@machina.ai/cell-cli-core 1.22.5-rc1 → 1.25.0-rc1

package/dist/src/hooks/hookRunner.js

@@ -4,8 +4,10 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { spawn } from 'node:child_process';
-import { HookEventName } from './types.js';
+import { HookEventName, ConfigSource } from './types.js';
 import { debugLogger } from '../utils/debugLogger.js';
+import { sanitizeEnvironment } from '../services/environmentSanitization.js';
+import { escapeShellArg, getShellConfiguration, } from '../utils/shell-utils.js';
 /**
  * Default timeout for hook execution (60 seconds)
  */
@@ -20,19 +22,35 @@ const EXIT_CODE_NON_BLOCKING_ERROR = 1;
  * Hook runner that executes command hooks
  */
 export class HookRunner {
-    constructor() { }
+    config;
+    constructor(config) {
+        this.config = config;
+    }
     /**
      * Execute a single hook
      */
     async executeHook(hookConfig, eventName, input) {
         const startTime = Date.now();
+        // Secondary security check: Ensure project hooks are not executed in untrusted folders
+        if (hookConfig.source === ConfigSource.Project &&
+            !this.config.isTrustedFolder()) {
+            const errorMessage = 'Security: Blocked execution of project hook in untrusted folder';
+            debugLogger.warn(errorMessage);
+            return {
+                hookConfig,
+                eventName,
+                success: false,
+                error: new Error(errorMessage),
+                duration: 0,
+            };
+        }
         try {
             return await this.executeCommandHook(hookConfig, eventName, input, startTime);
         }
         catch (error) {
             const duration = Date.now() - startTime;
-            const hookSource = hookConfig.command || 'unknown';
-            const errorMessage = `Hook execution failed for event '${eventName}' (source: ${hookSource}): ${error}`;
+            const hookId = hookConfig.name || hookConfig.command || 'unknown';
+            const errorMessage = `Hook execution failed for event '${eventName}' (hook: ${hookId}): ${error}`;
             debugLogger.warn(`Hook execution error (non-fatal): ${errorMessage}`);
             return {
                 hookConfig,
@@ -46,18 +64,26 @@ export class HookRunner {
     /**
      * Execute multiple hooks in parallel
      */
-    async executeHooksParallel(hookConfigs, eventName, input) {
-        const promises = hookConfigs.map((config) => this.executeHook(config, eventName, input));
+    async executeHooksParallel(hookConfigs, eventName, input, onHookStart, onHookEnd) {
+        const promises = hookConfigs.map(async (config, index) => {
+            onHookStart?.(config, index);
+            const result = await this.executeHook(config, eventName, input);
+            onHookEnd?.(config, result);
+            return result;
+        });
         return Promise.all(promises);
     }
     /**
      * Execute multiple hooks sequentially
      */
-    async executeHooksSequential(hookConfigs, eventName, input) {
+    async executeHooksSequential(hookConfigs, eventName, input, onHookStart, onHookEnd) {
         const results = [];
         let currentInput = input;
-        for (const config of hookConfigs) {
+        for (let i = 0; i < hookConfigs.length; i++) {
+            const config = hookConfigs[i];
+            onHookStart?.(config, i);
             const result = await this.executeHook(config, eventName, currentInput);
+            onHookEnd?.(config, result);
             results.push(result);
             // If the hook succeeded and has output, use it to modify the input for the next hook
             if (result.success && result.output) {
@@ -103,6 +129,17 @@ export class HookRunner {
                         }
                     }
                     break;
+                case HookEventName.BeforeTool:
+                    if ('tool_input' in hookOutput.hookSpecificOutput) {
+                        const newToolInput = hookOutput.hookSpecificOutput['tool_input'];
+                        if (newToolInput && 'tool_input' in modifiedInput) {
+                            modifiedInput.tool_input = {
+                                ...modifiedInput.tool_input,
+                                ...newToolInput,
+                            };
+                        }
+                    }
+                    break;
                 default:
                     // For other events, no special input modification is needed
                     break;
@@ -131,18 +168,19 @@ export class HookRunner {
             let stdout = '';
             let stderr = '';
             let timedOut = false;
-            const command = this.expandCommand(hookConfig.command, input);
+            const shellConfig = getShellConfiguration();
+            const command = this.expandCommand(hookConfig.command, input, shellConfig.shell);
             // Set up environment variables
             const env = {
-                ...process.env,
+                ...sanitizeEnvironment(process.env, this.config.sanitizationConfig),
                 GEMINI_PROJECT_DIR: input.cwd,
                 CLAUDE_PROJECT_DIR: input.cwd, // For compatibility
             };
-            const child = spawn(command, {
+            const child = spawn(shellConfig.executable, [...shellConfig.argsPrefix, command], {
                 env,
                 cwd: input.cwd,
                 stdio: ['pipe', 'pipe', 'pipe'],
-                shell: true,
+                shell: false,
             });
             // Set up timeout
             const timeoutHandle = setTimeout(() => {
@@ -160,7 +198,7 @@ export class HookRunner {
