@hasna/hooks 0.7.7 → 0.7.9

package/bin/index.js

@@ -1958,7 +1958,7 @@ var init_registry = __esm(() => {
     {
       name: "workspace-repos-guard",
       displayName: "Workspace Repos Guard",
-      description: "Blocks writes and deletes that break the ~/workspace/repos structure: writes to the repos root, top-level entry creation, non-org folders, and any delete under repos",
+      description: "Blocks writes and deletes that break the protected repo-checkout structure (~/.hasna/repos/clones canonical, plus legacy ~/workspace/repos during the migration window): writes to a protected root, top-level entry creation, non-org folders, and any delete under a protected root",
       version: "0.1.0",
       category: "Git Safety",
       event: "PreToolUse",
@@ -8908,8 +8908,12 @@ import { existsSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
 import { createHmac, timingSafeEqual } from "crypto";
+import { lookup as dnsLookup } from "dns/promises";
+import { isIP } from "net";
 import { randomUUID } from "crypto";
 import { spawn } from "child_process";
+import { request as nodeHttpRequest } from "http";
+import { request as nodeHttpsRequest } from "https";
 import { randomUUID as randomUUID2 } from "crypto";
 function getPathValue(input, path) {
   return path.split(".").reduce((value, part) => {
@@ -9312,6 +9316,214 @@ function signPayload(secret, timestamp, body) {
   const digest = createHmac("sha256", secret).update(buildSignatureBase(timestamp, body)).digest("hex");
   return `sha256=${digest}`;
 }
+var DEFAULT_MAX_REDIRECTS = 5;
+var IPV4_PRIVATE_RANGES = [
+  [0, 16777215],
+  [167772160, 184549375],
+  [1681915904, 1686110207],
+  [2130706432, 2147483647],
+  [2851995648, 2852061183],
+  [2886729728, 2887778303],
+  [3221225472, 3221225727],
+  [3221225984, 3221226239],
+  [3227017984, 3227018239],
+  [3232235520, 3232301055],
+  [3323068416, 3323199487],
+  [3325256704, 3325256959],
+  [3405803776, 3405804031],
+  [3758096384, 4294967295]
+];
+var IPV6_SPECIAL_PREFIXES = [
+  { groups: [0, 0, 0, 0, 0, 0, 0, 0], bits: 128 },
+  { groups: [0, 0, 0, 0, 0, 0, 0, 1], bits: 128 },
+  { groups: [0, 0, 0, 0, 0, 65535, 0, 0], bits: 96 },
+  { groups: [100, 65435, 0, 0, 0, 0, 0, 0], bits: 96 },
+  { groups: [256, 0, 0, 0, 0, 0, 0, 0], bits: 64 },
+  { groups: [8193, 0, 0, 0, 0, 0, 0, 0], bits: 32 },
+  { groups: [8193, 2, 0, 0, 0, 0, 0, 0], bits: 48 },
+  { groups: [8193, 16, 0, 0, 0, 0, 0, 0], bits: 28 },
+  { groups: [8193, 3512, 0, 0, 0, 0, 0, 0], bits: 32 },
+  { groups: [8194, 0, 0, 0, 0, 0, 0, 0], bits: 16 },
+  { groups: [16383, 0, 0, 0, 0, 0, 0, 0], bits: 20 },
+  { groups: [64512, 0, 0, 0, 0, 0, 0, 0], bits: 7 },
+  { groups: [65152, 0, 0, 0, 0, 0, 0, 0], bits: 10 },
+  { groups: [65216, 0, 0, 0, 0, 0, 0, 0], bits: 10 },
+  { groups: [65280, 0, 0, 0, 0, 0, 0, 0], bits: 8 }
+];
+function isPrivateAddress(address) {
+  const normalized = stripZoneId(address);
+  const version = isIP(normalized);
+  if (version === 4) {
+    const integer = ipv4ToInt(normalized);
+    if (integer === undefined)
+      return true;
+    return IPV4_PRIVATE_RANGES.some(([low, high]) => integer >= low && integer <= high);
+  }
+  if (version === 6) {
+    const groups = ipv6Groups(normalized);
+    if (!groups)
+      return true;
+    for (const prefix of IPV6_SPECIAL_PREFIXES) {
+      if (!ipv6MatchesPrefix(groups, prefix.groups, prefix.bits))
+        continue;
+      if (prefix.bits === 96 && groups[5] === 65535) {
+        return isPrivateAddress(ipv4IntToString(groups[6] << 16 | groups[7]));
+      }
+      if (prefix.bits === 16 && groups[0] === 8194) {
+        return isPrivateAddress(ipv4IntToString(groups[1] << 16 | groups[2]));
+      }
+      return true;
+    }
+    return false;
+  }
+  return true;
+}
+async function resolveWebhookTarget(url, policy = {}) {
+  const hostname = normalizeHostname(url.hostname);
+  const allowlist = (policy.allowPrivateHosts ?? []).map((entry) => normalizeHostname(entry.toLowerCase()));
+  if (allowlist.includes(hostname)) {
+    const version2 = isIP(hostname);
+    if (version2 === 4 || version2 === 6) {
+      return { hostname, addresses: [hostname] };
+    }
+    const lookup2 = policy.lookup ?? defaultTargetLookup;
+    let resolved2;
+    try {
+      resolved2 = await lookup2(hostname);
+    } catch {
+      throw new Error(`Webhook target ${hostname} could not be resolved`);
+    }
+    if (!Array.isArray(resolved2) || resolved2.length === 0) {
+      throw new Error(`Webhook target ${hostname} resolved to no addresses`);
+    }
+    const addresses = resolved2.map((entry) => normalizeHostname(entry.address));
+    return { hostname, addresses };
+  }
+  const version = isIP(hostname);
+  if (version === 4 || version === 6) {
+    if (isPrivateAddress(hostname)) {
+      throw new Error(`Webhook target ${hostname} is a private or special-use address`);
+    }
+    return { hostname, addresses: [hostname] };
+  }
+  const lookup = policy.lookup ?? defaultTargetLookup;
+  let resolved;
+  try {
+    resolved = await lookup(hostname);
+  } catch {
+    throw new Error(`Webhook target ${hostname} could not be resolved`);
+  }
+  if (!Array.isArray(resolved) || resolved.length === 0) {
+    throw new Error(`Webhook target ${hostname} resolved to no addresses`);
+  }
+  const allowed = [];
+  for (const entry of resolved) {
+    const address = normalizeHostname(entry.address);
+    if (isPrivateAddress(address)) {
+      if (allowlist.includes(address)) {
+        allowed.push(address);
+        continue;
+      }
+      throw new Error(`Webhook target ${hostname} resolves to private or special-use address ${address}`);
+    }
+    allowed.push(address);
+  }
+  if (allowed.length === 0) {
+    throw new Error(`Webhook target ${hostname} resolved to no public addresses`);
+  }
+  return { hostname, addresses: allowed };
+}
+function normalizeMaxRedirects(value) {
+  if (value === undefined)
+    return DEFAULT_MAX_REDIRECTS;
+  if (!Number.isInteger(value) || value < 0)
+    throw new Error("webhookTargetPolicy.maxRedirects must be a non-negative integer");
+  return value;
+}
+var defaultTargetLookup = async (hostname) => {
+  return dnsLookup(hostname, { all: true, verbatim: false });
+};
+function normalizeHostname(hostname) {
+  const lower = hostname.toLowerCase();
+  if (lower.startsWith("[") && lower.endsWith("]"))
+    return lower.slice(1, -1);
+  return lower;
+}
+function stripZoneId(address) {
+  const percent = address.indexOf("%");
+  return percent === -1 ? address : address.slice(0, percent);
+}
+function ipv4ToInt(address) {
+  const parts = address.split(".");
+  if (parts.length !== 4)
+    return;
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part))
+      return;
+    const octet = Number(part);
+    if (octet > 255)
+      return;
+    value = value << 8 | octet;
+  }
+  return value >>> 0;
+}
+function ipv4IntToString(integer) {
+  return [
+    integer >>> 24 & 255,
+    integer >>> 16 & 255,
+    integer >>> 8 & 255,
+    integer & 255
+  ].join(".");
+}
+function ipv6Groups(address) {
+  const raw = stripZoneId(address);
+  const doubleColon = raw.indexOf("::");
+  const headText = doubleColon === -1 ? raw : raw.slice(0, doubleColon);
+  const tailText = doubleColon === -1 ? "" : raw.slice(doubleColon + 2);
+  const parseGroups = (text) => {
+    if (text === "")
+      return [];
+    const out = [];
+    for (const part of text.split(":")) {
+      if (part.includes(".")) {
+        const v4 = ipv4ToInt(part);
+        if (v4 === undefined)
+          return;
+        out.push(v4 >>> 16 & 65535, v4 & 65535);
+      } else {
+        if (!/^[0-9a-fA-F]{1,4}$/.test(part))
+          return;
+        out.push(parseInt(part, 16));
+      }
+    }
+    return out;
+  };
+  const head = parseGroups(headText);
+  if (!head)
+    return;
+  const tail = parseGroups(tailText);
+  if (!tail)
+    return;
+  const total = head.length + tail.length;
+  if (doubleColon === -1) {
+    return total === 8 ? head : undefined;
+  }
+  if (total >= 8)
+    return;
+  return [...head, ...new Array(8 - total).fill(0), ...tail];
+}
+function ipv6MatchesPrefix(groups, prefixGroups, prefixBits) {
+  let remaining = prefixBits;
+  for (let index = 0;index < prefixGroups.length && remaining > 0; index += 1) {
+    const take = Math.min(16, remaining);
+    const mask = 65535 << 16 - take & 65535;
+    if ((groups[index] & mask) !== (prefixGroups[index] & mask))
+      return false;
