@hasna/hooks 0.9.5 → 0.9.6

package/bin/serve.js

@@ -174,6 +174,7 @@ var HOOKS = [
   },
   {
     name: "workspace-repos-guard",
+    timeoutSeconds: 10,
     displayName: "Workspace Repos Guard",
     description: "Blocks writes and deletes that break the protected repo-checkout structure (~/.hasna/repos/clones canonical, plus legacy ~/workspace/repos during the migration window): writes to a protected root, top-level entry creation, non-org folders, and any delete under a protected root",
     version: "0.1.0",
@@ -192,7 +193,7 @@ var HOOKS = [
     matcher: "^(Bash|apply_patch|ApplyPatch|functions\\.apply_patch)$",
     tags: ["rm", "delete", "trash", "recoverable", "guard", "safety", "bash"],
     rewritesInput: true,
-    timeoutSeconds: 5
+    timeoutSeconds: 10
   },
   {
     name: "checktests",
@@ -6112,155 +6113,356 @@ function secureEqual(a, b) {
 }
 
 // src/openapi.ts
-var openApiDocument = {
-  openapi: "3.1.0",
-  info: {
-    title: "Hooks Registry API",
-    version: "0.1.0",
-    description: "Local registry HTTP API for @hasna/hooks: catalog, lock, and artifact reads are open; publishing (PUT /api/v1/hooks) requires the API key (authorization: Bearer or x-api-key)."
-  },
-  servers: [{ url: "/" }],
-  paths: {
-    "/health": {
-      get: {
-        summary: "Liveness probe",
-        operationId: "getHealth",
-        responses: {
-          "200": {
-            description: "Service is alive",
-            content: {
-              "application/json": {
-                schema: { type: "object", additionalProperties: true }
+function buildOpenApiDocument(version) {
+  return {
+    openapi: "3.1.0",
+    info: {
+      title: "Hooks Registry API",
+      version,
+      description: "Local registry HTTP API for @hasna/hooks: catalog, lock, and artifact reads are open; publishing (PUT /api/v1/hooks) requires the API key (authorization: Bearer or x-api-key)."
+    },
+    servers: [{ url: "/" }],
+    paths: {
+      "/health": {
+        get: {
+          summary: "Liveness probe",
+          operationId: "getHealth",
+          responses: {
+            "200": {
+              description: "Service is alive",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksHealth" }
+                }
               }
             }
           }
         }
-      }
-    },
-    "/ready": {
-      get: {
-        summary: "Readiness probe \u2014 the hooks.lock store is readable",
-        operationId: "getReady",
-        responses: {
-          "200": { description: "Lock store is readable" },
-          "503": { description: "Lock store is not readable" }
+      },
+      "/ready": {
+        get: {
+          summary: "Readiness probe \u2014 the hooks.lock store is readable",
+          operationId: "getReady",
+          responses: {
+            "200": {
+              description: "Lock store is readable",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksHealth" }
+                }
+              }
+            },
+            "503": {
+              description: "Lock store is not readable",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksHealth" }
+                }
+              }
+            }
+          }
         }
-      }
-    },
-    "/version": {
-      get: {
-        summary: "Package version",
-        operationId: "getVersion",
-        responses: {
-          "200": {
-            description: "The installed @hasna/hooks version",
-            content: {
-              "application/json": {
-                schema: { type: "object", properties: { version: { type: "string" } } }
+      },
+      "/version": {
+        get: {
+          summary: "Package version",
+          operationId: "getVersion",
+          responses: {
+            "200": {
+              description: "The installed @hasna/hooks version",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksVersion" }
+                }
               }
             }
           }
         }
-      }
-    },
-    "/openapi.json": {
-      get: {
-        summary: "This OpenAPI document",
-        operationId: "getOpenApi",
-        responses: { "200": { description: "OpenAPI 3.1 document" } }
-      }
-    },
-    "/api/v1/catalog": {
-      get: {
-        summary: "List the full hook catalog with versions and sha256",
-        operationId: "getCatalog",
-        responses: {
-          "200": {
-            description: "Catalog entries",
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  properties: {
-                    hooks: {
-                      type: "array",
-                      items: {
-                        type: "object",
-                        properties: {
-                          name: { type: "string" },
-                          version: { type: "string" },
-                          sha256: { type: "string" },
-                          events: { type: "array", items: { type: "string" } }
-                        }
-                      }
-                    }
-                  }
+      },
+      "/openapi.json": {
+        get: {
+          summary: "This OpenAPI document",
