@hasna/hooks 0.7.8 → 0.7.10

package/bin/index.js

@@ -1120,8 +1120,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
       args = args.slice();
       let launchWithNode = false;
       const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
-      function findFile(baseDir, baseName) {
-        const localBin = path.resolve(baseDir, baseName);
+      function findFile(baseDir2, baseName) {
+        const localBin = path.resolve(baseDir2, baseName);
         if (fs.existsSync(localBin))
           return localBin;
         if (sourceExt.includes(path.extname(baseName)))
@@ -1886,6 +1886,132 @@ var require_commander = __commonJS((exports) => {
   exports.InvalidOptionArgumentError = InvalidArgumentError;
 });
 
+// ../../node_modules/.bun/@hasna+paths@0.1.0/node_modules/@hasna/paths/dist/index.js
+import { homedir as homedir3 } from "os";
+import { join as join4 } from "path";
+function assertApp2(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!APP_SLUG_RE2.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function envOf2(options) {
+  return options.env ?? process.env;
+}
+function envValue2(options, kind) {
+  const value = envOf2(options)[KIND_ENV2[kind]];
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function isMacOS2(platform) {
+  return platform === "darwin";
+}
+function baseDir2(kind, options) {
+  const override = envValue2(options, kind);
+  if (override)
+    return override;
+  const home = options.home ?? homedir3();
+  const platform = options.platform ?? process.platform;
+  if (isMacOS2(platform)) {
+    switch (kind) {
+      case "config":
+      case "data":
+        return join4(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return join4(home, "Library", "Caches", "Hasna");
+      case "state":
+        return join4(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return join4(home, ".config", "hasna");
+    case "data":
+      return join4(home, ".local", "share", "hasna");
+    case "state":
+      return join4(home, ".local", "state", "hasna");
+    case "cache":
+      return join4(home, ".cache", "hasna");
+  }
+}
+function resolvePath2(kind, options) {
+  assertApp2(options.app);
+  const appSegment = options.internal === true ? join4("internal", options.app) : options.app;
+  return join4(baseDir2(kind, options), appSegment);
+}
+function dataDir2(options) {
+  return resolvePath2("data", options);
+}
+var KIND_ENV2, APP_SLUG_RE2;
+var init_dist = __esm(() => {
+  KIND_ENV2 = {
+    config: "HASNA_CONFIG_HOME",
+    data: "HASNA_DATA_HOME",
+    state: "HASNA_STATE_HOME",
+    cache: "HASNA_CACHE_HOME"
+  };
+  APP_SLUG_RE2 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+});
+
+// src/lib/app-home.ts
+import { existsSync as existsSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join6, resolve as resolve2 } from "path";
+function getHomeDir(env = process.env) {
+  return env.HOME || env.USERPROFILE || homedir5();
+}
+function getResolverDataRoot(env = process.env) {
+  return dataDir2({ app: "hooks", home: getHomeDir(env), env });
+}
+function getLegacyDataRoot(env = process.env) {
+  return join6(getHomeDir(env), ".hasna", "hooks");
+}
+function adoptResolverDataRoot(resolved, env = process.env) {
+  const dataOverride = env.HASNA_DATA_HOME;
+  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
+    return true;
+  return existsSync3(join6(resolved, STORE_MARKER));
+}
+function getExplicitDataDir(env = process.env) {
+  const dir = env.HASNA_HOOKS_DATA_DIR ?? env.HOOKS_DATA_DIR;
+  if (typeof dir === "string" && dir.trim().length > 0)
+    return dir.trim();
+  return;
+}
+function getExactDataRoot(env = process.env) {
+  const dir = env.HASNA_HOOKS_HOME?.trim() || env.HOOKS_HOME?.trim();
+  if (dir)
+    return resolve2(dir);
+  return;
+}
+function getEffectiveDataRoot(env = process.env) {
+  const explicit = getExplicitDataDir(env);
+  if (explicit)
+    return explicit;
+  const exact = getExactDataRoot(env);
+  if (exact)
+    return exact;
+  const resolved = getResolverDataRoot(env);
+  return adoptResolverDataRoot(resolved, env) ? resolve2(resolved) : getLegacyDataRoot(env);
+}
+function getReportedDbPath(env = process.env) {
+  const explicit = getExplicitDbPath(env);
+  if (explicit)
+    return explicit;
+  return join6(getEffectiveDataRoot(env), "hooks.db");
+}
+function getExplicitDbPath(env = process.env) {
+  const db = env.HASNA_HOOKS_DB_PATH ?? env.HOOKS_DB_PATH;
+  if (typeof db === "string" && db.trim().length > 0)
+    return db.trim();
+  return;
+}
+var STORE_MARKER = "hooks.db";
+var init_app_home = __esm(() => {
+  init_dist();
+});
+
 // src/lib/registry.ts
 function getHooksByCategory(category) {
   return HOOKS.filter((h) => h.category === category);
@@ -1902,6 +2028,7 @@ function getHook(name) {
 }
 var CATEGORIES, HOOKS;
 var init_registry = __esm(() => {
+  init_app_home();
   CATEGORIES = [
     "Git Safety",
     "Code Quality",
@@ -2229,7 +2356,7 @@ var init_registry = __esm(() => {
     {
       name: "sessionlog",
       displayName: "Session Log",
-      description: "Logs every tool call to SQLite (~/.hasna/hooks/hooks.db)",
+      description: `Logs every tool call to SQLite (${getReportedDbPath()})`,
       version: "0.1.0",
       category: "Observability",
       event: "PostToolUse",
@@ -2239,7 +2366,7 @@ var init_registry = __esm(() => {
     {
       name: "commandlog",
       displayName: "Command Log",
-      description: "Logs every Bash command to SQLite (~/.hasna/hooks/hooks.db)",
+      description: `Logs every Bash command to SQLite (${getReportedDbPath()})`,
       version: "0.1.0",
       category: "Observability",
       event: "PostToolUse",
@@ -2259,7 +2386,7 @@ var init_registry = __esm(() => {
     {
       name: "errornotify",
       displayName: "Error Notify",
-      description: "Detects tool failures and logs errors to SQLite (~/.hasna/hooks/hooks.db)",
+      description: `Detects tool failures and logs errors to SQLite (${getReportedDbPath()})`,
       version: "0.1.0",
       category: "Observability",
       event: "PostToolUse",
@@ -4071,7 +4198,8 @@ var require_cli_spinners = __commonJS((exports, module) => {
 
 // ../contracts/dist/client/transport.js
 import { readFileSync, statSync } from "fs";
-import { join as join2 } from "path";
+import { createRequire } from "module";
+import { join as join7 } from "path";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
 }
@@ -4085,24 +4213,48 @@ function clientTransportEnvKeys(name) {
 function credentialOverrideEnvKey(name) {
   return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
 }
+function credentialPointerEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_REF`;
+}
 function homeDir(env) {
   const home = env.HOME?.trim();
   return home ? home : null;
 }
-function credentialDiskSources(name, env) {
-  return profileDiskSources(name, env, null);
-}
-function profileDiskSources(name, env, profile) {
+function credentialDiskSourceList(name, env, profile = null) {
   const home = homeDir(env);
   if (!home || !SAFE_APP_SLUG.test(name))
     return [];
   const stem = profile ? `${name}.${profile}` : name;
   const configStem = profile ? `${name}-${profile}` : name;
   return [
-    join2(home, HASNA_STATE_DIR, FLEET_CREDENTIAL_DIR, `${stem}.env`),
-    join2(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}-cloud.env`)
+    {
+      path: join7(home, HASNA_STATE_DIR, FLEET_CREDENTIAL_DIR, `${stem}.env`),
+      tier: "fleet-env",
+      deprecated: false
