@pushary/agent-hooks 0.61.0 → 0.62.1

package/dist/chunk-ER657KRJ.js

@@ -0,0 +1,168 @@
+import {
+  HOOK_BUDGETS
+} from "./chunk-DQAN3JQP.js";
+
+// src/codex-config.ts
+import { createHash } from "crypto";
+import { homedir } from "os";
+import { join } from "path";
+var CODEX_HOOK_BINARY = "pushary-codex-hook";
+var codexHome = () => codexHomeFrom(homedir());
+var codexHomeFrom = (home) => process.env.CODEX_HOME?.trim() || join(home, ".codex");
+var codexConfigToml = () => join(codexHome(), "config.toml");
+var codexHooksJson = () => join(codexHome(), "hooks.json");
+var codexAgentsMd = () => join(codexHome(), "AGENTS.md");
+var codexSkillDir = () => join(codexHome(), "skills", "pushary");
+var CODEX_HOOK_EVENTS = [
+  { event: "PermissionRequest", matcher: "Bash|apply_patch", timeout: HOOK_BUDGETS.codex.budgetSeconds, statusMessage: "Waiting for your phone" },
+  { event: "PreToolUse", matcher: "Bash|apply_patch", timeout: HOOK_BUDGETS.codex.budgetSeconds, statusMessage: "Checking Pushary policy" },
+  { event: "PostToolUse", matcher: "Bash|apply_patch", timeout: 10 },
+  { event: "UserPromptSubmit", timeout: 10 },
+  { event: "Stop", timeout: 10 },
+  { event: "SessionStart", matcher: "startup|resume", timeout: 10 }
+];
+var CODEX_EVENT_KEY = {
+  PermissionRequest: "permission_request",
+  PreToolUse: "pre_tool_use",
+  PostToolUse: "post_tool_use",
+  UserPromptSubmit: "user_prompt_submit",
+  Stop: "stop",
+  SessionStart: "session_start"
+};
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var ensureRecord = (target, key) => {
+  const existing = asRecord(target[key]);
+  if (existing) return existing;
+  const created = {};
+  target[key] = created;
+  return created;
+};
+var CODEX_MCP_URL = "https://pushary.com/api/mcp/mcp";
+var addCodexMcpServer = (config, apiKey) => {
+  const servers = ensureRecord(config, "mcp_servers");
+  const pushary = ensureRecord(servers, "pushary");
+  pushary.url = CODEX_MCP_URL;
+  ensureRecord(pushary, "http_headers").Authorization = `Bearer ${apiKey}`;
+  pushary.default_tools_approval_mode = "approve";
+  delete pushary.bearer_token_env_var;
+  delete pushary.tools;
+};
+var readCodexMcpAuth = (config) => {
+  const pushary = asRecord(asRecord(config.mcp_servers)?.pushary);
+  if (!pushary) return void 0;
+  const authorization = asRecord(pushary.http_headers)?.Authorization;
+  if (typeof authorization === "string" && authorization.startsWith("Bearer ")) {
+    return { method: "embedded", key: authorization.slice("Bearer ".length).trim() };
+  }
+  if (typeof pushary.bearer_token_env_var === "string") {
+    return { method: "env", envVar: pushary.bearer_token_env_var };
+  }
+  if (typeof pushary.bearer_token === "string") return { method: "legacy-bearer" };
+  return void 0;
+};
+var isPusharyCodexHook = (entry) => {
+  const hooks = asRecord(entry)?.hooks;
+  if (!Array.isArray(hooks)) return false;
+  return hooks.some((hook) => String(asRecord(hook)?.command ?? "").includes(CODEX_HOOK_BINARY));
+};
+var addCodexHooks = (config, command) => {
+  const hooks = ensureRecord(config, "hooks");
+  for (const definition of CODEX_HOOK_EVENTS) {
+    const existing = Array.isArray(hooks[definition.event]) ? hooks[definition.event] : [];
+    const entries = existing.filter((entry) => !isPusharyCodexHook(entry));
+    entries.push({
+      ...definition.matcher ? { matcher: definition.matcher } : {},
+      hooks: [{
+        type: "command",
+        command,
+        timeout: definition.timeout,
+        ...definition.statusMessage ? { statusMessage: definition.statusMessage } : {}
