@hasna/hooks 0.9.4 → 0.9.6

package/bin/index.js

@@ -2075,6 +2075,7 @@ var init_registry = __esm(() => {
     },
     {
       name: "workspace-repos-guard",
+      timeoutSeconds: 10,
       displayName: "Workspace Repos Guard",
       description: "Blocks writes and deletes that break the protected repo-checkout structure (~/.hasna/repos/clones canonical, plus legacy ~/workspace/repos during the migration window): writes to a protected root, top-level entry creation, non-org folders, and any delete under a protected root",
       version: "0.1.0",
@@ -2093,7 +2094,7 @@ var init_registry = __esm(() => {
       matcher: "^(Bash|apply_patch|ApplyPatch|functions\\.apply_patch)$",
       tags: ["rm", "delete", "trash", "recoverable", "guard", "safety", "bash"],
       rewritesInput: true,
-      timeoutSeconds: 5
+      timeoutSeconds: 10
     },
     {
       name: "checktests",
@@ -4500,6 +4501,139 @@ var init_resolve = __esm(() => {
   init_manifest();
 });
 
+// src/lib/native-safety.ts
+import { createHash } from "crypto";
+import { closeSync, constants, existsSync as existsSync7, fstatSync, lstatSync, openSync, readFileSync as readFileSync2, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join8 } from "path";
+import { homedir as homedir3 } from "os";
+function isNativeSafetyName(name) {
+  return name === "trash-guard" || name === "workspace-repos-guard";
+}
+function validateBinding(b) {
+  if (!b || !isNativeSafetyName(b.name) || ![b.runtime, b.worker, b.home].every((p) => typeof p === "string" && isAbsolute2(p) && !/[\0\r\n]/.test(p)) || ![b.runtimeSHA256, b.workerSHA256].every((h) => /^[0-9a-f]{64}$/.test(h)) || typeof b.path !== "string" || b.path.split(":").some((p) => !isAbsolute2(p) || /[\0\r\n]/.test(p)))
+    throw new Error("Invalid native safety binding");
+}
+function buildNativeSafetyCommand(binding) {
+  validateBinding(binding);
+  const encoded = Buffer.from(JSON.stringify(binding)).toString("base64url");
+  return prefix + [encoded, binding.runtime, binding.home, binding.path].map(quote).join(" ");
+}
+function nativeSafetyRegistration(command) {
+  if (!command.startsWith(prefix))
+    return;
+  const encoded = command.slice(prefix.length).match(/^'([A-Za-z0-9_-]+)' /)?.[1];
+  if (!encoded || encoded.length > 16384)
+    return;
+  try {
+    const binding = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    return buildNativeSafetyCommand(binding) === command ? binding.name : undefined;
+  } catch {
+    return;
+  }
+}
+function pinEligibleFile(file, maximum, executable = false) {
+  if (!isAbsolute2(file) || realpathSync2(file) !== file)
+    throw new Error("Native safety requires canonical files");
+  for (let parent = dirname3(file);; ) {
+    const s = lstatSync(parent);
+    if (!s.isDirectory() || ![0, process.getuid()].includes(s.uid) || s.mode & 18)
+      throw new Error("Native safety requires trusted, non-writable file ancestry");
+    if (parent === dirname3(parent))
+      break;
+    parent = dirname3(parent);
+  }
+  const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const s = fstatSync(fd);
+    if (!s.isFile() || ![0, process.getuid()].includes(s.uid) || s.mode & 18 || s.size > maximum || executable && !(s.mode & 64))
+      throw new Error("Native safety requires an eligible installed file");
+    const bytes = readFileSync2(fd);
+    if (bytes.length > maximum)
+      throw new Error("Native safety file exceeds its bound");
+    return createHash("sha256").update(bytes).digest("hex");
+  } finally {
+    closeSync(fd);
+  }
+}
+function installedNativeSafetyCommand(name) {
+  const home = realpathSync2(homedir3());
+  const runtime = realpathSync2(process.execPath);
+  const candidates = [join8(import.meta.dir, "../../bin/native-safety-entry.js"), join8(import.meta.dir, "../bin/native-safety-entry.js"), join8(import.meta.dir, "native-safety-entry.js")];
+  const worker = candidates.find(existsSync7);
+  if (!worker)
+    throw new Error("Bundled native safety runner is missing; build or reinstall @hasna/hooks before installing its guards.");
+  const canonicalWorker = realpathSync2(worker);
+  return buildNativeSafetyCommand({ name, runtime, runtimeSHA256: pinEligibleFile(runtime, 200000000, true), worker: canonicalWorker, workerSHA256: pinEligibleFile(canonicalWorker, 256000), home, path: `${dirname3(runtime)}:${join8(home, ".bun/bin")}:/usr/local/bin:/usr/bin:/bin` });
+}
+var supervisorSource, quote = (value) => "'" + value.replaceAll("'", "'\\''") + "'", program2, shell, prefix;
+var init_native_safety = __esm(() => {
+  supervisorSource = String.raw`async function supervise(encoded) {
+  const fs = require("node:fs");
+  const path = require("node:path");
+  const crypto = require("node:crypto");
+  const cp = require("node:child_process");
+  const fail = () => { process.stderr.write("Native safety guard refused: verification or execution failed.\n"); process.exit(2); };
+  try {
+    const b = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    const check = (file, hash, maximum) => {
+      if (!path.isAbsolute(file) || fs.realpathSync(file) !== file) throw Error();
+      for (let parent = path.dirname(file);;) {
+        const s = fs.lstatSync(parent);
+        if (!s.isDirectory() || ![0, process.getuid()].includes(s.uid) || (s.mode & 0o022)) throw Error();
+        if (parent === path.dirname(parent)) break;
+        parent = path.dirname(parent);
+      }
+      const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+      try {
+        const s = fs.fstatSync(fd);
+        if (!s.isFile() || ![0, process.getuid()].includes(s.uid) || (s.mode & 0o022) || s.size > maximum) throw Error();
+        const bytes = fs.readFileSync(fd);
+        if (crypto.createHash("sha256").update(bytes).digest("hex") !== hash) throw Error();
+        return bytes;
+      } finally { fs.closeSync(fd); }
+    };
+    check(b.runtime, b.runtimeSHA256, 200_000_000);
+    const bytes = check(b.worker, b.workerSHA256, 256_000);
+    const deadline = setTimeout(fail, 1500);
+    const chunks = []; let size = 0;
+    for await (const chunk of process.stdin) {
+      size += chunk.length;
+      if (size > 1_048_576) throw Error();
+      chunks.push(chunk);
+    }
+    clearTimeout(deadline);
+    const input = Buffer.concat(chunks);
+    const child = cp.spawnSync(b.runtime, ["--config=/dev/null", "--no-env-file", "--no-macros", "--no-install", "--eval", bytes.toString("utf8"), b.name], {
+      input, env: { HOME: b.home, PATH: b.path }, cwd: "/", timeout: 2500, killSignal: "SIGKILL", maxBuffer: 1_048_576,
+    });
+    if (child.error || child.status !== 0 || child.signal || child.stderr.length) throw Error();
+    const result = JSON.parse(child.stdout.toString("utf8"));
+    if (!result || Array.isArray(result) || Object.keys(result).length !== 1) throw Error();
+    if (result.verdict === null) return;
+    const output = result.verdict?.hookSpecificOutput;
+    if (!output || Object.keys(result.verdict).length !== 1 || output.hookEventName !== "PreToolUse") throw Error();
+    if (output.permissionDecision === "deny") {
+      if (Object.keys(output).sort().join() !== "hookEventName,permissionDecision,permissionDecisionReason" || typeof output.permissionDecisionReason !== "string" || !output.permissionDecisionReason.trim()) throw Error();
+    } else if (output.permissionDecision === "allow") {
+      if (b.name !== "trash-guard" || Object.keys(output).sort().join() !== "hookEventName,permissionDecision,updatedInput" || !output.updatedInput || typeof output.updatedInput.command !== "string" || !output.updatedInput.command.trim()) throw Error();
+    } else throw Error();
+    process.stdout.write(JSON.stringify(result.verdict));
+  } catch { fail(); }
+}`;
+  program2 = `(${supervisorSource})(process.argv[1]);`;
+  shell = `cd / || exit 2
+exec 3<&0 || exit 2
+/usr/bin/env -i HOME="$3" PATH="$4" "$2" --config=/dev/null --no-env-file --no-macros --no-install --eval ${quote(program2)} "$1" <&3 3<&- 2>/dev/null &
+runner=$!
+exec 3<&-
+(trap 'kill "$sleeper" 2>/dev/null; exit 0' TERM; /bin/sleep 6 & sleeper=$!; wait "$sleeper"; kill -KILL "$runner" 2>/dev/null) &
+watchdog=$!
+wait "$runner"; result=$?
+kill "$watchdog" 2>/dev/null; wait "$watchdog" 2>/dev/null
+if [ "$result" -ne 0 ]; then printf '%s\\n' 'Native safety guard refused: verification or execution failed.' >&2; exit 2; fi`;
+  prefix = `/usr/bin/env -i /bin/sh -c ${quote(shell)} hasna-native-safety-v1 `;
+});
+
 // src/lib/mementos-options.ts
 function validateMementosRegistration(name, value) {
   if (value === undefined)
@@ -4570,6 +4704,9 @@ function mementosRunEnvironment(env, value) {
 function registrationName(command) {
   if (typeof command !== "string")
     return;
+  const native = nativeSafetyRegistration(command);
+  if (native)
+    return native;
   if (/^hooks run mementos-context(?:\s|$)/.test(command.trim())) {
     try {
       retainedMementosRegistration([command.trim()]);
@@ -4662,8 +4799,7 @@ function hookRegisteredInSettings(settings, name, eventSpec, hookMatcher) {
   if (!Array.isArray(hooks))
     return false;
   return hooks.some((entry) => entry?.hooks?.some((h) => {
-    const match = h?.command?.match(/^hooks run ([\w-]+)/);
-    if (!match || match[1] !== name)
+    if (registrationName(h?.command) !== name)
       return false;
     if (!matcher)
       return true;
@@ -4675,6 +4811,7 @@ function hookRegisteredInSettings(settings, name, eventSpec, hookMatcher) {
 }
 var REGISTRATION_COMMAND_RE;
 var init_registration = __esm(() => {
+  init_native_safety();
   init_resolve();
   REGISTRATION_COMMAND_RE = /^(?:hooks run ([\w-]+)(?:\s+--profile\s+[\w-]+)?|hook-([\w-]+))$/;
 });
@@ -4873,9 +5010,9 @@ var init_migrations = __esm(() => {
 });
 
 // src/db/legacy-import.ts
-import { existsSync as existsSync7, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
-import { join as join8 } from "path";
-import { homedir as homedir3 } from "os";
+import { existsSync as existsSync8, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join9 } from "path";
+import { homedir as homedir4 } from "os";
 function ensureMetaTable(db) {
   db.exec(`
     CREATE TABLE IF NOT EXISTS _meta (
@@ -4898,7 +5035,7 @@ function nanoid() {
 function importJsonlFile(db, filePath) {
   let count = 0;
   try {
-    const lines = readFileSync2(filePath, "utf-8").split(`
+    const lines = readFileSync3(filePath, "utf-8").split(`
 `).filter(Boolean);
     for (const line of lines) {
       try {
@@ -4924,7 +5061,7 @@ function importJsonlFile(db, filePath) {
 function importErrorsLog(db, filePath) {
   let count = 0;
   try {
-    const lines = readFileSync2(filePath, "utf-8").split(`
+    const lines = readFileSync3(filePath, "utf-8").split(`
 `).filter(Boolean);
     const linePattern = /^\[(.+?)\]\s+(?:\[session:(\S+)\]\s+)?(.+?)\s+\u2014\s+(.+)$/;
     for (const line of lines) {
@@ -4949,25 +5086,25 @@ function importErrorsLog(db, filePath) {
   } catch {}
   return count;
 }
-function runLegacyImport(db, homeDir = homedir3()) {
+function runLegacyImport(db, homeDir = homedir4()) {
   try {
     if (isAlreadyDone(db))
       return;
     let total = 0;
-    const claudeProjectsDir = join8(homeDir, ".claude", "projects");
-    if (existsSync7(claudeProjectsDir)) {
+    const claudeProjectsDir = join9(homeDir, ".claude", "projects");
+    if (existsSync8(claudeProjectsDir)) {
       try {
         const projectDirs = readdirSync2(claudeProjectsDir);
         for (const dir of projectDirs) {
-          const projectDir = join8(claudeProjectsDir, dir);
+          const projectDir = join9(claudeProjectsDir, dir);
           try {
             const files = readdirSync2(projectDir);
             for (const file of files) {
               if (file.match(/^session-log-\d{4}-\d{2}-\d{2}\.jsonl$/)) {
-                total += importJsonlFile(db, join8(projectDir, file));
+                total += importJsonlFile(db, join9(projectDir, file));
               }
               if (file === "errors.log") {
-                total += importErrorsLog(db, join8(projectDir, file));
+                total += importErrorsLog(db, join9(projectDir, file));
               }
             }
           } catch {}
@@ -5014,8 +5151,8 @@ __export(exports_db, {
   allowLocalStore: () => allowLocalStore
 });
 import { Database } from "bun:sqlite";
-import { existsSync as existsSync8, mkdirSync as mkdirSync2, cpSync } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync2, cpSync } from "fs";
+import { join as join10 } from "path";
 function refuseLocalStore(message) {
   localStoreRefusal = message;
 }
@@ -5030,8 +5167,8 @@ function localStoreRefusalMessage() {
 }
 function resolveDataDir() {
   const effective = getEffectiveDataRoot();
-  const oldDir = join9(getHomeDir(), ".hooks");
-  if (!existsSync8(effective) && existsSync8(oldDir)) {
+  const oldDir = join10(getHomeDir(), ".hooks");
+  if (!existsSync9(effective) && existsSync9(oldDir)) {
     mkdirSync2(effective, { recursive: true });
     cpSync(oldDir, effective, { recursive: true });
   }
@@ -5042,11 +5179,11 @@ function getDbPath() {
   if (explicitDb)
     return explicitDb;
   const dataDir3 = resolveDataDir();
-  return join9(dataDir3, "hooks.db");
+  return join10(dataDir3, "hooks.db");
 }
 function ensureDir(dbPath) {
   const dir = dbPath.substring(0, dbPath.lastIndexOf("/"));
-  if (dir && !existsSync8(dir)) {
+  if (dir && !existsSync9(dir)) {
     mkdirSync2(dir, { recursive: true });
   }
 }
@@ -5056,7 +5193,7 @@ function getDb() {
   if (instance)
     return instance;
   const dbPath = getDbPath();
-  const isNew = dbPath === ":memory:" || !existsSync8(dbPath);
+  const isNew = dbPath === ":memory:" || !existsSync9(dbPath);
   ensureDir(dbPath);
   instance = new Database(dbPath);
   instance.exec("PRAGMA busy_timeout=5000");
@@ -5118,12 +5255,12 @@ __export(exports_store, {
   checkScriptHash: () => checkScriptHash,
   LockFileError: () => LockFileError
 });
-import { createHash } from "crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2, renameSync } from "fs";
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2, renameSync } from "fs";
 import { readFile as readFile2 } from "fs/promises";
 import { randomBytes } from "crypto";
 function sha256Of(input) {
-  return createHash("sha256").update(input).digest("hex");
+  return createHash2("sha256").update(input).digest("hex");
 }
 async function sha256File(path) {
   const buf = await readFile2(path);
@@ -5184,11 +5321,11 @@ function assertLockShape(parsed, path) {
 }
 function readLock() {
   const path = getLockPath();
-  if (!existsSync9(path))
+  if (!existsSync10(path))
     return { hooks: {} };
   let raw;
   try {
-    raw = readFileSync3(path, "utf-8");
+    raw = readFileSync4(path, "utf-8");
   } catch {
     throw new LockFileError(`hooks.lock (${path}) could not be read. Repair: fix permissions or move the file aside and run 'hooks sync'.`);
   }
@@ -5291,7 +5428,7 @@ async function verifyScriptHash(name, scriptPath) {
   return checkScriptHash(name, await sha256File(scriptPath));
 }
 function retrustHook(name, scriptPath, version, source) {
-  const actual = sha256Of(readFileSync3(scriptPath));
+  const actual = sha256Of(readFileSync4(scriptPath));
   const db = storeDb();
   if (db) {
     upsertHookRecord(db, {
@@ -5318,15 +5455,15 @@ var init_store = __esm(() => {
 });
 
