@hasna/hooks 0.7.10 → 0.8.0

package/dist/lib/app-home.d.ts

@@ -11,6 +11,15 @@
  * physically migrated there, so a live store at the legacy home never becomes
  * invisible on upgrade.
  */
+export type PathKind = "config" | "data" | "state" | "cache";
+export interface PathsResolverOptions {
+    app: string;
+    internal?: boolean;
+    platform?: string;
+    home?: string;
+    env?: Record<string, string | undefined>;
+}
+export declare function dataDir(options: PathsResolverOptions): string;
 /** Resolve the user's home directory: $HOME, then $USERPROFILE, then the OS user database. */
 export declare function getHomeDir(env?: NodeJS.ProcessEnv): string;
 /**

package/dist/lib/installer.d.ts

@@ -81,14 +81,5 @@ export declare function removeCodewithHookEntry(configText: string, name: string
     text: string;
     removed: boolean;
 };
-/**
- * Full uninstall — the settings registration, the store directory (custom
- * hooks), the lock pin and the DB record are all removed. Bundled hooks keep
- * their package files (they belong to the package, not the store).
- *
- * Resolves custom and registry-synced hooks, which live in the custom store
- * dir, as well as bundled ones (QA-1 BUG-A / QA-4: remove was bundled-only
- * and never cleaned the store/lock/DB).
- */
 export declare function uninstallHook(name: string, scope?: Scope, target?: Target): UninstallResult;
 export {};

package/dist/lib/local-opt-in.d.ts

@@ -0,0 +1,80 @@
+import type { HooksCredentialOptions, HooksLocalOptInEnv } from "./resolver-types.js";
+/** The deliberate unhosted opt-in, canonical name first. */
+export declare const HOOKS_LOCAL_OPT_IN_ENV_KEYS: readonly ["HASNA_HOOKS_LOCAL", "HOOKS_LOCAL"];
+/** True when the operator deliberately asked for the unhosted local store. */
+export declare function isHooksLocalOptIn(env?: HooksLocalOptInEnv): boolean;
+/** Every env name that can configure a hooks authority or credential, resolver-derived. */
+export declare function hooksAuthorityEnvKeys(): string[];
+/**
+ * Does the ENVIRONMENT itself configure a hooks authority or credential?
+ *
+ * Deliberately narrower than "does a credential resolve": answering it must not
+ * touch the Keychain or the filesystem, because doing so would defeat the
+ * isolation the opt-in short-circuit exists to provide. It reads the env
+ * dictionary and nothing else.
+ *
+ * A DECLARED-BUT-BLANK variable counts as absent HERE — a blank has always been
+ * this package's spelling for "not configured", and helpers in the wild blank
+ * rather than delete. It is NOT absent once we do go hosted: the resolver
+ * refuses a blank loudly rather than falling through to another identity, which
+ * is the behaviour that matters at that point.
+ */
+export declare function hasHooksEnvAuthorityIntent(env?: HooksLocalOptInEnv): boolean;
+/** True when this environment should be served by the on-box bundled store. */
+export declare function selectsHooksLocalStore(env?: HooksLocalOptInEnv): boolean;
+/**
+ * The environment as the resolver should see it: every authority/credential
+ * variable that is DECLARED BUT BLANK removed.
+ *
+ * A blank has always been this package's spelling for "not configured".
