@pushary/agent-hooks 0.29.0 → 0.30.0

package/dist/bin/pushary-clean.js

@@ -2,7 +2,7 @@
 import {
   removeClaudeMcpServers,
   removePusharySettings
-} from "../chunk-QNEYHDKR.js";
+} from "../chunk-H3LQRYMW.js";
 import {
   removeCodexHooks,
   removeGeminiSettings,
@@ -10,13 +10,14 @@ import {
 } from "../chunk-XY6OKUQ4.js";
 import {
   execNpm
-} from "../chunk-RSHN2AQ7.js";
+} from "../chunk-J7JWI3KU.js";
 import "../chunk-Z5PL3K7C.js";
 
 // bin/pushary-clean.ts
-import { existsSync, readFileSync, writeFileSync, rmSync } from "fs";
+import { existsSync, readFileSync, writeFileSync, rmSync, readdirSync } from "fs";
 import { join } from "path";
-import { homedir } from "os";
+import { homedir, tmpdir } from "os";
+import { execSync } from "child_process";
 import { confirm } from "@inquirer/prompts";
 import { parse as parseTOML, stringify as stringifyTOML } from "smol-toml";
 var dim = (s) => `\x1B[2m${s}\x1B[0m`;
@@ -31,7 +32,25 @@ var CLAUDE_JSON = join(homedir(), ".claude.json");
 var SKILL_DIR = join(homedir(), ".claude", "skills", "pushary");
 var CURSOR_MCP = join(".cursor", "mcp.json");
 var CURSOR_PLUGIN_DIR = join(homedir(), ".cursor", "plugins", "local", "pushary");
+var CURSOR_USER_HOOKS = join(homedir(), ".cursor", "hooks.json");
+var PUSHARY_DIR = join(homedir(), ".pushary");
 var SHELL_FILES = [".zshrc", ".zprofile", ".bashrc", ".bash_profile"].map((f) => join(homedir(), f));
+var resolveHermesPython = () => {
+  try {
+    const launcher = execSync("command -v hermes", { encoding: "utf-8", stdio: "pipe", timeout: 5e3 }).trim();
+    if (launcher) {
+      const shebang = readFileSync(launcher, "utf-8").split("\n", 1)[0];
+      if (shebang.startsWith("#!")) {
+        const interpreter = shebang.slice(2).trim().split(/\s+/)[0];
+        if (interpreter && /python/i.test(interpreter) && existsSync(interpreter)) return interpreter;
+      }
+    }
+  } catch {
+  }
+  const venvPython = join(homedir(), ".hermes", "hermes-agent", "venv", "bin", "python3");
+  if (existsSync(venvPython)) return venvPython;
+  return null;
+};
 var readJson = (path) => {
   try {
     return JSON.parse(readFileSync(path, "utf-8"));
@@ -61,7 +80,12 @@ var main = async () => {
   console.log(`  ${bold("Pushary Clean")}`);
   console.log(`  ${dim("Removes all Pushary configuration")}`);
   console.log();
-  const proceed = await confirm({ message: "Remove all Pushary configuration?", default: false });
+  const assumeYes = process.argv.includes("--yes") || process.argv.includes("-y");
+  if (!assumeYes && !process.stdin.isTTY) {
+    console.log(`  ${yellow("!")} Non-interactive shell. Re-run with --yes to confirm removal.`);
+    process.exit(1);
+  }
+  const proceed = assumeYes || await confirm({ message: "Remove all Pushary configuration?", default: false });
   if (!proceed) {
     console.log(`  ${dim("Cancelled.")}`);
     process.exit(0);
@@ -99,6 +123,23 @@ var main = async () => {
   } else {
     console.log(`  ${skip} Cursor plugin ${dim("(not installed)")}`);
   }
+  const cursorHooks = readJson(CURSOR_USER_HOOKS);
+  if (cursorHooks) {
+    const hooks = cursorHooks.hooks ?? {};
+    const existing = Array.isArray(hooks.beforeShellExecution) ? hooks.beforeShellExecution : [];
