praxis-sec 1.0.0

package/cli/commands/guard.js

@@ -0,0 +1,396 @@
+/**
+ * Guard Command
+ * =============
+ *
+ * Installs a git pre-push hook that runs praxis scan before every push.
+ * If secrets are found, the push is blocked.
+ *
+ * USAGE:
+ *   praxis guard                    Install pre-push hook
+ *   praxis guard --pre-commit       Install pre-commit hook instead
+ *   praxis guard remove             Remove installed hooks
+ *
+ * HUSKY SUPPORT:
+ *   If a .husky/ directory is detected, the hook is added there instead.
+ *   Otherwise it goes directly into .git/hooks/.
+ */
+
+import fs from 'fs';
+import path from 'path';
+import chalk from 'chalk';
+import * as output from '../utils/output.js';
+
+// =============================================================================
+// HOOK SCRIPTS
+// =============================================================================
+
+const PRE_PUSH_HOOK = `#!/bin/sh
+# praxis pre-push hook
+# Scans for leaked secrets before every git push.
+# Remove this hook with: npx praxis-sec guard remove
+
+echo ""
+echo "🔍 praxis: Scanning for secrets before push..."
+
+npx --yes praxis scan . --json > /tmp/praxis-scan.json 2>/dev/null
+
+if [ $? -ne 0 ]; then
+  echo ""
+  echo "❌ praxis: Secrets detected! Push blocked."
+  echo ""
+  echo "Run 'npx praxis-sec scan .' to see details."
+  echo "Fix the issues, then push again."
+  echo ""
+  echo "To skip this check (not recommended):"
+  echo "  git push --no-verify"
+  echo ""
+  rm -f /tmp/praxis-scan.json
+  exit 1
+fi
+
+echo "✅ praxis: No secrets detected. Pushing..."
+rm -f /tmp/praxis-scan.json
+exit 0
+`;
+
+const PRE_COMMIT_HOOK = `#!/bin/sh
+# praxis pre-commit hook
+# Scans staged files for leaked secrets before every commit.
+# Remove this hook with: npx praxis-sec guard remove
+
+echo ""
+echo "🔍 praxis: Scanning for secrets before commit..."
+
+npx --yes praxis scan . --json > /tmp/praxis-scan.json 2>/dev/null
+
+if [ $? -ne 0 ]; then
+  echo ""
+  echo "❌ praxis: Secrets detected! Commit blocked."
+  echo ""
+  echo "Run 'npx praxis-sec scan .' to see details."
+  echo "Fix the issues, then commit again."
+  echo ""
+  echo "To skip this check (not recommended):"
+  echo "  git commit --no-verify"
+  echo ""
+  rm -f /tmp/praxis-scan.json
+  exit 1
+fi
+
+echo "✅ praxis: No secrets detected. Committing..."
+rm -f /tmp/praxis-scan.json
+exit 0
+`;
+
+const HUSKY_PRE_PUSH = `#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+echo ""
+echo "🔍 praxis: Scanning for secrets before push..."
+
+npx praxis-sec scan . --json > /tmp/praxis-scan.json 2>/dev/null
+
+if [ $? -ne 0 ]; then
+  echo ""
+  echo "❌ praxis: Secrets detected! Push blocked."
+  echo "Run 'npx praxis-sec scan .' to see details."
+  rm -f /tmp/praxis-scan.json
+  exit 1
+fi
+
+echo "✅ praxis: No secrets detected."
+rm -f /tmp/praxis-scan.json
+`;
+
+const HUSKY_PRE_COMMIT = `#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+echo ""
+echo "🔍 praxis: Scanning for secrets before commit..."
+
+npx praxis-sec scan . --json > /tmp/praxis-scan.json 2>/dev/null
+
+if [ $? -ne 0 ]; then
+  echo ""
+  echo "❌ praxis: Secrets detected! Commit blocked."
+  echo "Run 'npx praxis-sec scan .' to see details."
+  rm -f /tmp/praxis-scan.json
+  exit 1
+fi
+
+echo "✅ praxis: No secrets detected."
