anantham-v2 2.0.0-alpha.1

package/dist/hooks/hook-manager.js

@@ -0,0 +1,177 @@
+/**
+ * Anantham V2 — Hook Manager & Lifecycle Engine
+ *
+ * Coordinates hook registration, trigger evaluation, deterministic execution,
+ * recursion protection, and SQLite WAL EventStore audit emission.
+ */
+import { HookRegistry } from "./hook-registry.js";
+import { HookMatcher } from "./hook-matcher.js";
+import { HookRecursionGuard } from "./hook-recursion-guard.js";
+import { HookExecutor } from "./hook-executor.js";
+import { HookSecurityGuard } from "./hook-security.js";
+import { HookTestRunner } from "./hook-test-runner.js";
+import { EventTypes } from "../domain/event.js";
+export class HookManager {
+    registry;
+    matcher;
+    recursionGuard;
+    executor;
+    securityGuard;
+    testRunner;
+    eventStore;
+    projectId;
+    constructor(options = {}) {
+        this.registry = options.registry || new HookRegistry();
+        this.matcher = options.matcher || new HookMatcher();
+        this.recursionGuard = options.recursionGuard || new HookRecursionGuard();
+        this.executor = options.executor || new HookExecutor();
+        this.securityGuard = options.securityGuard || new HookSecurityGuard();
+        this.testRunner = options.testRunner || new HookTestRunner({ executor: this.executor });
+        this.eventStore = options.eventStore;
+        this.projectId = options.projectId || "global";
+    }
+    getRegistry() {
+        return this.registry;
+    }
+    register(manifest, source = "project") {
+        const audit = this.securityGuard.audit(manifest);
+        if (!audit.isSafe) {
+            throw new Error(`Hook security audit failed: ${audit.violations.join(" ")}`);
+        }
+        const record = this.registry.register(manifest, source);
+        this.emitEvent(EventTypes.HOOK_REGISTERED, {
+            hookId: record.id,
+            event: record.manifest.event,
+            source,
+        });
+        return record;
+    }
+    unregister(hookId) {
+        const deleted = this.registry.unregister(hookId);
+        if (deleted) {
+            this.emitEvent(EventTypes.HOOK_REMOVED, { hookId });
+        }
+        return deleted;
+    }
+    enable(hookId) {
+        const record = this.registry.enable(hookId);
+        this.emitEvent(EventTypes.HOOK_ENABLED, { hookId });
+        return record;
+    }
+    disable(hookId) {
+        const record = this.registry.disable(hookId);
+        this.emitEvent(EventTypes.HOOK_DISABLED, { hookId });
+        return record;
+    }
+    get(hookId) {
+        return this.registry.get(hookId);
+    }
+    list(projectId) {
+        return this.registry.list(projectId);
+    }
+    /**
+     * Evaluates and executes all matching hooks for a lifecycle trigger event.
+     * Returns whether execution is blocked (due to fail-closed error).
+     */
+    async handleEvent(context) {
+        const currentDepth = context.depth || 0;
+        const matchContext = {
+            event: context.event,
+            projectId: context.projectId || this.projectId,
+            payload: context.payload,
+        };
+        const allHooks = this.registry.list(context.projectId || this.projectId);
+        const matched = this.matcher.match(allHooks, matchContext);
+        const results = [];
+        let isBlocked = false;
+        for (const hook of matched) {
+            // Recursion & cascade check
+            const recCheck = this.recursionGuard.check(hook.id, context.causationId, currentDepth);
+            if (!recCheck.allowed) {
+                const skippedResult = {
+                    hookId: hook.id,
+                    event: context.event,
+                    actionType: hook.manifest.action.type,
+                    success: false,
+                    decision: "skipped",
+                    durationMs: 0,
+                    error: recCheck.reason,
+                    isFailClosedBlocked: hook.manifest.policy.onFailure === "fail-closed",
+                    timestamp: new Date().toISOString(),
+                };
+                results.push(skippedResult);
+                if (skippedResult.isFailClosedBlocked)
+                    isBlocked = true;
+                continue;
+            }
+            this.recursionGuard.enter(hook.id, context.causationId);
+            this.emitEvent(EventTypes.HOOK_TRIGGERED, {
+                hookId: hook.id,
+                event: context.event,
+            });
+            try {
+                const execContext = {
+                    event: context.event,
+                    projectId: context.projectId || this.projectId,
+                    sessionId: context.sessionId,
+                    taskId: context.taskId,
+                    payload: context.payload,
+                    depth: currentDepth + 1,
+                };
+                const res = await this.executor.execute(hook, execContext);
+                results.push(res);
+                if (res.isFailClosedBlocked) {
+                    isBlocked = true;
+                    this.emitEvent(EventTypes.HOOK_BLOCKED, {
+                        hookId: hook.id,
+                        reason: res.error || "Blocked by hook policy",
+                    });
+                }
+                if (res.success) {
+                    this.emitEvent(EventTypes.HOOK_COMPLETED, {
+                        hookId: hook.id,
+                        durationMs: res.durationMs,
+                    });
+                }
+                else {
+                    this.emitEvent(EventTypes.HOOK_FAILED, {
+                        hookId: hook.id,
+                        error: res.error,
+                    });
+                }
+            }
+            finally {
+                this.recursionGuard.exit(hook.id, context.causationId);
+            }
+        }
+        return {
+            matchedCount: matched.length,
+            results,
+            isBlocked,
+        };
+    }
+    /**
+     * Deterministically tests a hook with a fixture (/hooks test <id>).
+     */
+    async test(hookId, fixture) {
+        const record = this.registry.get(hookId);
+        if (!record) {
+            throw new Error(`Hook "${hookId}" not found for testing.`);
+        }
+        return this.testRunner.runTest(record, fixture);
+    }
+    emitEvent(type, payload) {
+        if (this.eventStore) {
+            this.eventStore.append({
+                id: `evt_hk_${Date.now()}_${Math.random().toString(36).slice(2, 7)}`,
+                schemaVersion: 1,
+                projectId: this.projectId,
+                type,
+                actor: "system",
+                timestamp: new Date().toISOString(),
+                payload,
+            });
+        }
+    }
+}
+//# sourceMappingURL=hook-manager.js.map