                 child.stdin.on('error', (err) => {
                     // Ignore EPIPE errors which happen when the child process closes stdin early
                     if (err.code !== 'EPIPE') {
-                        debugLogger.warn(`Hook stdin error: ${err}`);
+                        debugLogger.debug(`Hook stdin error: ${err}`);
                     }
                 });
                 // Wrap write operations in try-catch to handle synchronous EPIPE errors
@@ -172,7 +210,7 @@ export class HookRunner {
                 catch (err) {
                     // Ignore EPIPE errors which happen when the child process closes stdin early
                     if (err instanceof Error && 'code' in err && err.code !== 'EPIPE') {
-                        debugLogger.warn(`Hook stdin write error: ${err}`);
+                        debugLogger.debug(`Hook stdin write error: ${err}`);
                     }
                 }
             }
@@ -253,10 +291,12 @@ export class HookRunner {
     /**
      * Expand command with environment variables and input context
      */
-    expandCommand(command, input) {
+    expandCommand(command, input, shellType) {
+        debugLogger.debug(`Expanding hook command: ${command} (cwd: ${input.cwd})`);
+        const escapedCwd = escapeShellArg(input.cwd, shellType);
         return command
-            .replace(/\$GEMINI_PROJECT_DIR/g, input.cwd)
-            .replace(/\$CLAUDE_PROJECT_DIR/g, input.cwd); // For compatibility
+            .replace(/\$GEMINI_PROJECT_DIR/g, () => escapedCwd)
+            .replace(/\$CLAUDE_PROJECT_DIR/g, () => escapedCwd); // For compatibility
     }
     /**
      * Convert plain text output to structured HookOutput

package/dist/src/hooks/hookRunner.js.map

@@ -1 +1 @@
-{"version":3,"file":"hookRunner.js","sourceRoot":"","sources":["../../../src/hooks/hookRunner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAU3C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD;;GAEG;AACH,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC;;GAEG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAEvC;;GAEG;AACH,MAAM,OAAO,UAAU;IACrB,gBAAe,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,UAAsB,EACtB,SAAwB,EACxB,KAAgB;QAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAClC,UAAU,EACV,SAAS,EACT,KAAK,EACL,SAAS,CACV,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,IAAI,SAAS,CAAC;YACnD,MAAM,YAAY,GAAG,oCAAoC,SAAS,cAAc,UAAU,MAAM,KAAK,EAAE,CAAC;YACxG,WAAW,CAAC,IAAI,CAAC,qCAAqC,YAAY,EAAE,CAAC,CAAC;YAEtE,OAAO;gBACL,UAAU;gBACV,SAAS;gBACT,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC;gBAC/D,QAAQ;aACT,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,WAAyB,EACzB,SAAwB,EACxB,KAAgB;QAEhB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC1C,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAC3C,CAAC;QAEF,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,WAAyB,EACzB,SAAwB,EACxB,KAAgB;QAEhB,MAAM,OAAO,GAA0B,EAAE,CAAC;QAC1C,IAAI,YAAY,GAAG,KAAK,CAAC;QAEzB,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAErB,qFAAqF;YACrF,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACpC,YAAY,GAAG,IAAI,CAAC,sBAAsB,CACxC,YAAY,EACZ,MAAM,CAAC,MAAM,EACb,SAAS,CACV,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,sBAAsB,CAC5B,aAAwB,EACxB,UAAsB,EACtB,SAAwB;QAExB,sCAAsC;QACtC,MAAM,aAAa,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAE3C,0DAA0D;QAC1D,IAAI,UAAU,CAAC,kBAAkB,EAAE,CAAC;YAClC,QAAQ,SAAS,EAAE,CAAC;gBAClB,KAAK,aAAa,CAAC,WAAW;oBAC5B,IAAI,mBAAmB,IAAI,UAAU,CAAC,kBAAkB,EAAE,CAAC;wBACzD,sEAAsE;wBACtE,MAAM,iBAAiB,GACrB,UAAU,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;wBACrD,IACE,OAAO,iBAAiB,KAAK,QAAQ;4BACrC,QAAQ,IAAI,aAAa,EACzB,CAAC;4BACA,aAAkC,CAAC,MAAM;gCACxC,MAAM,GAAG,iBAAiB,CAAC;wBAC/B,CAAC;oBACH,CAAC;oBACD,MAAM;gBAER,KAAK,aAAa,CAAC,WAAW;oBAC5B,IAAI,aAAa,IAAI,UAAU,CAAC,kBAAkB,EAAE,CAAC;wBACnD,6CAA6C;wBAC7C,MAAM,qBAAqB,GAAG,UAA+B,CAAC;wBAC9D,IACE,qBAAqB,CAAC,kBAAkB,EAAE,WAAW;4BACrD,aAAa,IAAI,aAAa,EAC9B,CAAC;4BACD,sDAAsD;4BACtD,MAAM,cAAc,GAAI,aAAkC;iCACvD,WAAW,CAAC;4BACf,MAAM,cAAc,GAClB,qBAAqB,CAAC,kBAAkB,CAAC,WAAW,CAAC;4BACtD,aAAkC,CAAC,WAAW,GAAG;gCAChD,GAAG,cAAc;gCACjB,GAAG,cAAc;6BACJ,CAAC;wBAClB,CAAC;oBACH,CAAC;oBACD,MAAM;gBAER;oBACE,4DAA4D;oBAC5D,MAAM;YACV,CAAC;QACH,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAC9B,UAAsB,EACtB,SAAwB,EACxB,KAAgB,EAChB,SAAiB;QAEjB,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,oBAAoB,CAAC;QAE3D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,YAAY,GAAG,8BAA8B,CAAC;gBACpD,WAAW,CAAC,IAAI,CACd,yCAAyC,YAAY,EAAE,CACxD,CAAC;gBACF,OAAO,CAAC;oBACN,UAAU;oBACV,SAAS;oBACT,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,IAAI,KAAK,CAAC,YAAY,CAAC;oBAC9B,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACjC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAE9D,+BAA+B;YAC/B,MAAM,GAAG,GAAG;gBACV,GAAG,OAAO,CAAC,GAAG;gBACd,kBAAkB,EAAE,KAAK,CAAC,GAAG;gBAC7B,kBAAkB,EAAE,KAAK,CAAC,GAAG,EAAE,oBAAoB;aACpD,CAAC;YAEF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE;gBAC3B,GAAG;gBACH,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;YAEH,iBAAiB;YACjB,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;gBACpC,QAAQ,GAAG,IAAI,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAEtB,6BAA6B;gBAC7B,UAAU,CAAC,GAAG,EAAE;oBACd,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;wBAClB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACxB,CAAC;gBACH,CAAC,EAAE,IAAI,CAAC,CAAC;YACX,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,sBAAsB;YACtB,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;oBACrD,6EAA6E;oBAC7E,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;wBACzB,WAAW,CAAC,IAAI,