@pushary/agent-hooks 0.94.0 → 0.95.1

package/dist/chunk-N6FAXQDD.js

@@ -0,0 +1,276 @@
+import {
+  resolvePathBinary
+} from "./chunk-L4ZCFMWW.js";
+
+// src/hermes-config.ts
+import { execFileSync } from "child_process";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { homedir, tmpdir } from "os";
+import { join } from "path";
+var isRecord = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+var isSnapshot = (value) => isRecord(value) && typeof value.present === "boolean" && Object.hasOwn(value, "value");
+var isHermesConfigReceipt = (value) => {
+  if (!isRecord(value)) return false;
+  return ["security", "approval", "transport", "fallback", "plugins", "enabled", "agent", "disabled"].every((key) => isSnapshot(value[key])) && typeof value.pushary_enabled === "boolean" && typeof value.clarify_disabled === "boolean";
+};
+var HERMES_PIP_PACKAGE = "hermes-plugin-pushary";
+var HERMES_CONFIG_SCRIPT = String.raw`
+import json, os, sys
+from hermes_cli.config import load_config, save_config
+
+mode, receipt_path = sys.argv[1], sys.argv[2]
+c = load_config()
+
+def snap(obj, key):
+    return {"present": key in obj, "value": obj.get(key)}
+
+restore_conflicts = []
+
+def restore(obj, key, before, ours):
+    if before.get("present") and before.get("value") == ours:
+        return
+    if before.get("present"):
+        if key in obj and obj.get(key) == before.get("value"):
+            return
+    elif key not in obj:
+        return
+    if obj.get(key) != ours:
+        restore_conflicts.append(key)
+        return
+    if before.get("present"):
+        obj[key] = before.get("value")
+    else:
+        obj.pop(key, None)
+
+def restore_container(obj, key, before, current, changed):
+    raw = obj.get(key)
+    if isinstance(before.get("value"), dict):
+        if not isinstance(raw, dict):
+            if changed:
+                restore_conflicts.append(key)
+            return
+        if current or before.get("present"):
+            obj[key] = current
+        else:
+            obj.pop(key, None)
+    elif isinstance(raw, dict) and current:
+        restore_conflicts.append(key)
+    else:
+        restore(obj, key, before, {})
+
+def restore_list_member(obj, key, before, ours, ours_before):
+    raw = obj.get(key)
+    if isinstance(before.get("value"), list):
+        if ours_before:
+            return
+        if not isinstance(raw, list):
+            restore_conflicts.append(key)
+            return
+        remaining = [item for item in raw if item != ours]
+        if remaining or before.get("present"):
+            obj[key] = remaining
+        else:
+            obj.pop(key, None)
+        return
+    if before.get("present") and raw == before.get("value"):
+        return
+    if not before.get("present") and key not in obj:
+        return
+    if not isinstance(raw, list):
+        restore_conflicts.append(key)
+        return
+    remaining = [item for item in raw if item != ours]
+    if remaining:
+        restore_conflicts.append(key)
+    else:
+        restore(obj, key, before, raw)
+
+def valid_snapshot(value):
+    return isinstance(value, dict) and isinstance(value.get("present"), bool) and "value" in value
+
+def valid_receipt(value):
+    snapshots = ["security", "approval", "transport", "fallback", "plugins", "enabled", "agent", "disabled"]
+    return (isinstance(value, dict)
+        and all(valid_snapshot(value.get(key)) for key in snapshots)
+        and isinstance(value.get("pushary_enabled"), bool)
+        and isinstance(value.get("clarify_disabled"), bool))
+
+if mode == "setup":
+    security_before = snap(c, "security")
+    s = c.get("security") if isinstance(c.get("security"), dict) else {}
+    approval_before = snap(s, "approval")
+    ap = s.get("approval") if isinstance(s.get("approval"), dict) else {}
+    plugins_before = snap(c, "plugins")
+    p = c.get("plugins") if isinstance(c.get("plugins"), dict) else {}
+    agent_before = snap(c, "agent")
+    a = c.get("agent") if isinstance(c.get("agent"), dict) else {}
