@pushary/agent-hooks 0.60.0 → 0.62.0

package/dist/chunk-YJ7YZRVV.js

@@ -0,0 +1,217 @@
+import {
+  NetworkError
+} from "./chunk-7QLSKOSU.js";
+import {
+  EXIT
+} from "./chunk-SP7OZXCQ.js";
+import {
+  isValidApiKey
+} from "./chunk-DQAN3JQP.js";
+import {
+  getBaseUrl
+} from "./chunk-2UMNXADU.js";
+
+// src/cli/net.ts
+import { createRequire } from "module";
+var requireCjs = createRequire(import.meta.url);
+var PROXY_VARS = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"];
+var proxyFromEnv = () => {
+  for (const name of PROXY_VARS) {
+    const value = process.env[name]?.trim();
+    if (value) return value;
+  }
+  return void 0;
+};
+var installed = false;
+var installProxyDispatcher = () => {
+  if (installed) return;
+  installed = true;
+  if (!proxyFromEnv()) return;
+  try {
+    const { EnvHttpProxyAgent, setGlobalDispatcher } = requireCjs("undici");
+    setGlobalDispatcher(new EnvHttpProxyAgent());
+  } catch {
+  }
+};
+var isNetworkFailure = (err) => {
+  if (!(err instanceof Error)) return false;
+  const code = err.code;
+  if (code && ["ENOTFOUND", "ECONNREFUSED", "ECONNRESET", "ETIMEDOUT", "EAI_AGAIN", "EPROTO", "CERT_HAS_EXPIRED", "UNABLE_TO_VERIFY_LEAF_SIGNATURE"].includes(code)) {
+    return true;
+  }
+  return err.name === "AbortError" || err.name === "TimeoutError" || /fetch failed/i.test(err.message);
+};
+var DEFAULT_TIMEOUT_MS = 15e3;
+var pusharyFetch = async (url, init = {}) => {
+  installProxyDispatcher();
+  const { timeoutMs = DEFAULT_TIMEOUT_MS, signal, ...rest } = init;
+  try {
+    return await fetch(url, {
+      ...rest,
+      signal: signal ?? AbortSignal.timeout(timeoutMs)
+    });
+  } catch (err) {
+    if (isNetworkFailure(err)) {
+      const proxy = proxyFromEnv();
+      const via = proxy ? ` (via proxy ${proxy})` : "";
+      throw new NetworkError(`Could not reach ${new URL(url).host}${via}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    throw err;
+  }
+};
+
+// src/session.ts
+var IDENTITY_PATH = "/api/v1/server/identity";
+var DEFAULT_TIMEOUT_MS2 = 1e4;
+var SUBSCRIPTION_REQUIRED_CODE = "subscription_required";
+var DEFAULT_UPGRADE_PATH = "/dashboard/settings?tab=billing";
+var KEY_SCOPES = ["full_access", "connector", "bound"];
+var SUBSCRIPTION_STATUSES = [
+  "active",
+  "past_due",
+  "canceled",
+  "incomplete",
+  "trialing",
+  "expired",
+  "none"
+];
+var asString = (value) => typeof value === "string" && value ? value : null;
+var asScope = (value) => KEY_SCOPES.includes(value) ? value : "full_access";
+var asStatus = (value) => SUBSCRIPTION_STATUSES.includes(value) ? value : "none";
+var asCount = (value) => typeof value === "number" && Number.isFinite(value) ? Math.max(0, Math.trunc(value)) : 0;
+var absoluteUrl = (baseUrl, pathOrUrl) => {
+  if (/^https?:\/\//i.test(pathOrUrl)) return pathOrUrl;
+  return `${baseUrl.replace(/\/+$/, "")}${pathOrUrl.startsWith("/") ? "" : "/"}${pathOrUrl}`;
+};
+var toIdentity = (body) => {
+  if (typeof body !== "object" || body === null) return null;
+  const raw = body;
+  const keyId = asString(raw.keyId);
+  const siteId = asString(raw.siteId);
+  if (!keyId || !siteId) return null;
+  return {
+    keyId,
+    keyPrefix: asString(raw.keyPrefix) ?? "",
+    keyName: asString(raw.keyName) ?? "",
+    keyScope: asScope(raw.keyScope),
+    siteId,
+    siteSlug: asString(raw.siteSlug) ?? "",
+    siteName: asString(raw.siteName) ?? "",
+    workspaceId: asString(raw.workspaceId) ?? "",
+    plan: asString(raw.plan) ?? "unknown",
+    surfacePlan: asString(raw.surfacePlan) ?? "unknown",
+    subscriptionStatus: asStatus(raw.subscriptionStatus),
+    locked: raw.locked === true,