+      }]
+    });
+    hooks[definition.event] = entries;
+  }
+};
+var removeCodexHooks = (config) => {
+  const hooks = asRecord(config.hooks);
+  if (!hooks) return false;
+  let changed = false;
+  for (const definition of CODEX_HOOK_EVENTS) {
+    const entries = hooks[definition.event];
+    if (!Array.isArray(entries)) continue;
+    const filtered = entries.filter((entry) => !isPusharyCodexHook(entry));
+    if (filtered.length !== entries.length) {
+      if (filtered.length === 0) {
+        delete hooks[definition.event];
+      } else {
+        hooks[definition.event] = filtered;
+      }
+      changed = true;
+    }
+  }
+  if (Object.keys(hooks).length === 0) delete config.hooks;
+  return changed;
+};
+var hasCodexHooks = (config) => {
+  const hooks = asRecord(config.hooks);
+  if (!hooks) return false;
+  return CODEX_HOOK_EVENTS.some((definition) => {
+    const entries = hooks[definition.event];
+    return Array.isArray(entries) && entries.some(isPusharyCodexHook);
+  });
+};
+var missingCodexHookEvents = (config) => {
+  const hooks = asRecord(config.hooks);
+  return CODEX_HOOK_EVENTS.filter((definition) => {
+    const entries = hooks?.[definition.event];
+    return !Array.isArray(entries) || !entries.some(isPusharyCodexHook);
+  }).map((definition) => definition.event);
+};
+var canonicalJson = (value) => {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return "[" + value.map(canonicalJson).join(",") + "]";
+  const obj = value;
+  return "{" + Object.keys(obj).sort().map((key) => JSON.stringify(key) + ":" + canonicalJson(obj[key])).join(",") + "}";
+};
+var codexHookTrustHash = (definition, command) => {
+  const hook = { async: false, command, timeout: definition.timeout, type: "command" };
+  if (definition.statusMessage) hook.statusMessage = definition.statusMessage;
+  const identity = { event_name: CODEX_EVENT_KEY[definition.event], hooks: [hook] };
+  if (definition.matcher) identity.matcher = definition.matcher;
+  return "sha256:" + createHash("sha256").update(canonicalJson(identity), "utf8").digest("hex");
+};
+var codexHookStateKey = (hooksJsonPath, event) => `${hooksJsonPath}:${CODEX_EVENT_KEY[event]}:0:0`;
+var untrustedCodexHookEvents = (config, hooksJsonPath, command) => {
+  const state = asRecord(asRecord(config.hooks)?.state);
+  return CODEX_HOOK_EVENTS.filter((definition) => {
+    const entry = asRecord(state?.[codexHookStateKey(hooksJsonPath, definition.event)]);
+    const stored = entry?.trusted_hash;
+    return stored !== codexHookTrustHash(definition, command);
+  }).map((definition) => definition.event);
+};
+var addCodexHookTrust = (config, hooksJsonPath, command) => {
+  const hooks = ensureRecord(config, "hooks");
+  const state = ensureRecord(hooks, "state");
+  for (const definition of CODEX_HOOK_EVENTS) {
+    const key = codexHookStateKey(hooksJsonPath, definition.event);
+    const existing = asRecord(state[key]) ?? {};
+    state[key] = { ...existing, trusted_hash: codexHookTrustHash(definition, command) };
+  }
+};
+
+export {
+  CODEX_HOOK_BINARY,
+  codexHome,
+  codexHomeFrom,
+  codexConfigToml,
+  codexHooksJson,
+  codexAgentsMd,
+  codexSkillDir,
+  addCodexMcpServer,
+  readCodexMcpAuth,
+  addCodexHooks,
+  removeCodexHooks,
+  hasCodexHooks,
+  missingCodexHookEvents,
+  untrustedCodexHookEvents,
+  addCodexHookTrust
+};

package/dist/{chunk-HUJQSP4F.js → chunk-IIZZYUWK.js}

@@ -2,7 +2,7 @@ import {
   EXIT,
   getPackageVersion,
   renderCommandHelp
-} from "./chunk-SML23YOT.js";
+} from "./chunk-SP7OZXCQ.js";
 