+    enabled = p.get("enabled") if isinstance(p.get("enabled"), list) else []
+    disabled = a.get("disabled_toolsets") if isinstance(a.get("disabled_toolsets"), list) else []
+    receipt = {
+        "security": security_before,
+        "approval": approval_before,
+        "transport": snap(ap, "transport"),
+        "fallback": snap(ap, "transport_fallback"),
+        "plugins": plugins_before,
+        "enabled": snap(p, "enabled"),
+        "pushary_enabled": "pushary" in enabled,
+        "agent": agent_before,
+        "disabled": snap(a, "disabled_toolsets"),
+        "clarify_disabled": "clarify" in disabled,
+    }
+    if os.path.exists(receipt_path):
+        with open(receipt_path, encoding="utf-8") as handle:
+            existing_receipt = json.load(handle)
+        if not valid_receipt(existing_receipt):
+            raise ValueError("invalid Pushary Hermes setup receipt")
+    else:
+        os.makedirs(os.path.dirname(receipt_path), exist_ok=True)
+        temp = receipt_path + ".tmp"
+        with open(temp, "x", encoding="utf-8") as handle:
+            json.dump(receipt, handle)
+        os.chmod(temp, 0o600)
+        os.replace(temp, receipt_path)
+    ap["transport"] = "pushary"
+    ap["transport_fallback"] = "builtin"
+    s["approval"] = ap
+    c["security"] = s
+    p["enabled"] = enabled if "pushary" in enabled else enabled + ["pushary"]
+    c["plugins"] = p
+    a["disabled_toolsets"] = disabled if "clarify" in disabled else disabled + ["clarify"]
+    c["agent"] = a
+else:
+    receipt_exists = os.path.exists(receipt_path)
+    try:
+        with open(receipt_path, encoding="utf-8") as handle:
+            receipt = json.load(handle)
+    except (OSError, ValueError):
+        if receipt_exists:
+            raise
+        receipt = None
+    s = c.get("security") if isinstance(c.get("security"), dict) else {}
+    ap = s.get("approval") if isinstance(s.get("approval"), dict) else {}
+    if receipt:
+        if not valid_receipt(receipt):
+            raise ValueError("invalid Pushary Hermes setup receipt")
+        approval_changed = (not receipt["transport"].get("present")
+            or receipt["transport"].get("value") != "pushary"
+            or not receipt["fallback"].get("present")
+            or receipt["fallback"].get("value") != "builtin")
+        plugins_changed = not (isinstance(receipt["enabled"].get("value"), list)
+            and receipt["pushary_enabled"])
+        agent_changed = not (isinstance(receipt["disabled"].get("value"), list)
+            and receipt["clarify_disabled"])
+        restore(ap, "transport", receipt["transport"], "pushary")
+        restore(ap, "transport_fallback", receipt["fallback"], "builtin")
+    else:
+        if ap.get("transport") == "pushary": ap.pop("transport", None)
+        if ap.get("transport_fallback") == "builtin": ap.pop("transport_fallback", None)
+    if receipt:
+        restore_container(s, "approval", receipt["approval"], ap, approval_changed)
+        restore_container(c, "security", receipt["security"], s, approval_changed)
+    else:
+        if ap: s["approval"] = ap
+        else: s.pop("approval", None)
+        if s: c["security"] = s
+        else: c.pop("security", None)
+
+    p = c.get("plugins") if isinstance(c.get("plugins"), dict) else {}
+    if receipt:
+        restore_list_member(p, "enabled", receipt["enabled"], "pushary", receipt["pushary_enabled"])
+        restore_container(c, "plugins", receipt["plugins"], p, plugins_changed)
+    else:
+        enabled = p.get("enabled") if isinstance(p.get("enabled"), list) else []
+        enabled = [item for item in enabled if item != "pushary"]
+        if enabled: p["enabled"] = enabled
+        else: p.pop("enabled", None)
+        if p: c["plugins"] = p
+        else: c.pop("plugins", None)
+
+    a = c.get("agent") if isinstance(c.get("agent"), dict) else {}
+    if receipt:
+        restore_list_member(a, "disabled_toolsets", receipt["disabled"], "clarify", receipt["clarify_disabled"])
