@pushary/agent-hooks 0.84.0 → 0.85.0

package/dist/{chunk-YJCMI5GF.js → chunk-ERYKGH4J.js}

@@ -5,7 +5,7 @@ import {
   generateSessionKey,
   uploadTranscriptRecords,
   wrapSessionKey
-} from "./chunk-NWYGW7HY.js";
+} from "./chunk-GCKAWHFP.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;
@@ -72,8 +72,10 @@ var LiveTranscriptRelay = class {
   sessionKey = null;
   wrappedKey = null;
   keyUploaded = false;
+  keyRejected = false;
   flushing = null;
   add(value) {
+    if (this.keyRejected) return;
     const raw = JSON.stringify(value);
     if (raw.length > MAX_TRANSCRIPT_TEXT) return;
     if (this.queue.length === MAX_TRANSCRIPT_QUEUE) this.queue.shift();
@@ -106,14 +108,19 @@ var LiveTranscriptRelay = class {
         this.queue.splice(0, count);
         return true;
       }
-      const uploaded = await uploadTranscriptRecords(this.options.apiKey, {
+      const result = await uploadTranscriptRecords(this.options.apiKey, {
         sessionId: this.sessionId,
         machineId: this.options.machineId,
         dataEncryptionKey: this.keyUploaded ? void 0 : this.wrappedKey ?? void 0,
         records
       }, this.options.baseUrl);
-      if (uploaded) {
-        this.keyUploaded = true;
+      if (result.keyConflict) {
+        this.keyRejected = true;
+        this.queue.length = 0;
+        return false;
+      }
+      if (result.ok) {
+        this.keyUploaded ||= result.keyRegistered;
         this.queue.splice(0, count);
         return true;
       }

package/dist/{chunk-OPMSMF5R.js → chunk-EXMUM226.js}

@@ -60,7 +60,7 @@ var CACHE_TTL_MS = 60 * 1e3;
 var STALE_CACHE_MAX_MS = 12 * 60 * 60 * 1e3;
 var policyRequestFor = (agentType) => ({
   agent: agentType,
-  repoAware: agentType === "claude_code"
+  repoAware: ["claude_code", "codex", "gemini_cli"].includes(agentType)
 });
 var policyCacheFile = (apiKey, agent, repoAware = false) => {
   const parts = [apiKey, agent, repoAware ? "repoAware" : void 0].filter(Boolean);
@@ -196,9 +196,10 @@ var readLastGoodMode = (apiKey) => {
     return null;
   }
 };
-var writeLastGoodMode = (apiKey, state) => {
+var writeLastGoodMode = (apiKey, state, sessionId) => {
   try {
-    writeFileSync(modeStateCacheFile(apiKey), JSON.stringify({ state, at: Date.now() }), { encoding: "utf-8", mode: 384 });
+    const cached = { state, at: Date.now(), ...sessionId ? { sessionId } : {} };
+    writeFileSync(modeStateCacheFile(apiKey), JSON.stringify(cached), { encoding: "utf-8", mode: 384 });
   } catch {
   }
 };
@@ -220,7 +221,18 @@ var degradedFallback = (apiKey, authoritative = false) => {
   return unknownMode();
 };
 var toPolicyVersion = (value) => typeof value === "string" || typeof value === "number" ? String(value) : null;
-var fetchModeState = async (apiKey, sessionId) => {
+var MODE_REUSE_MS = CACHE_TTL_MS;
+var readReusableMode = (apiKey, sessionId, maxAgeMs) => {
+  const last = readLastGoodMode(apiKey);
+  if (!last || (last.sessionId ?? null) !== (sessionId ?? null)) return null;
+  if (Date.now() - last.at >= maxAgeMs) return null;
+  return { ...last.state, degraded: false };
+};
+var fetchModeState = async (apiKey, sessionId, reuseWithinMs = 0) => {
+  if (reuseWithinMs > 0) {
+    const reusable = readReusableMode(apiKey, sessionId, reuseWithinMs);
+    if (reusable) return reusable;
+  }
   try {
     const baseUrl = getBaseUrl();
     const url = sessionId ? `${baseUrl}/api/mcp/mode?session=${encodeURIComponent(sessionId)}` : `${baseUrl}/api/mcp/mode`;
@@ -244,7 +256,7 @@ var fetchModeState = async (apiKey, sessionId) => {
       scope: isScopeContract(data.scope) ? data.scope : null,
       degraded: false
     };
-    writeLastGoodMode(apiKey, state);
+    writeLastGoodMode(apiKey, state, sessionId);
     return state;
   } catch {
     return degradedFallback(apiKey);
@@ -1053,7 +1065,7 @@ var handlePostToolUse = async (input, agent = CLAUDE_CODE_AGENT) => {
     const isError = isToolResultError(toolResult);
     const receiptsEnabled = process.env.PUSHARY_RECEIPTS !== "off";
     const sessionKey = input.session_id || DEFAULT_SESSION;
-    const liveMode = await fetchModeState(getApiKey(), input.session_id);
+    const liveMode = await fetchModeState(getApiKey(), input.session_id, MODE_REUSE_MS);
     const late = await reconcilePendingQuestions(sessionKey);
     let additionalContext;
     if (late.length > 0 && agent.type === CLAUDE_CODE_AGENT.type) {
@@ -1239,7 +1251,7 @@ var handleNotification = async (input, agent = CLAUDE_CODE_AGENT) => {
       } catch {
         return;
       }
-      const mode = await fetchModeState(apiKey, input.session_id).catch(() => null);
+      const mode = await fetchModeState(apiKey, input.session_id, MODE_REUSE_MS).catch(() => null);
       if (mode?.kill || mode?.mode === "terminal_only") return;
       await sendNotification(apiKey, {
         title: `${agent.label} is waiting`,
@@ -1302,7 +1314,7 @@ var handleStopFailure = async (input, agent = CLAUDE_CODE_AGENT) => {
       return;
     }
     const projectName = basename2(input.cwd ?? process.cwd());
-    const mode = await fetchModeState(apiKey, input.session_id).catch(() => null);
+    const mode = await fetchModeState(apiKey, input.session_id, MODE_REUSE_MS).catch(() => null);
     if (mode?.kill || mode?.mode === "terminal_only") return;
     const reason = describeStopFailure(input.error);
     await sendNotification(apiKey, {
@@ -1318,6 +1330,7 @@ var handleStopFailure = async (input, agent = CLAUDE_CODE_AGENT) => {
 };
 