package/dist/hooks/hook-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-manager.js","sourceRoot":"","sources":["../../src/hooks/hook-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAyB,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAA6B,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,cAAc,EAA6C,MAAM,uBAAuB,CAAC;AAElG,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAahD,MAAM,OAAO,WAAW;IACL,QAAQ,CAAe;IACvB,OAAO,CAAc;IACrB,cAAc,CAAqB;IACnC,QAAQ,CAAe;IACvB,aAAa,CAAoB;IACjC,UAAU,CAAiB;IAC3B,UAAU,CAAc;IACxB,SAAS,CAAS;IAEnC,YAAY,UAA8B,EAAE;QAC1C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,WAAW,EAAE,CAAC;QACpD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACzE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACtE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IACjD,CAAC;IAEM,WAAW;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEM,QAAQ,CACb,QAAsB,EACtB,SAA0C,SAAS;QAEnD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAExD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,eAAe,EAAE;YACzC,MAAM,EAAE,MAAM,CAAC,EAAE;YACjB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;YAC5B,MAAM;SACP,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,UAAU,CAAC,MAAc;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,MAAM,CAAC,MAAc;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,OAAO,CAAC,MAAc;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,GAAG,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAEM,IAAI,CAAC,SAAkB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,WAAW,CAAC,OAQxB;QAKC,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QACxC,MAAM,YAAY,GAAqB;YACrC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;YAC9C,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAE3D,MAAM,OAAO,GAA0B,EAAE,CAAC;QAC1C,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,4BAA4B;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACvF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,MAAM,aAAa,GAAwB;oBACzC,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI;oBACrC,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,SAAS;oBACnB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE,QAAQ,CAAC,MAAM;oBACtB,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,KAAK,aAAa;oBACrE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC5B,IAAI,aAAa,CAAC,mBAAmB;oBAAE,SAAS,GAAG,IAAI,CAAC;gBACxD,SAAS;YACX,CAAC;YAED,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,cAAc,EAAE;gBACxC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,MAAM,WAAW,GAAyB;oBACxC,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;oBAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,KAAK,EAAE,YAAY,GAAG,CAAC;iBACxB,CAAC;gBAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBAC3D,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAElB,IAAI,GAAG,CAAC,mBAAmB,EAAE,CAAC;oBAC5B,SAAS,GAAG,IAAI,CAAC;oBACjB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,EAAE;wBACtC,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,wBAAwB;qBAC9C,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;oBAChB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,cAAc,EAAE;wBACxC,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,UAAU,EAAE,GAAG,CAAC,UAAU;qBAC3B,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,EAAE;wBACrC,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,KAAK,EAAE,GAAG,CAAC,KAAK;qBACjB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,OAAO;YACL,YAAY,EAAE,OAAO,CAAC,MAAM;YAC5B,OAAO;YACP,SAAS;SACV,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,OAAwB;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,0BAA0B,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAEO,SAAS,CAAC,IAAY,EAAE,OAAgC;QAC9D,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBACrB,EAAE,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;gBACpE,aAAa,EAAE,CAAC;gBAChB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI;gBACJ,KAAK,EAAE,QAAQ;gBACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,OAAO;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/hooks/hook-matcher.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Anantham V2 — Hook Matcher & Deterministic Sorter
+ *
+ * Matches incoming lifecycle events against registered hooks and provides
+ * deterministic priority-based candidate ordering.
+ */
+import { type HookRecord, type HookTriggerType } from "../domain/hook.js";
+export interface HookMatchContext {
+    event: HookTriggerType;
+    projectId?: string;
+    payload?: Record<string, unknown>;
+}
+export declare class HookMatcher {
+    /**
+     * Evaluates and returns all matching, enabled hooks in deterministic priority order.
+     */
+    match(hooks: HookRecord[], context: HookMatchContext): HookRecord[];
+}
+//# sourceMappingURL=hook-matcher.d.ts.map

