@hasna/hooks 0.9.5 → 0.9.6

package/dist/index.js

@@ -4762,12 +4762,12 @@ __export(exports_store, {
   checkScriptHash: () => checkScriptHash,
   LockFileError: () => LockFileError
 });
-import { createHash } from "crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2, renameSync } from "fs";
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2, renameSync } from "fs";
 import { readFile } from "fs/promises";
 import { randomBytes } from "crypto";
 function sha256Of(input) {
-  return createHash("sha256").update(input).digest("hex");
+  return createHash2("sha256").update(input).digest("hex");
 }
 async function sha256File(path) {
   const buf = await readFile(path);
@@ -4828,11 +4828,11 @@ function assertLockShape(parsed, path) {
 }
 function readLock() {
   const path = getLockPath();
-  if (!existsSync6(path))
+  if (!existsSync7(path))
     return { hooks: {} };
   let raw;
   try {
-    raw = readFileSync3(path, "utf-8");
+    raw = readFileSync4(path, "utf-8");
   } catch {
     throw new LockFileError(`hooks.lock (${path}) could not be read. Repair: fix permissions or move the file aside and run 'hooks sync'.`);
   }
@@ -4935,7 +4935,7 @@ async function verifyScriptHash(name, scriptPath) {
   return checkScriptHash(name, await sha256File(scriptPath));
 }
 function retrustHook(name, scriptPath, version, source) {
-  const actual = sha256Of(readFileSync3(scriptPath));
+  const actual = sha256Of(readFileSync4(scriptPath));
   const db = storeDb();
   if (db) {
     upsertHookRecord(db, {
@@ -4974,12 +4974,12 @@ __export(exports_profiles, {
   deleteProfile: () => deleteProfile,
   createProfile: () => createProfile
 });
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5, readdirSync as readdirSync4, rmSync, cpSync as cpSync2 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync5, readdirSync as readdirSync4, rmSync, cpSync as cpSync2 } from "fs";
+import { join as join9 } from "path";
 function getProfilesDir() {
-  const newDir = join8(getEffectiveDataRoot(), "profiles");
-  const oldDir = join8(getHomeDir(), ".hooks", "profiles");
-  if (!existsSync9(newDir) && existsSync9(oldDir)) {
+  const newDir = join9(getEffectiveDataRoot(), "profiles");
+  const oldDir = join9(getHomeDir(), ".hooks", "profiles");
+  if (!existsSync10(newDir) && existsSync10(oldDir)) {
     mkdirSync6(newDir, { recursive: true });
     cpSync2(oldDir, newDir, { recursive: true });
   }
@@ -4987,12 +4987,12 @@ function getProfilesDir() {
 }
 function ensureProfilesDir() {
   const dir = getProfilesDir();
-  if (!existsSync9(dir)) {
+  if (!existsSync10(dir)) {
     mkdirSync6(dir, { recursive: true });
   }
 }
 function profilePath(id) {
-  return join8(getProfilesDir(), `${id}.json`);
+  return join9(getProfilesDir(), `${id}.json`);
 }
 function shortUuid() {
   return crypto.randomUUID().slice(0, 8);
@@ -5018,23 +5018,23 @@ function createProfile(input) {
 function getProfile(id) {
   const path = profilePath(id);
   try {
-    if (!existsSync9(path))
+    if (!existsSync10(path))
       return null;
-    return JSON.parse(readFileSync6(path, "utf-8"));
+    return JSON.parse(readFileSync7(path, "utf-8"));
   } catch {
     return null;
   }
 }
 function listProfiles() {
   const dir = getProfilesDir();
-  if (!existsSync9(dir))
+  if (!existsSync10(dir))
     return [];
   try {
     const files = readdirSync4(dir).filter((f) => f.endsWith(".json"));
     const profiles = [];
     for (const file of files) {
       try {
-        const content = readFileSync6(join8(dir, file), "utf-8");
+        const content = readFileSync7(join9(dir, file), "utf-8");
         profiles.push(JSON.parse(content));
       } catch {}
     }
@@ -5057,7 +5057,7 @@ function updateProfile(id, data) {
 }
 function deleteProfile(id) {
   const path = profilePath(id);
-  if (!existsSync9(path))
+  if (!existsSync10(path))
     return false;
   try {
     rmSync(path);
@@ -5087,7 +5087,7 @@ function importProfiles(profiles) {
       continue;
     }
     const path = profilePath(profile.agent_id);
-    if (existsSync9(path)) {
+    if (existsSync10(path)) {
       skipped++;
       continue;
     }
@@ -5104,15 +5104,15 @@ var init_profiles = __esm(() => {
 // ../contracts/dist/client/transport.js
 import { isIP } from "net";
 import { spawnSync } from "child_process";
-import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync22 } from "fs";
+import { closeSync as closeSync22, fstatSync as fstatSync2, openSync as openSync22, readFileSync as readFileSync22 } from "fs";
 import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";
 import { hostname as osHostname } from "os";
-import { isAbsolute as isAbsolute2, join as join22 } from "path";
+import { isAbsolute as isAbsolute3, join as join22 } from "path";
 import { createRequire } from "module";
 import { fileURLToPath as fileURLToPath22 } from "url";
-import { closeSync as closeSync3, fstatSync, lstatSync as lstatSync2, openSync as openSync3, readFileSync as readFileSync7, realpathSync as realpathSync2, statSync } from "fs";
+import { closeSync as closeSync3, fstatSync as fstatSync3, lstatSync as lstatSync3, openSync as openSync3, readFileSync as readFileSync8, realpathSync as realpathSync3, statSync } from "fs";
 import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
-import { basename as basename2, dirname as dirname5, join as join9, relative, sep as sep2 } from "path";
+import { basename as basename2, dirname as dirname6, join as join10, relative, sep as sep2 } from "path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL } from "url";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
@@ -5186,14 +5186,14 @@ function o(e2, r2, t2) {
   }
 }
 function entryPoint(directory) {
-  const root = realpathSync2(directory);
-  const fd = openSync3(join9(root, "package.json"), O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+  const root = realpathSync3(directory);
+  const fd = openSync3(join10(root, "package.json"), O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
   let pkg;
   try {
-    const stat = fstatSync(fd);
+    const stat = fstatSync3(fd);
     if (!stat.isFile() || stat.size > MAX_PACKAGE_BYTES)
       throw new Error("Invalid Secrets package metadata");
