@outerlayer/cli 0.2.0 → 0.4.0

package/dist/{chunk-Q6CL5THG.js → chunk-5DLBAXY5.js}

@@ -1,17 +1,61 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession } from './chunk-U32VSRLO.js';
-import { resolveRepoIdentity } from './chunk-4TNZMO7V.js';
+import { detectActiveSession } from './chunk-BFESLKPP.js';
+import { sanitizeTerminal } from './chunk-6Y63SXFO.js';
+import { resolveRepoIdentity } from './chunk-G7FSV7JX.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import { readCloudConfig } from './chunk-TFUIDMOB.js';
+import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import { signRunnerRequest } from './chunk-M5POMKKW.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
 createRequire(import.meta.url);
 
+// src/runner/signature-refusals.ts
+var MESSAGES = /* @__PURE__ */ new Map([
+  [
+    "runner_key_signature_required",
+    "the gateway wants a signature on every request from this runner key, and this one had none. Upgrade the CLI, and check that the runner's host key file exists"
+  ],
+  [
+    "runner_key_signature_invalid",
+    "this runner key is bound to another host's key, or the request was altered after it was signed. If the key moved to this machine, a member clears the old binding on the factory's API keys page (Clear host key), and the next claim binds this host"
+  ],
+  [
+    "runner_key_signature_stale",
+    "the signature's time is more than five minutes from the gateway's clock. The clock of this host is the likely cause: check that it is set correctly and synchronised"
+  ],
+  [
+    "runner_key_signature_replayed",
+    "the gateway already accepted this exact signed request, so it was refused as a replay. Something is sending copies of the runner's requests; restart the runner"
+  ]
+]);
+function signatureRefusalMessage(code) {
+  return MESSAGES.get(code);
+}
+function isSignatureRefusal(code) {
+  return MESSAGES.has(code);
+}
+
 // src/work-cmd.ts
 var GREEN = "\x1B[32m";
+var YELLOW = "\x1B[33m";
 var DIM = "\x1B[2m";
 var RESET = "\x1B[0m";
+async function signatureHeaders(method, endpoint, payload, signer) {
+  if (signer === void 0) return {};
+  return { ...await signRunnerRequest({ method, url: endpoint, body: new TextEncoder().encode(payload), signer }) };
+}
+async function signatureRefusalOf(response) {
+  let code;
+  try {
+    code = (await response.json()).error.code;
+  } catch {
+    return void 0;
+  }
+  const message = signatureRefusalMessage(code);
+  return message === void 0 ? void 0 : new WorkCommandError(`${code}: ${message}`, false, 401, code);
+}
 var WorkCommandError = class extends Error {
   /** True when the same request is worth sending again: the gateway was
    * unreachable, answered a body that never came from it, or failed in a way
@@ -22,27 +66,18 @@ var WorkCommandError = class extends Error {
    * reached a response. A caller that has to tell one refusal from another —
    * a claim lost to another host from a key that no longer works — reads it
    * rather than matching on the message. */
-  constructor(message, retryable = false, status) {
+  constructor(message, retryable = false, status, code) {
     super(message);
     this.retryable = retryable;
     this.status = status;
+    this.code = code;
   }
 };
-var WORK_ADD_RETRY_DELAYS_MS = [1e3, 5e3, 15e3, 6e4];
+var WORK_LINK_RETRY_DELAYS_MS = [1e3, 5e3, 15e3, 6e4];
 function resolveCredentials(opts) {
-  const home = opts.home ?? homeFromEnv();
-  const env = opts.env ?? process.env;
-  const fileConfig = readCloudConfig(home);
-  const url = opts.url ?? env.OUTERLAYER_URL ?? fileConfig.url;
-  const apiKey = opts.apiKey ?? env.OUTERLAYER_API_KEY ?? fileConfig.apiKey;
-  const appId = opts.appId ?? env.OUTERLAYER_APP_ID ?? fileConfig.appId;
-  if (!url || !apiKey || !appId) {