 export {
+  policyRequestFor,
   getPolicy,
   resolveAutoResolveOrigin,
   resolvePolicy,

package/dist/{chunk-NWYGW7HY.js → chunk-GCKAWHFP.js}

@@ -101,9 +101,16 @@ var uploadTranscriptRecords = async (apiKey, params, baseUrl = getBaseUrl()) =>
       body: JSON.stringify(params),
       signal: AbortSignal.timeout(15e3)
     });
-    return res.ok;
+    const body = await res.json().catch(() => null);
+    const keyRegistered = body?.keyRegistered === true;
+    const keyConflict = body?.keyConflict === true;
+    return {
+      ok: res.ok && !keyConflict && (params.dataEncryptionKey === void 0 || keyRegistered),
+      keyRegistered,
+      keyConflict
+    };
   } catch {
-    return false;
+    return { ok: false, keyRegistered: false, keyConflict: false };
   }
 };
 

package/dist/{chunk-QNBA5OXQ.js → chunk-GFM3STWO.js}

@@ -1,6 +1,6 @@
 import {
   PRETOOLUSE_HANDLED_TOOLS
-} from "./chunk-UKSQWTBH.js";
+} from "./chunk-64PXDATC.js";
 import {
   isGatingMoment,
   recordKeylessMoment
@@ -9,7 +9,7 @@ import {
   denyReasonFrom,
   isDeferAnswer,
   resolveGate
-} from "./chunk-37AD5K7W.js";
+} from "./chunk-GXIFADGD.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -29,7 +29,7 @@ import {
   sendNotification,
   throttlePass,
   waitForAnswer
-} from "./chunk-OPMSMF5R.js";
+} from "./chunk-EXMUM226.js";
 import {
   getMachineId
 } from "./chunk-RN3NOEJF.js";