 // src/lib/codex-settings.ts
-import { closeSync, existsSync as existsSync10, lstatSync, mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync4, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname3 } from "path";
+import { closeSync as closeSync2, existsSync as existsSync11, lstatSync as lstatSync2, mkdirSync as mkdirSync4, openSync as openSync2, readFileSync as readFileSync5, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname4 } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 function current(path) {
   try {
-    const stat = lstatSync(path);
+    const stat = lstatSync2(path);
     if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1048576)
       throw new Error("invalid_file");
-    return readFileSync4(path, "utf8");
+    return readFileSync5(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return null;
@@ -5358,11 +5495,11 @@ function writeCodexSettings(path, settings) {
   const snapshot = snapshots.get(settings);
   if (!snapshot || snapshot.path !== path)
     throw new Error("Codex settings require a complete current read before writing.");
-  mkdirSync4(dirname3(path), { recursive: true });
+  mkdirSync4(dirname4(path), { recursive: true });
   const lock = `${path}.hooks-write.lock`;
   let fd;
   try {
-    fd = openSync(lock, "wx", 384);
+    fd = openSync2(lock, "wx", 384);
   } catch {
     throw new Error("Codex settings are being edited; retry after the active writer finishes.");
   }
@@ -5378,9 +5515,9 @@ function writeCodexSettings(path, settings) {
     renameSync2(temp, path);
     snapshots.set(settings, { path, raw: next });
   } finally {
-    if (existsSync10(temp))
+    if (existsSync11(temp))
       unlinkSync(temp);
-    closeSync(fd);
+    closeSync2(fd);
     unlinkSync(lock);
   }
 }
@@ -5409,9 +5546,9 @@ __export(exports_installer, {
   detectRewriteConflict: () => detectRewriteConflict,
   buildCodewithTomlFragment: () => buildCodewithTomlFragment
 });
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync5, readdirSync as readdirSync3, rmdirSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
-import { join as join10, dirname as dirname4 } from "path";
-import { homedir as homedir4 } from "os";
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync6, readdirSync as readdirSync3, rmdirSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
+import { join as join11, dirname as dirname5 } from "path";
+import { homedir as homedir5 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function normalizeHookName(name) {
   return name.startsWith("hook-") ? name : `hook-${name}`;
@@ -5424,8 +5561,7 @@ function removeHookEntriesByName(entries, hookName) {
     if (!Array.isArray(entry.hooks))
       return [entry];
     const kept = entry.hooks.filter((h) => {
-      const match = h.command?.match(/^hooks run ([\w-]+)/);
-      return !(match && match[1] === hookName);
+      return registrationName(h.command) !== hookName;
     });
     return kept.length === entry.hooks.length ? [entry] : kept.length ? [{ ...entry, hooks: kept }] : [];
   });
@@ -5459,29 +5595,29 @@ function getSettingsPath(scope = "global", target = "claude", codewithConfigPath
     return globalOverride;
   const dir = getTargetSettingsDir(target);
   if (target === "codex")
-    return join10(scope === "project" ? process.cwd() : homedir4(), dir, "hooks.json");
+    return join11(scope === "project" ? process.cwd() : homedir5(), dir, "hooks.json");
   if (scope === "project") {
-    return target === "codewith" ? join10(process.cwd(), dir, "config.toml") : join10(process.cwd(), dir, "settings.json");
+    return target === "codewith" ? join11(process.cwd(), dir, "config.toml") : join11(process.cwd(), dir, "settings.json");
   }
-  return target === "codewith" ? join10(homedir4(), dir, "config.toml") : join10(homedir4(), dir, "settings.json");
+  return target === "codewith" ? join11(homedir5(), dir, "config.toml") : join11(homedir5(), dir, "settings.json");
 }
 function getHookPath(name) {
   const shortName = shortHookName(name);
   const resolved = resolveHookDir(shortName);
   if (resolved)
     return resolved;
-  return join10(HOOKS_DIR, normalizeHookName(shortName));
+  return join11(HOOKS_DIR, normalizeHookName(shortName));
 }
 function hookExists(name) {
-  return existsSync11(getHookPath(name));
+  return existsSync12(getHookPath(name));
 }
 function readSettings(scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
   if (target === "codex")
     return readCodexSettings(path);
   try {
-    if (existsSync11(path)) {
-      return JSON.parse(readFileSync5(path, "utf-8"));
+    if (existsSync12(path)) {
+      return JSON.parse(readFileSync6(path, "utf-8"));
     }
   } catch (error) {
     console.warn(`[hooks] Failed to read settings at ${path}: ${error instanceof Error ? error.message : String(error)}`);
@@ -5492,8 +5628,8 @@ function writeSettings(settings, scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
   if (target === "codex")
     return writeCodexSettings(path, settings);
-  const dir = dirname4(path);
-  if (!existsSync11(dir)) {
+  const dir = dirname5(path);
+  if (!existsSync12(dir)) {
     mkdirSync5(dir, { recursive: true });
   }
   writeFileSync4(path, JSON.stringify(settings, null, 2) + `
@@ -5521,6 +5657,9 @@ function codewithTimeout(name) {
   switch (name) {
     case "mementos-context":
       return 12;
+    case "trash-guard":
+    case "workspace-repos-guard":
+      return 10;
     case "knowledge-context":
       return 6;
     case "session-start":
@@ -5530,7 +5669,6 @@ function codewithTimeout(name) {
     case "prompt-guard":
       return 3;
     case "worktree-guard":
-    case "trash-guard":
     case "stop-sync":
       return 5;
     default:
@@ -5559,11 +5697,13 @@ function codewithStatusMessage(name) {
 }
 function buildCodewithTomlFragment(name, profile, mementos) {
   const shortName = shortHookName(name);
-  const meta = resolveHookMeta(shortName);
+  if (isNativeSafetyName(shortName) && profile)
+    throw new Error("Bundled native safety guards do not select registry profiles");
+  const meta = isNativeSafetyName(shortName) ? getHook(shortName) : resolveHookMeta(shortName);
   if (!meta)
     throw new Error(`Hook '${shortName}' not found`);
   validateMementosRegistration(shortName, mementos);
-  const command = (profile ? `hooks run ${shortName} --profile ${profile}` : `hooks run ${shortName}`) + mementosCommandSuffix(mementos);
+  const command = isNativeSafetyName(shortName) ? installedNativeSafetyCommand(shortName) : (profile ? `hooks run ${shortName} --profile ${profile}` : `hooks run ${shortName}`) + mementosCommandSuffix(mementos);
   const matcher = codewithMatcher(meta.matcher);
   const fragments = [];
   for (const event of getHookEvents(meta)) {
@@ -5588,17 +5728,17 @@ function buildCodewithTomlFragment(name, profile, mementos) {
 function readCodewithConfig(scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
   try {
-    return existsSync11(path) ? readFileSync5(path, "utf-8") : "";
+    return existsSync12(path) ? readFileSync6(path, "utf-8") : "";
   } catch {
     return "";
   }
 }
 function appendCodewithFragment(fragment, scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
-  const dir = dirname4(path);
-  if (!existsSync11(dir))
+  const dir = dirname5(path);
+  if (!existsSync12(dir))
     mkdirSync5(dir, { recursive: true });
-  const existing = existsSync11(path) ? readFileSync5(path, "utf-8") : "";
+  const existing = existsSync12(path) ? readFileSync6(path, "utf-8") : "";
   const sep2 = existing.trim() ? `
 
 ` : "";
@@ -5606,7 +5746,7 @@ function appendCodewithFragment(fragment, scope, configPath) {
   return path;
 }
 function detectConflict(name, scope, target) {
-  const meta = resolveHookMeta(name);
+  const meta = isNativeSafetyName(name) ? getHook(name) : resolveHookMeta(name);
   if (!meta || !meta.matcher)
     return;
   const events = new Set(getHookEvents(meta));
@@ -5626,7 +5766,7 @@ function detectConflict(name, scope, target) {
   return;
 }
 function detectRewriteConflict(name, scope, target, lookup = getHook) {
-  const meta = resolveHookMeta(name);
+  const meta = isNativeSafetyName(name) ? getHook(name) : resolveHookMeta(name);
   if (!meta?.matcher || !meta.rewritesInput)
     return;
   if (!getHookEvents(meta).includes("PreToolUse"))
@@ -5647,7 +5787,10 @@ function detectRewriteConflict(name, scope, target, lookup = getHook) {
 }
 function installForTarget(name, scope, overwrite, target, profile, codewithMode = "fragment", codewithConfigPath, mementos) {
   const shortName = shortHookName(name);
-  if (!hookExists(shortName)) {
+  if (isNativeSafetyName(shortName) && (profile || target === "gemini" || target === "codewith" && codewithMode === "write")) {
+    return { hook: shortName, success: false, error: "Bundled native safety guards support Claude/Codex and managed Codewith fragments, without registry profiles.", target };
+  }
+  if (!isNativeSafetyName(shortName) && !hookExists(shortName)) {
     return { hook: shortName, success: false, error: `Hook '${shortName}' not found`, target };
   }
   if (target === "codewith") {
@@ -5739,7 +5882,7 @@ function installHook(name, options = {}) {
   }
   if (target === "all") {
     const shortName = shortHookName(name);
-    const meta = resolveHookMeta(shortName);
+    const meta = isNativeSafetyName(shortName) ? getHook(shortName) : resolveHookMeta(shortName);
     if (meta) {
       const unsupportedTargets = ["claude", "codewith"].filter((agentTarget) => getHookEvents(meta).some((event) => !isEventSupported(event, agentTarget)));
       if (unsupportedTargets.length > 0) {
@@ -5772,7 +5915,7 @@ function installHook(name, options = {}) {
   return installForTarget(name, scope, overwrite, target, profile, codewithMode, codewithConfigPath, mementos);
 }
 function registerHook(name, scope = "global", target = "claude", profile, mementos) {
-  const meta = resolveHookMeta(name);
+  const meta = isNativeSafetyName(name) ? getHook(name) : resolveHookMeta(name);
   if (!meta)
     return;
   const eventKeys = getHookEvents(meta).map((event) => {
@@ -5789,8 +5932,17 @@ function registerHook(name, scope = "global", target = "claude", profile, mement
   const settings = readSettings(scope, target);
   if (!settings.hooks)
     settings.hooks = {};
+  if (isNativeSafetyName(name)) {
+    for (const groups of Object.values(settings.hooks))
+      for (const group of groups)
+        for (const hook of group.hooks ?? []) {
+          if (typeof hook.command === "string" && /(?:^|\s)hasna-native-safety-v\d+(?:\s|$)/.test(hook.command) && !registrationName(hook.command)) {
+            throw new Error("Unknown managed safety definition; reconcile its exact version before replacing it.");
+          }
+        }
+  }
   const retained = name === "mementos-context" && mementos === undefined ? retainedMementosRegistration(Object.values(settings.hooks).flatMap((groups) => Array.isArray(groups) ? groups.flatMap((group) => Array.isArray(group.hooks) ? group.hooks.map((hook) => hook.command).filter((command) => typeof command === "string") : []) : [])) : undefined;
-  const hookCommand = (profile ? `hooks run ${name} --profile ${profile}` : `hooks run ${name}`) + mementosCommandSuffix(mementos ?? retained);
+  const hookCommand = isNativeSafetyName(name) ? installedNativeSafetyCommand(name) : (profile ? `hooks run ${name} --profile ${profile}` : `hooks run ${name}`) + mementosCommandSuffix(mementos ?? retained);
   if (target === "codex") {
     const positions = [];
     for (const [event, groups] of Object.entries(settings.hooks)) {
@@ -5798,9 +5950,11 @@ function registerHook(name, scope = "global", target = "claude", profile, mement
         for (let index = 0;index < entry.hooks.length; index++) {
           const command = entry.hooks[index]?.command;
           const match = typeof command === "string" && command.trim().match(/^(?:hooks run ([\w-]+)(?:\s|$)|hook-([\w-]+)$)/);
-          if (match && (match[1] ?? match[2]) === name) {
+          if (match && (match[1] ?? match[2]) === name || registrationName(command) === name) {
             if (registrationName(command) !== name)
               throw new Error("Unrecognized Codex registration; reconcile it before updating this hook.");
+            if (isNativeSafetyName(name) && entry.hooks[index].async !== undefined && entry.hooks[index].async !== false)
+              throw new Error("Asynchronous safety hooks cannot block; reconcile this registration before updating it.");
             positions.push({ event, entry, index });
           }
         }
@@ -5864,12 +6018,20 @@ function getRegisteredHooksForTarget(scope = "global", target = "claude") {
   if (target === "codewith") {
     const config = readCodewithConfig(scope);
     const registered2 = [];
-    const re = /^\s*command\s*=\s*["']([^"'\n]+)["']\s*$/gm;
-    let match;
-    while (match = re.exec(config)) {
-      const name = registrationName(match[1]);
-      if (name)
-        registered2.push(name);
+    try {
+      const parsed = Bun.TOML.parse(config);
+      for (const groups of Object.values(parsed.hooks ?? {})) {
+        if (!Array.isArray(groups))
+          continue;
+        for (const group of groups)
+          for (const hook of group.hooks ?? []) {
+            const name = registrationName(hook.command);
+            if (name)
+              registered2.push(name);
+          }
+      }
+    } catch {
+      return [];
     }
     return [...new Set(registered2)];
   }
@@ -5914,9 +6076,9 @@ function removeHookForTarget(name, scope, target) {
 }
 function readSettingsAt(path) {
   try {
-    if (!existsSync11(path))
+    if (!existsSync12(path))
       return;
-    const raw = readFileSync5(path, "utf-8");
+    const raw = readFileSync6(path, "utf-8");
     return { raw, settings: JSON.parse(raw) };
   } catch {
     return;
@@ -5950,7 +6112,7 @@ function pruneStaleRegistrations(scope = "global") {
       staleCommandsByEvent.set(finding.event, commands);
     }
     const settings = target === "codex" ? readCodexSettings(path) : parsed.settings;
-    if (target === "codex" && readFileSync5(path, "utf8") !== parsed.raw)
+    if (target === "codex" && readFileSync6(path, "utf8") !== parsed.raw)
       throw new Error("Codex settings changed before pruning; retry.");
     for (const [eventKey, commands] of staleCommandsByEvent) {
       const entries = settings.hooks?.[eventKey];
@@ -6038,10 +6200,10 @@ function codewithHasHookEntryInText(configText, name) {
 }
 function codewithHasHookEntry(name, scope = "global") {
   const path = getSettingsPath(scope, "codewith");
-  if (!existsSync11(path))
+  if (!existsSync12(path))
     return false;
   try {
-    return codewithHasHookEntryInText(readFileSync5(path, "utf-8"), name);
+    return codewithHasHookEntryInText(readFileSync6(path, "utf-8"), name);
   } catch {
     return false;
   }
@@ -6050,12 +6212,12 @@ function removeStoreDirFailClosed(dir) {
   const entries = readdirSync3(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      removeStoreDirFailClosed(join10(dir, entry.name));
+      removeStoreDirFailClosed(join11(dir, entry.name));
     }
   }
   for (const entry of entries) {
     if (!entry.isDirectory()) {
-      unlinkSync2(join10(dir, entry.name));
+      unlinkSync2(join11(dir, entry.name));
     }
   }
   rmdirSync(dir);
@@ -6086,8 +6248,8 @@ function uninstallHook(name, scope = "global", target = "claude") {
   const registrationsRemaining = [];
   if (target === "codewith" || target === "all") {
     const codewithPath = getSettingsPath(scope, "codewith");
-    if (existsSync11(codewithPath)) {
-      const before = readFileSync5(codewithPath, "utf-8");
+    if (existsSync12(codewithPath)) {
+      const before = readFileSync6(codewithPath, "utf-8");
       const after = removeCodewithHookEntry(before, shortName);
       if (after.removed) {
         writeFileSync4(codewithPath, after.text, "utf-8");
@@ -6134,8 +6296,9 @@ var init_installer = __esm(() => {
   init_registration();
   init_store();
   init_codex_settings();
-  __dirname2 = dirname4(fileURLToPath2(import.meta.url));
-  HOOKS_DIR = existsSync11(join10(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join10(__dirname2, "..", "..", "hooks") : join10(__dirname2, "..", "hooks");
+  init_native_safety();
+  __dirname2 = dirname5(fileURLToPath2(import.meta.url));
+  HOOKS_DIR = existsSync12(join11(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join11(__dirname2, "..", "..", "hooks") : join11(__dirname2, "..", "hooks");
   EVENT_MAP = {
     claude: {
       PreToolUse: "PreToolUse",
@@ -6248,12 +6411,12 @@ var init_redact = __esm(() => {
 });
 
