@pushary/agent-hooks 0.89.7 → 0.89.8

package/dist/{chunk-ZH7TWAYK.js → chunk-R2AGKCXL.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-PZA7G4CN.js";
 import {
   getMachineId
-} from "./chunk-2M66JVZM.js";
+} from "./chunk-DKDDLF5P.js";
 import {
   pusharyDir
 } from "./chunk-GMI5QZLG.js";
@@ -17,24 +17,39 @@ import {
 import {
   readJsonSafe,
   writeFileAtomic,
-  writeJsonAtomic
-} from "./chunk-6MTNS63X.js";
+  writeJsonAtomic,
+  writeJsonAtomicDurable
+} from "./chunk-XX2V4QS5.js";
 import {
   getApiKey
 } from "./chunk-2UMNXADU.js";
 
 // src/daemon-lifecycle.ts
 import { dirname, join, win32 as win32Path } from "path";
-import { existsSync, mkdirSync, realpathSync, renameSync, unlinkSync, writeFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from "fs";
 import { createHash, randomUUID } from "crypto";
 import { homedir } from "os";
 import { execFileSync } from "child_process";
 var daemonNeedsHandoff = (status) => status.kind === "version-mismatch" || status.kind === "configuration-mismatch" || status.kind === "unresponsive" && status.processAlive === true;
+var runDaemonServiceCommand = (command, args) => execFileSync(command, [...args], {
+  encoding: "utf-8",
+  stdio: ["ignore", "pipe", "ignore"],
+  windowsHide: true
+});
+var commandFailureOutput = (error) => {
+  const failure = error;
+  return [failure.stdout, failure.stderr, failure.message].map((value) => Buffer.isBuffer(value) ? value.toString("utf-8") : typeof value === "string" ? value : "").filter(Boolean).join("\n");
+};
+var isExpectedProbeFailure = (probe, error) => {
+  const failure = error;
+  const status = typeof failure.status === "number" ? failure.status : typeof failure.code === "number" ? failure.code : null;
+  const exitMatches = probe.negativeExitCodes === void 0 || status !== null && probe.negativeExitCodes.includes(status);
+  const outputMatches = probe.negativeOutputPattern === void 0 || probe.negativeOutputPattern.test(commandFailureOutput(error));
+  return (probe.negativeExitCodes !== void 0 || probe.negativeOutputPattern !== void 0) && exitMatches && outputMatches;
+};
 var daemonServiceManagerAvailable = (options = {}) => {
   const platform = options.platform ?? process.platform;
-  const run = options.run ?? ((command, args) => {
-    execFileSync(command, [...args], { stdio: "ignore", windowsHide: true });
-  });
+  const run = options.run ?? runDaemonServiceCommand;
   try {
     if (platform === "darwin") {
       const uid = options.uid ?? process.getuid?.();
@@ -48,6 +63,12 @@ var daemonServiceManagerAvailable = (options = {}) => {
     }
     if (platform === "win32") {
       run("sc.exe", ["query", "Schedule"]);
+      run("powershell.exe", [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        "Get-Command Get-ScheduledTask -ErrorAction Stop | Out-Null"
+      ]);
       return true;
     }
     return false;
@@ -103,8 +124,25 @@ var buildDaemonService = (input) => {
       ],
       start: [{ command: "launchctl", args: ["kickstart", "-k", target] }],
       stop: [{ command: "launchctl", args: ["kill", "SIGTERM", target], ignoreFailure: true }],
+      disable: [{ command: "launchctl", args: ["disable", target] }],
+      canDisableWhenUnregistered: true,
       uninstall: [{ command: "launchctl", args: ["bootout", domain, definitionPath], ignoreFailure: true }],
-      registrationProbe: { command: "launchctl", args: ["print", target] }
+      registrationProbe: {
+        command: "launchctl",
+        args: ["print", target],
+        negativeExitCodes: [113]
+      },
+      enabledProbe: {
+        command: "launchctl",
+        args: ["print-disabled", domain],
+        disabledOutputPattern: new RegExp(`"${label}"\\s*=>\\s*disabled`)
+      },
+      runningProbe: {
+        command: "launchctl",
+        args: ["print", target],
+        outputPattern: /\bstate = running\b/,
+        negativeExitCodes: [113]
+      }
     };
   }
   if (input.platform === "linux") {
@@ -134,10 +172,20 @@ WantedBy=default.target
       ],
       start: [{ command: "systemctl", args: ["--user", "start", unit] }],
