@reneturcios/hookcheck 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Rene Turcios
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,109 @@
-# Temporary Holding Version
+# hookcheck
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**Find the hooks that run before you do. One scan, every auto-exec surface, one verdict.**
+
+Modern supply chain attacks do not need you to run anything. They persist through hooks that run automatically: an npm `postinstall` script, a Claude Code `SessionStart` hook in `.claude/settings.json`, a VS Code task set to run on folder open. The Shai-Hulud npm worm used exactly this pattern, planting a preinstall dropper and then persisting through agent and editor hooks so it survived cleanup and stole credentials on the next open.
+
+hookcheck scans a local repo for every auto-exec hook, classifies each one, and prints a single verdict: CLEAN, REVIEW, or COMPROMISED-PATTERN, with the file, command, rules, and evidence for every finding. Deterministic only. No LLM, no network in the core scan.
+
+## Why this exists
+
+Reports in October 2026 described AI agents orchestrating attacks and a self-propagating npm worm that backdoored hundreds of packages. Its persistence layer was not exotic malware. It was ordinary config files that every developer and every coding agent already trusts: package.json install scripts, `.claude/settings.json` hooks, and `.vscode/tasks.json` folderOpen tasks. Defenders needed a fast local check that an agent itself can call before opening, installing, or trusting a repo. That is hookcheck.
+
+## What it checks
+
+| surface | what it looks for |
+| --- | --- |
+| `package.json` | preinstall, install, postinstall, prepare scripts |
+| `.claude/settings.json` and `settings.local.json` | SessionStart, PreToolUse, and other hook commands |
+| `.vscode/tasks.json` | tasks with runOn folderOpen, plus task inventory |
+| `.husky/` | every hook file and its full command content |
+| `lefthook.yml` | run commands |
+| `.pre-commit-config.yaml` | entry commands and remote repo URLs |
+| `.cursor/` and `.codex/` | config commands and files |
+| MCP configs | `.mcp.json`, `mcp.json`, `.vscode/mcp.json`, `.cursor/mcp.json` servers that autostart |
+| `.github/workflows/` | run steps, as inventory |
+| `.githooks/` | hook files |
+
+Classification per hook:
+
+- **SAFE**: matches known safe dev patterns such as test, lint, build, typecheck, husky, or lint-staged, and matches no risky rule.
+- **RISKY**: matches at least one risky rule: network fetch, curl piped to a shell, credential store paths such as ~/.ssh or ~/.aws, environment secret access, base64 decoding or eval style obfuscation, shell spawning, inline code execution, or a remote URL.
+- **UNKNOWN**: matches neither safe nor risky patterns. A local script name alone is UNKNOWN until a human reads it. When a hook runs a local file such as `node setup.mjs`, hookcheck reads that file and escalates the finding if the file itself matches risky rules.
+
+Verdict rules:
+
+- **CLEAN**: every finding is SAFE, or no hooks were found. Exit code 0.
+- **REVIEW**: at least one UNKNOWN finding, or a RISKY finding without a remote fetch or credential rule. Exit code 1.
+- **COMPROMISED-PATTERN**: at least one RISKY finding that fetches remote code or touches credential stores. This is the Shai-Hulud persistence shape. Treat the repo as untrusted until proven otherwise. Exit code 1.
+
+Every finding reports file, hook id, command text, classification, rule ids, and evidence. Malformed JSON is reported as a warning, never silently ignored.
+
+## Usage
+
+### CLI
+
+```bash
+npx @reneturcios/hookcheck scan
+npx @reneturcios/hookcheck scan ./some-repo
+npx @reneturcios/hookcheck scan ./some-repo --json
+npx @reneturcios/hookcheck explain ./some-repo package.json:postinstall
+```
+
+Example output:
+
+```
+hookcheck ./some-repo: COMPROMISED-PATTERN
+  2 hook(s): 0 SAFE, 2 RISKY, 0 UNKNOWN
+  [RISKY] package.json:postinstall (package.json)
+      command: node setup.mjs
+      rules: NET-FETCH, ENV-ACCESS
+      evidence: referenced local file setup.mjs is RISKY: NET-FETCH: performs a network fetch
+COMPROMISED-PATTERN: at least one risky hook fetches remote code or touches credential stores.
+```
+
+### MCP server
+
+Add to your MCP client config:
+
+```json
+{
+  "mcpServers": {
+    "hookcheck": {
+      "command": "npx",
+      "args": ["-y", "@reneturcios/hookcheck", "mcp"]
+    }
+  }
+}
+```
+
+Tools:
+
+- `scan_hooks(path)`: full scan with verdict, findings, counts, and warnings.
+- `explain_hook(path, hookId or file)`: one hook explained in plain language with its evidence.
+
+### Docker
+
+```bash
+docker run -i ghcr.io/cloudcorprecords/hookcheck mcp
+docker run --rm -v "$PWD:/repo" ghcr.io/cloudcorprecords/hookcheck scan /repo
+```
+
+## The toolkit
+
+hookcheck is part of a family of small, single-purpose developer tools by the same author, all built the same way: one bin that serves a CLI and an MCP server, deterministic checks with evidence, no invented answers.
+
+- [greenlight](https://github.com/CloudCorpRecords/greenlight): pre-flight checks for open-source contributions: is this issue actually landable?
+- [shipcheck](https://github.com/CloudCorpRecords/shipcheck): verify a release actually shipped on every surface, or NO-GO.
+
+## Development
+
+```bash
+npm install
+npm run build
+npm test
+```
+
+## License
+
+MIT