 // src/lib/profiles.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5, readdirSync as readdirSync4, rmSync, cpSync as cpSync2 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync5, readdirSync as readdirSync4, rmSync, cpSync as cpSync2 } from "fs";
+import { join as join12 } from "path";
 function getProfilesDir() {
-  const newDir = join11(getEffectiveDataRoot(), "profiles");
-  const oldDir = join11(getHomeDir(), ".hooks", "profiles");
-  if (!existsSync12(newDir) && existsSync12(oldDir)) {
+  const newDir = join12(getEffectiveDataRoot(), "profiles");
+  const oldDir = join12(getHomeDir(), ".hooks", "profiles");
+  if (!existsSync13(newDir) && existsSync13(oldDir)) {
     mkdirSync6(newDir, { recursive: true });
     cpSync2(oldDir, newDir, { recursive: true });
   }
@@ -6261,12 +6424,12 @@ function getProfilesDir() {
 }
 function ensureProfilesDir() {
   const dir = getProfilesDir();
-  if (!existsSync12(dir)) {
+  if (!existsSync13(dir)) {
     mkdirSync6(dir, { recursive: true });
   }
 }
 function profilePath(id) {
-  return join11(getProfilesDir(), `${id}.json`);
+  return join12(getProfilesDir(), `${id}.json`);
 }
 function shortUuid() {
   return crypto.randomUUID().slice(0, 8);
@@ -6292,23 +6455,23 @@ function createProfile(input) {
 function getProfile(id) {
   const path = profilePath(id);
   try {
-    if (!existsSync12(path))
+    if (!existsSync13(path))
       return null;
-    return JSON.parse(readFileSync6(path, "utf-8"));
+    return JSON.parse(readFileSync7(path, "utf-8"));
   } catch {
     return null;
   }
 }
 function listProfiles() {
   const dir = getProfilesDir();
-  if (!existsSync12(dir))
+  if (!existsSync13(dir))
     return [];
   try {
     const files = readdirSync4(dir).filter((f) => f.endsWith(".json"));
     const profiles = [];
     for (const file of files) {
       try {
-        const content = readFileSync6(join11(dir, file), "utf-8");
+        const content = readFileSync7(join12(dir, file), "utf-8");
         profiles.push(JSON.parse(content));
       } catch {}
     }
@@ -6338,7 +6501,7 @@ function importProfiles(profiles) {
       continue;
     }
     const path = profilePath(profile.agent_id);
-    if (existsSync12(path)) {
+    if (existsSync13(path)) {
       skipped++;
       continue;
     }
@@ -6352,14 +6515,19 @@ var init_profiles = __esm(() => {
   init_app_home();
 });
 
-// ../../node_modules/.bun/@hasna+contracts@1.0.2+e0db24ae03127387/node_modules/@hasna/contracts/dist/client/transport.js
+// ../contracts/dist/client/transport.js
 import { isIP as isIP2 } from "net";
 import { spawnSync } from "child_process";
-import { closeSync as closeSync2, fstatSync, openSync as openSync2, readFileSync as readFileSync7 } from "fs";
-import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
-import { createRequire as createRequire2 } from "module";
+import { closeSync as closeSync22, fstatSync as fstatSync2, openSync as openSync22, readFileSync as readFileSync22 } from "fs";
+import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";
 import { hostname as osHostname } from "os";
-import { isAbsolute as isAbsolute2, join as join12 } from "path";
+import { isAbsolute as isAbsolute3, join as join22 } from "path";
+import { createRequire as createRequire2 } from "module";
+import { fileURLToPath as fileURLToPath22 } from "url";
+import { closeSync as closeSync3, fstatSync as fstatSync3, lstatSync as lstatSync3, openSync as openSync3, readFileSync as readFileSync8, realpathSync as realpathSync3, statSync } from "fs";
+import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
+import { basename as basename2, dirname as dirname6, join as join13, relative, sep as sep2 } from "path";
+import { fileURLToPath as fileURLToPath3, pathToFileURL } from "url";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
 }
@@ -6376,27 +6544,133 @@ function credentialOverrideEnvKey(name) {
 function credentialPointerEnvKey(name) {
   return `HASNA_${envToken(name)}_API_KEY_REF`;
 }
+function e(e2, n, r) {
+  throw new Error(r ? `No known conditions for "${n}" specifier in "${e2}" package` : `Missing "${n}" specifier in "${e2}" package`);
+}
+function n(n2, i, o, f) {
+  let s, u, l = r(n2, o), c = function(e2) {
+    let n3 = new Set(["default", ...e2.conditions || []]);
+    return e2.unsafe || n3.add(e2.require ? "require" : "import"), e2.unsafe || n3.add(e2.browser ? "browser" : "node"), n3;
+  }(f || {}), a = i[l];
+  if (a === undefined) {
+    let e2, n3, r, t;
+    for (t in i)
+      n3 && t.length < n3.length || (t[t.length - 1] === "/" && l.startsWith(t) ? (u = l.substring(t.length), n3 = t) : t.length > 1 && (r = t.indexOf("*", 1), ~r && (e2 = RegExp("^" + t.substring(0, r) + "(.*)" + t.substring(1 + r) + "$").exec(l), e2 && e2[1] && (u = e2[1], n3 = t))));
+    a = i[n3];
+  }
+  return a || e(n2, l), s = t(a, c), s || e(n2, l, 1), u && function(e2, n3) {
+    let r, t = 0, i2 = e2.length, o2 = /[*]/g, f2 = /[/]$/;
+    for (;t < i2; t++)
+      e2[t] = o2.test(r = e2[t]) ? r.replace(o2, n3) : f2.test(r) ? r + n3 : r;
+  }(s, u), s;
+}
+function r(e2, n2, r2) {
+  if (e2 === n2 || n2 === ".")
+    return ".";
+  let t = e2 + "/", i = t.length, o = n2.slice(0, i) === t, f = o ? n2.slice(i) : n2;
+  return f[0] === "#" ? f : o || !r2 ? f.slice(0, 2) === "./" ? f : "./" + f : f;
+}
+function t(e2, n2, r2) {
+  if (e2) {
+    if (typeof e2 == "string")
+      return r2 && r2.add(e2), [e2];
+    let i, o;
+    if (Array.isArray(e2)) {
+      for (o = r2 || new Set, i = 0;i < e2.length; i++)
+        t(e2[i], n2, o);
+      if (!r2 && o.size)
+        return [...o];
+    } else
+      for (i in e2)
+        if (n2.has(i))
+          return t(e2[i], n2, r2);
+  }
+}
+function o(e2, r2, t2) {
+  let i, o2 = e2.exports;
+  if (o2) {
+    if (typeof o2 == "string")
+      o2 = { ".": o2 };
+    else
+      for (i in o2) {
+        i[0] !== "." && (o2 = { ".": o2 });
+        break;
+      }
+    return n(e2.name, o2, r2 || ".", t2);
+  }
+}
+function entryPoint(directory) {
+  const root = realpathSync3(directory);
+  const fd = openSync3(join13(root, "package.json"), O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+  let pkg;
+  try {
+    const stat = fstatSync3(fd);
+    if (!stat.isFile() || stat.size > MAX_PACKAGE_BYTES2)
+      throw new Error("Invalid Secrets package metadata");
+    pkg = JSON.parse(readFileSync8(fd, "utf8"));
+  } finally {
+    closeSync3(fd);
+  }
+  if (!pkg || typeof pkg !== "object" || !("name" in pkg) || pkg.name !== PACKAGE) {
+    throw new Error("Invalid Secrets package identity");
+  }
+  const target = o(pkg, ".")?.[0];
+  if (typeof target !== "string" || !target.startsWith("./"))
+    throw new Error("Missing Secrets import export");
+  const parts = target.slice(2).split("/");
+  if (/[\\%?#\0]/.test(target) || parts.some((part) => !part || part === "." || part === ".." || part === "node_modules")) {
+    throw new Error("Invalid Secrets import export");
+  }
+  const file = realpathSync3(join13(root, ...parts));
+  const within = relative(root, file);
+  if (!within || within === ".." || within.startsWith(`..${sep2}`) || !statSync(file).isFile()) {
+    throw new Error("Secrets import export escapes its package or is not a file");
+  }
+  return pathToFileURL(file).href;
+}
+function resolveInstalledSecrets(parentUrl) {
+  let directory = dirname6(fileURLToPath3(parentUrl));
+  for (;; ) {
+    if (basename2(directory) !== "node_modules") {
+      const candidate = join13(directory, "node_modules", PACKAGE);
+      let absent = false;
+      try {
+        lstatSync3(candidate);
+      } catch (error) {
+        if (error.code !== "ENOENT")
+          throw error;
+        absent = true;
+      }
+      if (!absent)
+        return entryPoint(candidate);
+    }
+    const parent = dirname6(directory);
+    if (parent === directory)
+      throw new Error("Secrets SDK is not installed for this consumer");
+    directory = parent;
+  }
+}
 function homeDir(env) {
   const home = env.HOME?.trim();
   return home ? home : null;
 }
 function absoluteOverride(env, key) {
   const value = env[key]?.trim();
-  return value && isAbsolute2(value) ? value : null;
+  return value && isAbsolute3(value) ? value : null;
 }
 function hasnaHomeDir(env) {
   const override = absoluteOverride(env, HASNA_HOME_ENV_KEY);
   if (override)
     return override;
   const home = homeDir(env);
-  return home ? join12(home, HASNA_HOME_DIR) : null;
+  return home ? join22(home, HASNA_HOME_DIR) : null;
 }
 function appConfigDir(name, env) {
   const configRoot = absoluteOverride(env, HASNA_CONFIG_HOME_ENV_KEY);
   if (configRoot)
-    return join12(configRoot, name);
+    return join22(configRoot, name);
   const root = hasnaHomeDir(env);
-  return root ? join12(root, name, CONFIG_SUBDIR) : null;
+  return root ? join22(root, name, CONFIG_SUBDIR) : null;
 }
 function credentialDiskSourceList(name, env, profile = null) {
   if (!SAFE_APP_SLUG.test(name))
@@ -6405,7 +6679,7 @@ function credentialDiskSourceList(name, env, profile = null) {
   if (!directory)
     return [];
   const file = profile ? `${CREDENTIALS_FILE}-${profile}` : CREDENTIALS_FILE;
-  return [{ path: join12(directory, file), tier: "disk" }];
+  return [{ path: join22(directory, file), tier: "disk" }];
 }
 function credentialDiskSources(name, env) {
   return credentialDiskSourceList(name, env, null).map((s) => s.path);
@@ -6428,9 +6702,9 @@ function parseEnvFile(text) {
     if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
       continue;
     let value = withoutExport.slice(equals + 1).trim();
-    const quote = value[0];
-    if (quote === '"' || quote === "'") {
-      if (value.length < 2 || !value.endsWith(quote)) {
+    const quote2 = value[0];
+    if (quote2 === '"' || quote2 === "'") {
+      if (value.length < 2 || !value.endsWith(quote2)) {
         unusable.add(key);
         continue;
       }
@@ -6459,7 +6733,7 @@ function readAppConfigFile(path) {
   };
   let fd = -1;
   try {
-    fd = openSync2(path, O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+    fd = openSync22(path, O_RDONLY2 | O_NOFOLLOW2 | O_NONBLOCK2);
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT" || code === "ENOTDIR")
@@ -6469,7 +6743,7 @@ function readAppConfigFile(path) {
     unsafe(`the path could not be opened (${code ?? "unknown error"})`);
   }
   try {
-    const before = fstatSync(fd);
+    const before = fstatSync2(fd);
     if (!before.isFile())
       unsafe("the path is not a regular file");
     if (!configFileModeAllowed(before.mode)) {
@@ -6480,31 +6754,39 @@ function readAppConfigFile(path) {
       unsafe("the file is not owned by the current user");
     if (before.size > MAX_CREDENTIAL_FILE_BYTES2)
       unsafe("the file exceeds the size limit");
-    const bytes = readFileSync7(fd);
-    const after = fstatSync(fd);
+    const bytes = readFileSync22(fd);
+    const after = fstatSync2(fd);
     if (!configFileReadsCoherent(before, after)) {
       unsafe("the file changed while being read");
     }
     return parseEnvFile(bytes.toString("utf8"));
   } finally {
     if (fd !== -1)
-      closeSync2(fd);
+      closeSync22(fd);
   }
 }
-function readCredentialFile(path, apiKeyKeys) {
+function readCredentialFile(path, apiKeyKeys, pointerKey) {
   const parsed = readAppConfigFile(path);
   if (!parsed)
     return null;
-  for (const key of apiKeyKeys) {
+  for (const key of [...apiKeyKeys, pointerKey]) {
     if (parsed.unusable.has(key)) {
       throw new CredentialFileUnsafeError(path, `${key} is declared but blank or malformed`);
     }
   }
   const values = apiKeyKeys.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+  const pointer = parsed.values.get(pointerKey)?.trim();
+  if (pointer !== undefined) {
+    if (!VAULT_POINTER_SHAPE.test(pointer))
+      throw new CredentialFileUnsafeError(path, `${pointerKey} must name a vault item`);
+    if (values.length)
+      throw new CredentialFileUnsafeError(path, "a credential file cannot select both a literal key and a vault reference");
+    return { apiKey: "", pointerVaultKey: pointer };
+  }
   if (new Set(values).size > 1) {
     throw new CredentialFileUnsafeError(path, "credential aliases disagree");
   }
-  return values[0] ?? null;
+  return values[0] === undefined ? null : { apiKey: values[0] };
 }
 function appConfigDiskValue(name, env, keys) {
   const wanted = keys.filter((key) => !CREDENTIAL_SHAPED_KEY.test(key));
@@ -6576,6 +6858,18 @@ function sealCredential(fields) {
   });
   return Object.freeze(sealed);
 }
+function explicitCredential(appName, apiKey) {
+  const source = "explicit apiKey option";
+  assertUsableCredential(appName, source, apiKey);
+  return sealCredential({
+    apiKey,
+    tier: "argument",
+    source,
+    deliberate: true,
+    diskCandidates: [],
+    warning: null
+  });
+}
 function firstEnvValue(env, keys) {
   for (const key of keys) {
     if (!Object.prototype.hasOwnProperty.call(env, key))
@@ -6761,12 +7055,13 @@ function resolveCredential(name, env, options = {}) {
     }
     const paths = profileDiskSources(name, env, profile);
     for (const path of paths) {
-      const value = readCredentialFile(path, apiKeyKeys);
+      const value = readCredentialFile(path, apiKeyKeys, pointerKeyName);
       if (value) {
-        assertUsableCredential(name, path, value);
+        if (!value.pointerVaultKey)
+          assertUsableCredential(name, path, value.apiKey);
         return sealCredential({
-          apiKey: value,
-          tier: "profile",
+          ...value,
+          tier: value.pointerVaultKey ? "pointer" : "profile",
           source: path,
           deliberate: true,
           diskCandidates: paths,
@@ -6774,7 +7069,7 @@ function resolveCredential(name, env, options = {}) {
         });
       }
     }
-    throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
+    throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} or ${pointerKeyName} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
   }
   const definedEnvEntries = apiKeyKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, value: String(env[key]).trim() }));
   const blankEnv = definedEnvEntries.find((entry) => entry.value.length === 0);
@@ -6799,17 +7094,27 @@ function resolveCredential(name, env, options = {}) {
     });
   }
   const diskSourceList = credentialDiskSourceList(name, env, null);
-  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys, pointerKeyName) })).filter((hit) => hit.value !== null);
   if (diskHits.length > 0) {
     const winner = diskHits[0];
-    assertUsableCredential(name, winner.src.path, winner.value);
+    if (winner.value.pointerVaultKey) {
+      return sealCredential({
+        ...winner.value,
+        tier: "pointer",
+        source: winner.src.path,
+        deliberate: false,
+        diskCandidates: diskPaths,
+        warning: null
+      });
+    }
+    assertUsableCredential(name, winner.src.path, winner.value.apiKey);
     const divergentSources = [
-      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
-      ...envHit && envHit.value !== winner.value ? [envHit.key] : []
+      ...diskHits.slice(1).filter((hit) => hit.value.apiKey !== winner.value.apiKey || hit.value.pointerVaultKey !== winner.value.pointerVaultKey).map((hit) => hit.src.path),
+      ...envHit && envHit.value !== winner.value.apiKey ? [envHit.key] : []
     ];
     const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
     return sealCredential({
-      apiKey: winner.value,
+      apiKey: winner.value.apiKey,
       tier: winner.src.tier,
       source: winner.src.path,
       deliberate: false,
@@ -6830,6 +7135,53 @@ function resolveCredential(name, env, options = {}) {
   }
   return null;
 }
+async function completePointerCredential(name, pointerResolution, env = process.env) {
+  const secretsEnv = snapshotClientEnvironment("secrets", env);
+  const vaultKey = pointerResolution.pointerVaultKey;
+  const pointerEnvKey = pointerResolution.source;
+  if (!vaultKey) {
+    throw new CredentialResolutionError(name, `Pointer resolution from ${pointerEnvKey} carries no vault item key; this is a defect in the resolver.`, [pointerEnvKey]);
+  }
+  if (name === "secrets") {
+    throw new CredentialResolutionError(name, "The Secrets bootstrap credential cannot reference the same hosted vault; configure an independent bootstrap provider.", [pointerEnvKey]);
+  }
+  let secretsSdk;
+  try {
+    const sdkUrl = resolveInstalledSecrets(import.meta.url);
+    secretsSdk = requireSecretsSdk2(fileURLToPath22(sdkUrl));
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets SDK (@hasna/secrets) is not installed ` + `in this process. A vault pointer is TERMINAL: install @hasna/secrets to resolve it, or unset ${pointerEnvKey}.`, [pointerEnvKey]);
+  }
+  let client;
+  try {
+    const bootstrap = resolveCredential("secrets", secretsEnv);
+    if (!bootstrap || bootstrap.tier === "pointer") {
+      throw new CredentialResolutionError("secrets", "The Secrets vault requires an independent, non-reference bootstrap credential.", bootstrap ? [bootstrap.source] : []);
+    }
+    client = secretsSdk.createSecretsClientFromEnv(secretsEnv);
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets client could not be configured from this ` + `environment (the secrets service URL and key env are missing or invalid). A vault pointer is TERMINAL and ` + `never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  let secret;
+  try {
+    secret = await client.getSecret({ key: vaultKey });
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the vault could not be reached or the item is ` + `unavailable. A vault pointer is TERMINAL and never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  const value = secret.value;
+  if (!value) {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} resolved vault item '${vaultKey}', but it holds no value. A vault pointer is TERMINAL.`, [pointerEnvKey]);
+  }
+  assertUsableCredential(name, `${pointerEnvKey} -> vault:${vaultKey}`, value);
+  return sealCredential({
+    apiKey: value,
+    tier: "pointer",
+    source: `${pointerEnvKey} -> vault:${vaultKey}`,
+    deliberate: pointerResolution.deliberate,
+    diskCandidates: pointerResolution.diskCandidates,
+    warning: null
+  });
+}
 function defaultFleetGatewayBaseUrl(name) {
   return `${DEFAULT_FLEET_GATEWAY_ORIGIN}/${validateAppSlug(name)}`;
 }
@@ -7032,8 +7384,9 @@ function credentialDiskSourcesForMessage(name, env) {
   const paths = credentialDiskSources(name, env);
   return paths.length > 0 ? paths.join(" or ") : "<no HOME or HASNA_HOME set in this environment, so no credential file was consulted>";
 }
-var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES2, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM2, CREDENTIAL_SEAL2, AMBIENT_ENVIRONMENT2, SECRETS_PACKAGE_SPECIFIER, requireSecretsSdk2, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", DEFAULT_AUTHORITY_SOURCE = "default", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, ClientTransportConfigurationError, IDEMPOTENT_METHODS2, AUTHORITY_OVERRIDE_HEADERS2;
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", PACKAGE = "@hasna/secrets", MAX_PACKAGE_BYTES2, CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES2, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM2, CREDENTIAL_SEAL2, AMBIENT_ENVIRONMENT2, requireSecretsSdk2, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", DEFAULT_AUTHORITY_SOURCE = "default", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, ClientTransportConfigurationError, IDEMPOTENT_METHODS2, AUTHORITY_OVERRIDE_HEADERS2;
 var init_transport = __esm(() => {
+  MAX_PACKAGE_BYTES2 = 1024 * 1024;
   CredentialResolutionError = class CredentialResolutionError extends Error {
     appName;
     attempted;
@@ -7061,7 +7414,6 @@ var init_transport = __esm(() => {
   INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
   CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
   AMBIENT_ENVIRONMENT2 = Symbol.for("hasna:contracts:ambientClientEnvironment");
-  SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
   requireSecretsSdk2 = createRequire2(import.meta.url);
   ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
   DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
@@ -7150,7 +7502,9 @@ var exports_transport = {};
 __export(exports_transport, {
   rethrowHooksAuthorityFailure: () => rethrowHooksAuthorityFailure,
   resolveHooksTransport: () => resolveHooksTransport,
+  resolveHooksServePublishKeyAsync: () => resolveHooksServePublishKeyAsync,
   resolveHooksServePublishKey: () => resolveHooksServePublishKey,
+  resolveHooksRequestAuthority: () => resolveHooksRequestAuthority,
   hooksRegistryOrigin: () => hooksRegistryOrigin,
   announceHooksLocalMode: () => announceHooksLocalMode,
   __resetHooksLocalNotice: () => __resetHooksLocalNotice
@@ -7189,6 +7543,40 @@ function rethrowHooksAuthorityFailure(error) {
   }
   throw new Error(`REMOTE_API_URL_INVALID: ${message} local mode fallback is disabled`, { cause: error });
 }
+function sameCredential(left, right) {
+  return left === null || right === null ? left === right : left.apiKey === right.apiKey && left.pointerVaultKey === right.pointerVaultKey && left.source === right.source && left.tier === right.tier;
+}
+function changedBinding() {
+  throw new Error("REMOTE_API_CREDENTIAL_INVALID: The configured Hooks authority or credential changed while preparing a request; no request was sent.");
+}
+async function resolveHooksRequestAuthority(authority) {
+  if (authority.origin !== hooksRegistryOrigin(authority.v1BaseUrl))
+    changedBinding();
+  const binding = authorityBindings.get(authority);
+  if (!binding)
+    return { ...authority, apiKey: explicitCredential("hooks", authority.apiKey).apiKey };
+  const snapshot = () => {
+    const next = resolveHooksTransport(binding.env, binding.options);
+    if (next.mode !== "remote" || !next.authority || next.authority.v1BaseUrl !== authority.v1BaseUrl)
+      changedBinding();
+    return { authority: next.authority, binding: authorityBindings.get(next.authority) };
+  };
+  const first = snapshot();
+  const reviewed = snapshot();
+  if (!sameCredential(first.binding.credential, reviewed.binding.credential))
+    changedBinding();
+  let credential = reviewed.binding.credential;
+  try {
+    if (credential.tier === "pointer")
+      credential = await completePointerCredential("hooks", credential, binding.env);
+  } catch (error) {
+    rethrowHooksAuthorityFailure(error);
+  }
+  const final = snapshot();
+  if (!sameCredential(reviewed.binding.credential, final.binding.credential))
+    changedBinding();
+  return { ...reviewed.authority, apiKey: credential.apiKey };
+}
 function resolveHooksTransport(env = process.env, options = {}) {
   if (selectsHooksLocalStore(env)) {
     announceLocal(options.notice, "HASNA_HOOKS_LOCAL is set and nothing configures a registry authority");
@@ -7202,7 +7590,7 @@ function resolveHooksTransport(env = process.env, options = {}) {
   try {
     credential = resolveCredential("hooks", resolverEnv, credentialOptions);
     resolution = resolveClientTransport("hooks", resolverEnv, {
-      credentials: credential ? { ...credentialOptions, apiKey: credential.apiKey } : credentialOptions
+      credentials: credential && credential.tier !== "pointer" ? { ...credentialOptions, apiKey: credential.apiKey } : credentialOptions
     });
   } catch (error) {
     rethrowHooksAuthorityFailure(error);
@@ -7210,31 +7598,50 @@ function resolveHooksTransport(env = process.env, options = {}) {
   if (!credential) {
     throw new Error("REMOTE_API_CONFIG_MISSING: no hooks registry credential resolved; " + "local mode fallback is disabled");
   }
+  const authority = {
+    origin: hooksRegistryOrigin(resolution.baseUrl),
+    apiKey: credential.apiKey,
+    apiUrlSource: resolution.apiUrlSource,
+    apiKeySource: credential.source,
+    apiKeyTier: credential.tier,
+    v1BaseUrl: resolution.baseUrl,
+    warning: resolution.warning
+  };
+  authorityBindings.set(authority, { env, options, credential });
   return {
     mode: "remote",
     source: `${credential.source}+${resolution.apiUrlSource ?? "default"}`,
-    authority: {
-      origin: hooksRegistryOrigin(resolution.baseUrl),
-      apiKey: credential.apiKey,
-      apiUrlSource: resolution.apiUrlSource,
-      apiKeySource: credential.source,
-      apiKeyTier: credential.tier,
-      v1BaseUrl: resolution.baseUrl,
-      warning: resolution.warning
-    }
+    authority
   };
 }
 function resolveHooksServePublishKey(env = process.env, options = {}) {
   const { env: resolverEnv, credentials } = hooksResolverInputs(env, options.credentials);
   const tier1 = options.credentials?.apiKey;
   const credentialOptions = tier1 !== undefined ? { ...credentials, apiKey: tier1 } : credentials;
-  return resolveCredential("hooks", resolverEnv, credentialOptions)?.apiKey;
+  const credential = resolveCredential("hooks", resolverEnv, credentialOptions);
+  if (credential?.tier === "pointer")
+    throw new Error("Vault references require resolveHooksServePublishKeyAsync().");
+  return credential?.apiKey;
 }
-var localNoticePrinted = false;
+async function resolveHooksServePublishKeyAsync(env = process.env, options = {}) {
+  const { env: resolverEnv, credentials } = hooksResolverInputs(env, options.credentials);
+  const read = () => resolveCredential("hooks", resolverEnv, credentials);
+  const selected = read();
+  if (!selected || selected.tier !== "pointer")
+    return selected?.apiKey;
+  if (!sameCredential(selected, read()))
+    changedBinding();
+  const completed = await completePointerCredential("hooks", selected, env);
+  if (!sameCredential(selected, read()))
+    changedBinding();
+  return completed.apiKey;
+}
+var localNoticePrinted = false, authorityBindings;
 var init_transport2 = __esm(() => {
   init_transport();
   init_config();
   init_local_opt_in();
+  authorityBindings = new WeakMap;
 });
 