+    },
+    {
+      path: join7(home, HASNA_STATE_DIR, LEGACY_CLOUD_DIR, `${stem}.env`),
+      tier: "legacy-cloud",
+      deprecated: true
+    },
+    {
+      path: join7(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}.env`),
+      tier: "config",
+      deprecated: false
+    },
+    {
+      path: join7(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}-cloud.env`),
+      tier: "config-legacy",
+      deprecated: true
+    }
   ];
 }
+function credentialDiskSources(name, env) {
+  return credentialDiskSourceList(name, env, null).map((s) => s.path);
+}
+function profileDiskSources(name, env, profile) {
+  return credentialDiskSourceList(name, env, profile).map((s) => s.path);
+}
 function parseEnvFile(text) {
   const values = new Map;
   for (const rawLine of text.split(/\r?\n/)) {
@@ -4153,6 +4305,9 @@ function readCredentialFile(path, apiKeyKeys) {
   return null;
 }
 function assertUsableCredential(appName, source, value) {
+  if (VAULT_POINTER_SHAPE.test(value)) {
+    throw new CredentialResolutionError(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
+  }
   if (!ILLEGAL_IN_HEADER_VALUE.test(value))
     return;
   throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
@@ -4174,6 +4329,14 @@ function sealCredential(fields) {
     writable: false,
     configurable: false
   });
+  if (fields.pointerVaultKey !== undefined) {
+    Object.defineProperty(sealed, "pointerVaultKey", {
+      value: fields.pointerVaultKey,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
   Object.defineProperty(sealed, INSPECT_CUSTOM, {
     value: () => ({ ...visible, apiKey: "[redacted]" }),
     enumerable: false,
@@ -4245,6 +4408,27 @@ function resolveCredential(name, env, options = {}) {
       warning: null
     });
   }
+  const pointerKeyName = credentialPointerEnvKey(name);
+  const pointerRaw = env[pointerKeyName];
+  if (pointerRaw !== undefined) {
+    const pointer = pointerRaw.trim();
+    if (!pointer) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} is set but empty. It is a deliberate vault pointer, so it is not resolved around: ` + `either give it a vault item key or unset it to fall back to the credential on disk.`, [pointerKeyName]);
+    }
+    if (!VAULT_POINTER_SHAPE.test(pointer)) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} must name a vault ITEM KEY (a path-shaped reference like ` + `'namespace/app/live/api_key'), not a credential value. A pointer that carries a literal is refused.`, [pointerKeyName]);
+    }
+    return sealCredential({
+      apiKey: "",
+      pointerVaultKey: pointer,
+      tier: "pointer",
+      source: pointerKeyName,
+      deliberate: true,
+      deprecated: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
   const profile = options.profile?.trim() || env[CREDENTIAL_PROFILE_ENV_KEY]?.trim();
   if (profile) {
     const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
@@ -4269,26 +4453,42 @@ function resolveCredential(name, env, options = {}) {
     }
     throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
   }
-  const diskHits = diskPaths.map((path) => ({ path, value: readCredentialFile(path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  const diskSourceList = credentialDiskSourceList(name, env, null);
+  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
   if (diskHits.length > 0) {
     const winner = diskHits[0];
-    assertUsableCredential(name, winner.path, winner.value);
+    assertUsableCredential(name, winner.src.path, winner.value);
     const divergentSources = [
-      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.path),
+      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
       ...(() => {
         const legacyHit = firstEnvValue(env, apiKeyKeys);
         return legacyHit && legacyHit.value !== winner.value ? [legacyHit.key] : [];
       })()
     ];
-    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    let deprecated = winner.src.deprecated;
+    let finalWarning = warning;
+    if (winner.src.deprecated) {
+      deprecated = true;
+      const sink = options.onDeprecation ?? defaultDeprecationSink;
+      const notified = deprecationNotified();
+      const noticeKey = `${name}:${winner.src.path}`;
+      if (!notified.has(noticeKey)) {
+        notified.add(noticeKey);
+        const target = diskSourceList[0]?.path ?? "<none>";
+        const message = `[${name}] DEPRECATED: the API key came from ${winner.src.path} \u2014 a legacy credential location. ` + `The primary location is ${target} (~/.hasna/fleet-env/<app>.env). The legacy 'cloud' tiers are ` + `removed after ${LEGACY_CLOUD_REMOVAL_DEADLINE}. Migrate the key to the primary location.`;
+        sink(message);
+      }
+      finalWarning = [warning, `Legacy credential source: ${winner.src.path}. Removed after ${LEGACY_CLOUD_REMOVAL_DEADLINE}.`].filter(Boolean).join(" ") || null;
+    }
     return sealCredential({
       apiKey: winner.value,
-      tier: "disk",
-      source: winner.path,
+      tier: winner.src.tier,
+      source: winner.src.path,
       deliberate: false,
-      deprecated: false,
+      deprecated,
       diskCandidates: diskPaths,
-      warning
+      warning: finalWarning
     });
   }
   const legacy = firstEnvValue(env, apiKeyKeys);
@@ -4314,7 +4514,7 @@ function resolveCredential(name, env, options = {}) {
   }
   return null;
 }
-var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, HASNA_STATE_DIR = ".hasna", FLEET_CREDENTIAL_DIR = "cloud", CONFIG_DIR = ".config", CONFIG_NAMESPACE = "hasna", MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, INSPECT_CUSTOM, CREDENTIAL_SEAL, DEPRECATION_REGISTRY, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS;
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, HASNA_STATE_DIR = ".hasna", FLEET_CREDENTIAL_DIR = "fleet-env", LEGACY_CLOUD_DIR = "cloud", CONFIG_DIR = ".config", CONFIG_NAMESPACE = "hasna", LEGACY_CLOUD_REMOVAL_DEADLINE = "2026-10-01", MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, INSPECT_CUSTOM, CREDENTIAL_SEAL, DEPRECATION_REGISTRY, SECRETS_PACKAGE_SPECIFIER, requireSecretsSdk, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS;
 var init_transport = __esm(() => {
   CredentialResolutionError = class CredentialResolutionError extends Error {
     appName;
@@ -4330,9 +4530,12 @@ var init_transport = __esm(() => {
   SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
   SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
   ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
+  VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
   INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
   CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
   DEPRECATION_REGISTRY = Symbol.for("hasna:contracts:credentialDeprecationNotices");
+  SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
+  requireSecretsSdk = createRequire(import.meta.url);
   IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
   AUTHORITY_OVERRIDE_HEADERS = new Set([
     "host",
@@ -4355,34 +4558,30 @@ __export(exports_config, {
   getCustomHooksDir: () => getCustomHooksDir,
   getConfigPath: () => getConfigPath
 });
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { join as join3 } from "path";
-import { homedir as homedir2 } from "os";
+import { existsSync as existsSync5, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { join as join8 } from "path";
 function getHooksDataDir() {
-  const explicit = process.env.HASNA_HOOKS_DATA_DIR ?? process.env.HOOKS_DATA_DIR;
