@hasna/hooks 0.9.5 → 0.9.6

package/bin/native-safety-entry.js

@@ -0,0 +1,1136 @@
+// @bun
+// hooks/native-safety-entry.ts
+import { homedir as homedir2 } from "os";
+import { isAbsolute as isAbsolute3 } from "path";
+
+// hooks/hook-trash-guard/src/hook.ts
+import { dirname, isAbsolute, join, normalize, resolve, sep } from "path";
+import { readFileSync, realpathSync, statSync } from "fs";
+import { spawnSync } from "child_process";
+
+// hooks/codewith-native-common.ts
+function getCommand(input) {
+  const command = input.tool_input?.command;
+  return typeof command === "string" ? command : "";
+}
+var segmentCache = new Map;
+var SYSTEM_PROTECTED_ROOTS = [
+  "/",
+  "/bin",
+  "/boot",
+  "/dev",
+  "/etc",
+  "/home",
+  "/lib",
+  "/lib32",
+  "/lib64",
+  "/libx32",
+  "/opt",
+  "/proc",
+  "/root",
+  "/run",
+  "/sbin",
+  "/srv",
+  "/sys",
+  "/usr",
+  "/var",
+  "/Applications",
+  "/Library",
+  "/System",
+  "/Users",
+  "/Volumes",
+  "/private"
+];
+var OPAQUE_BUILTINS = new Set(["eval", "source", ".", "trap", "coproc", "exec"]);
+var COMPOUND_KEYWORDS = new Set(["{", "}", "then", "do", "else", "elif", "fi", "done", "!"]);
+var NAME_BINDING_BUILTINS = new Set(["read", "getopts", "mapfile", "readarray"]);
+var VALUE_BINDING_BUILTINS = new Set(["export", "declare", "typeset", "readonly", "local", "let"]);
+var RSYNC_OPTIONS_WITH_VALUE = new Set([
+  "-e",
+  "--rsh",
+  "--exclude",
+  "--exclude-from",
+  "--include",
+  "--include-from",
+  "--filter",
+  "--files-from",
+  "--rsync-path",
+  "--out-format",
+  "--log-file",
+  "--password-file",
+  "--backup-dir",
+  "--partial-dir",
+  "--compare-dest",
+  "--copy-dest",
+  "--link-dest"
+]);
+var SHELL_INTERPRETERS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "mksh", "busybox"]);
+var USER_SWITCH_COMMANDS = new Set(["su", "runuser"]);
+var SSH_OPTIONS_WITH_VALUE = new Set([
+  "-B",
+  "-b",
+  "-c",
+  "-D",
+  "-E",
+  "-e",
+  "-F",
+  "-I",
+  "-i",
+  "-J",
+  "-L",
+  "-l",
+  "-m",
+  "-O",
+  "-o",
+  "-P",
+  "-p",
+  "-Q",
+  "-R",
+  "-S",
+  "-W",
+  "-w"
+]);
+var SHELL_OPTIONS_WITH_VALUE = new Set(["-o", "+o", "--rcfile", "--init-file"]);
+
+// hooks/hook-trash-guard/src/hook.ts
+var DEFAULT_TIMEOUT_MS = 600000;
+var DEFAULT_DESCRIPTION = "Delete via trash guard (rm intercepted and made recoverable)";
+var HANDOFF_ROOTS = [".hasna/repos/clones", "workspace/repos"];
+var PROTECTED_HOME_TREES = [".hasna", ".ssh", ".aws"];
+var REFUSED_VERBS = {
+  rmdir: "`rmdir` is a delete that trash-guard does not rewrite (it takes rmdir's flags, not rm's). Re-run it as `rm -d -- <path>` for an empty directory, or `rm -r -- <path>` for a non-empty one, and it is redirected into trash.",
+  unlink: "`unlink` is a delete that trash-guard does not rewrite. Re-run it as `rm -- <path>` and it is redirected into trash.",
+  shred: "`shred` destroys content irrecoverably and is never allowed. Re-run it as `rm -- <path>` and it is redirected into trash."
+};
+var OPAQUE_COMMANDS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "eval", "source", ".", "su", "runuser"]);
+var WRAPPERS = {
+  sudo: ["-u", "--user", "-g", "--group", "-p", "--prompt", "-C", "--chdir", "-h", "--host", "-r", "--role", "-t", "--type", "-U", "--other-user"],
+  doas: ["-u", "-C"],
+  env: ["-u", "--unset", "-C", "--chdir", "-S", "--split-string"],
+  nice: ["-n", "--adjustment"],
+  ionice: ["-c", "--class", "-n", "--classdata", "-p", "--pid"],
+  stdbuf: ["-i", "-o", "-e", "--input", "--output", "--error"],
+  time: ["-f", "--format", "-o", "--output"],
+  timeout: ["-s", "--signal", "-k", "--kill-after"],
+  nohup: [],
+  setsid: [],
+  command: [],
+  builtin: [],
+  exec: []
+};
+var WRAPPER_POSITIONALS = {
+  timeout: 1
+};
+var APPLET_DISPATCHERS = new Set(["busybox", "toybox"]);
+var KEYWORDS = new Set(["!", "{", "}", "then", "do", "else", "elif", "if", "while", "until", "for", "case", "esac", "fi", "done", "select", "function"]);
+var GIT_VALUE_OPTIONS = new Set(["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path", "--config-env"]);
+var DELETE_VERB_WORD_RE = /(^|[^A-Za-z0-9_.-])(rm|rmdir|unlink|shred)(?![A-Za-z0-9_.-])/;
+function mentionsDeleteVerb(text) {
+  return DELETE_VERB_WORD_RE.test(decodeWord(text));
+}
+var ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
+function baseVerb(word) {
+  const slash = word.lastIndexOf("/");
+  return slash >= 0 ? word.slice(slash + 1) : word;
+}
+function lexCommand(command) {
+  const segments = [];
+  const substitutions = [];
+  let words = [];
+  let redirects = new Set;
+  let wordStart = -1;
+  let pendingRedirect = false;
+  let trustworthy = true;
+  let i = 0;
+  const n = command.length;
+  const closeWord = (end) => {
+    if (wordStart >= 0) {
+      const index = words.length;
+      words.push({ text: command.slice(wordStart, end), start: wordStart, end });
+      if (pendingRedirect)
+        redirects.add(index);
+      wordStart = -1;
+    }
+    pendingRedirect = false;
+  };
+  const closeSegment = (end) => {
+    closeWord(end);