       stop: [{ command: "systemctl", args: ["--user", "stop", unit], ignoreFailure: true }],
+      disable: [{ command: "systemctl", args: ["--user", "disable", unit] }],
       uninstall: [
         { command: "systemctl", args: ["--user", "disable", "--now", unit], ignoreFailure: true }
       ],
-      registrationProbe: { command: "systemctl", args: ["--user", "is-enabled", unit] },
+      registrationProbe: {
+        command: "systemctl",
+        args: ["--user", "is-enabled", unit],
+        negativeOutputPattern: /^(?:disabled|not-found)\s*$/m
+      },
+      runningProbe: {
+        command: "systemctl",
+        args: ["--user", "is-active", unit],
+        negativeOutputPattern: /^(?:inactive|failed|unknown)\s*$/m
+      },
       reloadAfterUninstall: { command: "systemctl", args: ["--user", "daemon-reload"] }
     };
   }
@@ -175,8 +223,38 @@ WantedBy=default.target
       ],
       start: [{ command: "schtasks.exe", args: ["/Run", "/TN", taskName] }],
       stop: [{ command: "schtasks.exe", args: ["/End", "/TN", taskName], ignoreFailure: true }],
+      disable: [{ command: "schtasks.exe", args: ["/Change", "/TN", taskName, "/Disable"] }],
       uninstall: [{ command: "schtasks.exe", args: ["/Delete", "/TN", taskName, "/F"], ignoreFailure: true }],
-      registrationProbe: { command: "schtasks.exe", args: ["/Query", "/TN", taskName] }
+      registrationProbe: {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          "$task = @(Get-ScheduledTask -ErrorAction Stop) | Where-Object { $_.TaskName -eq 'Pushary Daemon' -and $_.TaskPath -eq '\\' } | Select-Object -First 1; if ($null -eq $task) { exit 3 }"
+        ],
+        negativeExitCodes: [3]
+      },
+      enabledProbe: {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          "$task = @(Get-ScheduledTask -ErrorAction Stop) | Where-Object { $_.TaskName -eq 'Pushary Daemon' -and $_.TaskPath -eq '\\' } | Select-Object -First 1; if ($null -eq $task) { exit 3 }; if ($task.State -eq 'Disabled') { exit 4 }"
+        ],
+        negativeExitCodes: [3, 4]
+      },
+      runningProbe: {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          "$task = @(Get-ScheduledTask -ErrorAction Stop) | Where-Object { $_.TaskName -eq 'Pushary Daemon' -and $_.TaskPath -eq '\\' } | Select-Object -First 1; if ($null -eq $task) { exit 3 }; if ($task.State -ne 'Running') { exit 4 }"
+        ],
+        negativeExitCodes: [3, 4]
+      }
     };
   }
   return null;
@@ -219,26 +297,30 @@ var resolveDaemonServiceDefinition = (options = {}) => {
     uid: options.uid ?? process.getuid?.()
   });
 };
+var runDaemonServiceSteps = (steps, run) => {
+  for (const step of steps) {
+    try {
+      run(step.command, step.args);
+    } catch (err) {
+      if (!step.ignoreFailure) throw err;
+    }
+  }
+};
 var applyDaemonService = (action, definition, options = {}) => {
-  const run = options.run ?? ((command, args) => {
-    execFileSync(command, [...args], { stdio: "ignore", windowsHide: true });
-  });
+  const run = options.run ?? runDaemonServiceCommand;
   try {
     if (action === "install") writeFileAtomic(definition.definitionPath, definition.contents, 384);
     const steps = action === "uninstall" ? [...definition.stop, ...definition.uninstall] : definition[action];
-    for (const step of steps) {
-      try {
-        run(step.command, step.args);
-      } catch (err) {
-        if (!step.ignoreFailure) throw err;
-      }
-    }
+    runDaemonServiceSteps(steps, run);
     if (action === "uninstall") {
-      let registered = false;
+      let registered = true;
       try {
         run(definition.registrationProbe.command, definition.registrationProbe.args);
-        registered = true;
-      } catch {
+      } catch (err) {
+        if (!isExpectedProbeFailure(definition.registrationProbe, err)) {
+          throw new Error(`Could not verify native background service is absent: ${commandFailureOutput(err) || String(err)}`);
+        }
+        registered = false;
       }
       if (registered) throw new Error("Native background service remains registered");
       safeUnlink(definition.definitionPath);