-  if (explicit)
-    return explicit;
-  return join3(homedir2(), ".hasna", "hooks");
+  return getEffectiveDataRoot();
 }
 function getCustomHooksDir() {
-  return join3(getHooksDataDir(), "hooks");
+  return join8(getHooksDataDir(), "hooks");
 }
 function getLockPath() {
   const explicit = process.env.HASNA_HOOKS_LOCK_PATH ?? process.env.HOOKS_LOCK_PATH;
   if (explicit)
     return explicit;
-  return join3(getHooksDataDir(), "hooks.lock");
+  return join8(getHooksDataDir(), "hooks.lock");
 }
 function getConfigPath() {
   const explicit = process.env.HASNA_HOOKS_CONFIG_PATH ?? process.env.HOOKS_CONFIG_PATH;
   if (explicit)
     return explicit;
-  return join3(getHooksDataDir(), "config.json");
+  return join8(getHooksDataDir(), "config.json");
 }
 function readConfig() {
   try {
     const path = getConfigPath();
-    if (!existsSync2(path))
+    if (!existsSync5(path))
       return {};
     return JSON.parse(readFileSync2(path, "utf-8"));
   } catch {
@@ -4391,7 +4590,7 @@ function readConfig() {
 }
 function writeConfig(config) {
   const path = getConfigPath();
-  mkdirSync(join3(path, ".."), { recursive: true });
+  mkdirSync(join8(path, ".."), { recursive: true });
   writeFileSync(path, JSON.stringify(config, null, 2) + `
 `, "utf-8");
   return path;
@@ -4408,6 +4607,7 @@ function resolveApiKey() {
 }
 var init_config = __esm(() => {
   init_transport();
+  init_app_home();
 });
 
 // src/lib/semver.ts
@@ -4434,8 +4634,8 @@ __export(exports_manifest, {
   ScriptContainmentError: () => ScriptContainmentError,
   HOOK_NAME_RE: () => HOOK_NAME_RE
 });
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync, realpathSync, writeFileSync as writeFileSync2 } from "fs";
-import { basename, dirname, isAbsolute, join as join4, normalize, resolve, sep } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync, realpathSync, writeFileSync as writeFileSync2 } from "fs";
+import { basename, dirname, isAbsolute, join as join9, normalize, resolve as resolve3, sep } from "path";
 import { z } from "zod";
 function parseManifest(json) {
   const parsed = JSON.parse(json);
@@ -4451,8 +4651,8 @@ function isWithin(child, parent) {
   return child === parent || child.startsWith(parent + sep);
 }
 function assertContainedLexical(target, root, raw) {
-  const lexical = resolve(target);
-  const rootLexical = resolve(root);
+  const lexical = resolve3(target);
+  const rootLexical = resolve3(root);
   if (!isWithin(lexical, rootLexical)) {
     throw new ScriptContainmentError(target, root, raw);
   }
@@ -4461,14 +4661,14 @@ function assertContainedLexical(target, root, raw) {
 function realpathNearest(path) {
   const tail = [];
   let cur = path;
-  while (!existsSync3(cur)) {
+  while (!existsSync6(cur)) {
     const parent = dirname(cur);
     if (parent === cur)
       break;
     tail.unshift(basename(cur));
     cur = parent;
   }
-  return join4(realpathSync(cur), ...tail);
+  return join9(realpathSync(cur), ...tail);
 }
 function assertContainedReal(root, target, raw) {
   const rootReal = realpathSync(root);
@@ -4501,25 +4701,25 @@ function resolveScript(manifest, manifestDir) {
   if (isInlineScript(manifest))
     return { path: scriptRelFor(manifest), content: manifest.script };
   const rel = scriptRelFor(manifest);
-  const resolved = assertContained(join4(manifestDir, rel), manifestDir, manifest.script);
-  if (!existsSync3(resolved)) {
+  const resolved = assertContained(join9(manifestDir, rel), manifestDir, manifest.script);
+  if (!existsSync6(resolved)) {
     throw new Error(`manifest script file not found: ${resolved}`);
   }
   return { path: rel, content: readFileSync3(resolved, "utf-8") };
 }
 function customHookDir(name) {
-  return join4(getCustomHooksDir(), shortManifestName(name));
+  return join9(getCustomHooksDir(), shortManifestName(name));
 }
 function readCustomManifest(name) {
   const dir = customHookDir(name);
-  const manifestPath = join4(dir, "manifest.json");
-  if (!existsSync3(manifestPath))
+  const manifestPath = join9(dir, "manifest.json");
+  if (!existsSync6(manifestPath))
     return;
   try {
     const manifest = parseManifest(readFileSync3(manifestPath, "utf-8"));
     const script = resolveScript(manifest, dir);
     const scriptIsInline = isInlineScript(manifest);
-    return { manifest, scriptPath: join4(dir, script.path), scriptContent: script.content, scriptIsInline };
+    return { manifest, scriptPath: join9(dir, script.path), scriptContent: script.content, scriptIsInline };
   } catch (err) {
     if (err instanceof ScriptContainmentError)
       throw err;
@@ -4528,7 +4728,7 @@ function readCustomManifest(name) {
 }
 function listCustomHooks() {
   const dir = getCustomHooksDir();
-  if (!existsSync3(dir))
+  if (!existsSync6(dir))
     return [];
   const results = [];
   for (const entry of readdirSafe(dir)) {
@@ -4543,7 +4743,7 @@ function writeCustomHook(name, manifest, scriptContent, scriptRelPath) {
   if (isAbsolute(scriptRelPath)) {
     throw new ScriptContainmentError(scriptRelPath, dir);
   }
-  const scriptPath = scriptRelPath.includes("/") ? join4(dir, scriptRelPath) : join4(dir, scriptRelPath);
+  const scriptPath = scriptRelPath.includes("/") ? join9(dir, scriptRelPath) : join9(dir, scriptRelPath);
   assertContainedLexical(scriptPath, dir, scriptRelPath);
   mkdirSync2(dir, { recursive: true });
   assertContainedReal(dir, scriptPath, scriptRelPath);
@@ -4551,7 +4751,7 @@ function writeCustomHook(name, manifest, scriptContent, scriptRelPath) {
   if (scriptDir !== dir)
     mkdirSync2(scriptDir, { recursive: true });
   writeFileSync2(scriptPath, scriptContent, "utf-8");
-  writeFileSync2(join4(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + `
+  writeFileSync2(join9(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + `
 `, "utf-8");
   return { dir, scriptPath };
 }
@@ -4595,14 +4795,14 @@ __export(exports_resolve, {
   resolveHook: () => resolveHook,
   resolveBundledHooksDir: () => resolveBundledHooksDir
 });
-import { dirname as dirname2, join as join5 } from "path";
-import { existsSync as existsSync4 } from "fs";
+import { dirname as dirname2, join as join10 } from "path";
+import { existsSync as existsSync7 } from "fs";
 import { fileURLToPath } from "url";
 function resolveBundledHooksDir(moduleDir = dirname2(fileURLToPath(import.meta.url))) {
-  const sourceLayout = join5(moduleDir, "..", "..", "hooks");
-  if (existsSync4(join5(sourceLayout, "hook-gitguard")))
+  const sourceLayout = join10(moduleDir, "..", "..", "hooks");
+  if (existsSync7(join10(sourceLayout, "hook-gitguard")))
     return sourceLayout;
-  return join5(moduleDir, "..", "hooks");
+  return join10(moduleDir, "..", "hooks");
 }
 function resolveHookDir(name) {
   const custom = readCustomManifest(name);
@@ -4613,11 +4813,11 @@ function resolveHookDir(name) {
     return;
   const short = shortManifestName(name);
   const bundledBase = resolveBundledHooksDir();
-  const direct = join5(bundledBase, short);
-  if (existsSync4(direct))
+  const direct = join10(bundledBase, short);
+  if (existsSync7(direct))
     return direct;
-  const prefixed = join5(bundledBase, `hook-${short}`);
-  return existsSync4(prefixed) ? prefixed : undefined;
+  const prefixed = join10(bundledBase, `hook-${short}`);
+  return existsSync7(prefixed) ? prefixed : undefined;
 }
 function resolveScriptPath(name) {
   const custom = readCustomManifest(name);
@@ -4626,8 +4826,8 @@ function resolveScriptPath(name) {