package/dist/hooks/hook-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-matcher.d.ts","sourceRoot":"","sources":["../../src/hooks/hook-matcher.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE1E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,qBAAa,WAAW;IACtB;;OAEG;IACI,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,UAAU,EAAE;CA8D3E"}

package/dist/hooks/hook-matcher.js

@@ -0,0 +1,68 @@
+/**
+ * Anantham V2 — Hook Matcher & Deterministic Sorter
+ *
+ * Matches incoming lifecycle events against registered hooks and provides
+ * deterministic priority-based candidate ordering.
+ */
+export class HookMatcher {
+    /**
+     * Evaluates and returns all matching, enabled hooks in deterministic priority order.
+     */
+    match(hooks, context) {
+        const candidates = hooks.filter((record) => {
+            // 1. Must be enabled
+            if (record.lifecycleState !== "enabled" || !record.manifest.enabled) {
+                return false;
+            }
+            // 2. Must match event trigger type
+            if (record.manifest.event !== context.event) {
+                return false;
+            }
+            // 3. Must match project scope
+            if (record.manifest.scope === "project") {
+                if (!context.projectId || record.manifest.projectId !== context.projectId) {
+                    return false;
+                }
+            }
+            // 4. Evaluate optional filters
+            if (record.manifest.filter) {
+                const filter = record.manifest.filter;
+                const payload = context.payload || {};
+                if (filter.toolName && payload.toolName !== filter.toolName) {
+                    return false;
+                }
+                if (filter.modelProvider && payload.provider !== filter.modelProvider) {
+                    return false;
+                }
+                if (filter.pathPattern) {
+                    const targetPath = (payload.filePath || payload.path || "");
+                    try {
+                        const regex = new RegExp(filter.pathPattern);
+                        if (!regex.test(targetPath))
+                            return false;
+                    }
+                    catch {
+                        if (!targetPath.includes(filter.pathPattern))
+                            return false;
+                    }
+                }
+                if (filter.matchPayload) {
+                    for (const [key, value] of Object.entries(filter.matchPayload)) {
+                        if (payload[key] !== value) {
+                            return false;
+                        }
+                    }
+                }
+            }
+            return true;
+        });
+        // Deterministic Sort: Priority descending, then ID ascending
+        return candidates.sort((a, b) => {
+            if (b.manifest.priority !== a.manifest.priority) {
+                return b.manifest.priority - a.manifest.priority;
+            }
+            return a.id.localeCompare(b.id);
+        });
+    }
+}
+//# sourceMappingURL=hook-matcher.js.map

