@pushary/agent-hooks 0.18.1 → 0.18.3

package/data/cursor-plugin/scripts/pushary-gate.mjs

@@ -324,7 +324,14 @@ const main = async () => {
       diag('no input on stdin. Cursor did not pipe the command to this hook (a known Cursor issue on Windows). Handing off to Cursor\'s own prompt; the push approval cannot run without the command.')
       return respond(ask())
     }
-    input = JSON.parse(raw)
+    // Windows: Cursor prepends a BOM/encoding prefix to the hook's stdin, so raw
+    // arrives as e.g. "���{...}" and a bare JSON.parse throws,
+    // silently dropping us to "ask" with no push (the script works when run
+    // manually because there is no BOM). The payload is always a JSON object, so
+    // parse from the first "{" — robust to a BOM or whatever prefix bytes Cursor
+    // emits. Verified on Windows + Cursor 3.8.11.
+    const jsonStart = raw.indexOf('{')
+    input = JSON.parse(jsonStart > 0 ? raw.slice(jsonStart) : raw)
   } catch {
     diag('stdin was not valid JSON (often empty or corrupted, a known Cursor Windows stdin issue). Handing off to Cursor\'s own prompt.')
     return respond(ask())

package/dist/bin/pushary-doctor.js

@@ -189,8 +189,18 @@ var main = async () => {
   }
   const cursorPluginDir = join(homedir(), ".cursor", "plugins", "local", "pushary");
   if (existsSync(cursorPluginDir)) {
-    const cursorGate = join(cursorPluginDir, "hooks", "hooks.json");
-    check(existsSync(cursorGate), "Cursor: permission gate installed", existsSync(cursorGate) ? "beforeShellExecution gate" : "missing hooks.json, re-run setup");
+    const cursorUserHooks = join(homedir(), ".cursor", "hooks.json");
+    const userHooks = readJson(cursorUserHooks);
+    const gateEntry = userHooks.hooks?.beforeShellExecution?.find(
+      (h) => String(h.command ?? "").includes("pushary-gate")
+    );
+    if (!gateEntry) {
+      check(false, "Cursor: permission gate registered", "no Pushary gate in ~/.cursor/hooks.json \u2014 re-run setup (a plugin-only hooks.json is never read by Cursor)");
+    } else {
+      const scriptPath = String(gateEntry.command).match(/"([^"]+)"/)?.[1] ?? "";
+      const resolves = scriptPath ? existsSync(scriptPath) : false;
+      check(resolves, "Cursor: permission gate registered", resolves ? `~/.cursor/hooks.json \u2192 ${scriptPath}` : `gate script not found: ${scriptPath || gateEntry.command} \u2014 re-run setup`);
+    }
     const cursorMcp = readJson(join(cursorPluginDir, "mcp.json"));
     const cursorServers = cursorMcp?.mcpServers ?? {};
     const cursorAuth = cursorServers.pushary?.headers?.Authorization;

package/dist/bin/pushary-setup.js

@@ -296,6 +296,7 @@ var connectViaAppPairing = async () => {
 var CLAUDE_SETTINGS = join(homedir(), ".claude", "settings.json");
 var CLAUDE_JSON = join(homedir(), ".claude.json");
 var CURSOR_PLUGIN_DIR = join(homedir(), ".cursor", "plugins", "local", "pushary");
+var CURSOR_USER_HOOKS = join(homedir(), ".cursor", "hooks.json");
 var CLAUDE_SKILL_DIR = join(homedir(), ".claude", "skills", "pushary");
 var CODEX_HOME = process.env.CODEX_HOME?.trim() || join(homedir(), ".codex");
 var CODEX_SKILL_DIR = join(CODEX_HOME, "skills", "pushary");
@@ -697,6 +698,37 @@ var resolveBundledPlugin = () => {
   ];
   return candidates.find((p) => existsSync(join(p, ".cursor-plugin", "plugin.json"))) ?? null;
 };
+var installCursorUserHooks = (gateScript) => {
+  const template = readJson(join(CURSOR_PLUGIN_DIR, "hooks", "hooks.json")).hooks?.beforeShellExecution?.[0];
+  if (!template) throw new Error("bundled Cursor hooks.json missing a beforeShellExecution entry");
+  const entry = { ...template, command: `node "${gateScript}"` };
+  let userHooks = {};
+  if (existsSync(CURSOR_USER_HOOKS)) {
+    try {
+      userHooks = JSON.parse(readFileSync(CURSOR_USER_HOOKS, "utf-8"));
+    } catch {
+      try {
+        cpSync(CURSOR_USER_HOOKS, `${CURSOR_USER_HOOKS}.bak`);
+      } catch {
+      }
+      userHooks = {};
+    }
+  }
+  const hooks = userHooks.hooks ?? {};
+  const existing = Array.isArray(hooks.beforeShellExecution) ? hooks.beforeShellExecution : [];
+  const others = existing.filter((h) => !String(h.command ?? "").includes("pushary-gate"));
+  hooks.beforeShellExecution = [...others, entry];
+  writeJson(CURSOR_USER_HOOKS, { ...userHooks, version: userHooks.version ?? 1, hooks });
+};
+var neutralizePluginGate = () => {
+  const path = join(CURSOR_PLUGIN_DIR, "hooks", "hooks.json");
+  if (!existsSync(path)) return;
+  const data = readJson(path);
+  if (data.hooks && "beforeShellExecution" in data.hooks) {
+    delete data.hooks.beforeShellExecution;
+    writeJson(path, { version: data.version ?? 1, hooks: data.hooks });
+  }
+};
 var setupCursor = async (apiKey) => {
   console.log(`
   ${bold2("Setting up Cursor")}
@@ -720,12 +752,16 @@ var setupCursor = async (apiKey) => {
       writeJson(mcpPath, mcp);
     }
   });
+  await spinner("Registering permission gate (~/.cursor/hooks.json)", async () => {
+    installCursorUserHooks(join(CURSOR_PLUGIN_DIR, "scripts", "pushary-gate.mjs"));
+    neutralizePluginGate();
+  });
   console.log();
   console.log(`  ${dim2("What this configured:")}`);
-  console.log(`  ${dim2("\u2022")} Plugin installed to ~/.cursor/plugins/local/pushary`);
-  console.log(`  ${dim2("\u2022")} MCP tools, the always-on rule, the skill, and the permission gate`);
+  console.log(`  ${dim2("\u2022")} Plugin installed to ~/.cursor/plugins/local/pushary (MCP tools, rule, skill)`);
+  console.log(`  ${dim2("\u2022")} Permission gate registered once in ~/.cursor/hooks.json`);
   console.log(`  ${dim2("\u2022")} Risky shell commands route to push approval before they run`);
-  console.log(`  ${dim2("\u2022")} Restart Cursor (or run Developer: Reload Window) to load it`);
+  console.log(`  ${dim2("\u2022")} Fully quit and reopen Cursor to load it (a Reload Window may not be enough)`);
 };
 var saveApiKey = async (apiKey) => {
   await spinner("Saving your API key", async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.18.1",
+  "version": "0.18.3",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "author": "Pushary <business@pushary.com>",
   "homepage": "https://pushary.com",