   const dir = resolveHookDir(name);
   if (!dir)
     return;
-  const script = join5(dir, "src", "hook.ts");
-  return existsSync4(script) ? script : undefined;
+  const script = join10(dir, "src", "hook.ts");
+  return existsSync7(script) ? script : undefined;
 }
 function resolveHookMeta(name) {
   const custom = readCustomManifest(name);
@@ -4876,9 +5076,9 @@ var init_migrations = __esm(() => {
 });
 
 // src/db/legacy-import.ts
-import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
-import { join as join6 } from "path";
-import { homedir as homedir3 } from "os";
+import { existsSync as existsSync8, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import { join as join11 } from "path";
+import { homedir as homedir6 } from "os";
 function ensureMetaTable(db) {
   db.exec(`
     CREATE TABLE IF NOT EXISTS _meta (
@@ -4952,25 +5152,25 @@ function importErrorsLog(db, filePath) {
   } catch {}
   return count;
 }
-function runLegacyImport(db, homeDir2 = homedir3()) {
+function runLegacyImport(db, homeDir2 = homedir6()) {
   try {
     if (isAlreadyDone(db))
       return;
     let total = 0;
-    const claudeProjectsDir = join6(homeDir2, ".claude", "projects");
-    if (existsSync5(claudeProjectsDir)) {
+    const claudeProjectsDir = join11(homeDir2, ".claude", "projects");
+    if (existsSync8(claudeProjectsDir)) {
       try {
         const projectDirs = readdirSync2(claudeProjectsDir);
         for (const dir of projectDirs) {
-          const projectDir = join6(claudeProjectsDir, dir);
+          const projectDir = join11(claudeProjectsDir, dir);
           try {
             const files = readdirSync2(projectDir);
             for (const file of files) {
               if (file.match(/^session-log-\d{4}-\d{2}-\d{2}\.jsonl$/)) {
-                total += importJsonlFile(db, join6(projectDir, file));
+                total += importJsonlFile(db, join11(projectDir, file));
               }
               if (file === "errors.log") {
-                total += importErrorsLog(db, join6(projectDir, file));
+                total += importErrorsLog(db, join11(projectDir, file));
               }
             }
           } catch {}
@@ -5013,31 +5213,27 @@ __export(exports_db, {
   closeDb: () => closeDb
 });
 import { Database } from "bun:sqlite";
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, cpSync } from "fs";
-import { join as join7 } from "path";
-import { homedir as homedir4 } from "os";
+import { existsSync as existsSync9, mkdirSync as mkdirSync3, cpSync } from "fs";
+import { join as join12 } from "path";
 function resolveDataDir() {
-  const explicit = process.env.HASNA_HOOKS_DATA_DIR ?? process.env.HOOKS_DATA_DIR;
-  if (explicit)
-    return explicit;
-  const newDir = join7(homedir4(), ".hasna", "hooks");
-  const oldDir = join7(homedir4(), ".hooks");
-  if (!existsSync6(newDir) && existsSync6(oldDir)) {
-    mkdirSync3(join7(homedir4(), ".hasna"), { recursive: true });
-    cpSync(oldDir, newDir, { recursive: true });
+  const effective = getEffectiveDataRoot();
+  const oldDir = join12(getHomeDir(), ".hooks");
+  if (!existsSync9(effective) && existsSync9(oldDir)) {
+    mkdirSync3(effective, { recursive: true });
+    cpSync(oldDir, effective, { recursive: true });
   }
-  return newDir;
+  return effective;
 }
 function getDbPath() {
   const explicitDb = process.env.HASNA_HOOKS_DB_PATH ?? process.env.HOOKS_DB_PATH;
   if (explicitDb)
     return explicitDb;
-  const dataDir = resolveDataDir();
-  return join7(dataDir, "hooks.db");
+  const dataDir3 = resolveDataDir();
+  return join12(dataDir3, "hooks.db");
 }
 function ensureDir(dbPath) {
   const dir = dbPath.substring(0, dbPath.lastIndexOf("/"));
-  if (dir && !existsSync6(dir)) {
+  if (dir && !existsSync9(dir)) {
     mkdirSync3(dir, { recursive: true });
   }
 }
@@ -5045,7 +5241,7 @@ function getDb() {
   if (instance)
     return instance;
   const dbPath = getDbPath();
-  const isNew = dbPath === ":memory:" || !existsSync6(dbPath);
+  const isNew = dbPath === ":memory:" || !existsSync9(dbPath);
   ensureDir(dbPath);
   instance = new Database(dbPath);
   instance.exec("PRAGMA busy_timeout=5000");
@@ -5081,6 +5277,7 @@ function createTestDb() {
 }
 var instance = null;
 var init_db = __esm(() => {
+  init_app_home();
   init_migrations();
   init_legacy_import();
 });
@@ -5107,7 +5304,7 @@ __export(exports_store, {
   LockFileError: () => LockFileError
 });
 import { createHash } from "crypto";
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3, renameSync } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3, renameSync } from "fs";
 import { readFile as readFile2 } from "fs/promises";
 import { randomBytes } from "crypto";
 function sha256Of(input) {
@@ -5169,7 +5366,7 @@ function assertLockShape(parsed, path) {
 }
 function readLock() {
   const path = getLockPath();
-  if (!existsSync7(path))
+  if (!existsSync10(path))
     return { hooks: {} };
   let raw;
   try {
@@ -5311,9 +5508,9 @@ __export(exports_installer, {
   getHookPath: () => getHookPath,
   buildCodewithTomlFragment: () => buildCodewithTomlFragment
 });
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync4 } from "fs";
-import { join as join8, dirname as dirname3 } from "path";
-import { homedir as homedir5 } from "os";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync4 } from "fs";
+import { join as join13, dirname as dirname3 } from "path";
+import { homedir as homedir7 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function normalizeHookName(name) {
   return name.startsWith("hook-") ? name : `hook-${name}`;
@@ -5352,24 +5549,24 @@ function getSettingsPath(scope = "global", target = "claude", codewithConfigPath
     return globalOverride;
   const dir = getTargetSettingsDir(target);
   if (scope === "project") {
-    return target === "codewith" ? join8(process.cwd(), dir, "config.toml") : join8(process.cwd(), dir, "settings.json");
+    return target === "codewith" ? join13(process.cwd(), dir, "config.toml") : join13(process.cwd(), dir, "settings.json");
   }
-  return target === "codewith" ? join8(homedir5(), dir, "config.toml") : join8(homedir5(), dir, "settings.json");
+  return target === "codewith" ? join13(homedir7(), dir, "config.toml") : join13(homedir7(), dir, "settings.json");
 }
 function getHookPath(name) {
   const shortName = shortHookName(name);
   const resolved = resolveHookDir(shortName);
   if (resolved)
     return resolved;
-  return join8(HOOKS_DIR, normalizeHookName(shortName));
+  return join13(HOOKS_DIR, normalizeHookName(shortName));
 }
 function hookExists(name) {
-  return existsSync8(getHookPath(name));
+  return existsSync11(getHookPath(name));
 }
 function readSettings(scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
   try {
-    if (existsSync8(path)) {
+    if (existsSync11(path)) {
       return JSON.parse(readFileSync6(path, "utf-8"));
     }
   } catch (error) {
@@ -5380,7 +5577,7 @@ function readSettings(scope = "global", target = "claude") {
 function writeSettings(settings, scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
   const dir = dirname3(path);
-  if (!existsSync8(dir)) {
+  if (!existsSync11(dir)) {
     mkdirSync5(dir, { recursive: true });
   }
   writeFileSync4(path, JSON.stringify(settings, null, 2) + `
@@ -5469,7 +5666,7 @@ function buildCodewithTomlFragment(name, profile) {
 function readCodewithConfig(scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
   try {
-    return existsSync8(path) ? readFileSync6(path, "utf-8") : "";