 // src/lib/db-writer.ts
@@ -7356,12 +7763,12 @@ var init_db_writer = __esm(() => {
 });
 
 // src/lib/hook-env.ts
-import { dirname as dirname5, isAbsolute as isAbsolute3 } from "path";
-import { existsSync as existsSync13, realpathSync as realpathSync2, statSync } from "fs";
+import { dirname as dirname7, isAbsolute as isAbsolute4 } from "path";
+import { existsSync as existsSync14, realpathSync as realpathSync4, statSync as statSync2 } from "fs";
 import { tmpdir } from "os";
 function isDeniedEnvName(name) {
   const upper = name.toUpperCase();
-  if (DENY_PREFIXES.some((prefix) => upper.startsWith(prefix)))
+  if (DENY_PREFIXES.some((prefix2) => upper.startsWith(prefix2)))
     return true;
   if (DENY_SUFFIXES.some((suffix) => upper.endsWith(suffix)))
     return true;
@@ -7370,13 +7777,13 @@ function isDeniedEnvName(name) {
 function isInterpreterInjectionEnvName(name) {
   if (INTERPRETER_INJECTION.has(name))
     return true;
-  return INTERPRETER_INJECTION_PREFIXES.some((prefix) => name.startsWith(prefix));
+  return INTERPRETER_INJECTION_PREFIXES.some((prefix2) => name.startsWith(prefix2));
 }
 function isBashFunctionEnvName(name) {
   return name.startsWith("BASH_FUNC_");
 }
 function isUnsafePathEntry(entry, home) {
-  if (entry === "" || !isAbsolute3(entry))
+  if (entry === "" || !isAbsolute4(entry))
     return true;
   if (home && (entry === home || entry.startsWith(home + "/")))
     return true;
@@ -7386,7 +7793,7 @@ function isUnsafePathEntry(entry, home) {
     return true;
   const canonical = (path) => {
     try {
-      return realpathSync2(path);
+      return realpathSync4(path);
     } catch {
       return path;
     }
@@ -7398,16 +7805,16 @@ function isUnsafePathEntry(entry, home) {
       return true;
   }
   try {
-    if ((statSync(entry).mode & 2) !== 0)
+    if ((statSync2(entry).mode & 2) !== 0)
       return true;
   } catch {}
   return false;
 }
 function sanitizeHookPath(pathValue, home) {
   const baseline = PATH_BASELINE.slice();
-  if (process.platform === "darwin" && existsSync13("/opt/homebrew/bin"))
+  if (process.platform === "darwin" && existsSync14("/opt/homebrew/bin"))
     baseline.push("/opt/homebrew/bin");
-  const bunDir = dirname5(process.execPath);
+  const bunDir = dirname7(process.execPath);
   const seen = new Set;
   const out = [];
   for (const dir of baseline) {
@@ -7532,9 +7939,9 @@ __export(exports_run, {
 });
 import { randomBytes as randomBytes2 } from "crypto";
 import { rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute4, join as join13 } from "path";
+import { basename as basename3, dirname as dirname8, isAbsolute as isAbsolute5, join as join14 } from "path";
 function extensionOf(scriptPath) {
-  const base = basename2(scriptPath);
+  const base = basename3(scriptPath);
   const dot = base.lastIndexOf(".");
   return dot > 0 ? base.slice(dot + 1) : "ts";
 }
@@ -7546,9 +7953,9 @@ function shebangInterpreter(firstLine) {
     return null;
   const parts = rest.split(/\s+/);
   if (parts[0] === "env" || parts[0] === "/usr/bin/env") {
-    return parts[1] && parts[1] !== "-S" ? basename2(parts[1]) : parts[2] ? basename2(parts[2]) : null;
+    return parts[1] && parts[1] !== "-S" ? basename3(parts[1]) : parts[2] ? basename3(parts[2]) : null;
   }
-  return basename2(parts[0]);
+  return basename3(parts[0]);
 }
 function interpreterFor(name, scriptPath, content) {
   const ext = extensionOf(scriptPath);
@@ -7582,8 +7989,8 @@ async function readPipeWithDeadline(stream, deadlineMs) {
         result = await Promise.race([
           reader.read(),
           new Promise((_, reject) => {
-            const t = setTimeout(() => reject(new Error("pipe-drain-deadline")), remaining);
-            t.unref?.();
+            const t2 = setTimeout(() => reject(new Error("pipe-drain-deadline")), remaining);
+            t2.unref?.();
           })
         ]);
       } catch {
@@ -7601,9 +8008,9 @@ async function readPipeWithDeadline(stream, deadlineMs) {
   return chunks.join("");
 }
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname6(options.scriptPath);
+  const scriptDir = dirname8(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
-  const tempPath = join13(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
+  const tempPath = join14(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
   let timedOut = false;
   const timeoutTimer = options.timeout ? setTimeout(() => {
@@ -7612,7 +8019,7 @@ async function executeVerifiedScript(options) {
   }, options.timeout) : null;
   try {
     writeFileSync6(tempPath, options.content, { flag: "wx", mode: 384 });
-    proc = Bun.spawn([...interpreter.command, isAbsolute4(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
+    proc = Bun.spawn([...interpreter.command, isAbsolute5(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
       stdin: new Response(options.stdin),
       stdout: "pipe",
       stderr: "pipe",
@@ -7694,15 +8101,15 @@ __export(exports_custom_install, {
   installCustomSource: () => installCustomSource,
   ensureCustomDir: () => ensureCustomDir
 });
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync8, rmSync as rmSync3 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync9, rmSync as rmSync3 } from "fs";
+import { join as join15 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 function manifestAt(dir) {
-  const path = join14(dir, "manifest.json");
-  if (!existsSync14(path))
+  const path = join15(dir, "manifest.json");
+  if (!existsSync15(path))
     return;
   try {
-    return parseManifest(readFileSync8(path, "utf-8"));
+    return parseManifest(readFileSync9(path, "utf-8"));
   } catch {
     return;
   }
@@ -7721,8 +8128,8 @@ function writeFromManifest(manifest, srcDir, source, kind) {
   return { name, version: manifest.version, kind, source, dir, scriptPath };
 }
 async function cloneToTemp(gitUrl) {
-  const tmp = mkdtempSync(join14(tmpdir2(), "hooks-install-"));
-  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join14(tmp, "repo")], {
+  const tmp = mkdtempSync(join15(tmpdir2(), "hooks-install-"));
+  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join15(tmp, "repo")], {
     stdout: "pipe",
     stderr: "pipe"
   });
@@ -7735,7 +8142,7 @@ async function cloneToTemp(gitUrl) {
     rmSync3(tmp, { recursive: true, force: true });
     throw new Error(`git clone failed (${exitCode}): ${stderr.trim()}`);
   }
-  return join14(tmp, "repo");
+  return join15(tmp, "repo");
 }
 function isGitUrl(value) {
   return value.startsWith("git@") || value.startsWith("ssh://") || value.startsWith("file://") || value.endsWith(".git");
@@ -7745,7 +8152,7 @@ function isCustomSource(value) {
     return true;
   if (value.startsWith("http://") || value.startsWith("https://"))
     return true;
-  return existsSync14(value);
+  return existsSync15(value);
 }
 async function installCustomSource(source) {
   if (isGitUrl(source)) {
@@ -7759,11 +8166,11 @@ async function installCustomSource(source) {
   if (source.startsWith("http://") || source.startsWith("https://")) {
     return installManifestUrl(source);
   }
-  if (!existsSync14(source)) {
+  if (!existsSync15(source)) {
     throw new Error(`No such local path: ${source}`);
   }
   if (source.endsWith("manifest.json")) {
-    const manifest = parseManifest(readFileSync8(source, "utf-8"));
+    const manifest = parseManifest(readFileSync9(source, "utf-8"));
     return writeFromManifest(manifest, source.substring(0, source.lastIndexOf("/")), source, "local");
   }
   return copyManifestDir(source, source, "local");
@@ -7812,13 +8219,13 @@ __export(exports_sync, {
   fetchPinnedHook: () => fetchPinnedHook,
   commitSyncArtifacts: () => commitSyncArtifacts
 });
-import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync9 } from "fs";
+import { createHash as createHash3 } from "crypto";
+import { readFileSync as readFileSync10 } from "fs";
 function sha256OfText(text) {
-  return createHash2("sha256").update(text).digest("hex");
+  return createHash3("sha256").update(text).digest("hex");
 }
 function sha256OfPath(path) {
-  return createHash2("sha256").update(readFileSync9(path)).digest("hex");
+  return createHash3("sha256").update(readFileSync10(path)).digest("hex");
 }
 function collectBundledCatalog() {
   const out = [];
@@ -7836,7 +8243,14 @@ function collectBundledCatalog() {
 }
 async function fetchJson(base, path, apiKey, opts) {
   const headers = { accept: "application/json" };
-  if (apiKey)
+  if (typeof apiKey === "object") {
+    if (apiKey.origin !== base)
+      throw new Error("Hooks registry authority does not match the request target");
+    const resolved = await resolveHooksRequestAuthority(apiKey);
+    if (resolved.origin !== base)
+      throw new Error("Hooks registry authority changed before dispatch");
+    headers["x-api-key"] = resolved.apiKey;
+  } else if (apiKey)
     headers["x-api-key"] = apiKey;
   const res = await fetch(`${base}${path}`, {
     headers,
@@ -7904,8 +8318,8 @@ async function planSync(options = {}) {
     credentials: options.credentials
   });
   if (transport.mode === "remote" && transport.authority) {
-    const { origin, apiKey } = transport.authority;
-    const { catalog, remoteLock } = await fetchRemoteState(origin, apiKey);
+    const { origin } = transport.authority;
+    const { catalog, remoteLock } = await fetchRemoteState(origin, transport.authority);
     return { apiUrl: origin, dryRun: options.dryRun ?? false, diff: computeDiff(catalog, remoteLock) };
   }
   const diff = computeDiff(collectBundledCatalog(), null);
@@ -7933,10 +8347,10 @@ async function syncHooks(options = {}) {
     }
     return plan;
   }
-  const { origin, apiKey } = transport.authority;
-  const { catalog, remoteLock } = await fetchRemoteState(origin, apiKey);
+  const { origin } = transport.authority;
+  const { catalog, remoteLock } = await fetchRemoteState(origin, transport.authority);
   const diff = computeDiff(catalog, remoteLock);
-  const staged = await stageSyncArtifacts(origin, apiKey, [...diff.added, ...diff.updated], remoteLock);
+  const staged = await stageSyncArtifacts(origin, transport.authority, [...diff.added, ...diff.updated], remoteLock);
   await commitSyncArtifacts(staged, origin, remoteLock);
   return { apiUrl: origin, dryRun: false, diff };
 }
@@ -8597,21 +9011,20 @@ function secureEqual(a, b) {
   const ab = enc.encode(a);
   const bb = enc.encode(b);
   let diff = ab.length ^ bb.length;
-  const n = Math.max(ab.length, bb.length);
-  for (let i = 0;i < n; i++) {
+  const n2 = Math.max(ab.length, bb.length);
+  for (let i = 0;i < n2; i++) {
     diff |= (ab[i] ?? 0) ^ (bb[i] ?? 0);
   }
   return diff === 0;
 }
 