+    const others = existing.filter((h) => !String(h.command ?? "").includes("pushary-gate"));
+    if (others.length !== existing.length) {
+      if (others.length === 0) delete hooks.beforeShellExecution;
+      else hooks.beforeShellExecution = others;
+      cursorHooks.hooks = hooks;
+      writeJson(CURSOR_USER_HOOKS, cursorHooks);
+      console.log(`  ${check} Cursor gate ${dim("(removed from ~/.cursor/hooks.json)")}`);
+    } else {
+      console.log(`  ${skip} Cursor gate ${dim("(no pushary entries)")}`);
+    }
+  } else {
+    console.log(`  ${skip} Cursor gate ${dim("(no hooks.json)")}`);
+  }
   if (existsSync(SKILL_DIR)) {
     rmSync(SKILL_DIR, { recursive: true });
     console.log(`  ${check} Skill directory ${dim("(removed)")}`);
@@ -170,6 +211,24 @@ var main = async () => {
   } else {
     console.log(`  ${skip} Gemini GEMINI.md ${dim("(no pushary block)")}`);
   }
+  const hermesPython = resolveHermesPython();
+  if (hermesPython) {
+    const snippet = 'from hermes_cli.config import load_config, save_config; c = load_config(); p = c.get("plugins") if isinstance(c.get("plugins"), dict) else {}; e = p.get("enabled") if isinstance(p.get("enabled"), list) else []; p["enabled"] = [x for x in e if x != "pushary"]; c["plugins"] = p; a = c.get("agent") if isinstance(c.get("agent"), dict) else {}; d = a.get("disabled_toolsets") if isinstance(a.get("disabled_toolsets"), list) else []; a["disabled_toolsets"] = [x for x in d if x != "clarify"]; c["agent"] = a; save_config(c)';
+    try {
+      execSync(`"${hermesPython}" -c '${snippet}'`, { stdio: "pipe", timeout: 15e3 });
+      console.log(`  ${check} Hermes config ${dim("(plugin disabled, clarify toolset restored)")}`);
+    } catch {
+      console.log(`  ${skip} Hermes config ${dim("(could not update config.yaml)")}`);
+    }
+    try {
+      execSync(`"${hermesPython}" -m pip uninstall -y hermes-plugin-pushary`, { stdio: "pipe", timeout: 6e4 });
+      console.log(`  ${check} Hermes plugin ${dim("(pip uninstalled)")}`);
+    } catch {
+      console.log(`  ${skip} Hermes plugin ${dim("(not installed)")}`);
+    }
+  } else {
+    console.log(`  ${skip} Hermes ${dim("(not found)")}`);
+  }
   for (const shellFile of SHELL_FILES) {
     try {
       const content = readFileSync(shellFile, "utf-8");
@@ -181,6 +240,25 @@ var main = async () => {
     } catch {
     }
   }
+  if (existsSync(PUSHARY_DIR)) {
+    rmSync(PUSHARY_DIR, { recursive: true });
+    console.log(`  ${check} Local state ${dim("(~/.pushary removed: stored API key, ledger)")}`);
+  } else {
+    console.log(`  ${skip} Local state ${dim("(~/.pushary not found)")}`);
+  }
+  try {
+    let swept = 0;
+    for (const f of readdirSync(tmpdir())) {
+      if (!f.startsWith("pushary-")) continue;
+      try {
+        rmSync(join(tmpdir(), f), { recursive: true, force: true });
+        swept++;
+      } catch {
+      }
+    }
+    if (swept > 0) console.log(`  ${check} Temp state ${dim(`(${swept} pushary entries swept)`)}`);
+  } catch {
+  }
   try {
     execNpm("uninstall -g --no-workspaces @pushary/agent-hooks", { stdio: "ignore", timeout: 3e4 });
     console.log(`  ${check} Global package ${dim("(uninstalled)")}`);

