@pushary/agent-hooks 0.89.11 → 0.89.12

package/dist/{chunk-DKWM5T3P.js → chunk-5NDB3YOE.js}

@@ -1,9 +1,9 @@
 import {
   pusharyDir
-} from "./chunk-QA72MKIT.js";
+} from "./chunk-OVEGEQSB.js";
 import {
   writeFileAtomic
-} from "./chunk-XX2V4QS5.js";
+} from "./chunk-4LL6LG5X.js";
 
 // src/identity.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-TEZ2FZD6.js → chunk-6GU55AQQ.js}

@@ -1,9 +1,9 @@
 import {
   pusharyDir
-} from "./chunk-QA72MKIT.js";
+} from "./chunk-OVEGEQSB.js";
 import {
   readJsonSafe
-} from "./chunk-XX2V4QS5.js";
+} from "./chunk-4LL6LG5X.js";
 
 // src/process-ownership.ts
 import { createHash, randomUUID } from "crypto";

package/dist/{chunk-Q223OM5J.js → chunk-6V7ZDH3A.js}

@@ -1,17 +1,17 @@
 import {
   PRETOOLUSE_GATED_TOOLS,
   PRETOOLUSE_PHONE_ANSWERED_TOOLS
-} from "./chunk-6EKQZA6R.js";
+} from "./chunk-KVHP5ZME.js";
 import {
   guardBinary
-} from "./chunk-SYUIXXQW.js";
+} from "./chunk-VF3RTVWY.js";
 import {
   isProtectedByScope
-} from "./chunk-QA72MKIT.js";
+} from "./chunk-OVEGEQSB.js";
 import {
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-X6RXX2NF.js";
+} from "./chunk-3MCEES6Z.js";
 
 // src/claude-config.ts
 import { join } from "path";

package/dist/{chunk-OLAGKKSR.js → chunk-6VXNA5JB.js}

@@ -1,11 +1,13 @@
 import {
   buildTranscriptRecords,
   decodePublicKey,
-  fetchAccountPublicKey,
   generateSessionKey,
-  uploadTranscriptRecords,
   wrapSessionKey
-} from "./chunk-IUN6VOKV.js";
+} from "./chunk-WDVQ6O4C.js";
+import {
+  fetchTranscriptRecipients,
+  uploadTranscriptRecords
+} from "./chunk-QZCFVWA7.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;
@@ -71,6 +73,8 @@ var LiveTranscriptRelay = class {
   queue = [];
   sessionKey = null;
   wrappedKey = null;
+  providerWrappedKey = null;
+  providerKeyId = null;
   keyUploaded = false;
   keyRejected = false;
   flushing = null;
@@ -97,10 +101,14 @@ var LiveTranscriptRelay = class {
   async flushBatch() {
     try {
       if (!this.sessionKey) {
-        const publicKey = await fetchAccountPublicKey(this.options.apiKey, this.options.baseUrl);
-        if (!publicKey) return false;
+        const recipients = await fetchTranscriptRecipients(this.options.apiKey, this.options.baseUrl);
+        if (!recipients) return false;
         this.sessionKey = generateSessionKey();
-        this.wrappedKey = wrapSessionKey(this.sessionKey, decodePublicKey(publicKey));
+        this.wrappedKey = wrapSessionKey(this.sessionKey, decodePublicKey(recipients.phonePublicKey));
+        if (recipients.provider) {
+          this.providerWrappedKey = wrapSessionKey(this.sessionKey, decodePublicKey(recipients.provider.publicKey));
+          this.providerKeyId = recipients.provider.keyId;
+        }
       }
       const count = Math.min(this.queue.length, 50);
       const records = buildTranscriptRecords(this.queue.slice(0, count), this.sessionKey).records;
@@ -112,6 +120,8 @@ var LiveTranscriptRelay = class {
         sessionId: this.sessionId,
         machineId: this.options.machineId,
         dataEncryptionKey: this.keyUploaded ? void 0 : this.wrappedKey ?? void 0,
+        providerWrappedSessionKey: this.keyUploaded ? void 0 : this.providerWrappedKey ?? void 0,
+        providerKeyId: this.keyUploaded ? void 0 : this.providerKeyId ?? void 0,
         records
       }, this.options.baseUrl);
       if (result.keyConflict) {

package/dist/{chunk-34GN3IPX.js → chunk-7DK3ZH3N.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_BUDGETS,
   OPENCODE_APPROVAL_EVENT
-} from "./chunk-X6RXX2NF.js";
+} from "./chunk-3MCEES6Z.js";
 
