@pushary/agent-hooks 0.87.2 → 0.87.4

package/dist/bin/pushary-codex-hook.js

@@ -2,7 +2,7 @@
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-7MBDFNUC.js";
+} from "../chunk-VIHRP25S.js";
 import {
   readHookInput
 } from "../chunk-6CUUA7HO.js";
@@ -10,19 +10,19 @@ import {
   denyReasonFrom,
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
+import {
+  canonicalJson
+} from "../chunk-GIRT7677.js";
 import {
   CODEX_AGENT,
   codexAllow,
   codexDeny,
   codexPass,
-  deriveActionBody,
-  deriveBlocker,
-  deriveToolTarget,
   describeApplyPatch,
-  describeToolCall,
   fetchModeState,
   getPolicy,
   handlePostToolUse,
+  handleSessionEnd,
   handleStop,
   handleUserPrompt,
   permissionTimeoutDecision,
@@ -31,11 +31,10 @@ import {
   readLastPrompt,
   repoKeyFor,
   reportEvent,
-  scopePathFor,
   toCodexWire,
   toPolicyLookup,
   toPolicyLookups
-} from "../chunk-V2XPF77V.js";
+} from "../chunk-VOE4SYPR.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -44,12 +43,19 @@ import {
   savePendingQuestion,
   sendNotification
 } from "../chunk-J3YDT4HM.js";
+import {
+  deriveActionBody,
+  deriveBlocker,
+  deriveToolTarget,
+  describeToolCall,
+  scopePathFor
+} from "../chunk-7J67NYK4.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-Y3UTTFTZ.js";
+import "../chunk-KBS53WOE.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
 import {
@@ -62,57 +68,107 @@ import {
   hookWaitClamped,
   hookWaitDeadline,
   resolveGate
-} from "../chunk-7YJS2VTG.js";
+} from "../chunk-DMW54VWK.js";
 
