+  const diskPaths = credentialDiskSources(name, env);
+  const explicitKey = options.apiKey?.trim();
+  if (explicitKey) {
+    assertUsableCredential(name, "the explicit apiKey argument", explicitKey);
+    return sealCredential({
+      apiKey: explicitKey,
+      tier: "argument",
+      source: "explicit apiKey argument",
+      deliberate: true,
+      deprecated: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const overrideKeyName = credentialOverrideEnvKey(name);
+  const overrideRaw = env[overrideKeyName];
+  if (overrideRaw !== undefined) {
+    const override = overrideRaw.trim();
+    if (!override) {
+      throw new CredentialResolutionError(name, `${overrideKeyName} is set but empty. It is a deliberate override, so it is not resolved around: ` + `either give it a real key or unset it to fall back to the credential on disk.`, [overrideKeyName]);
+    }
+    assertUsableCredential(name, overrideKeyName, override);
+    return sealCredential({
+      apiKey: override,
+      tier: "override",
+      source: overrideKeyName,
+      deliberate: true,
+      deprecated: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const profile = options.profile?.trim() || env[CREDENTIAL_PROFILE_ENV_KEY]?.trim();
+  if (profile) {
+    const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
+    if (!SAFE_PROFILE.test(profile)) {
+      throw new CredentialResolutionError(name, `Profile name from ${profileSource} is not usable in a path. ` + `Use letters, digits, dot, dash, or underscore.`, [profileSource]);
+    }
+    const paths = profileDiskSources(name, env, profile);
+    for (const path of paths) {
+      const value = readCredentialFile(path, apiKeyKeys);
+      if (value) {
+        assertUsableCredential(name, path, value);
+        return sealCredential({
+          apiKey: value,
+          tier: "profile",
+          source: path,
+          deliberate: true,
+          deprecated: false,
+          diskCandidates: paths,
+          warning: null
+        });
+      }
+    }
+    throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
+  }
+  const diskHits = diskPaths.map((path) => ({ path, value: readCredentialFile(path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  if (diskHits.length > 0) {
+    const winner = diskHits[0];
+    assertUsableCredential(name, winner.path, winner.value);
+    const divergentSources = [
+      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.path),
+      ...(() => {
+        const legacyHit = firstEnvValue(env, apiKeyKeys);
+        return legacyHit && legacyHit.value !== winner.value ? [legacyHit.key] : [];
+      })()
+    ];
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential({
+      apiKey: winner.value,
+      tier: "disk",
+      source: winner.path,
+      deliberate: false,
+      deprecated: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  const legacy = firstEnvValue(env, apiKeyKeys);
+  if (legacy) {
+    assertUsableCredential(name, legacy.key, legacy.value);
+    const where = diskPaths.length > 0 ? `Put the current key in ${diskPaths[0]} \u2014 it is re-read on every call, so rotations take effect immediately.` : `This environment has no HOME, so no credential file could be consulted at all; the disk tier is ` + `unavailable here and this process will keep using the environment snapshot.`;
+    const message = `[${name}] DEPRECATED: the API key came from ${legacy.key} in this process's environment. ` + `Environment variables are a snapshot taken when this process started, so a shell that started ` + `before a key rotation keeps using the old key until it exits. ${where}`;
+    const sink = options.onDeprecation ?? defaultDeprecationSink;
+    const notified = deprecationNotified();
+    if (!notified.has(name)) {
+      notified.add(name);
+      sink(message);
+    }
+    return sealCredential({
+      apiKey: legacy.value,
+      tier: "legacy-env",
+      source: legacy.key,
+      deliberate: false,
+      deprecated: true,
+      diskCandidates: diskPaths,
+      warning: message
+    });
+  }
+  return null;
+}
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, HASNA_STATE_DIR = ".hasna", FLEET_CREDENTIAL_DIR = "cloud", CONFIG_DIR = ".config", CONFIG_NAMESPACE = "hasna", MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, INSPECT_CUSTOM, CREDENTIAL_SEAL, DEPRECATION_REGISTRY, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS;
+var init_transport = __esm(() => {
+  CredentialResolutionError = class CredentialResolutionError extends Error {
+    appName;
+    attempted;
+    constructor(appName, message, attempted) {
+      super(message);
+      this.name = "CredentialResolutionError";
+      this.appName = appName;
+      this.attempted = attempted;
+    }
+  };
+  MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
+  SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+  SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+  ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
+  INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+  CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
+  DEPRECATION_REGISTRY = Symbol.for("hasna:contracts:credentialDeprecationNotices");
+  IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+  AUTHORITY_OVERRIDE_HEADERS = new Set([
+    "host",
+    ":authority",
+    "forwarded",
+    "x-forwarded-host",
+    "x-original-host"
+  ]);
+});
+
 // src/config.ts
 var exports_config = {};
 __export(exports_config, {
@@ -4071,43 +4355,43 @@ __export(exports_config, {
   getCustomHooksDir: () => getCustomHooksDir,
   getConfigPath: () => getConfigPath
 });
-import { existsSync as existsSync2, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { join as join3 } from "path";
 import { homedir as homedir2 } from "os";