 // src/cli/usage.ts
 var exitOnHelpFlag = (command) => {

package/dist/chunk-N7XJ4L2W.js

@@ -0,0 +1,79 @@
+// src/instruction-file.ts
+import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "fs";
+import { dirname } from "path";
+var PUSHARY_BEGIN = "<!-- BEGIN PUSHARY (managed by @pushary/agent-hooks; do not edit this block) -->";
+var PUSHARY_END = "<!-- END PUSHARY -->";
+var instructionBody = (label) => `## Pushary notifications and approvals
+
+You have Pushary MCP tools that reach the user on their phone. Use them proactively. Do not wait for the user to ask.
+
+- When you need the user to make a decision or answer a clarifying question, call \`ask_user\` instead of guessing or stalling. Use type "confirm" for yes/no, "select" for a fixed set of options, and "input" for free text. \`ask_user\` blocks until the user replies or it times out, so you do not need a separate wait step.
+- Before any risky or irreversible step (deleting files, force pushing, spending money, sending external messages), call \`ask_user\` with type "confirm" and wait for approval.
+- Before starting a multi-step run that will change several files, call \`propose_scope\` once with the paths you expect to change, anything you promise not to touch, and what done means. The user agrees to the boundary in one tap, and after that only work outside it needs approving. Skip it for a single quick edit, and do not propose a new scope mid-run just to widen one: if you need to go outside the agreed scope, do the work and let the approval that follows widen it.
+- When you are blocked, stuck, or hit an error you cannot resolve on your own, call \`send_notification\` so the user knows, and call \`ask_user\` if you need a decision to continue.
+- When a task that took several steps finishes, call \`send_notification\` so the user knows it is done.
+- Use \`cancel_question\` to retract a pending question once it is no longer needed.
+- Respect the user's Pushary delivery mode: it decides where an approval is surfaced (phone, terminal, or awareness only), not whether it is required. In Terminal mode do not expect a phone answer; the approval waits in the terminal. If the Pushary hook already gated an action, a single approval is enough, do not ask again.
+
+Pass \`agentName\` as "${label} - <project folder name>" so the user knows which session is asking. If a question times out with no answer, retry once with a longer timeout before falling back to asking in the terminal.`;
+var renderAgentInstructions = (label) => instructionBody(label);
+var KEYLESS_FALLBACK_LINE = "This repo uses Pushary phone approvals. Your teammates get agent questions on their lock screens; you do not have a key yet, so questions will fall back to the terminal. Get your own key (7-day trial): https://pushary.com/sign-up?utm_source=agents-md&utm_medium=teammate";
+var renderProjectAgentInstructions = (label) => `${instructionBody(label)}
+
+If this environment has no Pushary API key (no PUSHARY_API_KEY and no key in ~/.pushary/config.json), the tools above are unavailable in this session. In that case, treat the following as a statement of fact about this session and continue in the terminal: ${KEYLESS_FALLBACK_LINE}`;
+var wrap = (body) => `${PUSHARY_BEGIN}
+${body}
+${PUSHARY_END}`;
+var writeInstructionBlock = (filePath, body) => {
+  const dir = dirname(filePath);
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  let existing = "";
+  try {
+    existing = readFileSync(filePath, "utf-8");
+  } catch {
+  }
+  const block = wrap(body);
+  const start = existing.indexOf(PUSHARY_BEGIN);
+  const end = existing.indexOf(PUSHARY_END);
+  let next;
+  if (start !== -1 && end !== -1 && end > start) {
+    next = existing.slice(0, start) + block + existing.slice(end + PUSHARY_END.length);
+  } else {
+    const prefix = existing.trim() ? existing.replace(/\s*$/, "") + "\n\n" : "";
+    next = prefix + block + "\n";
+  }
+  writeFileSync(filePath, next, "utf-8");
+};
+var removeInstructionBlock = (filePath) => {
+  let existing = "";
+  try {
+    existing = readFileSync(filePath, "utf-8");
+  } catch {
+    return false;
+  }
+  const start = existing.indexOf(PUSHARY_BEGIN);
+  const end = existing.indexOf(PUSHARY_END);
+  if (start === -1 || end === -1 || end < start) return false;
+  const remaining = (existing.slice(0, start) + existing.slice(end + PUSHARY_END.length)).trim();
+  if (remaining === "") {
+    rmSync(filePath, { force: true });
+  } else {
+    writeFileSync(filePath, remaining + "\n", "utf-8");
+  }
+  return true;
+};
+var hasInstructionBlock = (filePath) => {
+  try {
+    return readFileSync(filePath, "utf-8").includes(PUSHARY_BEGIN);
+  } catch {
+    return false;
+  }
+};
+
+export {
+  renderAgentInstructions,
+  renderProjectAgentInstructions,
+  writeInstructionBlock,
+  removeInstructionBlock,
+  hasInstructionBlock
+};