+ * @hasna/contracts takes the opposite and, for its purposes, correct view: a
+ * declared-but-blank credential is a misconfiguration it refuses loudly rather
+ * than resolving around, because a blank that fell through would authenticate
+ * as a different principal than the operator named.
+ *
+ * Both are right at their own layer, and the mismatch is not hypothetical: an
+ * environment carrying a real `HASNA_HOOKS_API_KEY` alongside a blank legacy
+ * alias — the exact shape a scrubbed-then-overridden fixture produces — is a
+ * complete, unambiguous configuration that would otherwise be refused for the
+ * alias nobody set. Normalising here keeps "blank means unset" true at the
+ * hooks seam while leaving the resolver's stricter rule intact for everything
+ * it does receive: a value that is present is still policed, and two aliases
+ * that actually disagree still refuse.
+ */
+export declare function hooksResolverEnv<T extends HooksLocalOptInEnv>(env: T): T;
+/** The env object and credential options a hooks surface hands @hasna/contracts. */
+export interface HooksResolverInputs<T extends HooksLocalOptInEnv> {
+    /** The environment with every declared-but-blank authority variable removed. */
+    env: T;
+    /** The chain options, with the Keychain tier's ambient gate already decided. */
+    credentials: HooksCredentialOptions;
+}
+/**
+ * Build the resolver's inputs: the normalised environment AND the credential
+ * options that keep the machine's Keychain tier reachable across it.
+ *
+ * WHY THIS IS NOT JUST {@link hooksResolverEnv}. Blanking a variable and
+ * deleting it are not the same operation to @hasna/contracts, because dropping
+ * a key forces us to hand the resolver a COPY, and the resolver gates its
+ * ambient tiers on OBJECT IDENTITY (`env === process.env`, or the registry
+ * symbol its own snapshot carries). A copy is, by that test, a caller-built
+ * world — the hermetic seam — so the Keychain is outside it and tier 3 turns
+ * itself off. Silently: there is no error, no warning and no diagnostic.
+ *
+ * The consequence is the one failure this whole ruling exists to prevent. On a
+ * station whose Keychain holds `hasna.credentials.hooks.api-key`, ONE
+ * declared-but-blank authority variable dropped the run from the Keychain
+ * identity to whatever came next: to `~/.hasna/hooks/config/credentials`, a
+ * DIFFERENT principal, with no notice; or, with nothing on disk, to a bare
+ * REMOTE_API_CONFIG_MISSING on a station that is in fact configured. A
+ * deliberate tier must never fall through to another identity, so the gate is
+ * decided HERE, on the original env, and carried across the copy as the
+ * documented `keychain.enabled` control rather than being left to an identity
+ * test the copy cannot pass.
+ *
+ * An explicit `enabled` from the caller still wins, and an injected `run`
+ * (which @hasna/contracts already treats as "enabled") is left alone, so the
+ * hermetic seam tests rely on is untouched. When there is no blank to remove
+ * the inputs pass through by identity, exactly as before.
+ */
+export declare function hooksResolverInputs<T extends HooksLocalOptInEnv>(env: T, credentials?: HooksCredentialOptions): HooksResolverInputs<T>;