package/dist/{chunk-MGJBC6DD.js → chunk-GOEXZ5QJ.js}

@@ -53,6 +53,7 @@ var COMMAND_LIST = [
     ]
   },
   { name: "doctor", module: "pushary-doctor", summary: "Verify your Pushary installation is working" },
+  { name: "disconnect", module: "pushary-disconnect", summary: "Turn off one agent (claude|codex|gemini|cursor)" },
   { name: "clean", module: "pushary-clean", summary: "Remove all Pushary configuration (--yes for non-interactive)" },
   { name: "mode", module: "pushary-mode", summary: "Switch approval mode (push_only, push_first, terminal_only)" },
   { name: "wait", module: "pushary-wait", summary: 'Show or set the "wait for your phone" ladder (pushary wait 45)' },

package/dist/{chunk-37AD5K7W.js → chunk-GXIFADGD.js}

@@ -2,7 +2,7 @@ import {
   isModeStateDegraded,
   resolveAutoResolveOrigin,
   resolvePolicyAcross
-} from "./chunk-OPMSMF5R.js";
+} from "./chunk-EXMUM226.js";
 import {
   evaluateScope,
   scopeChangeReason,

package/dist/{chunk-SEAHGHCE.js → chunk-HVZIHTOO.js}

@@ -139,6 +139,38 @@ var untrustedCodexHookEvents = (config, hooksJsonPath, command) => {
     return stored !== codexHookTrustHash(definition, command);
   }).map((definition) => definition.event);
 };
+var removeCodexMcpServer = (config) => {
+  const servers = asRecord(config.mcp_servers);
+  if (!servers?.pushary) return false;
+  delete servers.pushary;
+  if (Object.keys(servers).length === 0) delete config.mcp_servers;
+  return true;
+};
+var removeCodexHookTrust = (config, hooksJsonPath) => {
+  const state = asRecord(asRecord(config.hooks)?.state);
+  if (!state) return false;
+  let changed = false;
+  for (const definition of CODEX_HOOK_EVENTS) {
+    const key = codexHookStateKey(hooksJsonPath, definition.event);
+    if (key in state) {
+      delete state[key];
+      changed = true;
+    }
+  }
+  if (changed && Object.keys(state).length === 0) {
+    const hooks = asRecord(config.hooks);
+    if (hooks) {
+      delete hooks.state;
+      if (Object.keys(hooks).length === 0) delete config.hooks;
+    }
+  }
+  return changed;
+};
+var removeCodexSettings = (config, hooksJsonPath) => {
+  const mcp = removeCodexMcpServer(config);
+  const trust = removeCodexHookTrust(config, hooksJsonPath);
+  return mcp || trust;
+};
 var addCodexHookTrust = (config, hooksJsonPath, command) => {
   const hooks = ensureRecord(config, "hooks");
   const state = ensureRecord(hooks, "state");
@@ -183,6 +215,7 @@ export {
   hasCodexHooks,
   missingCodexHookEvents,
   untrustedCodexHookEvents,
+  removeCodexSettings,
   addCodexHookTrust,
   claudeSettings,
   claudeJson,

package/dist/chunk-PWTKKQQI.js

@@ -0,0 +1,27 @@
+import {
+  quoteIfNeeded
+} from "./chunk-VT4IVERX.js";
+
+// src/hook-command.ts
+var SHELL = "/bin/sh -c";
+var LOCATE = 'B=$(command -v "$0") || exit 0; [ -f "$B" ] || exit 0; [ -x "$B" ] || exit 0';
+var NODE_PRESENT = "command -v node >/dev/null 2>&1 || exit 0";
+var RESOLVE = {
+  native: `${LOCATE}; exec "$B"`,
+  node: `${LOCATE}; ${NODE_PRESENT}; exec "$B"`
+};
+var guardHookCommand = (target, platform = process.platform) => {
+  if (target.kind === "node") {
+    const script = quoteIfNeeded(target.script);
+    return platform === "win32" ? `node ${script}` : `${SHELL} '[ -f "$0" ] || exit 0; command -v node >/dev/null 2>&1 || exit 0; exec node "$0"' ${script}`;
+  }
+  const path = quoteIfNeeded(target.path);
+  return platform === "win32" ? path : `${SHELL} '${RESOLVE[target.runtime]}' ${path}`;
+};
+var guardBinary = (path, platform) => guardHookCommand({ kind: "binary", path, runtime: "node" }, platform);
+var guardNodeScript = (script, platform) => guardHookCommand({ kind: "node", script }, platform);
+
+export {
+  guardBinary,
+  guardNodeScript
+};