+    return existsSync11(path) ? readFileSync6(path, "utf-8") : "";
   } catch {
     return "";
   }
@@ -5477,9 +5674,9 @@ function readCodewithConfig(scope, configPath) {
 function appendCodewithFragment(fragment, scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
   const dir = dirname3(path);
-  if (!existsSync8(dir))
+  if (!existsSync11(dir))
     mkdirSync5(dir, { recursive: true });
-  const existing = existsSync8(path) ? readFileSync6(path, "utf-8") : "";
+  const existing = existsSync11(path) ? readFileSync6(path, "utf-8") : "";
   const sep2 = existing.trim() ? `
 
 ` : "";
@@ -5779,7 +5976,7 @@ function codewithHasHookEntryInText(configText, name) {
 }
 function codewithHasHookEntry(name, scope = "global") {
   const path = getSettingsPath(scope, "codewith");
-  if (!existsSync8(path))
+  if (!existsSync11(path))
     return false;
   try {
     return codewithHasHookEntryInText(readFileSync6(path, "utf-8"), name);
@@ -5813,7 +6010,7 @@ function uninstallHook(name, scope = "global", target = "claude") {
   const registrationsRemaining = [];
   if (target === "codewith" || target === "all") {
     const codewithPath = getSettingsPath(scope, "codewith");
-    if (existsSync8(codewithPath)) {
+    if (existsSync11(codewithPath)) {
       const before = readFileSync6(codewithPath, "utf-8");
       const after = removeCodewithHookEntry(before, shortName);
       if (after.removed) {
@@ -5860,7 +6057,7 @@ var init_installer = __esm(() => {
   init_manifest();
   init_store();
   __dirname2 = dirname3(fileURLToPath2(import.meta.url));
-  HOOKS_DIR = existsSync8(join8(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join8(__dirname2, "..", "..", "hooks") : join8(__dirname2, "..", "hooks");
+  HOOKS_DIR = existsSync11(join13(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join13(__dirname2, "..", "..", "hooks") : join13(__dirname2, "..", "hooks");
   EVENT_MAP = {
     claude: {
       PreToolUse: "PreToolUse",
@@ -6007,29 +6204,31 @@ var init_redact = __esm(() => {
 });
 
 // src/lib/profiles.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync5, readdirSync as readdirSync3, rmSync as rmSync2, cpSync as cpSync2 } from "fs";
-import { join as join9 } from "path";
-import { homedir as homedir6 } from "os";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync5, readdirSync as readdirSync3, rmSync as rmSync2, cpSync as cpSync2 } from "fs";
+import { join as join14 } from "path";
 function resolveProfilesDir() {
-  const newDir = join9(homedir6(), ".hasna", "hooks", "profiles");
-  const oldDir = join9(homedir6(), ".hooks", "profiles");
-  if (!existsSync9(newDir) && existsSync9(oldDir)) {
-    mkdirSync6(join9(homedir6(), ".hasna", "hooks"), { recursive: true });
+  const newDir = join14(getEffectiveDataRoot(), "profiles");
+  const oldDir = join14(getHomeDir(), ".hooks", "profiles");
+  if (!existsSync12(newDir) && existsSync12(oldDir)) {
+    mkdirSync6(newDir, { recursive: true });
     cpSync2(oldDir, newDir, { recursive: true });
   }
   return newDir;
 }
 function ensureProfilesDir() {
-  if (!existsSync9(PROFILES_DIR)) {
+  if (!existsSync12(PROFILES_DIR)) {
     mkdirSync6(PROFILES_DIR, { recursive: true });
   }
 }
 function profilePath(id) {
-  return join9(PROFILES_DIR, `${id}.json`);
+  return join14(PROFILES_DIR, `${id}.json`);
 }
 function shortUuid() {
   return crypto.randomUUID().slice(0, 8);
 }
+function getProfilesDir() {
+  return PROFILES_DIR;
+}
 function createProfile(input) {
   ensureProfilesDir();
   const id = shortUuid();
@@ -6051,7 +6250,7 @@ function createProfile(input) {
 function getProfile(id) {
   const path = profilePath(id);
   try {
-    if (!existsSync9(path))
+    if (!existsSync12(path))
       return null;
     return JSON.parse(readFileSync7(path, "utf-8"));
   } catch {
@@ -6059,14 +6258,14 @@ function getProfile(id) {
   }
 }
 function listProfiles() {
-  if (!existsSync9(PROFILES_DIR))
+  if (!existsSync12(PROFILES_DIR))
     return [];
   try {
     const files = readdirSync3(PROFILES_DIR).filter((f) => f.endsWith(".json"));
     const profiles = [];
     for (const file of files) {
       try {
-        const content = readFileSync7(join9(PROFILES_DIR, file), "utf-8");
+        const content = readFileSync7(join14(PROFILES_DIR, file), "utf-8");
         profiles.push(JSON.parse(content));
       } catch {}
     }
@@ -6096,7 +6295,7 @@ function importProfiles(profiles) {
       continue;
     }
     const path = profilePath(profile.agent_id);
-    if (existsSync9(path)) {
+    if (existsSync12(path)) {
       skipped++;
       continue;
     }
@@ -6108,6 +6307,7 @@ function importProfiles(profiles) {
 }
 var PROFILES_DIR;
 var init_profiles = __esm(() => {
+  init_app_home();
   PROFILES_DIR = resolveProfilesDir();
 });
 
@@ -6209,7 +6409,7 @@ var init_db_writer = __esm(() => {
 
 // src/lib/hook-env.ts
 import { dirname as dirname4, isAbsolute as isAbsolute2 } from "path";
-import { existsSync as existsSync10, statSync as statSync2 } from "fs";
+import { existsSync as existsSync13, statSync as statSync2 } from "fs";
 function isDeniedEnvName(name) {
   const upper = name.toUpperCase();
   if (DENY_PREFIXES.some((prefix) => upper.startsWith(prefix)))
@@ -6243,7 +6443,7 @@ function isUnsafePathEntry(entry, home) {
 }
 function sanitizeHookPath(pathValue, home) {
   const baseline = PATH_BASELINE.slice();
-  if (process.platform === "darwin" && existsSync10("/opt/homebrew/bin"))
+  if (process.platform === "darwin" && existsSync13("/opt/homebrew/bin"))
     baseline.push("/opt/homebrew/bin");
   const bunDir = dirname4(process.execPath);
   const seen = new Set;
@@ -6369,7 +6569,7 @@ __export(exports_run, {
 });
 import { randomBytes as randomBytes2 } from "crypto";
 import { rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute3, join as join10 } from "path";
+import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute3, join as join15 } from "path";
 function extensionOf(scriptPath) {
   const base = basename2(scriptPath);
   const dot = base.lastIndexOf(".");
@@ -6440,7 +6640,7 @@ async function readPipeWithDeadline(stream, deadlineMs) {
 async function executeVerifiedScript(options) {
   const scriptDir = dirname5(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
-  const tempPath = join10(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
+  const tempPath = join15(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
   let timedOut = false;
   const timeoutTimer = options.timeout ? setTimeout(() => {
@@ -6531,12 +6731,12 @@ __export(exports_custom_install, {
   installCustomSource: () => installCustomSource,
   ensureCustomDir: () => ensureCustomDir
 });
-import { existsSync as existsSync11, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync8, rmSync as rmSync4 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync8, rmSync as rmSync4 } from "fs";
+import { join as join16 } from "path";
 import { tmpdir } from "os";
 function manifestAt(dir) {
-  const path = join11(dir, "manifest.json");
-  if (!existsSync11(path))
+  const path = join16(dir, "manifest.json");
+  if (!existsSync14(path))
     return;
   try {
     return parseManifest(readFileSync8(path, "utf-8"));
@@ -6558,8 +6758,8 @@ function writeFromManifest(manifest, srcDir, source, kind) {
   return { name, version: manifest.version, kind, source, dir, scriptPath };
 }
 async function cloneToTemp(gitUrl) {
-  const tmp = mkdtempSync(join11(tmpdir(), "hooks-install-"));