-    const missing = [!url && "--url", !apiKey && "--api-key", !appId && "--app-id"].filter(Boolean).join(", ");
-    throw new WorkCommandError(
-      `missing ${missing}. Run \`outerlayer login --url <your gateway>\` and paste the key at the prompt, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.`
-    );
-  }
-  return { url, apiKey, appId };
+  const resolved = resolveGatewayCredentials(opts);
+  if (!resolved.ok) throw new WorkCommandError(resolved.message);
+  return { url: resolved.url, apiKey: resolved.credential, appId: resolved.appId };
 }
 function resolveRepository(repoFlag, cwd) {
   if (repoFlag) return repoFlag;
@@ -60,7 +95,7 @@ function parsePositiveInt(raw, flag) {
 }
 function parseRetries(raw) {
   const n = parseTrackerNumber(raw);
-  return n === void 0 ? 0 : Math.min(n, WORK_ADD_RETRY_DELAYS_MS.length);
+  return n === void 0 ? 0 : Math.min(n, WORK_LINK_RETRY_DELAYS_MS.length);
 }
 function resolveSubject(opts) {
   const issue = parsePositiveInt(opts.issue, "--issue");
@@ -69,33 +104,74 @@ function resolveSubject(opts) {
   }
   return { issue };
 }
-async function postJson(url, path, apiKey, appId, body, fetchImpl) {
+var TRACKER_FLAG_HELP = 'expected "linear" or "jira" \u2014 GitHub issues are named by number, with no --tracker';
+function resolveWorkSubject(opts) {
+  if (opts.issue === void 0) {
+    throw new WorkCommandError("pass --issue");
+  }
+  const asNumber = parseTrackerNumber(opts.issue);
+  if (asNumber !== void 0) {
+    if (opts.tracker !== void 0) {
+      throw new WorkCommandError(`--tracker cannot be used with --issue ${opts.issue}, a plain number: ${TRACKER_FLAG_HELP}`);
+    }
+    return { repository: resolveRepository(opts.repo, opts.cwd), issue: asNumber };
+  }
+  if (opts.tracker !== void 0 && opts.tracker !== "linear" && opts.tracker !== "jira") {
+    throw new WorkCommandError(`invalid --tracker "${opts.tracker}": ${TRACKER_FLAG_HELP}`);
+  }
+  return { key: String(opts.issue), tracker: opts.tracker, repository: opts.repo };
+}
+async function postJson(url, path, apiKey, appId, body, fetchImpl, timeoutMs, signer) {
+  const deadline = timeoutMs === void 0 ? void 0 : startDeadline(timeoutMs);
+  try {
+    return await postJsonBefore(url, path, apiKey, appId, body, fetchImpl, deadline, signer);
+  } finally {
+    deadline?.clear();
+  }
+}
+function startDeadline(ms) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), ms);
+  return { signal: controller.signal, ms, clear: () => clearTimeout(timer) };
+}
+async function postJsonBefore(url, path, apiKey, appId, body, fetchImpl, deadline, signer) {
   let response;
   const endpoint = new URL(path, url).toString();
+  const payload = JSON.stringify(body);
+  const signature = await signatureHeaders("POST", endpoint, payload ?? "", signer);
   try {
     response = await fetchImpl(endpoint, {
       method: "POST",
       headers: {
         "content-type": "application/json",
         authorization: `Bearer ${apiKey}`,
-        "x-outerlayer-app-id": appId
+        "x-outerlayer-app-id": appId,
+        ...signature
       },
-      body: JSON.stringify(body)
+      body: payload,
+      ...deadline ? { signal: deadline.signal } : {}
     });
   } catch (err) {
     throw new WorkCommandError(`network error reaching ${endpoint}: ${String(err)}`, true);
   }
   if (response.status === 401) {
-    throw new WorkCommandError(
-      "not authorized \u2014 the API key is unknown, expired, or bound to a different app. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys.",
+    throw await signatureRefusalOf(response) ?? new WorkCommandError(
+      unauthorizedMessage(apiKey),
       false,
       401
     );
   }
   let json;
   try {
-    json = await response.json();
-  } catch {
+    json = await readBodyBefore(response, deadline);
+  } catch (err) {
+    if (err instanceof BodyDeadlineError) {