 function getHooksDataDir() {
   const explicit = process.env.HASNA_HOOKS_DATA_DIR ?? process.env.HOOKS_DATA_DIR;
   if (explicit)
     return explicit;
-  return join2(homedir2(), ".hasna", "hooks");
+  return join3(homedir2(), ".hasna", "hooks");
 }
 function getCustomHooksDir() {
-  return join2(getHooksDataDir(), "hooks");
+  return join3(getHooksDataDir(), "hooks");
 }
 function getLockPath() {
   const explicit = process.env.HASNA_HOOKS_LOCK_PATH ?? process.env.HOOKS_LOCK_PATH;
   if (explicit)
     return explicit;
-  return join2(getHooksDataDir(), "hooks.lock");
+  return join3(getHooksDataDir(), "hooks.lock");
 }
 function getConfigPath() {
   const explicit = process.env.HASNA_HOOKS_CONFIG_PATH ?? process.env.HOOKS_CONFIG_PATH;
   if (explicit)
     return explicit;
-  return join2(getHooksDataDir(), "config.json");
+  return join3(getHooksDataDir(), "config.json");
 }
 function readConfig() {
   try {
     const path = getConfigPath();
     if (!existsSync2(path))
       return {};
-    return JSON.parse(readFileSync(path, "utf-8"));
+    return JSON.parse(readFileSync2(path, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeConfig(config) {
   const path = getConfigPath();
-  mkdirSync(join2(path, ".."), { recursive: true });
+  mkdirSync(join3(path, ".."), { recursive: true });
   writeFileSync(path, JSON.stringify(config, null, 2) + `
 `, "utf-8");
   return path;
@@ -4120,9 +4404,11 @@ function resolveApiUrl() {
   return cfg.api_url ? cfg.api_url.replace(/\/+$/, "") : undefined;
 }
 function resolveApiKey() {
-  return process.env.HASNA_HOOKS_API_KEY ?? process.env.HOOKS_API_KEY;
+  return resolveCredential("hooks", process.env)?.apiKey;
 }
-var init_config = () => {};
+var init_config = __esm(() => {
+  init_transport();
+});
 
 // src/lib/semver.ts
 var NUMERIC_ID = "(0|[1-9]\\d{0,15})", ALNUM_ID = "\\d*[A-Za-z-][0-9A-Za-z-]*", SEMVER_PATTERN;
@@ -4148,8 +4434,8 @@ __export(exports_manifest, {
   ScriptContainmentError: () => ScriptContainmentError,
   HOOK_NAME_RE: () => HOOK_NAME_RE
 });
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync, realpathSync, writeFileSync as writeFileSync2 } from "fs";
-import { basename, dirname, isAbsolute, join as join3, normalize, resolve, sep } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync, realpathSync, writeFileSync as writeFileSync2 } from "fs";
+import { basename, dirname, isAbsolute, join as join4, normalize, resolve, sep } from "path";
 import { z } from "zod";
 function parseManifest(json) {
   const parsed = JSON.parse(json);
@@ -4182,7 +4468,7 @@ function realpathNearest(path) {
     tail.unshift(basename(cur));
     cur = parent;
   }
-  return join3(realpathSync(cur), ...tail);
+  return join4(realpathSync(cur), ...tail);
 }
 function assertContainedReal(root, target, raw) {
   const rootReal = realpathSync(root);
@@ -4215,25 +4501,25 @@ function resolveScript(manifest, manifestDir) {
   if (isInlineScript(manifest))
     return { path: scriptRelFor(manifest), content: manifest.script };
   const rel = scriptRelFor(manifest);
-  const resolved = assertContained(join3(manifestDir, rel), manifestDir, manifest.script);
+  const resolved = assertContained(join4(manifestDir, rel), manifestDir, manifest.script);
   if (!existsSync3(resolved)) {
     throw new Error(`manifest script file not found: ${resolved}`);
   }
-  return { path: rel, content: readFileSync2(resolved, "utf-8") };
+  return { path: rel, content: readFileSync3(resolved, "utf-8") };
 }
 function customHookDir(name) {
-  return join3(getCustomHooksDir(), shortManifestName(name));
+  return join4(getCustomHooksDir(), shortManifestName(name));
 }
 function readCustomManifest(name) {
   const dir = customHookDir(name);
-  const manifestPath = join3(dir, "manifest.json");
+  const manifestPath = join4(dir, "manifest.json");
   if (!existsSync3(manifestPath))
     return;
   try {
-    const manifest = parseManifest(readFileSync2(manifestPath, "utf-8"));
+    const manifest = parseManifest(readFileSync3(manifestPath, "utf-8"));
     const script = resolveScript(manifest, dir);
     const scriptIsInline = isInlineScript(manifest);
-    return { manifest, scriptPath: join3(dir, script.path), scriptContent: script.content, scriptIsInline };
+    return { manifest, scriptPath: join4(dir, script.path), scriptContent: script.content, scriptIsInline };
   } catch (err) {
     if (err instanceof ScriptContainmentError)
       throw err;
@@ -4257,7 +4543,7 @@ function writeCustomHook(name, manifest, scriptContent, scriptRelPath) {
   if (isAbsolute(scriptRelPath)) {
     throw new ScriptContainmentError(scriptRelPath, dir);
   }
-  const scriptPath = scriptRelPath.includes("/") ? join3(dir, scriptRelPath) : join3(dir, scriptRelPath);
+  const scriptPath = scriptRelPath.includes("/") ? join4(dir, scriptRelPath) : join4(dir, scriptRelPath);
   assertContainedLexical(scriptPath, dir, scriptRelPath);
   mkdirSync2(dir, { recursive: true });
   assertContainedReal(dir, scriptPath, scriptRelPath);
@@ -4265,7 +4551,7 @@ function writeCustomHook(name, manifest, scriptContent, scriptRelPath) {
   if (scriptDir !== dir)
     mkdirSync2(scriptDir, { recursive: true });
   writeFileSync2(scriptPath, scriptContent, "utf-8");
-  writeFileSync2(join3(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + `
+  writeFileSync2(join4(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + `
 `, "utf-8");
   return { dir, scriptPath };
 }
@@ -4309,14 +4595,14 @@ __export(exports_resolve, {
   resolveHook: () => resolveHook,
   resolveBundledHooksDir: () => resolveBundledHooksDir
 });
-import { dirname as dirname2, join as join4 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 import { existsSync as existsSync4 } from "fs";
 import { fileURLToPath } from "url";
