@pushary/agent-hooks 0.61.0 → 0.62.0

package/dist/bin/pushary-upgrade.js

@@ -4,24 +4,47 @@ import {
   addPusharyHooks,
   addPusharyToolPermissions
 } from "../chunk-CAJZAFVS.js";
+import {
+  GEMINI_HOOK_BINARY,
+  addGeminiHooks,
+  addGeminiMcpServer,
+  hasGeminiHooks
+} from "../chunk-E2U35RLD.js";
+import {
+  CODEX_HOOK_BINARY,
+  addCodexHookTrust,
+  addCodexHooks,
+  addCodexMcpServer,
+  codexConfigToml,
+  codexHooksJson,
+  hasCodexHooks
+} from "../chunk-ER657KRJ.js";
 import {
   execNpm,
   npmErrorMessage,
-  resolveGlobalBinDir
+  quoteIfNeeded,
+  resolveGlobalBinDir,
+  resolveGlobalBinary
 } from "../chunk-MUEW424A.js";
 import {
   exitOnHelpFlag
-} from "../chunk-HUJQSP4F.js";
-import "../chunk-SML23YOT.js";
+} from "../chunk-IIZZYUWK.js";
+import "../chunk-SP7OZXCQ.js";
 import "../chunk-DQAN3JQP.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
 
+// bin/pushary-upgrade.ts
+import { existsSync as existsSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+
 // src/reapply.ts
 import { join, dirname } from "path";
 import { homedir } from "os";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { parse as parseTOML, stringify as stringifyTOML } from "smol-toml";
 var CLAUDE_SETTINGS = join(homedir(), ".claude", "settings.json");
 var CLAUDE_JSON = join(homedir(), ".claude.json");
 var readJson = (filePath) => {
@@ -66,9 +89,130 @@ var reapplyClaudeSettings = (apiKey, paths = {}) => {
   }
   return { reapplied: hooks || mcp, hooks, mcp };
 };
+var readToml = (filePath) => {
+  try {
+    const raw = readFileSync(filePath, "utf-8");
+    return raw.trim() === "" ? {} : parseTOML(raw);
+  } catch {
+    return null;
+  }
+};
+var reapplyCodexSettings = (apiKey, paths = {}) => {
+  const configPath = paths.configPath ?? codexConfigToml();
+  const hooksPath = paths.hooksPath ?? codexHooksJson();
+  const config = readToml(configPath);
+  const hooksConfig = readJson(hooksPath);
+  const configured = config != null && !!config.mcp_servers?.pushary || hooksConfig != null && hasCodexHooks(hooksConfig);
+  if (!configured) return { reapplied: false, hooks: false, mcp: false };
+  const command = quoteIfNeeded(resolveGlobalBinary(CODEX_HOOK_BINARY) ?? CODEX_HOOK_BINARY);
+  let hooks = false;
+  let mcp = false;
+  if (hooksConfig != null) {
+    try {
+      addCodexHooks(hooksConfig, command);
+      writeJson(hooksPath, hooksConfig);
+      hooks = true;
+    } catch {
+    }
+  }
+  if (config != null) {
+    try {
+      if (hooks) addCodexHookTrust(config, hooksPath, command);
+      if (apiKey) {
+        addCodexMcpServer(config, apiKey);
+        mcp = true;
+      }
+      if (hooks || apiKey) writeFileSync(configPath, stringifyTOML(config), "utf-8");
+    } catch {
+    }
+  }
+  return { reapplied: hooks || mcp, hooks, mcp };
+};
+var reapplyGeminiSettings = (apiKey, paths = {}) => {
+  const settingsPath = paths.settingsPath ?? join(homedir(), ".gemini", "settings.json");
+  const settings = readJson(settingsPath);
+  if (settings == null) return { reapplied: false, hooks: false, mcp: false };
+  const configured = hasGeminiHooks(settings) || !!settings.mcpServers?.pushary;
+  if (!configured) return { reapplied: false, hooks: false, mcp: false };
+  let hooks = false;
+  let mcp = false;
+  try {
+    addGeminiHooks(settings, quoteIfNeeded(resolveGlobalBinary(GEMINI_HOOK_BINARY) ?? GEMINI_HOOK_BINARY));
+    hooks = true;
+    if (apiKey) {
+      addGeminiMcpServer(settings, apiKey);
+      mcp = true;
+    }
+    writeJson(settingsPath, settings);
+  } catch {
+  }
+  return { reapplied: hooks || mcp, hooks, mcp };
+};
+var reapplyCursorPlugin = (apiKey, paths = {}) => {
+  const mcpPath = paths.pluginMcpPath ?? join(homedir(), ".cursor", "plugins", "local", "pushary", "mcp.json");
+  if (!apiKey) return { reapplied: false, hooks: false, mcp: false };
+  const mcpConfig = readJson(mcpPath);
+  if (mcpConfig == null) return { reapplied: false, hooks: false, mcp: false };
+  const servers = mcpConfig.mcpServers;
+  if (!servers?.pushary) return { reapplied: false, hooks: false, mcp: false };
+  try {
+    addClaudeMcpServer(mcpConfig, apiKey);
+    writeJson(mcpPath, mcpConfig);
+    return { reapplied: true, hooks: false, mcp: true };
+  } catch {
+    return { reapplied: false, hooks: false, mcp: false };
+  }
+};
+var reapplyAllAgents = (apiKey) => {
+  const runners = [
+    { label: "Claude Code", run: () => reapplyClaudeSettings(apiKey) },
+    { label: "Codex", run: () => reapplyCodexSettings(apiKey) },
+    { label: "Gemini CLI", run: () => reapplyGeminiSettings(apiKey) },
+    { label: "Cursor", run: () => reapplyCursorPlugin(apiKey) }
+  ];
+  const done = [];
+  for (const runner of runners) {
+    try {
+      const result = runner.run();
+      if (result.reapplied) done.push({ label: runner.label, result });
+    } catch {
+    }
+  }
+  return done;
+};
 