-    pkg = JSON.parse(readFileSync7(fd, "utf8"));
+    pkg = JSON.parse(readFileSync8(fd, "utf8"));
   } finally {
     closeSync3(fd);
   }
@@ -5207,7 +5207,7 @@ function entryPoint(directory) {
   if (/[\\%?#\0]/.test(target) || parts.some((part) => !part || part === "." || part === ".." || part === "node_modules")) {
     throw new Error("Invalid Secrets import export");
   }
-  const file = realpathSync2(join9(root, ...parts));
+  const file = realpathSync3(join10(root, ...parts));
   const within = relative(root, file);
   if (!within || within === ".." || within.startsWith(`..${sep2}`) || !statSync(file).isFile()) {
     throw new Error("Secrets import export escapes its package or is not a file");
@@ -5215,13 +5215,13 @@ function entryPoint(directory) {
   return pathToFileURL(file).href;
 }
 function resolveInstalledSecrets(parentUrl) {
-  let directory = dirname5(fileURLToPath3(parentUrl));
+  let directory = dirname6(fileURLToPath3(parentUrl));
   for (;; ) {
     if (basename2(directory) !== "node_modules") {
-      const candidate = join9(directory, "node_modules", PACKAGE);
+      const candidate = join10(directory, "node_modules", PACKAGE);
       let absent = false;
       try {
-        lstatSync2(candidate);
+        lstatSync3(candidate);
       } catch (error) {
         if (error.code !== "ENOENT")
           throw error;
@@ -5230,7 +5230,7 @@ function resolveInstalledSecrets(parentUrl) {
       if (!absent)
         return entryPoint(candidate);
     }
-    const parent = dirname5(directory);
+    const parent = dirname6(directory);
     if (parent === directory)
       throw new Error("Secrets SDK is not installed for this consumer");
     directory = parent;
@@ -5242,7 +5242,7 @@ function homeDir(env) {
 }
 function absoluteOverride(env, key) {
   const value = env[key]?.trim();
-  return value && isAbsolute2(value) ? value : null;
+  return value && isAbsolute3(value) ? value : null;
 }
 function hasnaHomeDir(env) {
   const override = absoluteOverride(env, HASNA_HOME_ENV_KEY);
@@ -5288,9 +5288,9 @@ function parseEnvFile(text) {
     if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
       continue;
     let value = withoutExport.slice(equals + 1).trim();
-    const quote = value[0];
-    if (quote === '"' || quote === "'") {
-      if (value.length < 2 || !value.endsWith(quote)) {
+    const quote2 = value[0];
+    if (quote2 === '"' || quote2 === "'") {
+      if (value.length < 2 || !value.endsWith(quote2)) {
         unusable.add(key);
         continue;
       }
@@ -5319,7 +5319,7 @@ function readAppConfigFile(path) {
   };
   let fd = -1;
   try {
-    fd = openSync2(path, O_RDONLY2 | O_NOFOLLOW2 | O_NONBLOCK2);
+    fd = openSync22(path, O_RDONLY2 | O_NOFOLLOW2 | O_NONBLOCK2);
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT" || code === "ENOTDIR")
@@ -5348,7 +5348,7 @@ function readAppConfigFile(path) {
     return parseEnvFile(bytes.toString("utf8"));
   } finally {
     if (fd !== -1)
-      closeSync2(fd);
+      closeSync22(fd);
   }
 }
 function readCredentialFile(path, apiKeyKeys, pointerKey) {
@@ -6202,12 +6202,12 @@ var init_db_writer = __esm(() => {
 });
 
 // src/lib/hook-env.ts
-import { dirname as dirname7, isAbsolute as isAbsolute3 } from "path";
-import { existsSync as existsSync11, realpathSync as realpathSync3, statSync as statSync2 } from "fs";
+import { dirname as dirname8, isAbsolute as isAbsolute4 } from "path";
+import { existsSync as existsSync12, realpathSync as realpathSync4, statSync as statSync2 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 function isDeniedEnvName(name) {
   const upper = name.toUpperCase();
-  if (DENY_PREFIXES.some((prefix) => upper.startsWith(prefix)))
+  if (DENY_PREFIXES.some((prefix2) => upper.startsWith(prefix2)))
     return true;
   if (DENY_SUFFIXES.some((suffix) => upper.endsWith(suffix)))
     return true;
@@ -6216,13 +6216,13 @@ function isDeniedEnvName(name) {
 function isInterpreterInjectionEnvName(name) {
   if (INTERPRETER_INJECTION.has(name))
     return true;
-  return INTERPRETER_INJECTION_PREFIXES.some((prefix) => name.startsWith(prefix));
+  return INTERPRETER_INJECTION_PREFIXES.some((prefix2) => name.startsWith(prefix2));
 }
 function isBashFunctionEnvName(name) {
   return name.startsWith("BASH_FUNC_");
 }
 function isUnsafePathEntry(entry, home) {
-  if (entry === "" || !isAbsolute3(entry))
+  if (entry === "" || !isAbsolute4(entry))
     return true;
   if (home && (entry === home || entry.startsWith(home + "/")))
     return true;
@@ -6232,7 +6232,7 @@ function isUnsafePathEntry(entry, home) {
     return true;
   const canonical = (path) => {
     try {
-      return realpathSync3(path);
+      return realpathSync4(path);
     } catch {
       return path;
     }
@@ -6251,9 +6251,9 @@ function isUnsafePathEntry(entry, home) {
 }
 function sanitizeHookPath(pathValue, home) {
   const baseline = PATH_BASELINE.slice();
-  if (process.platform === "darwin" && existsSync11("/opt/homebrew/bin"))
+  if (process.platform === "darwin" && existsSync12("/opt/homebrew/bin"))
     baseline.push("/opt/homebrew/bin");
-  const bunDir = dirname7(process.execPath);
+  const bunDir = dirname8(process.execPath);
   const seen = new Set;
   const out = [];
   for (const dir of baseline) {
@@ -6378,7 +6378,7 @@ __export(exports_run, {
 });
 import { randomBytes as randomBytes2 } from "crypto";
 import { rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename3, dirname as dirname8, isAbsolute as isAbsolute4, join as join12 } from "path";
+import { basename as basename3, dirname as dirname9, isAbsolute as isAbsolute5, join as join13 } from "path";
 function extensionOf(scriptPath) {
   const base = basename3(scriptPath);
   const dot = base.lastIndexOf(".");
@@ -6447,9 +6447,9 @@ async function readPipeWithDeadline(stream, deadlineMs) {
   return chunks.join("");
 }
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname8(options.scriptPath);
+  const scriptDir = dirname9(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
-  const tempPath = join12(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
+  const tempPath = join13(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
   let timedOut = false;