package/dist/bin/pushary-codex-hook.js

@@ -3,6 +3,10 @@ import {
   denyReasonFrom,
   isDeferAnswer
 } from "../chunk-KQYIHZ5E.js";
+import {
+  isGatingMoment,
+  recordKeylessMoment
+} from "../chunk-R5AJNXZS.js";
 import {
   CODEX_AGENT,
   DEFAULT_SESSION,
@@ -201,8 +205,25 @@ var decidePermissionRequest = async (input) => {
   }
 };
 var decidePreToolUse = async (input) => {
+  let apiKey;
+  try {
+    apiKey = getApiKey();
+  } catch {
+    try {
+      const lookup = toPolicyLookup(input.tool_name ?? "", input.tool_input ?? {}, input.cwd);
+      if (isGatingMoment(lookup.tool, lookup.input)) {
+        recordKeylessMoment({
+          ts: Date.now(),
+          tool: lookup.tool,
+          project: basename(input.cwd ?? process.cwd()),
+          sessionId: input.session_id
+        });
+      }
+    } catch {
+    }
+    return codexPass();
+  }
   try {
-    const apiKey = getApiKey();
     const modeState = await fetchModeState(apiKey, input.session_id);
     if (modeState.kill) return codexDeny(KILL_REASON);
     const lookup = toPolicyLookup(input.tool_name ?? "", input.tool_input ?? {}, input.cwd);

package/dist/bin/pushary-doctor.js

@@ -14,7 +14,10 @@ import {
 } from "../chunk-XY6OKUQ4.js";
 import {
   execNpm
-} from "../chunk-RSHN2AQ7.js";
+} from "../chunk-J7JWI3KU.js";
+import {
+  readLedgerSummary
+} from "../chunk-R5AJNXZS.js";
 import {
   callMcpTool,
   sendMcpRequest
@@ -317,12 +320,29 @@ var main = async () => {
     globalVersion = "";
   }
   check(!!globalVersion, "Global package installed", globalVersion || "not found");
+  if (globalVersion) {
+    try {
+      const res = await fetch("https://registry.npmjs.org/@pushary/agent-hooks/latest", {
+        signal: AbortSignal.timeout(5e3)
+      });
+      const latest = res.ok ? (await res.json()).version ?? "" : "";
+      if (latest) {
+        const upToDate = latest === globalVersion;
+        check(upToDate, "Global package up to date", upToDate ? globalVersion : `${globalVersion} installed, ${latest} available \u2014 run npx @pushary/agent-hooks@latest upgrade`);
+      }
+    } catch {
+    }
+  }
   console.log();
   console.log(`  ${dim("Connectivity")}`);
   if (!apiKey) {
     check(false, "MCP server reachable", "skipped \u2014 no API key");
     check(false, "API key valid", "skipped");
     check(false, "MCP handshake", "skipped");
+    const keylessSummary = readLedgerSummary(7);
+    if (keylessSummary.count > 0) {
+      check(false, "Keyless approval moments (7d)", `${keylessSummary.count} counted locally \u2014 npx @pushary/agent-hooks@latest stats`);
+    }
   } else {
     let sessionId = "";
     try {
@@ -379,7 +399,7 @@ var main = async () => {
       const msg = err instanceof Error ? err.message : "network error";
       check(false, "Push notification sent", msg);
     }
-    const testQuestion = await confirm({ message: "Test question roundtrip? (sends a push notification)", default: false });
+    const testQuestion = process.stdin.isTTY ? await confirm({ message: "Test question roundtrip? (sends a push notification)", default: false }) : false;
     if (testQuestion) {
       console.log();
       console.log(`  ${dim("Question Roundtrip")}`);
@@ -418,7 +438,8 @@ var main = async () => {
   if (apiKey) {
     try {
       const res = await fetch(`${getBaseUrl()}/api/mcp/policy`, {
-        headers: { Authorization: `Bearer ${apiKey}` }
+        headers: { Authorization: `Bearer ${apiKey}` },
+        signal: AbortSignal.timeout(1e4)
       });
       if (res.ok) {
         const policy = await res.json();
@@ -453,4 +474,7 @@ var main = async () => {
   }
   console.log();
 };
-main();
+main().catch((err) => {
+  console.error(`  doctor failed: ${err instanceof Error ? err.message : String(err)}`);
+  process.exit(1);
+});