package/dist/lib/profiles.d.ts

@@ -20,6 +20,16 @@ export interface CreateProfileInput {
     agent_type: "claude" | "gemini" | "custom";
     name?: string;
 }
+/**
+ * The profiles directory under the effective data root.
+ *
+ * Resolved on every call, never snapshotted at module load: the effective
+ * data root is env-driven (HASNA_HOOKS_DATA_DIR / HASNA_HOOKS_HOME / the XDG
+ * adoption in app-home), and bun test runs test files in one process with a
+ * SHARED process.env — a module-load snapshot froze the dir to whatever the
+ * env held at import time, so a concurrent file pinning a data-root override
+ * silently moved every profile operation of this module with it.
+ */
 export declare function getProfilesDir(): string;
 export declare function createProfile(input: CreateProfileInput): AgentProfile;
 export declare function getProfile(id: string): AgentProfile | null;

package/dist/lib/resolver-types.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The @hasna/contracts client types that @hasna/hooks PUBLISHES or hands back
+ * across its public seam, spelled locally.
+ *
+ * WHY THIS FILE EXISTS. `@hasna/contracts` is a BUILD-TIME dependency of this
+ * package (pinned 1.0.2, inlined by `bun build --target bun`), so the emitted
+ * `dist/**/*.d.ts` must never `import ... from "@hasna/contracts/client"` —
+ * a published declaration that references a package consumers do not have is
+ * a broken install (hasna/apps#1782). Every public signature therefore uses
+ * these local spellings, which are structurally identical to the resolver's
+ * own types (`CredentialChainOptions` / `KeychainCommandResult`). The
+ * `credential chain shape` test in `transport.test.ts` pins the local
+ * spellings against the real @hasna/contracts types so they cannot drift.
+ */
+export type HooksLocalOptInEnv = Record<string, string | undefined>;
+/** What an injected `security` runner returns: an exit status plus output. */
+export interface HooksKeychainCommandResult {
+    /** Exit status; null when the tool could not be started or was killed. */
+    status: number | null;
+    stdout: string;
+    stderr: string;
+}
+/** Tier 3 (Keychain) controls — structurally `KeychainTierOptions`. */
+export interface HooksKeychainTierOptions {
+    /** Whether the Keychain is consulted for a caller-built env object. */
+    enabled?: boolean;
+    /** Defaults to `process.platform`; the tier exists only on `"darwin"`. */
+    platform?: string;
+    /** The machine's host name when `HASNA_STATION` is unset. */
+    hostname?: () => string;
+    /** The `security` runner. Defaults to spawning `/usr/bin/security`. */
+    run?: (argv: readonly string[]) => HooksKeychainCommandResult;
+}
+/**
+ * Tier-1 credential inputs and Keychain-tier controls — structurally
+ * `CredentialChainOptions` from @hasna/contracts/client, spelled locally.
+ */
+export interface HooksCredentialOptions {
+    /** Tier 1: an explicit key, e.g. from `--api-key`. */
+    apiKey?: string;
+    /** Tier 1: an explicit profile name. Beats `HASNA_PROFILE`. */
+    profile?: string;
+    /** Tier 3: Keychain controls — a fake `security` runner in tests, an opt-out on CI. */
+    keychain?: HooksKeychainTierOptions;
+}

package/dist/lib/sync.d.ts

@@ -6,7 +6,16 @@
  * failure mid-sync leaves the local store untouched. Local-only hooks are
  * never deleted by a remote sync.
  */
+import type { HooksCredentialOptions } from "./resolver-types.js";
 import { parseManifest } from "./manifest.js";
+type Env = Record<string, string | undefined>;
+export interface HooksSyncOptions {
+    dryRun?: boolean;
+    /** Injectable environment (tests). Defaults to `process.env`. */
+    env?: Env;
+    /** Injectable credential-chain inputs (tests: fake `security` runner). */
+    credentials?: HooksCredentialOptions;
+}
 export interface SyncDiff {
     added: string[];
     updated: string[];
@@ -39,12 +48,8 @@ interface RemoteLock {
         versions?: string[];
     }>;
 }
-export declare function planSync(options?: {
-    dryRun?: boolean;
-}): Promise<SyncPlan>;
-export declare function syncHooks(options?: {
-    dryRun?: boolean;
-}): Promise<SyncPlan>;
+export declare function planSync(options?: HooksSyncOptions): Promise<SyncPlan>;
+export declare function syncHooks(options?: HooksSyncOptions): Promise<SyncPlan>;
 /**
  * One fully-validated artifact ready to be committed. Nothing has touched
  * the store at this point: every fetch, sha check and manifest parse has
@@ -64,7 +69,7 @@ export interface StagedSyncArtifact {
  * written. A failure here (network, sha mismatch, malformed manifest,
  * containment violation) throws with the store untouched.
  */
-export declare function stageSyncArtifacts(apiUrl: string, names: string[], remoteLock: RemoteLock): Promise<StagedSyncArtifact[]>;
+export declare function stageSyncArtifacts(apiUrl: string, apiKey: string, names: string[], remoteLock: RemoteLock): Promise<StagedSyncArtifact[]>;
 /**
  * P1-9 commit phase, ordered so a mid-commit failure cannot leave a partial
  * store that reads as trusted:
@@ -101,5 +106,5 @@ export interface PinnedHookInstall {
  * the user is fetched from the versioned registry — older-than-latest pins
  * are first-class, never rejected as "not the latest".
  */
-export declare function fetchPinnedHook(name: string, version: string, apiUrl: string): Promise<PinnedHookInstall>;
+export declare function fetchPinnedHook(name: string, version: string, apiUrl: string, apiKey: string): Promise<PinnedHookInstall>;
 export {};