-  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join11(tmp, "repo")], {
+  const tmp = mkdtempSync(join16(tmpdir(), "hooks-install-"));
+  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join16(tmp, "repo")], {
     stdout: "pipe",
     stderr: "pipe"
   });
@@ -6572,7 +6772,7 @@ async function cloneToTemp(gitUrl) {
     rmSync4(tmp, { recursive: true, force: true });
     throw new Error(`git clone failed (${exitCode}): ${stderr.trim()}`);
   }
-  return join11(tmp, "repo");
+  return join16(tmp, "repo");
 }
 function isGitUrl(value) {
   return value.startsWith("git@") || value.startsWith("ssh://") || value.startsWith("file://") || value.endsWith(".git");
@@ -6582,7 +6782,7 @@ function isCustomSource(value) {
     return true;
   if (value.startsWith("http://") || value.startsWith("https://"))
     return true;
-  return existsSync11(value);
+  return existsSync14(value);
 }
 async function installCustomSource(source) {
   if (isGitUrl(source)) {
@@ -6596,7 +6796,7 @@ async function installCustomSource(source) {
   if (source.startsWith("http://") || source.startsWith("https://")) {
     return installManifestUrl(source);
   }
-  if (!existsSync11(source)) {
+  if (!existsSync14(source)) {
     throw new Error(`No such local path: ${source}`);
   }
   if (source.endsWith("manifest.json")) {
@@ -7558,17 +7758,18 @@ var init_openapi = __esm(() => {
 var exports_serve = {};
 __export(exports_serve, {
   startServeServer: () => startServeServer,
+  resolveServeOptions: () => resolveServeOptions,
   handleServeRequest: () => handleServeRequest,
   SERVE_SERVICE_NAME: () => SERVE_SERVICE_NAME,
   SERVE_HOST: () => SERVE_HOST,
   DEFAULT_SERVE_PORT: () => DEFAULT_SERVE_PORT
 });
 import { readFileSync as readFileSync10 } from "fs";
-import { dirname as dirname6, join as join12 } from "path";
+import { dirname as dirname6, join as join17 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function packageVersion() {
   try {
-    const pkgPath = join12(dirname6(fileURLToPath3(import.meta.url)), "..", "package.json");
+    const pkgPath = join17(dirname6(fileURLToPath3(import.meta.url)), "..", "package.json");
     return JSON.parse(readFileSync10(pkgPath, "utf-8")).version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -7717,9 +7918,15 @@ function handleServeRequest(req, apiKey) {
   }
   return Promise.resolve(json({ error: "Not Found" }, 404));
 }
+function resolveServeOptions(options) {
+  const envPort = process.env.PORT?.trim();
+  const envHost = process.env.HOST?.trim();
+  const port = options.port ?? (envPort && /^[0-9]+$/.test(envPort) ? parseInt(envPort, 10) : DEFAULT_SERVE_PORT);
+  const host = options.host ?? (envHost && envHost.length > 0 ? envHost : SERVE_HOST);
+  return { port, host };
+}
 function startServeServer(options) {
-  const port = options.port ?? DEFAULT_SERVE_PORT;
-  const host = options.host ?? SERVE_HOST;
+  const { port, host } = resolveServeOptions(options);
   const apiKey = resolveApiKey();
   const server = Bun.serve({
     hostname: host,
@@ -7839,14 +8046,14 @@ import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z as z2 } from "zod";
 import { createServer } from "http";
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
-import { join as join13, dirname as dirname7 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync11 } from "fs";
+import { join as join18, dirname as dirname7 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 async function runVerifiedHook(name, stdin, timeoutMs) {
   const { resolveHook: resolveHook2, resolveScriptPath: resolveScriptPath2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
   const resolved = resolveHook2(name);
   const hookScript = resolveScriptPath2(name);
-  if (!resolved || !hookScript || !existsSync12(hookScript)) {
+  if (!resolved || !hookScript || !existsSync15(hookScript)) {
     throw new Error(`Hook '${name}' not found`);
   }
   const content = readFileSync11(hookScript);
@@ -8054,7 +8261,7 @@ function createHooksServer() {
     const settingsPath = getSettingsPath(scope);
     const issues = [];
     const healthy = [];
-    const settingsExist = existsSync12(settingsPath);
+    const settingsExist = existsSync15(settingsPath);
     if (!settingsExist) {
       issues.push({ hook: "(settings)", issue: `${settingsPath} not found`, severity: "warning" });
     }
@@ -8064,7 +8271,7 @@ function createHooksServer() {
       const meta = custom ? resolveHookMeta(name) : getHook(name);
       let hookHealthy = true;
       if (custom) {
-        if (!existsSync12(custom.scriptPath)) {
+        if (!existsSync15(custom.scriptPath)) {
           issues.push({ hook: name, issue: `Custom hook script missing: ${custom.scriptPath}`, severity: "error" });
           hookHealthy = false;
         }
@@ -8074,7 +8281,7 @@ function createHooksServer() {
           continue;
         }
         const hookDir = getHookPath(name);
-        if (!existsSync12(join13(hookDir, "src", "hook.ts"))) {
+        if (!existsSync15(join18(hookDir, "src", "hook.ts"))) {
           issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
           hookHealthy = false;
         }
@@ -8111,9 +8318,9 @@ function createHooksServer() {
         return { content: [{ type: "text", text: JSON.stringify({ error: `Hook '${name}' not found` }) }] };
       }
       const hookPath = getHookPath(name);
-      const readmePath = join13(hookPath, "README.md");
+      const readmePath = join18(hookPath, "README.md");
       let readme = "";
-      if (existsSync12(readmePath)) {
+      if (existsSync15(readmePath)) {
         readme = readFileSync11(readmePath, "utf-8");
       }
       if (verbose) {
@@ -8297,7 +8504,7 @@ function createHooksServer() {
     const ctx = {
       scope,
       settings_path: settingsPath,
-      settings_exists: existsSync12(settingsPath),
+      settings_exists: existsSync15(settingsPath),
       registered_hooks: hooks,
       hook_count: hooks.length,
       healthy,
@@ -8443,7 +8650,7 @@ function createHooksServer() {
     const settingsPath = getSettingsPath(scope);
     let settings = {};
     try {
-      if (existsSync12(settingsPath))
+      if (existsSync15(settingsPath))
         settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
     } catch {}
     if (!settings.hooks)
@@ -8466,7 +8673,7 @@ function createHooksServer() {
     const settingsPath = getSettingsPath(scope);
     let settings = {};
     try {
-      if (existsSync12(settingsPath))
+      if (existsSync15(settingsPath))
         settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
     } catch {}
     if (settings.hooks?.__disabled) {
@@ -8831,8 +9038,8 @@ var init_server = __esm(() => {
   pkg = { name: "@hasna/hooks", version: "0.0.0" };
   try {
     for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
-      const p = join13(__dirname3, rel);
-      if (existsSync12(p)) {
+      const p = join18(__dirname3, rel);
+      if (existsSync15(p)) {
         pkg = JSON.parse(readFileSync11(p, "utf-8"));
         break;
       }
@@ -8904,7 +9111,11 @@ var init_http = () => {};
 // ../events/dist/commander.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { Buffer as Buffer2 } from "buffer";
+import { existsSync as existsSync2 } from "fs";
+import { join as join3 } from "path";
 import { existsSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2, resolve } from "path";
 import { homedir } from "os";
 import { join } from "path";
 import { createHmac, timingSafeEqual } from "crypto";