 // bin/pushary-upgrade.ts
 exitOnHelpFlag("upgrade");
+var detectInstallModes = () => {
+  const candidates = [
+    {
+      label: "Cursor plugin",
+      upgrade: "updates itself through Cursor",
+      present: existsSync2(join2(homedir2(), ".cursor", "plugins", "local", "pushary"))
+    },
+    {
+      label: "Codex config",
+      upgrade: "npx @pushary/agent-hooks@latest setup --agents codex",
+      present: existsSync2(codexConfigToml())
+    },
+    {
+      label: "Claude Code config",
+      upgrade: "npx @pushary/agent-hooks@latest setup --agents claude_code",
+      present: existsSync2(join2(homedir2(), ".claude.json"))
+    },
+    {
+      label: "Gemini config",
+      upgrade: "npx @pushary/agent-hooks@latest setup --agents gemini_cli",
+      present: existsSync2(join2(homedir2(), ".gemini", "settings.json"))
+    },
+    {
+      label: "Hermes plugin (pip)",
+      upgrade: "pip install --upgrade pushary-hermes",
+      present: existsSync2(join2(homedir2(), ".hermes"))
+    }
+  ];
+  return candidates.filter((candidate) => candidate.present).map(({ label, upgrade }) => ({ label, upgrade }));
+};
 var getInstalledVersion = () => {
   try {
     return execNpm("list -g --no-workspaces @pushary/agent-hooks --depth=0", { timeout: 1e4 }).toString().match(/@pushary\/agent-hooks@([\d.]+)/)?.[1] ?? "";
@@ -100,8 +244,20 @@ var isNewer = (a, b) => {
 var main = async () => {
   const installed = getInstalledVersion();
   if (!installed) {
-    console.log("No global install of @pushary/agent-hooks found, so there is nothing to upgrade.");
-    console.log("Plugin installs update on their own. To set up the CLI hooks: npx @pushary/agent-hooks@latest setup");
+    const found = detectInstallModes();
+    console.log("No global install of @pushary/agent-hooks found, so there is nothing to upgrade here.");
+    console.log();
+    if (found.length === 0) {
+      console.log("Nothing on this machine looks Pushary-configured either.");
+      console.log("  Set it up with:  npx @pushary/agent-hooks@latest setup");
+    } else {
+      console.log("What this machine does have:");
+      for (const mode of found) {
+        console.log(`  ${mode.label.padEnd(22)} ${mode.upgrade}`);
+      }
+    }
+    console.log();
+    console.log("Check the result with: pushary doctor");
     return;
   }
   const latest = await fetchLatestVersion();
@@ -122,14 +278,23 @@ var main = async () => {
   } catch {
     apiKey = void 0;
   }
-  try {
-    const result = reapplyClaudeSettings(apiKey);
-    if (result.reapplied) {
-      console.log("Refreshed Claude Code hooks and settings so the new hook set is active now.");
+  const refreshed = reapplyAllAgents(apiKey);
+  console.log();
+  if (refreshed.length > 0) {
+    console.log("Refreshed so the new hook set is active now:");
+    for (const agent of refreshed) {
+      const parts = [agent.result.hooks ? "hooks" : null, agent.result.mcp ? "MCP key" : null].filter(Boolean).join(" + ");
+      console.log(`  ${agent.label.padEnd(14)} ${parts}`);
     }
-  } catch {
+    if (!apiKey) {
+      console.log();
+      console.log("No key was readable here, so MCP entries kept the key they already had.");
+    }
+  } else {
+    console.log("No agent config on this machine needed refreshing.");
   }
-  console.log("Done. Your hooks point at the global install and settings were refreshed.");
+  console.log();
+  console.log("Done. Your hooks point at the global install.");
   console.log("Verify with: pushary doctor");
 };
 main();