package/dist/{chunk-R6C4USIV.js → chunk-ONVEYEVR.js}

@@ -1,13 +1,13 @@
 import {
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-UKNAAVEE.js";
+} from "./chunk-YJ7YZRVV.js";
 import {
   createIo
 } from "./chunk-TX7KBKT7.js";
 import {
   EXIT
-} from "./chunk-SML23YOT.js";
+} from "./chunk-SP7OZXCQ.js";
 
 // src/cli/report-key.ts
 var { dim, yellow } = createIo();

package/dist/{chunk-SML23YOT.js → chunk-SP7OZXCQ.js}

@@ -65,7 +65,10 @@ var COMMANDS = COMMAND_LIST;
 var findCommand = (name) => COMMANDS.find((command) => command.name === name);
 var isCommandName = (name) => COMMANDS.some((command) => command.name === name);
 var COMMAND_OPTIONS = {
-  clean: [["--yes", "Remove everything without asking"]],
+  clean: [
+    ["--dry-run", "List everything it would remove and change nothing"],
+    ["--yes", "Remove everything without asking"]
+  ],
   mode: [
     ["<mode>", "One of: push_only, push_first, terminal_only, notify_only"],
     ["status", "Show the current override"],
@@ -78,10 +81,15 @@ var COMMAND_OPTIONS = {
     ["clear", "Reset the default window"]
   ],
   status: [["--json", "Emit the whole report as one object instead of the screen"]],
+  logout: [
+    ["--revoke", "Also kill the key server-side, so it stops working everywhere"],
+    ["--json", "Emit the result as one object instead of the screen"]
+  ],
   doctor: [
     ["--json", "Emit every check as one object instead of the screen"],
     ["--roundtrip", "Also send a real question and wait for you to answer it on your phone"],
-    ["--no-push", "Run every check without waking a device"]
+    ["--no-push", "Run every check without waking a device"],
+    ["--bundle", "Write a redacted diagnostics file you can attach to a support thread"]
   ],
   suggestions: [["accept <id>", "Turn a mined suggestion into an always-allow rule"]],
   claude: [