package/dist/lib/transport.d.ts

@@ -0,0 +1,87 @@
+import type { HooksCredentialOptions, HooksLocalOptInEnv } from "./resolver-types.js";
+/** The unhosted mode: bundled registry + local SQLite store. Never a default. */
+export type HooksTransportMode = "remote" | "local";
+/** The resolved remote-registry authority pair. Never carries a value besides `apiKey`. */
+export interface HooksRemoteAuthority {
+    /**
+     * Registry origin WITHOUT the `/v1` suffix the resolver appends — the sync
+     * client composes `/api/v1/...` routes on top of it.
+     */
+    origin: string;
+    /** The credential, resolved together with the authority it will be sent to. */
+    apiKey: string;
+    /** WHERE the authority came from: an env key NAME, a Keychain item reference, a file PATH, or "default". */
+    apiUrlSource: string | null;
+    /** WHERE the credential came from: an env key NAME, a Keychain item reference, or a file PATH. Never a value. */
+    apiKeySource: string | null;
+    /** Which tier of the chain supplied the credential. */
+    apiKeyTier: string | null;
+    /** The resolver's `<origin>/v1` base, for diagnostics. */
+    v1BaseUrl: string;
+    /** Human-readable warning, or null. Never contains secret values. */
+    warning: string | null;
+}
+/**
+ * The transport decision every hosted surface makes: remote (resolver-backed)
+ * or local (explicit opt-in, resolver never consulted).
+ *
+ * Local mode returns `authority: null` and carries no key. Remote mode always
+ * carries a fully resolved pair — the seam throws before returning a
+ * half-configured one.
+ */
+export interface HooksTransportResolution {
+    mode: HooksTransportMode;
+    /** `"local-opt-in"` for the deliberate unhosted store, else `"<api key source>+<api url source>"`. */
+    source: string;
+    /** The resolved remote pair; null in local mode. */
+    authority: HooksRemoteAuthority | null;
+}
+/** Where the one-line local-mode notice goes. Defaults to `process.stderr`. */
+export type HooksTransportNotice = (line: string) => void;
+/** Reset the once-per-process local-mode notice. Test seam only. */
+export declare function __resetHooksLocalNotice(): void;
+/**
+ * Announce the unhosted mode on stderr, once per process. Surfaces that never
+ * resolve the transport (the CLI gate opening through the opt-in) still have
+ * to SAY the run is local — the "local on stderr" doctrine (2026-09-04).
+ */
+export declare function announceHooksLocalMode(reason?: string, notice?: HooksTransportNotice): void;
+/** Strip the `/v1` suffix the resolver normalised onto the authority. */
+export declare function hooksRegistryOrigin(v1BaseUrl: string): string;
+/**
+ * Re-throw a `@hasna/contracts` resolution failure as hooks' own fail-closed
+ * diagnostic, preserving the resolver's message (which names every tier it
+ * consulted) behind the stable `REMOTE_API_*` code callers match on. Nothing
+ * here ever returns a client or a local store: every arm throws.
+ */
+export declare function rethrowHooksAuthorityFailure(error: unknown): never;
+/** Tier-1 credential inputs and Keychain-tier controls, forwarded verbatim. */
+export type { HooksCredentialOptions } from "./resolver-types.js";
+export interface HooksTransportOptions {
+    /** Tier-1 credential inputs (`--api-key` / `--profile`) and the injectable `security` runner tests use. */
+    credentials?: HooksCredentialOptions;
+    /** Where the one-line local-mode notice goes. Defaults to `process.stderr`. */
+    notice?: HooksTransportNotice;
+}
+/**
+ * Resolve the hooks transport. The deliberate unhosted opt-in is answered
+ * first and WITHOUT consulting the resolver; otherwise `@hasna/contracts`
+ * resolves the credential AND the authority together as one strict pair, and
+ * any failure to do so is a throw — the client never defaults to the on-box
+ * store (owner ruling 2026-09-04). Resolved fresh on every call.
+ */
+export declare function resolveHooksTransport(env?: HooksLocalOptInEnv, options?: HooksTransportOptions): HooksTransportResolution;
+/**
+ * The registry keys the publish surface checks. Local-by-design commands
+ * (`hooks serve`) never pick a transport; they only need to know whether a
+ * credential exists to honour a PUT. Resolved fresh on every call, through the
+ * same chain as {@link resolveHooksTransport}, so a key rotation heals a
+ * long-lived server without a restart.
+ *
+ * Returns `undefined` when no credential resolves — reads stay open and
+ * publish refuses — and THROWS on a deliberate tier that exists but cannot be
+ * honoured (a locked Keychain, an unsafe credential file), because falling
+ * through to another identity is the one silent failure the chain exists to
+ * end.
+ */
+export declare function resolveHooksServePublishKey(env?: HooksLocalOptInEnv, options?: HooksTransportOptions): string | undefined;