 // src/openapi.ts
-var openApiDocument;
-var init_openapi = __esm(() => {
-  openApiDocument = {
+function buildOpenApiDocument(version) {
+  return {
     openapi: "3.1.0",
     info: {
       title: "Hooks Registry API",
-      version: "0.1.0",
+      version,
       description: "Local registry HTTP API for @hasna/hooks: catalog, lock, and artifact reads are open; publishing (PUT /api/v1/hooks) requires the API key (authorization: Bearer or x-api-key)."
     },
     servers: [{ url: "/" }],
@@ -8625,7 +9038,7 @@ var init_openapi = __esm(() => {
               description: "Service is alive",
               content: {
                 "application/json": {
-                  schema: { type: "object", additionalProperties: true }
+                  schema: { $ref: "#/components/schemas/HooksHealth" }
                 }
               }
             }
@@ -8637,8 +9050,22 @@ var init_openapi = __esm(() => {
           summary: "Readiness probe \u2014 the hooks.lock store is readable",
           operationId: "getReady",
           responses: {
-            "200": { description: "Lock store is readable" },
-            "503": { description: "Lock store is not readable" }
+            "200": {
+              description: "Lock store is readable",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksHealth" }
+                }
+              }
+            },
+            "503": {
+              description: "Lock store is not readable",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksHealth" }
+                }
+              }
+            }
           }
         }
       },
@@ -8651,7 +9078,7 @@ var init_openapi = __esm(() => {
               description: "The installed @hasna/hooks version",
               content: {
                 "application/json": {
-                  schema: { type: "object", properties: { version: { type: "string" } } }
+                  schema: { $ref: "#/components/schemas/HooksVersion" }
                 }
               }
             }
@@ -8662,7 +9089,16 @@ var init_openapi = __esm(() => {
         get: {
           summary: "This OpenAPI document",
           operationId: "getOpenApi",
-          responses: { "200": { description: "OpenAPI 3.1 document" } }
+          responses: {
+            "200": {
+              description: "OpenAPI 3.1 document",
+              content: {
+                "application/json": {
+                  schema: { type: "object", additionalProperties: true }
+                }
+              }
+            }
+          }
         }
       },
       "/api/v1/catalog": {
@@ -8674,23 +9110,7 @@ var init_openapi = __esm(() => {
               description: "Catalog entries",
               content: {
                 "application/json": {
-                  schema: {
-                    type: "object",
-                    properties: {
-                      hooks: {
-                        type: "array",
-                        items: {
-                          type: "object",
-                          properties: {
-                            name: { type: "string" },
-                            version: { type: "string" },
-                            sha256: { type: "string" },
-                            events: { type: "array", items: { type: "string" } }
-                          }
-                        }
-                      }
-                    }
-                  }
+                  schema: { $ref: "#/components/schemas/HooksCatalog" }
                 }
               }
             }
@@ -8701,7 +9121,16 @@ var init_openapi = __esm(() => {
         get: {
           summary: "Read the published hooks.lock with per-hook versions",
           operationId: "getLock",
-          responses: { "200": { description: "The lock file" } }
+          responses: {
+            "200": {
+              description: "The lock file",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksLock" }
+                }
+              }
+            }
+          }
         }
       },
       "/api/v1/hooks/{name}/{version}": {
@@ -8714,10 +9143,35 @@ var init_openapi = __esm(() => {
           ],
           responses: {
             "200": {
-              description: "Hook artifact; x-hook-sha256 header carries the script hash"
+              description: "Hook artifact; x-hook-sha256 header carries the script hash",
+              headers: {
+                "x-hook-sha256": {
+                  description: "sha256 of the served script, the same value the lock pins",
+                  schema: { type: "string" }
+                }
+              },
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksArtifact" }
+                }
+              }
+            },
+            "400": {
+              description: "Invalid URL encoding or semver version",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
             },
-            "400": { description: "Invalid URL encoding or semver version" },
-            "404": { description: "Hook not found locally" }
+            "404": {
+              description: "Hook not found locally",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
+            }
           }
         }
       },
@@ -8729,18 +9183,51 @@ var init_openapi = __esm(() => {
             required: true,
             content: {
               "application/json": {
-                schema: {
-                  type: "object",
-                  properties: { name: { type: "string" }, version: { type: "string" } }
-                }
+                schema: { $ref: "#/components/schemas/HooksPublishRequest" }
               }
             }
           },
           responses: {
-            "200": { description: "Hook retrusted and pin updated" },
-            "401": { description: "Missing or invalid API key" },
-            "404": { description: "Hook not found in local store" },
-            "409": { description: "Version mismatch with the local store" }
+            "200": {
+              description: "Hook retrusted and pin updated",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksPublishResponse" }
+                }
+              }
+            },
+            "400": {
+              description: "Invalid JSON body",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
+            },
+            "401": {
+              description: "Missing or invalid API key",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
+            },
+            "404": {
+              description: "Hook not found in local store",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
+            },
+            "409": {
+              description: "Version mismatch with the local store",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
+            }
           },
           security: [{ apiKey: [] }]
         }
@@ -8753,10 +9240,135 @@ var init_openapi = __esm(() => {
           scheme: "bearer",
           description: "The registry API key \u2014 resolved by the client through the @hasna/contracts chain (HASNA_HOOKS_API_KEY, the Keychain item hasna.credentials.hooks.api-key, or ~/.hasna/hooks/config/credentials); the server compares the inbound bearer/x-api-key value."
         }
+      },
+      schemas: {
+        HooksHealth: {
+          type: "object",
+          additionalProperties: false,
+          required: ["status", "name"],
+          properties: {
+            status: { type: "string" },
+            name: { type: "string" }
+          }
+        },
+        HooksVersion: {
+          type: "object",
+          additionalProperties: false,
+          required: ["version"],
+          properties: { version: { type: "string" } }
+        },
+        HooksCatalogEntry: {
+          type: "object",
+          additionalProperties: false,
+          required: ["name", "version", "sha256", "events", "description", "source", "versions"],
+          properties: {
+            name: { type: "string" },
+            version: { type: "string" },
+            sha256: { type: "string" },
+            events: { type: "array", items: { type: "string" } },
+            description: { type: "string" },
+            source: {
+              type: "string",
+              description: "bundled | custom | custom-overrides-bundled"
+            },
+            versions: { type: "array", items: { type: "string" } }
+          }
+        },
+        HooksCatalog: {
+          type: "object",
+          additionalProperties: false,
+          required: ["hooks"],
+          properties: {
+            hooks: { type: "array", items: { $ref: "#/components/schemas/HooksCatalogEntry" } }
+          }
+        },
+        HooksLockEntry: {
+          type: "object",
+          additionalProperties: false,
+          required: ["version", "sha256", "source"],
+          properties: {
+            version: { type: "string" },
+            sha256: { type: "string" },
+            source: { type: "string" },
+            pinned: {
+              type: "boolean",
+              description: "True for an explicit install/update pin, absent for sync-maintained pins."
+            },
+            versions: { type: "array", items: { type: "string" } }
+          }
+        },
+        HooksLock: {
+          type: "object",
+          additionalProperties: false,
+          required: ["hooks"],
+          properties: {
+            hooks: {
+              type: "object",
+              additionalProperties: { $ref: "#/components/schemas/HooksLockEntry" }
+            }
+          }
+        },
+        HooksManifest: {
+          type: "object",
+          additionalProperties: false,
+          required: ["name", "version", "events", "script"],
+          properties: {
+            name: { type: "string" },
+            version: { type: "string" },
+            description: { type: "string" },
+            events: { type: "array", items: { type: "string" } },
+            script: { type: "string" },
+            script_kind: { type: "string", enum: ["inline", "file"] },
+            args: { type: "array", items: { type: "string" } },
+            timeout_ms: { type: "number" }
+          }
+        },
+        HooksArtifact: {
+          type: "object",
+          additionalProperties: false,
+          required: ["manifest", "script"],
+          properties: {
+            manifest: { $ref: "#/components/schemas/HooksManifest" },
+            script: { type: "string" }
+          }
+        },
+        HooksError: {
+          type: "object",
+          additionalProperties: false,
+          required: ["error"],
+          properties: { error: { type: "string" } }
+        },
+        HooksPublishRequest: {
+          type: "object",
+          additionalProperties: false,
+          required: ["name"],
+          properties: {
+            name: { type: "string" },
+            version: { type: "string" }
+          }
+        },
+        HooksPublishResponse: {
+          type: "object",
+          additionalProperties: false,
+          required: ["ok", "hook"],
+          properties: {
+            ok: { type: "boolean" },
+            hook: {
+              type: "object",
+              additionalProperties: false,
+              required: ["name", "version", "sha256"],
+              properties: {
+                name: { type: "string" },
+                version: { type: "string" },
+                sha256: { type: "string" }
+              }
+            }
+          }
+        }
       }
     }
   };
-});
+}
 