 function resolveBundledHooksDir(moduleDir = dirname2(fileURLToPath(import.meta.url))) {
-  const sourceLayout = join4(moduleDir, "..", "..", "hooks");
-  if (existsSync4(join4(sourceLayout, "hook-gitguard")))
+  const sourceLayout = join5(moduleDir, "..", "..", "hooks");
+  if (existsSync4(join5(sourceLayout, "hook-gitguard")))
     return sourceLayout;
-  return join4(moduleDir, "..", "hooks");
+  return join5(moduleDir, "..", "hooks");
 }
 function resolveHookDir(name) {
   const custom = readCustomManifest(name);
@@ -4327,10 +4613,10 @@ function resolveHookDir(name) {
     return;
   const short = shortManifestName(name);
   const bundledBase = resolveBundledHooksDir();
-  const direct = join4(bundledBase, short);
+  const direct = join5(bundledBase, short);
   if (existsSync4(direct))
     return direct;
-  const prefixed = join4(bundledBase, `hook-${short}`);
+  const prefixed = join5(bundledBase, `hook-${short}`);
   return existsSync4(prefixed) ? prefixed : undefined;
 }
 function resolveScriptPath(name) {
@@ -4340,7 +4626,7 @@ function resolveScriptPath(name) {
   const dir = resolveHookDir(name);
   if (!dir)
     return;
-  const script = join4(dir, "src", "hook.ts");
+  const script = join5(dir, "src", "hook.ts");
   return existsSync4(script) ? script : undefined;
 }
 function resolveHookMeta(name) {
@@ -4590,8 +4876,8 @@ var init_migrations = __esm(() => {
 });
 
 // src/db/legacy-import.ts
-import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import { join as join6 } from "path";
 import { homedir as homedir3 } from "os";
 function ensureMetaTable(db) {
   db.exec(`
@@ -4615,7 +4901,7 @@ function nanoid() {
 function importJsonlFile(db, filePath) {
   let count = 0;
   try {
-    const lines = readFileSync3(filePath, "utf-8").split(`
+    const lines = readFileSync4(filePath, "utf-8").split(`
 `).filter(Boolean);
     for (const line of lines) {
       try {
@@ -4641,7 +4927,7 @@ function importJsonlFile(db, filePath) {
 function importErrorsLog(db, filePath) {
   let count = 0;
   try {
-    const lines = readFileSync3(filePath, "utf-8").split(`
+    const lines = readFileSync4(filePath, "utf-8").split(`
 `).filter(Boolean);
     const linePattern = /^\[(.+?)\]\s+(?:\[session:(\S+)\]\s+)?(.+?)\s+\u2014\s+(.+)$/;
     for (const line of lines) {
@@ -4666,25 +4952,25 @@ function importErrorsLog(db, filePath) {
   } catch {}
   return count;
 }
-function runLegacyImport(db, homeDir = homedir3()) {
+function runLegacyImport(db, homeDir2 = homedir3()) {
   try {
     if (isAlreadyDone(db))
       return;
     let total = 0;
-    const claudeProjectsDir = join5(homeDir, ".claude", "projects");
+    const claudeProjectsDir = join6(homeDir2, ".claude", "projects");
     if (existsSync5(claudeProjectsDir)) {
       try {
         const projectDirs = readdirSync2(claudeProjectsDir);
         for (const dir of projectDirs) {
-          const projectDir = join5(claudeProjectsDir, dir);
+          const projectDir = join6(claudeProjectsDir, dir);
           try {
             const files = readdirSync2(projectDir);
             for (const file of files) {
               if (file.match(/^session-log-\d{4}-\d{2}-\d{2}\.jsonl$/)) {
-                total += importJsonlFile(db, join5(projectDir, file));
+                total += importJsonlFile(db, join6(projectDir, file));
               }
               if (file === "errors.log") {
-                total += importErrorsLog(db, join5(projectDir, file));
+                total += importErrorsLog(db, join6(projectDir, file));
               }
             }
           } catch {}
@@ -4728,16 +5014,16 @@ __export(exports_db, {
 });
 import { Database } from "bun:sqlite";
 import { existsSync as existsSync6, mkdirSync as mkdirSync3, cpSync } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { homedir as homedir4 } from "os";
 function resolveDataDir() {
   const explicit = process.env.HASNA_HOOKS_DATA_DIR ?? process.env.HOOKS_DATA_DIR;
   if (explicit)
     return explicit;
-  const newDir = join6(homedir4(), ".hasna", "hooks");
-  const oldDir = join6(homedir4(), ".hooks");
+  const newDir = join7(homedir4(), ".hasna", "hooks");
+  const oldDir = join7(homedir4(), ".hooks");
   if (!existsSync6(newDir) && existsSync6(oldDir)) {
-    mkdirSync3(join6(homedir4(), ".hasna"), { recursive: true });
+    mkdirSync3(join7(homedir4(), ".hasna"), { recursive: true });
     cpSync(oldDir, newDir, { recursive: true });
   }
   return newDir;
@@ -4747,7 +5033,7 @@ function getDbPath() {
   if (explicitDb)
     return explicitDb;
   const dataDir = resolveDataDir();
-  return join6(dataDir, "hooks.db");
+  return join7(dataDir, "hooks.db");
 }
 function ensureDir(dbPath) {
   const dir = dbPath.substring(0, dbPath.lastIndexOf("/"));
@@ -4821,7 +5107,7 @@ __export(exports_store, {
   LockFileError: () => LockFileError
 });
 import { createHash } from "crypto";
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3, renameSync } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3, renameSync } from "fs";
 import { readFile as readFile2 } from "fs/promises";
 import { randomBytes } from "crypto";
 function sha256Of(input) {
@@ -4887,7 +5173,7 @@ function readLock() {
     return { hooks: {} };
   let raw;
   try {
-    raw = readFileSync4(path, "utf-8");
+    raw = readFileSync5(path, "utf-8");
   } catch {
     throw new LockFileError(`hooks.lock (${path}) could not be read. Repair: fix permissions or move the file aside and run 'hooks sync'.`);
   }
@@ -4984,7 +5270,7 @@ async function verifyScriptHash(name, scriptPath) {
   return checkScriptHash(name, await sha256File(scriptPath));
 }
 function retrustHook(name, scriptPath, version, source) {
-  const actual = sha256Of(readFileSync4(scriptPath));