+rm -f /tmp/praxis-scan.json
+`;
+
+// =============================================================================
+// MAIN COMMAND
+// =============================================================================
+
+export async function guardCommand(action, options = {}) {
+  const cwd = process.cwd();
+
+  // Verify this is a git repo
+  const gitDir = findGitDir(cwd);
+  if (!gitDir) {
+    output.error('Not a git repository. Run this from your project root.');
+    process.exit(1);
+  }
+
+  if (options.generateHooks) {
+    return generateClaudeHooks(cwd);
+  }
+
+  if (action === 'remove') {
+    return removeHooks(gitDir, cwd);
+  }
+
+  return installHook(gitDir, cwd, options);
+}
+
+// =============================================================================
+// INSTALL
+// =============================================================================
+
+function installHook(gitDir, cwd, options) {
+  const hookType = options.preCommit ? 'pre-commit' : 'pre-push';
+  const hookScript = options.preCommit ? PRE_COMMIT_HOOK : PRE_PUSH_HOOK;
+  const huskyScript = options.preCommit ? HUSKY_PRE_COMMIT : HUSKY_PRE_PUSH;
+
+  output.header('Installing praxis Guard');
+
+  // Check for Husky
+  const huskyDir = path.join(cwd, '.husky');
+  const useHusky = fs.existsSync(huskyDir);
+
+  if (useHusky) {
+    installHuskyHook(huskyDir, hookType, huskyScript);
+  } else {
+    installGitHook(gitDir, hookType, hookScript);
+  }
+
+  console.log();
+  console.log(chalk.gray('What happens now:'));
+  console.log(chalk.gray(`  Every git ${hookType === 'pre-push' ? 'push' : 'commit'} will run praxis scan`));
+  console.log(chalk.gray('  If secrets are found, the operation is blocked'));
+  console.log(chalk.gray('  Use --no-verify to skip (not recommended)'));
+  console.log();
+  console.log(chalk.gray('To remove: npx praxis-sec guard remove'));
+}
+
+function installGitHook(gitDir, hookType, script) {
+  const hooksDir = path.join(gitDir, 'hooks');
+  const hookPath = path.join(hooksDir, hookType);
+
+  // Ensure hooks directory exists
+  if (!fs.existsSync(hooksDir)) {
+    fs.mkdirSync(hooksDir, { recursive: true });
+  }
+
+  // Check if hook already exists (not from praxis)
+  if (fs.existsSync(hookPath)) {
+    const existing = fs.readFileSync(hookPath, 'utf-8');
+    if (!existing.includes('praxis')) {
+      output.warning(`Existing ${hookType} hook found. Appending praxis check.`);
+      fs.appendFileSync(hookPath, '\n' + script);
+      output.success(`Appended to .git/hooks/${hookType}`);
+      return;
+    }
+    output.warning(`praxis guard already installed in .git/hooks/${hookType}`);
+    return;
+  }
+
+  fs.writeFileSync(hookPath, script);
+  // Make executable (chmod +x)
+  try {
+    fs.chmodSync(hookPath, '755');
+  } catch {
+    // Windows doesn't support chmod, but hooks still run via git
+  }
+
+  output.success(`Hook installed at .git/hooks/${hookType}`);
+}
+
+function installHuskyHook(huskyDir, hookType, script) {
+  const hookPath = path.join(huskyDir, hookType);
+
+  if (fs.existsSync(hookPath)) {
+    const existing = fs.readFileSync(hookPath, 'utf-8');
+    if (!existing.includes('praxis')) {
+      output.warning(`Existing Husky ${hookType} found. Appending praxis check.`);
+      fs.appendFileSync(hookPath, '\n# praxis\n' + script.split('\n').slice(3).join('\n'));
+      output.success(`Appended to .husky/${hookType}`);
+      return;
+    }
+    output.warning(`praxis guard already installed in .husky/${hookType}`);
+    return;
+  }
+
+  fs.writeFileSync(hookPath, script);
+  try {