package/dist/hooks/hook-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-matcher.js","sourceRoot":"","sources":["../../src/hooks/hook-matcher.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,MAAM,OAAO,WAAW;IACtB;;OAEG;IACI,KAAK,CAAC,KAAmB,EAAE,OAAyB;QACzD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;YACzC,qBAAqB;YACrB,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACpE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,mCAAmC;YACnC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAC;YACf,CAAC;YAED,8BAA8B;YAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;oBAC1E,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,+BAA+B;YAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;gBAEtC,IAAI,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAC5D,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,IAAI,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;oBACtE,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACvB,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE,CAAW,CAAC;oBACtE,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;wBAC7C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;4BAAE,OAAO,KAAK,CAAC;oBAC5C,CAAC;oBAAC,MAAM,CAAC;wBACP,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC;4BAAE,OAAO,KAAK,CAAC;oBAC7D,CAAC;gBACH,CAAC;gBAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;oBACxB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;wBAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;4BAC3B,OAAO,KAAK,CAAC;wBACf,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,6DAA6D;QAC7D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC9B,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBAChD,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnD,CAAC;YACD,OAAO,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/hooks/hook-recursion-guard.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Anantham V2 — Hook Recursion & Cascade Guard
+ *
+ * Enforces strict depth bounds, cycle detection, and fan-out limits to prevent
+ * infinite cascades (Hook A -> Event -> Hook A).
+ */
+export interface HookInvocationFrame {
+    hookId: string;
+    causationId?: string;
+    depth: number;
+}
+export declare class HookRecursionGuard {
+    private readonly maxDepth;
+    private readonly maxFanOut;
+    private readonly activeChains;
+    private readonly fanOutCounts;
+    constructor(options?: {
+        maxDepth?: number;
+        maxFanOut?: number;
+    });
+    /**
+     * Checks if a hook invocation is safe to proceed or violates recursion/fan-out bounds.
+     */
+    check(hookId: string, causationId?: string, currentDepth?: number): {
+        allowed: boolean;
+        reason?: string;
+    };
+    /**
+     * Enters an execution frame for a causation chain.
+     */
+    enter(hookId: string, causationId?: string): void;
+    /**
+     * Exits an execution frame.
+     */
+    exit(hookId: string, causationId?: string): void;
+    reset(): void;
+}
+//# sourceMappingURL=hook-recursion-guard.d.ts.map

package/dist/hooks/hook-recursion-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-recursion-guard.d.ts","sourceRoot":"","sources":["../../src/hooks/hook-recursion-guard.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+B;IAC5D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;gBAE9C,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;IAK/D;;OAEG;IACI,KAAK,CACV,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,MAAM,EACpB,YAAY,GAAE,MAAU,GACvB;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAiCxC;;OAEG;IACI,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI;IAQxD;;OAEG;IACI,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI;IAgBhD,KAAK,IAAI,IAAI;CAIrB"}

package/dist/hooks/hook-recursion-guard.js

@@ -0,0 +1,81 @@
+/**
+ * Anantham V2 — Hook Recursion & Cascade Guard
+ *
+ * Enforces strict depth bounds, cycle detection, and fan-out limits to prevent
+ * infinite cascades (Hook A -> Event -> Hook A).
+ */
+export class HookRecursionGuard {
+    maxDepth;
+    maxFanOut;
+    activeChains = new Map(); // causationId -> hookId[]
+    fanOutCounts = new Map(); // eventId -> count
+    constructor(options) {
+        this.maxDepth = options?.maxDepth || 5;
+        this.maxFanOut = options?.maxFanOut || 20;
+    }
+    /**
+     * Checks if a hook invocation is safe to proceed or violates recursion/fan-out bounds.
+     */
+    check(hookId, causationId, currentDepth = 0) {
+        // 1. Depth check
+        if (currentDepth >= this.maxDepth) {
+            return {
+                allowed: false,
+                reason: `Hook recursion limit exceeded (depth: ${currentDepth} >= max: ${this.maxDepth}).`,
+            };
+        }
+        // 2. Cycle detection within causation chain
+        if (causationId) {
+            const chain = this.activeChains.get(causationId) || [];
+            if (chain.includes(hookId)) {
+                return {
+                    allowed: false,
+                    reason: `Cyclic hook invocation detected for "${hookId}" in chain [${chain.join(" -> ")}].`,
+                };
+            }
+            // 3. Fan-out check per causation/event
+            const currentFanOut = (this.fanOutCounts.get(causationId) || 0) + 1;
+            if (currentFanOut > this.maxFanOut) {
+                return {
+                    allowed: false,
+                    reason: `Hook fan-out limit exceeded (${currentFanOut} > max: ${this.maxFanOut}) for causation "${causationId}".`,
+                };
+            }
+            this.fanOutCounts.set(causationId, currentFanOut);
+        }
+        return { allowed: true };
+    }
+    /**
+     * Enters an execution frame for a causation chain.
+     */
+    enter(hookId, causationId) {
+        if (causationId) {
+            const chain = this.activeChains.get(causationId) || [];
+            chain.push(hookId);
+            this.activeChains.set(causationId, chain);
+        }
+    }
+    /**
+     * Exits an execution frame.
+     */
+    exit(hookId, causationId) {
+        if (causationId) {
+            const chain = this.activeChains.get(causationId);
+            if (chain) {
+                const idx = chain.lastIndexOf(hookId);
+                if (idx !== -1) {
+                    chain.splice(idx, 1);
+                }
+                if (chain.length === 0) {
+                    this.activeChains.delete(causationId);
+                    this.fanOutCounts.delete(causationId);
+                }
+            }
+        }
+    }
+    reset() {
+        this.activeChains.clear();
+        this.fanOutCounts.clear();
+    }
+}
+//# sourceMappingURL=hook-recursion-guard.js.map