+  const actual = sha256Of(readFileSync5(scriptPath));
   const db = getDb();
   upsertHookRecord(db, {
     name,
@@ -5025,8 +5311,8 @@ __export(exports_installer, {
   getHookPath: () => getHookPath,
   buildCodewithTomlFragment: () => buildCodewithTomlFragment
 });
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync4 } from "fs";
-import { join as join7, dirname as dirname3 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync4 } from "fs";
+import { join as join8, dirname as dirname3 } from "path";
 import { homedir as homedir5 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function normalizeHookName(name) {
@@ -5066,16 +5352,16 @@ function getSettingsPath(scope = "global", target = "claude", codewithConfigPath
     return globalOverride;
   const dir = getTargetSettingsDir(target);
   if (scope === "project") {
-    return target === "codewith" ? join7(process.cwd(), dir, "config.toml") : join7(process.cwd(), dir, "settings.json");
+    return target === "codewith" ? join8(process.cwd(), dir, "config.toml") : join8(process.cwd(), dir, "settings.json");
   }
-  return target === "codewith" ? join7(homedir5(), dir, "config.toml") : join7(homedir5(), dir, "settings.json");
+  return target === "codewith" ? join8(homedir5(), dir, "config.toml") : join8(homedir5(), dir, "settings.json");
 }
 function getHookPath(name) {
   const shortName = shortHookName(name);
   const resolved = resolveHookDir(shortName);
   if (resolved)
     return resolved;
-  return join7(HOOKS_DIR, normalizeHookName(shortName));
+  return join8(HOOKS_DIR, normalizeHookName(shortName));
 }
 function hookExists(name) {
   return existsSync8(getHookPath(name));
@@ -5084,7 +5370,7 @@ function readSettings(scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
   try {
     if (existsSync8(path)) {
-      return JSON.parse(readFileSync5(path, "utf-8"));
+      return JSON.parse(readFileSync6(path, "utf-8"));
     }
   } catch (error) {
     console.warn(`[hooks] Failed to read settings at ${path}: ${error instanceof Error ? error.message : String(error)}`);
@@ -5183,7 +5469,7 @@ function buildCodewithTomlFragment(name, profile) {
 function readCodewithConfig(scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
   try {
-    return existsSync8(path) ? readFileSync5(path, "utf-8") : "";
+    return existsSync8(path) ? readFileSync6(path, "utf-8") : "";
   } catch {
     return "";
   }
@@ -5193,7 +5479,7 @@ function appendCodewithFragment(fragment, scope, configPath) {
   const dir = dirname3(path);
   if (!existsSync8(dir))
     mkdirSync5(dir, { recursive: true });
-  const existing = existsSync8(path) ? readFileSync5(path, "utf-8") : "";
+  const existing = existsSync8(path) ? readFileSync6(path, "utf-8") : "";
   const sep2 = existing.trim() ? `
 
 ` : "";
@@ -5238,7 +5524,7 @@ function installForTarget(name, scope, overwrite, target, profile, codewithMode
           target,
           fragment,
           applied: false,
-          note: "Codewith install is fragment-only by default; open-configs should own applying this TOML."
+          note: "Codewith install is fragment-only by default; configs should own applying this TOML."
         };
       }
       if (!codewithConfigPath) {
@@ -5265,7 +5551,7 @@ function installForTarget(name, scope, overwrite, target, profile, codewithMode
         fragment,
         applied: true,
         configPath: path,
-        note: "Direct Codewith config write was explicitly requested; prefer open-configs for managed machines."
+        note: "Direct Codewith config write was explicitly requested; prefer configs for managed machines."
       };
     } catch (error) {
       return {
@@ -5496,7 +5782,7 @@ function codewithHasHookEntry(name, scope = "global") {
   if (!existsSync8(path))
     return false;
   try {
-    return codewithHasHookEntryInText(readFileSync5(path, "utf-8"), name);
+    return codewithHasHookEntryInText(readFileSync6(path, "utf-8"), name);
   } catch {
     return false;
   }
@@ -5528,7 +5814,7 @@ function uninstallHook(name, scope = "global", target = "claude") {
   if (target === "codewith" || target === "all") {
     const codewithPath = getSettingsPath(scope, "codewith");
     if (existsSync8(codewithPath)) {
-      const before = readFileSync5(codewithPath, "utf-8");
+      const before = readFileSync6(codewithPath, "utf-8");
       const after = removeCodewithHookEntry(before, shortName);
       if (after.removed) {
         writeFileSync4(codewithPath, after.text, "utf-8");
@@ -5574,7 +5860,7 @@ var init_installer = __esm(() => {
   init_manifest();
   init_store();
   __dirname2 = dirname3(fileURLToPath2(import.meta.url));
-  HOOKS_DIR = existsSync8(join7(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join7(__dirname2, "..", "..", "hooks") : join7(__dirname2, "..", "hooks");
+  HOOKS_DIR = existsSync8(join8(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join8(__dirname2, "..", "..", "hooks") : join8(__dirname2, "..", "hooks");
   EVENT_MAP = {
     claude: {
       PreToolUse: "PreToolUse",
@@ -5721,14 +6007,14 @@ var init_redact = __esm(() => {
 });
 
 // src/lib/profiles.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5, readdirSync as readdirSync3, rmSync as rmSync2, cpSync as cpSync2 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync5, readdirSync as readdirSync3, rmSync as rmSync2, cpSync as cpSync2 } from "fs";
+import { join as join9 } from "path";
 import { homedir as homedir6 } from "os";
 function resolveProfilesDir() {
-  const newDir = join8(homedir6(), ".hasna", "hooks", "profiles");
-  const oldDir = join8(homedir6(), ".hooks", "profiles");
+  const newDir = join9(homedir6(), ".hasna", "hooks", "profiles");
+  const oldDir = join9(homedir6(), ".hooks", "profiles");
   if (!existsSync9(newDir) && existsSync9(oldDir)) {