package/dist/bin/pushary-gemini-hook.js

@@ -3,6 +3,10 @@ import {
   denyReasonFrom,
   isDeferAnswer
 } from "../chunk-KQYIHZ5E.js";
+import {
+  isGatingMoment,
+  recordKeylessMoment
+} from "../chunk-R5AJNXZS.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -181,8 +185,25 @@ var handlePushFirst = async (apiKey, input, lookup, pushFirstSeconds) => {
   return geminiPass();
 };
 var decideBeforeTool = async (input) => {
+  let apiKey;
+  try {
+    apiKey = getApiKey();
+  } catch {
+    try {
+      const lookup = toGeminiPolicyLookup(input.tool_name ?? "", input.tool_input ?? {});
+      if (isGatingMoment(lookup.tool, lookup.input)) {
+        recordKeylessMoment({
+          ts: Date.now(),
+          tool: lookup.tool,
+          project: basename(input.cwd ?? process.cwd()),
+          sessionId: input.session_id
+        });
+      }
+    } catch {
+    }
+    return geminiPass();
+  }
   try {
-    const apiKey = getApiKey();
     const modeState = await fetchModeState(apiKey, input.session_id);
     if (modeState.kill) return geminiDeny(KILL_REASON);
     const lookup = toGeminiPolicyLookup(input.tool_name ?? "", input.tool_input ?? {});

package/dist/bin/pushary-hook.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   handlePreToolUse
-} from "../chunk-GPLKEAFG.js";
-import "../chunk-WLF3NCHS.js";
+} from "../chunk-CY5YP34L.js";
 import "../chunk-KQYIHZ5E.js";
+import "../chunk-R5AJNXZS.js";
 import "../chunk-IAOXM7X5.js";
 import "../chunk-DWED7BS3.js";
 import "../chunk-Z5PL3K7C.js";

package/dist/bin/pushary-setup.js

@@ -3,7 +3,7 @@ import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "../chunk-QNEYHDKR.js";
+} from "../chunk-H3LQRYMW.js";
 import {
   GEMINI_HOOK_BINARY,
   addCodexHookTrust,
@@ -17,8 +17,11 @@ import {
 } from "../chunk-XY6OKUQ4.js";
 import {
   execNpm,
-  npmErrorMessage
-} from "../chunk-RSHN2AQ7.js";
+  npmErrorMessage,
+  quoteIfNeeded,
+  resolveGlobalBinDir,
+  resolveGlobalBinary
+} from "../chunk-J7JWI3KU.js";
 import {
   reportEvent
 } from "../chunk-IAOXM7X5.js";
@@ -463,13 +466,7 @@ var setupClaudeCode = async (apiKey) => {
   });
   await installGlobally();
   await spinner("Adding hooks (PreToolUse, PostToolUse, UserPromptSubmit, Stop)", async () => {
-    let binDir;
-    try {
-      binDir = join(execNpm("prefix -g --no-workspaces", { timeout: 5e3 }).toString().trim(), "bin");
-    } catch {
-      binDir = void 0;
-    }
-    addPusharyHooks(settings, binDir);
+    addPusharyHooks(settings, resolveGlobalBinDir("pushary-hook"));
   });
   await spinner(`Writing ${CLAUDE_SETTINGS}`, async () => {
     writeJson(CLAUDE_SETTINGS, settings);
@@ -591,9 +588,7 @@ var removeCodexNotifyEntry = (codexConfig) => {
   writeFileSync(codexConfig, stringifyTOML(config), "utf-8");
 };
 var addCodexNotifyEntry = (codexConfig) => {
-  const globalPrefix = execNpm("prefix -g --no-workspaces", { timeout: 5e3 }).toString().trim();
-  const pusharyCodexPath = join(globalPrefix, "bin", "pushary-codex");
-  if (!existsSync(pusharyCodexPath)) throw new Error("pushary-codex not found at " + pusharyCodexPath);
+  const pusharyCodexPath = resolveGlobalBinary("pushary-codex") ?? "pushary-codex";
   let raw = "";
   try {
     raw = readFileSync(codexConfig, "utf-8");
@@ -633,10 +628,8 @@ var setupCodex = async (apiKey) => {
   const trustAuto = codexTrustAutoSupported(codexVersion);
   let trusted = false;
   if (hooksSupported) {
-    const globalPrefix = execNpm("prefix -g --no-workspaces", { timeout: 5e3 }).toString().trim();
-    const hookCommand = join(globalPrefix, "bin", "pushary-codex-hook");
+    const hookCommand = quoteIfNeeded(resolveGlobalBinary("pushary-codex-hook") ?? "pushary-codex-hook");
     await spinner("Adding native hooks (~/.codex/hooks.json)", async () => {
-      if (!existsSync(hookCommand)) throw new Error("pushary-codex-hook not found at " + hookCommand);
       const hooksConfig = readJson(CODEX_HOOKS_JSON);
       addCodexHooks(hooksConfig, hookCommand);
       writeJson(CODEX_HOOKS_JSON, hooksConfig);
@@ -822,13 +815,7 @@ var setupGemini = async (apiKey) => {
     addGeminiMcpServer(settings, apiKey);
   });
   await spinner("Adding hooks (BeforeTool, AfterTool, BeforeAgent, SessionStart, SessionEnd)", async () => {
-    let hookCommand = GEMINI_HOOK_BINARY;
-    try {
-      const candidate = join(execNpm("prefix -g --no-workspaces", { timeout: 5e3 }).toString().trim(), "bin", GEMINI_HOOK_BINARY);
-      if (existsSync(candidate)) hookCommand = candidate;
-    } catch {
-    }
-    addGeminiHooks(settings, hookCommand);
+    addGeminiHooks(settings, quoteIfNeeded(resolveGlobalBinary(GEMINI_HOOK_BINARY) ?? GEMINI_HOOK_BINARY));
   });
   await spinner(`Writing ${GEMINI_SETTINGS}`, async () => {
     writeJson(GEMINI_SETTINGS, settings);