@@ -563,8 +645,7 @@ var deactivateDaemonService = async (action, options) => {
   const platform = options.platform ?? process.platform;
   const supported = ["darwin", "linux", "win32"].includes(platform);
   const managerAvailable = supported && daemonServiceManagerAvailable(options);
-  const definitionPresent = supported && hasDaemonServiceDefinition(options);
-  const service = definitionPresent && !managerAvailable ? { kind: "failed", detail: "Native background-service manager is unavailable" } : managerAvailable ? manageDaemonService(action, options) : { kind: "ok" };
+  const service = supported && !managerAvailable ? { kind: "failed", detail: "Native background-service manager is unavailable" } : managerAvailable ? manageDaemonService(action, options) : { kind: "ok" };
   const stopped = await stopDaemonRunning(options);
   const failures = [
     service.kind === "ok" ? null : service.detail,
@@ -574,9 +655,251 @@ var deactivateDaemonService = async (action, options) => {
 };
 var stopDaemonService = async (options = {}) => deactivateDaemonService("stop", options);
 var disableDaemonService = async (options = {}) => deactivateDaemonService("uninstall", options);
+var parseDaemonServiceTransaction = (value) => {
+  if (typeof value !== "object" || value === null) return null;
+  const transaction = value;
+  if (transaction.version !== 1 || transaction.phase !== "prepared" && transaction.phase !== "committed" || typeof transaction.definitionPath !== "string" || !(transaction.previousContents === null || typeof transaction.previousContents === "string") || typeof transaction.previousRegistered !== "boolean" || !(transaction.previousEnabled === void 0 || typeof transaction.previousEnabled === "boolean") || typeof transaction.previousRunning !== "boolean") return null;
+  return {
+    ...transaction,
+    previousEnabled: typeof transaction.previousEnabled === "boolean" ? transaction.previousEnabled : transaction.previousRegistered
+  };
+};
+var probeDaemonServiceState = (definition, run) => {
+  let registered = true;
+  try {
+    run(definition.registrationProbe.command, definition.registrationProbe.args);
+  } catch (err) {
+    if (!isExpectedProbeFailure(definition.registrationProbe, err)) {
+      return {
+        kind: "failed",
+        detail: `Could not inspect native service registration: ${commandFailureOutput(err) || String(err)}`
+      };
+    }
+    registered = false;
+  }
+  let enabled = registered;
+  const enabledProbe = definition.enabledProbe;
+  if (enabledProbe) {
+    try {
+      const output = run(enabledProbe.command, enabledProbe.args);
+      enabled = !(enabledProbe.disabledOutputPattern && typeof output === "string" && enabledProbe.disabledOutputPattern.test(output));
+    } catch (err) {
+      if (!isExpectedProbeFailure(enabledProbe, err)) {
+        return {
+          kind: "failed",
+          detail: `Could not inspect whether the native service is enabled: ${commandFailureOutput(err) || String(err)}`
+        };
+      }
+      enabled = false;
+    }
+  }
+  try {
+    const output = run(definition.runningProbe.command, definition.runningProbe.args);
+    const running = definition.runningProbe.outputPattern ? typeof output === "string" && definition.runningProbe.outputPattern.test(output) : true;
+    return { kind: "ok", registered, enabled, running };
+  } catch (err) {
+    if (!isExpectedProbeFailure(definition.runningProbe, err)) {
+      return {
+        kind: "failed",
+        detail: `Could not inspect whether the native service is running: ${commandFailureOutput(err) || String(err)}`
+      };
+    }
+    return { kind: "ok", registered, enabled, running: false };
+  }
+};
+var restoreDaemonServiceSnapshot = (definition, snapshot, run) => {
+  const removed = applyDaemonService("uninstall", definition, { run });
+  if (removed.kind !== "ok") return removed;
+  try {
+    if (snapshot.previousContents === null) safeUnlink(definition.definitionPath);
+    else writeFileAtomic(definition.definitionPath, snapshot.previousContents, 384);
+  } catch (err) {
+    return {
+      kind: "failed",
