@hasna/hooks 0.9.6 → 0.10.1

package/bin/native-safety-entry.js

@@ -534,6 +534,16 @@ function resolveLiteralTarget(raw, cwd, home) {
 function isUnder(target, root) {
   return target === root || target.startsWith(`${root}${sep}`);
 }
+function isScratchpadContent(target, home) {
+  const prefix = `${join(home, ".hasna", "scratchpad", "scratch")}${sep}`;
+  if (!target.startsWith(prefix))
+    return false;
+  const [session, firstChild] = target.slice(prefix.length).split(sep);
+  if (!session || !/^[a-z0-9][a-z0-9._-]{0,63}$/.test(session) || session.endsWith(".") || !firstChild)
+    return false;
+  const control = firstChild.normalize("NFKC").toLowerCase();
+  return control !== "meta.json" && control !== ".lock";
+}
 function protectedTargetReason(target, home) {
   if (target === home) {
     return `\`${target}\` is the home directory itself, which is never deleted or trashed. Delete a specific file or directory inside it instead.`;
@@ -545,6 +555,8 @@ function protectedTargetReason(target, home) {
   }
   for (const suffix of PROTECTED_HOME_TREES) {
     const root = join(home, suffix);
+    if (suffix === ".hasna" && isScratchpadContent(target, home))
+      continue;
     if (!isUnder(target, root) && !isUnder(root, target))
       continue;
     return `\`${target}\` is the protected \`~/${suffix}\` path (or contains it), which is never deleted or trashed. Delete a specific file inside it, and only when you are sure.`;

package/hooks/hook-trash-guard/README.md

@@ -1,6 +1,6 @@
 # trash-guard
 
-Codewith-native hook installed as `hooks run trash-guard`.
+Native safety hook installed with `hooks safety install trash-guard`.
 
 PreToolUse guard for `rm` issued through the Bash tool. It rewrites the verb
 into `@hasna/trash`'s guard subcommand — `<abs>/trash guard <same args>` — so
@@ -60,14 +60,24 @@ Each refusal carries a reason and a way forward: re-run the delete as
 
 ## The protected class
 
-Refused outright, never redirected (plan §15 decision 11.3):
+Literal protected paths are refused rather than redirected:
 
 - the filesystem root and the system roots `pre-bash`'s protected-path rules
   already name (`/etc`, `/usr`, `/bin`, `/home`, `/var`, …) — the root itself,
   or any ancestor of it;
 - the home directory itself (`~`, `$HOME`, `${HOME}`);
-- `~/.hasna`, `~/.ssh`, `~/.aws` — the state and credential stores, including
-  everything under them.
+- `~/.hasna`, `~/.ssh`, `~/.aws` — the state and credential stores, with the
+  Scratchpad content exception below.
+
+An owned content path beneath
+`~/.hasna/scratchpad/scratch/<session-id>/` can be redirected to Trash. The
+session identifier must match `[a-z0-9][a-z0-9._-]{0,63}` and cannot end in a
+dot. The session root and its ancestors remain protected. Session-level
+`meta.json` and `.lock`, their descendants, and their Unicode-normalized,
+case-insensitive equivalents also remain protected; a nested
+`notes/meta.json` is ordinary content. This routing exception does not grant
+permission to remove another session's files. Variable and glob limitations
+below still apply.
 
 These are the catastrophic cases where "move it to trash" is not an acceptable
 answer. Everything else this hook owns is rewritten, not refused.
@@ -91,10 +101,10 @@ therefore **refused**, and `hooks doctor` reports more than one input-rewriting
 hook on an overlapping matcher. Other overlaps still install with the usual
 advisory warning.
 
-The registration is written with `timeout: 5`. The harness's documented
-default is 600s, and a hook that times out **does not block** — only a verdict
-already on stdout does. Five seconds is several orders of magnitude above this
-hook's measured cost (a bounded lexer and a 500 ms identity check against a verified package binary).
+The native safety installer uses a bounded supervisor and a ten-second native
+registration timeout. The supervisor turns startup, integrity, input, worker
+and deadline failures into a blocking verdict. A harness that never delivers
+the event cannot be protected by the hook.
 
 ## Known limitations
 
@@ -134,11 +144,11 @@ absolute path found, so the rewritten command does not depend on `PATH` again.
 The guard emits their documented `PreToolUse` decision contract, including a
 complete `updatedInput.command`. No-op hooks emit no output. Codex unified exec
 also matches `Bash`; a `Delete File` patch must use `trash put` first. Configure
-Codex in `~/.codex/hooks.json` with matcher
-`^(Bash|apply_patch|ApplyPatch|functions\\.apply_patch)$` and the command
-`hooks run trash-guard`, with hook timeout 5 seconds. Preserve other registrations
-and refuse a second overlapping input-rewriting hook. Claude registration uses
-`hooks install trash-guard --target claude`. The command rewrite defaults to
+Codex using `hooks safety install trash-guard --target codex` and install
+`workspace-repos-guard` through the same safety command. The dedicated bundled
+runner does not require Hooks registry authentication. Preserve other
+registrations and refuse a second overlapping input-rewriting hook. Claude
+uses `hooks safety install trash-guard --target claude`. The command rewrite defaults to
 600 seconds for upload and verification, preserving an explicitly supplied timeout.
 
 After installation, prove the native harness actually executes the rewritten

package/hooks/hook-trash-guard/src/hook.ts

@@ -627,6 +627,17 @@ function isUnder(target: string, root: string): boolean {
   return target === root || target.startsWith(`${root}${sep}`);
 }
 
+/** Literal execution content only; this path shape does not confer task ownership. */
+function isScratchpadContent(target: string, home: string): boolean {
+  const prefix = `${join(home, ".hasna", "scratchpad", "scratch")}${sep}`;
+  if (!target.startsWith(prefix)) return false;
+  const [session, firstChild] = target.slice(prefix.length).split(sep);
+  if (!session || !/^[a-z0-9][a-z0-9._-]{0,63}$/.test(session) || session.endsWith(".") || !firstChild) return false;
+  // Session metadata and its mutation lock are app control state, not scratch.
+  const control = firstChild.normalize("NFKC").toLowerCase();
+  return control !== "meta.json" && control !== ".lock";
+}
+
 /**
  * Why `target` belongs to the protected class that is refused rather than
  * redirected, or null when it is an ordinary path. Matches both directions:
@@ -647,6 +658,7 @@ export function protectedTargetReason(target: string, home: string): string | nu
   }
   for (const suffix of PROTECTED_HOME_TREES) {
     const root = join(home, suffix);
+    if (suffix === ".hasna" && isScratchpadContent(target, home)) continue;
     // Tree mode, like `pre-bash`'s ~/.hasna rule: the store itself and
     // everything under it.
     if (!isUnder(target, root) && !isUnder(root, target)) continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/hooks",
-  "version": "0.9.6",
+  "version": "0.10.1",
   "description": "Open source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command",
   "type": "module",
   "bin": {