 // src/opencode-plugin.ts
 var OPENCODE_PLUGIN_MARKER = "pushary-opencode-plugin w1";

package/dist/{chunk-PZRWFWSR.js → chunk-7HYJPOGG.js}

@@ -1,11 +1,11 @@
 import {
   detectClaudeVersion
-} from "./chunk-KVE5RCQL.js";
+} from "./chunk-NBRM3FMD.js";
 import {
   claudeWired,
   codexWired,
   geminiWired
-} from "./chunk-FZ73G2RO.js";
+} from "./chunk-NESKLV6R.js";
 import {
   GEMINI_HOOK_BINARY,
   addClaudeMcpServer,
@@ -14,14 +14,14 @@ import {
   addPusharyHooks,
   addPusharyToolPermissions,
   hasGeminiHooks
-} from "./chunk-Q223OM5J.js";
+} from "./chunk-6V7ZDH3A.js";
 import {
   guardBinary
-} from "./chunk-SYUIXXQW.js";
+} from "./chunk-VF3RTVWY.js";
 import {
   resolveGlobalBinDir,
   resolveGlobalBinary
-} from "./chunk-X4ZUUFKV.js";
+} from "./chunk-L4ZCFMWW.js";
 import {
   CODEX_HOOK_BINARY,
   addCodexHookTrust,
@@ -32,10 +32,10 @@ import {
   codexHooksJson,
   hasCodexHooks,
   vscodePluginMcp
-} from "./chunk-QA72MKIT.js";
+} from "./chunk-OVEGEQSB.js";
 import {
   readJsonSafe
-} from "./chunk-XX2V4QS5.js";
+} from "./chunk-4LL6LG5X.js";
 
 // src/reapply.ts
 import { join, dirname } from "path";

package/dist/{chunk-TY5HVMXT.js → chunk-DHR4F2CR.js}

@@ -1,6 +1,6 @@
 import {
   getMachineId
-} from "./chunk-DKWM5T3P.js";
+} from "./chunk-5NDB3YOE.js";
 import {
   getPackageVersion
 } from "./chunk-DINDL2CF.js";

package/dist/{chunk-3HFK3UXM.js → chunk-FCUUVHTS.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-X6RXX2NF.js";
+} from "./chunk-3MCEES6Z.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-NCVIWGVA.js → chunk-GKPURU7P.js}

@@ -1,6 +1,6 @@
 import {
   shouldDeferToNativeMode
-} from "./chunk-X6RXX2NF.js";
+} from "./chunk-3MCEES6Z.js";
 
 // src/native-defer.ts
 var nativeDeferOptions = () => {

package/dist/chunk-JJV5Q4KG.js

@@ -0,0 +1,20 @@
+import {
+  readTranscriptPreference
+} from "./chunk-RNKPLUWC.js";
+
+// src/transcript-setting.ts
+var fromEnv = () => {
+  const value = process.env.PUSHARY_TRANSCRIPTS?.trim().toLowerCase();
+  if (!value) return null;
+  if (["0", "false", "off"].includes(value)) return false;
+  if (["1", "true", "on"].includes(value)) return true;
+  return null;
+};
+var configuredPreference = () => fromEnv() ?? readTranscriptPreference();
+var transcriptsEnabled = () => configuredPreference() ?? false;
+var transcriptPreferenceForSetup = (explicit = null) => explicit ?? configuredPreference() ?? true;
+
+export {
+  transcriptsEnabled,
+  transcriptPreferenceForSetup
+};

package/dist/{chunk-TG3T3M4K.js → chunk-JVZX5YRJ.js}

@@ -5,7 +5,7 @@ import {
   FILE_TARGET_TOOLS,
   redactSecrets,
   redactSecretsDeep
-} from "./chunk-X6RXX2NF.js";
+} from "./chunk-3MCEES6Z.js";
 