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+/**
+ * hookcheck CLI.
+ *   hookcheck scan [path] [--json]
+ *   hookcheck mcp
+ *   hookcheck --version
+ * Exit codes: 0 CLEAN, 1 REVIEW or COMPROMISED-PATTERN, 2 usage error.
+ */
+import { explainHook, renderReport, scanHooks, VERSION } from "./core.js";
+function usage() {
+    console.error(`Usage:
+  hookcheck scan [path] [--json]
+  hookcheck explain [path] <hookId-or-file>
+  hookcheck mcp
+  hookcheck --version`);
+    process.exit(2);
+}
+async function main() {
+    const [cmd, ...rest] = process.argv.slice(2);
+    if (cmd === "--version" || cmd === "-v") {
+        console.log(VERSION);
+        return;
+    }
+    if (cmd === "mcp") {
+        await import("./mcp.js");
+        return;
+    }
+    if (!cmd)
+        usage();
+    try {
+        if (cmd === "scan") {
+            const asJson = rest.includes("--json");
+            const target = rest.find((a) => !a.startsWith("--")) ?? ".";
+            const report = scanHooks(target);
+            if (asJson)
+                console.log(JSON.stringify(report, null, 2));
+            else
+                console.log(renderReport(report));
+            process.exit(report.verdict === "CLEAN" ? 0 : 1);
+        }
+        else if (cmd === "explain") {
+            const args = rest.filter((a) => !a.startsWith("--"));
+            const asJson = rest.includes("--json");
+            let target = ".";
+            let id = "";
+            if (args.length === 1)
+                id = args[0];
+            else if (args.length >= 2) {
+                target = args[0];
+                id = args[1];
+            }
+            else
+                usage();
+            const result = explainHook(target, id);
+            if (asJson)
+                console.log(JSON.stringify(result, null, 2));
+            else
+                console.log(result.explanation);
+            process.exit(result.finding ? 0 : 1);
+        }
+        else {
+            usage();
+        }
+    }
+    catch (err) {
+        console.error(`error: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(2);
+    }
+}
+void main();
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1E,SAAS,KAAK;IACZ,OAAO,CAAC,KAAK,CAAC;;;;sBAIM,CAAC,CAAC;IACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAC1E,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,KAAK,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;YAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;gBACpD,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,MAAM,GAAG,GAAG,CAAC;YAAC,IAAI,EAAE,GAAG,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;iBAC/B,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;;gBACzD,KAAK,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvC,IAAI,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;gBACpD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,IAAI,EAAE,CAAC"}

package/dist/core.d.ts

@@ -0,0 +1,28 @@
+import { relative } from "node:path";
+import type { Classification, HookFinding, ScanReport, Verdict } from "./types.js";
+export declare const VERSION = "0.1.0";
+interface RuleDef {
+    id: string;
+    pattern: RegExp;
+    evidence: string;
+    /** True when this rule alone indicates remote code fetch. */
+    remote?: boolean;
+    /** True when this rule indicates credential store access. */
+    credential?: boolean;
+}
+export declare const RISKY_RULES: RuleDef[];
+export declare function classifyCommand(command: string): {
+    classification: Classification;
+    rules: string[];
+    evidence: string;
+};
+export declare function computeVerdict(findings: HookFinding[]): Verdict;
+export declare function scanHooks(root: string): ScanReport;
+export declare function explainHook(root: string, idOrFile: string): {
+    finding: HookFinding | null;
+    explanation: string;
+    report: ScanReport;
+};
+export declare function renderReport(report: ScanReport): string;
+export { relative };
+export type { Classification, HookFinding, ScanReport, Verdict };