+    fs.chmodSync(hookPath, '755');
+  } catch {}
+
+  output.success(`Hook installed at .husky/${hookType} (Husky detected)`);
+}
+
+// =============================================================================
+// REMOVE
+// =============================================================================
+
+function removeHooks(gitDir, cwd) {
+  output.header('Removing praxis Guard');
+
+  let removed = 0;
+
+  // Check .git/hooks
+  const hookTypes = ['pre-push', 'pre-commit'];
+  for (const hookType of hookTypes) {
+    const hookPath = path.join(gitDir, 'hooks', hookType);
+    if (fs.existsSync(hookPath)) {
+      const content = fs.readFileSync(hookPath, 'utf-8');
+      if (content.includes('praxis')) {
+        if (content.trim() === PRE_PUSH_HOOK.trim() || content.trim() === PRE_COMMIT_HOOK.trim()) {
+          // Praxis is the only hook — delete the file
+          fs.unlinkSync(hookPath);
+          output.success(`Removed .git/hooks/${hookType}`);
+        } else {
+          // Other hooks exist — only remove praxis lines
+          const cleaned = content
+            .replace(/# praxis[\s\S]*?exit 0\n/g, '')
+            .trimEnd() + '\n';
+          fs.writeFileSync(hookPath, cleaned);
+          output.success(`Removed praxis from .git/hooks/${hookType}`);
+        }
+        removed++;
+      }
+    }
+
+    // Check .husky
+    const huskyHookPath = path.join(cwd, '.husky', hookType);
+    if (fs.existsSync(huskyHookPath)) {
+      const content = fs.readFileSync(huskyHookPath, 'utf-8');
+      if (content.includes('praxis')) {
+        fs.unlinkSync(huskyHookPath);
+        output.success(`Removed .husky/${hookType}`);
+        removed++;
+      }
+    }
+  }
+
+  if (removed === 0) {
+    output.warning('No praxis hooks found.');
+  }
+}
+
+// =============================================================================
+// CLAUDE CODE DEFENSIVE HOOKS
+// =============================================================================
+
+function generateClaudeHooks(cwd) {
+  output.header('Generating Defensive Claude Code Hooks');
+
+  const claudeDir = path.join(cwd, '.claude');
+  const settingsPath = path.join(claudeDir, 'settings.json');
+
+  // Defensive hooks that block common attack patterns
+  const preToolCmd = [
+    'node -e "',
+    'const c=process.argv[1]||String();',
+    'const bad=[/curl.*[|].*(?:bash|sh|node|python)/i,/wget.*[|].*(?:bash|sh)/i,',
+    '/rm\\s+-rf\\s+\\//,/webhook[.]site|requestbin|ngrok[.]io|pipedream/i,',
+    '/base64.*-d.*[|].*(?:bash|sh)/i];',
+    'const m=bad.find(r=>r.test(c));',
+    'if(m){console.error(String.fromCharCode(10060)+String.fromCharCode(32)+c.slice(0,80));process.exit(1)}',
+    '" "$INPUT"',
+  ].join('');
+
+  const postToolCmd = [
+    'node -e "',
+    'const f=process.argv[1]||String();',
+    'if(/[.]env$|[.]env[.]/.test(f)){console.log(String.fromCharCode(9888)+String.fromCharCode(32)+f)}',
+    '" "$INPUT"',
+  ].join('');
+
+  const defensiveHooks = {
+    hooks: {
+      PreToolUse: [
+        {
+          matcher: 'Bash',
+          command: preToolCmd,
+          description: 'Praxis: Block dangerous command patterns (curl|bash, rm -rf /, exfil domains)',
+        },
+      ],
+      PostToolUse: [
+        {
+          matcher: 'Write',
+          command: postToolCmd,
+          description: 'Praxis: Alert when .env files are modified',
+        },
+      ],
+    },
+  };
+
+  // Merge with existing settings
+  let existing = {};
+  if (fs.existsSync(settingsPath)) {
+    try {
+      existing = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