+      throw new WorkCommandError(
+        `${endpoint} answered ${response.status} but did not finish its body within ${err.ms}ms`,
+        true,
+        response.status
+      );
+    }
     throw new WorkCommandError(
       `${endpoint} answered ${response.status} with a body that is not JSON \u2014 the request may not have reached the gateway`,
       true,
@@ -106,25 +182,48 @@ async function postJson(url, path, apiKey, appId, body, fetchImpl) {
     throw new WorkCommandError(
       json.error?.message ?? `request failed (${response.status})`,
       response.status >= 500 || response.status === 429,
-      response.status
+      response.status,
+      json.error?.code
     );
   }
   return { status: response.status, data: json.data ?? json };
 }
-async function getJson(url, path, apiKey, appId, fetchImpl) {
+var BodyDeadlineError = class extends Error {
+  constructor(ms) {
+    super(`the response body did not finish within ${ms}ms`);
+    this.ms = ms;
+  }
+};
+function readBodyBefore(response, deadline) {
+  const read = response.json();
+  if (deadline === void 0) return read;
+  const { signal } = deadline;
+  return new Promise((resolve, reject) => {
+    const expire = () => reject(new BodyDeadlineError(deadline.ms));
+    if (signal.aborted) expire();
+    signal.addEventListener("abort", expire);
+    read.then(resolve, reject);
+  });
+}
+async function getJson(url, path, apiKey, appId, fetchImpl, signer) {
   const endpoint = new URL(path, url).toString();
   let response;
+  const signature = await signatureHeaders("GET", endpoint, "", signer);
   try {
     response = await fetchImpl(endpoint, {
       method: "GET",
-      headers: { authorization: `Bearer ${apiKey}`, "x-outerlayer-app-id": appId }
+      headers: {
+        authorization: `Bearer ${apiKey}`,
+        "x-outerlayer-app-id": appId,
+        ...signature
+      }
     });
   } catch (err) {
     throw new WorkCommandError(`network error reaching ${endpoint}: ${String(err)}`);
   }
   if (response.status === 401) {
-    throw new WorkCommandError(
-      "not authorized \u2014 the API key is unknown, expired, or bound to a different app. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys.",
+    throw await signatureRefusalOf(response) ?? new WorkCommandError(
+      unauthorizedMessage(apiKey),
       false,
       401
     );
@@ -143,7 +242,8 @@ async function getJson(url, path, apiKey, appId, fetchImpl) {
     throw new WorkCommandError(
       json.error?.message ?? `request failed (${response.status})`,
       response.status >= 500 || response.status === 429,
-      response.status
+      response.status,
+      json.error?.code
     );
   }
   return { status: response.status, data: json.data ?? json, pagination: json.pagination ?? null };
@@ -174,33 +274,65 @@ function environmentFacts(opts) {
     ...ci ? { ci } : {}
   };
 }
-async function runWorkAdd(opts) {
+function isRetryableAnswer(err) {
+  const status = err instanceof WorkCommandError ? err.status ?? 0 : 0;
+  return status >= 500 || status === 429;
+}
+async function postJsonWithRetry(url, path, apiKey, appId, body, fetchImpl, retries, sleep) {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      return await postJson(url, path, apiKey, appId, body, fetchImpl);
+    } catch (err) {
+      if (attempt >= retries || !isRetryableAnswer(err)) throw err;
+      await sleep(WORK_LINK_RETRY_DELAYS_MS[attempt]);
+    }
+  }
+}
+function tokenWarning(data) {
+  const tokens = data.repositoryTokens;
+  if (tokens === void 0 || tokens === null || tokens.earnable !== false) return "";
+  const why = typeof tokens.message === "string" ? sanitizeTerminal(tokens.message) : "the gateway named no reason";
+  return `
+${YELLOW}!${RESET} a container host will fail this build: ${why}`;
+}