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;oBAC/C,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,wEAAwE;gBACxE,mEAAmE;gBACnE,IAAI,CAAC;oBACH,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;oBACzC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBACpB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,6EAA6E;oBAC7E,IAAI,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;wBAClE,WAAW,CAAC,IAAI,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;oBACrD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,iBAAiB;YACjB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACxC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,iBAAiB;YACjB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACxC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,sBAAsB;YACtB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC7B,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAExC,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,CAAC;wBACN,UAAU;wBACV,SAAS;wBACT,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,IAAI,KAAK,CAAC,wBAAwB,OAAO,IAAI,CAAC;wBACrD,MAAM;wBACN,MAAM;wBACN,QAAQ;qBACT,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,eAAe;gBACf,IAAI,MAA8B,CAAC;gBACnC,IAAI,QAAQ,KAAK,iBAAiB,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;oBACpD,IAAI,CAAC;wBACH,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;wBACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;4BAC/B,8CAA8C;4BAC9C,mCAAmC;4BACnC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC9B,CAAC;wBACD,IAAI,MAAM,EAAE,CAAC;4BACX,MAAM,GAAG,MAAoB,CAAC;wBAChC,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,oDAAoD;wBACpD,MAAM,GAAG,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;oBACtE,CAAC;gBACH,CAAC;qBAAM,IAAI,QAAQ,KAAK,iBAAiB,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC3D,4CAA4C;oBAC5C,MAAM,GAAG,IAAI,CAAC,4BAA4B,CACxC,MAAM,CAAC,IAAI,EAAE,EACb,QAAQ,IAAI,4BAA4B,CACzC,CAAC;gBACJ,CAAC;gBAED,OAAO,CAAC;oBACN,UAAU;oBACV,SAAS;oBACT,OAAO,EAAE,QAAQ,KAAK,iBAAiB;oBACvC,MAAM;oBACN,MAAM;oBACN,MAAM;oBACN,QAAQ,EAAE,QAAQ,IAAI,iBAAiB;oBACvC,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,wBAAwB;YACxB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAExC,OAAO,CAAC;oBACN,UAAU;oBACV,SAAS;oBACT,OAAO,EAAE,KAAK;oBACd,KAAK;oBACL,MAAM;oBACN,MAAM;oBACN,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,OAAe,EAAE,KAAgB;QACrD,OAAO,OAAO;aACX,OAAO,CAAC,uBAAuB,EAAE,KAAK,CAAC,GAAG,CAAC;aAC3C,OAAO,CAAC,uBAAuB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB;IACtE,CAAC;IAED;;OAEG;IACK,4BAA4B,CAClC,IAAY,EACZ,QAAgB;QAEhB,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACnC,0DAA0D;YAC1D,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,aAAa,EAAE,IAAI;aACpB,CAAC;QACJ,CAAC;aAAM,IAAI,QAAQ,KAAK,wBAAwB,EAAE,CAAC;YACjD,iBAAiB;YACjB,OAAO;gBACL,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,IAAI;aACb,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,aAAa,EAAE,YAAY,IAAI,EAAE;aAClC,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"hookRunner.js","sourceRoot":"","sources":["../../../src/hooks/hookRunner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAYzD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EACL,cAAc,EACd,qBAAqB,GAEtB,MAAM,yBAAyB,CAAC;AAEjC;;GAEG;AACH,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC;;GAEG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAEvC;;GAEG;AACH,MAAM,OAAO,UAAU;IACJ,MAAM,CAAS;IAEhC,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,UAAsB,EACtB,SAAwB,EACxB,KAAgB;QAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,uFAAuF;QACvF,IACE,UAAU,CAAC,MAAM,KAAK,YAAY,CAAC,OAAO;YAC1C,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,EAC9B,CAAC;YACD,MAAM,YAAY,GAChB,iEAAiE,CAAC;YACpE,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC/B,OAAO;gBACL,UAAU;gBACV,SAAS;gBACT,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,KAAK,CAAC,YAAY,CAAC;gBAC9B,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAClC,UAAU,EACV,SAAS,EACT,KAAK,EACL,SAAS,CACV,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,IAAI,SAAS,CAAC;YAClE,MAAM,YAAY,GAAG,oCAAoC,SAAS,YAAY,MAAM,MAAM,KAAK,EAAE,CAAC;YAClG,WAAW,CAAC,IAAI,CAAC,qCAAqC,YAAY,EAAE,CAAC,CAAC;YAEtE,OAAO;gBACL,UAAU;gBACV,SAAS;gBACT,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC;gBAC/D,QAAQ;aACT,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,WAAyB,EACzB,SAAwB,EACxB,KAAgB,EAChB,WAAyD,EACzD,SAAqE;QAErE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;YACvD,WAAW,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YAChE,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,WAAyB,EACzB,SAAwB,EACxB,KAAgB,EAChB,WAAyD,EACzD,SAAqE;QAErE,MAAM,OAAO,GAA0B,EAAE,CAAC;QAC1C,IAAI,YAAY,GAAG,KAAK,CAAC;QAEzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC9B,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YACvE,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAErB,qFAAqF;YACrF,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACpC,YAAY,GAAG,IAAI,CAAC,sBAAsB,CACxC,YAAY,EACZ,MAAM,CAAC,MAAM,EACb,SAAS,CACV,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,sBAAsB,CAC5B,aAAwB,EACxB,UAAsB,EACtB,SAAwB;QAExB,sCAAsC;QACtC,MAAM,aAAa,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAE3C,0DAA0D;QAC1D,IAAI,UAAU,CAAC,kBAAkB,EAAE,CAAC;YAClC,QAAQ,SAAS,EAAE,CAAC;gBAClB,KAAK,aAAa,CAAC,WAAW;oBAC5B,IAAI,mBAAmB,IAAI,UAAU,CAAC,kBAAkB,EAAE,CAAC;wBACzD,sEAAsE;wBACtE,MAAM,iBAAiB,GACrB,UAAU,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;wBACrD,IACE,OAAO,iBAAiB,KAAK,QAAQ;4BACrC,QAAQ,IAAI,aAAa,EACzB,CAAC;4BACA,aAAkC,CAAC,MAAM;gCACxC,MAAM,GAAG,iBAAiB,CAAC;wBAC/B,CAAC;oBACH,CAAC;oBACD,MAAM;gBAER,KAAK,aAAa,CAAC,WAAW;oBAC5B,IAAI,aAAa,IAAI,UAAU,CAAC,kBAAkB,EAAE,CAAC;wBACnD,