+    if (words.length > 0)
+      segments.push({ words, redirects });
+    words = [];
+    redirects = new Set;
+  };
+  const scanSingle = (from) => {
+    const end = command.indexOf("'", from + 1);
+    return end === -1 ? -1 : end + 1;
+  };
+  const scanBacktick = (from) => {
+    let j = from + 1;
+    while (j < n) {
+      if (command[j] === "\\") {
+        j += 2;
+        continue;
+      }
+      if (command[j] === "`")
+        return j + 1;
+      j++;
+    }
+    return -1;
+  };
+  const scanParen = (from) => {
+    let depth = 0;
+    let j = from;
+    while (j < n) {
+      const c = command[j];
+      if (c === "\\") {
+        j += 2;
+        continue;
+      }
+      if (c === "'") {
+        const e = scanSingle(j);
+        if (e < 0)
+          return -1;
+        j = e;
+        continue;
+      }
+      if (c === '"') {
+        const e = scanDouble(j);
+        if (e < 0)
+          return -1;
+        j = e;
+        continue;
+      }
+      if (c === "`") {
+        const e = scanBacktick(j);
+        if (e < 0)
+          return -1;
+        j = e;
+        continue;
+      }
+      if (c === "(")
+        depth++;
+      else if (c === ")") {
+        depth--;
+        if (depth === 0)
+          return j + 1;
+      }
+      j++;
+    }
+    return -1;
+  };
+  function scanDouble(from) {
+    let j = from + 1;
+    while (j < n) {
+      const c = command[j];
+      if (c === "\\") {
+        j += 2;
+        continue;
+      }
+      if (c === '"')
+        return j + 1;
+      if (c === "`") {
+        const e = scanBacktick(j);
+        if (e < 0)
+          return -1;
+        j = e;
+        continue;
+      }
+      if (c === "$" && command[j + 1] === "(") {
+        const e = scanParen(j + 1);
+        if (e < 0)
+          return -1;
+        j = e;
+        continue;
+      }
+      j++;
+    }
+    return -1;
+  }
+  while (i < n) {
+    const ch = command[i];
+    if (ch === " " || ch === "\t" || ch === "\r") {
+      closeWord(i);
+      i++;
+      continue;
+    }
+    if (ch === `
+`) {
+      closeSegment(i);
+      i++;
+      continue;
+    }
+    if (ch === ";") {
+      closeSegment(i);
+      i++;
+      continue;
+    }
+    if (ch === "&") {
+      closeSegment(i);
+      i += command[i + 1] === "&" ? 2 : 1;
+      continue;
+    }
+    if (ch === "|") {
+      closeSegment(i);
+      i += command[i + 1] === "|" ? 2 : 1;
+      continue;
+    }
+    if (ch === "(" || ch === ")") {
+      closeSegment(i);
+      i++;
+      continue;
+    }
+    if (ch === "<" && command[i + 1] === "<" && command[i + 2] !== "<") {
+      const marker = command.slice(i + 2).match(/^-?[ \t]*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/);
+      if (!marker) {
+        trustworthy = false;
+        i = n;
+        continue;
+      }
+      const bodyStart = command.indexOf(`
+`, i + 2 + marker[0].length);
+      if (bodyStart === -1) {
+        trustworthy = false;
+        i = n;
+        continue;
+      }
+      const rest = command.slice(bodyStart + 1);
+      const endIdx = findHeredocEnd(rest, marker[2]);
+      if (endIdx === -1) {
+        trustworthy = false;
+        i = n;
+        continue;
+      }
+      closeWord(i);
+      i = bodyStart + 1 + endIdx + marker[2].length;
+      continue;
+    }
+    if (ch === ">" || ch === "<") {
+      closeWord(i);
+      pendingRedirect = true;
+      i += command[i + 1] === ch && ch === ">" ? 2 : 1;
+      continue;
+    }
+    if (ch === "'") {
+      if (wordStart < 0)
+        wordStart = i;
+      const e = scanSingle(i);
+      if (e < 0) {
+        trustworthy = false;
+        i = n;
+      } else
+        i = e;
+      continue;
+    }
+    if (ch === '"') {
+      if (wordStart < 0)
+        wordStart = i;
+      const e = scanDouble(i);
+      if (e < 0) {
+        trustworthy = false;
+        i = n;
+      } else
+        i = e;
+      continue;
+    }
+    if (ch === "`") {
+      if (wordStart < 0)
+        wordStart = i;
+      const e = scanBacktick(i);
+      if (e < 0) {
+        trustworthy = false;
+        i = n;
+      } else {
+        substitutions.push(command.slice(i + 1, e - 1));
+        i = e;
+      }
+      continue;
+    }
+    if (ch === "$" && command[i + 1] === "(") {
+      if (wordStart < 0)
+        wordStart = i;
+      const e = scanParen(i + 1);
+      if (e < 0) {
+        trustworthy = false;
+        i = n;
+      } else {
+        substitutions.push(command.slice(i + 2, e - 1));
+        i = e;
+      }
+      continue;
+    }
+    if (ch === "\\") {
+      if (wordStart < 0)
+        wordStart = i;
+      if (i + 1 >= n) {
+        trustworthy = false;
+        i = n;
+      } else
+        i += 2;
+      continue;
+    }
+    if (wordStart < 0)
+      wordStart = i;
+    i++;
+  }
+  closeSegment(n);
+  return { segments, trustworthy, substitutions };
+}
+function findHeredocEnd(rest, delimiter) {
+  let from = 0;
+  while (from <= rest.length) {
+    const at = rest.indexOf(delimiter, from);
+    if (at === -1)
+      return -1;