   const timeoutTimer = options.timeout ? setTimeout(() => {
@@ -6458,7 +6458,7 @@ async function executeVerifiedScript(options) {
   }, options.timeout) : null;
   try {
     writeFileSync6(tempPath, options.content, { flag: "wx", mode: 384 });
-    proc = Bun.spawn([...interpreter.command, isAbsolute4(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
+    proc = Bun.spawn([...interpreter.command, isAbsolute5(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
       stdin: new Response(options.stdin),
       stdout: "pipe",
       stderr: "pipe",
@@ -7034,6 +7034,7 @@ var HOOKS = [
   },
   {
     name: "workspace-repos-guard",
+    timeoutSeconds: 10,
     displayName: "Workspace Repos Guard",
     description: "Blocks writes and deletes that break the protected repo-checkout structure (~/.hasna/repos/clones canonical, plus legacy ~/workspace/repos during the migration window): writes to a protected root, top-level entry creation, non-org folders, and any delete under a protected root",
     version: "0.1.0",
@@ -7052,7 +7053,7 @@ var HOOKS = [
     matcher: "^(Bash|apply_patch|ApplyPatch|functions\\.apply_patch)$",
     tags: ["rm", "delete", "trash", "recoverable", "guard", "safety", "bash"],
     rewritesInput: true,
-    timeoutSeconds: 5
+    timeoutSeconds: 10
   },
   {
     name: "checktests",
@@ -7541,9 +7542,9 @@ function getHook(name) {
   return HOOKS.find((h) => h.name === name);
 }
 // src/lib/installer.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync5, readdirSync as readdirSync3, rmdirSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
-import { join as join7, dirname as dirname4 } from "path";
-import { homedir as homedir3 } from "os";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync6, readdirSync as readdirSync3, rmdirSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
+import { join as join8, dirname as dirname5 } from "path";
+import { homedir as homedir4 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/lib/resolve.ts
@@ -7634,6 +7635,137 @@ function resolveHook(name) {
 // src/lib/installer.ts
 init_manifest();
 
+// src/lib/native-safety.ts
+import { createHash } from "crypto";
+import { closeSync, constants, existsSync as existsSync6, fstatSync, lstatSync, openSync, readFileSync as readFileSync3, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join7 } from "path";
+import { homedir as homedir3 } from "os";
+function isNativeSafetyName(name) {
+  return name === "trash-guard" || name === "workspace-repos-guard";
+}
+var supervisorSource = String.raw`async function supervise(encoded) {
+  const fs = require("node:fs");
+  const path = require("node:path");
+  const crypto = require("node:crypto");
+  const cp = require("node:child_process");
+  const fail = () => { process.stderr.write("Native safety guard refused: verification or execution failed.\n"); process.exit(2); };
+  try {
+    const b = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    const check = (file, hash, maximum) => {
+      if (!path.isAbsolute(file) || fs.realpathSync(file) !== file) throw Error();
+      for (let parent = path.dirname(file);;) {
+        const s = fs.lstatSync(parent);
+        if (!s.isDirectory() || ![0, process.getuid()].includes(s.uid) || (s.mode & 0o022)) throw Error();
+        if (parent === path.dirname(parent)) break;
+        parent = path.dirname(parent);
+      }
+      const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+      try {
+        const s = fs.fstatSync(fd);
+        if (!s.isFile() || ![0, process.getuid()].includes(s.uid) || (s.mode & 0o022) || s.size > maximum) throw Error();
+        const bytes = fs.readFileSync(fd);
+        if (crypto.createHash("sha256").update(bytes).digest("hex") !== hash) throw Error();
+        return bytes;
+      } finally { fs.closeSync(fd); }
+    };
+    check(b.runtime, b.runtimeSHA256, 200_000_000);
+    const bytes = check(b.worker, b.workerSHA256, 256_000);
+    const deadline = setTimeout(fail, 1500);
+    const chunks = []; let size = 0;
+    for await (const chunk of process.stdin) {
+      size += chunk.length;
+      if (size > 1_048_576) throw Error();
+      chunks.push(chunk);
+    }
+    clearTimeout(deadline);
+    const input = Buffer.concat(chunks);
+    const child = cp.spawnSync(b.runtime, ["--config=/dev/null", "--no-env-file", "--no-macros", "--no-install", "--eval", bytes.toString("utf8"), b.name], {
+      input, env: { HOME: b.home, PATH: b.path }, cwd: "/", timeout: 2500, killSignal: "SIGKILL", maxBuffer: 1_048_576,
+    });
+    if (child.error || child.status !== 0 || child.signal || child.stderr.length) throw Error();
+    const result = JSON.parse(child.stdout.toString("utf8"));
+    if (!result || Array.isArray(result) || Object.keys(result).length !== 1) throw Error();
+    if (result.verdict === null) return;
+    const output = result.verdict?.hookSpecificOutput;
+    if (!output || Object.keys(result.verdict).length !== 1 || output.hookEventName !== "PreToolUse") throw Error();
+    if (output.permissionDecision === "deny") {
+      if (Object.keys(output).sort().join() !== "hookEventName,permissionDecision,permissionDecisionReason" || typeof output.permissionDecisionReason !== "string" || !output.permissionDecisionReason.trim()) throw Error();
+    } else if (output.permissionDecision === "allow") {
+      if (b.name !== "trash-guard" || Object.keys(output).sort().join() !== "hookEventName,permissionDecision,updatedInput" || !output.updatedInput || typeof output.updatedInput.command !== "string" || !output.updatedInput.command.trim()) throw Error();
+    } else throw Error();
+    process.stdout.write(JSON.stringify(result.verdict));
+  } catch { fail(); }
+}`;
+var quote = (value) => "'" + value.replaceAll("'", "'\\''") + "'";
+var program = `(${supervisorSource})(process.argv[1]);`;
+var shell = `cd / || exit 2
+exec 3<&0 || exit 2
+/usr/bin/env -i HOME="$3" PATH="$4" "$2" --config=/dev/null --no-env-file --no-macros --no-install --eval ${quote(program)} "$1" <&3 3<&- 2>/dev/null &
+runner=$!
+exec 3<&-
+(trap 'kill "$sleeper" 2>/dev/null; exit 0' TERM; /bin/sleep 6 & sleeper=$!; wait "$sleeper"; kill -KILL "$runner" 2>/dev/null) &
+watchdog=$!
+wait "$runner"; result=$?