6CAA6C;wBAC7C,MAAM,qBAAqB,GAAG,UAA+B,CAAC;wBAC9D,IACE,qBAAqB,CAAC,kBAAkB,EAAE,WAAW;4BACrD,aAAa,IAAI,aAAa,EAC9B,CAAC;4BACD,sDAAsD;4BACtD,MAAM,cAAc,GAAI,aAAkC;iCACvD,WAAW,CAAC;4BACf,MAAM,cAAc,GAClB,qBAAqB,CAAC,kBAAkB,CAAC,WAAW,CAAC;4BACtD,aAAkC,CAAC,WAAW,GAAG;gCAChD,GAAG,cAAc;gCACjB,GAAG,cAAc;6BACJ,CAAC;wBAClB,CAAC;oBACH,CAAC;oBACD,MAAM;gBAER,KAAK,aAAa,CAAC,UAAU;oBAC3B,IAAI,YAAY,IAAI,UAAU,CAAC,kBAAkB,EAAE,CAAC;wBAClD,MAAM,YAAY,GAAG,UAAU,CAAC,kBAAkB,CAChD,YAAY,CACc,CAAC;wBAC7B,IAAI,YAAY,IAAI,YAAY,IAAI,aAAa,EAAE,CAAC;4BACjD,aAAiC,CAAC,UAAU,GAAG;gCAC9C,GAAI,aAAiC,CAAC,UAAU;gCAChD,GAAG,YAAY;6BAChB,CAAC;wBACJ,CAAC;oBACH,CAAC;oBACD,MAAM;gBAER;oBACE,4DAA4D;oBAC5D,MAAM;YACV,CAAC;QACH,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAC9B,UAAsB,EACtB,SAAwB,EACxB,KAAgB,EAChB,SAAiB;QAEjB,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,oBAAoB,CAAC;QAE3D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,YAAY,GAAG,8BAA8B,CAAC;gBACpD,WAAW,CAAC,IAAI,CACd,yCAAyC,YAAY,EAAE,CACxD,CAAC;gBACF,OAAO,CAAC;oBACN,UAAU;oBACV,SAAS;oBACT,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,IAAI,KAAK,CAAC,YAAY,CAAC;oBAC9B,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACjC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,WAAW,GAAG,qBAAqB,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAChC,UAAU,CAAC,OAAO,EAClB,KAAK,EACL,WAAW,CAAC,KAAK,CAClB,CAAC;YAEF,+BAA+B;YAC/B,MAAM,GAAG,GAAG;gBACV,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;gBACnE,kBAAkB,EAAE,KAAK,CAAC,GAAG;gBAC7B,kBAAkB,EAAE,KAAK,CAAC,GAAG,EAAE,oBAAoB;aACpD,CAAC;YAEF,MAAM,KAAK,GAAG,KAAK,CACjB,WAAW,CAAC,UAAU,EACtB,CAAC,GAAG,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,EACpC;gBACE,GAAG;gBACH,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,KAAK,EAAE,KAAK;aACb,CACF,CAAC;YAEF,iBAAiB;YACjB,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;gBACpC,QAAQ,GAAG,IAAI,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAEtB,6BAA6B;gBAC7B,UAAU,CAAC,GAAG,EAAE;oBACd,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;wBAClB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACxB,CAAC;gBACH,CAAC,EAAE,IAAI,CAAC,CAAC;YACX,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,sBAAsB;YACtB,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;oBACrD,6EAA6E;oBAC7E,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;wBACzB,WAAW,CAAC,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;oBAChD,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,wEAAwE;gBACxE,mEAAmE;gBACnE,IAAI,CAAC;oBACH,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;oBACzC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBACpB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,6EAA6E;oBAC7E,IAAI,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;wBAClE,WAAW,CAAC,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;oBACtD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,iBAAiB;YACjB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACxC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,iBAAiB;YACjB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACxC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,sBAAsB;YACtB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC7B,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAExC,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,CAAC;wBACN,UAAU;wBACV,SAAS;wBACT,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,IAAI,KAAK,CAAC,wBAAwB,OAAO,IAAI,CAAC;wBACrD,MAAM;wBACN,MAAM;wBACN,QAAQ;qBACT,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,eAAe;gBACf,IAAI,MAA8B,CAAC;gBACnC,IAAI,QAAQ,KAAK,iBAAiB,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;oBACpD,IAAI,CAAC;wBACH,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;wBACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;4BAC/B,8CAA8C;4BAC9C,mCAAmC;4BACnC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC9B,CAAC;wBACD,IAAI,MAAM,EAAE,CAAC;4BACX,MAAM,GAAG,MAAoB,CAAC;wBAChC,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,oDAAoD;wBACpD,MAAM,GAAG,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;oBACtE,CAAC;gBACH,CAAC;qBAAM,IAAI,QAAQ,KAAK,iBAAiB,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC3D,4CAA4C;oBAC5C,MAAM,GAAG,IAAI,CAAC,4BAA4B,CACxC,MAAM,CAAC,IAAI,EAAE,EACb,QAAQ,IAAI,4BAA4B,CACzC,CAAC;gBACJ,CAAC;gBAED,OAAO,CAAC;oBACN,UAAU;oBACV,SAAS;oBACT,OAAO,EAAE,QAAQ,KAAK,iBAAiB;oBACvC,MAAM;oBACN,MAAM;oBACN,MAAM;oBACN,QAAQ,EAAE,QAAQ,IAAI,iBAAiB;oBACvC,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,wBAAwB;YACxB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAExC,OAAO,CAAC;oBACN,UAAU;oBACV,SAAS;oBACT,OAAO,EAAE,KAAK;oBACd,KAAK;oBACL,MAAM;oBACN,MAAM;oBACN,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,aAAa,CACnB,OAAe,EACf,KAAgB,EAChB,SAAoB;QAEpB,WAAW,CAAC,KAAK,CAAC,2BAA2B,OAAO,UAAU,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACxD,OAAO,OAAO;aACX,OAAO,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC;aAClD,OAAO,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,oBAAoB;IAC7E,CAAC;IAED;;OAEG;IACK,4BAA4B,CAClC,IAAY,EACZ,QAAgB;QAEhB,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACnC,0DAA0D;YAC1D,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,aAAa,EAAE,IAAI;aACpB,CAAC;QACJ,CAAC;aAAM,IAAI,QAAQ,KAAK,wBAAwB,EAAE,CAAC;YACjD,iBAAiB;YACjB,OAAO;gBACL,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,IAAI;aACb,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,aAAa,EAAE,YAAY,IAAI,EAAE;aAClC,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/src/hooks/hookRunner.test.js

@@ -6,7 +6,7 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { spawn } from 'node:child_process';
 import { HookRunner } from './hookRunner.js';