package/dist/core.js

@@ -0,0 +1,471 @@
+/**
+ * hookcheck core: deterministic local scan for auto-exec hooks.
+ *
+ * No network, no LLM. Every classification comes from explicit pattern
+ * rules so the same repo always produces the same report.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
+export const VERSION = "0.1.0";
+export const RISKY_RULES = [
+    { id: "CURL-PIPE-SH", pattern: /\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh)\b/, evidence: "pipes a network download straight into a shell", remote: true },
+    { id: "NET-FETCH", pattern: /\b(curl|wget)\b|\bfetch\s*\(|https?\s*\.get\s*\(|requests\.(get|post)\b|Invoke-WebRequest\b|Invoke-RestMethod\b/, evidence: "performs a network fetch", remote: true },
+    { id: "REMOTE-URL", pattern: /https?:\/\/[^\s"'`]+/, evidence: "references a remote URL", remote: true },
+    { id: "CRED-ACCESS", pattern: /~\/\.ssh|\$HOME\/\.ssh|\.aws\/|~\/\.aws|\.gnupg|id_rsa|id_ed25519|\.npmrc\b|\.netrc\b|credentials(\.json)?\b|\.config\/gh|keychain/i, evidence: "touches a credential store path", credential: true },
+    { id: "ENV-ACCESS", pattern: /process\.env|os\.environ|getenv\s*\(|\benv\b.*\b(print|export)|\$\{?\s*(AWS_SECRET|AWS_ACCESS|GITHUB_TOKEN|GH_TOKEN|NPM_TOKEN|OPENAI_API_KEY|ANTHROPIC_API_KEY)/, evidence: "reads environment variables that commonly hold secrets" },
+    { id: "ENV-EXFIL", pattern: /(process\.env|os\.environ)[\s\S]{0,80}(fetch|https?|request|post|send|upload)/i, evidence: "combines environment access with an outbound send pattern", credential: true, remote: true },
+    { id: "OBFUSCATION", pattern: /base64\s+(-d|--decode)|atob\s*\(|Buffer\.from\s*\([^)]*base64|\\x[0-9a-fA-F]{2}|eval\s*\(|Function\s*\(/, evidence: "uses decoding or dynamic evaluation often used to hide payloads" },
+    { id: "SHELL-EXEC", pattern: /\b(child_process|execSync|spawnSync|exec\s*\()\b|\/bin\/(sh|bash)\b|powershell(\.exe)?\b|cmd\.exe\b/, evidence: "spawns a shell or child process" },
+    { id: "WRITE-OUTSIDE", pattern: /(>>?|tee)\s+~\/|(>>?|tee)\s+\$HOME\/|chmod\s+\+x/, evidence: "writes outside the repo or changes executable bits" },
+    { id: "DOWNLOAD-EXEC", pattern: /\bnode\s+-e\b|\bpython3?\s+-c\b|\bdeno\s+eval\b|\bbun\s+-e\b/, evidence: "executes inline code supplied on the command line" },
+];
+const SAFE_PATTERNS = [
+    /^(npm|npx|yarn|pnpm|bun)\s+(run\s+)?(test|lint|build|dev|start|typecheck|check|format|prepare:.*|prepublishOnly.*)$/i,
+    /^(npx\s+)?(tsc|eslint|prettier|vitest|jest|mocha|husky|lint-staged|lefthook|pre-commit)(\s|$)/i,
+    /^node\s+(--test|scripts\/|tools\/|build)/i,
+    /^(echo|true|exit 0)\b/i,
+    /^git\s+(config|rev-parse|status)/i,
+    /^patch-package$/i,
+    /^simple-git-hooks$/i,
+];
+export function classifyCommand(command) {
+    const cmd = command.trim();
+    const fired = [];
+    for (const rule of RISKY_RULES) {
+        if (rule.pattern.test(cmd))
+            fired.push(rule);
+    }
+    if (fired.length > 0) {
+        return {
+            classification: "RISKY",
+            rules: fired.map((r) => r.id),
+            evidence: fired.map((r) => `${r.id}: ${r.evidence}`).join("; "),
+        };
+    }
+    for (const safe of SAFE_PATTERNS) {
+        if (safe.test(cmd)) {
+            return { classification: "SAFE", rules: [], evidence: "matches a known safe dev pattern (test, lint, build, dev tooling)" };
+        }
+    }
+    // A bare local script or binary with no risky indicators is UNKNOWN, not SAFE:
+    // we cannot prove what a local file does without reading it, and when the
+    // referenced local file itself contains risky patterns we escalate below.
+    return { classification: "UNKNOWN", rules: [], evidence: "no known safe pattern and no risky pattern matched; manual review needed" };
+}
+/** If a command runs a local file, inspect that file for risky patterns too. */
+function escalateWithLocalFile(root, finding) {
+    const m = /\b(?:node|bash|sh|python3?|deno run|bun run)\s+([^\s;&|]+\.(?:mjs|cjs|js|ts|sh|py))\b/.exec(finding.command);
+    if (!m)
+        return finding;
+    const rel = m[1].replace(/^\.\//, "");
+    const abs = join(root, rel);
+    if (!existsSync(abs))
+        return finding;
+    let content = "";
+    try {
+        content = readFileSync(abs, "utf8").slice(0, 20000);
+    }
+    catch {
+        return finding;
+    }
+    const inner = classifyCommand(content.replace(/\n/g, " "));
+    if (inner.classification === "RISKY") {
+        const rules = Array.from(new Set([...finding.rules, ...inner.rules]));
+        return {
+            ...finding,
+            classification: "RISKY",
+            rules,
+            evidence: `${finding.evidence === "" ? "" : finding.evidence + "; "}referenced local file ${rel} is RISKY: ${inner.evidence}`,
+        };
+    }
+    return finding;
+}
+export function computeVerdict(findings) {
+    let review = false;
+    for (const f of findings) {
+        if (f.classification === "RISKY") {
+            const hasRemote = f.rules.some((id) => RISKY_RULES.find((r) => r.id === id)?.remote);