-    mkdirSync6(join8(homedir6(), ".hasna", "hooks"), { recursive: true });
+    mkdirSync6(join9(homedir6(), ".hasna", "hooks"), { recursive: true });
     cpSync2(oldDir, newDir, { recursive: true });
   }
   return newDir;
@@ -5739,7 +6025,7 @@ function ensureProfilesDir() {
   }
 }
 function profilePath(id) {
-  return join8(PROFILES_DIR, `${id}.json`);
+  return join9(PROFILES_DIR, `${id}.json`);
 }
 function shortUuid() {
   return crypto.randomUUID().slice(0, 8);
@@ -5767,7 +6053,7 @@ function getProfile(id) {
   try {
     if (!existsSync9(path))
       return null;
-    return JSON.parse(readFileSync6(path, "utf-8"));
+    return JSON.parse(readFileSync7(path, "utf-8"));
   } catch {
     return null;
   }
@@ -5780,7 +6066,7 @@ function listProfiles() {
     const profiles = [];
     for (const file of files) {
       try {
-        const content = readFileSync6(join8(PROFILES_DIR, file), "utf-8");
+        const content = readFileSync7(join9(PROFILES_DIR, file), "utf-8");
         profiles.push(JSON.parse(content));
       } catch {}
     }
@@ -5923,7 +6209,7 @@ var init_db_writer = __esm(() => {
 
 // src/lib/hook-env.ts
 import { dirname as dirname4, isAbsolute as isAbsolute2 } from "path";
-import { existsSync as existsSync10, statSync } from "fs";
+import { existsSync as existsSync10, statSync as statSync2 } from "fs";
 function isDeniedEnvName(name) {
   const upper = name.toUpperCase();
   if (DENY_PREFIXES.some((prefix) => upper.startsWith(prefix)))
@@ -5950,7 +6236,7 @@ function isUnsafePathEntry(entry, home) {
   if (entry === "/var/tmp" || entry.startsWith("/var/tmp/"))
     return true;
   try {
-    if ((statSync(entry).mode & 2) !== 0)
+    if ((statSync2(entry).mode & 2) !== 0)
       return true;
   } catch {}
   return false;
@@ -6083,7 +6369,7 @@ __export(exports_run, {
 });
 import { randomBytes as randomBytes2 } from "crypto";
 import { rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute3, join as join9 } from "path";
+import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute3, join as join10 } from "path";
 function extensionOf(scriptPath) {
   const base = basename2(scriptPath);
   const dot = base.lastIndexOf(".");
@@ -6154,7 +6440,7 @@ async function readPipeWithDeadline(stream, deadlineMs) {
 async function executeVerifiedScript(options) {
   const scriptDir = dirname5(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
-  const tempPath = join9(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
+  const tempPath = join10(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
   let timedOut = false;
   const timeoutTimer = options.timeout ? setTimeout(() => {
@@ -6245,15 +6531,15 @@ __export(exports_custom_install, {
   installCustomSource: () => installCustomSource,
   ensureCustomDir: () => ensureCustomDir
 });
-import { existsSync as existsSync11, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync4 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync8, rmSync as rmSync4 } from "fs";
+import { join as join11 } from "path";
 import { tmpdir } from "os";
 function manifestAt(dir) {
-  const path = join10(dir, "manifest.json");
+  const path = join11(dir, "manifest.json");
   if (!existsSync11(path))
     return;
   try {
-    return parseManifest(readFileSync7(path, "utf-8"));
+    return parseManifest(readFileSync8(path, "utf-8"));
   } catch {
     return;
   }
@@ -6272,8 +6558,8 @@ function writeFromManifest(manifest, srcDir, source, kind) {
   return { name, version: manifest.version, kind, source, dir, scriptPath };
 }
 async function cloneToTemp(gitUrl) {
-  const tmp = mkdtempSync(join10(tmpdir(), "hooks-install-"));
-  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join10(tmp, "repo")], {
+  const tmp = mkdtempSync(join11(tmpdir(), "hooks-install-"));
+  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join11(tmp, "repo")], {
     stdout: "pipe",
     stderr: "pipe"
   });
@@ -6286,7 +6572,7 @@ async function cloneToTemp(gitUrl) {
     rmSync4(tmp, { recursive: true, force: true });
     throw new Error(`git clone failed (${exitCode}): ${stderr.trim()}`);
   }
-  return join10(tmp, "repo");
+  return join11(tmp, "repo");
 }
 function isGitUrl(value) {
   return value.startsWith("git@") || value.startsWith("ssh://") || value.startsWith("file://") || value.endsWith(".git");
@@ -6314,7 +6600,7 @@ async function installCustomSource(source) {
     throw new Error(`No such local path: ${source}`);
   }
   if (source.endsWith("manifest.json")) {
-    const manifest = parseManifest(readFileSync7(source, "utf-8"));
+    const manifest = parseManifest(readFileSync8(source, "utf-8"));
     return writeFromManifest(manifest, source.substring(0, source.lastIndexOf("/")), source, "local");
   }
   return copyManifestDir(source, source, "local");
@@ -6363,12 +6649,12 @@ __export(exports_sync, {
   commitSyncArtifacts: () => commitSyncArtifacts
 });
 import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 function sha256OfText(text) {
   return createHash2("sha256").update(text).digest("hex");
 }
 function sha256OfPath(path) {
-  return createHash2("sha256").update(readFileSync8(path)).digest("hex");
+  return createHash2("sha256").update(readFileSync9(path)).digest("hex");
 }
 function collectBundledCatalog() {
   const out = [];
@@ -7114,6 +7400,160 @@ function secureEqual(a, b) {
   return diff === 0;
 }
 
+// src/openapi.ts
+var openApiDocument;
+var init_openapi = __esm(() => {
+  openApiDocument = {
+    openapi: "3.1.0",
+    info: {
+      title: "Hooks Registry API",
+      version: "0.1.0",
+      description: "Local registry HTTP API for @hasna/hooks: catalog, lock, and artifact reads are open; publishing (PUT /api/v1/hooks) requires the API key (authorization: Bearer or x-api-key)."