package/dist/openapi.d.ts

@@ -209,7 +209,7 @@ export declare const openApiDocument: {
             readonly apiKey: {
                 readonly type: "http";
                 readonly scheme: "bearer";
-                readonly description: "The registry API key (HASNA_HOOKS_API_KEY / HOOKS_API_KEY).";
+                readonly description: "The registry API key — resolved by the client through the @hasna/contracts chain (HASNA_HOOKS_API_KEY, the Keychain item hasna.credentials.hooks.api-key, or ~/.hasna/hooks/config/credentials); the server compares the inbound bearer/x-api-key value.";
             };
         };
     };

package/dist/storage.js

@@ -15,92 +15,77 @@ var __export = (target, all) => {
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
-// ../../node_modules/.bun/@hasna+paths@0.1.0/node_modules/@hasna/paths/dist/index.js
+// src/lib/app-home.ts
+import { existsSync } from "fs";
 import { homedir } from "os";
-import { join } from "path";
-function assertApp(app) {
+import { join, resolve } from "path";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+function pathsResolverAssertApp(app) {
   if (typeof app !== "string" || app.length === 0) {
     throw new TypeError("paths: app must be a non-empty string");
   }
-  if (!APP_SLUG_RE.test(app)) {
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
     throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
   }
 }
-function envOf(options) {
-  return options.env ?? process.env;
-}
-function envValue(options, kind) {
-  const value = envOf(options)[KIND_ENV[kind]];
-  return typeof value === "string" && value.length > 0 ? value : undefined;
-}
-function isMacOS(platform) {
-  return platform === "darwin";
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
 }
-function baseDir(kind, options) {
-  const override = envValue(options, kind);
-  if (override)
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
     return override;
-  const home = options.home ?? homedir();
+  const home = options.home ?? pathsResolverHomedir();
   const platform = options.platform ?? process.platform;
-  if (isMacOS(platform)) {
+  if (platform === "darwin") {
     switch (kind) {
       case "config":
       case "data":
-        return join(home, "Library", "Application Support", "Hasna");
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
       case "cache":
-        return join(home, "Library", "Caches", "Hasna");
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
       case "state":
-        return join(home, "Library", "Logs", "Hasna");
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
     }
   }
   switch (kind) {
     case "config":
-      return join(home, ".config", "hasna");
+      return pathsResolverJoin(home, ".config", "hasna");
     case "data":
-      return join(home, ".local", "share", "hasna");
+      return pathsResolverJoin(home, ".local", "share", "hasna");
     case "state":
-      return join(home, ".local", "state", "hasna");
+      return pathsResolverJoin(home, ".local", "state", "hasna");
     case "cache":
-      return join(home, ".cache", "hasna");
+      return pathsResolverJoin(home, ".cache", "hasna");
   }
 }
-function resolvePath(kind, options) {
-  assertApp(options.app);
-  const appSegment = options.internal === true ? join("internal", options.app) : options.app;
-  return join(baseDir(kind, options), appSegment);
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
 }
 function dataDir(options) {
-  return resolvePath("data", options);
+  return pathsResolverResolve("data", options);
 }
-var KIND_ENV, APP_SLUG_RE;
-var init_dist = __esm(() => {
-  KIND_ENV = {
-    config: "HASNA_CONFIG_HOME",
-    data: "HASNA_DATA_HOME",
-    state: "HASNA_STATE_HOME",
-    cache: "HASNA_CACHE_HOME"
-  };
-  APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-});
-
-// src/lib/app-home.ts
-import { existsSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2, resolve } from "path";
 function getHomeDir(env = process.env) {
-  return env.HOME || env.USERPROFILE || homedir2();
+  return env.HOME || env.USERPROFILE || homedir();
 }
 function getResolverDataRoot(env = process.env) {
   return dataDir({ app: "hooks", home: getHomeDir(env), env });
 }
 function getLegacyDataRoot(env = process.env) {
-  return join2(getHomeDir(env), ".hasna", "hooks");
+  return join(getHomeDir(env), ".hasna", "hooks");
 }
 function adoptResolverDataRoot(resolved, env = process.env) {
   const dataOverride = env.HASNA_DATA_HOME;
   if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
     return true;
-  return existsSync(join2(resolved, STORE_MARKER));
+  return existsSync(join(resolved, STORE_MARKER));
 }
 function getExplicitDataDir(env = process.env) {
   const dir = env.HASNA_HOOKS_DATA_DIR ?? env.HOOKS_DATA_DIR;
@@ -128,7 +113,7 @@ function getReportedDbPath(env = process.env) {
   const explicit = getExplicitDbPath(env);
   if (explicit)
     return explicit;
-  return join2(getEffectiveDataRoot(env), "hooks.db");
+  return join(getEffectiveDataRoot(env), "hooks.db");
 }
 function getExplicitDbPath(env = process.env) {
   const db = env.HASNA_HOOKS_DB_PATH ?? env.HOOKS_DB_PATH;
@@ -136,9 +121,15 @@ function getExplicitDbPath(env = process.env) {
     return db.trim();
   return;
 }
-var STORE_MARKER = "hooks.db";
+var PATHS_RESOLVER_KIND_ENV, PATHS_RESOLVER_APP_SLUG_RE, STORE_MARKER = "hooks.db";
 var init_app_home = __esm(() => {
-  init_dist();
+  PATHS_RESOLVER_KIND_ENV = {
+    config: "HASNA_CONFIG_HOME",
+    data: "HASNA_DATA_HOME",
+    state: "HASNA_STATE_HOME",
+    cache: "HASNA_CACHE_HOME"
+  };
+  PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 });
 