package/dist/{chunk-J4KFVOCQ.js → chunk-SQOFGPNX.js}

@@ -1,6 +1,6 @@
 import {
   renderCommandHelp
-} from "./chunk-MGJBC6DD.js";
+} from "./chunk-GOEXZ5QJ.js";
 import {
   getPackageVersion
 } from "./chunk-DINDL2CF.js";

package/dist/{chunk-CCH775Y6.js → chunk-WEAQQSHQ.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VT4IVERX.js";
 import {
   pusharyDir
-} from "./chunk-SEAHGHCE.js";
+} from "./chunk-HVZIHTOO.js";
 import {
   getMachineId
 } from "./chunk-RN3NOEJF.js";

package/dist/{chunk-EVJ6ULHN.js → chunk-YKW6JCWI.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-SEAHGHCE.js";
+} from "./chunk-HVZIHTOO.js";
 import {
   readJsonSafe
 } from "./chunk-6MTNS63X.js";
@@ -91,7 +91,11 @@ var startProcessOwnership = (identity, options = {}) => {
         proof = { ...identity, port: address.port, token };
         mkdirSync(dir, { recursive: true, mode: 448 });
         pruneProofs(dir);
-        writeFileSync(path, JSON.stringify(proof), { encoding: "utf8", mode: 384 });
+        writeFileSync(path, JSON.stringify(proof), {
+          encoding: "utf8",
+          mode: 384,
+          flag: options.exclusive ? "wx" : "w"
+        });
         resolve();
       } catch {
         server.close();
@@ -113,41 +117,76 @@ var startProcessOwnership = (identity, options = {}) => {
     }
   };
 };
+var withSpawnProcessOwnership = async (spawnId, run, options = {}) => {
+  if (!spawnId) return run();
+  const sessionId = `spawn:${spawnId}`;
+  const ownership = startProcessOwnership({
+    sessionId,
+    pid: process.pid,
+    spawnId
+  }, { ...options, exclusive: true });
+  await ownership.ready;
+  if (!await ownsLiveProcess({ sessionId, pid: process.pid, spawnId }, options)) {
+    ownership.stop();
+    throw new Error("Could not establish spawned process ownership");
+  }
+  try {
+    return await run();
+  } finally {
+    ownership.stop();
+  }
+};
 var ownsLiveProcess = async (request, options = {}) => {
   const stored = readJsonSafe(proofPath(ownershipDir(options), request.sessionId));
   if (stored.kind !== "ok" || !isProof(stored.value)) return false;
   const proof = stored.value;
   if (proof.sessionId !== request.sessionId || proof.pid !== request.pid) return false;
   if (request.spawnId && proof.spawnId !== request.spawnId) return false;
-  return new Promise((resolve) => {
-    let settled = false;
-    let raw = "";
-    const socket = createConnection({ host: "127.0.0.1", port: proof.port });
-    const finish = (owned) => {
-      if (settled) return;
-      settled = true;
-      socket.destroy();
-      resolve(owned);
-    };
-    socket.setTimeout(options.connectTimeoutMs ?? 500, () => finish(false));
-    socket.on("error", () => finish(false));
-    socket.on("connect", () => socket.write(proof.token));
-    socket.on("data", (chunk) => {
-      raw += String(chunk);
-      if (raw.length > MAX_PROOF_BYTES) finish(false);
-    });
-    socket.on("end", () => {
-      try {
-        const live = JSON.parse(raw);
-        finish(isProof(live) && live.token === proof.token && live.sessionId === proof.sessionId && live.pid === proof.pid && live.spawnId === proof.spawnId);
-      } catch {
-        finish(false);
-      }
-    });
-  });
+  return verifyProof(proof, options);
 };
+var findLiveProcessBySpawnId = async (spawnId, options = {}) => {
+  try {
+    const dir = ownershipDir(options);
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
+      const stored = readJsonSafe(join(dir, entry.name));
+      if (stored.kind !== "ok" || !isProof(stored.value) || stored.value.spawnId !== spawnId) continue;
+      if (await verifyProof(stored.value, options)) return stored.value.pid;
+    }
+  } catch {
+  }
+  return null;
+};
+var verifyProof = (proof, options) => new Promise((resolve) => {
+  let settled = false;
+  let raw = "";
+  const socket = createConnection({ host: "127.0.0.1", port: proof.port });
+  const finish = (owned) => {
+    if (settled) return;
+    settled = true;
+    socket.destroy();
+    resolve(owned);
+  };
+  socket.setTimeout(options.connectTimeoutMs ?? 500, () => finish(false));
+  socket.on("error", () => finish(false));
+  socket.on("connect", () => socket.write(proof.token));
+  socket.on("data", (chunk) => {
+    raw += String(chunk);
+    if (raw.length > MAX_PROOF_BYTES) finish(false);
+  });
+  socket.on("end", () => {
+    try {
+      const live = JSON.parse(raw);
+      finish(isProof(live) && live.token === proof.token && live.sessionId === proof.sessionId && live.pid === proof.pid && live.spawnId === proof.spawnId);
+    } catch {
+      finish(false);
+    }
+  });
+});
 