package/dist/bin/pushary-wait.js

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
 import {
   exitOnFailedResponse
-} from "../chunk-R6C4USIV.js";
+} from "../chunk-ONVEYEVR.js";
 import {
   describeWaitLadder
 } from "../chunk-IIENZE2J.js";
-import "../chunk-UKNAAVEE.js";
+import "../chunk-YJ7YZRVV.js";
 import {
   createIo
 } from "../chunk-TX7KBKT7.js";
 import "../chunk-7QLSKOSU.js";
 import {
   exitOnHelpFlag
-} from "../chunk-HUJQSP4F.js";
+} from "../chunk-IIZZYUWK.js";
 import {
   EXIT
-} from "../chunk-SML23YOT.js";
+} from "../chunk-SP7OZXCQ.js";
 import "../chunk-DQAN3JQP.js";
 import {
   getApiKey,

package/dist/bin/pushary.js

@@ -5,7 +5,7 @@ import {
   getPackageVersion,
   isCommandName,
   renderHelp
-} from "../chunk-SML23YOT.js";
+} from "../chunk-SP7OZXCQ.js";
 
 // bin/pushary.ts
 var LOADERS = {

package/dist/{chunk-B26DNXCA.js → chunk-247C4RE5.js}

@@ -229,6 +229,7 @@ export {
   writeJsonAtomic,
   KEY_FILE_MODE,
   exportLine,
+  keyPrefix,
   writeKey,
   clearKey,
   readKeySource