package/dist/hooks/hook-recursion-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-recursion-guard.js","sourceRoot":"","sources":["../../src/hooks/hook-recursion-guard.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,MAAM,OAAO,kBAAkB;IACZ,QAAQ,CAAS;IACjB,SAAS,CAAS;IAClB,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC,CAAC,0BAA0B;IACtE,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,mBAAmB;IAE9E,YAAY,OAAmD;QAC7D,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC;IAC5C,CAAC;IAED;;OAEG;IACI,KAAK,CACV,MAAc,EACd,WAAoB,EACpB,eAAuB,CAAC;QAExB,iBAAiB;QACjB,IAAI,YAAY,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,yCAAyC,YAAY,YAAY,IAAI,CAAC,QAAQ,IAAI;aAC3F,CAAC;QACJ,CAAC;QAED,4CAA4C;QAC5C,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACvD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,wCAAwC,MAAM,eAAe,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;iBAC5F,CAAC;YACJ,CAAC;YAED,uCAAuC;YACvC,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACpE,IAAI,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,gCAAgC,aAAa,WAAW,IAAI,CAAC,SAAS,oBAAoB,WAAW,IAAI;iBAClH,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,MAAc,EAAE,WAAoB;QAC/C,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACI,IAAI,CAAC,MAAc,EAAE,WAAoB;QAC9C,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACjD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBACtC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;oBACf,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACvB,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;oBACtC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEM,KAAK;QACV,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;CACF"}

package/dist/hooks/hook-registry.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Anantham V2 — Hook Registry
+ *
+ * Authoritative registry managing registered, enabled, and project-scoped hooks.
+ */
+import { type HookRecord, type HookManifest } from "../domain/hook.js";
+export declare class HookRegistry {
+    private readonly hooks;
+    register(manifest: HookManifest, source?: "system" | "project" | "plugin"): HookRecord;
+    unregister(hookId: string): boolean;
+    get(hookId: string): HookRecord | undefined;
+    has(hookId: string): boolean;
+    list(projectId?: string): HookRecord[];
+    enable(hookId: string): HookRecord;
+    disable(hookId: string): HookRecord;
+    clear(): void;
+}
+//# sourceMappingURL=hook-registry.d.ts.map

package/dist/hooks/hook-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-registry.d.ts","sourceRoot":"","sources":["../../src/hooks/hook-registry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,KAAK,UAAU,EACf,KAAK,YAAY,EAGlB,MAAM,mBAAmB,CAAC;AAE3B,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IAEhD,QAAQ,CACb,QAAQ,EAAE,YAAY,EACtB,MAAM,GAAE,QAAQ,GAAG,SAAS,GAAG,QAAoB,GAClD,UAAU;IAeN,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAInC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAI3C,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI5B,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE;IAUtC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IAUlC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IAUnC,KAAK,IAAI,IAAI;CAGrB"}