+          operationId: "getOpenApi",
+          responses: {
+            "200": {
+              description: "OpenAPI 3.1 document",
+              content: {
+                "application/json": {
+                  schema: { type: "object", additionalProperties: true }
                 }
               }
             }
           }
         }
-      }
-    },
-    "/api/v1/lock": {
-      get: {
-        summary: "Read the published hooks.lock with per-hook versions",
-        operationId: "getLock",
-        responses: { "200": { description: "The lock file" } }
-      }
-    },
-    "/api/v1/hooks/{name}/{version}": {
-      get: {
-        summary: "Fetch one hook's manifest and script",
-        operationId: "getHookArtifact",
-        parameters: [
-          { name: "name", in: "path", required: true, schema: { type: "string" } },
-          { name: "version", in: "path", required: true, schema: { type: "string" } }
-        ],
-        responses: {
-          "200": {
-            description: "Hook artifact; x-hook-sha256 header carries the script hash"
+      },
+      "/api/v1/catalog": {
+        get: {
+          summary: "List the full hook catalog with versions and sha256",
+          operationId: "getCatalog",
+          responses: {
+            "200": {
+              description: "Catalog entries",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksCatalog" }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/api/v1/lock": {
+        get: {
+          summary: "Read the published hooks.lock with per-hook versions",
+          operationId: "getLock",
+          responses: {
+            "200": {
+              description: "The lock file",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksLock" }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/api/v1/hooks/{name}/{version}": {
+        get: {
+          summary: "Fetch one hook's manifest and script",
+          operationId: "getHookArtifact",
+          parameters: [
+            { name: "name", in: "path", required: true, schema: { type: "string" } },
+            { name: "version", in: "path", required: true, schema: { type: "string" } }
+          ],
+          responses: {
+            "200": {
+              description: "Hook artifact; x-hook-sha256 header carries the script hash",
+              headers: {
+                "x-hook-sha256": {
+                  description: "sha256 of the served script, the same value the lock pins",
+                  schema: { type: "string" }
+                }
+              },
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksArtifact" }
+                }
+              }
+            },
+            "400": {
+              description: "Invalid URL encoding or semver version",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
+            },
+            "404": {
+              description: "Hook not found locally",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/api/v1/hooks": {
+        put: {
+          summary: "Publish/retrust a hook (requires the API key)",
+          operationId: "putHook",
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/HooksPublishRequest" }
+              }
+            }
+          },
+          responses: {
+            "200": {
+              description: "Hook retrusted and pin updated",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksPublishResponse" }
+                }
+              }
+            },
+            "400": {
+              description: "Invalid JSON body",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
+            },
+            "401": {
+              description: "Missing or invalid API key",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
+            },
+            "404": {
+              description: "Hook not found in local store",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
+            },
+            "409": {
+              description: "Version mismatch with the local store",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
+            }
           },
-          "400": { description: "Invalid URL encoding or semver version" },
-          "404": { description: "Hook not found locally" }
+          security: [{ apiKey: [] }]
         }
       }
     },
-    "/api/v1/hooks": {
-      put: {
-        summary: "Publish/retrust a hook (requires the API key)",
-        operationId: "putHook",
-        requestBody: {
-          required: true,
-          content: {
-            "application/json": {
-              schema: {
-                type: "object",
-                properties: { name: { type: "string" }, version: { type: "string" } }
-              }
+    components: {
+      securitySchemes: {
+        apiKey: {
+          type: "http",
+          scheme: "bearer",
+          description: "The registry API key \u2014 resolved by the client through the @hasna/contracts chain (HASNA_HOOKS_API_KEY, the Keychain item hasna.credentials.hooks.api-key, or ~/.hasna/hooks/config/credentials); the server compares the inbound bearer/x-api-key value."