+    machineId: asString(raw.machineId),
+    authorizedUserId: asString(raw.authorizedUserId),
+    workspaceMembers: asCount(raw.workspaceMembers),
+    createdAt: asString(raw.createdAt),
+    lastUsedAt: asString(raw.lastUsedAt)
+  };
+};
+var readJsonBody = async (response) => {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+};
+var checkApiKey = async (apiKey, options = {}) => {
+  if (!isValidApiKey(apiKey)) return { kind: "malformed" };
+  const baseUrl = options.baseUrl ?? getBaseUrl();
+  const fetchImpl = options.fetchImpl ?? pusharyFetch;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+  let response;
+  try {
+    response = await fetchImpl(`${baseUrl.replace(/\/+$/, "")}${IDENTITY_PATH}`, {
+      headers: { Authorization: `Bearer ${apiKey}`, Accept: "application/json" },
+      timeoutMs
+    });
+  } catch (err) {
+    const detail = err instanceof NetworkError || err instanceof Error ? err.message : String(err);
+    return { kind: "unreachable", detail };
+  }
+  if (response.status === 401) return { kind: "rejected" };
+  if (response.status === 403) {
+    const body = await readJsonBody(response);
+    const raw = typeof body === "object" && body !== null ? body : {};
+    if (raw.code !== SUBSCRIPTION_REQUIRED_CODE) {
+      return { kind: "unreachable", detail: asString(raw.message) ?? `HTTP ${response.status}` };
+    }
+    return {
+      kind: "locked",
+      plan: asString(raw.plan),
+      upgradeUrl: absoluteUrl(baseUrl, asString(raw.upgradeUrl) ?? DEFAULT_UPGRADE_PATH)
+    };
+  }
+  if (!response.ok) {
+    return { kind: "unreachable", detail: `HTTP ${response.status}` };
+  }
+  const identity = toIdentity(await readJsonBody(response));
+  if (!identity) {
+    return { kind: "unreachable", detail: "the server answered with an unexpected body" };
+  }
+  return { kind: "ok", identity };
+};
+var keyCheckFromResponse = async (response, baseUrl = getBaseUrl()) => {
+  if (response.status === 401) return { kind: "rejected" };
+  if (response.status !== 403) return null;
+  const body = await readJsonBody(response.clone());
+  const raw = typeof body === "object" && body !== null ? body : {};
+  if (raw.code !== SUBSCRIPTION_REQUIRED_CODE) return null;
+  return {
+    kind: "locked",
+    plan: asString(raw.plan),
+    upgradeUrl: absoluteUrl(baseUrl, asString(raw.upgradeUrl) ?? DEFAULT_UPGRADE_PATH)
+  };
+};
+var describeKeyCheck = (check, baseUrl = getBaseUrl()) => {
+  const settingsUrl = absoluteUrl(baseUrl, "/dashboard/agent/settings");
+  switch (check.kind) {
+    case "ok":
+      return {
+        message: `Key verified for ${check.identity.siteSlug || check.identity.siteName || "your site"}.`,
+        next: [],
+        exitCode: EXIT.OK,
+        fatal: false
+      };
+    case "malformed":
+      return {
+        message: "That does not look like a Pushary API key.",
+        next: [`Expected the pk_xxx.xxx form. Copy yours from ${settingsUrl}`],
+        exitCode: EXIT.USAGE,
+        fatal: true
+      };
+    case "rejected":
+      return {
+        message: "This key was rejected by pushary.com.",
+        next: [`Get a working key: ${settingsUrl}`, "Then re-run: pushary setup"],
+        exitCode: EXIT.UNAUTHENTICATED,
+        fatal: true
+      };
+    case "locked":
+      return {
+        message: "Your Pushary plan is not active, so approvals will not deliver yet.",
+        next: [
+          "Your agents are configured and your key itself is fine.",
+          `Activate the plan: ${check.upgradeUrl}`,
+          "Then run: pushary doctor"
+        ],
+        exitCode: EXIT.PROBLEMS_FOUND,
+        fatal: false