package/dist/hooks/hook-registry.js

@@ -0,0 +1,59 @@
+/**
+ * Anantham V2 — Hook Registry
+ *
+ * Authoritative registry managing registered, enabled, and project-scoped hooks.
+ */
+import { HookRecordSchema, HookManifestSchema, } from "../domain/hook.js";
+export class HookRegistry {
+    hooks = new Map();
+    register(manifest, source = "project") {
+        const validatedManifest = HookManifestSchema.parse(manifest);
+        const record = HookRecordSchema.parse({
+            id: validatedManifest.id,
+            manifest: validatedManifest,
+            lifecycleState: validatedManifest.enabled ? "enabled" : "disabled",
+            source,
+            registeredAt: new Date().toISOString(),
+        });
+        this.hooks.set(validatedManifest.id, record);
+        return record;
+    }
+    unregister(hookId) {
+        return this.hooks.delete(hookId);
+    }
+    get(hookId) {
+        return this.hooks.get(hookId);
+    }
+    has(hookId) {
+        return this.hooks.has(hookId);
+    }
+    list(projectId) {
+        const all = Array.from(this.hooks.values());
+        if (!projectId) {
+            return all;
+        }
+        return all.filter((h) => h.manifest.scope === "global" || h.manifest.projectId === projectId);
+    }
+    enable(hookId) {
+        const record = this.hooks.get(hookId);
+        if (!record) {
+            throw new Error(`Hook "${hookId}" not found.`);
+        }
+        record.lifecycleState = "enabled";
+        record.manifest.enabled = true;
+        return record;
+    }
+    disable(hookId) {
+        const record = this.hooks.get(hookId);
+        if (!record) {
+            throw new Error(`Hook "${hookId}" not found.`);
+        }
+        record.lifecycleState = "disabled";
+        record.manifest.enabled = false;
+        return record;
+    }
+    clear() {
+        this.hooks.clear();
+    }
+}
+//# sourceMappingURL=hook-registry.js.map

package/dist/hooks/hook-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-registry.js","sourceRoot":"","sources":["../../src/hooks/hook-registry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAGL,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,OAAO,YAAY;IACN,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEhD,QAAQ,CACb,QAAsB,EACtB,SAA0C,SAAS;QAEnD,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAe,gBAAgB,CAAC,KAAK,CAAC;YAChD,EAAE,EAAE,iBAAiB,CAAC,EAAE;YACxB,QAAQ,EAAE,iBAAiB;YAC3B,cAAc,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;YAClE,MAAM;YACN,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACvC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,UAAU,CAAC,MAAc;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAEM,GAAG,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAEM,GAAG,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAEM,IAAI,CAAC,SAAkB;QAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,CACf,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAC3E,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,MAAc;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,cAAc,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,CAAC,cAAc,GAAG,SAAS,CAAC;QAClC,MAAM,CAAC,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,OAAO,CAAC,MAAc;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,cAAc,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,CAAC,cAAc,GAAG,UAAU,CAAC;QACnC,MAAM,CAAC,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC;QAChC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK;QACV,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF"}

package/dist/hooks/hook-security.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Anantham V2 — Hook Security Guard
+ *
+ * Enforces policy boundaries on hook manifests, detects adversarial patterns,
+ * and prevents privilege escalation or security bypass attempts.
+ */
+import { type HookManifest } from "../domain/hook.js";
+export interface HookSecurityAuditResult {
+    isSafe: boolean;
+    violations: string[];
+}
+export declare class HookSecurityGuard {
+    private static readonly DANGEROUS_COMMAND_PATTERNS;
+    /**
+     * Scans a hook manifest for security violations and forbidden commands.
+     */
+    audit(manifest: HookManifest): HookSecurityAuditResult;
+}
+//# sourceMappingURL=hook-security.d.ts.map

package/dist/hooks/hook-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-security.d.ts","sourceRoot":"","sources":["../../src/hooks/hook-security.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAQhD;IAEF;;OAEG;IACI,KAAK,CAAC,QAAQ,EAAE,YAAY,GAAG,uBAAuB;CAiC9D"}