 // ../hook-mapping/src/describe.ts
 import { isAbsolute, relative, resolve } from "path";
@@ -46,10 +46,13 @@ var eventPrefixes = {
 };
 var EVENT_ACTION_MAX = 120;
 var HOOK_FALLBACK_MAX = 200;
+var UNNAMED_ACTION = "this request";
 var describeToolCall = (toolName, toolInput, format = "hook") => {
+  if (!toolName) return "";
   const prefixes = format === "hook" ? hookPrefixes : eventPrefixes;
   const builder = prefixes[toolName];
-  const raw = builder ? builder(toolInput) : format === "hook" ? `${toolName}: ${JSON.stringify(toolInput)}` : `${toolName}: done`;
+  const detail = JSON.stringify(toolInput ?? {});
+  const raw = builder ? builder(toolInput) : format === "hook" ? detail === "{}" || detail === void 0 ? toolName : `${toolName}: ${detail}` : `${toolName}: done`;
   const redacted = redactSecrets(raw);
   if (format === "event") return redacted.slice(0, EVENT_ACTION_MAX);
   return builder ? redacted : redacted.slice(0, HOOK_FALLBACK_MAX);
@@ -269,6 +272,7 @@ var taskTitleFrom = (prompt) => typeof prompt === "string" ? prompt.replace(/\s+
 
 export {
   HOOK_FALLBACK_MAX,
+  UNNAMED_ACTION,
   describeToolCall,
   deriveToolTarget,
   parseApplyPatchOps,

package/dist/{chunk-6EKQZA6R.js → chunk-KVHP5ZME.js}

@@ -1,6 +1,6 @@
 import {
   ASKED_IN_EVERY_MODE_TOOLS
-} from "./chunk-X6RXX2NF.js";
+} from "./chunk-3MCEES6Z.js";
 