+    const lineStart = at === 0 || rest[at - 1] === `
+`;
+    const after = at + delimiter.length;
+    const lineEnd = after === rest.length || rest[after] === `
+` || rest[after] === "\r";
+    if (lineStart && lineEnd)
+      return at;
+    from = at + 1;
+  }
+  return -1;
+}
+function decodeWord(text) {
+  let out = "";
+  let i = 0;
+  while (i < text.length) {
+    const ch = text[i];
+    if (ch === "\\") {
+      if (i + 1 < text.length)
+        out += text[i + 1];
+      i += 2;
+      continue;
+    }
+    if (ch === "'") {
+      const end = text.indexOf("'", i + 1);
+      if (end === -1) {
+        out += text.slice(i + 1);
+        break;
+      }
+      out += text.slice(i + 1, end);
+      i = end + 1;
+      continue;
+    }
+    if (ch === '"') {
+      i++;
+      while (i < text.length && text[i] !== '"') {
+        if (text[i] === "\\" && i + 1 < text.length) {
+          out += text[i + 1];
+          i += 2;
+          continue;
+        }
+        out += text[i];
+        i++;
+      }
+      i++;
+      continue;
+    }
+    out += ch;
+    i++;
+  }
+  return out;
+}
+function commandWordIndex(segment) {
+  let index = 0;
+  let guard = 0;
+  while (index < segment.words.length && guard++ < 32) {
+    const raw = segment.words[index].text;
+    const decoded = decodeWord(raw);
+    if (ASSIGNMENT_RE.test(decoded) && !decoded.startsWith("-")) {
+      index++;
+      continue;
+    }
+    if (KEYWORDS.has(decoded)) {
+      index++;
+      continue;
+    }
+    const wrapperValues = WRAPPERS[decoded];
+    if (wrapperValues) {
+      index++;
+      while (index < segment.words.length) {
+        const option = decodeWord(segment.words[index].text);
+        if (!option.startsWith("-") || option === "-")
+          break;
+        if (option === "--") {
+          index++;
+          break;
+        }
+        index++;
+        if (wrapperValues.includes(option))
+          index++;
+      }
+      let positionals = WRAPPER_POSITIONALS[decoded] ?? 0;
+      while (positionals > 0 && index < segment.words.length) {
+        const positional = decodeWord(segment.words[index].text);
+        if (positional.startsWith("-") && positional !== "-")
+          break;
+        index++;
+        positionals--;
+      }
+      continue;
+    }
+    return index;
+  }
+  return -1;
+}
+function rmOperands(segment, verbIndex) {
+  const operands = [];
+  let seenDoubleDash = false;
+  for (let index = verbIndex + 1;index < segment.words.length; index++) {
+    if (segment.redirects.has(index))
+      continue;
+    const decoded = decodeWord(segment.words[index].text);
+    if (!seenDoubleDash) {
+      if (decoded === "--") {
+        seenDoubleDash = true;
+        continue;
+      }
+      if (decoded.startsWith("-") && decoded !== "-")
+        continue;
+    }
+    operands.push(segment.words[index]);
+  }
+  return operands;
+}
+function handoffRoots(home) {
+  return HANDOFF_ROOTS.map((suffix) => join(home, ...suffix.split("/")));
+}
+function expandHomeSpelling(token, home) {
+  if (token === "~" || token === "$HOME" || token === "${HOME}")
+    return home;
+  if (token.startsWith("~/"))
+    return join(home, token.slice(2));
+  if (token.startsWith("$HOME/"))
+    return join(home, token.slice("$HOME/".length));
+  if (token.startsWith("${HOME}/"))
+    return join(home, token.slice("${HOME}/".length));
+  return token;
+}
+function resolveLiteralTarget(raw, cwd, home) {
+  let decoded = decodeWord(raw);
+  if (!decoded)
+    return null;
+  if (decoded.includes("`"))
+    return null;
+  if (decoded === "$HOME" || decoded === "${HOME}" || decoded === "$HOME/" || decoded === "${HOME}/")
+    return home;
+  const withoutHome = decoded.replace(/\$\{HOME\}/g, "").replace(/\$HOME/g, "");
+  if (withoutHome.includes("$"))
+    return null;
+  if (/[*?[\]]/.test(decoded))
+    return null;
+  if (decoded.startsWith("~")) {
+    const expanded = expandHomeSpelling(decoded, home);
+    if (expanded === decoded)
+      return null;
+    decoded = expanded;
+  }
+  const absolute = isAbsolute(decoded) ? normalize(decoded) : resolve(cwd, decoded);
+  const trimmed = absolute.replace(/\/+$/, "");
+  return trimmed === "" ? "/" : trimmed;
+}
+function isUnder(target, root) {
+  return target === root || target.startsWith(`${root}${sep}`);
+}
+function protectedTargetReason(target, home) {
+  if (target === home) {
+    return `\`${target}\` is the home directory itself, which is never deleted or trashed. Delete a specific file or directory inside it instead.`;
+  }
+  for (const root of SYSTEM_PROTECTED_ROOTS) {
+    if (target !== root && !isUnder(root, target))
+      continue;
+    return root === "/" ? `\`${target}\` is the filesystem root, which is never deleted.` : `\`${target}\` is the system root \`${root}\` (or an ancestor of it), which is never deleted or trashed.`;
+  }
+  for (const suffix of PROTECTED_HOME_TREES) {
+    const root = join(home, suffix);
+    if (!isUnder(target, root) && !isUnder(root, target))
+      continue;