package/dist/hooks/hook-security.js

@@ -0,0 +1,48 @@
+/**
+ * Anantham V2 — Hook Security Guard
+ *
+ * Enforces policy boundaries on hook manifests, detects adversarial patterns,
+ * and prevents privilege escalation or security bypass attempts.
+ */
+export class HookSecurityGuard {
+    static DANGEROUS_COMMAND_PATTERNS = [
+        /sudo\s+/i,
+        /rm\s+-rf\s+\//i,
+        /chmod\s+777/i,
+        /bypass[_\-\s]?policy/i,
+        /disable[_\-\s]?security/i,
+        /export\s+(api_key|secret|token)/i,
+        /eval\s*\(/i,
+    ];
+    /**
+     * Scans a hook manifest for security violations and forbidden commands.
+     */
+    audit(manifest) {
+        const violations = [];
+        // 1. Audit command if present
+        if (manifest.action.command) {
+            for (const pattern of HookSecurityGuard.DANGEROUS_COMMAND_PATTERNS) {
+                if (pattern.test(manifest.action.command)) {
+                    violations.push(`Forbidden dangerous command pattern detected: ${pattern.source}`);
+                }
+            }
+        }
+        // 2. Audit message / context for prompt injection patterns
+        const textToScan = `${manifest.action.message || ""} ${manifest.action.context || ""}`;
+        if (textToScan.trim()) {
+            if (/ignore (all )?previous instructions/i.test(textToScan)) {
+                violations.push("Prompt injection pattern detected in hook action text.");
+            }
+        }
+        // 3. Size check on action parameters / context
+        const serializedAction = JSON.stringify(manifest.action);
+        if (serializedAction.length > 64 * 1024) {
+            violations.push(`Hook action payload exceeds size limit (64KB max).`);
+        }
+        return {
+            isSafe: violations.length === 0,
+            violations,
+        };
+    }
+}
+//# sourceMappingURL=hook-security.js.map

package/dist/hooks/hook-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-security.js","sourceRoot":"","sources":["../../src/hooks/hook-security.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,MAAM,OAAO,iBAAiB;IACpB,MAAM,CAAU,0BAA0B,GAAG;QACnD,UAAU;QACV,gBAAgB;QAChB,cAAc;QACd,uBAAuB;QACvB,0BAA0B;QAC1B,kCAAkC;QAClC,YAAY;KACb,CAAC;IAEF;;OAEG;IACI,KAAK,CAAC,QAAsB;QACjC,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,8BAA8B;QAC9B,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC5B,KAAK,MAAM,OAAO,IAAI,iBAAiB,CAAC,0BAA0B,EAAE,CAAC;gBACnE,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1C,UAAU,CAAC,IAAI,CACb,iDAAiD,OAAO,CAAC,MAAM,EAAE,CAClE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,MAAM,UAAU,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACvF,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACtB,IAAI,sCAAsC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5D,UAAU,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,gBAAgB,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YACxC,UAAU,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,OAAO;YACL,MAAM,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;YAC/B,UAAU;SACX,CAAC;IACJ,CAAC"}

package/dist/hooks/hook-test-runner.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Anantham V2 — Hook Test Runner
+ *
+ * Deterministic fixture test harness for hooks (/hooks test <id>).
+ */
+import { type HookRecord, type HookExecutionResult, type HookTriggerType } from "../domain/hook.js";
+import { HookExecutor } from "./hook-executor.js";
+export interface HookTestFixture {
+    id: string;
+    hookId: string;
+    triggerEvent: HookTriggerType;
+    inputPayload?: Record<string, unknown>;
+    expectedDecision?: "allow" | "deny" | "modify" | "executed" | "skipped";
+    expectedSuccess?: boolean;
+}
+export interface HookTestReport {
+    fixtureId: string;
+    hookId: string;
+    passed: boolean;
+    durationMs: number;
+    result: HookExecutionResult;
+    assertions: Array<{
+        assertion: string;
+        passed: boolean;
+        error?: string;
+    }>;
+}
+export declare class HookTestRunner {
+    private readonly executor;
+    constructor(options?: {
+        executor?: HookExecutor;
+    });
+    /**
+     * Runs a deterministic test fixture against a target hook.
+     */
+    runTest(hook: HookRecord, fixture: HookTestFixture): Promise<HookTestReport>;
+}
+//# sourceMappingURL=hook-test-runner.d.ts.map

package/dist/hooks/hook-test-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-test-runner.d.ts","sourceRoot":"","sources":["../../src/hooks/hook-test-runner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,eAAe,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IACxE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3E;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;gBAE5B,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,YAAY,CAAA;KAAE;IAIjD;;OAEG;IACU,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;CAyC1F"}