package/dist/bin/pushary-stats.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   readLedgerSummary
-} from "../chunk-WLF3NCHS.js";
+} from "../chunk-R5AJNXZS.js";
 import "../chunk-Z5PL3K7C.js";
 import {
   getApiKey

package/dist/bin/pushary-upgrade.js

@@ -2,7 +2,7 @@
 import {
   execNpm,
   npmErrorMessage
-} from "../chunk-RSHN2AQ7.js";
+} from "../chunk-J7JWI3KU.js";
 
 // bin/pushary-upgrade.ts
 var getInstalledVersion = () => {

package/dist/bin/pushary.js

@@ -25,7 +25,7 @@ Pushary Agent Hooks
 Commands:
   setup    Configure Claude Code, Codex, Gemini CLI, Hermes, or Cursor with Pushary
   doctor   Verify your Pushary installation is working
-  clean    Remove all Pushary configuration
+  clean    Remove all Pushary configuration (--yes for non-interactive)
   mode     Switch approval mode (push_only, push_first, terminal_only)
   wait     Show or set the "wait for your phone" ladder (pushary wait 45)
   stats    Show the approval moments your agents hit while not connected

package/dist/{chunk-GPLKEAFG.js → chunk-CY5YP34L.js}

@@ -1,11 +1,11 @@
-import {
-  isGatingMoment,
-  recordKeylessMoment
-} from "./chunk-WLF3NCHS.js";
 import {
   denyReasonFrom,
   isDeferAnswer
 } from "./chunk-KQYIHZ5E.js";
+import {
+  isGatingMoment,
+  recordKeylessMoment
+} from "./chunk-R5AJNXZS.js";
 import {
   DEFAULT_SESSION,
   askUser,

package/dist/{chunk-QNEYHDKR.js → chunk-H3LQRYMW.js}

@@ -60,7 +60,10 @@ var addPusharyToolPermissions = (settings) => {
   permissions.allow = filtered;
 };
 var addPusharyHooks = (settings, binDir) => {
-  const resolve = (name) => binDir ? join(binDir, name) : name;
+  const resolve = (name) => {
+    const path = binDir ? join(binDir, name) : name;
+    return /\s/.test(path) ? `"${path}"` : path;
+  };
   const hooks = ensureRecord(settings, "hooks");
   const preToolUse = (Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : []).filter((entry) => !isPusharyHook(entry));
   preToolUse.push({