+    return `\`${target}\` is the protected \`~/${suffix}\` path (or contains it), which is never deleted or trashed. Delete a specific file inside it, and only when you are sure.`;
+  }
+  return null;
+}
+function isHandoff(operands, cwd, home) {
+  const roots = handoffRoots(home);
+  if (roots.some((root) => isUnder(cwd, root)))
+    return true;
+  for (const operand of operands) {
+    const target = resolveLiteralTarget(operand.text, cwd, home);
+    if (target && roots.some((root) => isUnder(target, root)))
+      return true;
+  }
+  return false;
+}
+function scanCommand(command, options) {
+  const ctx = { cwd: options.cwd, home: options.home, depth: options.depth ?? 0 };
+  const result = { rmHits: [], handoffHits: [], refusals: [], protectedHits: [], trustworthy: true };
+  const lexed = lexCommand(command);
+  result.trustworthy = lexed.trustworthy;
+  if (!lexed.trustworthy) {
+    return result;
+  }
+  let cwd = ctx.cwd;
+  for (const segment of lexed.segments) {
+    const index = commandWordIndex(segment);
+    if (index < 0)
+      continue;
+    const verb = baseVerb(decodeWord(segment.words[index].text));
+    if (verb === "cd") {
+      const operand = segment.words[index + 1];
+      if (operand) {
+        const target = resolveLiteralTarget(operand.text, cwd, ctx.home);
+        if (target)
+          cwd = target;
+        else
+          cwd = ctx.cwd;
+      }
+      continue;
+    }
+    const refusal = REFUSED_VERBS[verb];
+    if (refusal) {
+      result.refusals.push({ reason: refusal });
+      continue;
+    }
+    if (verb === "rm") {
+      const operands = rmOperands(segment, index);
+      if (operands.length === 0)
+        continue;
+      const hit = { word: segment.words[index], operands };
+      if (isHandoff(hit.operands, cwd, ctx.home)) {
+        result.handoffHits.push(hit);
+        continue;
+      }
+      result.rmHits.push(hit);
+      for (const operand of hit.operands) {
+        const target = resolveLiteralTarget(operand.text, cwd, ctx.home);
+        if (!target)
+          continue;
+        const reason = protectedTargetReason(target, ctx.home);
+        if (reason) {
+          result.protectedHits.push({ reason });
+          break;
+        }
+      }
+      continue;
+    }
+    if (APPLET_DISPATCHERS.has(verb)) {
+      const appletIndex = segment.words.findIndex((word, at) => at > index && !decodeWord(word.text).startsWith("-"));
+      const applet = appletIndex >= 0 ? baseVerb(decodeWord(segment.words[appletIndex].text)) : "";
+      if (applet === "rm" || applet in REFUSED_VERBS) {
+        result.refusals.push({
+          reason: `\`${verb} ${applet}\` runs the ${verb} applet, whose own \`rm\` is not GNU \`rm\` and cannot be rewritten in place. Run the delete as \`rm -- <path>\`, which is redirected into trash.`
+        });
+      }
+      continue;
+    }
+    if (verb === "git") {
+      const sub = gitSubcommand(segment, index);
+      if (sub === "rm" || sub === "clean") {
+        const dryOrIndexOnly = sub === "rm" ? gitRmIsNonDeleting(segment, index) : gitHasDryRun(segment, index);
+        if (!dryOrIndexOnly) {
+          result.refusals.push({
+            reason: sub === "rm" ? "`git rm` is refused: without `--cached` it deletes the working-tree file, and its semantics are not `rm`'s. Use `rm -- <path>` (intercepted and redirected into trash) to remove the file, or `git rm --cached -- <path>` to unstage it without deleting." : "`git clean` deletes untracked files irrecoverably and is refused. Remove them explicitly with `rm -- <path>` (intercepted and redirected into trash), or preview with `git clean -n`."
+          });
+        }
+      }
+      continue;
+    }
+    if (verb === "find") {
+      const words = segment.words.map((word) => decodeWord(word.text));
+      const deleteIndex = words.indexOf("-delete");
+      if (deleteIndex >= 0) {
+        result.refusals.push({
+          reason: "`find -delete` deletes files irrecoverably and is refused. List the paths first (`find \u2026 -print`), then remove them explicitly with `rm -- <path>` so the delete is redirected into trash."
+        });
+        continue;
+      }
+      const execIndex = words.findIndex((word) => word === "-exec" || word === "-execdir" || word === "-ok");
+      if (execIndex >= 0 && words.slice(execIndex).some((word) => word === "rm" || word === "rmdir" || word === "unlink" || word === "shred")) {
+        result.refusals.push({
+          reason: "`find -exec <delete>` is refused: the delete runs through find, not through `rm`, and cannot be redirected into trash. Remove the paths explicitly with `rm -- <path>`."
+        });
+        continue;
+      }
+      continue;
+    }
+    if (verb === "xargs" && segment.words.some((word) => decodeWord(word.text) === "rm")) {
+      result.refusals.push({
+        reason: "`xargs rm` takes its targets from stdin, so this hook cannot verify what would be deleted. Pipe the paths into an explicit `rm -- <path> \u2026` instead, which is redirected into trash."