+async function runWorkBuild(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const env = opts.env ?? process.env;
   const home = opts.home ?? homeFromEnv(env);
   const { url, apiKey, appId } = resolveCredentials(opts);
-  const subject = resolveSubject(opts);
-  const repository = resolveRepository(opts.repo, cwd);
-  const fetchImpl = opts.fetchImpl ?? fetch;
-  const body = {
-    subject: { repository, ...subject },
-    note: opts.note,
-    ...environmentFacts({ cwd, env, home, sessionIdOverride: opts.sessionId })
-  };
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
+  const facts = environmentFacts({ cwd, env, home, sessionIdOverride: opts.sessionId });
   const retries = parseRetries(opts.retry);
   const sleep = opts.sleepImpl ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-  let data;
-  for (let attempt = 0; ; attempt += 1) {
-    try {
-      data = (await postJson(url, "/v1/work-items", apiKey, appId, body, fetchImpl)).data;
-      break;
-    } catch (err) {
-      if (attempt >= retries || !(err instanceof WorkCommandError) || !err.retryable) throw err;
-      await sleep(WORK_ADD_RETRY_DELAYS_MS[attempt]);
+  const itemNumber = parsePositiveInt(opts.item, "--item");
+  if (opts.local) {
+    if (itemNumber !== void 0) {
+      throw new WorkCommandError(
+        `--local takes --issue, not --item: item #${itemNumber} is already on Work \u2014 start a session on it with OUTERLAYER_WORK=${itemNumber}`
+      );
     }
+    const body2 = {
+      subject: resolveWorkSubject({ issue: opts.issue, tracker: opts.tracker, repo: opts.repo, cwd }),
+      note: opts.note,
+      ...facts
+    };
+    const { data: data2 } = await postJsonWithRetry(url, "/v1/work-items", apiKey, appId, body2, fetchImpl, retries, sleep);
+    const label = data2.number != null ? `#${data2.number}` : String(data2.workItemId);
+    const launch = data2.number != null ? `OUTERLAYER_WORK=${data2.number} claude` : null;
+    const branch = typeof data2.branch === "string" && data2.branch !== "" ? data2.branch : null;
+    const output2 = opts.json ? JSON.stringify({ ...data2, ...launch !== null ? { launchCommand: launch } : {} }) : `${GREEN}\u2713${RESET} on Work for you to build ${DIM}\xB7${RESET} ${label} ${DIM}\xB7${RESET} no host will take it` + (branch !== null ? `
+  branch: ${branch}` : "") + (launch !== null ? `
+  start your session with: ${launch}` : "");
+    if (!opts.quiet) process.stdout.write(output2 + "\n");
+    return { data: data2, output: output2 };
   }
-  const stageLine = data.recomputed === false ? `stage ${data.stage} (not yet derived \u2014 the hourly sweep settles it)` : `stage ${data.stage}`;
-  const output = opts.json ? JSON.stringify(data) : `${GREEN}\u2713${RESET} added ${DIM}\xB7${RESET} ${data.number != null ? `#${data.number}` : data.workItemId} ${DIM}\xB7${RESET} attestor ${data.attestor} ${DIM}\xB7${RESET} ${stageLine}`;
+  const body = itemNumber !== void 0 ? { workItemId: String(itemNumber), note: opts.note, ...facts } : {
+    subject: resolveWorkSubject({ issue: opts.issue, tracker: opts.tracker, repo: opts.repo, cwd }),
+    note: opts.note,
+    ...facts
+  };
+  const { data } = await postJsonWithRetry(url, "/v1/work-items/build", apiKey, appId, body, fetchImpl, retries, sleep);
+  const output = opts.json ? JSON.stringify(data) : `${GREEN}\u2713${RESET} build requested ${DIM}\xB7${RESET} ${data.number != null ? `#${data.number}` : data.workItemId} ${DIM}\xB7${RESET} by ${data.attestor}` + tokenWarning(data);
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };
 }
@@ -215,9 +347,14 @@ async function runWorkLinkSession(opts) {
   if (!sessionId) {
     throw new WorkCommandError("no session id detected \u2014 pass --session-id or run from a live session");
   }
-  const fetchImpl = opts.fetchImpl ?? fetch;
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