package/dist/{chunk-GX64YGU3.js → chunk-3O27ZSRE.js}

@@ -155,6 +155,7 @@ var cyan = (s) => `\x1B[36m${s}\x1B[0m`;
 var yellow = (s) => `\x1B[33m${s}\x1B[0m`;
 var check = green("\u2713");
 var apiBase = () => process.env.PUSHARY_API_URL?.trim() || process.env.PUSHARY_BASE_URL?.trim() || "https://pushary.com";
+var EXIT_ABORTED = 130;
 var CONNECT_POLL_INTERVAL_MS = 2500;
 var CONNECT_TIMEOUT_MS = 18e4;
 var EMPTY_CHANNELS = {
@@ -463,6 +464,17 @@ var startPairing = async (cliPublicKey) => {
     return null;
   }
 };
+var cancelPairing = async (pairId) => {
+  try {
+    await fetch(`${apiBase()}/api/mobile/pair/start`, {
+      method: "DELETE",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ pairId }),
+      signal: AbortSignal.timeout(5e3)
+    });
+  } catch {
+  }
+};
 var claimPairing = async (pairId) => {
   try {
     const res = await fetch(`${apiBase()}/api/mobile/pair/claim?id=${encodeURIComponent(pairId)}`, {
@@ -504,8 +516,16 @@ var connectViaAppPairing = async () => {
     const left = Math.max(0, Math.ceil((deadline - Date.now()) / 1e3));
     return `Waiting for the app to authorize ${dim(`(${left}s)`)}`;
   });
+  let cancelled = false;
+  const onInterrupt = () => {
+    cancelled = true;
+    stop(yellow("!"), "Cancelled");
+    void cancelPairing(pairId).finally(() => process.exit(EXIT_ABORTED));
+  };
+  process.once("SIGINT", onInterrupt);
   try {
     while (Date.now() < deadline) {
+      if (cancelled) return null;
       const claim = await claimPairing(pairId);
       if (claim?.status === "authorized") {
         let apiKey;
@@ -513,6 +533,7 @@ var connectViaAppPairing = async () => {
           apiKey = openSealedKey(claim.sealed, keypair);
         } catch {
           stop(yellow("!"), "Pairing failed to decrypt \u2014 re-run setup to try again");
+          await cancelPairing(pairId);
           return null;
         }
         stop(check, "App connected");
@@ -525,10 +546,14 @@ var connectViaAppPairing = async () => {
       await sleep(PAIR_POLL_INTERVAL_MS);
     }
     stop(yellow("!"), "Timed out waiting for the app");
+    await cancelPairing(pairId);
     return null;
   } catch (err) {
     stop(yellow("!"), `Pairing error ${dim(`(${err instanceof Error ? err.message : "network"})`)}`);
+    await cancelPairing(pairId);
     return null;
+  } finally {
+    process.off("SIGINT", onInterrupt);
   }
 };
 

package/dist/{chunk-HI4AGGE6.js → chunk-5SO3CEGJ.js}

@@ -25,10 +25,7 @@ import {
   sendNotification,
   throttlePass,
   waitForAnswer
-} from "./chunk-VFBYRR2N.js";
-import {
-  getMachineId
-} from "./chunk-RN3NOEJF.js";
+} from "./chunk-HIIBSYFJ.js";
 import {
   isGatingMoment,
   recordKeylessMoment
@@ -42,6 +39,9 @@ import {
   scopeChangeReason,
   scopeRequiresHuman
 } from "./chunk-DQAN3JQP.js";
+import {
+  getMachineId
+} from "./chunk-RN3NOEJF.js";
 import {
   getApiKey,
   getBaseUrl