+    remaining -= take;
+  }
+  return true;
+}
 function now() {
   return new Date().toISOString();
 }
@@ -9342,9 +9554,18 @@ function buildWebhookRequest(event, channel, options = {}) {
   }
   return { body, headers };
 }
+function normalizeWebhookUrl(raw) {
+  const url = new URL(raw);
+  if (url.username !== "" || url.password !== "") {
+    url.username = "";
+    url.password = "";
+  }
+  return url.toString();
+}
 async function dispatchWebhook(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
+  const webhookUrl = normalizeWebhookUrl(channel.webhook.url);
   const startedAt = now();
   let secret = channel.webhook.secret;
   if (channel.webhook.secretRef) {
@@ -9361,10 +9582,14 @@ async function dispatchWebhook(event, channel, options = {}) {
   }
   const timestamp = (options.now?.() ?? new Date).toISOString();
   const { body, headers } = buildWebhookRequest(event, channel, { secret, timestamp });
+  const validateTargets = options.webhookTargetPolicy !== undefined || options.fetchImpl === undefined;
+  if (validateTargets) {
+    return dispatchValidatedWebhook(event, channel, { body, headers, startedAt, options });
+  }
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
   try {
-    const response = await (options.fetchImpl ?? fetch)(channel.webhook.url, {
+    const response = await (options.fetchImpl ?? fetch)(webhookUrl, {
       method: "POST",
       headers,
       body,
@@ -9392,6 +9617,130 @@ async function dispatchWebhook(event, channel, options = {}) {
     clearTimeout(timeout);
   }
 }
+function isRedirectStatus(status) {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function redirectKeepsBody(status) {
+  return status === 307 || status === 308;
+}
+async function pinnedNativeRequest(target, addresses, method, headers, body, signal, tls) {
+  const isHttps = target.protocol === "https:";
+  if (!isHttps && target.protocol !== "http:") {
+    throw new Error(`Webhook target uses unsupported protocol ${target.protocol}`);
+  }
+  const defaultPort = isHttps ? 443 : 80;
+  const port = target.port ? Number(target.port) : defaultPort;
+  const requestOptions = {
+    hostname: target.hostname,
+    port,
+    path: `${target.pathname}${target.search}`,
+    method,
+    headers,
+    ...tls?.ca ? { ca: tls.ca } : {},
+    lookup: (hostname, _options, callback) => {
+      const entries = addresses.map((address) => ({
+        address,
+        family: address.includes(":") ? 6 : 4
+      }));
+      callback(null, entries);
+    }
+  };
+  return new Promise((resolve, reject) => {
+    const request = isHttps ? nodeHttpsRequest(requestOptions, onResponse) : nodeHttpRequest(requestOptions, onResponse);
+    const onAbort = () => {
+      const error = new Error("The operation was aborted.");
+      error.name = "AbortError";
+      request.destroy(error);
+    };
+    if (signal.aborted)
+      onAbort();
+    else
+      signal.addEventListener("abort", onAbort, { once: true });
+    request.on("error", reject);
+    if (body !== undefined)
+      request.write(body);
+    request.end();
+    function onResponse(response) {
+      const chunks = [];
+      response.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+      response.on("error", reject);
+      response.on("end", () => {
+        const headersRecord = {};
+        for (const [name, value] of Object.entries(response.headers)) {
+          if (typeof value === "string")
+            headersRecord[name] = value;
+          else if (Array.isArray(value))
+            headersRecord[name] = value.join(", ");
+        }
+        resolve(new Response(Buffer.concat(chunks), { status: response.statusCode ?? 200, headers: headersRecord }));
+      });
+    }
+  });
+}
+async function dispatchValidatedWebhook(event, channel, input) {
+  const { body, headers, startedAt, options } = input;
+  const webhook = channel.webhook;
+  if (!webhook)
+    throw new Error(`Channel ${channel.id} has no webhook config`);
+  const policy = options.webhookTargetPolicy ?? {};
+  const maxRedirects = normalizeMaxRedirects(policy.maxRedirects);
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), webhook.timeoutMs ?? 15000);
+  try {
+    let target = new URL(normalizeWebhookUrl(webhook.url));
+    let requestHeaders = headers;
+    let method = "POST";
+    let requestBody = body;
+    let redirectsFollowed = 0;
+    for (;; ) {
+      const resolved = await resolveWebhookTarget(target, policy).catch((error) => {
+        throw new Error(`Webhook target rejected by SSRF guard: ${error.message}`);
+      });
+      const response = options.fetchImpl ? await options.fetchImpl(target, {
+        method,
+        headers: requestHeaders,
+        body: requestBody,
+        signal: controller.signal,
+        redirect: "manual"
+      }) : await pinnedNativeRequest(target, resolved.addresses, method, requestHeaders, requestBody, controller.signal, options.tls);
+      const location = response.headers.get("location");
+      if (isRedirectStatus(response.status) && location) {
+        if (redirectsFollowed >= maxRedirects) {
+          return failedAttempt(startedAt, `Webhook target exceeded ${maxRedirects} redirects`);
+        }
+        redirectsFollowed += 1;
+        const next = new URL(location, target);
+        target = next;
+        if (!redirectKeepsBody(response.status)) {
+          method = "GET";
+          requestBody = undefined;
+          requestHeaders = Object.fromEntries(Object.entries(requestHeaders).filter(([name]) => name.toLowerCase() !== "content-type" && name.toLowerCase() !== "content-length"));
+        }
+        continue;
+      }
+      const responseBody = truncate(await response.text());
+      return {
+        attempt: 1,
+        status: response.ok ? "success" : "failed",
+        startedAt,
+        completedAt: now(),
+        responseStatus: response.status,
+        responseBody,
+        error: response.ok ? undefined : `Webhook returned HTTP ${response.status}`
+      };
+    }
+  } catch (error) {
+    return {
+      attempt: 1,
+      status: "failed",
+      startedAt,
+      completedAt: now(),
+      error: error instanceof Error ? error.message : String(error)
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 function failedAttempt(startedAt, error) {
   return {
     attempt: 1,
@@ -9601,7 +9950,9 @@ class EventsClient {
     this.transportOptions = {
       fetchImpl: options.fetchImpl,
       secretResolver: options.secretResolver,
-      now: options.now
+      now: options.now,
+      tls: options.tls,
+      webhookTargetPolicy: options.webhookTargetPolicy
     };
     this.catalog = options.catalog ?? defaultEventTypeCatalog;
     this.validateCatalogTypes = options.validateCatalogTypes ?? false;
@@ -12813,6 +13164,29 @@ Cloudflare provisioning complete:
   console.log(chalk2.dim("  wrangler.toml, fill in the D1 database id, then run the commands above."));
   console.log();
 });
+program2.command("migrate").description("Apply PostgreSQL migrations to the storage database (HASNA_HOOKS_DATABASE_URL)").option("-j, --json", "Output as JSON", false).action(async (options) => {
+  try {
+    const { getStoragePg: getStoragePg2, runStorageMigrations: runStorageMigrations2 } = await Promise.resolve().then(() => (init_storage(), exports_storage));
+    const remote = await getStoragePg2();
+    try {
+      await runStorageMigrations2(remote);
+    } finally {
+      await remote.close();
+    }
+    if (options.json) {
+      console.log(JSON.stringify({ ok: true }));
+      return;
+    }
+    console.log(chalk2.green("\u2713 PostgreSQL migrations applied"));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (options.json)
+      console.log(JSON.stringify({ error: message }));
+    else
+      console.error(chalk2.red(`\u2717 ${message}`));
+    process.exitCode = 1;
+  }
+});
 program2.command("mcp").option("-s, --stdio", "Use stdio transport (one process per agent)", false).option("--sse", "Use legacy SSE transport (port 39427)", false).option("--http", "Use Streamable HTTP transport (explicit; this is also the default)", false).option("-p, --port <port>", "Port for HTTP/SSE transport (defaults to 8847 for HTTP, 39427 for SSE)").description("Start MCP server for AI agent integration (default: shared Streamable HTTP)").action(async (options) => {
   if (options.stdio) {
     const { startStdioServer: startStdioServer2 } = await Promise.resolve().then(() => (init_server(), exports_server));