 // src/serve.ts
 var exports_serve = {};
@@ -8768,13 +9380,13 @@ __export(exports_serve, {
   SERVE_HOST: () => SERVE_HOST,
   DEFAULT_SERVE_PORT: () => DEFAULT_SERVE_PORT
 });
-import { readFileSync as readFileSync10 } from "fs";
-import { dirname as dirname7, join as join15 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { readFileSync as readFileSync11 } from "fs";
+import { dirname as dirname9, join as join16 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 function packageVersion() {
   try {
-    const pkgPath = join15(dirname7(fileURLToPath3(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync10(pkgPath, "utf-8")).version || "0.0.0";
+    const pkgPath = join16(dirname9(fileURLToPath4(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync11(pkgPath, "utf-8")).version || "0.0.0";
   } catch {
     return "0.0.0";
   }
@@ -8863,7 +9475,7 @@ function handleServeRequest(req, apiKey) {
     return Promise.resolve(json({ version: packageVersion() }));
   }
   if (url.pathname === "/openapi.json" && req.method === "GET") {
-    return Promise.resolve(json(openApiDocument));
+    return Promise.resolve(json(buildOpenApiDocument(packageVersion())));
   }
   if (url.pathname === "/api/v1/catalog" && req.method === "GET") {
     return buildCatalog().then((catalog) => json({ hooks: catalog }));
@@ -8935,7 +9547,7 @@ function startServeServer(options) {
     hostname: host,
     port,
     async fetch(req) {
-      return handleServeRequest(req, resolveHooksServePublishKey());
+      return handleServeRequest(req, await resolveHooksServePublishKeyAsync());
     }
   });
   console.error(`hooks registry listening on http://${host}:${server.port} (publish requires an API key)`);
@@ -8948,7 +9560,6 @@ var init_serve = __esm(() => {
   init_store();
   init_resolve();
   init_transport2();
-  init_openapi();
   init_semver();
   if (false) {}
 });
@@ -9075,17 +9686,17 @@ import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z as z2 } from "zod";
 import { createServer } from "http";
-import { existsSync as existsSync15, readFileSync as readFileSync11 } from "fs";
-import { join as join16, dirname as dirname8 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { existsSync as existsSync16, readFileSync as readFileSync12 } from "fs";
+import { join as join17, dirname as dirname10 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
 async function runVerifiedHook(name, stdin, timeoutMs) {
   const { resolveHook: resolveHook2, resolveScriptPath: resolveScriptPath2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
   const resolved = resolveHook2(name);
   const hookScript = resolveScriptPath2(name);
-  if (!resolved || !hookScript || !existsSync15(hookScript)) {
+  if (!resolved || !hookScript || !existsSync16(hookScript)) {
     throw new Error(`Hook '${name}' not found`);
   }
-  const content = readFileSync11(hookScript);
+  const content = readFileSync12(hookScript);
   const sha = sha256Of(content);
   const check = checkScriptHash(name, sha);
   if (!check.ok) {
@@ -9151,8 +9762,8 @@ async function runVerifiedHook(name, stdin, timeoutMs) {
   return ran;
 }
 function formatInstallResults(results, extra) {
-  const installed = results.filter((r) => r.success).map((r) => r.hook);
-  const failed = results.filter((r) => !r.success).map((r) => ({ hook: r.hook, error: r.error }));
+  const installed = results.filter((r2) => r2.success).map((r2) => r2.hook);
+  const failed = results.filter((r2) => !r2.success).map((r2) => ({ hook: r2.hook, error: r2.error }));
   return {
     content: [{
       type: "text",
@@ -9290,7 +9901,7 @@ function createHooksServer() {
     const settingsPath = getSettingsPath(scope);
     const issues = [];
     const healthy = [];
-    const settingsExist = existsSync15(settingsPath);
+    const settingsExist = existsSync16(settingsPath);
     if (!settingsExist) {
       issues.push({ hook: "(settings)", issue: `${settingsPath} not found`, severity: "warning" });
     }
@@ -9300,7 +9911,7 @@ function createHooksServer() {
       const meta = custom ? resolveHookMeta(name) : getHook(name);
       let hookHealthy = true;
       if (custom) {
-        if (!existsSync15(custom.scriptPath)) {
+        if (!existsSync16(custom.scriptPath)) {
           issues.push({ hook: name, issue: `Custom hook script missing: ${custom.scriptPath}`, severity: "error" });
           hookHealthy = false;
         }
@@ -9310,14 +9921,14 @@ function createHooksServer() {
           continue;
         }
         const hookDir = getHookPath(name);
-        if (!existsSync15(join16(hookDir, "src", "hook.ts"))) {
+        if (!existsSync16(join17(hookDir, "src", "hook.ts"))) {
           issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
           hookHealthy = false;
         }
       }
       if (meta && settingsExist) {
         try {
-          const settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
+          const settings = JSON.parse(readFileSync12(settingsPath, "utf-8"));
           if (!hookRegisteredInSettings(settings, name, meta.event, meta.matcher)) {
             const eventName = meta.event.split(":")[0];
             issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
@@ -9354,10 +9965,10 @@ function createHooksServer() {
         return { content: [{ type: "text", text: JSON.stringify({ error: `Hook '${name}' not found` }) }] };
       }
       const hookPath = getHookPath(name);
-      const readmePath = join16(hookPath, "README.md");
+      const readmePath = join17(hookPath, "README.md");
       let readme = "";
-      if (existsSync15(readmePath)) {
-        readme = readFileSync11(readmePath, "utf-8");
+      if (existsSync16(readmePath)) {
+        readme = readFileSync12(readmePath, "utf-8");
       }
       if (verbose) {
         return { content: [{ type: "text", text: JSON.stringify({ ...meta, readme }) }] };
@@ -9515,8 +10126,8 @@ function createHooksServer() {
       }
       return installHook(name, { scope, overwrite: true });
     });
-    const updated = results.filter((r) => r.success).map((r) => r.hook);
-    const failed = results.filter((r) => !r.success).map((r) => ({ hook: r.hook, error: r.error }));
+    const updated = results.filter((r2) => r2.success).map((r2) => r2.hook);
+    const failed = results.filter((r2) => !r2.success).map((r2) => ({ hook: r2.hook, error: r2.error }));
     return { content: [{ type: "text", text: JSON.stringify({ updated, failed, total: results.length }) }] };
   });
   defineTool("hooks_context", "Get compact agent context in one call: installed hooks, active profile summary, settings path, and doctor status.", {
@@ -9540,7 +10151,7 @@ function createHooksServer() {
     const ctx = {
       scope,
       settings_path: settingsPath,
-      settings_exists: existsSync15(settingsPath),
+      settings_exists: existsSync16(settingsPath),
       registered_hooks: hooks,
       hook_count: hooks.length,
       healthy,
@@ -9603,7 +10214,7 @@ function createHooksServer() {
         return { name, decision: "block", error: err instanceof Error ? err.message : String(err) };
       }
     }));
-    const blocked = results.find((r) => r.decision === "block");
+    const blocked = results.find((r2) => r2.decision === "block");
     return {
       content: [{
         type: "text",
@@ -9637,8 +10248,8 @@ function createHooksServer() {
     const target = agent_type === "gemini" ? "gemini" : "claude";
     const toInstall = hooks && hooks.length > 0 ? hooks : ["gitguard", "checkpoint", "checktests", "protectfiles"];
     const results = toInstall.map((h) => installHook(h, { scope, overwrite: false, profile: profile.agent_id, target }));
-    const installed = results.filter((r) => r.success).map((r) => r.hook);
-    const failed = results.filter((r) => !r.success).map((r) => ({ hook: r.hook, error: r.error }));
+    const installed = results.filter((r2) => r2.success).map((r2) => r2.hook);
+    const failed = results.filter((r2) => !r2.success).map((r2) => ({ hook: r2.hook, error: r2.error }));
     return {
       content: [{
         type: "text",
@@ -9686,8 +10297,8 @@ function createHooksServer() {
     const settingsPath = getSettingsPath(scope);
     let settings = {};
     try {
-      if (existsSync15(settingsPath))
-        settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
+      if (existsSync16(settingsPath))
+        settings = JSON.parse(readFileSync12(settingsPath, "utf-8"));
     } catch {}
     if (!settings.hooks)
       settings.hooks = {};
@@ -9696,8 +10307,8 @@ function createHooksServer() {
       disabled.push(name);
     settings.hooks.__disabled = disabled;
     const { writeFileSync: writeFileSync7, mkdirSync: mkdirSync8 } = await import("fs");
-    const { dirname: dirname9 } = await import("path");
-    mkdirSync8(dirname9(settingsPath), { recursive: true });
+    const { dirname: dirname11 } = await import("path");
+    mkdirSync8(dirname11(settingsPath), { recursive: true });
     writeFileSync7(settingsPath, JSON.stringify(settings, null, 2) + `
 `);
     return { content: [{ type: "text", text: JSON.stringify({ hook: name, disabled: true, scope }) }] };
@@ -9709,11 +10320,11 @@ function createHooksServer() {
     const settingsPath = getSettingsPath(scope);
     let settings = {};
     try {
-      if (existsSync15(settingsPath))
-        settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
+      if (existsSync16(settingsPath))
+        settings = JSON.parse(readFileSync12(settingsPath, "utf-8"));
     } catch {}
     if (settings.hooks?.__disabled) {
-      settings.hooks.__disabled = settings.hooks.__disabled.filter((n) => n !== name);
+      settings.hooks.__disabled = settings.hooks.__disabled.filter((n2) => n2 !== name);
       if (settings.hooks.__disabled.length === 0)
         delete settings.hooks.__disabled;
       const { writeFileSync: writeFileSync7 } = await import("fs");
@@ -9770,9 +10381,9 @@ function createHooksServer() {
       const m = s.match(/^(\d+)(s|m|h|d)$/);
       if (!m)
         return null;
-      const n = parseInt(m[1]);
+      const n2 = parseInt(m[1]);
       const ms = { s: 1000, m: 60000, h: 3600000, d: 86400000 }[m[2]];
-      return new Date(Date.now() - n * ms).toISOString();
+      return new Date(Date.now() - n2 * ms).toISOString();
     }
     let sql = "SELECT * FROM hook_events WHERE 1=1";
     const params = [];
@@ -9810,10 +10421,10 @@ function createHooksServer() {
   defineTool("hooks_log_tail", "Show recent hook events from SQLite. Compact summaries by default.", {
     n: z2.number().default(20).describe("Number of most recent events to return"),
     compact: z2.boolean().default(true).describe("Return compact event summaries by default. Set false for full rows.")
-  }, async ({ n, compact }) => {
+  }, async ({ n: n2, compact }) => {
     const { getDb: getDb2 } = await Promise.resolve().then(() => (init_db(), exports_db));
     const db = getDb2();
-    const maxRows = boundedLimit(n, 20, compact ? 100 : 500);
+    const maxRows = boundedLimit(n2, 20, compact ? 100 : 500);
     const rows = db.query("SELECT * FROM hook_events ORDER BY timestamp DESC LIMIT ?").all(maxRows);
     const projected = projectLogRows(rows);
     return {
@@ -9840,9 +10451,9 @@ function createHooksServer() {
       const m = s.match(/^(\d+)(s|m|h|d)$/);
       if (!m)
         return s;
-      const n = parseInt(m[1]);
+      const n2 = parseInt(m[1]);
       const ms = { s: 1000, m: 60000, h: 3600000, d: 86400000 }[m[2]];
-      return new Date(Date.now() - n * ms).toISOString();
+      return new Date(Date.now() - n2 * ms).toISOString();
     }
     const ts = since.match(/^\d{4}/) ? since : parseDuration(since);
     const rows = db.query("SELECT * FROM hook_events WHERE error IS NOT NULL AND timestamp >= ? ORDER BY timestamp DESC LIMIT ?").all(ts, maxRows);
@@ -9868,20 +10479,20 @@ function createHooksServer() {
       const m = s.match(/^(\d+)(s|m|h|d)$/);
       if (!m)
         return s;
-      const n = parseInt(m[1]);
+      const n2 = parseInt(m[1]);
       const ms = { s: 1000, m: 60000, h: 3600000, d: 86400000 }[m[2]];
-      return new Date(Date.now() - n * ms).toISOString();
+      return new Date(Date.now() - n2 * ms).toISOString();
     }
     const ts = since.match(/^\d{4}/) ? since : parseDuration(since);
     const totals = db.query("SELECT hook_name, COUNT(*) as total, SUM(CASE WHEN error IS NOT NULL THEN 1 ELSE 0 END) as errors FROM hook_events WHERE timestamp >= ? GROUP BY hook_name ORDER BY total DESC").all(ts);
-    const summary = totals.map((r) => ({
-      hook_name: r.hook_name,
-      total: r.total,
-      errors: r.errors,
-      error_rate: r.total > 0 ? (r.errors / r.total * 100).toFixed(1) + "%" : "0%"
+    const summary = totals.map((r2) => ({
+      hook_name: r2.hook_name,
+      total: r2.total,
+      errors: r2.errors,
+      error_rate: r2.total > 0 ? (r2.errors / r2.total * 100).toFixed(1) + "%" : "0%"
     }));
-    const grandTotal = totals.reduce((s, r) => s + r.total, 0);
-    const grandErrors = totals.reduce((s, r) => s + r.errors, 0);
+    const grandTotal = totals.reduce((s, r2) => s + r2.total, 0);
+    const grandErrors = totals.reduce((s, r2) => s + r2.errors, 0);
     return {
       content: [{
         type: "text",
@@ -9912,8 +10523,8 @@ function createHooksServer() {
         pkg.version
       ]);
       return { content: [{ type: "text", text: "Feedback saved. Thank you!" }] };
-    } catch (e) {
-      return { content: [{ type: "text", text: String(e) }], isError: true };
+    } catch (e2) {
+      return { content: [{ type: "text", text: String(e2) }], isError: true };
     }
   });
   defineTool("register_agent", "Register an agent session. Returns agent_id. Auto-triggers a heartbeat.", {
@@ -10080,13 +10691,13 @@ var init_server = __esm(() => {
   init_redact();
   init_authority();
   init_storage();
-  __dirname3 = dirname8(fileURLToPath4(import.meta.url));
+  __dirname3 = dirname10(fileURLToPath5(import.meta.url));
   pkg = { name: "@hasna/hooks", version: "0.0.0" };
   try {
     for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
-      const p = join16(__dirname3, rel);
-      if (existsSync15(p)) {
-        pkg = JSON.parse(readFileSync11(p, "utf-8"));
+      const p = join17(__dirname3, rel);
+      if (existsSync16(p)) {
+        pkg = JSON.parse(readFileSync12(p, "utf-8"));
         break;
       }
     }
@@ -11828,9 +12439,9 @@ var {
 
 // src/cli/index.tsx
 import chalk2 from "chalk";
-import { existsSync as existsSync16, readFileSync as readFileSync12, rmSync as rmSync4 } from "fs";
-import { join as join17, dirname as dirname9 } from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
+import { existsSync as existsSync17, readFileSync as readFileSync13, rmSync as rmSync4 } from "fs";
+import { join as join18, dirname as dirname11 } from "path";
+import { fileURLToPath as fileURLToPath6 } from "url";
 
 // src/cli/components/App.tsx
 import { useState as useState7 } from "react";
@@ -13002,6 +13613,7 @@ function App({ initialHooks, overwrite = false }) {
 }
 