+kill "$watchdog" 2>/dev/null; wait "$watchdog" 2>/dev/null
+if [ "$result" -ne 0 ]; then printf '%s\\n' 'Native safety guard refused: verification or execution failed.' >&2; exit 2; fi`;
+var prefix = `/usr/bin/env -i /bin/sh -c ${quote(shell)} hasna-native-safety-v1 `;
+function validateBinding(b) {
+  if (!b || !isNativeSafetyName(b.name) || ![b.runtime, b.worker, b.home].every((p) => typeof p === "string" && isAbsolute2(p) && !/[\0\r\n]/.test(p)) || ![b.runtimeSHA256, b.workerSHA256].every((h) => /^[0-9a-f]{64}$/.test(h)) || typeof b.path !== "string" || b.path.split(":").some((p) => !isAbsolute2(p) || /[\0\r\n]/.test(p)))
+    throw new Error("Invalid native safety binding");
+}
+function buildNativeSafetyCommand(binding) {
+  validateBinding(binding);
+  const encoded = Buffer.from(JSON.stringify(binding)).toString("base64url");
+  return prefix + [encoded, binding.runtime, binding.home, binding.path].map(quote).join(" ");
+}
+function nativeSafetyRegistration(command) {
+  if (!command.startsWith(prefix))
+    return;
+  const encoded = command.slice(prefix.length).match(/^'([A-Za-z0-9_-]+)' /)?.[1];
+  if (!encoded || encoded.length > 16384)
+    return;
+  try {
+    const binding = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    return buildNativeSafetyCommand(binding) === command ? binding.name : undefined;
+  } catch {
+    return;
+  }
+}
+function pinEligibleFile(file, maximum, executable = false) {
+  if (!isAbsolute2(file) || realpathSync2(file) !== file)
+    throw new Error("Native safety requires canonical files");
+  for (let parent = dirname3(file);; ) {
+    const s = lstatSync(parent);
+    if (!s.isDirectory() || ![0, process.getuid()].includes(s.uid) || s.mode & 18)
+      throw new Error("Native safety requires trusted, non-writable file ancestry");
+    if (parent === dirname3(parent))
+      break;
+    parent = dirname3(parent);
+  }
+  const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const s = fstatSync(fd);
+    if (!s.isFile() || ![0, process.getuid()].includes(s.uid) || s.mode & 18 || s.size > maximum || executable && !(s.mode & 64))
+      throw new Error("Native safety requires an eligible installed file");
+    const bytes = readFileSync3(fd);
+    if (bytes.length > maximum)
+      throw new Error("Native safety file exceeds its bound");
+    return createHash("sha256").update(bytes).digest("hex");
+  } finally {
+    closeSync(fd);
+  }
+}
+function installedNativeSafetyCommand(name) {
+  const home = realpathSync2(homedir3());
+  const runtime = realpathSync2(process.execPath);
+  const candidates = [join7(import.meta.dir, "../../bin/native-safety-entry.js"), join7(import.meta.dir, "../bin/native-safety-entry.js"), join7(import.meta.dir, "native-safety-entry.js")];
+  const worker = candidates.find(existsSync6);
+  if (!worker)
+    throw new Error("Bundled native safety runner is missing; build or reinstall @hasna/hooks before installing its guards.");
+  const canonicalWorker = realpathSync2(worker);
+  return buildNativeSafetyCommand({ name, runtime, runtimeSHA256: pinEligibleFile(runtime, 200000000, true), worker: canonicalWorker, workerSHA256: pinEligibleFile(canonicalWorker, 256000), home, path: `${dirname3(runtime)}:${join7(home, ".bun/bin")}:/usr/local/bin:/usr/bin:/bin` });
+}
+
 // src/lib/mementos-options.ts
 function validateMementosRegistration(name, value) {
   if (value === undefined)
@@ -7695,6 +7827,9 @@ var REGISTRATION_COMMAND_RE = /^(?:hooks run ([\w-]+)(?:\s+--profile\s+[\w-]+)?|
 function registrationName(command) {
   if (typeof command !== "string")
     return;
+  const native = nativeSafetyRegistration(command);
+  if (native)
+    return native;
   if (/^hooks run mementos-context(?:\s|$)/.test(command.trim())) {
     try {
       retainedMementosRegistration([command.trim()]);
@@ -7714,16 +7849,16 @@ function matchersOverlap(a, b) {
 init_store();
 
 // src/lib/codex-settings.ts
-import { closeSync, existsSync as existsSync7, lstatSync, mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync4, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname3 } from "path";
+import { closeSync as closeSync2, existsSync as existsSync8, lstatSync as lstatSync2, mkdirSync as mkdirSync4, openSync as openSync2, readFileSync as readFileSync5, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname4 } from "path";
 import { randomUUID } from "crypto";
 var snapshots = new WeakMap;
 function current(path) {
   try {
-    const stat = lstatSync(path);
+    const stat = lstatSync2(path);
     if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1048576)
       throw new Error("invalid_file");
-    return readFileSync4(path, "utf8");
+    return readFileSync5(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return null;
@@ -7755,11 +7890,11 @@ function writeCodexSettings(path, settings) {
   const snapshot = snapshots.get(settings);
   if (!snapshot || snapshot.path !== path)
     throw new Error("Codex settings require a complete current read before writing.");
-  mkdirSync4(dirname3(path), { recursive: true });
+  mkdirSync4(dirname4(path), { recursive: true });
   const lock = `${path}.hooks-write.lock`;
   let fd;
   try {
-    fd = openSync(lock, "wx", 384);
+    fd = openSync2(lock, "wx", 384);
   } catch {
     throw new Error("Codex settings are being edited; retry after the active writer finishes.");
   }
@@ -7775,16 +7910,16 @@ function writeCodexSettings(path, settings) {
     renameSync2(temp, path);
     snapshots.set(settings, { path, raw: next });
   } finally {
-    if (existsSync7(temp))
+    if (existsSync8(temp))
       unlinkSync(temp);
-    closeSync(fd);
+    closeSync2(fd);
     unlinkSync(lock);
   }
 }
 
 // src/lib/installer.ts
-var __dirname2 = dirname4(fileURLToPath2(import.meta.url));
-var HOOKS_DIR = existsSync8(join7(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join7(__dirname2, "..", "..", "hooks") : join7(__dirname2, "..", "hooks");
+var __dirname2 = dirname5(fileURLToPath2(import.meta.url));
+var HOOKS_DIR = existsSync9(join8(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join8(__dirname2, "..", "..", "hooks") : join8(__dirname2, "..", "hooks");
 function normalizeHookName(name) {
   return name.startsWith("hook-") ? name : `hook-${name}`;
 }
@@ -7796,8 +7931,7 @@ function removeHookEntriesByName(entries, hookName) {
     if (!Array.isArray(entry.hooks))
       return [entry];
     const kept = entry.hooks.filter((h) => {
-      const match = h.command?.match(/^hooks run ([\w-]+)/);
-      return !(match && match[1] === hookName);
+      return registrationName(h.command) !== hookName;
     });
     return kept.length === entry.hooks.length ? [entry] : kept.length ? [{ ...entry, hooks: kept }] : [];
   });
@@ -7873,29 +8007,29 @@ function getSettingsPath(scope = "global", target = "claude", codewithConfigPath
     return globalOverride;
   const dir = getTargetSettingsDir(target);
   if (target === "codex")
-    return join7(scope === "project" ? process.cwd() : homedir3(), dir, "hooks.json");
+    return join8(scope === "project" ? process.cwd() : homedir4(), dir, "hooks.json");
   if (scope === "project") {
-    return target === "codewith" ? join7(process.cwd(), dir, "config.toml") : join7(process.cwd(), dir, "settings.json");
+    return target === "codewith" ? join8(process.cwd(), dir, "config.toml") : join8(process.cwd(), dir, "settings.json");
   }
-  return target === "codewith" ? join7(homedir3(), dir, "config.toml") : join7(homedir3(), dir, "settings.json");
+  return target === "codewith" ? join8(homedir4(), dir, "config.toml") : join8(homedir4(), dir, "settings.json");
 }
 function getHookPath(name) {
   const shortName = shortHookName(name);