package/bin/serve.js

@@ -60,7 +60,7 @@ var HOOKS = [
   {
     name: "workspace-repos-guard",
     displayName: "Workspace Repos Guard",
-    description: "Blocks writes and deletes that break the ~/workspace/repos structure: writes to the repos root, top-level entry creation, non-org folders, and any delete under repos",
+    description: "Blocks writes and deletes that break the protected repo-checkout structure (~/.hasna/repos/clones canonical, plus legacy ~/workspace/repos during the migration window): writes to a protected root, top-level entry creation, non-org folders, and any delete under a protected root",
     version: "0.1.0",
     category: "Git Safety",
     event: "PreToolUse",

package/dist/index.js

@@ -6191,7 +6191,7 @@ var HOOKS = [
   {
     name: "workspace-repos-guard",
     displayName: "Workspace Repos Guard",
-    description: "Blocks writes and deletes that break the ~/workspace/repos structure: writes to the repos root, top-level entry creation, non-org folders, and any delete under repos",
+    description: "Blocks writes and deletes that break the protected repo-checkout structure (~/.hasna/repos/clones canonical, plus legacy ~/workspace/repos during the migration window): writes to a protected root, top-level entry creation, non-org folders, and any delete under a protected root",
     version: "0.1.0",
     category: "Git Safety",
     event: "PreToolUse",

package/hooks/hook-workspace-repos-guard/README.md

@@ -2,35 +2,38 @@
 
 Codewith-native hook installed as `hooks run workspace-repos-guard`.
 