 export {
   startProcessOwnership,
-  ownsLiveProcess
+  withSpawnProcessOwnership,
+  ownsLiveProcess,
+  findLiveProcessBySpawnId
 };

package/dist/src/index.d.ts

@@ -39,7 +39,7 @@ interface ModeState {
     readonly scope?: ScopeContract | null;
     readonly degraded?: boolean;
 }
-declare const fetchModeState: (apiKey: string, sessionId?: string) => Promise<ModeState>;
+declare const fetchModeState: (apiKey: string, sessionId?: string, reuseWithinMs?: number) => Promise<ModeState>;
 declare const fetchModeOverride: (apiKey: string) => Promise<ApprovalMode | null>;
 
 interface UsageReport {

package/dist/src/index.js

@@ -1,9 +1,11 @@
 import {
   handlePreToolUse
-} from "../chunk-QNBA5OXQ.js";
-import "../chunk-UKSQWTBH.js";
+} from "../chunk-GFM3STWO.js";
+import "../chunk-64PXDATC.js";
+import "../chunk-PWTKKQQI.js";
+import "../chunk-VT4IVERX.js";
 import "../chunk-NJ7JT26G.js";
-import "../chunk-37AD5K7W.js";
+import "../chunk-GXIFADGD.js";
 import {
   askUser,
   cancelQuestion,
@@ -16,7 +18,7 @@ import {
   reportEvent,
   resolvePolicy,
   waitForAnswer
-} from "../chunk-OPMSMF5R.js";
+} from "../chunk-EXMUM226.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.84.0",
+  "version": "0.85.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",
@@ -68,7 +68,8 @@
     "pushary-suggestions": "./dist/bin/pushary-suggestions.js",
     "pushary-upgrade": "./dist/bin/pushary-upgrade.js",
     "pushary-bell": "./dist/bin/pushary-bell.js",
-    "pushary-bell-hook": "./dist/bin/pushary-bell-hook.js"
+    "pushary-bell-hook": "./dist/bin/pushary-bell-hook.js",
+    "pushary-disconnect": "./dist/bin/pushary-disconnect.js"
   },
   "files": [
     "dist",