 // src/claude-tools.ts
 var PRETOOLUSE_GATED_TOOLS = [

package/dist/{chunk-X4ZUUFKV.js → chunk-L4ZCFMWW.js}

@@ -1,7 +1,7 @@
 // src/npm.ts
 import { execFileSync, execSync } from "child_process";
 import { existsSync, readFileSync, realpathSync } from "fs";
-import { dirname, join } from "path";
+import { dirname, isAbsolute, join, relative, resolve } from "path";
 var cleanNpmEnv = () => {
   const env = {};
   for (const [key, value] of Object.entries(process.env)) {
@@ -77,12 +77,67 @@ var resolveGlobalPackageVersion = (name) => {
     return void 0;
   }
 };
+var localImportsPresent = (entry, packageDir, seen = /* @__PURE__ */ new Set()) => {
+  if (seen.has(entry)) return true;
+  seen.add(entry);
+  try {
+    const source = readFileSync(entry, "utf8");
+    for (const match of source.matchAll(/\b(?:import|export)\s+(?:[^"'()]*?\s+from\s+)?["'](\.{1,2}\/[^"']+)["']|\bimport\s*\(\s*["'](\.{1,2}\/[^"']+)["']/g)) {
+      const dependency = resolve(dirname(entry), match[1] ?? match[2]);
+      const localPath = relative(packageDir, dependency);
+      if (localPath.startsWith("..") || isAbsolute(localPath) || !existsSync(dependency)) return false;
+      if (/\.[cm]?js$/.test(dependency) && !localImportsPresent(dependency, packageDir, seen)) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+};
+var packageBinsPresent = (packageDir, prefix, platform = process.platform, requiredFiles = []) => {
+  try {
+    const manifest = JSON.parse(readFileSync(join(packageDir, "package.json"), "utf8"));
+    if (!manifest.bin || typeof manifest.bin !== "object" || Array.isArray(manifest.bin)) return false;
+    const bins = Object.entries(manifest.bin);
+    if (bins.length === 0) return false;
+    if (!requiredFiles.every((path) => existsSync(join(packageDir, path)))) return false;
+    const seen = /* @__PURE__ */ new Set();
+    return bins.every(([name, target]) => {
+      if (typeof target !== "string") return false;
+      const shims = platform === "win32" ? [join(prefix, `${name}.cmd`), join(prefix, name)] : [join(prefix, "bin", name)];
+      const entry = join(packageDir, target);
+      return existsSync(entry) && shims.some(existsSync) && localImportsPresent(entry, packageDir, seen);
+    });
+  } catch {
+    return false;
+  }
+};
+var AGENT_HOOKS_RUNTIME_FILES = [
+  "data/SKILL.md",
+  "data/cursor-plugin/.cursor-plugin/plugin.json",
+  "data/cursor-plugin/hooks/hooks.json",
+  "data/cursor-plugin/mcp.json",
+  "data/cursor-plugin/scripts/pushary-gate.mjs",
+  "data/vscode-plugin/.claude-plugin/plugin.json",
+  "data/vscode-plugin/hooks/hooks.json",
+  "data/vscode-plugin/.mcp.json",
+  "data/vscode-plugin/scripts/pushary-gate.mjs"
+];
+var globalPackageBinsPresent = (name) => {
+  try {
+    const root = execNpm("root -g --no-workspaces", { timeout: 5e3 }).toString().trim();
+    const prefix = execNpm("prefix -g --no-workspaces", { timeout: 5e3 }).toString().trim();
+    return packageBinsPresent(join(root, ...name.split("/")), prefix, process.platform, AGENT_HOOKS_RUNTIME_FILES);
+  } catch {
+    return false;
+  }
+};
 var resolveGlobalBinDir = (probe) => {
   if (process.platform === "win32") return void 0;
   const resolved = resolveGlobalBinary(probe);
   return resolved ? resolved.slice(0, resolved.length - probe.length - 1) : void 0;
 };
 var quoteIfNeeded = (path) => /\s/.test(path) ? `"${path}"` : path;
+var needsGlobalInstall = (requested, installed, binaryPresent) => requested !== installed || !binaryPresent;
 var installState;
 var installGlobally = (options) => {
   if (installState) {
@@ -90,6 +145,13 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     const pinned = process.env.PUSHARY_PIN_GLOBAL_VERSION !== "0";
+    if (pinned && !needsGlobalInstall(
+      options.version,
+      resolveGlobalPackageVersion("@pushary/agent-hooks"),
+      globalPackageBinsPresent("@pushary/agent-hooks")
+    )) {
+      return "skipped";
+    }
     const spec = pinned && options.version && options.version !== "0.0.0" ? `@pushary/agent-hooks@${options.version}` : "@pushary/agent-hooks@latest";
     execNpm(`install -g --no-workspaces ${spec}`, { timeout: options.timeoutMs ?? 12e4 });
     return "installed";

package/dist/{chunk-2LPEZYMC.js → chunk-MFNQ5IMW.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-BSZYIAZL.js";
 import {
   reportedInstallSource
-} from "./chunk-IUWRVTQK.js";
+} from "./chunk-XREW7RQ3.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {

package/dist/{chunk-KVE5RCQL.js → chunk-NBRM3FMD.js}

@@ -1,6 +1,6 @@
 import {
   parseVersion
-} from "./chunk-Q223OM5J.js";
+} from "./chunk-6V7ZDH3A.js";
 