 // bin/pushary-codex-hook.ts
-import { basename, join } from "path";
+import { basename } from "path";
+
+// src/codex-call-decision.ts
+import { createHash } from "crypto";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "fs";
 import { tmpdir, userInfo } from "os";
-import { existsSync, mkdirSync, statSync, unlinkSync, writeFileSync } from "fs";
-var START_MS = Date.now();
-var APPROVAL_TTL_MS = 10 * 60 * 1e3;
-var sanitizeId = (value) => value.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 128);
+import { join } from "path";
+var CODEX_DECISION_TTL_MS = 60 * 1e3;
 var userScope = () => {
   try {
     const info = userInfo();
     const id = typeof info.uid === "number" && info.uid >= 0 ? String(info.uid) : info.username;
-    return sanitizeId(id) || "default";
+    return id.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 128) || "default";
   } catch {
     return "default";
   }
 };
-var APPROVAL_DIR = join(tmpdir(), `pushary-codex-approvals-${userScope()}`);
-var markApproved = (toolUseId) => {
-  if (!toolUseId) return;
+var decisionDir = () => join(tmpdir(), `pushary-codex-decisions-${userScope()}`);
+var decisionFile = (key) => join(decisionDir(), key);
+var PRESENTATION_ONLY_INPUT_KEYS = ["description"];
+var identifyingToolInput = (toolInput) => {
+  if (!toolInput) return {};
+  const identifying = {};
+  for (const [key, value] of Object.entries(toolInput)) {
+    if (PRESENTATION_ONLY_INPUT_KEYS.includes(key)) continue;
+    identifying[key] = value;
+  }
+  return identifying;
+};
+var codexCallKey = (identity) => {
+  if (!identity.sessionId || !identity.turnId || !identity.toolName) return null;
+  const material = canonicalJson([
+    identity.sessionId,
+    identity.turnId,
+    identity.toolName,
+    identifyingToolInput(identity.toolInput)
+  ]);
+  return createHash("sha256").update(material, "utf-8").digest("hex").slice(0, 32);
+};
+var parseDecision = (raw) => {
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed.kind === "approved") return { kind: "approved" };
+    if (parsed.kind === "handled") return { kind: "handled" };
+    if (parsed.kind === "denied") {
+      return { kind: "denied", reason: typeof parsed.reason === "string" ? parsed.reason : "" };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+};
+var sweepExpired = (dir, nowMs) => {
   try {
-    if (!existsSync(APPROVAL_DIR)) mkdirSync(APPROVAL_DIR, { recursive: true, mode: 448 });
-    writeFileSync(join(APPROVAL_DIR, sanitizeId(toolUseId)), "", { encoding: "utf-8", mode: 384 });
+    for (const name of readdirSync(dir)) {
+      const path = join(dir, name);
+      try {
+        if (nowMs - statSync(path).mtimeMs >= CODEX_DECISION_TTL_MS) rmSync(path, { force: true });
+      } catch {
+        continue;
+      }
+    }
   } catch {
+    return;
   }
 };
-var consumeApproval = (toolUseId) => {
-  if (!toolUseId) return false;
-  const path = join(APPROVAL_DIR, sanitizeId(toolUseId));
+var recordCodexCallDecision = (key, decision) => {
+  if (!key) return;
   try {
-    const fresh = Date.now() - statSync(path).mtimeMs < APPROVAL_TTL_MS;
-    unlinkSync(path);
-    return fresh;
+    const dir = decisionDir();
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 448 });
+    else sweepExpired(dir, Date.now());
+    writeFileSync(decisionFile(key), JSON.stringify(decision), { encoding: "utf-8", mode: 384 });
   } catch {
-    return false;
+    return;
   }
 };
-var NOTIFY_TTL_MS = 60 * 1e3;
-var claimNotify = (toolUseId) => {
-  if (!toolUseId) return true;
-  const path = join(APPROVAL_DIR, `notify-${sanitizeId(toolUseId)}`);
+var consumeCodexCallDecision = (key) => {
+  if (!key) return null;
+  const path = decisionFile(key);
   try {
-    if (existsSync(path) && Date.now() - statSync(path).mtimeMs < NOTIFY_TTL_MS) return false;
-    if (!existsSync(APPROVAL_DIR)) mkdirSync(APPROVAL_DIR, { recursive: true, mode: 448 });
-    writeFileSync(path, "", { encoding: "utf-8", mode: 384 });
-    return true;
+    const fresh = Date.now() - statSync(path).mtimeMs < CODEX_DECISION_TTL_MS;
+    const raw = readFileSync(path, "utf-8");
+    rmSync(path, { force: true });
+    return fresh ? parseDecision(raw) : null;
   } catch {
-    return true;
+    return null;
   }
 };
+
+// bin/pushary-codex-hook.ts
+var callKeyFor = (input) => codexCallKey({
+  sessionId: input.session_id,
+  turnId: input.turn_id,
+  toolName: input.tool_name,
+  toolInput: input.tool_input
+});
+var START_MS = Date.now();
 var agentNameFor = (input) => `Codex - ${basename(input.cwd ?? process.cwd())}`;
 var describeFor = (input, lookup) => input.tool_name === "apply_patch" ? describeApplyPatch(input.tool_input?.command) ?? describeToolCall(lookup.tool, lookup.input, "hook") : describeToolCall(lookup.tool, lookup.input, "hook");
 var pushQuestion = async (apiKey, input, lookup, waitSeconds, mode) => {
@@ -184,7 +240,14 @@ var codexGate = async (apiKey, input) => {
   });
   return { verdict, lookup };
 };