-PreToolUse guard for the canonical workspace structure (knowledge
-`k_mssu9jdq_dgnnu2`): `$HOME/workspace` contains ONLY `repos/` + `scratch/` +
-`AGENTS.md`, and `repos/` contains ONLY GitHub-org folders. Checkouts at
-`$HOME/workspace/repos/<org>/<repo>/` are read/context only.
+PreToolUse guard for the protected repo-checkout roots. During the migration
+window BOTH roots are guarded: the canonical clones root (knowledge
+`k_mssu9jdq_dgnnu2`) `$HOME/.hasna/repos/clones`, and the still-live legacy
+root `$HOME/workspace/repos`. Each contains ONLY GitHub-org folders, and
+checkouts at `<root>/<org>/<repo>/` are read/context only. The legacy root
+stays guarded until `~/workspace/repos` is decommissioned fleet-wide.
 
 ## What it blocks
 
-- Any write to `$HOME/workspace/repos` itself (file tools and Bash).
-- Any write that would create a top-level entry directly under `repos/`
+- Any write to either protected root itself (`$HOME/.hasna/repos/clones` or
+  `$HOME/workspace/repos`), via file tools and Bash.
+- Any write that would create a top-level entry directly under either root
   (depth 1 — a stray folder or file at the org level).
 - Any write whose second path segment is not an allowed GitHub org.
 - Any delete (`rm`, `rmdir`, `git clean`, `git rm`, `unlink`, `shred`,
-  `trash`, ...) anywhere under `$HOME/workspace/repos`, at any depth,
+  `trash`, ...) anywhere under either protected root, at any depth,
   including deep inside org checkouts.
 
 ## What it allows
 
 - Reads, always.
 - Writes deeper inside an allowed org folder
-  (`repos/<org>/<repo>/...`). Structure only: it deliberately does NOT
+  (`clones/<org>/<repo>/...`). Structure only: it deliberately does NOT
   duplicate the `worktree-guard` hook, which owns edits-in-shared-checkouts
   semantics.
 
 Home spellings (`~`, `$HOME`, `${HOME}`, quoted or not, including split-quote
-forms like `"$HOME"/workspace/repos`, which Bash treats identically to the
+forms like `"$HOME"/.hasna/repos/clones`, which Bash treats identically to the
 unquoted spelling) are expanded before classification; `apply_patch` tools
 are inspected through their `Add File` / `Update File` / `Delete File`
 markers; Bash relative operands are resolved against the command's cwd when
-it sits under `repos/`; parenthesized command groups
+it sits under the clones root; parenthesized command groups
 (`(cd ... && rm -rf ...)`) are unwrapped.
 
 ## Configuration

package/hooks/hook-workspace-repos-guard/src/hook.test.ts

@@ -4,7 +4,8 @@ import { join } from "path";
 import { evaluate, resolveAllowedOrgs } from "./hook";
 
 const HOME = homedir();
-const REPOS = join(HOME, "workspace", "repos");
+const REPOS = join(HOME, ".hasna", "repos", "clones");
+const LEGACY = join(HOME, "workspace", "repos");
 
 function preToolUse(tool_name: string, tool_input: Record<string, unknown>, cwd = join(REPOS, "hasna", "apps")) {
   return { hook_event_name: "PreToolUse", tool_name, tool_input, cwd };
@@ -75,11 +76,11 @@ function isBlocked(result: { output: { decision?: string; reason?: string } }):
 
     test("tilde/$HOME spellings of deep allowed-org writes continue", () => {
       const commands = [
-        `touch ~/workspace/repos/hasna/apps/foo.md`,
-        `echo x > ~/workspace/repos/hasnaxyz/iapp-probe/notes.md`,
-        `mkdir -p "${HOME}/workspace/repos/hasnaxyz/iapp-probe/notes"`,
-        `touch "$HOME"/workspace/repos/hasna/apps/x.txt`,
-        `echo x > "\${HOME}"/workspace/repos/hasnaxyz/iapp-probe/notes.md`,
+        `touch ~/.hasna/repos/clones/hasna/apps/foo.md`,
+        `echo x > ~/.hasna/repos/clones/hasnaxyz/iapp-probe/notes.md`,
+        `mkdir -p "${HOME}/.hasna/repos/clones/hasnaxyz/iapp-probe/notes"`,
+        `touch "$HOME"/.hasna/repos/clones/hasna/apps/x.txt`,
+        `echo x > "\${HOME}"/.hasna/repos/clones/hasnaxyz/iapp-probe/notes.md`,
       ];
       for (const command of commands) {
         const result = evaluate(preToolUse("Bash", { command }));
@@ -89,10 +90,10 @@ function isBlocked(result: { output: { decision?: string; reason?: string } }):
 
     test("file-tool tilde/$HOME paths deep inside an allowed org continue", () => {
       const results = [
-        evaluate(preToolUse("Write", { file_path: `~/workspace/repos/hasna/apps/src/x.ts` })),
-        evaluate(preToolUse("Edit", { file_path: `$HOME/workspace/repos/hasnaxyz/iapp-probe/n.ipynb` })),
-        evaluate(preToolUse("Write", { file_path: `"${HOME}/workspace/repos/hasna/apps/notes.md"` })),
-        evaluate(preToolUse("Write", { file_path: `"$HOME"/workspace/repos/hasna/apps/notes2.md` })),
+        evaluate(preToolUse("Write", { file_path: `~/.hasna/repos/clones/hasna/apps/src/x.ts` })),
+        evaluate(preToolUse("Edit", { file_path: `$HOME/.hasna/repos/clones/hasnaxyz/iapp-probe/n.ipynb` })),
+        evaluate(preToolUse("Write", { file_path: `"${HOME}/.hasna/repos/clones/hasna/apps/notes.md"` })),
+        evaluate(preToolUse("Write", { file_path: `"$HOME"/.hasna/repos/clones/hasna/apps/notes2.md` })),
       ];
       for (const result of results) {
         expect(result.output.continue).toBe(true);
@@ -129,7 +130,7 @@ function isBlocked(result: { output: { decision?: string; reason?: string } }):
   });
 
   describe("negative controls — must block", () => {
-    test("Write to ~/workspace/repos itself is blocked", () => {
+    test("Write to ~/.hasna/repos/clones itself is blocked", () => {
       const result = evaluate(preToolUse("Write", { file_path: join(REPOS, "stray.txt") }));
       const reason = isBlocked(result);
       expect(reason).not.toBeNull();
@@ -207,21 +208,21 @@ function isBlocked(result: { output: { decision?: string; reason?: string } }):
 