+            const hasCred = f.rules.some((id) => RISKY_RULES.find((r) => r.id === id)?.credential);
+            if (hasRemote || hasCred)
+                return "COMPROMISED-PATTERN";
+            review = true;
+        }
+        else if (f.classification === "UNKNOWN") {
+            review = true;
+        }
+    }
+    return review ? "REVIEW" : "CLEAN";
+}
+function makeFinding(root, file, source, hook, command, idSuffix) {
+    const c = classifyCommand(command);
+    const id = `${file}:${hook}${idSuffix !== undefined ? `:${idSuffix}` : ""}`;
+    const base = {
+        id, file, source, hook, command,
+        classification: c.classification, rules: c.rules,
+        evidence: c.evidence,
+    };
+    return escalateWithLocalFile(root, base);
+}
+function readText(abs) {
+    try {
+        return readFileSync(abs, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+function readJson(root, rel, warnings) {
+    const raw = readText(join(root, rel));
+    if (raw === null)
+        return null;
+    // Strip simple JSONC comments and trailing commas for VS Code style files.
+    const cleaned = raw
+        .replace(/^\s*\/\/.*$/gm, "")
+        .replace(/,\s*([}\]])/g, "$1");
+    try {
+        return JSON.parse(cleaned);
+    }
+    catch {
+        warnings.push(`Malformed JSON in ${rel}: file skipped for structured parsing`);
+        return null;
+    }
+}
+function scanPackageJson(root, findings, warnings) {
+    const rel = "package.json";
+    if (!existsSync(join(root, rel)))
+        return;
+    const data = readJson(root, rel, warnings);
+    if (!data) {
+        // readJson already warned when the file exists but is malformed. If it
+        // parsed to a non object, note it as well.
+        if (readText(join(root, rel)) !== null && !warnings.some((w) => w.includes(rel))) {
+            warnings.push(`Could not parse ${rel} as an object`);
+        }
+        return;
+    }
+    const watched = ["preinstall", "install", "postinstall", "prepare", "prepublish", "prepublishOnly"];
+    for (const name of watched) {
+        const cmd = data.scripts?.[name];
+        if (typeof cmd === "string" && cmd.trim()) {
+            findings.push(makeFinding(root, rel, "package.json", name, cmd));
+        }
+    }
+}
+function collectClaudeHooks(node, file, root, findings, prefix) {
+    if (!node || typeof node !== "object")
+        return;
+    const obj = node;
+    if (typeof obj.command === "string" && obj.command.trim()) {
+        findings.push(makeFinding(root, file, "claude-settings", prefix || "hook", obj.command, String(findings.length)));
+        return;
+    }
+    for (const [key, value] of Object.entries(obj)) {
+        if (Array.isArray(value)) {
+            value.forEach((item, i) => collectClaudeHooks(item, file, root, findings, prefix ? `${prefix}:${key}` : key));
+        }
+        else if (value && typeof value === "object") {
+            collectClaudeHooks(value, file, root, findings, prefix ? `${prefix}:${key}` : key);
+        }
+    }
+}
+function scanClaude(root, findings, warnings) {
+    for (const rel of [".claude/settings.json", ".claude/settings.local.json"]) {
+        if (!existsSync(join(root, rel)))
+            continue;
+        const data = readJson(root, rel, warnings);
+        if (!data)
+            continue;
+        if (data.hooks)
+            collectClaudeHooks(data.hooks, rel, root, findings, "");
+        else
+            warnings.push(`No hooks key in ${rel}`);
+    }
+}
+function scanVscode(root, findings, warnings) {
+    const rel = ".vscode/tasks.json";
+    if (!existsSync(join(root, rel)))
+        return;
+    const data = readJson(root, rel, warnings);
+    if (!data?.tasks)
+        return;
+    data.tasks.forEach((task, idx) => {
+        const runOptions = (task.runOptions ?? {});
+        const runOn = runOptions.runOn;
+        const isFolderOpen = runOn === "folderOpen" || (Array.isArray(runOn) && runOn.includes("folderOpen"));
+        const command = typeof task.command === "string" ? task.command : "";
+        const args = Array.isArray(task.args) ? task.args.filter((a) => typeof a === "string").join(" ") : "";
+        const full = [command, args].filter(Boolean).join(" ").trim();
+        if (!full)
+            return;
+        const label = typeof task.label === "string" ? task.label : `task-${idx}`;
+        if (isFolderOpen) {
+            findings.push(makeFinding(root, rel, "vscode-tasks", `folderOpen:${label}`, full, String(idx)));
+        }
+        else {
+            // Inventory non auto-run tasks at lower weight: still record them so
+            // explain can find them, classified by their command.
+            const f = makeFinding(root, rel, "vscode-tasks", label, full, String(idx));
+            findings.push(f);
+        }
+    });
+    // MCP config inside .vscode
+    scanMcpFile(root, ".vscode/mcp.json", findings, warnings);
+}
+function scanDirFiles(root, dirRel, source, findings) {
+    const abs = join(root, dirRel);
+    if (!existsSync(abs))
+        return;