+    } catch { /* fresh start */ }
+  }
+
+  // Merge hooks — don't overwrite existing hooks, append
+  if (!existing.hooks) existing.hooks = {};
+  if (!existing.hooks.PreToolUse) existing.hooks.PreToolUse = [];
+  if (!existing.hooks.PostToolUse) existing.hooks.PostToolUse = [];
+
+  // Check if praxis hooks already present
+  const hasPreHook = existing.hooks.PreToolUse.some(h => h.description?.includes('Praxis'));
+  const hasPostHook = existing.hooks.PostToolUse.some(h => h.description?.includes('Praxis'));
+
+  if (hasPreHook && hasPostHook) {
+    output.warning('Praxis hooks already installed in .claude/settings.json');
+    return;
+  }
+
+  if (!hasPreHook) {
+    existing.hooks.PreToolUse.push(...defensiveHooks.hooks.PreToolUse);
+  }
+  if (!hasPostHook) {
+    existing.hooks.PostToolUse.push(...defensiveHooks.hooks.PostToolUse);
+  }
+
+  // Write
+  if (!fs.existsSync(claudeDir)) fs.mkdirSync(claudeDir, { recursive: true });
+  fs.writeFileSync(settingsPath, JSON.stringify(existing, null, 2) + '\n');
+
+  output.success('Defensive hooks installed in .claude/settings.json');
+  console.log();
+  console.log(chalk.gray('  Hooks installed:'));
+  console.log(chalk.gray('    PreToolUse  → Block curl|bash, rm -rf /, exfil domains'));
+  console.log(chalk.gray('    PostToolUse → Alert on .env file modifications'));
+  console.log();
+  console.log(chalk.gray('  These hooks protect against:'));
+  console.log(chalk.gray('    • Remote code execution via piped downloads'));
+  console.log(chalk.gray('    • Data exfiltration to webhook.site/ngrok/requestbin'));
+  console.log(chalk.gray('    • Destructive filesystem operations'));
+  console.log(chalk.gray('    • Unauthorized .env modifications'));
+  console.log();
+}
+
+// =============================================================================
+// UTILITIES
+// =============================================================================
+
+function findGitDir(startPath) {
+  let current = startPath;
+
+  while (true) {
+    const gitPath = path.join(current, '.git');
+    if (fs.existsSync(gitPath)) {
+      return gitPath;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) return null; // Reached filesystem root
+    current = parent;
+  }
+}

package/cli/commands/hooks.js

@@ -0,0 +1,278 @@
+/**
+ * Hooks Command
+ * =============
+ *
+ * Installs praxis as PreToolUse / PostToolUse hooks in Claude Code
+ * (~/.claude/settings.json). Once installed, praxis runs automatically
+ * on every Write, Edit, and Bash tool call — blocking secrets before they
+ * land on disk and feeding advisory findings back into the conversation.
+ *
+ * USAGE:
+ *   npx praxis-sec hooks install     Install hooks into ~/.claude/settings.json
+ *   npx praxis-sec hooks remove      Remove praxis hooks
+ *   npx praxis-sec hooks status      Show whether hooks are installed
+ *
+ * HOOK BEHAVIOUR:
+ *   PreToolUse  — blocks Write/Edit if critical secrets detected; blocks
+ *                 dangerous Bash patterns (curl|bash, credential exfiltration)
+ *   PostToolUse — scans the written file and injects advisory findings into
+ *                 Claude's context (never blocks — just informs)
+ *
+ * STABLE PATH STRATEGY:
+ *   npx caches packages in a volatile temp directory. Writing that temp path
+ *   to ~/.claude/settings.json means hooks break silently as soon as npx
+ *   clears or rotates its cache. Instead, we copy the three hook scripts to
+ *   ~/.praxis/hooks/ (a stable, user-owned directory) and register those
+ *   paths. They survive npx cache rotations and package updates.