+      });
+      continue;
+    }
+    if (OPAQUE_COMMANDS.has(verb) && mentionsDeleteVerb(segmentText(segment))) {
+      result.refusals.push({
+        reason: `\`${verb}\` runs a command string this hook cannot rewrite in place. Run the delete directly as \`rm -- <path>\` (intercepted and redirected into trash), or as a script that uses \`trash guard\` itself.`
+      });
+      continue;
+    }
+  }
+  if (ctx.depth < 3) {
+    for (const body of lexed.substitutions) {
+      const inner = scanCommand(body, { cwd, home: ctx.home, depth: ctx.depth + 1 });
+      if (inner.rmHits.length > 0 || inner.refusals.length > 0 || inner.handoffHits.length > 0 || inner.protectedHits.length > 0) {
+        result.refusals.push({
+          reason: "This command runs a delete inside a command substitution `$(\u2026)`, which this hook cannot rewrite. Run the delete as a separate `rm -- <path>` command, which is redirected into trash."
+        });
+        break;
+      }
+    }
+  } else if (lexed.substitutions.some((body) => mentionsDeleteVerb(body))) {
+    result.refusals.push({
+      reason: "This command nests a delete inside command substitutions deeper than this hook will follow. Run the delete as a separate `rm -- <path>` command."
+    });
+  }
+  return result;
+}
+function segmentText(segment) {
+  return segment.words.map((word) => word.text).join(" ");
+}
+function gitSubcommand(segment, verbIndex) {
+  let index = verbIndex + 1;
+  while (index < segment.words.length) {
+    const option = decodeWord(segment.words[index].text);
+    if (!option.startsWith("-"))
+      return option;
+    index++;
+    if (GIT_VALUE_OPTIONS.has(option))
+      index++;
+  }
+  return null;
+}
+function gitRmIsNonDeleting(segment, verbIndex) {
+  const options = segment.words.slice(verbIndex + 1).map((word) => decodeWord(word.text));
+  if (options.includes("--cached"))
+    return true;
+  return gitHasDryRun(segment, verbIndex);
+}
+function gitHasDryRun(segment, verbIndex) {
+  const options = segment.words.slice(verbIndex + 1).map((word) => decodeWord(word.text));
+  return options.includes("-n") || options.includes("--dry-run");
+}
+function findTrashBinary(env = process.env) {
+  const pathValue = env.PATH ?? "";
+  const deadline = Date.now() + 2000;
+  for (const dir of pathValue.split(":").slice(0, 64)) {
+    if (!isAbsolute(dir) || Date.now() >= deadline)
+      continue;
+    const candidate = resolve(dir, "trash");
+    try {
+      const stat = statSync(candidate);
+      if (!stat.isFile() || (stat.mode & 73) === 0 || (stat.mode & 18) !== 0)
+        continue;
+      const executable = realpathSync(candidate);
+      const packageRoot = resolve(dirname(executable), "../..");
+      const manifestPath = join(packageRoot, "package.json");
+      const manifestStat = statSync(manifestPath);
+      if (!manifestStat.isFile() || manifestStat.size > 16384 || (manifestStat.mode & 18) !== 0)
+        continue;
+      const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+      if (manifest.name !== "@hasna/trash" || typeof manifest.version !== "string" || typeof manifest.bin?.trash !== "string" || realpathSync(resolve(packageRoot, manifest.bin.trash)) !== executable)
+        continue;
+      const probe = spawnSync(candidate, ["--identity"], {
+        encoding: "utf8",
+        timeout: Math.max(1, Math.min(500, deadline - Date.now())),
+        maxBuffer: 2048,
+        env: { PATH: pathValue },
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      if (probe.error || probe.status !== 0)
+        continue;
+      const identity = JSON.parse(probe.stdout);
+      if (identity.name === "@hasna/trash" && identity.version === manifest.version && identity.guardProtocol === "hasna.trash.guard.v1")
+        return candidate;
+    } catch {}
+  }
+  return null;
+}
+function shellQuoteWord(word) {
+  if (/^[A-Za-z0-9_\-./+=:,@%^]+$/.test(word))
+    return word;
+  return `'${word.replace(/'/g, `'\\''`)}'`;
+}
+function rewriteCommand(command, hits, trashPath) {
+  const replacement = `${shellQuoteWord(trashPath)} guard`;
+  const ordered = [...hits].sort((a, b) => b.word.start - a.word.start);
+  let out = command;
+  for (const hit of ordered) {
+    out = `${out.slice(0, hit.word.start)}${replacement}${out.slice(hit.word.end)}`;
+  }
+  return out;
+}
+function rewriteIsComplete(original, rewritten, hits, cwd, home) {
+  if (!rewritten || rewritten === original)
+    return false;
+  if (hits.length === 0)
+    return false;
+  const verify = scanCommand(rewritten, { cwd, home });
+  if (!verify.trustworthy)
+    return false;
+  if (verify.rmHits.length > 0 || verify.handoffHits.length > 0)
+    return false;
+  return verify.refusals.length === 0;
+}
+function buildUpdatedInput(toolInput, command) {
+  const out = {};
+  for (const [key, value] of Object.entries(toolInput ?? {}))
+    out[key] = value;
+  out.command = command;
+  if (typeof out.description !== "string" || out.description.trim() === "") {
+    out.description = DEFAULT_DESCRIPTION;
+  }
+  if (typeof out.timeout !== "number" || !Number.isFinite(out.timeout) || out.timeout <= 0) {
+    out.timeout = DEFAULT_TIMEOUT_MS;
+  }
+  if (typeof out.run_in_background !== "boolean") {
+    out.run_in_background = false;
+  }