     test("tilde/$HOME spellings of the protected path are blocked", () => {
       const commands = [
-        `rm -rf ~/workspace/repos`,
-        `rm -rf ~/workspace/repos/hasna/apps`,
-        `rm -rf $HOME/workspace/repos/hasna`,
-        `rm -rf "${HOME}/workspace/repos"`,
-        `rm -rf "$HOME"/workspace/repos`,
-        `rm -rf "$HOME"/workspace/repos/hasna/apps`,
-        `rm -rf "\${HOME}"/workspace/repos/hasna`,
-        `rm -rf "${HOME}"/workspace/repos/hasna`,
-        `touch ~/workspace/repos/stray.txt`,
-        `mkdir -p ~/workspace/repos/notanorg`,
-        `echo x > ~/workspace/repos/notanorg/f.ts`,
-        `mv /tmp/x ~/workspace/repos`,
-        `truncate -s 0 ~/workspace/repos/stray.log`,
-        `rsync -a /tmp/x ~/workspace/repos/`,
-        `scp f.txt ~/workspace/repos/`,
+        `rm -rf ~/.hasna/repos/clones`,
+        `rm -rf ~/.hasna/repos/clones/hasna/apps`,
+        `rm -rf $HOME/.hasna/repos/clones/hasna`,
+        `rm -rf "${HOME}/.hasna/repos/clones"`,
+        `rm -rf "$HOME"/.hasna/repos/clones`,
+        `rm -rf "$HOME"/.hasna/repos/clones/hasna/apps`,
+        `rm -rf "\${HOME}"/.hasna/repos/clones/hasna`,
+        `rm -rf "${HOME}"/.hasna/repos/clones/hasna`,
+        `touch ~/.hasna/repos/clones/stray.txt`,
+        `mkdir -p ~/.hasna/repos/clones/notanorg`,
+        `echo x > ~/.hasna/repos/clones/notanorg/f.ts`,
+        `mv /tmp/x ~/.hasna/repos/clones`,
+        `truncate -s 0 ~/.hasna/repos/clones/stray.log`,
+        `rsync -a /tmp/x ~/.hasna/repos/clones/`,
+        `scp f.txt ~/.hasna/repos/clones/`,
       ];
       for (const command of commands) {
         const result = evaluate(preToolUse("Bash", { command }));
@@ -231,11 +232,11 @@ function isBlocked(result: { output: { decision?: string; reason?: string } }):
 
     test("file-tool tilde/$HOME spellings are blocked", () => {
       const results = [
-        evaluate(preToolUse("Write", { file_path: `~/workspace/repos/stray.txt` })),
-        evaluate(preToolUse("Write", { file_path: `$HOME/workspace/repos/notanorg/f.ts` })),
-        evaluate(preToolUse("Edit", { file_path: `~/workspace/repos/hasna` })),
-        evaluate(preToolUse("Write", { file_path: `~/workspace/repos` })),
-        evaluate(preToolUse("Write", { file_path: `"$HOME"/workspace/repos/stray.txt` })),
+        evaluate(preToolUse("Write", { file_path: `~/.hasna/repos/clones/stray.txt` })),
+        evaluate(preToolUse("Write", { file_path: `$HOME/.hasna/repos/clones/notanorg/f.ts` })),
+        evaluate(preToolUse("Edit", { file_path: `~/.hasna/repos/clones/hasna` })),
+        evaluate(preToolUse("Write", { file_path: `~/.hasna/repos/clones` })),
+        evaluate(preToolUse("Write", { file_path: `"$HOME"/.hasna/repos/clones/stray.txt` })),
       ];
       for (const result of results) {
         expect(isBlocked(result)).not.toBeNull();
@@ -244,7 +245,7 @@ function isBlocked(result: { output: { decision?: string; reason?: string } }):
 
     test("subshell-grouped cd + rm is blocked", () => {
       const commands = [
-        `(cd ~/workspace/repos && rm -rf hasna)`,
+        `(cd ~/.hasna/repos/clones && rm -rf hasna)`,
         `(cd ${REPOS} && rm -rf hasna)`,
         `( cd ${REPOS} && touch stray.txt )`,
       ];
@@ -265,11 +266,11 @@ function isBlocked(result: { output: { decision?: string; reason?: string } }):
 