package/dist/chunk-UKSQWTBH.js

@@ -1,208 +0,0 @@
-import {
-  HOOK_BUDGETS
-} from "./chunk-MQMPG5X4.js";
-
-// src/claude-config.ts
-import { join } from "path";
-var PUSHARY_MCP_URL = "https://pushary.com/api/mcp/mcp";
-var PUSHARY_PERMISSION_RULE = "mcp__pushary__*";
-var PRETOOLUSE_GATED_TOOLS = ["Bash", "Write", "Edit", "MultiEdit", "NotebookEdit", "PowerShell", "Monitor"];
-var PRETOOLUSE_HANDLED_TOOLS = /* @__PURE__ */ new Set([...PRETOOLUSE_GATED_TOOLS, "AskUserQuestion"]);
-var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-var ensureRecord = (target, key) => {
-  const existing = asRecord(target[key]);
-  if (existing) return existing;
-  const created = {};
-  target[key] = created;
-  return created;
-};
-var isPusharyPermission = (rule) => typeof rule === "string" && (rule.includes("pushary") || rule.includes("MCP(pushary"));
-var isPusharyHook = (entry) => {
-  const hooks = asRecord(entry)?.hooks;
-  if (!Array.isArray(hooks)) return false;
-  return hooks.some((hook) => {
-    const command = String(asRecord(hook)?.command ?? "");
-    return command.includes("pushary-hook") || command.includes("pushary-post-hook") || command.includes("pushary-stop-hook") || command.includes("pushary-prompt-hook") || command.includes("pushary-notification-hook") || command.includes("pushary-session-start-hook") || command.includes("pushary-session-end-hook") || command.includes("pushary-stopfailure-hook") || command.includes("pushary-permission-hook") || command.includes("pushary-permission-denied-hook");
-  });
-};
-var addClaudeMcpServer = (config, apiKey) => {
-  const mcpServers = ensureRecord(config, "mcpServers");
-  mcpServers.pushary = {
-    type: "http",
-    url: PUSHARY_MCP_URL,
-    headers: { Authorization: `Bearer ${apiKey}` }
-  };
-};
-var removeClaudeMcpServers = (config) => {
-  let changed = false;
-  const removeFrom = (target) => {
-    const mcpServers = asRecord(target.mcpServers);
-    if (!mcpServers?.pushary) return;
-    delete mcpServers.pushary;
-    if (Object.keys(mcpServers).length === 0) delete target.mcpServers;
-    changed = true;
-  };
-  removeFrom(config);
-  const projects = asRecord(config.projects);
-  if (projects) {
-    for (const project of Object.values(projects)) {
-      const projectConfig = asRecord(project);
-      if (projectConfig) removeFrom(projectConfig);
-    }
-  }
-  return changed;
-};
-var addPusharyToolPermissions = (settings) => {
-  const permissions = ensureRecord(settings, "permissions");
-  const allow = Array.isArray(permissions.allow) ? permissions.allow : [];
-  const filtered = allow.filter((rule) => !isPusharyPermission(rule));
-  if (!filtered.includes(PUSHARY_PERMISSION_RULE)) {
-    filtered.push(PUSHARY_PERMISSION_RULE);
-  }
-  permissions.allow = filtered;
-};
-var addPusharyHooks = (settings, binDir) => {
-  const resolve = (name) => {
-    const path = binDir ? join(binDir, name) : name;
-    return /\s/.test(path) ? `"${path}"` : path;
-  };
-  const hooks = ensureRecord(settings, "hooks");
-  const SHELL_AND_FILE_TOOLS = PRETOOLUSE_GATED_TOOLS.join("|");
-  const preToolUse = (Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : []).filter((entry) => !isPusharyHook(entry));
-  preToolUse.push({
-    matcher: `${SHELL_AND_FILE_TOOLS}|AskUserQuestion`,
-    hooks: [{
-      type: "command",
-      command: resolve("pushary-hook"),
-      timeout: HOOK_BUDGETS.claude.budgetSeconds
-    }]
-  });
-  hooks.PreToolUse = preToolUse;
-  const postToolUse = (Array.isArray(hooks.PostToolUse) ? hooks.PostToolUse : []).filter((entry) => !isPusharyHook(entry));
-  postToolUse.push({
-    matcher: `${SHELL_AND_FILE_TOOLS}|TodoWrite`,
-    hooks: [{
-      type: "command",
-      command: resolve("pushary-post-hook"),
-      timeout: 10
-    }]
-  });
-  hooks.PostToolUse = postToolUse;
-  const stop = (Array.isArray(hooks.Stop) ? hooks.Stop : []).filter((entry) => !isPusharyHook(entry));
-  stop.push({
-    hooks: [{
-      type: "command",