+    },
+    servers: [{ url: "/" }],
+    paths: {
+      "/health": {
+        get: {
+          summary: "Liveness probe",
+          operationId: "getHealth",
+          responses: {
+            "200": {
+              description: "Service is alive",
+              content: {
+                "application/json": {
+                  schema: { type: "object", additionalProperties: true }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/ready": {
+        get: {
+          summary: "Readiness probe \u2014 the hooks.lock store is readable",
+          operationId: "getReady",
+          responses: {
+            "200": { description: "Lock store is readable" },
+            "503": { description: "Lock store is not readable" }
+          }
+        }
+      },
+      "/version": {
+        get: {
+          summary: "Package version",
+          operationId: "getVersion",
+          responses: {
+            "200": {
+              description: "The installed @hasna/hooks version",
+              content: {
+                "application/json": {
+                  schema: { type: "object", properties: { version: { type: "string" } } }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/openapi.json": {
+        get: {
+          summary: "This OpenAPI document",
+          operationId: "getOpenApi",
+          responses: { "200": { description: "OpenAPI 3.1 document" } }
+        }
+      },
+      "/api/v1/catalog": {
+        get: {
+          summary: "List the full hook catalog with versions and sha256",
+          operationId: "getCatalog",
+          responses: {
+            "200": {
+              description: "Catalog entries",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    properties: {
+                      hooks: {
+                        type: "array",
+                        items: {
+                          type: "object",
+                          properties: {
+                            name: { type: "string" },
+                            version: { type: "string" },
+                            sha256: { type: "string" },
+                            events: { type: "array", items: { type: "string" } }
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/api/v1/lock": {
+        get: {
+          summary: "Read the published hooks.lock with per-hook versions",
+          operationId: "getLock",
+          responses: { "200": { description: "The lock file" } }
+        }
+      },
+      "/api/v1/hooks/{name}/{version}": {
+        get: {
+          summary: "Fetch one hook's manifest and script",
+          operationId: "getHookArtifact",
+          parameters: [
+            { name: "name", in: "path", required: true, schema: { type: "string" } },
+            { name: "version", in: "path", required: true, schema: { type: "string" } }
+          ],
+          responses: {
+            "200": {
+              description: "Hook artifact; x-hook-sha256 header carries the script hash"
+            },
+            "400": { description: "Invalid URL encoding or semver version" },
+            "404": { description: "Hook not found locally" }
+          }
+        }
+      },
+      "/api/v1/hooks": {
+        put: {
+          summary: "Publish/retrust a hook (requires the API key)",
+          operationId: "putHook",
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: { name: { type: "string" }, version: { type: "string" } }
+                }
+              }
+            }
+          },
+          responses: {
+            "200": { description: "Hook retrusted and pin updated" },
+            "401": { description: "Missing or invalid API key" },
+            "404": { description: "Hook not found in local store" },
+            "409": { description: "Version mismatch with the local store" }
+          },
+          security: [{ apiKey: [] }]
+        }
+      }
+    },
+    components: {
+      securitySchemes: {
+        apiKey: {
+          type: "http",
+          scheme: "bearer",
+          description: "The registry API key (HASNA_HOOKS_API_KEY / HOOKS_API_KEY)."
+        }
+      }
+    }
+  };
+});
+
 // src/serve.ts
 var exports_serve = {};
 __export(exports_serve, {
@@ -7123,6 +7563,17 @@ __export(exports_serve, {
   SERVE_HOST: () => SERVE_HOST,
   DEFAULT_SERVE_PORT: () => DEFAULT_SERVE_PORT
 });
+import { readFileSync as readFileSync10 } from "fs";
+import { dirname as dirname6, join as join12 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+function packageVersion() {
+  try {
+    const pkgPath = join12(dirname6(fileURLToPath3(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync10(pkgPath, "utf-8")).version || "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
 async function buildCatalog() {
   const byName = new Map;
   for (const meta of HOOKS) {
@@ -7195,6 +7646,20 @@ function handleServeRequest(req, apiKey) {
   if (url.pathname === "/health" && req.method === "GET") {
     return Promise.resolve(json({ status: "ok", name: SERVE_SERVICE_NAME }));
   }
+  if (url.pathname === "/ready" && req.method === "GET") {
+    try {
+      readLock();
+      return Promise.resolve(json({ status: "ready", name: SERVE_SERVICE_NAME }));
+    } catch {
+      return Promise.resolve(json({ status: "not-ready", name: SERVE_SERVICE_NAME }, 503));
+    }
+  }
+  if (url.pathname === "/version" && req.method === "GET") {
+    return Promise.resolve(json({ version: packageVersion() }));
+  }
+  if (url.pathname === "/openapi.json" && req.method === "GET") {
+    return Promise.resolve(json(openApiDocument));
+  }
   if (url.pathname === "/api/v1/catalog" && req.method === "GET") {
     return buildCatalog().then((catalog) => json({ hooks: catalog }));
   }
@@ -7273,6 +7738,7 @@ var init_serve = __esm(() => {
   init_store();
   init_resolve();
   init_config();
+  init_openapi();
   init_semver();
   if (false) {}
 });
@@ -7373,9 +7839,9 @@ import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z as z2 } from "zod";
 import { createServer } from "http";
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