+      };
+    case "unreachable":
+      return {
+        message: `Could not reach pushary.com to verify the key (${check.detail}).`,
+        next: ["Continuing anyway. Run `pushary doctor` once you are online."],
+        exitCode: EXIT.UNREACHABLE,
+        fatal: false
+      };
+  }
+};
+
+export {
+  checkApiKey,
+  keyCheckFromResponse,
+  describeKeyCheck
+};

package/dist/src/index.js

@@ -1,6 +1,6 @@
 import {
   handlePreToolUse
-} from "../chunk-BE5X3WXL.js";
+} from "../chunk-5SO3CEGJ.js";
 import "../chunk-CAJZAFVS.js";
 import "../chunk-YHG74UFF.js";
 import {
@@ -15,15 +15,15 @@ import {
   reportEvent,
   resolvePolicy,
   waitForAnswer
-} from "../chunk-WNRYRN2R.js";
-import "../chunk-RN3NOEJF.js";
+} from "../chunk-HIIBSYFJ.js";
 import "../chunk-WLGEY4UX.js";
-import "../chunk-DWED7BS3.js";
+import "../chunk-HNTKTK5B.js";
 import "../chunk-DQAN3JQP.js";
+import "../chunk-RN3NOEJF.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-NKXSILEW.js";
+} from "../chunk-2UMNXADU.js";
 export {
   askUser,
   cancelQuestion,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.60.0",
+  "version": "0.62.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",
@@ -60,6 +60,10 @@
     "pushary-gemini-hook": "./dist/bin/pushary-gemini-hook.js",
     "pushary-setup": "./dist/bin/pushary-setup.js",
     "pushary-clean": "./dist/bin/pushary-clean.js",
+    "pushary-status": "./dist/bin/pushary-status.js",
+    "pushary-login": "./dist/bin/pushary-login.js",
+    "pushary-logout": "./dist/bin/pushary-logout.js",
+    "pushary-connect": "./dist/bin/pushary-connect.js",
     "pushary-doctor": "./dist/bin/pushary-doctor.js",
     "pushary-mode": "./dist/bin/pushary-mode.js",
     "pushary-wait": "./dist/bin/pushary-wait.js",
@@ -69,18 +73,21 @@
   },
   "files": [
     "dist",
-    "data"
+    "data",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "build": "node scripts/bundle-plugin.mjs && tsup",
     "dev": "tsup --watch",
-    "test": "bun test src/api.test.ts && bun test src/claude-config.test.ts && bun test src/config.test.ts && bun test src/mcp-http.test.ts && bun test src/retry.test.ts && bun test src/usage.test.ts && bun test src/validate.test.ts && bun test src/policy.test.ts && bun test src/npm.test.ts && bun test src/identity.test.ts && bun test src/pending.test.ts && bun test src/events.test.ts && bun test src/describe.test.ts && bun test src/reapply.test.ts && bun test src/suggestions.test.ts && bun test src/safe-commands.test.ts && bun test src/hook.test.ts && bun test src/codex-adapter.test.ts && bun test src/codex-config.test.ts && bun test src/gemini-adapter.test.ts && bun test src/gemini-config.test.ts && bun test src/instruction-file.test.ts && bun test src/pairing.test.ts && bun test src/wait-ladder.test.ts && bun test src/ledger.test.ts && bun test src/wrapper/wrapper.test.ts && bun test src/wrapper/messageQueue.test.ts && bun test src/wrapper/approver.test.ts && bun test src/wrapper/remoteLoop.test.ts && bun test src/wrapper/spawnClaude.test.ts && bun test src/wrapper/wsProtocol.test.ts && bun test src/wrapper/relayClient.test.ts && bun test src/wrapper/modeLoop.test.ts && bun test src/wrapper/stdinHandoff.test.ts && bun test src/wrapper/localLeg.test.ts && bun test src/crypto.test.ts && bun test src/crypto-vector.test.ts && bun test src/transcript-capture.test.ts && bun test src/transcript-sync.test.ts && bun test src/spawn-daemon.test.ts && bun test src/decision-episode.test.ts && bun test src/repo.test.ts"
+    "test": "node ../../scripts/ci/run-tests.mjs src bin",
+    "typecheck": "tsc --noEmit"
   },
   "dependencies": {
     "@inquirer/prompts": "^8.4.2",