-      command: resolve("pushary-stop-hook"),
-      timeout: 10
-    }]
-  });
-  hooks.Stop = stop;
-  const userPromptSubmit = (Array.isArray(hooks.UserPromptSubmit) ? hooks.UserPromptSubmit : []).filter((entry) => !isPusharyHook(entry));
-  userPromptSubmit.push({
-    hooks: [{
-      type: "command",
-      command: resolve("pushary-prompt-hook"),
-      timeout: 10
-    }]
-  });
-  hooks.UserPromptSubmit = userPromptSubmit;
-  const notification = (Array.isArray(hooks.Notification) ? hooks.Notification : []).filter((entry) => !isPusharyHook(entry));
-  notification.push({
-    matcher: "permission_prompt|idle_prompt|agent_needs_input|agent_completed",
-    hooks: [{
-      type: "command",
-      command: resolve("pushary-notification-hook"),
-      timeout: 10
-    }]
-  });
-  hooks.Notification = notification;
-  const sessionStart = (Array.isArray(hooks.SessionStart) ? hooks.SessionStart : []).filter((entry) => !isPusharyHook(entry));
-  sessionStart.push({
-    matcher: "startup|resume|clear",
-    hooks: [{
-      type: "command",
-      command: resolve("pushary-session-start-hook"),
-      timeout: 10
-    }]
-  });
-  hooks.SessionStart = sessionStart;
-  const sessionEnd = (Array.isArray(hooks.SessionEnd) ? hooks.SessionEnd : []).filter((entry) => !isPusharyHook(entry));
-  sessionEnd.push({
-    hooks: [{
-      type: "command",
-      command: resolve("pushary-session-end-hook"),
-      timeout: 10
-    }]
-  });
-  hooks.SessionEnd = sessionEnd;
-  const stopFailure = (Array.isArray(hooks.StopFailure) ? hooks.StopFailure : []).filter((entry) => !isPusharyHook(entry));
-  stopFailure.push({
-    hooks: [{
-      type: "command",
-      command: resolve("pushary-stopfailure-hook"),
-      timeout: 10
-    }]
-  });
-  hooks.StopFailure = stopFailure;
-  const permissionRequest = (Array.isArray(hooks.PermissionRequest) ? hooks.PermissionRequest : []).filter((entry) => !isPusharyHook(entry));
-  permissionRequest.push({
-    hooks: [{
-      type: "command",
-      command: resolve("pushary-permission-hook"),
-      timeout: HOOK_BUDGETS.claude.budgetSeconds
-    }]
-  });
-  hooks.PermissionRequest = permissionRequest;
-  const permissionDenied = (Array.isArray(hooks.PermissionDenied) ? hooks.PermissionDenied : []).filter((entry) => !isPusharyHook(entry));
-  permissionDenied.push({
-    hooks: [{
-      type: "command",
-      command: resolve("pushary-permission-denied-hook"),
-      timeout: 60
-    }]
-  });
-  hooks.PermissionDenied = permissionDenied;
-};
-var removePusharySettings = (settings) => {
-  let changed = removeClaudeMcpServers(settings);
-  const permissions = asRecord(settings.permissions);
-  if (permissions && Array.isArray(permissions.allow)) {
-    const filtered = permissions.allow.filter((rule) => !isPusharyPermission(rule));
-    if (filtered.length !== permissions.allow.length) {
-      if (filtered.length === 0) {
-        delete permissions.allow;
-      } else {
-        permissions.allow = filtered;
-      }
-      if (Object.keys(permissions).length === 0) delete settings.permissions;
-      changed = true;
-    }
-  }
-  const hooks = asRecord(settings.hooks);
-  if (hooks) {
-    for (const key of ["PreToolUse", "PostToolUse", "Stop", "StopFailure", "UserPromptSubmit", "Notification", "SessionStart", "SessionEnd", "PermissionRequest", "PermissionDenied"]) {
-      const entries = hooks[key];
-      if (!Array.isArray(entries)) continue;
-      const filtered = entries.filter((entry) => !isPusharyHook(entry));
-      if (filtered.length !== entries.length) {
-        if (filtered.length === 0) {
-          delete hooks[key];
-        } else {
-          hooks[key] = filtered;
-        }
-        changed = true;
-      }
-    }
-    if (Object.keys(hooks).length === 0) delete settings.hooks;
-  }
-  return changed;
-};
-
-export {
-  PRETOOLUSE_HANDLED_TOOLS,
-  addClaudeMcpServer,
-  removeClaudeMcpServers,
-  addPusharyToolPermissions,
-  addPusharyHooks,
-  removePusharySettings
-};