@hasna/hooks 0.8.0 → 0.9.1

package/bin/serve.js

@@ -182,6 +182,18 @@ var HOOKS = [
     matcher: "^(Bash|Write|Edit|MultiEdit|NotebookEdit|apply_patch|ApplyPatch|functions\\.apply_patch)$",
     tags: ["workspace", "repos", "structure", "guard", "safety", "orgs", "multi-agent"]
   },
+  {
+    name: "trash-guard",
+    displayName: "Trash Guard",
+    description: "Rewrites rm issued through Bash into `trash guard`, so the delete lands in a recoverable trash store; refuses the delete when there is nothing to redirect to (trash absent, a delete verb it cannot rewrite, or the protected class: /, ~, ~/.hasna, ~/.ssh, ~/.aws)",
+    version: "0.1.1",
+    category: "Git Safety",
+    event: "PreToolUse",
+    matcher: "^(Bash|apply_patch|ApplyPatch|functions\\.apply_patch)$",
+    tags: ["rm", "delete", "trash", "recoverable", "guard", "safety", "bash"],
+    rewritesInput: true,
+    timeoutSeconds: 5
+  },
   {
     name: "checktests",
     displayName: "Check Tests",
@@ -5080,6 +5092,10 @@ function runRetention(db, days) {
 
 // src/db/index.ts
 var instance = null;
+var localStoreRefusal = null;
+function isLocalStoreRefused() {
+  return localStoreRefusal !== null;
+}
 function resolveDataDir() {
   const effective = getEffectiveDataRoot();
   const oldDir = join5(getHomeDir(), ".hooks");
@@ -5103,6 +5119,8 @@ function ensureDir(dbPath) {
   }
 }
 function getDb() {
+  if (localStoreRefusal !== null)
+    throw new Error(localStoreRefusal);
   if (instance)
     return instance;
   const dbPath = getDbPath();
@@ -5138,6 +5156,9 @@ async function sha256File(path) {
   const buf = await readFile(path);
   return sha256Of(buf);
 }
+function storeDb() {
+  return isLocalStoreRefused() ? null : getDb();
+}
 function getHookRecord(db, name) {
   return db.query("SELECT * FROM hooks WHERE name = ?").get(name);
 }
@@ -5226,14 +5247,16 @@ function setPinnedHook(name, entry) {
 }
 function retrustHook(name, scriptPath, version, source) {
   const actual = sha256Of(readFileSync3(scriptPath));
-  const db = getDb();
-  upsertHookRecord(db, {
-    name,
-    version,
-    sha256: actual,
-    source_type: source,
-    last_verified_at: new Date().toISOString()
-  });
+  const db = storeDb();
+  if (db) {
+    upsertHookRecord(db, {
+      name,
+      version,
+      sha256: actual,
+      source_type: source,
+      last_verified_at: new Date().toISOString()
+    });
+  }
   setPinnedHook(name, { version, sha256: actual, source });
   return { ok: true, pinned: true, expected: actual, actual, name };
 }
@@ -5327,7 +5350,7 @@ import { readFileSync as readFileSync5 } from "fs";
 import { dirname as dirname3, join as join8 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
-// ../contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.0.2+e0db24ae03127387/node_modules/@hasna/contracts/dist/client/transport.js
 import { spawnSync } from "child_process";
 import { closeSync, fstatSync, openSync, readFileSync as readFileSync4 } from "fs";
 import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
@@ -6207,7 +6230,7 @@ function startServeServer(options) {
       return handleServeRequest(req, resolveHooksServePublishKey());
     }
   });
-  console.error(`hooks registry listening on http://${host}:${port} (publish requires an API key)`);
+  console.error(`hooks registry listening on http://${host}:${server.port} (publish requires an API key)`);
   return server;
 }
 if (import.meta.main) {

package/dist/db/index.d.ts

@@ -7,6 +7,14 @@
  * Supports HASNA_HOOKS_DATA_DIR / HOOKS_DATA_DIR and HASNA_HOOKS_DB_PATH / HOOKS_DB_PATH env overrides.
  */
 import { Database } from "bun:sqlite";
+/** Refuse every local-store open for the rest of this process. */
+export declare function refuseLocalStore(message: string): void;
+/** Lift a refusal installed by {@link refuseLocalStore}. Test seam. */
+export declare function allowLocalStore(): void;
+/** True while {@link refuseLocalStore} is in force for this process. */
+export declare function isLocalStoreRefused(): boolean;
+/** The installed refusal text, or null when the store is not refused. */
+export declare function localStoreRefusalMessage(): string | null;
 export declare function getDbPath(): string;
 export declare function getDb(): Database;
 export declare function closeDb(): void;

package/dist/index.d.ts

@@ -77,6 +77,9 @@ export type { StorageBackend, StorageEnv, StorageStatus, SyncMeta, SyncResult }
 export { getHooksDataDir, getCustomHooksDir, getLockPath, } from "./config.js";
 export { resolveHooksTransport, resolveHooksServePublishKey, hooksRegistryOrigin, type HooksRemoteAuthority, type HooksCredentialOptions, type HooksTransportMode, type HooksTransportNotice, type HooksTransportOptions, type HooksTransportResolution, } from "./lib/transport.js";
 export type { HooksLocalOptInEnv } from "./lib/resolver-types.js";
+export { HOOKS_LOCAL_OPT_IN_ENV_KEYS, isHooksLocalOptIn, hasHooksEnvAuthorityIntent, selectsHooksLocalStore, hooksFailClosedLine, hooksHostedRouteLocalStoreRefusal, hooksEventSinkRefusal, } from "./lib/local-opt-in.js";
+export { refuseLocalStore, allowLocalStore, isLocalStoreRefused } from "./db/index.js";
+export { resolveHookEventSink, type HookEventSink } from "./lib/db-writer.js";
 export { getHookRecord, listHookRecords, upsertHookRecord, removeHookRecord, readLock, writeLock, setPinnedHook, getPinnedHook, removePinnedHook, pinInstalledHook, removeHookFromStore, verifyScriptHash, checkScriptHash, retrustHook, sha256Of, sha256File, } from "./lib/store.js";
 export type { HookRecord, LockEntry, LockFile, TrustCheck } from "./lib/store.js";
 export { parseManifest, readCustomManifest, listCustomHooks, writeCustomHook, resolveScript, } from "./lib/manifest.js";
@@ -85,7 +88,7 @@ export { resolveHook, resolveHookDir, resolveHookMeta, resolveScriptPath, } from
 export type { ResolvedHook, HookSource } from "./lib/resolve.js";
 export { installCustomSource, isCustomSource, } from "./lib/custom-install.js";
 export type { CustomInstallResult, CustomSourceKind } from "./lib/custom-install.js";
-export { planSync, syncHooks, fetchPinnedHook, } from "./lib/sync.js";
+export { planSync, syncHooks, fetchPinnedHook, installPinnedFromBundled, } from "./lib/sync.js";
 export type { SyncDiff, SyncPlan, ArtifactResponse, PinnedHookInstall } from "./lib/sync.js";
 export { handleServeRequest, startServeServer, DEFAULT_SERVE_PORT, } from "./serve.js";
 export type { CatalogEntry, ArtifactPayload } from "./serve.js";