+      detail: `could not restore the previous definition: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  if (!snapshot.previousRegistered) {
+    const reload = definition.reloadAfterUninstall;
+    if (snapshot.previousContents !== null && reload) {
+      try {
+        run(reload.command, reload.args);
+      } catch (err) {
+        return { kind: "failed", detail: `could not reload the previous definition: ${commandFailureOutput(err) || String(err)}` };
+      }
+    }
+    if (snapshot.previousRunning) {
+      const started = applyDaemonService("start", definition, { run });
+      if (started.kind !== "ok") return started;
+    }
+    if (!snapshot.previousEnabled && definition.canDisableWhenUnregistered) {
+      try {
+        runDaemonServiceSteps(definition.disable, run);
+      } catch (err) {
+        return { kind: "failed", detail: `could not restore the previous disabled state: ${commandFailureOutput(err) || String(err)}` };
+      }
+    }
+    const state2 = probeDaemonServiceState(definition, run);
+    if (state2.kind !== "ok") return { kind: "failed", detail: state2.detail };
+    if (state2.registered || state2.enabled !== snapshot.previousEnabled || state2.running !== snapshot.previousRunning) {
+      return { kind: "failed", detail: "could not restore the previous unregistered service state" };
+    }
+    return { kind: "ok" };
+  }
+  if (snapshot.previousContents === null) {
+    return { kind: "failed", detail: "the previous registered service had no recoverable definition" };
+  }
+  const restored = applyDaemonService("install", {
+    ...definition,
+    contents: snapshot.previousContents
+  }, { run });
+  if (restored.kind !== "ok") return restored;
+  if (!snapshot.previousRunning) applyDaemonService("stop", definition, { run });
+  if (!snapshot.previousEnabled) {
+    try {
+      runDaemonServiceSteps(definition.disable, run);
+    } catch (err) {
+      return { kind: "failed", detail: `could not restore the previous disabled state: ${commandFailureOutput(err) || String(err)}` };
+    }
+  }
+  const state = probeDaemonServiceState(definition, run);
+  if (state.kind !== "ok") return { kind: "failed", detail: state.detail };
+  if (!state.registered) return { kind: "failed", detail: "the previous service is no longer registered" };
+  if (state.enabled !== snapshot.previousEnabled) {
+    return { kind: "failed", detail: "could not restore whether the previous service was enabled" };
+  }
+  if (state.running !== snapshot.previousRunning) {
+    return {
+      kind: "failed",
+      detail: snapshot.previousRunning ? "the previous service did not restart" : "could not restore the previous stopped state"
+    };
+  }
+  return { kind: "ok" };
+};
+var recoverDaemonServiceTransaction = (definition, path, run) => {
+  const stored = readJsonSafe(path);
+  if (stored.kind === "missing") return { kind: "ok" };
+  if (stored.kind !== "ok") {
+    return { kind: "failed", detail: `transaction receipt is ${stored.kind}` };
+  }
+  const transaction = parseDaemonServiceTransaction(stored.value);
+  if (!transaction) return { kind: "failed", detail: "transaction receipt is invalid" };
+  if (transaction.definitionPath !== definition.definitionPath) {
+    return { kind: "failed", detail: "transaction receipt belongs to a different service definition" };
+  }
+  if (transaction.phase === "prepared") {
+    const restored = restoreDaemonServiceSnapshot(definition, transaction, run);
+    if (restored.kind !== "ok") return restored;
+  }
+  try {
+    safeUnlink(path);
+  } catch (err) {
+    return { kind: "failed", detail: `could not clear transaction receipt: ${err instanceof Error ? err.message : String(err)}` };
+  }
+  return { kind: "ok" };
+};
 var replaceDaemonService = async (options = {}) => {
+  const definition = resolveDaemonServiceDefinition(options);
+  if (!definition) {
+    return {
+      kind: "unavailable",
+      detail: "Could not find the globally installed daemon entry. Run Pushary setup again."
+    };
+  }
+  const run = options.run ?? runDaemonServiceCommand;
+  const transactionPath = join(options.stateDir ?? options.dir ?? pusharyDir(), "daemon-service-transaction.json");