-import { HookEventName, HookType } from './types.js';
+import { HookEventName, HookType, ConfigSource } from './types.js';
 // Mock child_process with importOriginal for partial mocking
 vi.mock('node:child_process', async (importOriginal) => {
     const actual = await importOriginal();
@@ -15,6 +15,16 @@ vi.mock('node:child_process', async (importOriginal) => {
         spawn: vi.fn(),
     };
 });
+// Mock debugLogger using vi.hoisted
+const mockDebugLogger = vi.hoisted(() => ({
+    log: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    debug: vi.fn(),
+}));
+vi.mock('../utils/debugLogger.js', () => ({
+    debugLogger: mockDebugLogger,
+}));
 // Mock console methods
 const mockConsole = {
     log: vi.fn(),
@@ -26,6 +36,7 @@ vi.stubGlobal('console', mockConsole);
 describe('HookRunner', () => {
     let hookRunner;
     let mockSpawn;
+    let mockConfig;
     const mockInput = {
         session_id: 'test-session',
         transcript_path: '/path/to/transcript',
@@ -35,7 +46,13 @@ describe('HookRunner', () => {
     };
     beforeEach(() => {
         vi.resetAllMocks();
-        hookRunner = new HookRunner();
+        mockConfig = {
+            isTrustedFolder: vi.fn().mockReturnValue(true),
+            sanitizationConfig: {
+                enableEnvironmentVariableRedaction: true,
+            },
+        };
+        hookRunner = new HookRunner(mockConfig);
         // Mock spawn with accessible mock functions
         const mockStdoutOn = vi.fn();
         const mockStderrOn = vi.fn();
@@ -65,6 +82,55 @@ describe('HookRunner', () => {
         vi.restoreAllMocks();
     });
     describe('executeHook', () => {
+        describe('security checks', () => {
+            it('should block project hooks in untrusted folders', async () => {
+                vi.mocked(mockConfig.isTrustedFolder).mockReturnValue(false);
+                const projectHookConfig = {
+                    type: HookType.Command,
+                    command: './hooks/test.sh',
+                    source: ConfigSource.Project,
+                };
+                const result = await hookRunner.executeHook(projectHookConfig, HookEventName.BeforeTool, mockInput);
+                expect(result.success).toBe(false);
+                expect(result.error?.message).toContain('Security: Blocked execution of project hook in untrusted folder');
+                expect(mockDebugLogger.warn).toHaveBeenCalledWith(expect.stringContaining('Security: Blocked execution'));
+                expect(spawn).not.toHaveBeenCalled();
+            });
+            it('should allow project hooks in trusted folders', async () => {
+                vi.mocked(mockConfig.isTrustedFolder).mockReturnValue(true);
+                const projectHookConfig = {
+                    type: HookType.Command,
+                    command: './hooks/test.sh',
+                    source: ConfigSource.Project,
+                };
+                // Mock successful execution
+                mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
+                    if (event === 'close') {
+                        setTimeout(() => callback(0), 10);
+                    }
+                });
+                const result = await hookRunner.executeHook(projectHookConfig, HookEventName.BeforeTool, mockInput);
+                expect(result.success).toBe(true);
+                expect(spawn).toHaveBeenCalled();
+            });
+            it('should allow non-project hooks even in untrusted folders', async () => {
+                vi.mocked(mockConfig.isTrustedFolder).mockReturnValue(false);
+                const systemHookConfig = {
+                    type: HookType.Command,
+                    command: './hooks/test.sh',
+                    source: ConfigSource.System,
+                };
+                // Mock successful execution
+                mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
+                    if (event === 'close') {
+                        setTimeout(() => callback(0), 10);
+                    }
+                });
+                const result = await hookRunner.executeHook(systemHookConfig, HookEventName.BeforeTool, mockInput);
+                expect(result.success).toBe(true);
+                expect(spawn).toHaveBeenCalled();
+            });
+        });
         describe('command hooks', () => {
             const commandConfig = {
                 type: HookType.Command,
@@ -76,12 +142,12 @@ describe('HookRunner', () => {
                 // Mock successful execution
                 mockSpawn.mockStdoutOn.mockImplementation((event, callback) => {
                     if (event === 'data') {
-                        setTimeout(() => callback(Buffer.from(JSON.stringify(mockOutput))), 10);
+                        setImmediate(() => callback(Buffer.from(JSON.stringify(mockOutput))));
                     }
                 });
                 mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
                     if (event === 'close') {
-                        setTimeout(() => callback(0), 20);
+                        setImmediate(() => callback(0));
                     }
                 });
                 const result = await hookRunner.executeHook(commandConfig, HookEventName.BeforeTool, mockInput);
@@ -94,12 +160,12 @@ describe('HookRunner', () => {
                 const errorMessage = 'Command failed';
                 mockSpawn.mockStderrOn.mockImplementation((event, callback) => {
                     if (event === 'data') {
-                        setTimeout(() => callback(Buffer.from(errorMessage)), 10);
+                        setImmediate(() => callback(Buffer.from(errorMessage)));