-import { join as join11, dirname as dirname6 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
+import { join as join13, dirname as dirname7 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 async function runVerifiedHook(name, stdin, timeoutMs) {
   const { resolveHook: resolveHook2, resolveScriptPath: resolveScriptPath2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
   const resolved = resolveHook2(name);
@@ -7383,7 +7849,7 @@ async function runVerifiedHook(name, stdin, timeoutMs) {
   if (!resolved || !hookScript || !existsSync12(hookScript)) {
     throw new Error(`Hook '${name}' not found`);
   }
-  const content = readFileSync9(hookScript);
+  const content = readFileSync11(hookScript);
   const sha = sha256Of(content);
   const check = checkScriptHash(name, sha);
   if (!check.ok) {
@@ -7608,14 +8074,14 @@ function createHooksServer() {
           continue;
         }
         const hookDir = getHookPath(name);
-        if (!existsSync12(join11(hookDir, "src", "hook.ts"))) {
+        if (!existsSync12(join13(hookDir, "src", "hook.ts"))) {
           issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
           hookHealthy = false;
         }
       }
       if (meta && settingsExist) {
         try {
-          const settings = JSON.parse(readFileSync9(settingsPath, "utf-8"));
+          const settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
           if (!hookRegisteredInSettings(settings, name, meta.event, meta.matcher)) {
             const eventName = meta.event.split(":")[0];
             issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
@@ -7645,10 +8111,10 @@ function createHooksServer() {
         return { content: [{ type: "text", text: JSON.stringify({ error: `Hook '${name}' not found` }) }] };
       }
       const hookPath = getHookPath(name);
-      const readmePath = join11(hookPath, "README.md");
+      const readmePath = join13(hookPath, "README.md");
       let readme = "";
       if (existsSync12(readmePath)) {
-        readme = readFileSync9(readmePath, "utf-8");
+        readme = readFileSync11(readmePath, "utf-8");
       }
       if (verbose) {
         return { content: [{ type: "text", text: JSON.stringify({ ...meta, readme }) }] };
@@ -7978,7 +8444,7 @@ function createHooksServer() {
     let settings = {};
     try {
       if (existsSync12(settingsPath))
-        settings = JSON.parse(readFileSync9(settingsPath, "utf-8"));
+        settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
     } catch {}
     if (!settings.hooks)
       settings.hooks = {};
@@ -7987,8 +8453,8 @@ function createHooksServer() {
       disabled.push(name);
     settings.hooks.__disabled = disabled;
     const { writeFileSync: writeFileSync7, mkdirSync: mkdirSync8 } = await import("fs");
-    const { dirname: dirname7 } = await import("path");
-    mkdirSync8(dirname7(settingsPath), { recursive: true });
+    const { dirname: dirname8 } = await import("path");
+    mkdirSync8(dirname8(settingsPath), { recursive: true });
     writeFileSync7(settingsPath, JSON.stringify(settings, null, 2) + `
 `);
     return { content: [{ type: "text", text: JSON.stringify({ hook: name, disabled: true, scope }) }] };
@@ -8001,7 +8467,7 @@ function createHooksServer() {
     let settings = {};
     try {
       if (existsSync12(settingsPath))
-        settings = JSON.parse(readFileSync9(settingsPath, "utf-8"));
+        settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
     } catch {}
     if (settings.hooks?.__disabled) {
       settings.hooks.__disabled = settings.hooks.__disabled.filter((n) => n !== name);
@@ -8361,13 +8827,13 @@ var init_server = __esm(() => {
   init_store();
   init_redact();
   init_storage();
-  __dirname3 = dirname6(fileURLToPath3(import.meta.url));
+  __dirname3 = dirname7(fileURLToPath4(import.meta.url));
   pkg = { name: "@hasna/hooks", version: "0.0.0" };
   try {
     for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
-      const p = join11(__dirname3, rel);
+      const p = join13(__dirname3, rel);
       if (existsSync12(p)) {
-        pkg = JSON.parse(readFileSync9(p, "utf-8"));
+        pkg = JSON.parse(readFileSync11(p, "utf-8"));
         break;
       }
     }
@@ -9638,9 +10104,9 @@ var {
 
 // src/cli/index.tsx
 import chalk2 from "chalk";
-import { existsSync as existsSync13, readFileSync as readFileSync10, rmSync as rmSync5 } from "fs";
-import { join as join12, dirname as dirname7 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { existsSync as existsSync13, readFileSync as readFileSync12, rmSync as rmSync5 } from "fs";
+import { join as join14, dirname as dirname8 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
 
 // src/cli/components/App.tsx
 import { useState as useState7 } from "react";
@@ -10821,9 +11287,9 @@ init_resolve();
 init_store();
 init_semver();
 import { jsxDEV as jsxDEV8 } from "react/jsx-dev-runtime";
-var __dirname4 = dirname7(fileURLToPath4(import.meta.url));
-var pkgPath = existsSync13(join12(__dirname4, "..", "package.json")) ? join12(__dirname4, "..", "package.json") : join12(__dirname4, "..", "..", "package.json");
-var pkg2 = JSON.parse(readFileSync10(pkgPath, "utf-8"));
+var __dirname4 = dirname8(fileURLToPath5(import.meta.url));
+var pkgPath = existsSync13(join14(__dirname4, "..", "package.json")) ? join14(__dirname4, "..", "package.json") : join14(__dirname4, "..", "..", "package.json");
+var pkg2 = JSON.parse(readFileSync12(pkgPath, "utf-8"));
 var program2 = new Command;
 function resolveScope(options) {
   if (options.project)
@@ -10857,7 +11323,7 @@ function projectLogRows2(rows) {
 function readToken(tokenFile) {
   if (tokenFile) {
     try {
-      return readFileSync10(tokenFile, "utf-8").trim();
+      return readFileSync12(tokenFile, "utf-8").trim();
     } catch {
       return;
     }
@@ -10994,7 +11460,7 @@ program2.command("run").argument("<hook>", "Hook to run").option("--profile <id>
     console.error(JSON.stringify({ error: `Hook script not found: ${hookScript ?? hook}` }));
     process.exit(1);
   }
-  const content = readFileSync10(hookScript);
+  const content = readFileSync12(hookScript);