     "qrcode-terminal": "^0.12.0",
     "smol-toml": "^1.6.1",
-    "tweetnacl": "^1.0.3"
+    "tweetnacl": "^1.0.3",
+    "undici": "^6.21.0"
   },
   "devDependencies": {
     "@pushary/contracts": "workspace:*",

package/dist/chunk-BQLCELYC.js

@@ -1,332 +0,0 @@
-import {
-  HOOK_BUDGETS
-} from "./chunk-DQAN3JQP.js";
-
-// src/codex-config.ts
-import { createHash } from "crypto";
-var CODEX_HOOK_BINARY = "pushary-codex-hook";
-var CODEX_HOOK_EVENTS = [
-  { event: "PermissionRequest", matcher: "Bash|apply_patch", timeout: HOOK_BUDGETS.codex.budgetSeconds, statusMessage: "Waiting for your phone" },
-  { event: "PreToolUse", matcher: "Bash|apply_patch", timeout: HOOK_BUDGETS.codex.budgetSeconds, statusMessage: "Checking Pushary policy" },
-  { event: "PostToolUse", matcher: "Bash|apply_patch", timeout: 10 },
-  { event: "UserPromptSubmit", timeout: 10 },
-  { event: "Stop", timeout: 10 },
-  { event: "SessionStart", matcher: "startup|resume", timeout: 10 }
-];
-var CODEX_EVENT_KEY = {
-  PermissionRequest: "permission_request",
-  PreToolUse: "pre_tool_use",
-  PostToolUse: "post_tool_use",
-  UserPromptSubmit: "user_prompt_submit",
-  Stop: "stop",
-  SessionStart: "session_start"
-};
-var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-var ensureRecord = (target, key) => {
-  const existing = asRecord(target[key]);
-  if (existing) return existing;
-  const created = {};
-  target[key] = created;
-  return created;
-};
-var CODEX_MCP_URL = "https://pushary.com/api/mcp/mcp";
-var addCodexMcpServer = (config, apiKey) => {
-  const servers = ensureRecord(config, "mcp_servers");
-  const pushary = ensureRecord(servers, "pushary");
-  pushary.url = CODEX_MCP_URL;
-  ensureRecord(pushary, "http_headers").Authorization = `Bearer ${apiKey}`;
-  pushary.default_tools_approval_mode = "approve";
-  delete pushary.bearer_token_env_var;
-  delete pushary.tools;
-};
-var readCodexMcpAuth = (config) => {
-  const pushary = asRecord(asRecord(config.mcp_servers)?.pushary);
-  if (!pushary) return void 0;
-  const authorization = asRecord(pushary.http_headers)?.Authorization;
-  if (typeof authorization === "string" && authorization.startsWith("Bearer ")) {
-    return { method: "embedded", key: authorization.slice("Bearer ".length).trim() };
-  }
-  if (typeof pushary.bearer_token_env_var === "string") {
-    return { method: "env", envVar: pushary.bearer_token_env_var };
-  }
-  if (typeof pushary.bearer_token === "string") return { method: "legacy-bearer" };
-  return void 0;
-};
-var isPusharyCodexHook = (entry) => {
-  const hooks = asRecord(entry)?.hooks;
-  if (!Array.isArray(hooks)) return false;
-  return hooks.some((hook) => String(asRecord(hook)?.command ?? "").includes(CODEX_HOOK_BINARY));
-};
-var addCodexHooks = (config, command) => {
-  const hooks = ensureRecord(config, "hooks");
-  for (const definition of CODEX_HOOK_EVENTS) {
-    const existing = Array.isArray(hooks[definition.event]) ? hooks[definition.event] : [];
-    const entries = existing.filter((entry) => !isPusharyCodexHook(entry));
-    entries.push({
-      ...definition.matcher ? { matcher: definition.matcher } : {},
-      hooks: [{
-        type: "command",
-        command,
-        timeout: definition.timeout,
-        ...definition.statusMessage ? { statusMessage: definition.statusMessage } : {}
-      }]
-    });
-    hooks[definition.event] = entries;
-  }
-};
-var removeCodexHooks = (config) => {
-  const hooks = asRecord(config.hooks);
-  if (!hooks) return false;
-  let changed = false;
-  for (const definition of CODEX_HOOK_EVENTS) {
-    const entries = hooks[definition.event];