     test("mutating verbs writing under the protected root are blocked", () => {
       const commands = [
-        `sed -i 's/x/y/' ~/workspace/repos/stray.txt`,
+        `sed -i 's/x/y/' ~/.hasna/repos/clones/stray.txt`,
         `rsync -a ${join(REPOS, "hasna")} /tmp/out`,
         `scp -r ${join(REPOS, "hasna")} other:/tmp/`,
         `truncate -s 0 ${join(REPOS, "notanorg", "f.ts")}`,
-        `python3 -c "open('~/workspace/repos/stray.txt','w')"`,
+        `python3 -c "open('~/.hasna/repos/clones/stray.txt','w')"`,
         `node -e "require('fs').writeFileSync('${join(REPOS, "notanorg", "f.ts")}','x')"`,
       ];
       for (const command of commands) {
@@ -309,4 +310,157 @@ function isBlocked(result: { output: { decision?: string; reason?: string } }):
       }
     });
   });
+
+  describe("legacy ~/workspace/repos root during the migration window — positive controls (must continue)", () => {
+    test("Write deep inside an allowed org checkout under the legacy root continues", () => {
+      const result = evaluate(preToolUse("Write", { file_path: join(LEGACY, "hasna", "apps", "apps", "foo", "src", "index.ts") }));
+      expect(result.output.continue).toBe(true);
+      expect(isBlocked(result)).toBeNull();
+    });
+
+    test("Bash write deep inside an allowed org checkout under the legacy root continues", () => {
+      const commands = [
+        `echo note > ${join(LEGACY, "hasna", "apps", "scratch.md")}`,
+        `git clone https://github.com/hasna/foo.git ${join(LEGACY, "hasna", "foo")}`,
+        `mkdir -p ${join(LEGACY, "hasnaxyz", "iapp-probe", "docs")}`,
+      ];
+      for (const command of commands) {
+        const result = evaluate(preToolUse("Bash", { command }));
+        expect(result.output.continue).toBe(true);
+      }
+    });
+
+    test("tilde/$HOME spellings of deep allowed-org writes under the legacy root continue", () => {
+      const commands = [
+        `touch ~/workspace/repos/hasna/apps/foo.md`,
+        `echo x > ~/workspace/repos/hasnaxyz/iapp-probe/notes.md`,
+        `mkdir -p "${HOME}/workspace/repos/hasnaxyz/iapp-probe/notes"`,
+        `touch "$HOME"/workspace/repos/hasna/apps/x.txt`,
+        `echo x > "\${HOME}"/workspace/repos/hasnaxyz/iapp-probe/notes.md`,
+      ];
+      for (const command of commands) {
+        const result = evaluate(preToolUse("Bash", { command }));
+        expect(result.output.continue).toBe(true);
+      }
+    });
+
+    test("file-tool tilde/$HOME paths deep inside an allowed org under the legacy root continue", () => {
+      const results = [
+        evaluate(preToolUse("Write", { file_path: `~/workspace/repos/hasna/apps/src/x.ts` })),
+        evaluate(preToolUse("Edit", { file_path: `$HOME/workspace/repos/hasnaxyz/iapp-probe/n.ipynb` })),
+        evaluate(preToolUse("Write", { file_path: `"${HOME}/workspace/repos/hasna/apps/notes.md"` })),
+        evaluate(preToolUse("Write", { file_path: `"$HOME"/workspace/repos/hasna/apps/notes2.md` })),
+      ];
+      for (const result of results) {
+        expect(result.output.continue).toBe(true);
+      }
+    });
+  });
+
+  describe("legacy ~/workspace/repos root during the migration window — negative controls restored (must block)", () => {
+    test("rm -rf of the legacy root itself is blocked", () => {
+      const result = evaluate(preToolUse("Bash", { command: `rm -rf ~/workspace/repos` }));
+      const reason = isBlocked(result);
+      expect(reason).not.toBeNull();
+      expect(reason).toContain("workspace-repos-guard");
+    });
+
+    test("rm -rf deep inside an allowed org checkout under the legacy root is blocked", () => {
+      const result = evaluate(preToolUse("Bash", { command: `rm -rf ~/workspace/repos/hasna/apps` }));
+      expect(isBlocked(result)).not.toBeNull();
+    });
+
+    test("tilde/$HOME spellings of the legacy root are blocked", () => {
+      const commands = [
+        `rm -rf ~/workspace/repos`,
+        `rm -rf ~/workspace/repos/hasna/apps`,
+        `rm -rf $HOME/workspace/repos/hasna`,
+        `rm -rf "${HOME}/workspace/repos"`,
+        `rm -rf "$HOME"/workspace/repos`,
+        `rm -rf "$HOME"/workspace/repos/hasna/apps`,
+        `rm -rf "\${HOME}"/workspace/repos/hasna`,
+        `rm -rf "${HOME}"/workspace/repos/hasna`,
+        `touch ~/workspace/repos/stray.txt`,
+        `mkdir -p ~/workspace/repos/notanorg`,
+        `echo x > ~/workspace/repos/notanorg/f.ts`,
+        `mv /tmp/x ~/workspace/repos`,
+        `truncate -s 0 ~/workspace/repos/stray.log`,
+        `rsync -a /tmp/x ~/workspace/repos/`,
+        `scp f.txt ~/workspace/repos/`,
+      ];
+      for (const command of commands) {
+        const result = evaluate(preToolUse("Bash", { command }));
+        expect(isBlocked(result), `expected BLOCK for: ${command}`).not.toBeNull();
+      }
+    });
+
+    test("file-tool tilde/$HOME spellings under the legacy root are blocked", () => {
+      const results = [
+        evaluate(preToolUse("Write", { file_path: `~/workspace/repos/stray.txt` })),
+        evaluate(preToolUse("Write", { file_path: `$HOME/workspace/repos/notanorg/f.ts` })),
+        evaluate(preToolUse("Edit", { file_path: `~/workspace/repos/hasna` })),
+        evaluate(preToolUse("Write", { file_path: `~/workspace/repos` })),
+        evaluate(preToolUse("Write", { file_path: `"$HOME"/workspace/repos/stray.txt` })),
+      ];
+      for (const result of results) {
+        expect(isBlocked(result)).not.toBeNull();
+      }
+    });
+
+    test("subshell-grouped cd + rm under the legacy root is blocked", () => {
+      const commands = [
+        `(cd ~/workspace/repos && rm -rf hasna)`,
+        `(cd ${LEGACY} && rm -rf hasna)`,
+        `( cd ${LEGACY} && touch stray.txt )`,
+      ];
+      for (const command of commands) {
+        const result = evaluate(preToolUse("Bash", { command }));
+        expect(isBlocked(result), `expected BLOCK for: ${command}`).not.toBeNull();
+      }
+    });
+
+    test("cwd-relative deletes under the legacy root without an explicit cd are blocked", () => {
+      const fromRoot = evaluate(preToolUse("Bash", { command: `rm -rf .` }, LEGACY));
+      expect(isBlocked(fromRoot)).not.toBeNull();
+      const fromOrg = evaluate(preToolUse("Bash", { command: `rm -rf .` }, join(LEGACY, "hasna")));
+      expect(isBlocked(fromOrg)).not.toBeNull();
+    });
+
+    test("git clean inside a legacy checkout is blocked", () => {
+      const result = evaluate(preToolUse("Bash", { command: `git -C ${join(LEGACY, "hasna", "apps")} clean -fd` }));
+      expect(isBlocked(result)).not.toBeNull();
+    });
+
+    test("top-level non-org folder creation under the legacy root is blocked", () => {
+      const commands = [
+        `mkdir -p ${join(LEGACY, "notanorg")}`,
+        `mkdir -p ${join(LEGACY, "notanorg", "sub")}`,
+        `touch ${join(LEGACY, "neworg", "x")}`,
+        `mv ${join(LEGACY, "hasna", "apps", "a")} ${join(LEGACY, "anotherorg")}`,
+      ];
+      for (const command of commands) {
+        const result = evaluate(preToolUse("Bash", { command }));
+        expect(isBlocked(result)).not.toBeNull();
+      }
+    });
+
+    test("Bash write into a non-allowed org folder under the legacy root is blocked", () => {
+      const result = evaluate(preToolUse("Bash", { command: `echo x > ${join(LEGACY, "notanorg", "deep", "f.ts")}` }));
+      expect(isBlocked(result)).not.toBeNull();
+    });
+
+    test("mutating verbs writing under the legacy root are blocked", () => {
+      const commands = [
+        `sed -i 's/x/y/' ~/workspace/repos/stray.txt`,
+        `python3 -c "open('~/workspace/repos/stray.txt','w')"`,
+        `truncate -s 0 ${join(LEGACY, "notanorg", "f.ts")}`,
+        `rsync -a ${join(LEGACY, "hasna")} /tmp/out`,
+        `scp -r ${join(LEGACY, "hasna")} other:/tmp/`,
+      ];
+      for (const command of commands) {
+        const result = evaluate(preToolUse("Bash", { command }));
+        expect(isBlocked(result), `expected BLOCK for: ${command}`).not.toBeNull();
+      }
+    });
+  });
 });