   const resolved = resolveHookDir(shortName);
   if (resolved)
     return resolved;
-  return join7(HOOKS_DIR, normalizeHookName(shortName));
+  return join8(HOOKS_DIR, normalizeHookName(shortName));
 }
 function hookExists(name) {
-  return existsSync8(getHookPath(name));
+  return existsSync9(getHookPath(name));
 }
 function readSettings(scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
   if (target === "codex")
     return readCodexSettings(path);
   try {
-    if (existsSync8(path)) {
-      return JSON.parse(readFileSync5(path, "utf-8"));
+    if (existsSync9(path)) {
+      return JSON.parse(readFileSync6(path, "utf-8"));
     }
   } catch (error) {
     console.warn(`[hooks] Failed to read settings at ${path}: ${error instanceof Error ? error.message : String(error)}`);
@@ -7906,8 +8040,8 @@ function writeSettings(settings, scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
   if (target === "codex")
     return writeCodexSettings(path, settings);
-  const dir = dirname4(path);
-  if (!existsSync8(dir)) {
+  const dir = dirname5(path);
+  if (!existsSync9(dir)) {
     mkdirSync5(dir, { recursive: true });
   }
   writeFileSync4(path, JSON.stringify(settings, null, 2) + `
@@ -7935,6 +8069,9 @@ function codewithTimeout(name) {
   switch (name) {
     case "mementos-context":
       return 12;
+    case "trash-guard":
+    case "workspace-repos-guard":
+      return 10;
     case "knowledge-context":
       return 6;
     case "session-start":
@@ -7944,7 +8081,6 @@ function codewithTimeout(name) {
     case "prompt-guard":
       return 3;
     case "worktree-guard":
-    case "trash-guard":
     case "stop-sync":
       return 5;
     default:
@@ -7973,11 +8109,13 @@ function codewithStatusMessage(name) {
 }
 function buildCodewithTomlFragment(name, profile, mementos) {
   const shortName = shortHookName(name);
-  const meta = resolveHookMeta(shortName);
+  if (isNativeSafetyName(shortName) && profile)
+    throw new Error("Bundled native safety guards do not select registry profiles");
+  const meta = isNativeSafetyName(shortName) ? getHook(shortName) : resolveHookMeta(shortName);
   if (!meta)
     throw new Error(`Hook '${shortName}' not found`);
   validateMementosRegistration(shortName, mementos);
-  const command = (profile ? `hooks run ${shortName} --profile ${profile}` : `hooks run ${shortName}`) + mementosCommandSuffix(mementos);
+  const command = isNativeSafetyName(shortName) ? installedNativeSafetyCommand(shortName) : (profile ? `hooks run ${shortName} --profile ${profile}` : `hooks run ${shortName}`) + mementosCommandSuffix(mementos);
   const matcher = codewithMatcher(meta.matcher);
   const fragments = [];
   for (const event of getHookEvents(meta)) {
@@ -8002,17 +8140,17 @@ function buildCodewithTomlFragment(name, profile, mementos) {
 function readCodewithConfig(scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
   try {
-    return existsSync8(path) ? readFileSync5(path, "utf-8") : "";
+    return existsSync9(path) ? readFileSync6(path, "utf-8") : "";
   } catch {
     return "";
   }
 }
 function appendCodewithFragment(fragment, scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
-  const dir = dirname4(path);
-  if (!existsSync8(dir))
+  const dir = dirname5(path);
+  if (!existsSync9(dir))
     mkdirSync5(dir, { recursive: true });
-  const existing = existsSync8(path) ? readFileSync5(path, "utf-8") : "";
+  const existing = existsSync9(path) ? readFileSync6(path, "utf-8") : "";
   const sep2 = existing.trim() ? `
 
 ` : "";
@@ -8020,7 +8158,7 @@ function appendCodewithFragment(fragment, scope, configPath) {
   return path;
 }
 function detectConflict(name, scope, target) {
-  const meta = resolveHookMeta(name);
+  const meta = isNativeSafetyName(name) ? getHook(name) : resolveHookMeta(name);
   if (!meta || !meta.matcher)
     return;
   const events = new Set(getHookEvents(meta));
@@ -8040,7 +8178,7 @@ function detectConflict(name, scope, target) {
   return;
 }
 function detectRewriteConflict(name, scope, target, lookup = getHook) {
-  const meta = resolveHookMeta(name);
+  const meta = isNativeSafetyName(name) ? getHook(name) : resolveHookMeta(name);
   if (!meta?.matcher || !meta.rewritesInput)
     return;
   if (!getHookEvents(meta).includes("PreToolUse"))
@@ -8061,7 +8199,10 @@ function detectRewriteConflict(name, scope, target, lookup = getHook) {
 }
 function installForTarget(name, scope, overwrite, target, profile, codewithMode = "fragment", codewithConfigPath, mementos) {
   const shortName = shortHookName(name);
-  if (!hookExists(shortName)) {
+  if (isNativeSafetyName(shortName) && (profile || target === "gemini" || target === "codewith" && codewithMode === "write")) {
+    return { hook: shortName, success: false, error: "Bundled native safety guards support Claude/Codex and managed Codewith fragments, without registry profiles.", target };
+  }
+  if (!isNativeSafetyName(shortName) && !hookExists(shortName)) {
     return { hook: shortName, success: false, error: `Hook '${shortName}' not found`, target };
   }
   if (target === "codewith") {
@@ -8153,7 +8294,7 @@ function installHook(name, options = {}) {
   }
   if (target === "all") {
     const shortName = shortHookName(name);
-    const meta = resolveHookMeta(shortName);
+    const meta = isNativeSafetyName(shortName) ? getHook(shortName) : resolveHookMeta(shortName);
     if (meta) {
       const unsupportedTargets = ["claude", "codewith"].filter((agentTarget) => getHookEvents(meta).some((event) => !isEventSupported(event, agentTarget)));
       if (unsupportedTargets.length > 0) {
@@ -8186,7 +8327,7 @@ function installHook(name, options = {}) {
   return installForTarget(name, scope, overwrite, target, profile, codewithMode, codewithConfigPath, mementos);
 }
 function registerHook(name, scope = "global", target = "claude", profile, mementos) {
-  const meta = resolveHookMeta(name);
+  const meta = isNativeSafetyName(name) ? getHook(name) : resolveHookMeta(name);
   if (!meta)
     return;
   const eventKeys = getHookEvents(meta).map((event) => {
@@ -8203,8 +8344,17 @@ function registerHook(name, scope = "global", target = "claude", profile, mement
   const settings = readSettings(scope, target);
   if (!settings.hooks)
     settings.hooks = {};
+  if (isNativeSafetyName(name)) {
+    for (const groups of Object.values(settings.hooks))
+      for (const group of groups)
+        for (const hook of group.hooks ?? []) {
+          if (typeof hook.command === "string" && /(?:^|\s)hasna-native-safety-v\d+(?:\s|$)/.test(hook.command) && !registrationName(hook.command)) {
+            throw new Error("Unknown managed safety definition; reconcile its exact version before replacing it.");
+          }
+        }
+  }
   const retained = name === "mementos-context" && mementos === undefined ? retainedMementosRegistration(Object.values(settings.hooks).flatMap((groups) => Array.isArray(groups) ? groups.flatMap((group) => Array.isArray(group.hooks) ? group.hooks.map((hook) => hook.command).filter((command) => typeof command === "string") : []) : [])) : undefined;
-  const hookCommand = (profile ? `hooks run ${name} --profile ${profile}` : `hooks run ${name}`) + mementosCommandSuffix(mementos ?? retained);
+  const hookCommand = isNativeSafetyName(name) ? installedNativeSafetyCommand(name) : (profile ? `hooks run ${name} --profile ${profile}` : `hooks run ${name}`) + mementosCommandSuffix(mementos ?? retained);
   if (target === "codex") {
     const positions = [];
     for (const [event, groups] of Object.entries(settings.hooks)) {
@@ -8212,9 +8362,11 @@ function registerHook(name, scope = "global", target = "claude", profile, mement
         for (let index = 0;index < entry.hooks.length; index++) {