 // src/setup/agent-probe.ts
 import { execSync } from "child_process";

package/dist/{chunk-FZ73G2RO.js → chunk-NESKLV6R.js}

@@ -1,22 +1,22 @@
 import {
   hasGeminiHooks
-} from "./chunk-Q223OM5J.js";
+} from "./chunk-6V7ZDH3A.js";
 import {
   hasCodexHooks
-} from "./chunk-QA72MKIT.js";
+} from "./chunk-OVEGEQSB.js";
 import {
   HOOK_LOCATOR_BINARY
-} from "./chunk-X6RXX2NF.js";
+} from "./chunk-3MCEES6Z.js";
 
 // src/diagnostics/wiring.ts
 var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
 var CLAUDE_HOOK_BINARY = /pushary-[a-z-]*hook/;
-var EXACT_HOOK_BINARY = /^pushary-[a-z-]*hook$/;
+var EXACT_HOOK_BINARY = /^pushary-[a-z-]*(hook|gate)$/;
 var pusharyHookExecutable = (command) => {
   const tokens = command.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
   for (const raw of tokens.reverse()) {
     const token = raw[0] === '"' && raw.at(-1) === '"' || raw[0] === "'" && raw.at(-1) === "'" ? raw.slice(1, -1) : raw;
-    const name = token.split(/[/\\]/).pop()?.replace(/\.(cmd|exe)$/i, "") ?? "";
+    const name = token.split(/[/\\]/).pop()?.replace(/\.(cmd|exe|mjs)$/i, "") ?? "";
     if (name === HOOK_LOCATOR_BINARY || EXACT_HOOK_BINARY.test(name)) return token;
   }
   return null;
@@ -44,10 +44,29 @@ var geminiWired = ({ settings }) => {
   if (record(s.mcpServers)?.pushary) return true;
   return hasGeminiHooks(s);
 };
+var cursorWired = ({ userHooks, mcp, pluginDirExists }) => {
+  if (pluginDirExists) return true;
+  if (record(record(mcp)?.mcpServers)?.pushary) return true;
+  const hooks = record(record(userHooks)?.hooks);
+  if (!hooks) return false;
+  return Object.values(hooks).some((entries) => Array.isArray(entries) && entries.some((entry) => pusharyHookExecutable(String(record(entry)?.command ?? "")) !== null));
+};
+var cursorMcpAuthorization = (pluginMcp, userMcp) => {
+  const pluginServers = record(record(pluginMcp)?.mcpServers);
+  const usePlugin = pluginServers !== null && Object.hasOwn(pluginServers, "pushary");
+  const servers = usePlugin ? pluginServers : record(record(userMcp)?.mcpServers);
+  const headers = record(record(servers?.pushary)?.headers);
+  return {
+    authorization: typeof headers?.Authorization === "string" ? headers.Authorization : null,
+    source: usePlugin ? "plugin mcp.json" : "~/.cursor/mcp.json"
+  };
+};
 
 export {
   pusharyHookExecutable,
   claudeWired,
   codexWired,
-  geminiWired
+  geminiWired,
+  cursorWired,
+  cursorMcpAuthorization
 };

package/dist/{chunk-FXIL7RCL.js → chunk-OADGBOP7.js}

@@ -26,16 +26,16 @@ import {
   summarizeStop,
   taskTitleFrom,
   toolResultErrorText
-} from "./chunk-TG3T3M4K.js";
+} from "./chunk-JVZX5YRJ.js";
 import {
   getMachineId
-} from "./chunk-DKWM5T3P.js";
+} from "./chunk-5NDB3YOE.js";
 import {
   withRetry
 } from "./chunk-BSZYIAZL.js";
 import {
   reportedInstallSource
-} from "./chunk-IUWRVTQK.js";
+} from "./chunk-XREW7RQ3.js";
 import {
   getApiKey,
   getBaseUrl
@@ -51,7 +51,7 @@ import {
   pendingCommandEvents,
   resolveAutoResolveOrigin,
   resolvePolicy
-} from "./chunk-X6RXX2NF.js";
+} from "./chunk-3MCEES6Z.js";
 