+ */
+
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import chalk from 'chalk';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+// Source: hook scripts shipped inside the package
+const PKG_HOOK_DIR = path.resolve(__dirname, '../hooks');
+
+// Stable destination: user-owned, survives npx cache rotations
+const STABLE_HOOK_DIR = path.join(os.homedir(), '.praxis', 'hooks');
+const PRE_HOOK_SCRIPT  = path.join(STABLE_HOOK_DIR, 'pre-tool-use.js');
+const POST_HOOK_SCRIPT = path.join(STABLE_HOOK_DIR, 'post-tool-use.js');
+
+// Claude Code settings.json location
+const CLAUDE_SETTINGS_PATH = path.join(os.homedir(), '.claude', 'settings.json');
+
+// The command strings we register (use stable paths)
+const PRE_COMMAND  = `node "${PRE_HOOK_SCRIPT}"`;
+const POST_COMMAND = `node "${POST_HOOK_SCRIPT}"`;
+
+// =============================================================================
+// Public API
+// =============================================================================
+
+export async function hooksCommand(action = 'install', _options = {}) {
+  switch (action) {
+    case 'install': return install();
+    case 'remove':  return remove();
+    case 'status':  return status();
+    default:
+      console.error(chalk.red(`Unknown action: ${action}. Use: install | remove | status`));
+      process.exit(1);
+  }
+}
+
+// =============================================================================
+// Install
+// =============================================================================
+
+function install() {
+  // ── 1. Copy hook scripts to stable location ────────────────────────────────
+  const scripts = ['pre-tool-use.js', 'post-tool-use.js', 'patterns.js'];
+
+  for (const script of scripts) {
+    const src = path.join(PKG_HOOK_DIR, script);
+    if (!fs.existsSync(src)) {
+      console.error(chalk.red(`Hook script not found: ${src}. Try reinstalling praxis.`));
+      process.exit(1);
+    }
+  }
+
+  try {
+    fs.mkdirSync(STABLE_HOOK_DIR, { recursive: true });
+    for (const script of scripts) {
+      fs.copyFileSync(
+        path.join(PKG_HOOK_DIR, script),
+        path.join(STABLE_HOOK_DIR, script)
+      );
+    }
+  } catch (err) {
+    console.error(chalk.red(`Failed to copy hook scripts to ${STABLE_HOOK_DIR}: ${err.message}`));
+    process.exit(1);
+  }
+
+  // ── 2. Register stable paths in ~/.claude/settings.json ───────────────────
+  const settings = readSettings();
+  ensureHooksStructure(settings);
+
+  let changed = false;
+
+  // PreToolUse: Write / Edit / MultiEdit / Bash
+  const preEntry = buildEntry(
+    ['Write', 'Edit', 'MultiEdit', 'Bash'],
+    PRE_COMMAND,
+    'praxis pre-tool-use: block secrets in writes, dangerous bash patterns'
+  );
+  if (!hasEntry(settings.hooks.PreToolUse, PRE_COMMAND)) {
+    settings.hooks.PreToolUse.push(preEntry);
+    changed = true;
+  }
+
+  // PostToolUse: Write / Edit / MultiEdit
+  const postEntry = buildEntry(
+    ['Write', 'Edit', 'MultiEdit'],
+    POST_COMMAND,
+    'praxis post-tool-use: advisory scan after file writes'
+  );
+  if (!hasEntry(settings.hooks.PostToolUse, POST_COMMAND)) {
+    settings.hooks.PostToolUse.push(postEntry);
+    changed = true;
+  }
+
+  if (!changed) {
+    console.log(chalk.green('✔ praxis hooks are already installed.'));
+    printStatus(settings);
+    return;
+  }
+
+  writeSettings(settings);
+
+  console.log(chalk.green.bold('\n✔ praxis hooks installed successfully.\n'));
+  console.log(chalk.gray('  Hook scripts: ') + chalk.white(STABLE_HOOK_DIR));
+  console.log(chalk.gray('  Settings file: ') + chalk.white(CLAUDE_SETTINGS_PATH));
+  console.log();
+  console.log(chalk.cyan('  What happens now:'));
+  console.log(chalk.white('  Write / Edit    ') + chalk.gray('→ blocked if critical secrets detected in content'));
+  console.log(chalk.white('  Bash            ') + chalk.gray('→ blocked on curl|bash, credential exfiltration patterns'));
+  console.log(chalk.white('  Write / Edit    ') + chalk.gray('→ advisory scan after save (findings injected into context)'));
+  console.log();
+  console.log(chalk.gray('  To remove:  npx praxis-sec hooks remove'));
+  console.log(chalk.gray('  To verify:  npx praxis-sec hooks status\n'));
+}
+
+// =============================================================================
+// Remove
+// =============================================================================