-    if (!Array.isArray(entries)) continue;
-    const filtered = entries.filter((entry) => !isPusharyCodexHook(entry));
-    if (filtered.length !== entries.length) {
-      if (filtered.length === 0) {
-        delete hooks[definition.event];
-      } else {
-        hooks[definition.event] = filtered;
-      }
-      changed = true;
-    }
-  }
-  if (Object.keys(hooks).length === 0) delete config.hooks;
-  return changed;
-};
-var hasCodexHooks = (config) => {
-  const hooks = asRecord(config.hooks);
-  if (!hooks) return false;
-  return CODEX_HOOK_EVENTS.some((definition) => {
-    const entries = hooks[definition.event];
-    return Array.isArray(entries) && entries.some(isPusharyCodexHook);
-  });
-};
-var missingCodexHookEvents = (config) => {
-  const hooks = asRecord(config.hooks);
-  return CODEX_HOOK_EVENTS.filter((definition) => {
-    const entries = hooks?.[definition.event];
-    return !Array.isArray(entries) || !entries.some(isPusharyCodexHook);
-  }).map((definition) => definition.event);
-};
-var canonicalJson = (value) => {
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return "[" + value.map(canonicalJson).join(",") + "]";
-  const obj = value;
-  return "{" + Object.keys(obj).sort().map((key) => JSON.stringify(key) + ":" + canonicalJson(obj[key])).join(",") + "}";
-};
-var codexHookTrustHash = (definition, command) => {
-  const hook = { async: false, command, timeout: definition.timeout, type: "command" };
-  if (definition.statusMessage) hook.statusMessage = definition.statusMessage;
-  const identity = { event_name: CODEX_EVENT_KEY[definition.event], hooks: [hook] };
-  if (definition.matcher) identity.matcher = definition.matcher;
-  return "sha256:" + createHash("sha256").update(canonicalJson(identity), "utf8").digest("hex");
-};
-var codexHookStateKey = (hooksJsonPath, event) => `${hooksJsonPath}:${CODEX_EVENT_KEY[event]}:0:0`;
-var untrustedCodexHookEvents = (config, hooksJsonPath, command) => {
-  const state = asRecord(asRecord(config.hooks)?.state);
-  return CODEX_HOOK_EVENTS.filter((definition) => {
-    const entry = asRecord(state?.[codexHookStateKey(hooksJsonPath, definition.event)]);
-    const stored = entry?.trusted_hash;
-    return stored !== codexHookTrustHash(definition, command);
-  }).map((definition) => definition.event);
-};
-var addCodexHookTrust = (config, hooksJsonPath, command) => {
-  const hooks = ensureRecord(config, "hooks");
-  const state = ensureRecord(hooks, "state");
-  for (const definition of CODEX_HOOK_EVENTS) {
-    const key = codexHookStateKey(hooksJsonPath, definition.event);
-    const existing = asRecord(state[key]) ?? {};
-    state[key] = { ...existing, trusted_hash: codexHookTrustHash(definition, command) };
-  }
-};
-
-// src/gemini-config.ts
-var GEMINI_HOOK_BINARY = "pushary-gemini-hook";
-var GEMINI_MCP_URL = "https://pushary.com/api/mcp/mcp";
-var GEMINI_HOOK_EVENTS = [
-  { event: "BeforeTool", matcher: "run_shell_command|write_file|replace", timeoutMs: HOOK_BUDGETS.gemini.budgetSeconds * 1e3 },
-  { event: "AfterTool", matcher: "run_shell_command|write_file|replace", timeoutMs: 1e4 },
-  { event: "BeforeAgent", timeoutMs: 1e4 },
-  { event: "SessionStart", timeoutMs: 1e4 },
-  { event: "SessionEnd", timeoutMs: 1e4 }
-];
-var asRecord2 = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-var ensureRecord2 = (target, key) => {
-  const existing = asRecord2(target[key]);
-  if (existing) return existing;
-  const created = {};
-  target[key] = created;
-  return created;
-};
-var isPusharyGeminiHook = (entry) => {
-  const hooks = asRecord2(entry)?.hooks;
-  if (!Array.isArray(hooks)) return false;