package/hooks/hook-workspace-repos-guard/src/hook.ts

@@ -3,24 +3,28 @@
 /**
  * PreToolUse hook: workspace-repos-guard
  *
- * Guards the canonical workspace structure (knowledge k_mssu9jdq_dgnnu2):
- * $HOME/workspace contains ONLY repos/ + scratch/ + AGENTS.md, and repos/
- * contains ONLY GitHub-org folders. Checkouts at
- * $HOME/workspace/repos/<org>/<repo>/ are read/context only.
+ * Guards the protected repo-checkout roots. During the migration window BOTH
+ * of these roots are protected: the canonical clones root
+ * $HOME/.hasna/repos/clones (knowledge k_mssu9jdq_dgnnu2) and the legacy root
+ * $HOME/workspace/repos. Each contains ONLY GitHub-org folders, and checkouts
+ * at <root>/<org>/<repo>/ are read/context only. The legacy root stays guarded
+ * until ~/workspace/repos is decommissioned fleet-wide.
  *
  * Structure-only guard — it deliberately does NOT duplicate the worktree-guard
  * hook, which owns edits-in-shared-checkouts semantics.
  *
  * BLOCKS:
- *   - any write to $HOME/workspace/repos itself (file tools and Bash),
- *   - any write that would create a top-level entry under repos/ (depth <= 1),
+ *   - any write to either protected root itself (file tools and Bash),
+ *   - any write that would create a top-level entry under either root
+ *     (depth <= 1),
  *   - any write whose second path segment is not an allowed GitHub org,
  *   - any delete (rm, rmdir, git clean, git rm, unlink, shred, trash, ...)
- *     anywhere under $HOME/workspace/repos, at any depth.
+ *     anywhere under either protected root, at any depth.
  *
  * ALLOWS (structure only):
  *   - reads, always,
- *   - writes deeper inside an allowed org folder (repos/<org>/<repo>/...).
+ *   - writes deeper inside an allowed org folder
+ *     (clones/<org>/<repo>/... or workspace/repos/<org>/<repo>/...).
  *
  * Home spellings (~, $HOME, ${HOME}, including quoted forms) are expanded
  * before classification in Bash targets, file-tool paths, cd operands and
@@ -58,9 +62,22 @@ const DEFAULT_ORGS = ["hasna", "hasnaxyz", "hasna-products"];
 const RULE = "workspace-repos-guard";
 
 function reposRoot(home: string): string {
+  return join(home, ".hasna", "repos", "clones");
+}
+
+/**
+ * Legacy repo-checkout root, still live and populated during the migration
+ * window (see the header comment). Guarded identically to the canonical clones
+ * root until ~/workspace/repos is decommissioned fleet-wide.
+ */
+function legacyRoot(home: string): string {
   return join(home, "workspace", "repos");
 }
 
+function protectedRoots(home: string): string[] {
+  return [reposRoot(home), legacyRoot(home)];
+}
+
 export function resolveAllowedOrgs(env: NodeJS.ProcessEnv = process.env): Set<string> {
   const raw = env.WORKSPACE_REPOS_GUARD_ORGS;
   if (typeof raw !== "string" || !raw.trim()) return new Set(DEFAULT_ORGS);
@@ -80,18 +97,18 @@ interface Verdict {
 }
 
 /**
- * Classify a single absolute target path against the repos root. Structure
- * only: a write at depth >= 2 inside an allowed org passes, and anything else
- * (deletes at any depth, writes at the root or org level, writes into a
- * non-allowed org) is blocked. Paths outside the repos root are not this
- * hook's concern and pass.
+ * Classify a single absolute target path against one protected repo-checkout
+ * root. Structure only: a write at depth >= 2 inside an allowed org passes,
+ * and anything else (deletes at any depth, writes at the root or org level,
+ * writes into a non-allowed org) is blocked. Paths outside this root are not
+ * this hook's concern and pass.
  */
 export function classifyPath(target: string, root: string, orgs: Set<string>, op: Operation): Verdict {
   if (op === "read") return { blocked: false };
   let rel = relative(root, target);
   if (rel === "") {
-    if (op === "delete") return { blocked: true, reason: `[${RULE}] delete of the repos root is forbidden: ${root}` };
-    return { blocked: true, reason: `[${RULE}] writes directly to the repos root are forbidden: ${root}` };
+    if (op === "delete") return { blocked: true, reason: `[${RULE}] delete of the protected repo-checkout root is forbidden: ${root}` };
+    return { blocked: true, reason: `[${RULE}] writes directly to the protected repo-checkout root are forbidden: ${root}` };
   }
   if (rel.startsWith(`..${sep}`) || rel === ".." || isAbsolute(rel)) {
     return { blocked: false };
@@ -99,13 +116,13 @@ export function classifyPath(target: string, root: string, orgs: Set<string>, op
   const segments = rel.split(sep).filter(Boolean);
 
   if (op === "delete") {
-    return { blocked: true, reason: `[${RULE}] delete under ~/workspace/repos is forbidden at any depth: ${target}` };
+    return { blocked: true, reason: `[${RULE}] delete under the protected repo-checkout root (${root}) is forbidden at any depth: ${target}` };
   }
 
   if (segments.length <= 1) {
     return {
       blocked: true,
-      reason: `[${RULE}] writing would create a top-level entry directly under repos/; only GitHub-org folders belong there: ${target}`,
+      reason: `[${RULE}] writing would create a top-level entry directly under the protected repo-checkout root (${root}); only GitHub-org folders belong there: ${target}`,
     };
   }
 
@@ -113,7 +130,7 @@ export function classifyPath(target: string, root: string, orgs: Set<string>, op
   if (!orgs.has(org)) {
     return {
       blocked: true,
-      reason: `[${RULE}] '${org}' is not an allowed GitHub org under ~/workspace/repos (allowed: ${[...orgs].join(", ")}): ${target}`,
+      reason: `[${RULE}] '${org}' is not an allowed GitHub org under the protected repo-checkout root (${root}); allowed: ${[...orgs].join(", ")}: ${target}`,
     };
   }
 
@@ -193,7 +210,7 @@ export function expandHomeSpelling(token: string, home: string): string {
 
 /**
  * Strip one level of wrapping shell-group punctuation from a segment so a
- * subshell group like `(cd ~/workspace/repos && rm -rf hasna)` is analysed as
+ * subshell group like `(cd ~/.hasna/repos/clones && rm -rf hasna)` is analysed as
  * its parts after the `&&` split.
  */
 function unwrapSegment(segment: string): string {
@@ -208,16 +225,18 @@ function regexEscape(text: string): string {
 }
 