 // src/cli/index.tsx
+init_native_safety();
 init_registry();
 init_installer();
 init_registration();
@@ -13017,10 +13629,10 @@ init_local_opt_in();
 init_transport2();
 init_db();
 import { jsxDEV as jsxDEV8 } from "react/jsx-dev-runtime";
-var __dirname4 = dirname9(fileURLToPath5(import.meta.url));
-var pkgPath = existsSync16(join17(__dirname4, "..", "package.json")) ? join17(__dirname4, "..", "package.json") : join17(__dirname4, "..", "..", "package.json");
-var pkg2 = JSON.parse(readFileSync12(pkgPath, "utf-8"));
-var program2 = new Command;
+var __dirname4 = dirname11(fileURLToPath6(import.meta.url));
+var pkgPath = existsSync17(join18(__dirname4, "..", "package.json")) ? join18(__dirname4, "..", "package.json") : join18(__dirname4, "..", "..", "package.json");
+var pkg2 = JSON.parse(readFileSync13(pkgPath, "utf-8"));
+var program3 = new Command;
 function resolveScope(options) {
   if (options.project)
     return "project";
@@ -13099,7 +13711,7 @@ async function openLocalStoreOrExit(json2) {
 function readToken(tokenFile) {
   if (tokenFile) {
     try {
-      return readFileSync12(tokenFile, "utf-8").trim();
+      return readFileSync13(tokenFile, "utf-8").trim();
     } catch {
       return;
     }
@@ -13144,22 +13756,22 @@ function printDisclosureHint(hidden, detailCommand, options = {}) {
   }
 }
 function editDistance(a, b) {
-  const m = a.length, n = b.length;
-  const dp = Array.from({ length: m + 1 }, (_, i) => [i, ...Array(n).fill(0)]);
-  for (let j = 0;j <= n; j++)
+  const m = a.length, n2 = b.length;
+  const dp = Array.from({ length: m + 1 }, (_, i) => [i, ...Array(n2).fill(0)]);
+  for (let j = 0;j <= n2; j++)
     dp[0][j] = j;
   for (let i = 1;i <= m; i++) {
-    for (let j = 1;j <= n; j++) {
+    for (let j = 1;j <= n2; j++) {
       dp[i][j] = a[i - 1] === b[j - 1] ? dp[i - 1][j - 1] : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
     }
   }
-  return dp[m][n];
+  return dp[m][n2];
 }
 function suggestHooks(name, max = 3) {
-  return HOOKS.map((h) => ({ name: h.name, dist: editDistance(name.toLowerCase(), h.name.toLowerCase()) })).filter(({ dist }) => dist <= 4).sort((a, b) => a.dist - b.dist).slice(0, max).map(({ name: n }) => n);
+  return HOOKS.map((h) => ({ name: h.name, dist: editDistance(name.toLowerCase(), h.name.toLowerCase()) })).filter(({ dist }) => dist <= 4).sort((a, b) => a.dist - b.dist).slice(0, max).map(({ name: n2 }) => n2);
 }
-program2.name("hooks").description("Install hooks for AI coding agents").version(pkg2.version);
-program2.command("interactive", { isDefault: true }).alias("i").description("Interactive hook browser").action(() => {
+program3.name("hooks").description("Install hooks for AI coding agents").version(pkg2.version);
+program3.command("interactive", { isDefault: true }).alias("i").description("Interactive hook browser").action(() => {
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
     console.error(chalk2.red("The interactive hook browser requires a TTY terminal.") + `
 ` + chalk2.dim("Use `hooks search <query>`, `hooks list`, or `hooks categories` for non-interactive use."));
@@ -13167,7 +13779,7 @@ program2.command("interactive", { isDefault: true }).alias("i").description("Int
   }
   render(/* @__PURE__ */ jsxDEV8(App, {}, undefined, false, undefined, this));
 });
-program2.command("init").description("Register a new agent profile with a unique ID").option("-a, --agent <type>", "Agent type: claude, gemini, custom", "claude").option("-n, --name <name>", "Optional display name for the agent").option("-j, --json", "Output as JSON", false).option("--cloudflare", "Configure a remote registry (Cloudflare worker)", false).option("--api-url <url>", "Remote registry API URL (with --cloudflare)").option("--api-key <ref>", "Vault key NAME for the registry API key (never the value; with --cloudflare)").action(async (options) => {
+program3.command("init").description("Register a new agent profile with a unique ID").option("-a, --agent <type>", "Agent type: claude, gemini, custom", "claude").option("-n, --name <name>", "Optional display name for the agent").option("-j, --json", "Output as JSON", false).option("--cloudflare", "Configure a remote registry (Cloudflare worker)", false).option("--api-url <url>", "Remote registry API URL (with --cloudflare)").option("--api-key <ref>", "Vault key NAME for the registry API key (never the value; with --cloudflare)").action(async (options) => {
   if (options.cloudflare) {
     if (!options.apiUrl) {
       const message = "--cloudflare requires --api-url <url>";
@@ -13237,13 +13849,13 @@ program2.command("init").description("Register a new agent profile with a unique
   if (profile.name) {
     console.log(`  ${chalk2.dim("Name:")}       ${profile.name}`);
   }
-  console.log(`  ${chalk2.dim("Profile:")}    ${join17(getProfilesDir(), `${profile.agent_id}.json`)}`);
+  console.log(`  ${chalk2.dim("Profile:")}    ${join18(getProfilesDir(), `${profile.agent_id}.json`)}`);
   console.log();
   console.log(chalk2.dim("  Install hooks with this profile:"));
   console.log(`    hooks install gitguard --profile ${profile.agent_id}`);
   console.log();
 });
-program2.command("run").argument("<hook>", "Hook to run").option("--profile <id>", "Agent profile ID").option("--enable-mementos", "Enable mementos-context for this invocation (provider assistance remains separately opt-in)").option("--disable-mementos", "Disable mementos-context for this invocation").option("--openrouter-secret-ref <reference>", "Secrets reference for the enabled Mementos hook; never a key value").description("Execute a hook (called by AI coding agents)").action(async (hook, options) => {
+program3.command("run").argument("<hook>", "Hook to run").option("--profile <id>", "Agent profile ID").option("--enable-mementos", "Enable mementos-context for this invocation (provider assistance remains separately opt-in)").option("--disable-mementos", "Disable mementos-context for this invocation").option("--openrouter-secret-ref <reference>", "Secrets reference for the enabled Mementos hook; never a key value").description("Execute a hook (called by AI coding agents)").action(async (hook, options) => {
   let mementos;
   try {
     mementos = mementosRegistrationFromFlags(hook, options);
@@ -13261,11 +13873,11 @@ program2.command("run").argument("<hook>", "Hook to run").option("--profile <id>
     process.exit(1);
   }
   const hookScript = resolveScriptPath2(hook);
-  if (!hookScript || !existsSync16(hookScript)) {
+  if (!hookScript || !existsSync17(hookScript)) {
     console.error(JSON.stringify({ error: `Hook script not found: ${hookScript ?? hook}` }));
     process.exit(1);
   }
-  const content = readFileSync12(hookScript);
+  const content = readFileSync13(hookScript);
   const sha = sha256Of2(content);
   const check = checkScriptHash2(hook, sha);
   if (!check.ok) {
@@ -13371,7 +13983,7 @@ program2.command("run").argument("<hook>", "Hook to run").option("--profile <id>
     process.stderr.write(stderr);
   process.exit(exitCode);
 });
-program2.command("install").alias("add").argument("[hooks...]", "Hooks to install").option("-o, --overwrite", "Overwrite existing hooks", false).option("-a, --all", "Install all available hooks", false).option("-c, --category <category>", "Install all hooks in a category").option("-g, --global", "Install globally (~/.claude/settings.json)", false).option("-p, --project", "Install for current project (.claude/settings.json)", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith, codex, all (default: claude)", "claude").option("--profile <id>", "Agent profile ID to scope hooks to").option("--enable-mementos", "Persistently enable mementos-context (provider assistance remains separately opt-in)").option("--disable-mementos", "Persistently disable mementos-context").option("--openrouter-secret-ref <reference>", "Secrets reference for the enabled Mementos hook; never a key value").option("--dry-run", "Preview what would be installed without writing to settings", false).option("--apply-codewith", "Explicitly append Codewith TOML to a config file (prefer configs for managed configs)", false).option("--codewith-config <path>", "Explicit Codewith config path required with --apply-codewith").option("-j, --json", "Output as JSON", false).description("Install one or more hooks (registry names, local paths, git URLs, manifest URLs, or <name>@<version> pinned installs)").action(async (hooks, options) => {
+program3.command("install").alias("add").argument("[hooks...]", "Hooks to install").option("-o, --overwrite", "Overwrite existing hooks", false).option("-a, --all", "Install all available hooks", false).option("-c, --category <category>", "Install all hooks in a category").option("-g, --global", "Install globally (~/.claude/settings.json)", false).option("-p, --project", "Install for current project (.claude/settings.json)", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith, codex, all (default: claude)", "claude").option("--profile <id>", "Agent profile ID to scope hooks to").option("--enable-mementos", "Persistently enable mementos-context (provider assistance remains separately opt-in)").option("--disable-mementos", "Persistently disable mementos-context").option("--openrouter-secret-ref <reference>", "Secrets reference for the enabled Mementos hook; never a key value").option("--dry-run", "Preview what would be installed without writing to settings", false).option("--apply-codewith", "Explicitly append Codewith TOML to a config file (prefer configs for managed configs)", false).option("--codewith-config <path>", "Explicit Codewith config path required with --apply-codewith").option("-j, --json", "Output as JSON", false).description("Install one or more hooks (registry names, local paths, git URLs, manifest URLs, or <name>@<version> pinned installs)").action(async (hooks, options) => {
   const scope = resolveScope(options);
   const target = resolveTarget(options);
   let toInstall = hooks;
@@ -13437,10 +14049,10 @@ program2.command("install").alias("add").argument("[hooks...]", "Hooks to instal
     return { name, version };
   }
   const pinnedRequests = toInstall.map((arg) => ({ arg, pinned: parseNameVersion(arg) })).filter((x) => x.pinned !== null);
-  const customSources = toInstall.filter((n) => !getHook(n) && isCustomSource2(n));
+  const customSources = toInstall.filter((n2) => !getHook(n2) && isCustomSource2(n2));
   if (options.dryRun) {
-    const known = toInstall.filter((n) => getHook(n));
-    const unknown = toInstall.filter((n) => !getHook(n) && !isCustomSource2(n) && !parseNameVersion(n) && !readCustomManifest2(n));
+    const known = toInstall.filter((n2) => getHook(n2));
+    const unknown = toInstall.filter((n2) => !getHook(n2) && !isCustomSource2(n2) && !parseNameVersion(n2) && !readCustomManifest2(n2));
     if (options.json) {
       console.log(JSON.stringify({
         dryRun: true,
@@ -13514,7 +14126,7 @@ Dry run \u2014 would install (${scope}, ${target}):
   for (const { arg, pinned } of pinnedRequests) {
     try {
       const transport = resolveHooksTransport2();
-      const pinnedInstall = transport.mode === "remote" && transport.authority ? await fetchPinnedHook2(pinned.name, pinned.version, transport.authority.origin, transport.authority.apiKey) : await installPinnedFromBundled2(pinned.name, pinned.version);
+      const pinnedInstall = transport.mode === "remote" && transport.authority ? await fetchPinnedHook2(pinned.name, pinned.version, transport.authority.origin, transport.authority) : await installPinnedFromBundled2(pinned.name, pinned.version);
       installedPinned.push(pinnedInstall.name);
       if (options.json) {
         console.log(JSON.stringify({ pinned: { request: arg, name: pinnedInstall.name, version: pinnedInstall.version, sha256: pinnedInstall.sha256, source: pinnedInstall.source } }));
@@ -13533,7 +14145,7 @@ Dry run \u2014 would install (${scope}, ${target}):
     }
   }
   const namesToRegister = [...new Set([
-    ...toInstall.filter((n) => !isCustomSource2(n) && !parseNameVersion(n)),
+    ...toInstall.filter((n2) => !isCustomSource2(n2) && !parseNameVersion(n2)),
     ...installedCustom,
     ...installedPinned
   ])];
@@ -13557,22 +14169,22 @@ Dry run \u2014 would install (${scope}, ${target}):
   }
   if (options.json) {
     console.log(JSON.stringify({
-      installed: results.filter((r) => r.success).map((r) => r.hook),
-      failed: results.filter((r) => !r.success).map((r) => ({ hook: r.hook, error: r.error })),
-      fragments: results.filter((r) => r.success && r.fragment).map((r) => ({ hook: r.hook, fragment: r.fragment, applied: r.applied, configPath: r.configPath, note: r.note })),
+      installed: results.filter((r2) => r2.success).map((r2) => r2.hook),
+      failed: results.filter((r2) => !r2.success).map((r2) => ({ hook: r2.hook, error: r2.error })),
+      fragments: results.filter((r2) => r2.success && r2.fragment).map((r2) => ({ hook: r2.hook, fragment: r2.fragment, applied: r2.applied, configPath: r2.configPath, note: r2.note })),
       total: results.length,
-      success: results.filter((r) => r.success).length,
+      success: results.filter((r2) => r2.success).length,
       scope,
       target,
-      applied: results.some((r) => r.applied),
-      ...target === "codex" ? { notes: results.filter((r) => r.success && r.note).map((r) => r.note) } : {}
+      applied: results.some((r2) => r2.applied),
+      ...target === "codex" ? { notes: results.filter((r2) => r2.success && r2.note).map((r2) => r2.note) } : {}
     }));
-    if (results.some((r) => !r.success)) {
+    if (results.some((r2) => !r2.success)) {
       process.exitCode = 1;
     }
     return;
   }
-  const successCount = results.filter((r) => r.success).length;
+  const successCount = results.filter((r2) => r2.success).length;
   const settingsFile = target === "codewith" ? options.applyCodewith ? options.codewithConfig : "TOML fragment only (configs should apply)" : formatSettingsPath(scope, target);
   console.log(chalk2.bold(`
 Installing hooks (${scope}, ${target})...
@@ -13615,7 +14227,7 @@ Installing hooks (${scope}, ${target})...
   console.log(chalk2.dim(`
 Registered in ${settingsFile}`));
 });
-program2.command("list").alias("ls").option("-c, --category <category>", "Filter by category").option("-a, --all", "Show all available hooks", false).option("-i, --installed", "Show only installed hooks", false).option("-r, --registered", "Show registered hooks", false).option("-g, --global", "Check global settings", false).option("-p, --project", "Check project settings", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith, codex (default: claude)", "claude").option("-n, --limit <n>", "Max rows to show in compact output", "20").option("--verbose", "Show descriptions and full detail columns", false).option("-j, --json", "Output as JSON", false).description("List available or installed hooks (bundled + custom/registry)").action((options) => {
+program3.command("list").alias("ls").option("-c, --category <category>", "Filter by category").option("-a, --all", "Show all available hooks", false).option("-i, --installed", "Show only installed hooks", false).option("-r, --registered", "Show registered hooks", false).option("-g, --global", "Check global settings", false).option("-p, --project", "Check project settings", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith, codex (default: claude)", "claude").option("-n, --limit <n>", "Max rows to show in compact output", "20").option("--verbose", "Show descriptions and full detail columns", false).option("-j, --json", "Output as JSON", false).description("List available or installed hooks (bundled + custom/registry)").action((options) => {
   const scope = resolveScope(options);
   const limit = options.all ? Number.MAX_SAFE_INTEGER : parseLimit(options.limit, 20, 200);
   const storeHooks = listStoreHooks();
@@ -13724,7 +14336,7 @@ Custom / Registry hooks (${storeHooks.length}, showing ${storeVisible.length}):
     printDisclosureHint(storeHooks.length - storeVisible.length, "hooks info <name>", { includeAll: true });
   }
 });
-program2.command("search").argument("<query>", "Search term").option("-n, --limit <n>", "Max rows to show in compact output", "10").option("--verbose", "Show descriptions for search results", false).option("-j, --json", "Output as JSON", false).description("Search for hooks").action((query, options) => {
+program3.command("search").argument("<query>", "Search term").option("-n, --limit <n>", "Max rows to show in compact output", "10").option("--verbose", "Show descriptions for search results", false).option("-j, --json", "Output as JSON", false).description("Search for hooks").action((query, options) => {
   const results = searchHooks(query);
   if (options.json) {
     console.log(JSON.stringify(results));
@@ -13743,7 +14355,7 @@ Found ${results.length} hook(s), showing ${visible.length}:
     console.log(hookSummaryLine(h, { verbose: options.verbose }));
   printDisclosureHint(results.length - visible.length, "hooks info <name>");
 });
-program2.command("remove").alias("rm").argument("<hook>", "Hook to remove").option("-g, --global", "Remove from global settings", false).option("-p, --project", "Remove from project settings", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith, codex, all (default: claude)", "claude").option("-j, --json", "Output as JSON", false).description("Remove an installed hook (settings registration + store + lock + DB)").action(async (hook, options) => {
+program3.command("remove").alias("rm").argument("<hook>", "Hook to remove").option("-g, --global", "Remove from global settings", false).option("-p, --project", "Remove from project settings", false).option("-t, --target <target>", "Agent target: claude, gemini, codewith, codex, all (default: claude)", "claude").option("-j, --json", "Output as JSON", false).description("Remove an installed hook (settings registration + store + lock + DB)").action(async (hook, options) => {
   const scope = resolveScope(options);
   const target = resolveTarget(options);
   const { uninstallHook: uninstallHook2 } = await Promise.resolve().then(() => (init_installer(), exports_installer));
@@ -13779,7 +14391,7 @@ program2.command("remove").alias("rm").argument("<hook>", "Hook to remove").opti
     console.log(chalk2.red(`\u2717 Hook '${hook}' not found${hint}`));
   }
 });
-program2.command("categories").option("-j, --json", "Output as JSON", false).description("List all categories").action((options) => {
+program3.command("categories").option("-j, --json", "Output as JSON", false).description("List all categories").action((options) => {
   if (options.json) {
     const result = CATEGORIES.map((cat) => ({
       name: cat,
@@ -13796,7 +14408,7 @@ Categories:
     console.log(`  ${category} (${count})`);
   }
 });
-program2.command("info").argument("<hook>", "Hook name").option("-j, --json", "Output as JSON", false).description("Show detailed info about a hook").action(async (hook, options) => {
+program3.command("info").argument("<hook>", "Hook name").option("-j, --json", "Output as JSON", false).description("Show detailed info about a hook").action(async (hook, options) => {
   const { resolveHookMeta: resolveHookMeta2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
   const meta = resolveHookMeta2(hook) ?? getHook(hook);
   if (!meta) {
@@ -13844,7 +14456,7 @@ ${meta.displayName}
     console.log(chalk2.dim("  \u25CB Not installed in project"));
   }
 });
-program2.command("doctor").option("-g, --global", "Check global settings", false).option("-p, --project", "Check project settings", false).option("-f, --fix", "Remove stale registrations (a .bak is written beside each settings file)", false).option("-j, --json", "Output as JSON", false).description("Check health of installed hooks; --fix removes registrations whose hook cannot resolve").action((options) => {