   const identity = resolveRepoIdentity(cwd);
-  const body = { sessionId, repository: identity.gitRepo ?? "" };
+  const body = {
+    sessionId,
+    repository: identity.gitRepo ?? "",
+    ...opts.noLease ? { noLease: true } : {},
+    ...opts.ended ? { ended: true } : {}
+  };
   const retries = parseRetries(opts.retry);
   const sleep = opts.sleepImpl ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
   let data;
@@ -227,10 +364,12 @@ async function runWorkLinkSession(opts) {
       break;
     } catch (err) {
       if (attempt >= retries || !(err instanceof WorkCommandError) || !err.retryable) throw err;
-      await sleep(WORK_ADD_RETRY_DELAYS_MS[attempt]);
+      await sleep(WORK_LINK_RETRY_DELAYS_MS[attempt]);
     }
   }
-  const output = opts.json ? JSON.stringify(data) : `${GREEN}\u2713${RESET} linked ${DIM}\xB7${RESET} session ${sessionId} ${DIM}\xB7${RESET} #${number}`;
+  const heldBy = typeof data.heldBy === "string" ? data.heldBy : void 0;
+  const linked = data.linked === true;
+  const output = opts.json ? JSON.stringify(data) : opts.ended ? linked ? `${GREEN}\u2713${RESET} ended ${DIM}\xB7${RESET} session ${sessionId} ${DIM}\xB7${RESET} #${number}` : `${DIM}\xB7${RESET} session ${sessionId} was not linked to #${number}` : heldBy ? `${DIM}\xB7${RESET} session ${sessionId} linked to #${number}, held by ${sanitizeTerminal(heldBy)} \u2014 no lease taken` : `${GREEN}\u2713${RESET} linked ${DIM}\xB7${RESET} session ${sessionId} ${DIM}\xB7${RESET} #${number}`;
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };
 }
@@ -242,7 +381,7 @@ async function runWorkRemove(opts) {
   if (!opts.reason) {
     throw new WorkCommandError("--reason is required \u2014 a removal records why");
   }
-  const fetchImpl = opts.fetchImpl ?? fetch;
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
   const itemNumber = parsePositiveInt(opts.item, "--item");
   if (itemNumber !== void 0) {
     const { data: data2 } = await postJson(
@@ -289,7 +428,7 @@ async function runWorkStatus(opts) {
       `/v1/work-items/${fetchByItem}`,
       creds.apiKey,
       creds.appId,
-      opts.fetchImpl ?? fetch
+      opts.fetchImpl ?? defaultFetch
     );
     const body = opts.json ? JSON.stringify(data2) : JSON.stringify(data2, null, 2);
     if (!opts.quiet) process.stdout.write(body + "\n");
@@ -297,7 +436,7 @@ async function runWorkStatus(opts) {
   }
   const subject = resolveSubject(opts);
   const repository = resolveRepository(opts.repo, cwd);
-  const fetchImpl = opts.fetchImpl ?? fetch;
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
   const number = subject.issue;
   const item = await findLiveItem(creds, repository, subject, fetchImpl);
   if (!item) {
@@ -311,7 +450,7 @@ async function runWorkStatus(opts) {
 async function runWorkList(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const { url, apiKey, appId } = resolveCredentials(opts);
-  const fetchImpl = opts.fetchImpl ?? fetch;
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
   const repository = opts.repo ?? resolveRepoIdentity(cwd).gitRepo;
   if (opts.needs !== void 0 && opts.needs !== "amend") {
     throw new WorkCommandError('--needs only accepts "amend"');
@@ -321,6 +460,7 @@ async function runWorkList(opts) {
   if (opts.stage) query.set("stage", opts.stage);
   if (opts.section) query.set("section", opts.section);
   if (opts.unclaimed) query.set("unclaimed", "true");
+  if (opts.claimed) query.set("claimed", "true");
   if (opts.startable) query.set("startable", "true");
   if (opts.needs) query.set("needs", opts.needs);
   const items = [];
@@ -332,9 +472,16 @@ async function runWorkList(opts) {
     cursor = page.pagination?.cursor ?? null;
   } while (cursor);
   const data = items;