package/dist/chunk-E2U35RLD.js

@@ -0,0 +1,108 @@
+import {
+  HOOK_BUDGETS
+} from "./chunk-DQAN3JQP.js";
+
+// src/gemini-config.ts
+var GEMINI_HOOK_BINARY = "pushary-gemini-hook";
+var GEMINI_MCP_URL = "https://pushary.com/api/mcp/mcp";
+var GEMINI_HOOK_EVENTS = [
+  { event: "BeforeTool", matcher: "run_shell_command|write_file|replace", timeoutMs: HOOK_BUDGETS.gemini.budgetSeconds * 1e3 },
+  { event: "AfterTool", matcher: "run_shell_command|write_file|replace", timeoutMs: 1e4 },
+  { event: "BeforeAgent", timeoutMs: 1e4 },
+  { event: "SessionStart", timeoutMs: 1e4 },
+  { event: "SessionEnd", timeoutMs: 1e4 }
+];
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var ensureRecord = (target, key) => {
+  const existing = asRecord(target[key]);
+  if (existing) return existing;
+  const created = {};
+  target[key] = created;
+  return created;
+};
+var isPusharyGeminiHook = (entry) => {
+  const hooks = asRecord(entry)?.hooks;
+  if (!Array.isArray(hooks)) return false;
+  return hooks.some((hook) => String(asRecord(hook)?.command ?? "").includes(GEMINI_HOOK_BINARY));
+};
+var addGeminiMcpServer = (settings, apiKey) => {
+  const mcpServers = ensureRecord(settings, "mcpServers");
+  mcpServers.pushary = {
+    httpUrl: GEMINI_MCP_URL,
+    headers: { Authorization: `Bearer ${apiKey}` },
+    trust: true
+  };
+};
+var addGeminiHooks = (settings, command) => {
+  const hooks = ensureRecord(settings, "hooks");
+  for (const definition of GEMINI_HOOK_EVENTS) {
+    const existing = Array.isArray(hooks[definition.event]) ? hooks[definition.event] : [];
+    const entries = existing.filter((entry) => !isPusharyGeminiHook(entry));
+    entries.push({
+      ...definition.matcher ? { matcher: definition.matcher } : {},
+      hooks: [{
+        name: "pushary",
+        type: "command",
+        command,
+        timeout: definition.timeoutMs
+      }]
+    });
+    hooks[definition.event] = entries;
+  }
+};
+var removeGeminiHooks = (settings) => {
+  const hooks = asRecord(settings.hooks);
+  if (!hooks) return false;
+  let changed = false;
+  for (const definition of GEMINI_HOOK_EVENTS) {
+    const entries = hooks[definition.event];
+    if (!Array.isArray(entries)) continue;
+    const filtered = entries.filter((entry) => !isPusharyGeminiHook(entry));
+    if (filtered.length !== entries.length) {
+      if (filtered.length === 0) {
+        delete hooks[definition.event];
+      } else {
+        hooks[definition.event] = filtered;
+      }
+      changed = true;
+    }
+  }
+  if (Object.keys(hooks).length === 0) delete settings.hooks;
+  return changed;
+};
+var removeGeminiMcpServer = (settings) => {
+  const mcpServers = asRecord(settings.mcpServers);
+  if (!mcpServers?.pushary) return false;
+  delete mcpServers.pushary;
+  if (Object.keys(mcpServers).length === 0) delete settings.mcpServers;
+  return true;
+};
+var removeGeminiSettings = (settings) => {
+  const mcpRemoved = removeGeminiMcpServer(settings);
+  const hooksRemoved = removeGeminiHooks(settings);
+  return mcpRemoved || hooksRemoved;
+};
+var hasGeminiHooks = (settings) => {
+  const hooks = asRecord(settings.hooks);
+  if (!hooks) return false;
+  return GEMINI_HOOK_EVENTS.some((definition) => {
+    const entries = hooks[definition.event];
+    return Array.isArray(entries) && entries.some(isPusharyGeminiHook);
+  });
+};
+var missingGeminiHookEvents = (settings) => {
+  const hooks = asRecord(settings.hooks);
+  return GEMINI_HOOK_EVENTS.filter((definition) => {
+    const entries = hooks?.[definition.event];
+    return !Array.isArray(entries) || !entries.some(isPusharyGeminiHook);
+  }).map((definition) => definition.event);
+};
+
+export {
+  GEMINI_HOOK_BINARY,
+  addGeminiMcpServer,
+  addGeminiHooks,
+  removeGeminiSettings,
+  hasGeminiHooks,
+  missingGeminiHookEvents
+};