 /**
- * Extract workspace-repos targets from a Bash command. Recognises explicit
- * `~/...`, `$HOME/...`, `${HOME}/...` and literal-home references (expanded
- * before classification), plus a trailing relative operand (`.`, `..`, a bare
- * name) when the command `cd`s into the repos root or the command's cwd
- * already sits under it. Tokens outside the repos root are ignored; reads are
- * returned so callers can decide (they are never blocked).
+ * Extract protected-repo-checkout targets from a Bash command. Recognises
+ * explicit `~/...`, `$HOME/...`, `${HOME}/...` and literal-home references
+ * (expanded before classification) under EITHER protected root (the canonical
+ * clones root or the legacy workspace/repos root), plus a trailing relative
+ * operand (`.`, `..`, a bare name) when the command `cd`s into one of the
+ * protected roots or the command's cwd already sits under one. Tokens outside
+ * both protected roots are ignored; reads are returned so callers can decide
+ * (they are never blocked).
  */
 export function bashTargets(command: string, home: string, cwd: string): PathTarget[] {
   if (!command) return [];
-  const root = reposRoot(home);
+  const roots = protectedRoots(home);
   const segments = command.split(/\s*&&\s*|\s*\|\|\s*|;\s*|\n+/);
 
   const targets: PathTarget[] = [];
@@ -230,11 +249,14 @@ export function bashTargets(command: string, home: string, cwd: string): PathTar
     const cdMatch = segment.match(/(?:^|\s)cd(?:\s+(?:-[A-Za-z]+|--))*\s+([^\s;&|<>()\x60]+)/);
     if (cdMatch) {
       const cdTarget = expandHomeSpelling(cdMatch[1], home);
-      if (cdTarget && (cdTarget === root || cdTarget.startsWith(`${root}${sep}`))) cwdUnderRepos = cdTarget;
+      if (cdTarget && roots.some((root) => cdTarget === root || cdTarget.startsWith(`${root}${sep}`))) {
+        cwdUnderRepos = cdTarget;
+      }
     }
 
     const homeLiteral = regexEscape(home);
-    const prefixRe = new RegExp(`(?:~|\\$HOME"*|\\$\\{HOME\\}"*|${homeLiteral}"*)/workspace/repos`);
+    const suffix = roots.map((root) => regexEscape(root.slice(home.length + 1))).join("|");
+    const prefixRe = new RegExp(`(?:~|\\$HOME"*|\\$\\{HOME\\}"*|${homeLiteral}"*)/(?:${suffix})`);
     const re = new RegExp(`(${prefixRe.source})([^\\s"';&|<>()\x60]*|$)`, "g");
     let m: RegExpExecArray | null;
     let foundExplicit = false;
@@ -246,7 +268,8 @@ export function bashTargets(command: string, home: string, cwd: string): PathTar
 
     if (!foundExplicit && (op === "delete" || op === "write")) {
       const base =
-        cwdUnderRepos ?? (cwd === root || cwd.startsWith(`${root}${sep}`) ? cwd : null);
+        cwdUnderRepos ??
+        (roots.some((root) => cwd === root || cwd.startsWith(`${root}${sep}`)) ? cwd : null);
       if (base) {
         const relMatch = segment.match(/(?:^|\s)(\.\.?|[^\s"';&|<>()\x60/]+(?:\/[^\s"';&|<>()\x60]*)?)\s*$/);
         if (relMatch) {
@@ -282,7 +305,7 @@ export function evaluate(input: CodewithHookInput): { output: CodewithHookOutput
 
   const tool = typeof input.tool_name === "string" ? input.tool_name : "";
   const home = homedir();
-  const root = reposRoot(home);
+  const roots = protectedRoots(home);
   const orgs = resolveAllowedOrgs();
 
   if (tool === "Bash") {
@@ -291,9 +314,11 @@ export function evaluate(input: CodewithHookInput): { output: CodewithHookOutput
     const cwd = typeof input.cwd === "string" && input.cwd ? input.cwd : process.cwd();
     const targets = bashTargets(command, home, cwd);
     for (const target of targets) {
-      const verdict = classifyPath(target.path, root, orgs, target.op);
-      if (verdict.blocked) {
-        return { output: { decision: "block", reason: verdict.reason }, warnings };
+      for (const root of roots) {
+        const verdict = classifyPath(target.path, root, orgs, target.op);
+        if (verdict.blocked) {
+          return { output: { decision: "block", reason: verdict.reason }, warnings };
+        }
       }
     }
     return { output: { continue: true }, warnings };
@@ -307,9 +332,11 @@ export function evaluate(input: CodewithHookInput): { output: CodewithHookOutput
     if (!patch) return { output: { continue: true }, warnings };
     const targets = patchTargets(patch, cwd);
     for (const target of targets) {
-      const verdict = classifyPath(target.path, root, orgs, target.op);
-      if (verdict.blocked) {
-        return { output: { decision: "block", reason: verdict.reason }, warnings };
+      for (const root of roots) {
+        const verdict = classifyPath(target.path, root, orgs, target.op);
+        if (verdict.blocked) {
+          return { output: { decision: "block", reason: verdict.reason }, warnings };
+        }
       }
     }
     return { output: { continue: true }, warnings };
@@ -329,9 +356,11 @@ export function evaluate(input: CodewithHookInput): { output: CodewithHookOutput
 
   const expanded = expandHomeSpelling(raw, home);
   const target = isAbsolute(expanded) ? normalize(expanded) : resolve(cwd, expanded);
-  const verdict = classifyPath(target, root, orgs, "write");
-  if (verdict.blocked) {
-    return { output: { decision: "block", reason: verdict.reason }, warnings };
+  for (const root of roots) {
+    const verdict = classifyPath(target, root, orgs, "write");
+    if (verdict.blocked) {
+      return { output: { decision: "block", reason: verdict.reason }, warnings };
+    }
   }
   return { output: { continue: true }, warnings };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/hooks",
-  "version": "0.7.7",
+  "version": "0.7.9",
   "description": "Open source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command",
   "type": "module",
   "bin": {
@@ -52,11 +52,11 @@
     "@types/react": "^18.2.0",
     "typescript": "^5",
     "bun-types": "1.3.14",
-    "@hasna/contracts": "0.13.4"
+    "@hasna/contracts": "0.14.0"
   },
   "dependencies": {
     "@hasna/events": "^0.1.16",
-    "@hasna/secrets": "0.3.7",
+    "@hasna/secrets": "0.3.10",
     "@modelcontextprotocol/sdk": "^1.26.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
@@ -68,7 +68,7 @@
     "pg": "^8.16.3",
     "react": "^18.2.0",
     "zod": "3.25.76",
-    "@hasna/contracts": "0.13.4"
+    "@hasna/contracts": "0.14.0"
   },
   "engines": {
     "bun": ">=1.0.0"