-  const output = opts.json ? JSON.stringify(data) : items.length === 0 ? "no live work items" : items.map((i) => `${i.trackerKey} ${DIM}\xB7${RESET} ${i.stage} ${DIM}\xB7${RESET} ${i.section} ${DIM}\xB7${RESET} ${i.title}`).join("\n");
+  const claimSuffix = (claim) => {
+    if (!claim) return "";
+    const holder = claim.holderKind === "session" ? `${claim.memberName || "a member"} (local session` : `${sanitizeTerminal(claim.host)} (${claim.kind}`;
+    return ` ${DIM}\xB7${RESET} claimed by ${holder}, since ${claim.createdAt}, until ${claim.expiresAt})`;
+  };
+  const output = opts.json ? JSON.stringify(data) : items.length === 0 ? "no live work items" : items.map(
+    (i) => `${i.trackerKey} ${DIM}\xB7${RESET} ${i.stage} ${DIM}\xB7${RESET} ${i.section} ${DIM}\xB7${RESET} ${i.title}${claimSuffix(i.claim)}`
+  ).join("\n");
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };
 }
 
-export { WorkCommandError, findLiveItem, getJson, parsePositiveInt, postJson, resolveCredentials, resolveRepository, runWorkAdd, runWorkLinkSession, runWorkList, runWorkRemove, runWorkStatus };
+export { WorkCommandError, findLiveItem, getJson, isSignatureRefusal, parsePositiveInt, postJson, resolveCredentials, resolveRepository, runWorkBuild, runWorkLinkSession, runWorkList, runWorkRemove, runWorkStatus, signatureRefusalMessage };

package/dist/{chunk-R5KBGVII.js → chunk-5QRP3MVS.js}

@@ -5,7 +5,7 @@ import { existsSync, readFileSync, mkdirSync, copyFileSync, writeFileSync } from
 import { join, dirname, isAbsolute } from 'path';
 
 createRequire(import.meta.url);
-var REGISTERED_EVENTS = ["SessionStart", "SessionEnd", "Stop"];
+var REGISTERED_EVENTS = ["SessionStart", "SessionEnd", "Stop", "PostToolUse"];
 var MARKER = "_outerlayer";
 function settingsPath(scope, opts = {}) {
   const home = opts.home ?? homeFromEnv();
@@ -43,6 +43,12 @@ function tokenizeCommand(command) {
 function quoteBin(bin) {
   return /\s/.test(bin) ? `"${bin}"` : bin;
 }
+function isScriptBin(bin) {
+  return /\.[cm]?js$/i.test(bin);
+}
+function cliCommand(cliBin) {
+  return isScriptBin(cliBin) ? `node ${quoteBin(cliBin)}` : quoteBin(cliBin);
+}
 function isOurBin(bin, cliBin) {
   if (cliBin !== void 0 && normalizeBinPath(bin) === normalizeBinPath(cliBin)) return true;
   const parts = bin.replace(/\\/g, "/").split("/");
@@ -63,30 +69,40 @@ function splitCliInvocation(command, cliBin) {
   if (typeof command !== "string") return null;
   const tokens = tokenizeCommand(command.trim());
   if (!tokens) return null;
-  let i = 0;
   const launcher = (tokens[0] ?? "").replace(/\\/g, "/").split("/").pop() ?? "";
-  if (launcher === "node" || launcher === "node.exe" || launcher === "npx") i = 1;
+  const viaNode = launcher === "node" || launcher === "node.exe";
+  const viaNpx = launcher === "npx";
+  const i = viaNode || viaNpx ? 1 : 0;
   const bin = tokens[i];
   if (!bin || !isOurBin(bin, cliBin)) return null;
-  return { bin, args: tokens.slice(i + 1), viaNpx: launcher === "npx" };
+  return { bin, args: tokens.slice(i + 1), viaNpx, viaNode };
 }
 function parseCliInvocation(command, cliBin) {
   return splitCliInvocation(command, cliBin)?.args ?? null;
 }
 function ourCommandBins(settings) {
-  const bins = [];
+  return unique(ourCommandLaunches(settings).map((l) => l.bin));
+}
+function ourDirectScriptBins(settings) {
+  return unique(ourCommandLaunches(settings).filter((l) => !l.viaNode && isScriptBin(l.bin)).map((l) => l.bin));
+}
+function ourCommandLaunches(settings) {
+  const launches = [];
   const add = (command) => {
     const parsed = splitCliInvocation(command);
     if (!parsed || parsed.viaNpx) return;
     if (!["hook", "hook-wrap", "statusline"].includes(parsed.args[0] ?? "")) return;
     if (parsed.bin.includes("$") || !isAbsolute(parsed.bin)) return;
-    if (!bins.includes(parsed.bin)) bins.push(parsed.bin);
+    launches.push({ bin: parsed.bin, viaNode: parsed.viaNode });
   };