+  if ("dangerouslyDisableSandbox" in out && typeof out.dangerouslyDisableSandbox !== "boolean") {
+    delete out.dangerouslyDisableSandbox;
+  }
+  return out;
+}
+function updatedInputIsComplete(updated, original, hits, cwd, home) {
+  if (typeof updated.command !== "string" || updated.command.trim() === "")
+    return false;
+  if (typeof updated.description !== "string" || updated.description.trim() === "")
+    return false;
+  if (typeof updated.timeout !== "number" || !Number.isFinite(updated.timeout) || updated.timeout <= 0)
+    return false;
+  if (typeof updated.run_in_background !== "boolean")
+    return false;
+  if ("dangerouslyDisableSandbox" in updated && typeof updated.dangerouslyDisableSandbox !== "boolean")
+    return false;
+  return rewriteIsComplete(original, updated.command, hits, cwd, home);
+}
+function deny(reason) {
+  return {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: reason
+    }
+  };
+}
+function allowRewrite(updatedInput) {
+  return {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "allow",
+      updatedInput
+    }
+  };
+}
+function resolveTrash(deps) {
+  try {
+    return { path: deps.findTrash(), error: null };
+  } catch (cause) {
+    return { path: null, error: cause instanceof Error ? cause.message : String(cause) };
+  }
+}
+var ABSENT_REASON = "[trash-guard] No verified @hasna/trash guard was found on PATH. This deletion is refused. Install the current @hasna/trash package with Bun and run its setup; the operating-system trash utility is not a compatible guard.";
+function evaluate(input, deps) {
+  if (input.hook_event_name !== "PreToolUse")
+    return { continue: true };
+  if (["apply_patch", "ApplyPatch", "functions.apply_patch"].includes(input.tool_name ?? "")) {
+    const patch = input.tool_input?.command;
+    if (typeof patch !== "string")
+      return deny("[trash-guard] Unreadable patch input; deletion safety cannot be checked.");
+    if (/^\s*\*\*\* Delete File:/m.test(patch)) {
+      return deny("[trash-guard] Delete File would bypass recoverable deletion. First use `trash put -- <path>` or the trash_put MCP tool, then submit any remaining edits without the deletion block.");
+    }
+    return { continue: true };
+  }
+  if (input.tool_name !== "Bash")
+    return { continue: true };
+  const rawCommand = input.tool_input?.command;
+  if (typeof rawCommand !== "string") {
+    return deny("[trash-guard] The Bash tool call carried no readable `command`, so this hook cannot verify what would run. Refusing a call it cannot verify. Re-run the delete explicitly as `rm -- <path>` so it can be redirected into trash.");
+  }
+  const command = getCommand(input);
+  if (!command.trim())
+    return { continue: true };
+  const scanned = scanCommand(command, { cwd: deps.cwd, home: deps.home });
+  if (scanned.refusals.length > 0) {
+    return deny(`[trash-guard] ${scanned.refusals[0].reason}`);
+  }
+  if (scanned.protectedHits.length > 0) {
+    return deny(`[trash-guard] ${scanned.protectedHits[0].reason}`);
+  }
+  if (!scanned.trustworthy) {
+    return mentionsDeleteVerb(command) ? deny("[trash-guard] This command could not be parsed to the end (unterminated quote, substitution or here-document), so a delete inside it cannot be redirected. Re-run the delete as a plain `rm -- <path>` command.") : { continue: true };
+  }
+  if (scanned.rmHits.length === 0) {
+    if (scanned.handoffHits.length > 0) {
+      return { continue: true };
+    }
+    return { continue: true };
+  }
+  if (scanned.handoffHits.length > 0) {
+    return deny("[trash-guard] This command mixes a delete under the protected repo-checkout roots (owned by workspace-repos-guard) with a delete outside them, and a partial rewrite would leave one of them unredirected. Re-run them as separate commands, so each delete is handled by the hook that owns it.");
+  }
+  const trash = resolveTrash(deps);
+  if (trash.error !== null) {
+    return deny(`[trash-guard] The guard could not resolve the \`trash\` binary (${trash.error}), so this \`rm\` cannot be redirected into a recoverable delete \u2014 and an unrecoverable delete is never allowed, so the command is refused rather than run. Fix the environment (PATH, permissions) and re-run the same command.`);
+  }
+  if (trash.path === null) {
+    return deny(ABSENT_REASON);
+  }
+  const trashPath = trash.path;
+  const rewritten = rewriteCommand(command, scanned.rmHits, trashPath);
+  const updatedInput = buildUpdatedInput(input.tool_input, rewritten);
+  if (!updatedInputIsComplete(updatedInput, command, scanned.rmHits, deps.cwd, deps.home)) {
+    return deny("[trash-guard] The rewrite of this command did not verify (the delete could not be redirected cleanly), so the command is refused rather than run unredirected. Re-run the delete as a plain `rm -- <path>` command.");
+  }
+  return allowRewrite(updatedInput);
+}
+if (false) {}
+
+// hooks/hook-workspace-repos-guard/src/hook.ts
+import { homedir } from "os";
+import { isAbsolute as isAbsolute2, join as join2, normalize as normalize2, relative, resolve as resolve2, sep as sep2 } from "path";
+var FILE_WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
+var PATCH_TOOLS = new Set(["apply_patch", "ApplyPatch", "functions.apply_patch"]);
+var DEFAULT_ORGS = ["hasna", "hasnaxyz", "hasna-products"];