+    let entries = [];
+    try {
+        entries = readdirSync(abs);
+    }
+    catch {
+        return;
+    }
+    for (const name of entries.sort()) {
+        const fileAbs = join(abs, name);
+        let st;
+        try {
+            st = statSync(fileAbs);
+        }
+        catch {
+            continue;
+        }
+        if (!st.isFile())
+            continue;
+        if (name === "_" || name.startsWith("."))
+            continue;
+        const content = readText(fileAbs);
+        if (content === null)
+            continue;
+        const firstMeaningful = content.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#") && !l.startsWith("set -")).join(" ");
+        const fileRel = `${dirRel}/${name}`;
+        // Entire file content is the command surface for husky style hooks.
+        findings.push(makeFinding(root, fileRel, source, name, content.trim().slice(0, 500)));
+        void firstMeaningful;
+    }
+}
+function scanLefthook(root, findings) {
+    for (const rel of ["lefthook.yml", "lefthook.yaml", ".lefthook.yml"]) {
+        if (!existsSync(join(root, rel)))
+            continue;
+        const raw = readText(join(root, rel)) ?? "";
+        const runRe = /^\s*run:\s*(.+)$/gm;
+        let m;
+        let i = 0;
+        while ((m = runRe.exec(raw)) !== null) {
+            findings.push(makeFinding(root, rel, "lefthook", "run", m[1].trim().replace(/^["']|["']$/g, ""), String(i++)));
+        }
+    }
+}
+function scanPreCommit(root, findings) {
+    const rel = ".pre-commit-config.yaml";
+    if (!existsSync(join(root, rel)))
+        return;
+    const raw = readText(join(root, rel)) ?? "";
+    const entryRe = /^\s*entry:\s*(.+)$/gm;
+    let m;
+    let i = 0;
+    while ((m = entryRe.exec(raw)) !== null) {
+        findings.push(makeFinding(root, rel, "pre-commit", "entry", m[1].trim().replace(/^["']|["']$/g, ""), String(i++)));
+    }
+    const repoRe = /^\s*-\s*repo:\s*(https?:\/\/\S+)$/gm;
+    while ((m = repoRe.exec(raw)) !== null) {
+        findings.push(makeFinding(root, rel, "pre-commit", "remote-repo", m[1].trim(), String(i++)));
+    }
+}
+function scanAgentDirs(root, findings, warnings) {
+    for (const [dir, source] of [[".cursor", "cursor"], [".codex", "codex"]]) {
+        const abs = join(root, dir);
+        if (!existsSync(abs))
+            continue;
+        let entries = [];
+        try {
+            entries = readdirSync(abs);
+        }
+        catch {
+            continue;
+        }
+        for (const name of entries.sort()) {
+            const fileAbs = join(abs, name);
+            let st;
+            try {
+                st = statSync(fileAbs);
+            }
+            catch {
+                continue;
+            }
+            if (!st.isFile())
+                continue;
+            const rel = `${dir}/${name}`;
+            if (name.endsWith(".json")) {
+                const data = readJson(root, rel, warnings);
+                if (data)
+                    collectGenericCommands(data, rel, root, findings, source);
+            }
+            else {
+                const content = readText(fileAbs);
+                if (content && content.trim()) {
+                    findings.push(makeFinding(root, rel, source, name, content.trim().slice(0, 500)));
+                }
+            }
+            if (name === "mcp.json")
+                scanMcpFile(root, rel, findings, warnings);
+        }
+    }
+}
+function collectGenericCommands(node, file, root, findings, source, prefix = "") {
+    if (!node || typeof node !== "object")
+        return;
+    const obj = node;
+    if (typeof obj.command === "string" && obj.command.trim()) {
+        const args = Array.isArray(obj.args) ? obj.args.filter((a) => typeof a === "string").join(" ") : "";
+        findings.push(makeFinding(root, file, source, prefix || "command", [obj.command, args].filter(Boolean).join(" "), String(findings.length)));
+    }
+    for (const [key, value] of Object.entries(obj)) {
+        if (value && typeof value === "object")
+            collectGenericCommands(value, file, root, findings, source, prefix ? `${prefix}:${key}` : key);
+    }
+}
+function scanMcpFile(root, rel, findings, warnings) {
+    if (!existsSync(join(root, rel)))
+        return;
+    const data = readJson(root, rel, warnings);
+    if (!data)
+        return;
+    const servers = (data.mcpServers ?? data.servers ?? {});
+    if (!servers || typeof servers !== "object")
+        return;
+    for (const [name, cfg] of Object.entries(servers)) {
+        if (!cfg || typeof cfg !== "object")
+            continue;
+        const c = cfg;
+        const command = typeof c.command === "string" ? c.command : "";
+        const args = Array.isArray(c.args) ? c.args.filter((a) => typeof a === "string").join(" ") : "";
+        const full = [command, args].filter(Boolean).join(" ").trim();
+        if (full)
+            findings.push(makeFinding(root, rel, "mcp-config", `mcp:${name}`, full));
+        if (typeof c.url === "string" && c.url) {