                     }
                 });
                 mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
                     if (event === 'close') {
-                        setTimeout(() => callback(1), 20);
+                        setImmediate(() => callback(1));
                     }
                 });
                 const result = await hookRunner.executeHook(commandConfig, HookEventName.BeforeTool, mockInput);
@@ -107,6 +173,19 @@ describe('HookRunner', () => {
                 expect(result.exitCode).toBe(1);
                 expect(result.stderr).toBe(errorMessage);
             });
+            it('should use hook name in error messages if available', async () => {
+                const namedConfig = {
+                    name: 'my-friendly-hook',
+                    type: HookType.Command,
+                    command: './hooks/fail.sh',
+                };
+                // Mock error during spawn
+                vi.mocked(spawn).mockImplementationOnce(() => {
+                    throw new Error('Spawn error');
+                });
+                await hookRunner.executeHook(namedConfig, HookEventName.BeforeTool, mockInput);
+                expect(mockDebugLogger.warn).toHaveBeenCalledWith(expect.stringContaining('(hook: my-friendly-hook): Error: Spawn error'));
+            });
             it('should handle command hook timeout', async () => {
                 const shortTimeoutConfig = {
                     type: HookType.Command,
@@ -126,9 +205,9 @@ describe('HookRunner', () => {
                     killWasCalled = true;
                     // Simulate that killing the process triggers the close event
                     if (closeCallback) {
-                        setTimeout(() => {
+                        setImmediate(() => {
                             closeCallback(128); // Exit code 128 indicates process was killed by signal
-                        }, 5);
+                        });
                     }
                     return true;
                 });
@@ -145,18 +224,42 @@ describe('HookRunner', () => {
                 };
                 mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
                     if (event === 'close') {
-                        setTimeout(() => callback(0), 10);
+                        setImmediate(() => callback(0));
                     }
                 });
                 await hookRunner.executeHook(configWithEnvVar, HookEventName.BeforeTool, mockInput);
-                expect(spawn).toHaveBeenCalledWith('/test/project/hooks/test.sh', expect.objectContaining({
-                    shell: true,
+                expect(spawn).toHaveBeenCalledWith(expect.stringMatching(/bash|powershell/), expect.arrayContaining([
+                    expect.stringMatching(/['"]?\/test\/project['"]?\/hooks\/test\.sh/),
+                ]), expect.objectContaining({
+                    shell: false,
                     env: expect.objectContaining({
                         GEMINI_PROJECT_DIR: '/test/project',
                         CLAUDE_PROJECT_DIR: '/test/project',
                     }),
                 }));
             });
+            it('should not allow command injection via GEMINI_PROJECT_DIR', async () => {
+                const maliciousCwd = '/test/project; echo "pwned" > /tmp/pwned';
+                const mockMaliciousInput = {
+                    ...mockInput,
+                    cwd: maliciousCwd,
+                };
+                const config = {
+                    type: HookType.Command,
+                    command: 'ls $GEMINI_PROJECT_DIR',
+                };
+                // Mock the process closing immediately
+                mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
+                    if (event === 'close') {
+                        setImmediate(() => callback(0));
+                    }
+                });
+                await hookRunner.executeHook(config, HookEventName.BeforeTool, mockMaliciousInput);
+                // If secure, spawn will be called with the shell executable and escaped command
+                expect(spawn).toHaveBeenCalledWith(expect.stringMatching(/bash|powershell/), expect.arrayContaining([
+                    expect.stringMatching(/ls (['"]).*echo.*pwned.*\1/),
+                ]), expect.objectContaining({ shell: false }));
+            });
         });
     });
     describe('executeHooksParallel', () => {
@@ -168,7 +271,7 @@ describe('HookRunner', () => {
             // Mock both commands to succeed
             mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
                 if (event === 'close') {
-                    setTimeout(() => callback(0), 10);
+                    setImmediate(() => callback(0));
                 }
             });
             const results = await hookRunner.executeHooksParallel(configs, HookEventName.BeforeTool, mockInput);
@@ -176,6 +279,21 @@ describe('HookRunner', () => {
             expect(results.every((r) => r.success)).toBe(true);
             expect(spawn).toHaveBeenCalledTimes(2);
         });
+        it('should call onHookStart and onHookEnd callbacks', async () => {
+            const configs = [
+                { name: 'hook1', type: HookType.Command, command: './hook1.sh' },
+            ];
+            mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
+                if (event === 'close') {
+                    setImmediate(() => callback(0));
+                }
+            });
+            const onStart = vi.fn();
+            const onEnd = vi.fn();