 // src/policy.ts
 import { createHash } from "crypto";

package/dist/{chunk-J4K75V4D.js → chunk-OCMOTJTW.js}

@@ -1,14 +1,14 @@
 import {
   PRETOOLUSE_HANDLED_TOOLS,
   PRETOOLUSE_PHONE_ANSWERED_TOOLS
-} from "./chunk-6EKQZA6R.js";
+} from "./chunk-KVHP5ZME.js";
 import {
   defersToNativeMode
-} from "./chunk-NCVIWGVA.js";
+} from "./chunk-GKPURU7P.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-3HFK3UXM.js";
+} from "./chunk-FCUUVHTS.js";
 import {
   denyReasonFrom,
   isDeferAnswer
@@ -20,7 +20,7 @@ import {
   readLastUserPrompt,
   repoKeyFor,
   throttlePass
-} from "./chunk-FXIL7RCL.js";
+} from "./chunk-OADGBOP7.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -30,16 +30,17 @@ import {
   sendNotification
 } from "./chunk-JHJHCMAF.js";
 import {
+  UNNAMED_ACTION,
   deriveAction,
   deriveActionBody,
   deriveBlocker,
   deriveToolTarget,
   describeToolCall,
   scopePathFor
-} from "./chunk-TG3T3M4K.js";
+} from "./chunk-JVZX5YRJ.js";
 import {
   getMachineId
-} from "./chunk-DKWM5T3P.js";
+} from "./chunk-5NDB3YOE.js";
 import {
   getApiKey,
   getBaseUrl
@@ -54,7 +55,7 @@ import {
   parseAgentQuestionAnswers,
   parseAgentQuestions,
   resolveGate
-} from "./chunk-X6RXX2NF.js";
+} from "./chunk-3MCEES6Z.js";
 
 // src/decision-episode.ts
 var EPISODE_PATH = "/api/agent/decision-episode";
@@ -100,7 +101,7 @@ var handlePushOnly = async (apiKey, description, projectName, timeoutSeconds, ti
   let result;
   try {
     result = await askUser(apiKey, {
-      question: `Allow ${description}?`,
+      question: `Allow ${description || UNNAMED_ACTION}?`,
       type: "confirm",
       context: `Agent wants to run this in ${projectName}`,
       agentName: `Claude Code - ${projectName}`,
@@ -168,7 +169,7 @@ var handlePushFirst = async (apiKey, description, projectName, pushFirstSeconds,
   let result;
   try {
     result = await askUser(apiKey, {
-      question: `Allow ${description}?`,
+      question: `Allow ${description || UNNAMED_ACTION}?`,
       type: "confirm",
       context: `Agent wants to run this in ${projectName}`,
       agentName: `Claude Code - ${projectName}`,

package/dist/{chunk-LURY4WNF.js → chunk-OTPJ4FUR.js}

@@ -1,6 +1,6 @@
 import {
   renderCommandHelp
-} from "./chunk-3XTFX4CL.js";
+} from "./chunk-RLQWNEPM.js";
 import {
   getPackageVersion
 } from "./chunk-DINDL2CF.js";

package/dist/{chunk-QA72MKIT.js → chunk-OVEGEQSB.js}

@@ -1,17 +1,17 @@
 import {
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-X6RXX2NF.js";
+} from "./chunk-3MCEES6Z.js";
+
+// src/removal-scope.ts
+var namesAppLocator = (command) => command.includes(HOOK_LOCATOR_BINARY);
+var isProtectedByScope = (command, scope) => scope?.keepAppWiring === true && namesAppLocator(command);
 
 // src/codex-config.ts
 import { createHash } from "crypto";
 import { homedir } from "os";
 import { join } from "path";
 
-// src/removal-scope.ts
-var namesAppLocator = (command) => command.includes(HOOK_LOCATOR_BINARY);
-var isProtectedByScope = (command, scope) => scope?.keepAppWiring === true && namesAppLocator(command);
-
 // src/canonical-json.ts
 var canonicalJson = (value) => {
   if (value === null || typeof value !== "object") return JSON.stringify(value);