+  const recovered = recoverDaemonServiceTransaction(definition, transactionPath, run);
+  if (recovered.kind !== "ok") {
+    return { kind: "failed", detail: `Could not recover interrupted service replacement: ${recovered.detail}` };
+  }
+  let previousContents = null;
+  try {
+    if (existsSync(definition.definitionPath)) {
+      previousContents = readFileSync(definition.definitionPath, "utf-8");
+    }
+  } catch (err) {
+    return { kind: "failed", detail: `Could not snapshot the existing service: ${err instanceof Error ? err.message : String(err)}` };
+  }
+  const previousState = probeDaemonServiceState(definition, run);
+  if (previousState.kind !== "ok") return { kind: "failed", detail: previousState.detail };
+  if ((previousState.registered || previousState.running) && previousContents === null) {
+    return { kind: "failed", detail: "Could not replace an active native service with no recoverable definition" };
+  }
+  const transaction = {
+    version: 1,
+    phase: "prepared",
+    definitionPath: definition.definitionPath,
+    previousContents,
+    previousRegistered: previousState.registered,
+    previousEnabled: previousState.enabled,
+    previousRunning: previousState.running
+  };
+  try {
+    writeJsonAtomicDurable(transactionPath, transaction, 384);
+  } catch (err) {
+    return { kind: "failed", detail: `Could not persist the service rollback snapshot: ${err instanceof Error ? err.message : String(err)}` };
+  }
   const stopped = await stopDaemonRunning(options);
-  return stopped.kind === "unavailable" ? stopped : manageDaemonService("install", options);
+  if (stopped.kind === "unavailable") {
+    try {
+      safeUnlink(transactionPath);
+    } catch (err) {
+      return {
+        kind: "failed",
+        detail: `${stopped.detail}; could not clear unused rollback evidence: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+    return stopped;
+  }
+  let installed = applyDaemonService("install", definition, { run });
+  if (installed.kind === "ok") {
+    const state = probeDaemonServiceState(definition, run);
+    if (state.kind !== "ok") {
+      installed = { kind: "failed", detail: state.detail };
+    } else if (!state.registered || !state.enabled || !state.running) {
+      installed = {
+        kind: "failed",
+        detail: !state.registered ? "Service registration verification failed" : !state.enabled ? "Service enable verification failed" : "Service start verification failed"
+      };
+    }
+  }
+  if (installed.kind === "ok") {
+    try {
+      writeJsonAtomicDurable(transactionPath, { ...transaction, phase: "committed" }, 384);
+    } catch (err) {
+      const detail = `Could not commit the service replacement: ${err instanceof Error ? err.message : String(err)}`;
+      const recovered2 = recoverDaemonServiceTransaction(definition, transactionPath, run);
+      return recovered2.kind === "ok" ? { kind: "failed", detail } : {
+        kind: "failed",
+        detail: `${detail}; recovery failed: ${recovered2.detail}`
+      };
+    }
+    try {
+      safeUnlink(transactionPath);
+      return installed;
+    } catch (err) {
+      return {
+        kind: "failed",
+        detail: `Service replacement committed but its receipt could not be cleared: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+  }
+  const restored = restoreDaemonServiceSnapshot(definition, transaction, run);
+  if (restored.kind !== "ok") {
+    return { kind: "failed", detail: `${installed.detail}; rollback failed: ${restored.detail}` };
+  }
+  try {
+    safeUnlink(transactionPath);
+  } catch (err) {
+    return {
+      kind: "failed",
+      detail: `${installed.detail}; previous service restored but recovery evidence could not be cleared: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  return {
+    kind: "failed",
+    detail: `${installed.detail}; ${transaction.previousRegistered ? "previous service restored" : "previous service state restored"}`
+  };
 };
 var launchInstalledDaemon = (options) => {
   const entryExists = options.entryExists ?? existsSync;