-  return hooks.some((hook) => String(asRecord2(hook)?.command ?? "").includes(GEMINI_HOOK_BINARY));
-};
-var addGeminiMcpServer = (settings, apiKey) => {
-  const mcpServers = ensureRecord2(settings, "mcpServers");
-  mcpServers.pushary = {
-    httpUrl: GEMINI_MCP_URL,
-    headers: { Authorization: `Bearer ${apiKey}` },
-    trust: true
-  };
-};
-var addGeminiHooks = (settings, command) => {
-  const hooks = ensureRecord2(settings, "hooks");
-  for (const definition of GEMINI_HOOK_EVENTS) {
-    const existing = Array.isArray(hooks[definition.event]) ? hooks[definition.event] : [];
-    const entries = existing.filter((entry) => !isPusharyGeminiHook(entry));
-    entries.push({
-      ...definition.matcher ? { matcher: definition.matcher } : {},
-      hooks: [{
-        name: "pushary",
-        type: "command",
-        command,
-        timeout: definition.timeoutMs
-      }]
-    });
-    hooks[definition.event] = entries;
-  }
-};
-var removeGeminiHooks = (settings) => {
-  const hooks = asRecord2(settings.hooks);
-  if (!hooks) return false;
-  let changed = false;
-  for (const definition of GEMINI_HOOK_EVENTS) {
-    const entries = hooks[definition.event];
-    if (!Array.isArray(entries)) continue;
-    const filtered = entries.filter((entry) => !isPusharyGeminiHook(entry));
-    if (filtered.length !== entries.length) {
-      if (filtered.length === 0) {
-        delete hooks[definition.event];
-      } else {
-        hooks[definition.event] = filtered;
-      }
-      changed = true;
-    }
-  }
-  if (Object.keys(hooks).length === 0) delete settings.hooks;
-  return changed;
-};
-var removeGeminiMcpServer = (settings) => {
-  const mcpServers = asRecord2(settings.mcpServers);
-  if (!mcpServers?.pushary) return false;
-  delete mcpServers.pushary;
-  if (Object.keys(mcpServers).length === 0) delete settings.mcpServers;
-  return true;
-};
-var removeGeminiSettings = (settings) => {
-  const mcpRemoved = removeGeminiMcpServer(settings);
-  const hooksRemoved = removeGeminiHooks(settings);
-  return mcpRemoved || hooksRemoved;
-};
-var hasGeminiHooks = (settings) => {
-  const hooks = asRecord2(settings.hooks);
-  if (!hooks) return false;
-  return GEMINI_HOOK_EVENTS.some((definition) => {
-    const entries = hooks[definition.event];
-    return Array.isArray(entries) && entries.some(isPusharyGeminiHook);
-  });
-};
-var missingGeminiHookEvents = (settings) => {
-  const hooks = asRecord2(settings.hooks);
-  return GEMINI_HOOK_EVENTS.filter((definition) => {
-    const entries = hooks?.[definition.event];
-    return !Array.isArray(entries) || !entries.some(isPusharyGeminiHook);
-  }).map((definition) => definition.event);
-};
-
-// src/instruction-file.ts
-import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "fs";
-import { dirname } from "path";
-var PUSHARY_BEGIN = "<!-- BEGIN PUSHARY (managed by @pushary/agent-hooks; do not edit this block) -->";
-var PUSHARY_END = "<!-- END PUSHARY -->";
-var instructionBody = (label) => `## Pushary notifications and approvals
-
-You have Pushary MCP tools that reach the user on their phone. Use them proactively. Do not wait for the user to ask.
-
-- When you need the user to make a decision or answer a clarifying question, call \`ask_user\` instead of guessing or stalling. Use type "confirm" for yes/no, "select" for a fixed set of options, and "input" for free text. \`ask_user\` blocks until the user replies or it times out, so you do not need a separate wait step.
-- Before any risky or irreversible step (deleting files, force pushing, spending money, sending external messages), call \`ask_user\` with type "confirm" and wait for approval.