+var RULE = "workspace-repos-guard";
+function reposRoot(home) {
+  return join2(home, ".hasna", "repos", "clones");
+}
+function legacyRoot(home) {
+  return join2(home, "workspace", "repos");
+}
+function protectedRoots(home) {
+  return [reposRoot(home), legacyRoot(home)];
+}
+function resolveAllowedOrgs(env = process.env) {
+  const raw = env.WORKSPACE_REPOS_GUARD_ORGS;
+  if (typeof raw !== "string" || !raw.trim())
+    return new Set(DEFAULT_ORGS);
+  return new Set(raw.split(",").map((s) => s.trim()).filter(Boolean));
+}
+function classifyPath(target, root, orgs, op) {
+  if (op === "read")
+    return { blocked: false };
+  let rel = relative(root, target);
+  if (rel === "") {
+    if (op === "delete")
+      return { blocked: true, reason: `[${RULE}] delete of the protected repo-checkout root is forbidden: ${root}` };
+    return { blocked: true, reason: `[${RULE}] writes directly to the protected repo-checkout root are forbidden: ${root}` };
+  }
+  if (rel.startsWith(`..${sep2}`) || rel === ".." || isAbsolute2(rel)) {
+    return { blocked: false };
+  }
+  const segments = rel.split(sep2).filter(Boolean);
+  if (op === "delete") {
+    return { blocked: true, reason: `[${RULE}] delete under the protected repo-checkout root (${root}) is forbidden at any depth: ${target}` };
+  }
+  if (segments.length <= 1) {
+    return {
+      blocked: true,
+      reason: `[${RULE}] writing would create a top-level entry directly under the protected repo-checkout root (${root}); only GitHub-org folders belong there: ${target}`
+    };
+  }
+  const org = segments[0];
+  if (!orgs.has(org)) {
+    return {
+      blocked: true,
+      reason: `[${RULE}] '${org}' is not an allowed GitHub org under the protected repo-checkout root (${root}); allowed: ${[...orgs].join(", ")}: ${target}`
+    };
+  }
+  return { blocked: false };
+}
+var WRITE_FLAGS = /\b(?:-o|--output|-O|--output-document|-out)\b/;
+function segmentOperation(segment) {
+  const trimmed = segment.trim();
+  if (!trimmed)
+    return "read";
+  if (/(?:^|\s)(?:rm|rmdir|unlink|shred|trash|rmtree|del)(?:\s|$)/.test(trimmed))
+    return "delete";
+  if (/\bgit\b/.test(trimmed)) {
+    if (/\bgit\b[^;&|]*\b(?:clean|rm)\b/.test(trimmed))
+      return "delete";
+    if (/\bgit\b[^;&|]*\b(?:clone|init)\b/.test(trimmed))
+      return "write";
+    return "read";
+  }
+  if (/(?:^|\s)(?:mkdir|mkfile|touch|mv|cp|ln|tee|install|dd)(?:\s|$)/.test(trimmed))
+    return "write";
+  if (/\b(?:curl|wget)\b/.test(trimmed)) {
+    if (WRITE_FLAGS.test(trimmed))
+      return "write";
+    return "read";
+  }
+  if (/\bsed\b/.test(trimmed)) {
+    if (/(?:^|\s)-i\S*(?:\s|$)|--in-place(?:\s|$)/.test(trimmed))
+      return "write";
+  } else if (/\b(?:rsync|scp|truncate)\b/.test(trimmed)) {
+    return "write";
+  } else if (/(?:^|\s)(?:python3?|node|bun)\b[^;&|]*\s+-[ce](?:\s|$)/.test(trimmed)) {
+    return "write";
+  }
+  if (/(?:^|[;&|])\s*echo\b/.test(trimmed) || /[>&]/.test(trimmed))
+    return "write";
+  return "read";
+}
+function expandHomeSpelling2(token, home) {
+  let body = token.trim();
+  const quoted = body.match(/^(['"])([\s\S]*)\1$/);
+  if (quoted)
+    body = quoted[2];
+  body = body.replace(/^"*\$HOME"*\//, "$HOME/");
+  body = body.replace(/^"*\$\{HOME\}"*\//, "${HOME}/");
+  if (body === "~")
+    return home;
+  if (body.startsWith("~/"))
+    return join2(home, body.slice(2));
+  if (body === "$HOME" || body === "${HOME}")
+    return home;
+  if (body.startsWith("$HOME/"))
+    return join2(home, body.slice("$HOME/".length));
+  if (body.startsWith("${HOME}/"))
+    return join2(home, body.slice("${HOME}/".length));
+  const homeMatch = body.match(new RegExp(`^"*${regexEscape(home)}"*/`));
+  if (homeMatch)
+    return home + "/" + body.slice(homeMatch[0].length);
+  return token;
+}
+function unwrapSegment(segment) {
+  let s = segment.trim();
+  while (s.startsWith("(") || s.startsWith("{"))
+    s = s.slice(1).trim();
+  while (s.endsWith(")") || s.endsWith("}"))
+    s = s.slice(0, -1).trim();
+  return s;
+}
+function regexEscape(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function bashTargets(command, home, cwd) {
+  if (!command)
+    return [];
+  const roots = protectedRoots(home);
+  const segments = command.split(/\s*&&\s*|\s*\|\|\s*|;\s*|\n+/);
+  const targets = [];
+  let cwdUnderRepos = null;
+  for (const rawSegment of segments) {
+    const segment = unwrapSegment(rawSegment);
+    const op = segmentOperation(segment);
+    const cdMatch = segment.match(/(?:^|\s)cd(?:\s+(?:-[A-Za-z]+|--))*\s+([^\s;&|<>()\x60]+)/);
+    if (cdMatch) {
+      const cdTarget = expandHomeSpelling2(cdMatch[1], home);
+      if (cdTarget && roots.some((root) => cdTarget === root || cdTarget.startsWith(`${root}${sep2}`))) {
+        cwdUnderRepos = cdTarget;
+      }
+    }
+    const homeLiteral = regexEscape(home);
+    const suffix = roots.map((root) => regexEscape(root.slice(home.length + 1))).join("|");
+    const prefixRe = new RegExp(`(?:~|\\$HOME"*|\\$\\{HOME\\}"*|${homeLiteral}"*)/(?:${suffix})`);
+    const re = new RegExp(`(${prefixRe.source})([^\\s"';&|<>()\`]*|$)`, "g");
+    let m;
+    let foundExplicit = false;
+    while ((m = re.exec(segment)) !== null) {
+      foundExplicit = true;