package/dist/{chunk-RSHN2AQ7.js → chunk-J7JWI3KU.js}

@@ -1,5 +1,7 @@
 // src/npm.ts
 import { execSync } from "child_process";
+import { existsSync } from "fs";
+import { join } from "path";
 var cleanNpmEnv = () => {
   const env = {};
   for (const [key, value] of Object.entries(process.env)) {
@@ -22,8 +24,26 @@ var execNpm = (args, options = {}) => {
     env: { ...cleanNpmEnv(), ...options.env ?? {} }
   });
 };
+var resolveGlobalBinary = (name) => {
+  try {
+    const prefix = execNpm("prefix -g --no-workspaces", { timeout: 5e3 }).toString().trim();
+    const candidates = process.platform === "win32" ? [join(prefix, `${name}.cmd`), join(prefix, name)] : [join(prefix, "bin", name)];
+    return candidates.find(existsSync);
+  } catch {
+    return void 0;
+  }
+};
+var resolveGlobalBinDir = (probe) => {
+  if (process.platform === "win32") return void 0;
+  const resolved = resolveGlobalBinary(probe);
+  return resolved ? resolved.slice(0, resolved.length - probe.length - 1) : void 0;
+};
+var quoteIfNeeded = (path) => /\s/.test(path) ? `"${path}"` : path;
 
 export {
   npmErrorMessage,
-  execNpm
+  execNpm,
+  resolveGlobalBinary,
+  resolveGlobalBinDir,
+  quoteIfNeeded
 };

package/dist/{chunk-WLF3NCHS.js → chunk-R5AJNXZS.js}

@@ -30,26 +30,28 @@ var recordKeylessMoment = (entry) => {
 var readLedgerSummary = (days = 7) => {
   const sinceMs = Date.now() - days * 864e5;
   const summary = { count: 0, sessions: 0, byTool: {}, sinceMs };
-  let raw;
-  try {
-    raw = readFileSync(ledgerPath(), "utf-8");
-  } catch {
-    return summary;
-  }
   const sessions = /* @__PURE__ */ new Set();
-  for (const line of raw.split("\n")) {
-    if (!line.trim()) continue;
-    let entry;
+  for (const path of [`${ledgerPath()}.1`, ledgerPath()]) {
+    let raw;
     try {
-      entry = JSON.parse(line);
+      raw = readFileSync(path, "utf-8");
     } catch {
       continue;
     }
-    if (typeof entry.ts !== "number" || entry.ts < sinceMs) continue;
-    summary.count += 1;
-    const tool = typeof entry.tool === "string" && entry.tool ? entry.tool : "Other";
-    summary.byTool[tool] = (summary.byTool[tool] ?? 0) + 1;
-    sessions.add(entry.sessionId || `${entry.project ?? "unknown"}:no-session`);
+    for (const line of raw.split("\n")) {
+      if (!line.trim()) continue;
+      let entry;
+      try {
+        entry = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      if (typeof entry.ts !== "number" || entry.ts < sinceMs) continue;
+      summary.count += 1;
+      const tool = typeof entry.tool === "string" && entry.tool ? entry.tool : "Other";
+      summary.byTool[tool] = (summary.byTool[tool] ?? 0) + 1;
+      sessions.add(entry.sessionId || `${entry.project ?? "unknown"}:no-session`);
+    }
   }
   summary.sessions = sessions.size;
   return summary;

package/dist/src/index.js

@@ -1,8 +1,8 @@
 import {
   handlePreToolUse
-} from "../chunk-GPLKEAFG.js";
-import "../chunk-WLF3NCHS.js";
+} from "../chunk-CY5YP34L.js";
 import "../chunk-KQYIHZ5E.js";
+import "../chunk-R5AJNXZS.js";
 import {
   askUser,
   cancelQuestion,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",