   const sha = sha256Of2(content);
   const check = checkScriptHash2(hook, sha);
   if (!check.ok) {
@@ -11100,7 +11566,7 @@ program2.command("run").argument("<hook>", "Hook to run").option("--profile <id>
     process.stderr.write(stderr);
   process.exit(exitCode);
 });
-program2.command("install").alias("add").argument("[hooks...]", "Hooks to install").option("-o, --overwrite", "Overwrite existing hooks", false).option("-a, --all", "Install all available hooks", false).option("-c, --category <category>", "Install all hooks in a category").option("-g, --global", "Install globally (~/.claude/settings.json)", false).option("-p, --project", "Install for current project (.claude/settings.json)", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith, all (default: claude)", "claude").option("--profile <id>", "Agent profile ID to scope hooks to").option("--dry-run", "Preview what would be installed without writing to settings", false).option("--apply-codewith", "Explicitly append Codewith TOML to a config file (prefer open-configs for managed configs)", false).option("--codewith-config <path>", "Explicit Codewith config path required with --apply-codewith").option("-j, --json", "Output as JSON", false).description("Install one or more hooks (registry names, local paths, git URLs, manifest URLs, or <name>@<version> pinned installs)").action(async (hooks, options) => {
+program2.command("install").alias("add").argument("[hooks...]", "Hooks to install").option("-o, --overwrite", "Overwrite existing hooks", false).option("-a, --all", "Install all available hooks", false).option("-c, --category <category>", "Install all hooks in a category").option("-g, --global", "Install globally (~/.claude/settings.json)", false).option("-p, --project", "Install for current project (.claude/settings.json)", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith, all (default: claude)", "claude").option("--profile <id>", "Agent profile ID to scope hooks to").option("--dry-run", "Preview what would be installed without writing to settings", false).option("--apply-codewith", "Explicitly append Codewith TOML to a config file (prefer configs for managed configs)", false).option("--codewith-config <path>", "Explicit Codewith config path required with --apply-codewith").option("-j, --json", "Output as JSON", false).description("Install one or more hooks (registry names, local paths, git URLs, manifest URLs, or <name>@<version> pinned installs)").action(async (hooks, options) => {
   const scope = resolveScope(options);
   const target = resolveTarget(options);
   let toInstall = hooks;
@@ -11288,7 +11754,7 @@ Dry run \u2014 would install (${scope}, ${target}):
     return;
   }
   const successCount = results.filter((r) => r.success).length;
-  const settingsFile = target === "codewith" ? options.applyCodewith ? options.codewithConfig : "TOML fragment only (open-configs should apply)" : scope === "project" ? ".claude/settings.json" : "~/.claude/settings.json";
+  const settingsFile = target === "codewith" ? options.applyCodewith ? options.codewithConfig : "TOML fragment only (configs should apply)" : scope === "project" ? ".claude/settings.json" : "~/.claude/settings.json";
   console.log(chalk2.bold(`
 Installing hooks (${scope}, ${target})...
 `));
@@ -11570,7 +12036,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
   let wiringCount = 0;
   if (settingsExist) {
     try {
-      const settings = JSON.parse(readFileSync10(settingsPath, "utf-8"));
+      const settings = JSON.parse(readFileSync12(settingsPath, "utf-8"));
       wiringCount = countSettingsWiring(settings);
     } catch {}
   }
@@ -11590,7 +12056,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
         continue;
       }
       const hookDir = getHookPath(name);
-      const hookScript = join12(hookDir, "src", "hook.ts");
+      const hookScript = join14(hookDir, "src", "hook.ts");
       if (!existsSync13(hookScript)) {
         issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
         hookHealthy = false;
@@ -11598,7 +12064,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
     }
     if (meta && settingsExist) {
       try {
-        const settings = JSON.parse(readFileSync10(settingsPath, "utf-8"));
+        const settings = JSON.parse(readFileSync12(settingsPath, "utf-8"));
         if (!hookRegisteredInSettings(settings, name, meta.event, meta.matcher)) {
           const eventName = meta.event.split(":")[0];
           issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
@@ -11765,10 +12231,10 @@ program2.command("docs").argument("[hook]", "Hook name (shows general docs if om
       return;
     }
     const hookPath = getHookPath(hook);
-    const readmePath = join12(hookPath, "README.md");
+    const readmePath = join14(hookPath, "README.md");
     let readme = "";
     if (existsSync13(readmePath)) {
-      readme = readFileSync10(readmePath, "utf-8");
+      readme = readFileSync12(readmePath, "utf-8");
     }
     if (options.json) {
       console.log(JSON.stringify({ ...meta, readme }));
@@ -11822,7 +12288,7 @@ ${meta.displayName} v${meta.version}
     installation: {
       global: "hooks install gitguard",
       project: "hooks install gitguard --project",
-      codewith: "hooks install session-start --target codewith  # emits TOML for open-configs to apply",
+      codewith: "hooks install session-start --target codewith  # emits TOML for configs to apply",
       category: 'hooks install --category "Git Safety"',
       all: "hooks install --all"
     },
@@ -11965,9 +12431,9 @@ program2.command("profile-import").argument("<file>", "JSON file to import profi
   if (file === "-") {
     raw = await new Response(Bun.stdin.stream()).text();
   } else {
-    const { readFileSync: readFileSync11 } = await import("fs");
+    const { readFileSync: readFileSync13 } = await import("fs");
     try {
-      raw = readFileSync11(file, "utf-8");
+      raw = readFileSync13(file, "utf-8");
     } catch {
       if (options.json) {
         console.log(JSON.stringify({ error: `Cannot read file: ${file}` }));