package/dist/chunk-ER657KRJ.js

@@ -0,0 +1,168 @@
+import {
+  HOOK_BUDGETS
+} from "./chunk-DQAN3JQP.js";
+
+// src/codex-config.ts
+import { createHash } from "crypto";
+import { homedir } from "os";
+import { join } from "path";
+var CODEX_HOOK_BINARY = "pushary-codex-hook";
+var codexHome = () => codexHomeFrom(homedir());
+var codexHomeFrom = (home) => process.env.CODEX_HOME?.trim() || join(home, ".codex");
+var codexConfigToml = () => join(codexHome(), "config.toml");
+var codexHooksJson = () => join(codexHome(), "hooks.json");
+var codexAgentsMd = () => join(codexHome(), "AGENTS.md");
+var codexSkillDir = () => join(codexHome(), "skills", "pushary");
+var CODEX_HOOK_EVENTS = [
+  { event: "PermissionRequest", matcher: "Bash|apply_patch", timeout: HOOK_BUDGETS.codex.budgetSeconds, statusMessage: "Waiting for your phone" },
+  { event: "PreToolUse", matcher: "Bash|apply_patch", timeout: HOOK_BUDGETS.codex.budgetSeconds, statusMessage: "Checking Pushary policy" },
+  { event: "PostToolUse", matcher: "Bash|apply_patch", timeout: 10 },
+  { event: "UserPromptSubmit", timeout: 10 },
+  { event: "Stop", timeout: 10 },
+  { event: "SessionStart", matcher: "startup|resume", timeout: 10 }
+];
+var CODEX_EVENT_KEY = {
+  PermissionRequest: "permission_request",
+  PreToolUse: "pre_tool_use",
+  PostToolUse: "post_tool_use",
+  UserPromptSubmit: "user_prompt_submit",
+  Stop: "stop",
+  SessionStart: "session_start"
+};
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var ensureRecord = (target, key) => {
+  const existing = asRecord(target[key]);
+  if (existing) return existing;
+  const created = {};
+  target[key] = created;
+  return created;
+};
+var CODEX_MCP_URL = "https://pushary.com/api/mcp/mcp";
+var addCodexMcpServer = (config, apiKey) => {
+  const servers = ensureRecord(config, "mcp_servers");
+  const pushary = ensureRecord(servers, "pushary");
+  pushary.url = CODEX_MCP_URL;
+  ensureRecord(pushary, "http_headers").Authorization = `Bearer ${apiKey}`;
+  pushary.default_tools_approval_mode = "approve";
+  delete pushary.bearer_token_env_var;
+  delete pushary.tools;
+};
+var readCodexMcpAuth = (config) => {
+  const pushary = asRecord(asRecord(config.mcp_servers)?.pushary);
+  if (!pushary) return void 0;
+  const authorization = asRecord(pushary.http_headers)?.Authorization;
+  if (typeof authorization === "string" && authorization.startsWith("Bearer ")) {
+    return { method: "embedded", key: authorization.slice("Bearer ".length).trim() };
+  }
+  if (typeof pushary.bearer_token_env_var === "string") {
+    return { method: "env", envVar: pushary.bearer_token_env_var };
+  }
+  if (typeof pushary.bearer_token === "string") return { method: "legacy-bearer" };
+  return void 0;
+};
+var isPusharyCodexHook = (entry) => {
+  const hooks = asRecord(entry)?.hooks;
+  if (!Array.isArray(hooks)) return false;
+  return hooks.some((hook) => String(asRecord(hook)?.command ?? "").includes(CODEX_HOOK_BINARY));
+};
+var addCodexHooks = (config, command) => {
+  const hooks = ensureRecord(config, "hooks");
+  for (const definition of CODEX_HOOK_EVENTS) {
+    const existing = Array.isArray(hooks[definition.event]) ? hooks[definition.event] : [];
+    const entries = existing.filter((entry) => !isPusharyCodexHook(entry));
+    entries.push({
+      ...definition.matcher ? { matcher: definition.matcher } : {},
+      hooks: [{
+        type: "command",
+        command,
+        timeout: definition.timeout,
+        ...definition.statusMessage ? { statusMessage: definition.statusMessage } : {}
+      }]
+    });
