hypomnema 1.5.1 → 1.6.0

package/scripts/uninstall.mjs

@@ -38,6 +38,8 @@ import {
   EXT_TYPES,
   CODEX_TYPES,
   readExtensionPkgStateNoMutate,
+  parseExtKey,
+  buildHookCommand,
 } from './lib/extensions.mjs';
 
 const HOME = homedir();
@@ -138,13 +140,23 @@ function stripExtensionsFromPkg(pkgPath, target, removedKeys, apply) {
   return changed;
 }
 
-// Remove hypo-ext-* hard-copies for one target (claude | codex). Mirrors
-// removeCommands' 3-way model: filesystem scan + per-target recorded SHA from
-// hypo-pkg.json#extensions[target] decides ownership. A file we never installed
-// (no recorded SHA) is left alone — that may be a foreign hypo-ext-* file the
-// user created by hand, never ours to delete. A user-modified file is preserved
-// unless --force-extensions; a symlink/non-regular target is always preserved
-// (force does not follow them, matching install/upgrade E3's guard).
+// Remove Hypomnema-installed extension hard-copies for one target (claude |
+// codex). Ownership is decided by the per-target recorded SHA map in
+// hypo-pkg.json#extensions[target]: we iterate the RECORDED KEYS (not a
+// filesystem+prefix scan) because the reverse-capture design decoupled the install filename from
+// the wiki `hypo-ext-*` storage name — a reverse-captured command installs as
+// `commands/mycmd.md`, which a prefix scan would never reach. The SHA map key
+// IS the install path relative to the target root, so it names every file we
+// own regardless of its filename.
+//
+// Safety (capture design §8): a recorded key comes from an on-disk JSON we do not
+// fully control, so each key is validated by `parseExtKey` to a single covered
+// `<type>/<safe-basename>` segment (no separators / traversal) before any
+// join/rm — a corrupt or malicious key can never delete outside the extension
+// directory. "Never delete unowned" holds via SHA MATCHING, not the prefix: a
+// file whose on-disk SHA differs from the recorded one is user-modified and
+// preserved unless --force-extensions; a symlink/non-regular target is always
+// preserved (force does not follow them, matching install/upgrade E3's guard).
 function removeExtensions(target, apply, force) {
   const targetRoot = target === 'codex' ? join(HOME, '.codex') : join(HOME, '.claude');
   const types = target === 'codex' ? CODEX_TYPES : EXT_TYPES;
@@ -158,37 +170,27 @@ function removeExtensions(target, apply, force) {
   const skippedUserModified = [];
   const skippedNonRegular = [];
 
-  for (const type of types) {
-    const typeDir = join(targetRoot, type);
-    if (!existsSync(typeDir)) continue;
-    let entries;
-    try {
-      entries = readdirSync(typeDir);
-    } catch {
+  for (const [key, recordedSHA] of Object.entries(recorded)) {
+    if (!recordedSHA) continue; // no ownership baseline → nothing to remove
+    const parsed = parseExtKey(key, types);
+    if (!parsed) continue; // untrusted / cross-target key → never join+rm
+    const fullPath = join(targetRoot, parsed.type, parsed.installFile);
+    if (!existsSync(fullPath)) continue; // already gone
+
+    if (!isRegularFile(fullPath)) {
+      // Refuse to follow symlinks/sockets even under --force-extensions.
+      skippedNonRegular.push(fullPath);
       continue;
     }
-    for (const fname of entries) {
-      if (!fname.startsWith(EXT_PREFIX)) continue;
-      const key = `${type}/${fname}`;
-      const recordedSHA = recorded[key];
-      if (!recordedSHA) continue; // not tracked by us → leave alone
-      const fullPath = join(typeDir, fname);
-
-      if (!isRegularFile(fullPath)) {
-        // Refuse to follow symlinks/sockets even under --force-extensions.
-        skippedNonRegular.push(fullPath);
-        continue;
-      }
-      const buf = readFileIfRegular(fullPath);
-      const sha = buf ? sha256(buf) : null;
-
-      if (sha === recordedSHA || force) {
-        if (apply) rmSync(fullPath);
-        removed.push(fullPath);
-        removedKeys.push(key);
-      } else {
-        skippedUserModified.push(fullPath);
-      }
+    const buf = readFileIfRegular(fullPath);
+    const sha = buf ? sha256(buf) : null;
+
+    if (sha === recordedSHA || force) {
+      if (apply) rmSync(fullPath);
+      removed.push(fullPath);
+      removedKeys.push(key);
+    } else {
+      skippedUserModified.push(fullPath);
     }
   }
   return { target, removed, removedKeys, skippedUserModified, skippedNonRegular };
@@ -226,12 +228,39 @@ function unprocessedExtensionTargetRemains(pkgPath, processedTargets) {
   return false;
 }
 