           const command = entry.hooks[index]?.command;
           const match = typeof command === "string" && command.trim().match(/^(?:hooks run ([\w-]+)(?:\s|$)|hook-([\w-]+)$)/);
-          if (match && (match[1] ?? match[2]) === name) {
+          if (match && (match[1] ?? match[2]) === name || registrationName(command) === name) {
             if (registrationName(command) !== name)
               throw new Error("Unrecognized Codex registration; reconcile it before updating this hook.");
+            if (isNativeSafetyName(name) && entry.hooks[index].async !== undefined && entry.hooks[index].async !== false)
+              throw new Error("Asynchronous safety hooks cannot block; reconcile this registration before updating it.");
             positions.push({ event, entry, index });
           }
         }
@@ -8278,12 +8430,20 @@ function getRegisteredHooksForTarget(scope = "global", target = "claude") {
   if (target === "codewith") {
     const config = readCodewithConfig(scope);
     const registered2 = [];
-    const re = /^\s*command\s*=\s*["']([^"'\n]+)["']\s*$/gm;
-    let match;
-    while (match = re.exec(config)) {
-      const name = registrationName(match[1]);
-      if (name)
-        registered2.push(name);
+    try {
+      const parsed = Bun.TOML.parse(config);
+      for (const groups of Object.values(parsed.hooks ?? {})) {
+        if (!Array.isArray(groups))
+          continue;
+        for (const group of groups)
+          for (const hook of group.hooks ?? []) {
+            const name = registrationName(hook.command);
+            if (name)
+              registered2.push(name);
+          }
+      }
+    } catch {
+      return [];
     }
     return [...new Set(registered2)];
   }
@@ -8384,10 +8544,10 @@ function codewithHasHookEntryInText(configText, name) {
 }
 function codewithHasHookEntry(name, scope = "global") {
   const path = getSettingsPath(scope, "codewith");
-  if (!existsSync8(path))
+  if (!existsSync9(path))
     return false;
   try {
-    return codewithHasHookEntryInText(readFileSync5(path, "utf-8"), name);
+    return codewithHasHookEntryInText(readFileSync6(path, "utf-8"), name);
   } catch {
     return false;
   }
@@ -8396,12 +8556,12 @@ function removeStoreDirFailClosed(dir) {
   const entries = readdirSync3(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      removeStoreDirFailClosed(join7(dir, entry.name));
+      removeStoreDirFailClosed(join8(dir, entry.name));
     }
   }
   for (const entry of entries) {
     if (!entry.isDirectory()) {
-      unlinkSync2(join7(dir, entry.name));
+      unlinkSync2(join8(dir, entry.name));
     }
   }
   rmdirSync(dir);
@@ -8432,8 +8592,8 @@ function uninstallHook(name, scope = "global", target = "claude") {
   const registrationsRemaining = [];
   if (target === "codewith" || target === "all") {
     const codewithPath = getSettingsPath(scope, "codewith");
-    if (existsSync8(codewithPath)) {
-      const before = readFileSync5(codewithPath, "utf-8");
+    if (existsSync9(codewithPath)) {
+      const before = readFileSync6(codewithPath, "utf-8");
       const after = removeCodewithHookEntry(before, shortName);
       if (after.removed) {
         writeFileSync4(codewithPath, after.text, "utf-8");
@@ -8475,7 +8635,7 @@ function uninstallHook(name, scope = "global", target = "claude") {
 // src/index.ts
 init_profiles();
 init_config();
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
 
 // src/lib/transport.ts
 init_transport();
@@ -8615,15 +8775,15 @@ init_manifest();
 // src/lib/custom-install.ts
 init_config();
 init_manifest();
-import { existsSync as existsSync10, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync8, rmSync as rmSync2 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync9, rmSync as rmSync2 } from "fs";
+import { join as join11 } from "path";
 import { tmpdir } from "os";
 function manifestAt(dir) {
-  const path = join10(dir, "manifest.json");
-  if (!existsSync10(path))
+  const path = join11(dir, "manifest.json");
+  if (!existsSync11(path))
     return;
   try {
-    return parseManifest(readFileSync8(path, "utf-8"));
+    return parseManifest(readFileSync9(path, "utf-8"));
   } catch {
     return;
   }
@@ -8642,8 +8802,8 @@ function writeFromManifest(manifest, srcDir, source, kind) {
   return { name, version: manifest.version, kind, source, dir, scriptPath };
 }
 async function cloneToTemp(gitUrl) {
-  const tmp = mkdtempSync(join10(tmpdir(), "hooks-install-"));
-  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join10(tmp, "repo")], {
+  const tmp = mkdtempSync(join11(tmpdir(), "hooks-install-"));
+  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join11(tmp, "repo")], {
     stdout: "pipe",
     stderr: "pipe"
   });
@@ -8656,7 +8816,7 @@ async function cloneToTemp(gitUrl) {
     rmSync2(tmp, { recursive: true, force: true });
     throw new Error(`git clone failed (${exitCode}): ${stderr.trim()}`);
   }
-  return join10(tmp, "repo");
+  return join11(tmp, "repo");
 }
 function isGitUrl(value) {
   return value.startsWith("git@") || value.startsWith("ssh://") || value.startsWith("file://") || value.endsWith(".git");
@@ -8666,7 +8826,7 @@ function isCustomSource(value) {
     return true;
   if (value.startsWith("http://") || value.startsWith("https://"))
     return true;
-  return existsSync10(value);
+  return existsSync11(value);
 }
 async function installCustomSource(source) {
   if (isGitUrl(source)) {
@@ -8680,11 +8840,11 @@ async function installCustomSource(source) {
   if (source.startsWith("http://") || source.startsWith("https://")) {
     return installManifestUrl(source);
   }
-  if (!existsSync10(source)) {
+  if (!existsSync11(source)) {
     throw new Error(`No such local path: ${source}`);
   }
   if (source.endsWith("manifest.json")) {
-    const manifest = parseManifest(readFileSync8(source, "utf-8"));
+    const manifest = parseManifest(readFileSync9(source, "utf-8"));
     return writeFromManifest(manifest, source.substring(0, source.lastIndexOf("/")), source, "local");
   }
   return copyManifestDir(source, source, "local");
@@ -8714,16 +8874,16 @@ async function installManifestUrl(url) {
   return { name, version: manifest.version, kind: "url", source: url, dir, scriptPath };
 }
 // src/lib/sync.ts
-import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync9 } from "fs";
+import { createHash as createHash3 } from "crypto";
+import { readFileSync as readFileSync10 } from "fs";
 init_db();
 init_store();
 init_manifest();
 function sha256OfText(text) {
-  return createHash2("sha256").update(text).digest("hex");
+  return createHash3("sha256").update(text).digest("hex");
 }
 function sha256OfPath(path) {
-  return createHash2("sha256").update(readFileSync9(path)).digest("hex");
+  return createHash3("sha256").update(readFileSync10(path)).digest("hex");
 }
 function collectBundledCatalog() {
   const out = [];
@@ -9024,8 +9184,8 @@ async function installPinnedFromBundled(name, version) {
 // src/serve.ts
 init_manifest();
 init_store();
-import { readFileSync as readFileSync10 } from "fs";
-import { dirname as dirname6, join as join11 } from "path";
+import { readFileSync as readFileSync11 } from "fs";
+import { dirname as dirname7, join as join12 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 
 // src/lib/secure-compare.ts
@@ -9042,155 +9202,356 @@ function secureEqual(a, b) {
 }
 
 // src/openapi.ts
-var openApiDocument = {
-  openapi: "3.1.0",
-  info: {
-    title: "Hooks Registry API",
-    version: "0.1.0",
-    description: "Local registry HTTP API for @hasna/hooks: catalog, lock, and artifact reads are open; publishing (PUT /api/v1/hooks) requires the API key (authorization: Bearer or x-api-key)."