+            findings.push(makeFinding(root, rel, "mcp-config", `mcp:${name}:url`, c.url));
+        }
+    }
+}
+function scanWorkflows(root, findings) {
+    const dir = ".github/workflows";
+    const abs = join(root, dir);
+    if (!existsSync(abs))
+        return;
+    let entries = [];
+    try {
+        entries = readdirSync(abs);
+    }
+    catch {
+        return;
+    }
+    for (const name of entries.sort()) {
+        if (!/\.(yml|yaml)$/.test(name))
+            continue;
+        const rel = `${dir}/${name}`;
+        const raw = readText(join(root, rel)) ?? "";
+        const runRe = /^\s*-?\s*run:\s*(.+)$/gm;
+        let m;
+        let i = 0;
+        while ((m = runRe.exec(raw)) !== null) {
+            const cmd = m[1].trim();
+            if (cmd === "|" || cmd === ">" || cmd === "")
+                continue;
+            findings.push(makeFinding(root, rel, "github-workflow", "run", cmd, String(i++)));
+        }
+    }
+}
+function scanGitHooks(root, findings) {
+    scanDirFiles(root, ".githooks", "githooks", findings);
+}
+export function scanHooks(root) {
+    const findings = [];
+    const warnings = [];
+    if (!existsSync(root)) {
+        warnings.push(`Path does not exist: ${root}`);
+        return {
+            path: root, verdict: "REVIEW", findings, warnings,
+            counts: { total: 0, safe: 0, risky: 0, unknown: 0 },
+            scannedAt: new Date().toISOString(),
+        };
+    }
+    scanPackageJson(root, findings, warnings);
+    scanClaude(root, findings, warnings);
+    scanVscode(root, findings, warnings);
+    scanDirFiles(root, ".husky", "husky", findings);
+    scanLefthook(root, findings);
+    scanPreCommit(root, findings);
+    scanAgentDirs(root, findings, warnings);
+    for (const rel of [".mcp.json", "mcp.json", ".cursor/mcp.json"])
+        scanMcpFile(root, rel, findings, warnings);
+    scanWorkflows(root, findings);
+    scanGitHooks(root, findings);
+    // Dedupe identical ids (agent dir scan may double count mcp.json).
+    const seen = new Set();
+    const deduped = findings.filter((f) => {
+        const key = `${f.id}|${f.command}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+    const counts = {
+        total: deduped.length,
+        safe: deduped.filter((f) => f.classification === "SAFE").length,
+        risky: deduped.filter((f) => f.classification === "RISKY").length,
+        unknown: deduped.filter((f) => f.classification === "UNKNOWN").length,
+    };
+    return {
+        path: root,
+        verdict: computeVerdict(deduped),
+        findings: deduped,
+        counts,
+        warnings,
+        scannedAt: new Date().toISOString(),
+    };
+}
+export function explainHook(root, idOrFile) {
+    const report = scanHooks(root);
+    const finding = report.findings.find((f) => f.id === idOrFile || f.file === idOrFile || f.id.startsWith(idOrFile)) ?? null;
+    if (!finding) {
+        return { finding: null, explanation: `No hook matched "${idOrFile}". ${report.findings.length} hook(s) found in this repo.`, report };
+    }
+    const parts = [
+        `Hook ${finding.id} in ${finding.file} (${finding.source}, event ${finding.hook}).`,
+        `Command: ${finding.command}`,
+        `Classification: ${finding.classification}.`,
+        `Evidence: ${finding.evidence || "none"}.`,
+        finding.classification === "RISKY"
+            ? "This hook runs automatically and matched risky patterns. Treat the repo as untrusted until this hook is removed or proven benign."
+            : finding.classification === "SAFE"
+                ? "This hook matches known safe dev tooling patterns and matched no risky rules."
+                : "This hook matched neither safe nor risky patterns. Read the command and any file it invokes before trusting this repo.",
+    ];
+    return { finding, explanation: parts.join(" "), report };
+}
+export function renderReport(report) {
+    const lines = [];
+    lines.push(`hookcheck ${report.path}: ${report.verdict}`);
+    lines.push(`  ${report.counts.total} hook(s): ${report.counts.safe} SAFE, ${report.counts.risky} RISKY, ${report.counts.unknown} UNKNOWN`);
+    for (const f of report.findings) {
+        lines.push(`  [${f.classification}] ${f.id} (${f.source})`);
+        lines.push(`      command: ${f.command.slice(0, 200)}`);
+        if (f.rules.length)
+            lines.push(`      rules: ${f.rules.join(", ")}`);
+        lines.push(`      evidence: ${f.evidence}`);
+    }
+    for (const w of report.warnings)
+        lines.push(`  [warn] ${w}`);
+    if (report.verdict === "CLEAN")
+        lines.push("CLEAN: no risky or unknown auto-exec hooks found.");
+    else if (report.verdict === "REVIEW")
+        lines.push("REVIEW: at least one hook needs manual review.");
+    else
+        lines.push("COMPROMISED-PATTERN: at least one risky hook fetches remote code or touches credential stores. Treat as a Shai-Hulud style persistence pattern until proven otherwise.");
+    return lines.join("\n");
+}
+export { relative };
+//# sourceMappingURL=core.js.map