+program3.command("doctor").option("-g, --global", "Check global settings", false).option("-p, --project", "Check project settings", false).option("-f, --fix", "Remove stale registrations (a .bak is written beside each settings file)", false).option("-j, --json", "Output as JSON", false).description("Check health of installed hooks; --fix removes registrations whose hook cannot resolve").action((options) => {
   const scope = resolveScope(options);
   const settingsPath = getSettingsPath(scope);
   const issues = [];
@@ -13859,7 +14471,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
     });
   }
   const staleNames = new Set(stale.map((finding) => finding.hook));
-  const settingsExist = existsSync16(settingsPath);
+  const settingsExist = existsSync17(settingsPath);
   if (!settingsExist) {
     issues.push({ hook: "(settings)", issue: `${settingsPath} not found`, severity: "warning" });
   }
@@ -13867,7 +14479,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
   let wiringCount = 0;
   if (settingsExist) {
     try {
-      const settings = JSON.parse(readFileSync12(settingsPath, "utf-8"));
+      const settings = JSON.parse(readFileSync13(settingsPath, "utf-8"));
       wiringCount = countSettingsWiring(settings);
     } catch {}
   }
@@ -13878,7 +14490,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
     const meta = custom ? resolveHookMeta(name) : getHook(name);
     let hookHealthy = true;
     if (custom) {
-      if (!existsSync16(custom.scriptPath)) {
+      if (!existsSync17(custom.scriptPath)) {
         issues.push({ hook: name, issue: `Custom hook script missing: ${custom.scriptPath}`, severity: "error" });
         hookHealthy = false;
       }
@@ -13889,15 +14501,15 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
         continue;
       }
       const hookDir = getHookPath(name);
-      const hookScript = join17(hookDir, "src", "hook.ts");
-      if (!existsSync16(hookScript)) {
+      const hookScript = join18(hookDir, "src", "hook.ts");
+      if (!existsSync17(hookScript)) {
         issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
         hookHealthy = false;
       }
     }
     if (meta && settingsExist) {
       try {
-        const settings = JSON.parse(readFileSync12(settingsPath, "utf-8"));
+        const settings = JSON.parse(readFileSync13(settingsPath, "utf-8"));
         if (!hookRegisteredInSettings(settings, name, meta.event, meta.matcher)) {
           const eventName = meta.event.split(":")[0];
           issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
@@ -13984,7 +14596,7 @@ Hook Health Check (${scope})
   }
   console.log();
 });
-program2.command("update").argument("[hooks...]", "Hooks to update (defaults to all installed)").option("-g, --global", "Update global hooks", false).option("-p, --project", "Update project hooks", false).option("-j, --json", "Output as JSON", false).description("Re-register hooks (picks up new package version), refresh lock pins, or install a pinned registry version (<name>@<version>)").action(async (hooks, options) => {
+program3.command("update").argument("[hooks...]", "Hooks to update (defaults to all installed)").option("-g, --global", "Update global hooks", false).option("-p, --project", "Update project hooks", false).option("-j, --json", "Output as JSON", false).description("Re-register hooks (picks up new package version), refresh lock pins, or install a pinned registry version (<name>@<version>)").action(async (hooks, options) => {
   const scope = resolveScope(options);
   const installed = getInstalledHooks(scope);
   const toUpdate = hooks.length > 0 ? hooks : installed;
@@ -14024,7 +14636,7 @@ program2.command("update").argument("[hooks...]", "Hooks to update (defaults to
     if (pinned) {
       try {
         const transport = resolveHooksTransport2();
-        const pinnedInstall = transport.mode === "remote" && transport.authority ? await fetchPinnedHook2(pinned.name, pinned.version, transport.authority.origin, transport.authority.apiKey) : await installPinnedFromBundled2(pinned.name, pinned.version);
+        const pinnedInstall = transport.mode === "remote" && transport.authority ? await fetchPinnedHook2(pinned.name, pinned.version, transport.authority.origin, transport.authority) : await installPinnedFromBundled2(pinned.name, pinned.version);
         const registered = installHook(pinnedInstall.name, { scope, overwrite: true });
         if (!registered.success) {
           results.push({ hook: arg, success: false, error: registered.error ?? "registration failed" });
@@ -14065,10 +14677,10 @@ program2.command("update").argument("[hooks...]", "Hooks to update (defaults to
   }
   if (options.json) {
     console.log(JSON.stringify({
-      updated: results.filter((r) => r.success).map((r) => r.hook),
-      failed: results.filter((r) => !r.success).map((r) => ({ hook: r.hook, error: r.error }))
+      updated: results.filter((r2) => r2.success).map((r2) => r2.hook),
+      failed: results.filter((r2) => !r2.success).map((r2) => ({ hook: r2.hook, error: r2.error }))
     }));
-    if (results.some((r) => !r.success)) {
+    if (results.some((r2) => !r2.success)) {
       process.exitCode = 1;
     }
     return;
@@ -14083,11 +14695,11 @@ Updating hooks...
       console.log(chalk2.red(`\u2717 ${result.hook}: ${result.error}`));
     }
   }
-  if (results.some((r) => !r.success)) {
+  if (results.some((r2) => !r2.success)) {
     process.exitCode = 1;
   }
 });
-program2.command("docs").argument("[hook]", "Hook name (shows general docs if omitted)").option("--verbose", "Print full hook README content", false).option("-j, --json", "Output as JSON", false).description("Show documentation for hooks").action((hook, options) => {
+program3.command("docs").argument("[hook]", "Hook name (shows general docs if omitted)").option("--verbose", "Print full hook README content", false).option("-j, --json", "Output as JSON", false).description("Show documentation for hooks").action((hook, options) => {
   if (hook) {
     const meta = getHook(hook);
     if (!meta) {
@@ -14100,10 +14712,10 @@ program2.command("docs").argument("[hook]", "Hook name (shows general docs if om
       return;
     }
     const hookPath = getHookPath(hook);
-    const readmePath = join17(hookPath, "README.md");
+    const readmePath = join18(hookPath, "README.md");
     let readme = "";
-    if (existsSync16(readmePath)) {
-      readme = readFileSync12(readmePath, "utf-8");
+    if (existsSync17(readmePath)) {
+      readme = readFileSync13(readmePath, "utf-8");
     }
     if (options.json) {
       console.log(JSON.stringify({ ...meta, readme }));
@@ -14221,7 +14833,7 @@ ${meta.displayName} v${meta.version}
   console.log(`    hooks docs --json              Machine-readable documentation`);
   console.log();
 });
-program2.command("upgrade").option("-c, --check", "Check for updates without installing", false).option("-j, --json", "Output as JSON", false).description("Update the @hasna/hooks package to the latest version").action(async (options) => {
+program3.command("upgrade").option("-c, --check", "Check for updates without installing", false).option("-j, --json", "Output as JSON", false).description("Update the @hasna/hooks package to the latest version").action(async (options) => {
   const current2 = pkg2.version;
   let pm = "npm";
   try {
@@ -14283,7 +14895,7 @@ Upgrading @hasna/hooks (${pm})...
 \u2713 Upgraded: ${current2} \u2192 ${latest}`));
   }
 });
-program2.command("profile-export").description("Export all agent profiles as JSON (for backup/cross-machine setup)").option("-o, --output <file>", "Write to file instead of stdout").option("-j, --json", "Output as JSON (default: true)", false).action(async (options) => {
+program3.command("profile-export").description("Export all agent profiles as JSON (for backup/cross-machine setup)").option("-o, --output <file>", "Write to file instead of stdout").option("-j, --json", "Output as JSON (default: true)", false).action(async (options) => {
   const profiles = exportProfiles();
   const json2 = JSON.stringify(profiles, null, 2);
   if (options.output) {
@@ -14295,14 +14907,14 @@ program2.command("profile-export").description("Export all agent profiles as JSO
     console.log(json2);
   }
 });
-program2.command("profile-import").argument("<file>", "JSON file to import profiles from (use - for stdin)").description("Import agent profiles from a JSON export file").option("-j, --json", "Output result as JSON", false).action(async (file, options) => {
+program3.command("profile-import").argument("<file>", "JSON file to import profiles from (use - for stdin)").description("Import agent profiles from a JSON export file").option("-j, --json", "Output result as JSON", false).action(async (file, options) => {
   let raw;
   if (file === "-") {
     raw = await new Response(Bun.stdin.stream()).text();
   } else {
-    const { readFileSync: readFileSync13 } = await import("fs");
+    const { readFileSync: readFileSync14 } = await import("fs");
     try {
-      raw = readFileSync13(file, "utf-8");
+      raw = readFileSync14(file, "utf-8");
     } catch {
       if (options.json) {
         console.log(JSON.stringify({ error: `Cannot read file: ${file}` }));
@@ -14333,7 +14945,7 @@ program2.command("profile-import").argument("<file>", "JSON file to import profi
       console.log(chalk2.dim(`  Skipped ${result.skipped} (already exist or invalid)`));
   }
 });
-var logCmd = program2.command("log").description(`Query hook event logs from SQLite (${getReportedDbPath()})`);
+var logCmd = program3.command("log").description(`Query hook event logs from SQLite (${getReportedDbPath()})`);
 logCmd.command("list").description("List hook events").option("--hook <name>", "Filter by hook name").option("--session <id>", "Filter by session ID").option("-n, --limit <n>", "Number of rows to show", "50").option("-j, --json", "Output as JSON", false).action(async (options) => {
   const db = await openLocalStoreOrExit(options.json);
   const limit = parseInt(options.limit) || 50;
@@ -14428,16 +15040,16 @@ logCmd.command("errors").description("Show hook events that contain errors").opt
     const m = s.match(/^(\d+)(s|m|h|d)$/);
     if (!m)
       return 86400000;
-    const n = parseInt(m[1]);
+    const n2 = parseInt(m[1]);
     switch (m[2]) {
       case "s":
-        return n * 1000;
+        return n2 * 1000;
       case "m":
-        return n * 60 * 1000;
+        return n2 * 60 * 1000;
       case "h":
-        return n * 60 * 60 * 1000;
+        return n2 * 60 * 60 * 1000;
       case "d":
-        return n * 24 * 60 * 60 * 1000;
+        return n2 * 24 * 60 * 60 * 1000;
       default:
         return 86400000;
     }
@@ -14484,7 +15096,7 @@ logCmd.command("clear").description("Delete hook event logs").option("--hook <na
   }
   console.log(chalk2.green(`\u2713 Cleared ${count} event(s).`));
 });
-var storageCmd = program2.command("storage").description("Sync local hook data with storage PostgreSQL");
+var storageCmd = program3.command("storage").description("Sync local hook data with storage PostgreSQL");
 storageCmd.command("status").description("Show storage sync status").option("-j, --json", "Output as JSON", false).action(async (options) => {
   try {
     const { getStorageStatus: getStorageStatus2 } = await Promise.resolve().then(() => (init_storage(), exports_storage));
@@ -14567,7 +15179,7 @@ storageCmd.command("sync").description("Bidirectional storage sync: pull then pu
     process.exitCode = 1;
   }
 });
-program2.command("trust").argument("<hook>", "Hook to trust").option("-j, --json", "Output as JSON", false).description("Trust the current script content of a hook (re-pins its sha256)").action(async (hook, options) => {
+program3.command("trust").argument("<hook>", "Hook to trust").option("-j, --json", "Output as JSON", false).description("Trust the current script content of a hook (re-pins its sha256)").action(async (hook, options) => {
   const { resolveHook: resolveHook2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
   const { retrustHook: retrustHook2 } = await Promise.resolve().then(() => (init_store(), exports_store));
   const resolved = resolveHook2(hook);
@@ -14586,14 +15198,14 @@ program2.command("trust").argument("<hook>", "Hook to trust").option("-j, --json
   console.log(chalk2.green(`\u2713 Trusted '${resolved.name}' v${resolved.version} (${resolved.source})`));
   console.log(chalk2.dim(`  sha256 ${result.actual}`));
 });
-program2.command("serve").option("-p, --port <port>", "Port (default 39428)").option("--host <host>", "Host to bind (default 127.0.0.1)").description("Serve the local hook registry over HTTP (catalog, artifacts, lock). The publish API key resolves from the @hasna/contracts chain per request (HASNA_HOOKS_API_KEY, the Keychain item hasna.credentials.hooks.api-key, or ~/.hasna/hooks/config/credentials) \u2014 there is deliberately no --api-key flag (P1-8).").action(async (options) => {
+program3.command("serve").option("-p, --port <port>", "Port (default 39428)").option("--host <host>", "Host to bind (default 127.0.0.1)").description("Serve the local hook registry over HTTP (catalog, artifacts, lock). The publish API key resolves from the @hasna/contracts chain per request (HASNA_HOOKS_API_KEY, the Keychain item hasna.credentials.hooks.api-key, or ~/.hasna/hooks/config/credentials) \u2014 there is deliberately no --api-key flag (P1-8).").action(async (options) => {
   const { startServeServer: startServeServer2 } = await Promise.resolve().then(() => (init_serve(), exports_serve));
   startServeServer2({
     port: options.port ? parseInt(options.port, 10) : undefined,
     host: options.host
   });
 });
-program2.command("sync").option("--dry-run", "Print the plan without changing anything", false).option("-j, --json", "Output as JSON", false).description("Sync local hooks with the remote registry (or bundled registry when no registry credential resolves and local mode is opted into)").action(async (options) => {
+program3.command("sync").option("--dry-run", "Print the plan without changing anything", false).option("-j, --json", "Output as JSON", false).description("Sync local hooks with the remote registry (or bundled registry when no registry credential resolves and local mode is opted into)").action(async (options) => {
   const { syncHooks: syncHooks2, planSync: planSync2 } = await Promise.resolve().then(() => (init_sync(), exports_sync));
   try {
     const plan = options.dryRun ? await syncHooks2({ dryRun: true }) : await syncHooks2();
@@ -14637,7 +15249,7 @@ Hook sync (${source})${plan.dryRun ? " \u2014 dry run" : ""}
     process.exitCode = 1;
   }
 });
-program2.command("cf").description("Provision and deploy the hooks registry to Cloudflare").option("--deploy", "Provision D1 + R2 via the Cloudflare API", true).option("--dry-run", "Print the plan without calling the Cloudflare API", false).option("--account-id <id>", "Cloudflare account id (defaults to CF_ACCOUNT_ID env)").option("--database-name <name>", "D1 database name (default hooks-registry)").option("--bucket-name <name>", "R2 bucket name (default hooks-registry-artifacts)").option("--token-file <path>", "Read the API token from a file (defaults to CF_API_TOKEN env)").option("-j, --json", "Output as JSON", false).action(async (options) => {
+program3.command("cf").description("Provision and deploy the hooks registry to Cloudflare").option("--deploy", "Provision D1 + R2 via the Cloudflare API", true).option("--dry-run", "Print the plan without calling the Cloudflare API", false).option("--account-id <id>", "Cloudflare account id (defaults to CF_ACCOUNT_ID env)").option("--database-name <name>", "D1 database name (default hooks-registry)").option("--bucket-name <name>", "R2 bucket name (default hooks-registry-artifacts)").option("--token-file <path>", "Read the API token from a file (defaults to CF_API_TOKEN env)").option("-j, --json", "Output as JSON", false).action(async (options) => {
   const token = readToken(options.tokenFile);
   const accountId = options.accountId ?? process.env.CF_ACCOUNT_ID;
   if (!options.dryRun) {
@@ -14686,7 +15298,7 @@ Cloudflare provisioning complete:
   console.log(chalk2.dim("  wrangler.toml, fill in the D1 database id, then run the commands above."));
   console.log();
 });
-program2.command("migrate").description("Apply PostgreSQL migrations to the storage database (HASNA_HOOKS_DATABASE_URL)").option("-j, --json", "Output as JSON", false).action(async (options) => {
+program3.command("migrate").description("Apply PostgreSQL migrations to the storage database (HASNA_HOOKS_DATABASE_URL)").option("-j, --json", "Output as JSON", false).action(async (options) => {
   try {
     const { getStoragePg: getStoragePg2, runStorageMigrations: runStorageMigrations2 } = await Promise.resolve().then(() => (init_storage(), exports_storage));
     const remote = await getStoragePg2();
@@ -14709,7 +15321,7 @@ program2.command("migrate").description("Apply PostgreSQL migrations to the stor
     process.exitCode = 1;
   }
 });
-program2.command("mcp").option("-s, --stdio", "Use stdio transport (one process per agent)", false).option("--sse", "Use legacy SSE transport (port 39427)", false).option("--http", "Use Streamable HTTP transport (explicit; this is also the default)", false).option("-p, --port <port>", "Port for HTTP/SSE transport (defaults to 8847 for HTTP, 39427 for SSE)").description("Start MCP server for AI agent integration (default: shared Streamable HTTP)").action(async (options) => {
+program3.command("mcp").option("-s, --stdio", "Use stdio transport (one process per agent)", false).option("--sse", "Use legacy SSE transport (port 39427)", false).option("--http", "Use Streamable HTTP transport (explicit; this is also the default)", false).option("-p, --port <port>", "Port for HTTP/SSE transport (defaults to 8847 for HTTP, 39427 for SSE)").description("Start MCP server for AI agent integration (default: shared Streamable HTTP)").action(async (options) => {
   if (options.stdio) {
     const { startStdioServer: startStdioServer2 } = await Promise.resolve().then(() => (init_server(), exports_server));
     await startStdioServer2();
@@ -14730,8 +15342,20 @@ program2.command("mcp").option("-s, --stdio", "Use stdio transport (one process
     startMcpHttpServer2({ name: "hooks", port: resolveMcpHttpPort2(args), buildServer: createHooksServer2 });
   }
 });
-registerEventsCommands(program2, { source: "hooks" });
+registerEventsCommands(program3, { source: "hooks" });
+program3.command("safety").description("Register bundled native deletion guards without a registry credential").command("install <guard>").option("--target <target>", "codex or claude", "codex").option("--scope <scope>", "global or project", "global").option("--overwrite", "Replace this guard in place; native trust is still required").action((guard, options) => {
+  if (!isNativeSafetyName(guard) || !["codex", "claude"].includes(options.target) || !["global", "project"].includes(options.scope)) {
+    console.error("Unsupported bundled safety registration");
+    process.exitCode = 1;
+    return;
+  }
+  const result = installHook(guard, { target: options.target, scope: options.scope, overwrite: options.overwrite });
+  console.log(JSON.stringify(result));
+  if (!result.success)
+    process.exitCode = 1;
+});
 var API_INDEPENDENT_COMMANDS = new Set([
+  "safety",
   "serve",
   "mcp",
   "cf",
@@ -14792,4 +15416,4 @@ function enforceTransportGate() {
   refuseLocalStore(hooksHostedRouteLocalStoreRefusal(transport.authority.v1BaseUrl));
 }
 enforceTransportGate();
-program2.parse();
+program3.parse();