-  },
-  servers: [{ url: "/" }],
-  paths: {
-    "/health": {
-      get: {
-        summary: "Liveness probe",
-        operationId: "getHealth",
-        responses: {
-          "200": {
-            description: "Service is alive",
-            content: {
-              "application/json": {
-                schema: { type: "object", additionalProperties: true }
+function buildOpenApiDocument(version) {
+  return {
+    openapi: "3.1.0",
+    info: {
+      title: "Hooks Registry API",
+      version,
+      description: "Local registry HTTP API for @hasna/hooks: catalog, lock, and artifact reads are open; publishing (PUT /api/v1/hooks) requires the API key (authorization: Bearer or x-api-key)."
+    },
+    servers: [{ url: "/" }],
+    paths: {
+      "/health": {
+        get: {
+          summary: "Liveness probe",
+          operationId: "getHealth",
+          responses: {
+            "200": {
+              description: "Service is alive",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksHealth" }
+                }
               }
             }
           }
         }
-      }
-    },
-    "/ready": {
-      get: {
-        summary: "Readiness probe \u2014 the hooks.lock store is readable",
-        operationId: "getReady",
-        responses: {
-          "200": { description: "Lock store is readable" },
-          "503": { description: "Lock store is not readable" }
+      },
+      "/ready": {
+        get: {
+          summary: "Readiness probe \u2014 the hooks.lock store is readable",
+          operationId: "getReady",
+          responses: {
+            "200": {
+              description: "Lock store is readable",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksHealth" }
+                }
+              }
+            },
+            "503": {
+              description: "Lock store is not readable",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksHealth" }
+                }
+              }
+            }
+          }
         }
-      }
-    },
-    "/version": {
-      get: {
-        summary: "Package version",
-        operationId: "getVersion",
-        responses: {
-          "200": {
-            description: "The installed @hasna/hooks version",
-            content: {
-              "application/json": {
-                schema: { type: "object", properties: { version: { type: "string" } } }
+      },
+      "/version": {
+        get: {
+          summary: "Package version",
+          operationId: "getVersion",
+          responses: {
+            "200": {
+              description: "The installed @hasna/hooks version",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksVersion" }
+                }
               }
             }
           }
         }
-      }
-    },
-    "/openapi.json": {
-      get: {
-        summary: "This OpenAPI document",
-        operationId: "getOpenApi",
-        responses: { "200": { description: "OpenAPI 3.1 document" } }
-      }
-    },
-    "/api/v1/catalog": {
-      get: {
-        summary: "List the full hook catalog with versions and sha256",
-        operationId: "getCatalog",
-        responses: {
-          "200": {
-            description: "Catalog entries",
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  properties: {
-                    hooks: {
-                      type: "array",
-                      items: {
-                        type: "object",
-                        properties: {
-                          name: { type: "string" },
-                          version: { type: "string" },
-                          sha256: { type: "string" },
-                          events: { type: "array", items: { type: "string" } }
-                        }
-                      }
-                    }
-                  }
+      },
+      "/openapi.json": {
+        get: {
+          summary: "This OpenAPI document",
+          operationId: "getOpenApi",
+          responses: {
+            "200": {
+              description: "OpenAPI 3.1 document",
+              content: {
+                "application/json": {
+                  schema: { type: "object", additionalProperties: true }
                 }
               }
             }
           }
         }
-      }
-    },
-    "/api/v1/lock": {
-      get: {
-        summary: "Read the published hooks.lock with per-hook versions",
-        operationId: "getLock",
-        responses: { "200": { description: "The lock file" } }
-      }
-    },
-    "/api/v1/hooks/{name}/{version}": {
-      get: {
-        summary: "Fetch one hook's manifest and script",
-        operationId: "getHookArtifact",
-        parameters: [
-          { name: "name", in: "path", required: true, schema: { type: "string" } },
-          { name: "version", in: "path", required: true, schema: { type: "string" } }
-        ],
-        responses: {
-          "200": {
-            description: "Hook artifact; x-hook-sha256 header carries the script hash"
+      },
+      "/api/v1/catalog": {
+        get: {
+          summary: "List the full hook catalog with versions and sha256",
+          operationId: "getCatalog",
+          responses: {
+            "200": {
+              description: "Catalog entries",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksCatalog" }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/api/v1/lock": {
+        get: {
+          summary: "Read the published hooks.lock with per-hook versions",
+          operationId: "getLock",
+          responses: {
+            "200": {
+              description: "The lock file",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksLock" }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/api/v1/hooks/{name}/{version}": {
+        get: {
+          summary: "Fetch one hook's manifest and script",
+          operationId: "getHookArtifact",
+          parameters: [
+            { name: "name", in: "path", required: true, schema: { type: "string" } },
+            { name: "version", in: "path", required: true, schema: { type: "string" } }
+          ],
+          responses: {
+            "200": {
+              description: "Hook artifact; x-hook-sha256 header carries the script hash",
+              headers: {
+                "x-hook-sha256": {
+                  description: "sha256 of the served script, the same value the lock pins",
+                  schema: { type: "string" }
+                }
+              },
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksArtifact" }
+                }
+              }
+            },
+            "400": {
+              description: "Invalid URL encoding or semver version",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
+            },
+            "404": {
+              description: "Hook not found locally",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/api/v1/hooks": {
+        put: {
+          summary: "Publish/retrust a hook (requires the API key)",
+          operationId: "putHook",
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/HooksPublishRequest" }
+              }
+            }
+          },
+          responses: {
+            "200": {
+              description: "Hook retrusted and pin updated",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksPublishResponse" }
+                }
+              }
+            },
+            "400": {
+              description: "Invalid JSON body",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
+            },
+            "401": {
+              description: "Missing or invalid API key",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
+            },
+            "404": {
+              description: "Hook not found in local store",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
+            },
+            "409": {
+              description: "Version mismatch with the local store",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/HooksError" }
+                }
+              }
+            }
           },
-          "400": { description: "Invalid URL encoding or semver version" },
-          "404": { description: "Hook not found locally" }
+          security: [{ apiKey: [] }]
         }
       }
     },
-    "/api/v1/hooks": {
-      put: {
-        summary: "Publish/retrust a hook (requires the API key)",
-        operationId: "putHook",
-        requestBody: {
-          required: true,
-          content: {
-            "application/json": {
-              schema: {
-                type: "object",
-                properties: { name: { type: "string" }, version: { type: "string" } }
-              }
+    components: {
+      securitySchemes: {
+        apiKey: {
+          type: "http",
+          scheme: "bearer",
+          description: "The registry API key \u2014 resolved by the client through the @hasna/contracts chain (HASNA_HOOKS_API_KEY, the Keychain item hasna.credentials.hooks.api-key, or ~/.hasna/hooks/config/credentials); the server compares the inbound bearer/x-api-key value."
