feat(security): add SHA-256 hook integrity verification

Cargo.toml

@@ -27,6 +27,7 @@ toml = "0.8"
 chrono = "0.4"
 thiserror = "1.0"
 tempfile = "3"
+sha2 = "0.10"
 
 [dev-dependencies]
 

src/init.rs

@@ -4,6 +4,8 @@ use std::io::Write;
 use std::path::{Path, PathBuf};
 use tempfile::NamedTempFile;
 
+use crate::integrity;
+
 // Embedded hook script (guards before set -euo pipefail)
 const REWRITE_HOOK: &str = include_str!("../hooks/rtk-rewrite.sh");
 
@@ -223,6 +225,19 @@ fn ensure_hook_installed(hook_path: &Path, verbose: u8) -> Result<bool> {
     fs::set_permissions(hook_path, fs::Permissions::from_mode(0o755))
         .with_context(|| format!("Failed to set hook permissions: {}", hook_path.display()))?;
 
+    // Store SHA-256 hash for runtime integrity verification.
+    // Always store (idempotent) to ensure baseline exists even for
+    // hooks installed before integrity checks were added.
+    integrity::store_hash(hook_path).with_context(|| {
+        format!(
+            "Failed to store integrity hash for {}",
+            hook_path.display()
+        )
+    })?;
+    if verbose > 0 && changed {
+        eprintln!("Stored integrity hash for hook");
+    }
+
     Ok(changed)
 }
 
@@ -416,6 +431,11 @@ pub fn uninstall(global: bool, verbose: u8) -> Result<()> {
         removed.push(format!("Hook: {}", hook_path.display()));
     }
 
+    // 1b. Remove integrity hash file
+    if integrity::remove_hash(&hook_path)? {
+        removed.push("Integrity hash: removed".to_string());
+    }
+
     // 2. Remove RTK.md
     let rtk_md_path = claude_dir.join("RTK.md");
     if rtk_md_path.exists() {
@@ -934,6 +954,25 @@ pub fn show_config() -> Result<()> {
         println!("⚪ RTK.md: not found");
     }
 
+    // Check hook integrity
+    match integrity::verify_hook_at(&hook_path) {
+        Ok(integrity::IntegrityStatus::Verified) => {
+            println!("✅ Integrity: hook hash verified");
+        }
+        Ok(integrity::IntegrityStatus::Tampered { .. }) => {
+            println!("❌ Integrity: hook modified outside rtk init (run: rtk verify)");
+        }
+        Ok(integrity::IntegrityStatus::NoBaseline) => {
+            println!("⚠️  Integrity: no baseline hash (run: rtk init -g to establish)");
+        }
+        Ok(integrity::IntegrityStatus::NotInstalled) | Ok(integrity::IntegrityStatus::OrphanedHash) => {
+            // Don't show integrity line if hook isn't installed
+        }
+        Err(_) => {
+            println!("⚠️  Integrity: check failed");
+        }
+    }
+
     // Check global CLAUDE.md
     if global_claude_md.exists() {
         let content = fs::read_to_string(&global_claude_md)?;