+    hooks[definition.event] = entries;
+  }
+};
+var removeCodexHooks = (config) => {
+  const hooks = asRecord(config.hooks);
+  if (!hooks) return false;
+  let changed = false;
+  for (const definition of CODEX_HOOK_EVENTS) {
+    const entries = hooks[definition.event];
+    if (!Array.isArray(entries)) continue;
+    const filtered = entries.filter((entry) => !isPusharyCodexHook(entry));
+    if (filtered.length !== entries.length) {
+      if (filtered.length === 0) {
+        delete hooks[definition.event];
+      } else {
+        hooks[definition.event] = filtered;
+      }
+      changed = true;
+    }
+  }
+  if (Object.keys(hooks).length === 0) delete config.hooks;
+  return changed;
+};
+var hasCodexHooks = (config) => {
+  const hooks = asRecord(config.hooks);
+  if (!hooks) return false;
+  return CODEX_HOOK_EVENTS.some((definition) => {
+    const entries = hooks[definition.event];
+    return Array.isArray(entries) && entries.some(isPusharyCodexHook);
+  });
+};
+var missingCodexHookEvents = (config) => {
+  const hooks = asRecord(config.hooks);
+  return CODEX_HOOK_EVENTS.filter((definition) => {
+    const entries = hooks?.[definition.event];
+    return !Array.isArray(entries) || !entries.some(isPusharyCodexHook);
+  }).map((definition) => definition.event);
+};
+var canonicalJson = (value) => {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return "[" + value.map(canonicalJson).join(",") + "]";
+  const obj = value;
+  return "{" + Object.keys(obj).sort().map((key) => JSON.stringify(key) + ":" + canonicalJson(obj[key])).join(",") + "}";
+};
+var codexHookTrustHash = (definition, command) => {
+  const hook = { async: false, command, timeout: definition.timeout, type: "command" };
+  if (definition.statusMessage) hook.statusMessage = definition.statusMessage;
+  const identity = { event_name: CODEX_EVENT_KEY[definition.event], hooks: [hook] };
+  if (definition.matcher) identity.matcher = definition.matcher;
+  return "sha256:" + createHash("sha256").update(canonicalJson(identity), "utf8").digest("hex");
+};
+var codexHookStateKey = (hooksJsonPath, event) => `${hooksJsonPath}:${CODEX_EVENT_KEY[event]}:0:0`;
+var untrustedCodexHookEvents = (config, hooksJsonPath, command) => {
+  const state = asRecord(asRecord(config.hooks)?.state);
+  return CODEX_HOOK_EVENTS.filter((definition) => {
+    const entry = asRecord(state?.[codexHookStateKey(hooksJsonPath, definition.event)]);
+    const stored = entry?.trusted_hash;
+    return stored !== codexHookTrustHash(definition, command);
+  }).map((definition) => definition.event);
+};
+var addCodexHookTrust = (config, hooksJsonPath, command) => {
+  const hooks = ensureRecord(config, "hooks");
+  const state = ensureRecord(hooks, "state");
+  for (const definition of CODEX_HOOK_EVENTS) {
+    const key = codexHookStateKey(hooksJsonPath, definition.event);
+    const existing = asRecord(state[key]) ?? {};
+    state[key] = { ...existing, trusted_hash: codexHookTrustHash(definition, command) };
+  }
+};
+
+export {
+  CODEX_HOOK_BINARY,
+  codexHome,
+  codexHomeFrom,
+  codexConfigToml,
+  codexHooksJson,
+  codexAgentsMd,
+  codexSkillDir,
+  addCodexMcpServer,
+  readCodexMcpAuth,
+  addCodexHooks,
+  removeCodexHooks,
+  hasCodexHooks,
+  missingCodexHookEvents,
+  untrustedCodexHookEvents,
+  addCodexHookTrust
+};

package/dist/{chunk-HUJQSP4F.js → chunk-IIZZYUWK.js}

@@ -2,7 +2,7 @@ import {
   EXIT,
   getPackageVersion,
   renderCommandHelp
-} from "./chunk-SML23YOT.js";
+} from "./chunk-SP7OZXCQ.js";
 
 // src/cli/usage.ts
 var exitOnHelpFlag = (command) => {