+
+function remove() {
+  const settings = readSettings();
+
+  if (!settings.hooks) {
+    console.log(chalk.yellow('No hooks configured in settings.json.'));
+    return;
+  }
+
+  let removed = 0;
+
+  for (const event of ['PreToolUse', 'PostToolUse']) {
+    if (!Array.isArray(settings.hooks[event])) continue;
+    const before = settings.hooks[event].length;
+    settings.hooks[event] = settings.hooks[event].filter(entry => !isOurEntry(entry));
+    removed += before - settings.hooks[event].length;
+  }
+
+  if (removed === 0) {
+    console.log(chalk.yellow('No praxis hooks found in settings.json.'));
+    return;
+  }
+
+  // Clean up empty arrays / empty hooks object so settings.json is left tidy
+  for (const event of ['PreToolUse', 'PostToolUse']) {
+    if (Array.isArray(settings.hooks[event]) && settings.hooks[event].length === 0) {
+      delete settings.hooks[event];
+    }
+  }
+  if (Object.keys(settings.hooks).length === 0) {
+    delete settings.hooks;
+  }
+
+  writeSettings(settings);
+  console.log(chalk.green(`✔ Removed ${removed} praxis hook(s) from ${CLAUDE_SETTINGS_PATH}`));
+  console.log(chalk.gray(`  Hook scripts kept at ${STABLE_HOOK_DIR} (safe to delete manually)`));
+}
+
+// =============================================================================
+// Status
+// =============================================================================
+
+function status() {
+  const settings = readSettings();
+  printStatus(settings);
+}
+
+function printStatus(settings) {
+  const preInstalled  = settings.hooks?.PreToolUse  && hasEntry(settings.hooks.PreToolUse,  PRE_COMMAND);
+  const postInstalled = settings.hooks?.PostToolUse && hasEntry(settings.hooks.PostToolUse, POST_COMMAND);
+  const scriptsExist  = fs.existsSync(PRE_HOOK_SCRIPT) && fs.existsSync(POST_HOOK_SCRIPT);
+
+  console.log(chalk.bold('\npraxis Claude Code hooks status:\n'));
+  console.log(
+    (preInstalled  ? chalk.green('  ✔') : chalk.red('  ✗')) +
+    chalk.white(' PreToolUse  ') +
+    chalk.gray('(block secrets in writes, dangerous bash commands)')
+  );
+  console.log(
+    (postInstalled ? chalk.green('  ✔') : chalk.red('  ✗')) +
+    chalk.white(' PostToolUse ') +
+    chalk.gray('(advisory scan after file writes)')
+  );
+  console.log(
+    (scriptsExist  ? chalk.green('  ✔') : chalk.yellow('  ✗')) +
+    chalk.white(' Hook scripts') +
+    chalk.gray(` (${STABLE_HOOK_DIR})`)
+  );
+  console.log();
+
+  if (!preInstalled || !postInstalled) {
+    console.log(chalk.gray('  Run: npx praxis-sec hooks install'));
+  }
+  console.log();
+}
+
+// =============================================================================
+// Settings helpers
+// =============================================================================
+
+function readSettings() {
+  try {
+    if (fs.existsSync(CLAUDE_SETTINGS_PATH)) {
+      return JSON.parse(fs.readFileSync(CLAUDE_SETTINGS_PATH, 'utf8'));
+    }
+  } catch {
+    // If the file exists but is malformed, back it up and start fresh
+    const backup = CLAUDE_SETTINGS_PATH + '.bak';
+    try { fs.copyFileSync(CLAUDE_SETTINGS_PATH, backup); } catch {}
+    console.warn(chalk.yellow(`Warning: could not parse existing settings.json — backed up to ${backup}`));
+  }
+  return {};
+}
+
+function writeSettings(settings) {
+  const dir = path.dirname(CLAUDE_SETTINGS_PATH);
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(CLAUDE_SETTINGS_PATH, JSON.stringify(settings, null, 2) + '\n', 'utf8');
+}
+
+function ensureHooksStructure(settings) {
+  if (!settings.hooks) settings.hooks = {};
+  if (!Array.isArray(settings.hooks.PreToolUse))  settings.hooks.PreToolUse  = [];
+  if (!Array.isArray(settings.hooks.PostToolUse)) settings.hooks.PostToolUse = [];
+}
+
+function buildEntry(matchers, command, description) {
+  return {
+    matcher: matchers.join('|'),
+    hooks: [
+      {
+        type: 'command',
+        command,
+        description,
+      },
+    ],
+  };
+}
+
+function hasEntry(list, command) {
+  if (!Array.isArray(list)) return false;
+  return list.some(entry =>
+    Array.isArray(entry.hooks) &&
+    entry.hooks.some(h => h.command === command)
+  );
+}
+
+function isOurEntry(entry) {
+  if (!Array.isArray(entry.hooks)) return false;
+  return entry.hooks.some(h => h.command === PRE_COMMAND || h.command === POST_COMMAND);
+}