package/dist/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG3C,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAY/B,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,oDAAoD,EAAE,QAAQ,EAAE,gDAAgD,EAAE,MAAM,EAAE,IAAI,EAAE;IAC/J,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,iHAAiH,EAAE,QAAQ,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,EAAE;IACnM,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,EAAE;IACxG,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,qIAAqI,EAAE,QAAQ,EAAE,iCAAiC,EAAE,UAAU,EAAE,IAAI,EAAE;IACpO,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,iKAAiK,EAAE,QAAQ,EAAE,wDAAwD,EAAE;IACpQ,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,gFAAgF,EAAE,QAAQ,EAAE,2DAA2D,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;IACrN,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,yGAAyG,EAAE,QAAQ,EAAE,iEAAiE,EAAE;IACtN,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,qGAAqG,EAAE,QAAQ,EAAE,iCAAiC,EAAE;IACjL,EAAE,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,kDAAkD,EAAE,QAAQ,EAAE,oDAAoD,EAAE;IACpJ,EAAE,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,8DAA8D,EAAE,QAAQ,EAAE,mDAAmD,EAAE;CAChK,CAAC;AAEF,MAAM,aAAa,GAAa;IAC9B,sHAAsH;IACtH,gGAAgG;IAChG,2CAA2C;IAC3C,wBAAwB;IACxB,mCAAmC;IACnC,kBAAkB;IAClB,qBAAqB;CACtB,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,cAAc,EAAE,OAAO;YACvB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SAChE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,mEAAmE,EAAE,CAAC;QAC9H,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,0EAA0E;IAC1E,0EAA0E;IAC1E,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,0EAA0E,EAAE,CAAC;AACxI,CAAC;AAED,gFAAgF;AAChF,SAAS,qBAAqB,CAAC,IAAY,EAAE,OAAoB;IAC/D,MAAM,CAAC,GAAG,uFAAuF,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxH,IAAI,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IACvB,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QAAC,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,OAAO,CAAC;IAAC,CAAC;IACtF,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtE,OAAO;YACL,GAAG,OAAO;YACV,cAAc,EAAE,OAAO;YACvB,KAAK;YACL,QAAQ,EAAE,GAAG,OAAO,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,yBAAyB,GAAG,cAAc,KAAK,CAAC,QAAQ,EAAE;SAC9H,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAuB;IACpD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;YACvF,IAAI,SAAS,IAAI,OAAO;gBAAE,OAAO,qBAAqB,CAAC;YACvD,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;aAAM,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,MAAkB,EAAE,IAAY,EAAE,OAAe,EAAE,QAAiB;IACnH,MAAM,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,IAAI,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC5E,MAAM,IAAI,GAAgB;QACxB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;QAC/B,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;QAChD,QAAQ,EAAE,CAAC,CAAC,QAAQ;KACrB,CAAC;IACF,OAAO,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAClE,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAW,EAAE,QAAkB;IAC7D,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,2EAA2E;IAC3E,MAAM,OAAO,GAAG,GAAG;SAChB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SAC5B,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,qBAAqB,GAAG,uCAAuC,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAAuB,EAAE,QAAkB;IAChF,MAAM,GAAG,GAAG,cAAc,CAAC;IAC3B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAiD,CAAC;IAC3F,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,uEAAuE;QACvE,2CAA2C;QAC3C,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACjF,QAAQ,CAAC,IAAI,CAAC,mBAAmB,GAAG,eAAe,CAAC,CAAC;QACvD,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACpG,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa,EAAE,IAAY,EAAE,IAAY,EAAE,QAAuB,EAAE,MAAc;IAC5G,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9C,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,IAAI,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClH,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChH,CAAC;aAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9C,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAAuB,EAAE,QAAkB;IAC3E,KAAK,MAAM,GAAG,IAAI,CAAC,uBAAuB,EAAE,6BAA6B,CAAC,EAAE,CAAC;QAC3E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAAE,SAAS;QAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAA+B,CAAC;QACzE,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,IAAI,CAAC,KAAK;YAAE,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;;YACnE,QAAQ,CAAC,IAAI,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAAuB,EAAE,QAAkB;IAC3E,MAAM,GAAG,GAAG,oBAAoB,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAsD,CAAC;IAChG,IAAI,CAAC,IAAI,EAAE,KAAK;QAAE,OAAO;IACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAA4B,CAAC;QACtE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC/B,MAAM,YAAY,GAAG,KAAK,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACtG,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC1E,IAAI,YAAY,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,cAAc,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClG,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,sDAAsD;YACtD,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3E,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,4BAA4B;IAC5B,WAAW,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc,EAAE,MAAkB,EAAE,QAAuB;IAC7F,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC;QAAC,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO;IAAC,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChC,IAAI,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAC3D,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,SAAS;QAC3B,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACnD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5I,MAAM,OAAO,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;QACpC,oEAAoE;QACpE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACtF,KAAK,eAAe,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,QAAuB;IACzD,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAAE,SAAS;QAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,oBAAoB,CAAC;QACnC,IAAI,CAAyB,CAAC;QAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,QAAuB;IAC1D,MAAM,GAAG,GAAG,yBAAyB,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO;IACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,sBAAsB,CAAC;IACvC,IAAI,CAAyB,CAAC;IAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,MAAM,GAAG,qCAAqC,CAAC;IACrD,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,QAAuB,EAAE,QAAkB;IAC9E,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAgC,EAAE,CAAC;QACxG,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/B,IAAI,OAAO,GAAa,EAAE,CAAC;QAC3B,IAAI,CAAC;YAAC,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAChC,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC3D,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC3B,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC3C,IAAI,IAAI;oBAAE,sBAAsB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAClC,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC9B,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;YACD,IAAI,IAAI,KAAK,UAAU;gBAAE,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAa,EAAE,IAAY,EAAE,IAAY,EAAE,QAAuB,EAAE,MAAkB,EAAE,MAAM,GAAG,EAAE;IACjI,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9C,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9I,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,sBAAsB,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzI,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,GAAW,EAAE,QAAuB,EAAE,QAAkB;IACzF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAmC,CAAC;IAC7E,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;IACnF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO;IACpD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QAC9C,MAAM,CAAC,GAAG,GAA8B,CAAC;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QACnF,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,IAAI,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,QAAuB;IAC1D,MAAM,GAAG,GAAG,mBAAmB,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC;QAAC,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO;IAAC,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,yBAAyB,CAAC;QACxC,IAAI,CAAyB,CAAC;QAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE;gBAAE,SAAS;YACvD,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,QAAuB;IACzD,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;QAC9C,OAAO;YACL,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;YACjD,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;YACnD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;IACD,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1C,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrC,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrC,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChD,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7B,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9B,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,kBAAkB,CAAC;QAAE,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5G,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9B,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE7B,mEAAmE;IACnE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACpC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG;QACb,KAAK,EAAE,OAAO,CAAC,MAAM;QACrB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,MAAM;QAC/D,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,CAAC,MAAM;QACjE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,MAAM;KACtE,CAAC;IACF,OAAO;QACL,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC;QAChC,QAAQ,EAAE,OAAO;QACjB,MAAM;QACN,QAAQ;QACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAAgB;IACxD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IAC3H,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,oBAAoB,QAAQ,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,8BAA8B,EAAE,MAAM,EAAE,CAAC;IACxI,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,QAAQ,OAAO,CAAC,EAAE,OAAO,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,WAAW,OAAO,CAAC,IAAI,IAAI;QACnF,YAAY,OAAO,CAAC,OAAO,EAAE;QAC7B,mBAAmB,OAAO,CAAC,cAAc,GAAG;QAC5C,aAAa,OAAO,CAAC,QAAQ,IAAI,MAAM,GAAG;QAC1C,OAAO,CAAC,cAAc,KAAK,OAAO;YAChC,CAAC,CAAC,mIAAmI;YACrI,CAAC,CAAC,OAAO,CAAC,cAAc,KAAK,MAAM;gBACjC,CAAC,CAAC,+EAA+E;gBACjF,CAAC,CAAC,wHAAwH;KAC/H,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,aAAa,MAAM,CAAC,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,MAAM,CAAC,KAAK,WAAW,MAAM,CAAC,MAAM,CAAC,OAAO,UAAU,CAAC,CAAC;IAC3I,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;SAC3F,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;;QAC9F,KAAK,CAAC,IAAI,CAAC,wKAAwK,CAAC,CAAC;IAC1L,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,OAAO,EAAE,QAAQ,EAAE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./types.js";
+export * from "./core.js";