+      const expanded = expandHomeSpelling2(m[0], home);
+      targets.push({ path: normalize2(expanded).replace(/\/+$/, ""), op });
+    }
+    if (!foundExplicit && (op === "delete" || op === "write")) {
+      const base = cwdUnderRepos ?? (roots.some((root) => cwd === root || cwd.startsWith(`${root}${sep2}`)) ? cwd : null);
+      if (base) {
+        const relMatch = segment.match(/(?:^|\s)(\.\.?|[^\s"';&|<>()\x60/]+(?:\/[^\s"';&|<>()\x60]*)?)\s*$/);
+        if (relMatch) {
+          targets.push({ path: normalize2(resolve2(base, relMatch[1])), op });
+        }
+      }
+    }
+  }
+  return targets;
+}
+var PATCH_FILE_RE = /^\s*\*\*\*\s+(Add File|Update File|Delete File):\s+(\S+)\s*$/gm;
+function patchTargets(patch, cwd) {
+  const targets = [];
+  let m;
+  while ((m = PATCH_FILE_RE.exec(patch)) !== null) {
+    const op = m[1] === "Delete File" ? "delete" : "write";
+    targets.push({ path: normalize2(resolve2(cwd, m[2])), op });
+  }
+  return targets;
+}
+function evaluate2(input) {
+  const warnings = [];
+  if (input.hook_event_name !== "PreToolUse")
+    return { output: { continue: true }, warnings };
+  const tool = typeof input.tool_name === "string" ? input.tool_name : "";
+  const home = homedir();
+  const roots = protectedRoots(home);
+  const orgs = resolveAllowedOrgs();
+  if (tool === "Bash") {
+    const command = getCommand(input);
+    if (!command)
+      return { output: { continue: true }, warnings };
+    const cwd2 = typeof input.cwd === "string" && input.cwd ? input.cwd : process.cwd();
+    const targets = bashTargets(command, home, cwd2);
+    for (const target2 of targets) {
+      for (const root of roots) {
+        const verdict = classifyPath(target2.path, root, orgs, target2.op);
+        if (verdict.blocked) {
+          return { output: { decision: "block", reason: verdict.reason }, warnings };
+        }
+      }
+    }
+    return { output: { continue: true }, warnings };
+  }
+  const toolInput = input.tool_input ?? {};
+  const cwd = typeof input.cwd === "string" && input.cwd ? input.cwd : process.cwd();
+  if (PATCH_TOOLS.has(tool)) {
+    const patch = typeof toolInput.patch === "string" ? toolInput.patch : "";
+    if (!patch)
+      return { output: { continue: true }, warnings };
+    const targets = patchTargets(patch, cwd);
+    for (const target2 of targets) {
+      for (const root of roots) {
+        const verdict = classifyPath(target2.path, root, orgs, target2.op);
+        if (verdict.blocked) {
+          return { output: { decision: "block", reason: verdict.reason }, warnings };
+        }
+      }
+    }
+    return { output: { continue: true }, warnings };
+  }
+  if (!FILE_WRITE_TOOLS.has(tool))
+    return { output: { continue: true }, warnings };
+  const raw = typeof toolInput.file_path === "string" ? toolInput.file_path : typeof toolInput.path === "string" ? toolInput.path : typeof toolInput.notebook_path === "string" ? toolInput.notebook_path : null;
+  if (!raw)
+    return { output: { continue: true }, warnings };
+  const expanded = expandHomeSpelling2(raw, home);
+  const target = isAbsolute2(expanded) ? normalize2(expanded) : resolve2(cwd, expanded);
+  for (const root of roots) {
+    const verdict = classifyPath(target, root, orgs, "write");
+    if (verdict.blocked) {
+      return { output: { decision: "block", reason: verdict.reason }, warnings };
+    }
+  }
+  return { output: { continue: true }, warnings };
+}
+if (false) {}
+
+// hooks/native-safety-entry.ts
+var name = process.argv[1];
+if (name !== "trash-guard" && name !== "workspace-repos-guard")
+  throw new Error("Invalid safety capability");
+var input = JSON.parse(await Bun.stdin.text());
+if (!input || Array.isArray(input) || input.hook_event_name !== "PreToolUse" || typeof input.tool_name !== "string" || !input.tool_input || typeof input.tool_input !== "object" || Array.isArray(input.tool_input) || typeof input.cwd !== "string" || !isAbsolute3(input.cwd))
+  throw new Error("Invalid safety input");
+if (input.tool_name === "Bash" && typeof input.tool_input.command !== "string")
+  throw new Error("Invalid shell input");
+if (["apply_patch", "ApplyPatch", "functions.apply_patch"].includes(input.tool_name)) {
+  if (input.tool_input.command !== undefined && input.tool_input.patch !== undefined && input.tool_input.command !== input.tool_input.patch)
+    throw new Error("Conflicting patch aliases");
+  const patch = input.tool_input.command ?? input.tool_input.patch;
+  if (typeof patch !== "string")
+    throw new Error("Invalid patch input");
+  input.tool_input = { ...input.tool_input, command: patch, patch };
+}
+var repos = evaluate2(input).output;
+var handoff = input.tool_name === "Bash" && scanCommand(input.tool_input.command, { home: homedir2(), cwd: input.cwd }).handoffHits.length > 0;
+var verdict = repos.decision === "block" ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: repos.reason } } : handoff ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "[workspace-repos-guard] Deletion under a protected repository checkout is refused." } } : name === "trash-guard" ? evaluate(input, { home: homedir2(), cwd: input.cwd, findTrash: findTrashBinary }) : { continue: true };
+process.stdout.write(JSON.stringify({ verdict: "continue" in verdict ? null : verdict }));