+            await hookRunner.executeHooksParallel(configs, HookEventName.BeforeTool, mockInput, onStart, onEnd);
+            expect(onStart).toHaveBeenCalledWith(configs[0], 0);
+            expect(onEnd).toHaveBeenCalledWith(configs[0], expect.objectContaining({ success: true }));
+        });
         it('should handle mixed success and failure', async () => {
             const configs = [
                 { type: HookType.Command, command: './hook1.sh' },
@@ -185,7 +303,7 @@ describe('HookRunner', () => {
             mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
                 if (event === 'close') {
                     const exitCode = callCount++ === 0 ? 0 : 1; // First succeeds, second fails
-                    setTimeout(() => callback(exitCode), 10);
+                    setImmediate(() => callback(exitCode));
                 }
             });
             const results = await hookRunner.executeHooksParallel(configs, HookEventName.BeforeTool, mockInput);
@@ -204,9 +322,10 @@ describe('HookRunner', () => {
             // Mock both commands to succeed
             mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
                 if (event === 'close') {
-                    const command = vi.mocked(spawn).mock.calls[executionOrder.length][0];
+                    const args = vi.mocked(spawn).mock.calls[executionOrder.length][1];
+                    const command = args[args.length - 1];
                     executionOrder.push(command);
-                    setTimeout(() => callback(0), 10);
+                    setImmediate(() => callback(0));
                 }
             });
             const results = await hookRunner.executeHooksSequential(configs, HookEventName.BeforeTool, mockInput);
@@ -216,6 +335,24 @@ describe('HookRunner', () => {
             // Verify they were called sequentially
             expect(executionOrder).toEqual(['./hook1.sh', './hook2.sh']);
         });
+        it('should call onHookStart and onHookEnd callbacks sequentially', async () => {
+            const configs = [
+                { name: 'hook1', type: HookType.Command, command: './hook1.sh' },
+                { name: 'hook2', type: HookType.Command, command: './hook2.sh' },
+            ];
+            mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
+                if (event === 'close') {
+                    setImmediate(() => callback(0));
+                }
+            });
+            const onStart = vi.fn();
+            const onEnd = vi.fn();
+            await hookRunner.executeHooksSequential(configs, HookEventName.BeforeTool, mockInput, onStart, onEnd);
+            expect(onStart).toHaveBeenCalledTimes(2);
+            expect(onEnd).toHaveBeenCalledTimes(2);
+            expect(onStart).toHaveBeenNthCalledWith(1, configs[0], 0);
+            expect(onStart).toHaveBeenNthCalledWith(2, configs[1], 1);
+        });
         it('should continue execution even if a hook fails', async () => {
             const configs = [
                 { type: HookType.Command, command: './hook1.sh' },
@@ -226,13 +363,13 @@ describe('HookRunner', () => {
             mockSpawn.mockStderrOn.mockImplementation((event, callback) => {
                 if (event === 'data' && callCount === 1) {
                     // Second hook fails
-                    setTimeout(() => callback(Buffer.from('Hook 2 failed')), 10);
+                    setImmediate(() => callback(Buffer.from('Hook 2 failed')));
                 }
             });
             mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
                 if (event === 'close') {
                     const exitCode = callCount++ === 1 ? 1 : 0; // Second fails, others succeed
-                    setTimeout(() => callback(exitCode), 20);
+                    setImmediate(() => callback(exitCode));
                 }
             });
             const results = await hookRunner.executeHooksSequential(configs, HookEventName.BeforeTool, mockInput);
@@ -261,14 +398,14 @@ describe('HookRunner', () => {
             mockSpawn.mockStdoutOn.mockImplementation((event, callback) => {
                 if (event === 'data') {
                     if (hookCallCount === 0) {
-                        setTimeout(() => callback(Buffer.from(JSON.stringify(mockOutput1))), 10);
+                        setImmediate(() => callback(Buffer.from(JSON.stringify(mockOutput1))));
                     }
                 }
             });
             mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
                 if (event === 'close') {
                     hookCallCount++;
-                    setTimeout(() => callback(0), 20);
+                    setImmediate(() => callback(0));
                 }
             });
             const results = await hookRunner.executeHooksSequential(configs, HookEventName.BeforeAgent, mockBeforeAgentInput);
@@ -304,14 +441,14 @@ describe('HookRunner', () => {
             mockSpawn.mockStdoutOn.mockImplementation((event, callback) => {
                 if (event === 'data') {
                     if (hookCallCount === 0) {
-                        setTimeout(() => callback(Buffer.from(JSON.stringify(mockOutput1))), 10);
+                        setImmediate(() => callback(Buffer.from(JSON.stringify(mockOutput1))));
                     }
                 }
             });
             mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
                 if (event === 'close') {
                     hookCallCount++;
-                    setTimeout(() => callback(0), 20);
+                    setImmediate(() => callback(0));
                 }
             });