 // src/db/schema.ts
@@ -336,8 +327,8 @@ var init_migrations = __esm(() => {
 
 // src/db/legacy-import.ts
 import { existsSync as existsSync2, readdirSync, readFileSync } from "fs";
-import { join as join3 } from "path";
-import { homedir as homedir3 } from "os";
+import { join as join2 } from "path";
+import { homedir as homedir2 } from "os";
 function ensureMetaTable(db) {
   db.exec(`
     CREATE TABLE IF NOT EXISTS _meta (
@@ -411,25 +402,25 @@ function importErrorsLog(db, filePath) {
   } catch {}
   return count;
 }
-function runLegacyImport(db, homeDir = homedir3()) {
+function runLegacyImport(db, homeDir = homedir2()) {
   try {
     if (isAlreadyDone(db))
       return;
     let total = 0;
-    const claudeProjectsDir = join3(homeDir, ".claude", "projects");
+    const claudeProjectsDir = join2(homeDir, ".claude", "projects");
     if (existsSync2(claudeProjectsDir)) {
       try {
         const projectDirs = readdirSync(claudeProjectsDir);
         for (const dir of projectDirs) {
-          const projectDir = join3(claudeProjectsDir, dir);
+          const projectDir = join2(claudeProjectsDir, dir);
           try {
             const files = readdirSync(projectDir);
             for (const file of files) {
               if (file.match(/^session-log-\d{4}-\d{2}-\d{2}\.jsonl$/)) {
-                total += importJsonlFile(db, join3(projectDir, file));
+                total += importJsonlFile(db, join2(projectDir, file));
               }
               if (file === "errors.log") {
-                total += importErrorsLog(db, join3(projectDir, file));
+                total += importErrorsLog(db, join2(projectDir, file));
               }
             }
           } catch {}
@@ -466,10 +457,10 @@ function runRetention(db, days) {
 // src/db/index.ts
 import { Database } from "bun:sqlite";
 import { existsSync as existsSync3, mkdirSync, cpSync } from "fs";
-import { join as join4 } from "path";
+import { join as join3 } from "path";
 function resolveDataDir() {
   const effective = getEffectiveDataRoot();
-  const oldDir = join4(getHomeDir(), ".hooks");
+  const oldDir = join3(getHomeDir(), ".hooks");
   if (!existsSync3(effective) && existsSync3(oldDir)) {
     mkdirSync(effective, { recursive: true });
     cpSync(oldDir, effective, { recursive: true });
@@ -481,7 +472,7 @@ function getDbPath() {
   if (explicitDb)
     return explicitDb;
   const dataDir2 = resolveDataDir();
-  return join4(dataDir2, "hooks.db");
+  return join3(dataDir2, "hooks.db");
 }
 function ensureDir(dbPath) {
   const dir = dbPath.substring(0, dbPath.lastIndexOf("/"));
@@ -568,8 +559,8 @@ var init_redact = __esm(() => {
     /AKIA[0-9A-Z]{16}/g,
     /ASIA[0-9A-Z]{16}/g,
     /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
-    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/g,
-    /-----BEGIN OPENSSH PRIVATE KEY-----/g,
+    /-----BEGIN [A-Z0-9 ]*PRIVAT[E] KEY-----/g,
+    /-----BEGIN OPENSSH PRIVAT[E] KEY-----/g,
     /\bBearer\s+[A-Za-z0-9._~+/=-]{6,}/g,
     /\b[a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:[^/\s@]+@/gi,
     /\b(?:password|passwd|pwd|token|api[_-]?key|secret|access[_-]?key|client[_-]?secret|authorization|auth|credential|database_url|db_url|connection_string|dsn)\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;"']{6,})/gi