package/dist/index.js

@@ -0,0 +1,3 @@
+export * from "./types.js";
+export * from "./core.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC"}

package/dist/mcp.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/mcp.js

@@ -0,0 +1,26 @@
+/**
+ * hookcheck MCP server. Tools: scan_hooks, explain_hook.
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { explainHook, scanHooks, VERSION } from "./core.js";
+const server = new McpServer({ name: "hookcheck", version: VERSION });
+server.tool("scan_hooks", "Scan a local repo directory for auto-exec hooks: npm install scripts, Claude Code settings hooks, VS Code folderOpen tasks, husky, lefthook, pre-commit, Cursor and Codex configs, MCP autostart configs, and GitHub workflow run steps. Classifies each hook SAFE, RISKY, or UNKNOWN and returns a CLEAN, REVIEW, or COMPROMISED-PATTERN verdict with evidence per finding. Deterministic, local only, no network.", { path: z.string().describe("Local directory to scan, e.g. /home/user/project") }, async ({ path }) => {
+    const report = scanHooks(path);
+    return { content: [{ type: "text", text: JSON.stringify(report, null, 2) }] };
+});
+server.tool("explain_hook", "Explain one hook found by scan_hooks: its command, classification, rules that fired, and what the classification means. Pass the hook id (e.g. package.json:postinstall) or its file path.", {
+    path: z.string().describe("Local directory to scan"),
+    hookId: z.string().optional().describe("Hook id from a scan report, e.g. package.json:postinstall"),
+    file: z.string().optional().describe("File path of the hook as an alternative selector"),
+}, async ({ path, hookId, file }) => {
+    const selector = hookId ?? file ?? "";
+    const result = explainHook(path, selector);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+});
+async function main() {
+    await server.connect(new StdioServerTransport());
+}
+void main();
+//# sourceMappingURL=mcp.js.map

package/dist/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE5D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAEtE,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,qZAAqZ,EACrZ,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC,EAAE,EACjF,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;IACjB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,cAAc,EACd,4LAA4L,EAC5L;IACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;IACnG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;CACzF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE;IAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC,CACF,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,IAAI,EAAE,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,44 @@
+/**
+ * hookcheck types.
+ *
+ * A HookFinding is one auto-exec hook discovered in a repo: where it lives,
+ * the exact command text, how it was classified, and the rule ids plus
+ * evidence that produced that classification. Nothing is inferred silently.
+ */
+export type Classification = "SAFE" | "RISKY" | "UNKNOWN";
+export type Verdict = "CLEAN" | "REVIEW" | "COMPROMISED-PATTERN";
+export type HookSource = "package.json" | "claude-settings" | "vscode-tasks" | "husky" | "lefthook" | "pre-commit" | "cursor" | "codex" | "mcp-config" | "github-workflow" | "githooks";
+export interface HookFinding {
+    /** Stable id, e.g. "package.json:postinstall" or ".claude/settings.json:SessionStart:0". */
+    id: string;
+    /** Repo relative file path the hook was found in. */
+    file: string;
+    source: HookSource;
+    /** Hook name or event, e.g. postinstall, SessionStart, folderOpen. */
+    hook: string;
+    /** Exact command text that would auto-execute. */
+    command: string;
+    classification: Classification;
+    /** Rule ids that fired, e.g. ["NET-FETCH", "CRED-ACCESS"]. Empty for SAFE. */
+    rules: string[];
+    /** Human readable evidence for the classification. */
+    evidence: string;
+}
+export interface ScanReport {
+    path: string;
+    verdict: Verdict;
+    findings: HookFinding[];
+    counts: {
+        total: number;
+        safe: number;
+        risky: number;
+        unknown: number;
+    };
+    warnings: string[];
+    scannedAt: string;
+}
+export interface ExplainResult {
+    finding: HookFinding | null;
+    explanation: string;
+    report: ScanReport;
+}

package/dist/types.js

@@ -0,0 +1,9 @@
+/**
+ * hookcheck types.
+ *
+ * A HookFinding is one auto-exec hook discovered in a repo: where it lives,
+ * the exact command text, how it was classified, and the rule ids plus
+ * evidence that produced that classification. Nothing is inferred silently.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/package.json

@@ -1,6 +1 @@
-{
-  "name": "@reneturcios/hookcheck",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{"bin":{"hookcheck":"dist/cli.js"},"dependencies":{"@modelcontextprotocol/sdk":"^1","zod":"^3"},"description":"AI persistence hook auditor: scan a repo for auto-exec hooks (npm install scripts, Claude Code hooks, VS Code folderOpen tasks, husky, MCP autostart) and flag Shai-Hulud style persistence patterns.","devDependencies":{"@types/node":"^20","tsx":"^4","typescript":"^5"},"engines":{"node":">=20"},"files":["dist","server.json"],"homepage":"https://github.com/CloudCorpRecords/hookcheck#readme","license":"MIT","mcpName":"io.github.CloudCorpRecords/hookcheck","name":"@reneturcios/hookcheck","private":false,"publishConfig":{"access":"public"},"repository":{"type":"git","url":"git+https://github.com/CloudCorpRecords/hookcheck.git"},"scripts":{"build":"tsc","dev":"tsx src/cli.ts","test":"tsx --test test/*.test.ts"},"type":"module","version":"0.1.0"}

package/server.json

@@ -0,0 +1 @@
+{"$schema":"https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json","description":"AI persistence hook auditor: scan a repo for auto-exec hooks and flag Shai-Hulud style persistence patterns.","name":"io.github.CloudCorpRecords/hookcheck","packages":[{"identifier":"@reneturcios/hookcheck","packageArguments":[{"type":"positional","value":"mcp"}],"registryBaseUrl":"https://registry.npmjs.org","registryType":"npm","runtimeHint":"npx","transport":{"type":"stdio"},"version":"0.1.0"},{"identifier":"ghcr.io/cloudcorprecords/hookcheck:0.1.0","packageArguments":[{"type":"positional","value":"mcp"}],"registryType":"oci","runtimeArguments":[{"name":"--rm","type":"named"},{"name":"-i","type":"named"}],"runtimeHint":"docker","transport":{"type":"stdio"}}],"repository":{"source":"github","url":"https://github.com/CloudCorpRecords/hookcheck"},"version":"0.1.0"}