+var fromRecordedDecision = (decision) => {
+  if (decision.kind === "approved") return codexAllow();
+  if (decision.kind === "denied") return codexDeny(decision.reason);
+  return codexPass();
+};
 var decidePermissionRequest = async (input) => {
+  const recorded = consumeCodexCallDecision(callKeyFor(input));
+  if (recorded) return fromRecordedDecision(recorded);
   try {
     const apiKey = getApiKey();
     const { verdict, lookup } = await codexGate(apiKey, input);
@@ -195,7 +258,7 @@ var decidePermissionRequest = async (input) => {
     const toolPolicy = verdict.policy;
     if (toolPolicy.mode === "terminal_only") return codexPass();
     if (toolPolicy.mode === "notify_only") {
-      if (claimNotify(input.tool_use_id)) await notifyApprovalNeeded(apiKey, input, lookup);
+      await notifyApprovalNeeded(apiKey, input, lookup);
       return codexPass();
     }
     const waitSeconds = toolPolicy.mode === "push_first" ? toolPolicy.pushFirstSeconds : effectiveWaitSeconds(toolPolicy.timeoutAction, toolPolicy.timeoutSeconds, "codex");
@@ -207,22 +270,24 @@ var decidePermissionRequest = async (input) => {
     }
     if (answer.answered) {
       if (isDeferAnswer(answer.value)) return codexPass();
-      if (answer.value === "yes") {
-        if (toolPolicy.mode === "push_only") markApproved(input.tool_use_id);
-        return codexAllow();
-      }
+      if (answer.value === "yes") return codexAllow();
       return codexDeny(denyReasonFrom(answer.value, answer.note));
     }
     savePendingQuestion(input.session_id || DEFAULT_SESSION, correlationId);
     if (toolPolicy.mode === "push_first") return codexPass();
     if (clampCut) return codexPass();
-    const decision = permissionTimeoutDecision(toolPolicy.timeoutAction);
-    if (decision.kind === "allow") markApproved(input.tool_use_id);
-    return decision;
+    return permissionTimeoutDecision(toolPolicy.timeoutAction);
   } catch {
     return codexPass();
   }
 };
+var recordPreToolUse = (key, outcome) => {
+  recordCodexCallDecision(
+    key,
+    outcome.kind === "deny" ? { kind: "denied", reason: outcome.reason } : { kind: "handled" }
+  );
+  return outcome;
+};
 var decidePreToolUse = async (input) => {
   let apiKey;
   try {
@@ -249,30 +314,35 @@ var decidePreToolUse = async (input) => {
     if (verdict.kind === "deny") return codexDeny(verdict.reason);
     if (verdict.kind === "defer") return codexPass();
     const toolPolicy = verdict.policy;
+    const callKey = callKeyFor(input);
     if (toolPolicy.mode === "push_only") {
-      if (consumeApproval(input.tool_use_id)) return codexPass();
       let pushed;
       try {
         pushed = await pushQuestion(apiKey, input, lookup, effectiveWaitSeconds(toolPolicy.timeoutAction, toolPolicy.timeoutSeconds, "codex"), "push_only");
       } catch {
-        return preToolUseTimeoutDecision(toolPolicy.timeoutAction, "Push notification failed, denying per policy");
+        return recordPreToolUse(callKey, preToolUseTimeoutDecision(toolPolicy.timeoutAction, "Push notification failed, denying per policy"));
       }
       const { answer, correlationId, suppressed, clampCut } = pushed;
       if (suppressed) {
         await cancelQuestion(apiKey, correlationId).catch(() => {
         });
-        return codexPass();
+        return recordPreToolUse(callKey, codexPass());
       }
       if (answer.answered) {
-        if (isDeferAnswer(answer.value)) return codexPass();
-        return answer.value === "yes" ? codexPass() : codexDeny(denyReasonFrom(answer.value, answer.note));
+        if (isDeferAnswer(answer.value)) return recordPreToolUse(callKey, codexPass());
+        if (answer.value === "yes") {
+          recordCodexCallDecision(callKey, { kind: "approved" });
+          return codexPass();
+        }
+        return recordPreToolUse(callKey, codexDeny(denyReasonFrom(answer.value, answer.note)));
       }
       savePendingQuestion(input.session_id || DEFAULT_SESSION, correlationId);
-      if (clampCut) return codexPass();
-      return preToolUseTimeoutDecision(toolPolicy.timeoutAction);
+      if (clampCut) return recordPreToolUse(callKey, codexPass());
+      return recordPreToolUse(callKey, preToolUseTimeoutDecision(toolPolicy.timeoutAction));
     }
     if (toolPolicy.mode === "notify_only") {
-      if (claimNotify(input.tool_use_id)) await notifyApprovalNeeded(apiKey, input, lookup);
+      await notifyApprovalNeeded(apiKey, input, lookup);
+      recordCodexCallDecision(callKey, { kind: "handled" });
       return codexPass();
     }
     return codexPass();
@@ -336,6 +406,13 @@ var main = async () => {
       case "SessionStart":
         await reportSessionStart(input);
         break;
+      case "SessionEnd":
+        await handleSessionEnd({
+          cwd: input.cwd,
+          session_id: input.session_id,
+          reason: input.reason
+        }, CODEX_AGENT, { reconcile: false, reportAttempts: 1, reportTimeoutMs: 1200 });
+        break;
       default:
         break;
     }