package/dist/{chunk-42TTFZLV.js → chunk-TF247BET.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-GMI5QZLG.js";
 import {
   readJsonSafe
-} from "./chunk-6MTNS63X.js";
+} from "./chunk-XX2V4QS5.js";
 
 // src/process-ownership.ts
 import { createHash, randomUUID } from "crypto";

package/dist/{chunk-L3YUHEB6.js → chunk-V6N4Q223.js}

@@ -9,7 +9,7 @@ import {
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic
-} from "./chunk-6MTNS63X.js";
+} from "./chunk-XX2V4QS5.js";
 import {
   configFilePath
 } from "./chunk-2UMNXADU.js";

package/dist/{chunk-6MTNS63X.js → chunk-XX2V4QS5.js}

@@ -46,10 +46,21 @@ var writeFileAtomic = (filePath, contents, mode) => {
 };
 var writeJsonAtomic = (filePath, data, mode) => writeFileAtomic(filePath, `${JSON.stringify(data, null, 2)}
 `, mode);
+var writeJsonAtomicDurable = (filePath, data, mode) => {
+  writeJsonAtomic(filePath, data, mode);
+  if (process.platform === "win32") return;
+  const directory = openSync(dirname(filePath), "r");
+  try {
+    fsyncSync(directory);
+  } finally {
+    closeSync(directory);
+  }
+};
 
 export {
   readJsonSafe,
   backupFile,
   writeFileAtomic,
-  writeJsonAtomic
+  writeJsonAtomic,
+  writeJsonAtomicDurable
 };

package/dist/{chunk-TESGYWEM.js → chunk-ZL7HEF2T.js}

@@ -1,6 +1,6 @@
 import {
   getMachineId
-} from "./chunk-2M66JVZM.js";
+} from "./chunk-DKDDLF5P.js";
 import {
   getPackageVersion
 } from "./chunk-DINDL2CF.js";

package/dist/src/index.js

@@ -1,6 +1,6 @@
 import {
   handlePreToolUse
-} from "../chunk-5YUVKPTS.js";
+} from "../chunk-EJT2ER6G.js";
 import "../chunk-ATBKJNWS.js";
 import "../chunk-VZKXBFUA.js";
 import "../chunk-YHG74UFF.js";
@@ -12,21 +12,21 @@ import {
   handlePostToolUse,
   handleStop,
   reportEvent
-} from "../chunk-BPKMGE7L.js";
+} from "../chunk-4XZCDSNG.js";
 import {
   askUser,
   cancelQuestion,
   waitForAnswer
 } from "../chunk-GKAKAOKC.js";
 import "../chunk-KOPUTJQC.js";
-import "../chunk-2M66JVZM.js";
+import "../chunk-DKDDLF5P.js";
 import "../chunk-GMI5QZLG.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-OFRNZWC4.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-6MTNS63X.js";
+import "../chunk-XX2V4QS5.js";
 import {
   getApiKey,
   getBaseUrl

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.89.7",
+  "version": "0.89.8",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",