package/hooks/hook-affected-tests/package.json

@@ -43,7 +43,7 @@
     "bun": ">=1.0"
   },
   "devDependencies": {
-    "@types/bun": "^1.3.8",
+    "@types/bun": "1.3.14",
     "@types/node": "^20",
     "typescript": "^5.0.0"
   }

package/hooks/hook-agent-rules-version-check/package.json

@@ -46,7 +46,7 @@
     "bun": ">=1.0"
   },
   "devDependencies": {
-    "@types/bun": "^1.3.8",
+    "@types/bun": "1.3.14",
     "@types/node": "^20",
     "typescript": "^5.0.0"
   }

package/hooks/hook-agentmessages/package.json

@@ -23,7 +23,7 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@types/bun": "^1.3.8",
+    "@types/bun": "1.3.14",
     "typescript": "^5.7.2"
   },
   "author": "Hasna",

package/hooks/hook-announce-start/package.json

@@ -44,7 +44,7 @@
     "bun": ">=1.0"
   },
   "devDependencies": {
-    "@types/bun": "^1.3.8",
+    "@types/bun": "1.3.14",
     "@types/node": "^20",
     "typescript": "^5.0.0"
   }

package/hooks/hook-announce-stop/package.json

@@ -44,7 +44,7 @@
     "bun": ">=1.0"
   },
   "devDependencies": {
-    "@types/bun": "^1.3.8",
+    "@types/bun": "1.3.14",
     "@types/node": "^20",
     "typescript": "^5.0.0"
   }

package/hooks/hook-autoformat/package.json

@@ -51,7 +51,7 @@
     "bun": ">=1.0"
   },
   "devDependencies": {
-    "@types/bun": "^1.3.8",
+    "@types/bun": "1.3.14",
     "@types/node": "^20",
     "typescript": "^5.0.0"
   }

package/hooks/hook-branchprotect/package.json

@@ -35,7 +35,7 @@
   },
   "engines": { "node": ">=18", "bun": ">=1.0" },
   "devDependencies": {
-    "@types/bun": "^1.3.8",
+    "@types/bun": "1.3.14",
     "@types/node": "^20",
     "typescript": "^5.0.0"
   }

package/hooks/hook-checkbugs/package.json

@@ -51,7 +51,7 @@
     "bun": ">=1.0"
   },
   "devDependencies": {
-    "@types/bun": "^1.3.8",
+    "@types/bun": "1.3.14",
     "@types/node": "^20",
     "typescript": "^5.0.0"
   }

package/hooks/hook-checkdocs/package.json

@@ -50,7 +50,7 @@
     "bun": ">=1.0"
   },
   "devDependencies": {
-    "@types/bun": "^1.3.8",
+    "@types/bun": "1.3.14",
     "@types/node": "^20",
     "typescript": "^5.0.0"
   }

package/hooks/hook-checkfiles/package.json

@@ -49,7 +49,7 @@
     "bun": ">=1.0"
   },
   "devDependencies": {
-    "@types/bun": "^1.3.8",
+    "@types/bun": "1.3.14",
     "@types/node": "^20",
     "typescript": "^5.0.0"
   }