package/dist/bin/pushary-codex.js

@@ -1,23 +1,24 @@
 #!/usr/bin/env node
 import {
   reportEvent
-} from "../chunk-V2XPF77V.js";
+} from "../chunk-VOE4SYPR.js";
 import {
   askUser,
   waitForAnswer
 } from "../chunk-J3YDT4HM.js";
+import "../chunk-7J67NYK4.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-Y3UTTFTZ.js";
+import "../chunk-KBS53WOE.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
-import "../chunk-7YJS2VTG.js";
+import "../chunk-DMW54VWK.js";
 
 // bin/pushary-codex.ts
 import { basename } from "path";

package/dist/bin/pushary-connect.js

@@ -1,22 +1,22 @@
 #!/usr/bin/env node
 import {
   printKeyCheck
-} from "../chunk-JAICP7BA.js";
+} from "../chunk-TD3M232T.js";
 import {
   confirmAppConnection,
   connectDevice,
   printConnectInstructions
-} from "../chunk-3LKYBFWA.js";
+} from "../chunk-EJL3PJU7.js";
 import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey
-} from "../chunk-A4I5JGCW.js";
+} from "../chunk-KFAH6KRE.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
 import {
   readKeySource
-} from "../chunk-OT4YD54Q.js";
+} from "../chunk-YX6ZKCC5.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
@@ -29,7 +29,7 @@ import "../chunk-DINDL2CF.js";
 import "../chunk-6MTNS63X.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-Y3UTTFTZ.js";
+import "../chunk-KBS53WOE.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
@@ -37,7 +37,7 @@ import {
   EXIT
 } from "../chunk-KZERVKTD.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-7YJS2VTG.js";
+import "../chunk-DMW54VWK.js";
 
 // bin/pushary-connect.ts
 exitOnHelpFlag("connect");

package/dist/bin/pushary-daemon.js

@@ -8,7 +8,7 @@ import {
   acquireDaemonLease,
   readDaemonStatus,
   requestDaemonHandoff
-} from "../chunk-SJVLFIYP.js";
+} from "../chunk-H5PIPIKQ.js";
 import {
   CODEX_BRIDGE_CAPABILITY,
   CODEX_RESUME_CAPABILITY,
@@ -17,7 +17,7 @@ import {
 import {
   findLiveProcessBySpawnId,
   ownsLiveProcess
-} from "../chunk-QBWYNVKY.js";
+} from "../chunk-BFBAHOGR.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
@@ -26,7 +26,8 @@ import {
   resolveGlobalPackageVersion,
   resolvePackageVersionFromBinary
 } from "../chunk-VT4IVERX.js";
-import "../chunk-B3V2H6SA.js";
+import "../chunk-NAPRGHZ3.js";
+import "../chunk-GIRT7677.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
@@ -43,7 +44,7 @@ import {
   getApiKey,
   getBaseUrl
 } from "../chunk-2UMNXADU.js";
-import "../chunk-7YJS2VTG.js";
+import "../chunk-DMW54VWK.js";
 
 // src/spawn-daemon.ts
 import { execFileSync, spawn } from "child_process";