package/dist/chunk-UXXRRXUS.js

@@ -0,0 +1,93 @@
+import {
+  codexHomeFrom
+} from "./chunk-ER657KRJ.js";
+
+// src/setup/detect.ts
+import { execSync } from "child_process";
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var whichCommand = () => process.platform === "win32" ? "where" : "which";
+var binaryOnPath = (binary) => {
+  try {
+    execSync(`${whichCommand()} ${binary}`, { stdio: "ignore", timeout: 5e3 });
+    return true;
+  } catch {
+    return false;
+  }
+};
+var defaultDeps = { onPath: binaryOnPath, exists: existsSync };
+var detectAgent = (probe, deps = defaultDeps) => {
+  const checked = [];
+  if (probe.binary) {
+    checked.push(`${whichCommand()} ${probe.binary}`);
+    if (deps.onPath(probe.binary)) {
+      return { kind: "installed", evidence: `${probe.binary} on PATH`, strong: true };
+    }
+  }
+  for (const path of probe.paths) {
+    checked.push(path);
+    if (deps.exists(path)) return { kind: "installed", evidence: path, strong: true };
+  }
+  for (const marker of probe.configMarkers) {
+    checked.push(marker);
+    if (deps.exists(marker)) return { kind: "installed", evidence: marker, strong: false };
+  }
+  if (probe.binary === null && probe.paths.length === 0 && probe.configMarkers.length === 0) {
+    return { kind: "unknown" };
+  }
+  return { kind: "not-found", checked };
+};
+var agentProbes = (home = homedir()) => ({
+  claude_code: {
+    binary: "claude",
+    // The native installer puts it here, outside a default non-login PATH.
+    paths: [join(home, ".local", "bin", "claude")],
+    configMarkers: [join(home, ".claude")]
+  },
+  codex: {
+    binary: "codex",
+    paths: [],
+    configMarkers: [codexHomeFrom(home)]
+  },
+  gemini_cli: {
+    binary: "gemini",
+    paths: [],
+    configMarkers: [join(home, ".gemini")]
+  },
+  hermes: {
+    binary: "hermes",
+    paths: [],
+    configMarkers: [join(home, ".hermes")]
+  },
+  cursor: {
+    // GUI editor. `cursor` on PATH only exists if the user ran "Install 'cursor'
+    // command in PATH" from the command palette, which most never do.
+    binary: "cursor",
+    paths: process.platform === "darwin" ? ["/Applications/Cursor.app"] : process.platform === "win32" ? [join(process.env.LOCALAPPDATA ?? join(home, "AppData", "Local"), "Programs", "cursor")] : ["/usr/share/cursor", join(home, ".local", "share", "cursor")],
+    configMarkers: [join(home, ".cursor")]
+  },
+  // "Other" is a set of printed instructions for any MCP or HTTP client. There is
+  // nothing to detect, and it must never be auto-selected.
+  custom: { binary: null, paths: [], configMarkers: [] }
+});
+var detectAllAgents = (deps = defaultDeps, home) => {
+  const probes = agentProbes(home);
+  return Object.keys(probes).map((agent) => ({
+    agent,
+    result: detectAgent(probes[agent], deps)
+  }));
+};
+var isDetected = (result) => result.kind === "installed";
+var shortenHome = (path, home = homedir()) => home && path.startsWith(home) ? `~${path.slice(home.length)}` : path;
+var describeDetection = (result, home) => {
+  if (result.kind !== "installed") return null;
+  const evidence = shortenHome(result.evidence, home);
+  return result.strong ? evidence : `${evidence}, config only`;
+};
+
+export {
+  detectAllAgents,
+  isDetected,
+  describeDetection
+};

package/dist/{chunk-UKNAAVEE.js → chunk-YJ7YZRVV.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-7QLSKOSU.js";
 import {
   EXIT
-} from "./chunk-SML23YOT.js";
+} from "./chunk-SP7OZXCQ.js";
 import {
   isValidApiKey
 } from "./chunk-DQAN3JQP.js";

package/dist/src/index.js

@@ -1,6 +1,6 @@
 import {
   handlePreToolUse
-} from "../chunk-HI4AGGE6.js";
+} from "../chunk-5SO3CEGJ.js";
 import "../chunk-CAJZAFVS.js";
 import "../chunk-YHG74UFF.js";
 import {
@@ -15,11 +15,11 @@ import {
   reportEvent,
   resolvePolicy,
   waitForAnswer
-} from "../chunk-VFBYRR2N.js";
-import "../chunk-RN3NOEJF.js";
+} from "../chunk-HIIBSYFJ.js";
 import "../chunk-WLGEY4UX.js";
 import "../chunk-HNTKTK5B.js";
 import "../chunk-DQAN3JQP.js";
+import "../chunk-RN3NOEJF.js";
 import {
   getApiKey,
   getBaseUrl

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.61.0",
+  "version": "0.62.1",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",