             const results = await hookRunner.executeHooksSequential(configs, HookEventName.BeforeModel, mockBeforeModelInput);
@@ -329,12 +466,12 @@ describe('HookRunner', () => {
             ];
             mockSpawn.mockStderrOn.mockImplementation((event, callback) => {
                 if (event === 'data') {
-                    setTimeout(() => callback(Buffer.from('Hook failed')), 10);
+                    setImmediate(() => callback(Buffer.from('Hook failed')));
                 }
             });
             mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
                 if (event === 'close') {
-                    setTimeout(() => callback(1), 20); // All hooks fail
+                    setImmediate(() => callback(1)); // All hooks fail
                 }
             });
             const results = await hookRunner.executeHooksSequential(configs, HookEventName.BeforeTool, mockInput);
@@ -355,12 +492,12 @@ describe('HookRunner', () => {
             const invalidJson = '{ "decision": "allow", incomplete';
             mockSpawn.mockStdoutOn.mockImplementation((event, callback) => {
                 if (event === 'data') {
-                    setTimeout(() => callback(Buffer.from(invalidJson)), 10);
+                    setImmediate(() => callback(Buffer.from(invalidJson)));
                 }
             });
             mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
                 if (event === 'close') {
-                    setTimeout(() => callback(0), 20);
+                    setImmediate(() => callback(0));
                 }
             });
             const result = await hookRunner.executeHook(commandConfig, HookEventName.BeforeTool, mockInput);
@@ -376,12 +513,12 @@ describe('HookRunner', () => {
             const malformedJson = 'not json at all';
             mockSpawn.mockStdoutOn.mockImplementation((event, callback) => {
                 if (event === 'data') {
-                    setTimeout(() => callback(Buffer.from(malformedJson)), 10);
+                    setImmediate(() => callback(Buffer.from(malformedJson)));
                 }
             });
             mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
                 if (event === 'close') {
-                    setTimeout(() => callback(0), 20);
+                    setImmediate(() => callback(0));
                 }
             });
             const result = await hookRunner.executeHook(commandConfig, HookEventName.BeforeTool, mockInput);
@@ -395,12 +532,12 @@ describe('HookRunner', () => {
             const invalidJson = '{ broken json';
             mockSpawn.mockStderrOn.mockImplementation((event, callback) => {
                 if (event === 'data') {
-                    setTimeout(() => callback(Buffer.from(invalidJson)), 10);
+                    setImmediate(() => callback(Buffer.from(invalidJson)));
                 }
             });
             mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
                 if (event === 'close') {
-                    setTimeout(() => callback(1), 20);
+                    setImmediate(() => callback(1));
                 }
             });
             const result = await hookRunner.executeHook(commandConfig, HookEventName.BeforeTool, mockInput);
@@ -415,12 +552,12 @@ describe('HookRunner', () => {
             const invalidJson = '{ "error": incomplete';
             mockSpawn.mockStderrOn.mockImplementation((event, callback) => {
                 if (event === 'data') {
-                    setTimeout(() => callback(Buffer.from(invalidJson)), 10);
+                    setImmediate(() => callback(Buffer.from(invalidJson)));
                 }
             });
             mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
                 if (event === 'close') {
-                    setTimeout(() => callback(2), 20);
+                    setImmediate(() => callback(2));
                 }
             });
             const result = await hookRunner.executeHook(commandConfig, HookEventName.BeforeTool, mockInput);
@@ -434,12 +571,12 @@ describe('HookRunner', () => {
         it('should handle empty JSON output', async () => {
             mockSpawn.mockStdoutOn.mockImplementation((event, callback) => {
                 if (event === 'data') {
-                    setTimeout(() => callback(Buffer.from('')), 10);
+                    setImmediate(() => callback(Buffer.from('')));
                 }
             });
             mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
                 if (event === 'close') {
-                    setTimeout(() => callback(0), 20);
+                    setImmediate(() => callback(0));
                 }
             });
             const result = await hookRunner.executeHook(commandConfig, HookEventName.BeforeTool, mockInput);
@@ -452,12 +589,12 @@ describe('HookRunner', () => {
             const doubleEncodedJson = JSON.stringify(JSON.stringify(mockOutput));
             mockSpawn.mockStdoutOn.mockImplementation((event, callback) => {
                 if (event === 'data') {
-                    setTimeout(() => callback(Buffer.from(doubleEncodedJson)), 10);
+                    setImmediate(() => callback(Buffer.from(doubleEncodedJson)));
                 }
             });
             mockSpawn.mockProcessOn.mockImplementation((event, callback) => {
                 if (event === 'close') {
-                    setTimeout(() => callback(0), 20);
+                    setImmediate(() => callback(0));
                 }
             });
             const result = await hookRunner.executeHook(commandConfig, HookEventName.BeforeTool, mockInput);