package/dist/bin/pushary-disconnect.js

@@ -2,12 +2,22 @@
 import {
   removeClaudeMcpServers,
   removePusharySettings
-} from "../chunk-5646VKR4.js";
+} from "../chunk-2JYQAW4B.js";
+import {
+  OPENCODE_PLUGIN_SIBLING,
+  OPENCODE_PLUGIN_SIBLING_CONTENTS,
+  hasForeignPlugins,
+  isOpenCodePluginOurs,
+  openCodeConfigFile,
+  openCodePluginDir,
+  openCodePluginFile,
+  removeOpenCodeMcpServer
+} from "../chunk-ZGC3W23N.js";
 import {
   removeGeminiSettings
-} from "../chunk-ZZE6FN7T.js";
+} from "../chunk-K42RXJPG.js";
 import "../chunk-ATBKJNWS.js";
-import "../chunk-M7RYIZX6.js";
+import "../chunk-B7ZBHWOW.js";
 import "../chunk-VT4IVERX.js";
 import {
   claudeJson,
@@ -21,21 +31,23 @@ import {
   geminiSettings,
   removeCodexHooks,
   removeCodexSettings
-} from "../chunk-B3V2H6SA.js";
+} from "../chunk-NAPRGHZ3.js";
+import "../chunk-GIRT7677.js";
 import {
   exitOnHelpFlag
 } from "../chunk-SQOFGPNX.js";
 import "../chunk-GOEXZ5QJ.js";
 import "../chunk-DINDL2CF.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-7YJS2VTG.js";
+import "../chunk-DMW54VWK.js";
 
 // bin/pushary-disconnect.ts
-import { readFileSync, writeFileSync } from "fs";
+import { readdirSync, readFileSync, rmSync, writeFileSync } from "fs";
 import { parse as parseTOML, stringify as stringifyTOML } from "smol-toml";
 
 // src/disconnect.ts
-var DISCONNECTABLE_AGENTS = ["claude", "codex", "gemini", "cursor"];
+import { dirname } from "path";
+var DISCONNECTABLE_AGENTS = ["claude", "codex", "gemini", "cursor", "opencode"];
 var isDisconnectableAgent = (value) => DISCONNECTABLE_AGENTS.includes(value);
 var removeCursorHooks = (config) => {
   const hooks = config.hooks;
@@ -85,8 +97,24 @@ var disconnectPlan = (agent) => {
         { path: cursorUserHooks(), format: "json", remove: removeCursorHooks },
         { path: cursorUserMcp(), format: "json", remove: removeClaudeMcpServers }
       ];
+    // The plugin itself is a whole file of ours and comes out in
+    // `disconnectRemovals` below; the MCP entry is an ordinary edit to a config
+    // that is otherwise the person's own.
+    case "opencode":
+      return [{ path: openCodeConfigFile(), format: "json", remove: removeOpenCodeMcpServer }];
   }
 };
+var disconnectRemovals = (agent) => {
+  if (agent !== "opencode") return [];
+  return [
+    { path: openCodePluginFile(), ownedBy: isOpenCodePluginOurs },
+    {
+      path: `${openCodePluginDir()}/${OPENCODE_PLUGIN_SIBLING}`,
+      ownedBy: (contents) => contents === OPENCODE_PLUGIN_SIBLING_CONTENTS,
+      onlyIfLast: true
+    }
+  ];
+};
 var disconnectAgent = (agent, io) => {
   const changed = [];
   const untouched = [];
@@ -109,6 +137,27 @@ var disconnectAgent = (agent, io) => {
       untouched.push(edit.path);
     }
   }
+  for (const removal of disconnectRemovals(agent)) {
+    const raw = io.read(removal.path);
+    if (raw === null) continue;
+    if (!removal.ownedBy(raw)) {
+      untouched.push(removal.path);
+      continue;
+    }
+    if (removal.onlyIfLast) {
+      const entries = io.list?.(dirname(removal.path));
+      if (entries === void 0 || hasForeignPlugins(entries)) {
+        untouched.push(removal.path);
+        continue;
+      }
+    }
+    try {
+      io.remove?.(removal.path);
+      changed.push(removal.path);
+    } catch {
+      untouched.push(removal.path);
+    }
+  }
   return { agent, changed, untouched };
 };
 
@@ -130,7 +179,15 @@ var result = disconnectAgent(requested, {
   },
   write: (path, contents) => writeFileSync(path, contents, "utf-8"),
   parseToml: (raw) => parseTOML(raw),
-  stringifyToml: (config) => stringifyTOML(config)
+  stringifyToml: (config) => stringifyTOML(config),
+  remove: (path) => rmSync(path, { force: true }),
+  list: (dir) => {
+    try {
+      return readdirSync(dir);
+    } catch {
+      return [];
+    }
+  }
 });
 if (result.changed.length === 0) {
   console.log(`${requested} was not connected.`);