+        }
+      },
+      schemas: {
+        HooksHealth: {
+          type: "object",
+          additionalProperties: false,
+          required: ["status", "name"],
+          properties: {
+            status: { type: "string" },
+            name: { type: "string" }
+          }
+        },
+        HooksVersion: {
+          type: "object",
+          additionalProperties: false,
+          required: ["version"],
+          properties: { version: { type: "string" } }
+        },
+        HooksCatalogEntry: {
+          type: "object",
+          additionalProperties: false,
+          required: ["name", "version", "sha256", "events", "description", "source", "versions"],
+          properties: {
+            name: { type: "string" },
+            version: { type: "string" },
+            sha256: { type: "string" },
+            events: { type: "array", items: { type: "string" } },
+            description: { type: "string" },
+            source: {
+              type: "string",
+              description: "bundled | custom | custom-overrides-bundled"
+            },
+            versions: { type: "array", items: { type: "string" } }
+          }
+        },
+        HooksCatalog: {
+          type: "object",
+          additionalProperties: false,
+          required: ["hooks"],
+          properties: {
+            hooks: { type: "array", items: { $ref: "#/components/schemas/HooksCatalogEntry" } }
+          }
+        },
+        HooksLockEntry: {
+          type: "object",
+          additionalProperties: false,
+          required: ["version", "sha256", "source"],
+          properties: {
+            version: { type: "string" },
+            sha256: { type: "string" },
+            source: { type: "string" },
+            pinned: {
+              type: "boolean",
+              description: "True for an explicit install/update pin, absent for sync-maintained pins."
+            },
+            versions: { type: "array", items: { type: "string" } }
+          }
+        },
+        HooksLock: {
+          type: "object",
+          additionalProperties: false,
+          required: ["hooks"],
+          properties: {
+            hooks: {
+              type: "object",
+              additionalProperties: { $ref: "#/components/schemas/HooksLockEntry" }
             }
           }
         },
-        responses: {
-          "200": { description: "Hook retrusted and pin updated" },
-          "401": { description: "Missing or invalid API key" },
-          "404": { description: "Hook not found in local store" },
-          "409": { description: "Version mismatch with the local store" }
+        HooksManifest: {
+          type: "object",
+          additionalProperties: false,
+          required: ["name", "version", "events", "script"],
+          properties: {
+            name: { type: "string" },
+            version: { type: "string" },
+            description: { type: "string" },
+            events: { type: "array", items: { type: "string" } },
+            script: { type: "string" },
+            script_kind: { type: "string", enum: ["inline", "file"] },
+            args: { type: "array", items: { type: "string" } },
+            timeout_ms: { type: "number" }
+          }
         },
-        security: [{ apiKey: [] }]
-      }
-    }
-  },
-  components: {
-    securitySchemes: {
-      apiKey: {
-        type: "http",
-        scheme: "bearer",
-        description: "The registry API key \u2014 resolved by the client through the @hasna/contracts chain (HASNA_HOOKS_API_KEY, the Keychain item hasna.credentials.hooks.api-key, or ~/.hasna/hooks/config/credentials); the server compares the inbound bearer/x-api-key value."
+        HooksArtifact: {
+          type: "object",
+          additionalProperties: false,
+          required: ["manifest", "script"],
+          properties: {
+            manifest: { $ref: "#/components/schemas/HooksManifest" },
+            script: { type: "string" }
+          }
+        },
+        HooksError: {
+          type: "object",
+          additionalProperties: false,
+          required: ["error"],
+          properties: { error: { type: "string" } }
+        },
+        HooksPublishRequest: {
+          type: "object",
+          additionalProperties: false,
+          required: ["name"],
+          properties: {
+            name: { type: "string" },
+            version: { type: "string" }
+          }
+        },
+        HooksPublishResponse: {
+          type: "object",
+          additionalProperties: false,
+          required: ["ok", "hook"],
+          properties: {
+            ok: { type: "boolean" },
+            hook: {
+              type: "object",
+              additionalProperties: false,
+              required: ["name", "version", "sha256"],
+              properties: {
+                name: { type: "string" },
+                version: { type: "string" },
+                sha256: { type: "string" }
+              }
+            }
+          }
+        }
       }
     }
-  }
-};
+  };
+}
 
 // src/serve.ts
 init_semver();
@@ -9199,8 +9560,8 @@ var SERVE_HOST = "127.0.0.1";
 var SERVE_SERVICE_NAME = "hooks-registry";
 function packageVersion() {
   try {
-    const pkgPath = join11(dirname6(fileURLToPath4(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync10(pkgPath, "utf-8")).version || "0.0.0";
+    const pkgPath = join12(dirname7(fileURLToPath4(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync11(pkgPath, "utf-8")).version || "0.0.0";
   } catch {
     return "0.0.0";
   }
@@ -9289,7 +9650,7 @@ function handleServeRequest(req, apiKey) {
     return Promise.resolve(json({ version: packageVersion() }));
   }
   if (url.pathname === "/openapi.json" && req.method === "GET") {
-    return Promise.resolve(json(openApiDocument));
+    return Promise.resolve(json(buildOpenApiDocument(packageVersion())));
   }
   if (url.pathname === "/api/v1/catalog" && req.method === "GET") {
     return buildCatalog().then((catalog) => json({ hooks: catalog }));
@@ -9466,11 +9827,11 @@ async function runHook(name, input, options = {}) {
     throw new Error(`Hook '${name}' not found`);
   const hookScript = getHookPath(name) + "/src/hook.ts";
   const resolvedScript = custom2?.scriptPath;
-  const script = resolvedScript ?? (existsSync12(hookScript) ? hookScript : undefined);
+  const script = resolvedScript ?? (existsSync13(hookScript) ? hookScript : undefined);
   if (!script)
     throw new Error(`Hook script not found: ${name}`);
   const { sha256Of: sha256Of2, checkScriptHash: checkScriptHash2 } = await Promise.resolve().then(() => (init_store(), exports_store));
-  const content = readFileSync11(script);
+  const content = readFileSync12(script);
   const check = checkScriptHash2(name, sha256Of2(content));
   if (!check.ok) {
     throw new Error(`Hook '${name}' script changed since it was trusted (sha256 ${check.expected} != ${check.actual}). Run 'hooks trust ${name}' to trust the new content.`);