-// settings.json: strip groups whose command points to a hypo-ext-* path under
-// the target's hooks dir. Identity is path-based (plan §0 D1) — no hookMap needed
+// Build the set of settings.json commands owned by reverse-captured hooks that
+// install under their ORIGINAL name (not the hypo-ext-* storage name). The prefix
+// scan below only reaches hypo-ext-* commands; a captured hook registers as
+// `node $HOME/.claude/hooks/foo.mjs`, which no prefix would ever match. The
+// recorded per-target SHA map names every file we own, so its hooks `.mjs` keys
+// reconstruct exactly the commands we registered. Read WITHOUT mutation and while
+// the map is still whole. stripExtensionsFromPkg (which clears it) runs later.
+// Only `.mjs` keys are commands; the paired `.manifest.json` sidecar keys (which
+// parseExtKey also admits for hooks) are dropped by the extension check.
+function ownedHookCommands(pkgPath, target, hooksDir) {
+  const types = target === 'codex' ? CODEX_TYPES : EXT_TYPES;
+  const recorded = readExtensionPkgStateNoMutate(pkgPath, target);
+  const commands = new Set();
+  for (const key of Object.keys(recorded)) {
+    const parsed = parseExtKey(key, types);
+    if (!parsed || parsed.type !== 'hooks') continue;
+    if (!parsed.installFile.endsWith('.mjs')) continue;
+    commands.add(buildHookCommand(hooksDir, parsed.installFile));
+  }
+  return commands;
+}
+
+// settings.json: strip groups whose command is one of ours under the target's
+// hooks dir. Ownership is the UNION of two path-based signals (plan §0 D1, P2):
+// the hypo-ext-* command prefix (catches wiki-authored hooks and hypo-ext-*
+// leftovers whose recorded key was already cleared by a partial uninstall) and
+// the recorded owned-command set (`ownedCommands`, catches reverse-captured hooks
+// registered under their original name, which carry no hypo-ext-* marker). Both
+// branches are needed, so this is a union, not a replacement. No hookMap needed
 // because ext hooks are never enumerated there. Mixed groups (foreign hook +
 // ours) keep the foreign hook; ours-only groups are dropped entirely. Mirrors
 // stripSettingsJson's flatMap pattern so other-plugin invariants (§7.3) hold.
-function stripExtensionSettings(settingsPath, hooksDir, apply) {
+function stripExtensionSettings(settingsPath, hooksDir, apply, ownedCommands = new Set()) {
   if (!existsSync(settingsPath)) return { stripped: [] };
   let settings;
   try {
@@ -243,7 +272,10 @@ function stripExtensionSettings(settingsPath, hooksDir, apply) {
 
   const cmdPrefix = `node ${hooksDir.replace(HOME, '$HOME')}/${EXT_PREFIX}`;
   const isExtHook = (h) =>
-    h && h.type === 'command' && typeof h.command === 'string' && h.command.startsWith(cmdPrefix);
+    h &&
+    h.type === 'command' &&
+    typeof h.command === 'string' &&
+    (h.command.startsWith(cmdPrefix) || ownedCommands.has(h.command));
 
   const stripped = [];
   let changed = false;
@@ -432,7 +464,12 @@ const commandResult = removeCommands(args.apply, args.forceCommands);
 // hook copy was deleted by hand (force-commands legacy state).
 const pkgJsonPath = join(HOME, '.claude', 'hypo-pkg.json');
 const claudeExtResult = removeExtensions('claude', args.apply, args.forceExtensions);
-const claudeExtSettings = stripExtensionSettings(claudeSettings, claudeHooksDir, args.apply);
+const claudeExtSettings = stripExtensionSettings(
+  claudeSettings,
+  claudeHooksDir,
+  args.apply,
+  ownedHookCommands(pkgJsonPath, 'claude', claudeHooksDir),
+);
 
 let codexHookResult = { removed: [], missing: [] };
 let codexSettingsResult = { stripped: [] };
@@ -452,7 +489,12 @@ if (args.codex) {
   codexHookResult = removeHookFiles(codexHooksDir, hookFiles, args.apply);
   codexSettingsResult = stripSettingsJson(codexSettings, codexHooksDir, hookMap, args.apply);
   codexExtResult = removeExtensions('codex', args.apply, args.forceExtensions);
-  codexExtSettings = stripExtensionSettings(codexSettings, codexHooksDir, args.apply);
+  codexExtSettings = stripExtensionSettings(
+    codexSettings,
+    codexHooksDir,
+    args.apply,
+    ownedHookCommands(pkgJsonPath, 'codex', codexHooksDir),
+  );
 }
 
 // Surgical per-target ext SHA strip — only for files we actually removed.

package/templates/hypo-config.md

@@ -1,7 +1,7 @@
 ---
 title: Hypomnema Config
 type: config
-version: "1.5.1"
+version: "1.6.0"
 created: YYYY-MM-DD
 ---