   for (const matchers of Object.values(settings?.hooks ?? {})) {
     for (const matcher of matchers ?? []) for (const h of matcher.hooks ?? []) add(h.command);
   }
   add(settings?.statusLine?.command);
-  return bins;
+  return launches;
+}
+function unique(values) {
+  return [...new Set(values)];
 }
 function parseLifecycleHookCommand(command, cliBin) {
   const args = parseCliInvocation(command, cliBin);
@@ -142,7 +158,7 @@ var SettingsParseError = class extends Error {
 };
 function ourEntry(cliBin, event) {
   return {
-    hooks: [{ type: "command", command: `${quoteBin(cliBin)} hook ${event}`, [MARKER]: true }]
+    hooks: [{ type: "command", command: `${cliCommand(cliBin)} hook ${event}`, [MARKER]: true }]
   };
 }
 function pruneOurHooks(blocks, cliBin) {
@@ -229,7 +245,7 @@ function wrapHookCommand(cliBin, h, opts = {}) {
   if (isWrapped(h, cliBin)) return h;
   const id = encodeWrappedCommand(h.command);
   const flag = opts.captureOutput ? " --capture-output" : "";
-  return { type: "command", command: `${quoteBin(cliBin)} hook-wrap --id ${id}${flag}`, [WRAP_MARKER]: h.command };
+  return { type: "command", command: `${cliCommand(cliBin)} hook-wrap --id ${id}${flag}`, [WRAP_MARKER]: h.command };
 }
 function unwrapHookCommand(h, cliBin) {
   const original = wrappedOriginalCommand(h, cliBin);
@@ -280,11 +296,11 @@ function repointWrappedHooks(settings, cliBin) {
         const h = matcher.hooks[hi];
         const parsed = splitCliInvocation(h.command, cliBin);
         if (!parsed || parsed.args[0] !== "hook-wrap") continue;
-        if (normalizeBinPath(parsed.bin) === normalizeBinPath(cliBin)) continue;
+        if (normalizeBinPath(parsed.bin) === normalizeBinPath(cliBin) && parsed.viaNode === isScriptBin(cliBin)) continue;
         const original = wrappedOriginalCommand(h, cliBin);
         if (original === null) continue;
         const flag = parsed.args.includes("--capture-output") ? " --capture-output" : "";
-        const desired = `${quoteBin(cliBin)} hook-wrap --id ${encodeWrappedCommand(original)}${flag}`;
+        const desired = `${cliCommand(cliBin)} hook-wrap --id ${encodeWrappedCommand(original)}${flag}`;
         matcher.hooks[hi] = { ...h, command: desired, [WRAP_MARKER]: original };
         changed = true;
       }
@@ -293,10 +309,10 @@ function repointWrappedHooks(settings, cliBin) {
   return { next, changed };
 }
 function statuslineCommand(cliBin) {
-  return `${quoteBin(cliBin)} statusline`;
+  return `${cliCommand(cliBin)} statusline`;
 }
 function statuslineWrapCommand(cliBin, original) {
-  return `${quoteBin(cliBin)} statusline --wrap-id ${encodeWrappedCommand(original)}`;
+  return `${cliCommand(cliBin)} statusline --wrap-id ${encodeWrappedCommand(original)}`;
 }
 function isOurStatuslineSlot(slot, cliBin) {
   if (slot[MARKER] === true) return true;
@@ -377,4 +393,4 @@ function unwrapHooks(settings, cliBin) {
   return { next, changed, unwrapped };
 }
 
-export { AUTO_WRAP_EVENTS, REGISTERED_EVENTS, SettingsParseError, cliBinResolvable, decodeWrappedCommand, isOurHookCommand, isOurStatuslineSlot, listHookCandidates, mergeHooks, mergeStatusline, ourCommandBins, readSettings, removeHooks, removeStatusline, repointWrappedHooks, settingsPath, statuslineWrappedOriginal, unwrapHooks, wrapHooks, wrappedOriginalCommand, writeSettings };
+export { AUTO_WRAP_EVENTS, REGISTERED_EVENTS, SettingsParseError, cliBinResolvable, cliCommand, decodeWrappedCommand, encodeWrappedCommand, isOurHookCommand, isOurHookCommandFor, isOurStatuslineSlot, isWrapped, listHookCandidates, mergeHooks, mergeStatusline, ourCommandBins, ourDirectScriptBins, parseLifecycleHookCommand, readSettings, removeHooks, removeStatusline, repointWrappedHooks, settingsPath, statuslineCommand, statuslineWrappedOriginal, unwrapHooks, wrapHooks, wrappedOriginalCommand, writeSettings };