@@ -9010,13 +9221,106 @@ function channelMatchesEvent(channel, event) {
     return true;
   return channel.filters.some((filter) => eventMatchesFilter(event, filter));
 }
+var KIND_ENV = {
+  config: "HASNA_CONFIG_HOME",
+  data: "HASNA_DATA_HOME",
+  state: "HASNA_STATE_HOME",
+  cache: "HASNA_CACHE_HOME"
+};
+var APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function assertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function envOf(options) {
+  return options.env ?? process.env;
+}
+function envValue(options, kind) {
+  const value = envOf(options)[KIND_ENV[kind]];
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function isMacOS(platform) {
+  return platform === "darwin";
+}
+function baseDir(kind, options) {
+  const override = envValue(options, kind);
+  if (override)
+    return override;
+  const home = options.home ?? homedir();
+  const platform = options.platform ?? process.platform;
+  if (isMacOS(platform)) {
+    switch (kind) {
+      case "config":
+      case "data":
+        return join(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return join(home, "Library", "Caches", "Hasna");
+      case "state":
+        return join(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return join(home, ".config", "hasna");
+    case "data":
+      return join(home, ".local", "share", "hasna");
+    case "state":
+      return join(home, ".local", "state", "hasna");
+    case "cache":
+      return join(home, ".cache", "hasna");
+  }
+}
+function resolvePath(kind, options) {
+  assertApp(options.app);
+  const appSegment = options.internal === true ? join("internal", options.app) : options.app;
+  return join(baseDir(kind, options), appSegment);
+}
+function dataDir(options) {
+  return resolvePath("data", options);
+}
 var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR";
 var HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME";
+var EVENTS_STORE_SENTINEL_FILE = "events.json";
+function effectiveHome() {
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir2();
+}
+function legacyHomeDir() {
+  return join2(effectiveHome(), ".hasna", "events");
+}
+function resolverHome() {
+  return dataDir({ app: "events", home: effectiveHome() || undefined });
+}
+function adoptResolverHome(resolved, env = process.env) {
+  const dataOverride = env.HASNA_DATA_HOME;
+  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
+    return true;
+  return existsSync(join2(resolved, EVENTS_STORE_SENTINEL_FILE));
+}
+function exactEventsHome() {
+  const dir = process.env[HASNA_EVENTS_DIR_ENV];
+  if (dir && dir.trim())
+    return dir.trim();
+  const home = process.env[HASNA_EVENTS_HOME_ENV];
+  if (home && home.trim())
+    return home.trim();
+  return;
+}
+function getEventsHome() {
+  const exact = exactEventsHome();
+  if (exact)
+    return resolve(exact);
+  const resolved = resolverHome();
+  return adoptResolverHome(resolved) ? resolve(resolved) : resolve(legacyHomeDir());
+}
 var LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:";
 var DEFAULT_EVENT_PAGE_LIMIT = 100;
 var MAX_EVENT_PAGE_LIMIT = 1000;
 function getEventsDataDir(override) {
-  return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join(homedir(), ".hasna", "events");
+  return override || getEventsHome();
 }
 function getActiveEventsDirEnv() {
   if (process.env[HASNA_EVENTS_DIR_ENV])
@@ -9032,12 +9336,12 @@ class JsonEventsStore {
   channelsPath;
   eventsPath;
   deliveriesPath;
-  constructor(dataDir = getEventsDataDir()) {
-    this.dataDir = dataDir;
-    this.runtime = localJsonRuntime(dataDir);
-    this.channelsPath = join(dataDir, "channels.json");
-    this.eventsPath = join(dataDir, "events.json");
-    this.deliveriesPath = join(dataDir, "deliveries.json");
+  constructor(dataDir2 = getEventsDataDir()) {
+    this.dataDir = dataDir2;
+    this.runtime = localJsonRuntime(dataDir2);
+    this.channelsPath = join3(dataDir2, "channels.json");
+    this.eventsPath = join3(dataDir2, "events.json");
+    this.deliveriesPath = join3(dataDir2, "deliveries.json");
   }
   async init() {
     await mkdir(this.dataDir, { recursive: true, mode: 448 });
@@ -9154,7 +9458,7 @@ class JsonEventsStore {
     };
   }
   async ensureArrayFile(path) {
-    if (!existsSync(path)) {
+    if (!existsSync2(path)) {
       await writeFile(path, `[]
 `, { encoding: "utf-8", mode: 384 });
     }
@@ -9184,7 +9488,7 @@ class JsonEventsStore {
     });
   }
 }
-function localJsonRuntime(dataDir = getEventsDataDir()) {
+function localJsonRuntime(dataDir2 = getEventsDataDir()) {
   return {
     mode: "local-files",
     name: "json-events-store",
@@ -9197,7 +9501,7 @@ function localJsonRuntime(dataDir = getEventsDataDir()) {
     durable: true,
     idempotency: "best-effort-local",
     replayCursors: true,
-    description: `Local JSON files in ${dataDir}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
+    description: `Local JSON files in ${dataDir2}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
   };
 }
 function encodeLocalJsonEventCursor(offset, options = {}) {
@@ -9261,8 +9565,8 @@ function assertCursorFilter(name, cursorValue, optionValue) {
 function findEventByIdentity(events, identity) {
   return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
 }
-async function getEventsStatus(dataDir) {
-  const store = new JsonEventsStore(dataDir);
+async function getEventsStatus(dataDir2) {
+  const store = new JsonEventsStore(dataDir2);
   await store.init();
   const [channels, events, deliveries] = await Promise.all([
     store.listChannels(),
@@ -9304,9 +9608,9 @@ async function getEventsStatus(dataDir) {
     }
   };
 }
-function statusFile(dataDir, fileName, records) {
-  const path = join(dataDir, fileName);
-  return { path, exists: existsSync(path), records };
+function statusFile(dataDir2, fileName, records) {
+  const path = join3(dataDir2, fileName);
+  return { path, exists: existsSync2(path), records };
 }
 var DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
 function buildSignatureBase(timestamp, body) {
@@ -9645,7 +9949,7 @@ async function pinnedNativeRequest(target, addresses, method, headers, body, sig
       callback(null, entries);
     }
   };
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const request = isHttps ? nodeHttpsRequest(requestOptions, onResponse) : nodeHttpRequest(requestOptions, onResponse);
     const onAbort = () => {
       const error = new Error("The operation was aborted.");
@@ -9672,7 +9976,7 @@ async function pinnedNativeRequest(target, addresses, method, headers, body, sig
           else if (Array.isArray(value))
             headersRecord[name] = value.join(", ");
         }
-        resolve(new Response(Buffer.concat(chunks), { status: response.statusCode ?? 200, headers: headersRecord }));
+        resolve2(new Response(Buffer.concat(chunks), { status: response.statusCode ?? 200, headers: headersRecord }));
       });
     }
   });
@@ -9769,7 +10073,7 @@ async function dispatchCommand(event, channel) {
     HASNA_EVENT_SCHEMA_VERSION: event.schemaVersion,
     HASNA_EVENT_JSON: eventJson
   };
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const child = spawn(channel.command.command, channel.command.args ?? [], {
       cwd: channel.command.cwd,
       env,
@@ -9787,7 +10091,7 @@ async function dispatchCommand(event, channel) {
     });
     child.on("error", (error) => {
       clearTimeout(timeout);
-      resolve({
+      resolve2({
         attempt: 1,