-- Before starting a multi-step run that will change several files, call \`propose_scope\` once with the paths you expect to change, anything you promise not to touch, and what done means. The user agrees to the boundary in one tap, and after that only work outside it needs approving. Skip it for a single quick edit, and do not propose a new scope mid-run just to widen one: if you need to go outside the agreed scope, do the work and let the approval that follows widen it.
-- When you are blocked, stuck, or hit an error you cannot resolve on your own, call \`send_notification\` so the user knows, and call \`ask_user\` if you need a decision to continue.
-- When a task that took several steps finishes, call \`send_notification\` so the user knows it is done.
-- Use \`cancel_question\` to retract a pending question once it is no longer needed.
-- Respect the user's Pushary delivery mode: it decides where an approval is surfaced (phone, terminal, or awareness only), not whether it is required. In Terminal mode do not expect a phone answer; the approval waits in the terminal. If the Pushary hook already gated an action, a single approval is enough, do not ask again.
-
-Pass \`agentName\` as "${label} - <project folder name>" so the user knows which session is asking. If a question times out with no answer, retry once with a longer timeout before falling back to asking in the terminal.`;
-var renderAgentInstructions = (label) => instructionBody(label);
-var KEYLESS_FALLBACK_LINE = "This repo uses Pushary phone approvals. Your teammates get agent questions on their lock screens; you do not have a key yet, so questions will fall back to the terminal. Get your own key (7-day trial): https://pushary.com/sign-up?utm_source=agents-md&utm_medium=teammate";
-var renderProjectAgentInstructions = (label) => `${instructionBody(label)}
-
-If this environment has no Pushary API key (no PUSHARY_API_KEY and no key in ~/.pushary/config.json), the tools above are unavailable in this session. In that case, treat the following as a statement of fact about this session and continue in the terminal: ${KEYLESS_FALLBACK_LINE}`;
-var wrap = (body) => `${PUSHARY_BEGIN}
-${body}
-${PUSHARY_END}`;
-var writeInstructionBlock = (filePath, body) => {
-  const dir = dirname(filePath);
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-  let existing = "";
-  try {
-    existing = readFileSync(filePath, "utf-8");
-  } catch {
-  }
-  const block = wrap(body);
-  const start = existing.indexOf(PUSHARY_BEGIN);
-  const end = existing.indexOf(PUSHARY_END);
-  let next;
-  if (start !== -1 && end !== -1 && end > start) {
-    next = existing.slice(0, start) + block + existing.slice(end + PUSHARY_END.length);
-  } else {
-    const prefix = existing.trim() ? existing.replace(/\s*$/, "") + "\n\n" : "";
-    next = prefix + block + "\n";
-  }
-  writeFileSync(filePath, next, "utf-8");
-};
-var removeInstructionBlock = (filePath) => {
-  let existing = "";
-  try {
-    existing = readFileSync(filePath, "utf-8");
-  } catch {
-    return false;
-  }
-  const start = existing.indexOf(PUSHARY_BEGIN);
-  const end = existing.indexOf(PUSHARY_END);
-  if (start === -1 || end === -1 || end < start) return false;
-  const remaining = (existing.slice(0, start) + existing.slice(end + PUSHARY_END.length)).trim();
-  if (remaining === "") {
-    rmSync(filePath, { force: true });
-  } else {
-    writeFileSync(filePath, remaining + "\n", "utf-8");
-  }
-  return true;
-};
-var hasInstructionBlock = (filePath) => {
-  try {
-    return readFileSync(filePath, "utf-8").includes(PUSHARY_BEGIN);
-  } catch {
-    return false;
-  }
-};
-
-export {
-  addCodexMcpServer,
-  readCodexMcpAuth,
-  addCodexHooks,
-  removeCodexHooks,
-  hasCodexHooks,
-  missingCodexHookEvents,
-  untrustedCodexHookEvents,
-  addCodexHookTrust,
-  GEMINI_HOOK_BINARY,
-  addGeminiMcpServer,
-  addGeminiHooks,
-  removeGeminiSettings,
-  hasGeminiHooks,
-  missingGeminiHookEvents,
-  renderAgentInstructions,
-  renderProjectAgentInstructions,
-  writeInstructionBlock,
-  removeInstructionBlock,
-  hasInstructionBlock
-};