+        }
+      },
+      schemas: {
+        HooksHealth: {
+          type: "object",
+          additionalProperties: false,
+          required: ["status", "name"],
+          properties: {
+            status: { type: "string" },
+            name: { type: "string" }
+          }
+        },
+        HooksVersion: {
+          type: "object",
+          additionalProperties: false,
+          required: ["version"],
+          properties: { version: { type: "string" } }
+        },
+        HooksCatalogEntry: {
+          type: "object",
+          additionalProperties: false,
+          required: ["name", "version", "sha256", "events", "description", "source", "versions"],
+          properties: {
+            name: { type: "string" },
+            version: { type: "string" },
+            sha256: { type: "string" },
+            events: { type: "array", items: { type: "string" } },
+            description: { type: "string" },
+            source: {
+              type: "string",
+              description: "bundled | custom | custom-overrides-bundled"
+            },
+            versions: { type: "array", items: { type: "string" } }
+          }
+        },
+        HooksCatalog: {
+          type: "object",
+          additionalProperties: false,
+          required: ["hooks"],
+          properties: {
+            hooks: { type: "array", items: { $ref: "#/components/schemas/HooksCatalogEntry" } }
+          }
+        },
+        HooksLockEntry: {
+          type: "object",
+          additionalProperties: false,
+          required: ["version", "sha256", "source"],
+          properties: {
+            version: { type: "string" },
+            sha256: { type: "string" },
+            source: { type: "string" },
+            pinned: {
+              type: "boolean",
+              description: "True for an explicit install/update pin, absent for sync-maintained pins."
+            },
+            versions: { type: "array", items: { type: "string" } }
+          }
+        },
+        HooksLock: {
+          type: "object",
+          additionalProperties: false,
+          required: ["hooks"],
+          properties: {
+            hooks: {
+              type: "object",
+              additionalProperties: { $ref: "#/components/schemas/HooksLockEntry" }
             }
           }
         },
-        responses: {
-          "200": { description: "Hook retrusted and pin updated" },
-          "401": { description: "Missing or invalid API key" },
-          "404": { description: "Hook not found in local store" },
-          "409": { description: "Version mismatch with the local store" }
+        HooksManifest: {
+          type: "object",
+          additionalProperties: false,
+          required: ["name", "version", "events", "script"],
+          properties: {
+            name: { type: "string" },
+            version: { type: "string" },
+            description: { type: "string" },
+            events: { type: "array", items: { type: "string" } },
+            script: { type: "string" },
+            script_kind: { type: "string", enum: ["inline", "file"] },
+            args: { type: "array", items: { type: "string" } },
+            timeout_ms: { type: "number" }
+          }
         },
-        security: [{ apiKey: [] }]
-      }
-    }
-  },
-  components: {
-    securitySchemes: {
-      apiKey: {
-        type: "http",
-        scheme: "bearer",
-        description: "The registry API key \u2014 resolved by the client through the @hasna/contracts chain (HASNA_HOOKS_API_KEY, the Keychain item hasna.credentials.hooks.api-key, or ~/.hasna/hooks/config/credentials); the server compares the inbound bearer/x-api-key value."
+        HooksArtifact: {
+          type: "object",
+          additionalProperties: false,
+          required: ["manifest", "script"],
+          properties: {
+            manifest: { $ref: "#/components/schemas/HooksManifest" },
+            script: { type: "string" }
+          }
+        },
+        HooksError: {
+          type: "object",
+          additionalProperties: false,
+          required: ["error"],
+          properties: { error: { type: "string" } }
+        },
+        HooksPublishRequest: {
+          type: "object",
+          additionalProperties: false,
+          required: ["name"],
+          properties: {
+            name: { type: "string" },
+            version: { type: "string" }
+          }
+        },
+        HooksPublishResponse: {
+          type: "object",
+          additionalProperties: false,
+          required: ["ok", "hook"],
+          properties: {
+            ok: { type: "boolean" },
+            hook: {
+              type: "object",
+              additionalProperties: false,
+              required: ["name", "version", "sha256"],
+              properties: {
+                name: { type: "string" },
+                version: { type: "string" },
+                sha256: { type: "string" }
+              }
+            }
+          }
+        }
       }
     }
-  }
-};
+  };
+}
 
 // src/serve.ts
 var DEFAULT_SERVE_PORT = 39428;
@@ -6358,7 +6560,7 @@ function handleServeRequest(req, apiKey) {
     return Promise.resolve(json({ version: packageVersion() }));
   }
   if (url.pathname === "/openapi.json" && req.method === "GET") {
-    return Promise.resolve(json(openApiDocument));
+    return Promise.resolve(json(buildOpenApiDocument(packageVersion())));
   }
   if (url.pathname === "/api/v1/catalog" && req.method === "GET") {
     return buildCatalog().then((catalog) => json({ hooks: catalog }));