         status: "failed",
         startedAt,
@@ -9800,7 +10104,7 @@ async function dispatchCommand(event, channel) {
     child.on("close", (code, signal) => {
       clearTimeout(timeout);
       const success = code === 0;
-      resolve({
+      resolve2({
         attempt: 1,
         status: success ? "success" : "failed",
         startedAt,
@@ -10455,8 +10759,8 @@ var {
 
 // src/cli/index.tsx
 import chalk2 from "chalk";
-import { existsSync as existsSync13, readFileSync as readFileSync12, rmSync as rmSync5 } from "fs";
-import { join as join14, dirname as dirname8 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync12, rmSync as rmSync5 } from "fs";
+import { join as join19, dirname as dirname8 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 
 // src/cli/components/App.tsx
@@ -11637,9 +11941,11 @@ init_manifest();
 init_resolve();
 init_store();
 init_semver();
+init_app_home();
+init_config();
 import { jsxDEV as jsxDEV8 } from "react/jsx-dev-runtime";
 var __dirname4 = dirname8(fileURLToPath5(import.meta.url));
-var pkgPath = existsSync13(join14(__dirname4, "..", "package.json")) ? join14(__dirname4, "..", "package.json") : join14(__dirname4, "..", "..", "package.json");
+var pkgPath = existsSync16(join19(__dirname4, "..", "package.json")) ? join19(__dirname4, "..", "package.json") : join19(__dirname4, "..", "..", "package.json");
 var pkg2 = JSON.parse(readFileSync12(pkgPath, "utf-8"));
 var program2 = new Command;
 function resolveScope(options) {
@@ -11791,7 +12097,7 @@ program2.command("init").description("Register a new agent profile with a unique
   if (profile.name) {
     console.log(`  ${chalk2.dim("Name:")}       ${profile.name}`);
   }
-  console.log(`  ${chalk2.dim("Profile:")}    ~/.hasna/hooks/profiles/${profile.agent_id}.json`);
+  console.log(`  ${chalk2.dim("Profile:")}    ${join19(getProfilesDir(), `${profile.agent_id}.json`)}`);
   console.log();
   console.log(chalk2.dim("  Install hooks with this profile:"));
   console.log(`    hooks install gitguard --profile ${profile.agent_id}`);
@@ -11807,7 +12113,7 @@ program2.command("run").argument("<hook>", "Hook to run").option("--profile <id>
     process.exit(1);
   }
   const hookScript = resolveScriptPath2(hook);
-  if (!hookScript || !existsSync13(hookScript)) {
+  if (!hookScript || !existsSync16(hookScript)) {
     console.error(JSON.stringify({ error: `Hook script not found: ${hookScript ?? hook}` }));
     process.exit(1);
   }
@@ -12345,7 +12651,7 @@ program2.command("info").argument("<hook>", "Hook name").option("-j, --json", "O
   const { readCustomManifest: readCustomManifest2 } = await Promise.resolve().then(() => (init_manifest(), exports_manifest));
   const custom = readCustomManifest2(meta.name);
   const source = custom ? "custom" : "bundled";
-  const sourceNote = custom ? "custom (~/.hasna/hooks/hooks/) overrides the bundled registry" : "bundled registry";
+  const sourceNote = custom ? `custom (${getCustomHooksDir()}/) overrides the bundled registry` : "bundled registry";
   if (options.json) {
     console.log(JSON.stringify({ ...meta, source, source_note: sourceNote, global: globalInstalled, project: projectInstalled }));
     return;
@@ -12379,7 +12685,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
   const settingsPath = getSettingsPath(scope);
   const issues = [];
   const healthy = [];
-  const settingsExist = existsSync13(settingsPath);
+  const settingsExist = existsSync16(settingsPath);
   if (!settingsExist) {
     issues.push({ hook: "(settings)", issue: `${settingsPath} not found`, severity: "warning" });
   }
@@ -12396,7 +12702,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
     const meta = custom ? resolveHookMeta(name) : getHook(name);
     let hookHealthy = true;
     if (custom) {
-      if (!existsSync13(custom.scriptPath)) {
+      if (!existsSync16(custom.scriptPath)) {
         issues.push({ hook: name, issue: `Custom hook script missing: ${custom.scriptPath}`, severity: "error" });
         hookHealthy = false;
       }
@@ -12407,8 +12713,8 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
         continue;
       }
       const hookDir = getHookPath(name);
-      const hookScript = join14(hookDir, "src", "hook.ts");
-      if (!existsSync13(hookScript)) {
+      const hookScript = join19(hookDir, "src", "hook.ts");
+      if (!existsSync16(hookScript)) {
         issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
         hookHealthy = false;
       }
@@ -12582,9 +12888,9 @@ program2.command("docs").argument("[hook]", "Hook name (shows general docs if om
       return;
     }
     const hookPath = getHookPath(hook);
-    const readmePath = join14(hookPath, "README.md");
+    const readmePath = join19(hookPath, "README.md");
     let readme = "";
-    if (existsSync13(readmePath)) {
+    if (existsSync16(readmePath)) {
       readme = readFileSync12(readmePath, "utf-8");
     }
     if (options.json) {
@@ -12815,7 +13121,7 @@ program2.command("profile-import").argument("<file>", "JSON file to import profi
       console.log(chalk2.dim(`  Skipped ${result.skipped} (already exist or invalid)`));
   }
 });
-var logCmd = program2.command("log").description("Query hook event logs from SQLite (~/.hasna/hooks/hooks.db)");
+var logCmd = program2.command("log").description(`Query hook event logs from SQLite (${getReportedDbPath()})`);
 logCmd.command("list").description("List hook events").option("--hook <name>", "Filter by hook name").option("--session <id>", "Filter by session ID").option("-n, --limit <n>", "Number of rows to show", "50").option("-j, --json", "Output as JSON", false).action(async (options) => {
   const { getDb: getDb2 } = await Promise.resolve().then(() => (init_db(), exports_db));
   const db = getDb2();
@@ -13164,6 +13470,29 @@ Cloudflare provisioning complete:
   console.log(chalk2.dim("  wrangler.toml, fill in the D1 database id, then run the commands above."));
   console.log();
 });
+program2.command("migrate").description("Apply PostgreSQL migrations to the storage database (HASNA_HOOKS_DATABASE_URL)").option("-j, --json", "Output as JSON", false).action(async (options) => {
+  try {
+    const { getStoragePg: getStoragePg2, runStorageMigrations: runStorageMigrations2 } = await Promise.resolve().then(() => (init_storage(), exports_storage));
+    const remote = await getStoragePg2();
+    try {
+      await runStorageMigrations2(remote);
+    } finally {
+      await remote.close();
+    }
+    if (options.json) {
+      console.log(JSON.stringify({ ok: true }));
+      return;
+    }
+    console.log(chalk2.green("\u2713 PostgreSQL migrations applied"));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (options.json)
+      console.log(JSON.stringify({ error: message }));
+    else
+      console.error(chalk2.red(`\u2717 ${message}`));
+    process.exitCode = 1;
+  }
+});
 program2.command("mcp").option("-s, --stdio", "Use stdio transport (one process per agent)", false).option("--sse", "Use legacy SSE transport (port 39427)", false).option("--http", "Use Streamable HTTP transport (explicit; this is also the default)", false).option("-p, --port <port>", "Port for HTTP/SSE transport (defaults to 8847 for HTTP, 39427 for SSE)").description("Start MCP server for AI agent integration (default: shared Streamable HTTP)").action(async (options) => {
   if (options.stdio) {
     const { startStdioServer: startStdioServer2 } = await Promise.resolve().then(() => (init_server(), exports_server));