+        restore_container(c, "agent", receipt["agent"], a, agent_changed)
+    else:
+        disabled = a.get("disabled_toolsets") if isinstance(a.get("disabled_toolsets"), list) else []
+        disabled = [item for item in disabled if item != "clarify"]
+        if disabled: a["disabled_toolsets"] = disabled
+        else: a.pop("disabled_toolsets", None)
+        if a: c["agent"] = a
+        else: c.pop("agent", None)
+
+    if receipt and restore_conflicts:
+        raise ValueError("Hermes config changed after Pushary setup")
+
+save_config(c)
+`;
+var resolveHermesPython = () => {
+  const launcher = resolvePathBinary("hermes");
+  if (launcher && process.platform !== "win32") {
+    try {
+      const shebang = readFileSync(launcher, "utf-8").split("\n", 1)[0];
+      const interpreter = shebang?.startsWith("#!") ? shebang.slice(2).trim().split(/\s+/)[0] : void 0;
+      if (interpreter && /python/i.test(interpreter) && existsSync(interpreter)) return interpreter;
+    } catch {
+    }
+  }
+  const root = join(homedir(), ".hermes", "hermes-agent", "venv");
+  const candidates = process.platform === "win32" ? [join(root, "Scripts", "python.exe"), join(root, "Scripts", "python3.exe")] : [join(root, "bin", "python3"), join(root, "bin", "python")];
+  return candidates.find(existsSync) ?? null;
+};
+var runHermesPythonScript = (python, script, ...args) => {
+  const path = join(tmpdir(), `pushary-hermes-${process.pid}-${Date.now()}.py`);
+  try {
+    writeFileSync(path, script, { encoding: "utf-8", mode: 384 });
+    execFileSync(python, [path, ...args], { env: { ...process.env }, stdio: "pipe", timeout: 15e3 });
+    return true;
+  } catch {
+    return false;
+  } finally {
+    try {
+      rmSync(path, { force: true });
+    } catch {
+    }
+  }
+};
+
+// src/cli/dry-run.ts
+import { execSync } from "child_process";
+import { rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+var createGuards = (isDryRun, note) => ({
+  write: (path, contents) => {
+    if (isDryRun()) return note("rewrite", path);
+    writeFileSync2(path, contents, "utf-8");
+  },
+  remove: (path, options = {}) => {
+    if (isDryRun()) return note("remove ", path);
+    rmSync2(path, { recursive: true, force: options.force ?? false });
+  },
+  exec: (command, options, describe) => {
+    if (isDryRun()) return note("run    ", describe);
+    execSync(command, options);
+  }
+});
+var describeService = (effects) => {
+  if (effects.controlMode === "off") return "skip     the phone-start background service (--control off)";
+  const where = effects.serviceDefinitionPath ?? "the phone-start service definition";
+  const condition = effects.controlMode === "on" ? "" : ", when a supported agent and a service manager are present";
+  return `write    ${where} and register it with the OS${condition}`;
+};
+var describeSetupSideEffects = (effects) => [
+  `run      npm install -g @pushary/agent-hooks@${effects.version} (the hooks run from the global copy; up to two minutes)`,
+  `write    ${effects.configFile} (the API key, mode 600)`,
+  effects.rcPath ? `edit     ${effects.rcPath} (export PUSHARY_API_KEY)` : "print    the export line for your shell, since no rc file was found",
+  describeService(effects),
+  "ask      Add Pushary instructions to this project's CLAUDE.md/AGENTS.md? (default no)",
+  "ask      Alias claude to pushary claude? (default no)"
+];
+
+export {
+  isHermesConfigReceipt,
+  HERMES_PIP_PACKAGE,
+  HERMES_CONFIG_SCRIPT,
+  resolveHermesPython,
+  runHermesPythonScript,
+  createGuards,
+  describeSetupSideEffects
+};

package/dist/{chunk-UZFVNEEU.js → chunk-PDFVIRPB.js}

@@ -13,7 +13,7 @@ import {
 import {
   isValidApiKey,
   normalizeKeyScope
-} from "./chunk-Z6CP5ZZD.js";
+} from "./chunk-VOWZ5VOO.js";
 
 // src/session.ts
 var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;

package/dist/chunk-PQ4K74WL.js

@@ -0,0 +1,30 @@
+// src/wrapper/claudeBinary.ts
+import { statSync } from "fs";
+import { join, delimiter } from "path";
+var WRAPPER_ACTIVE_ENV = "PUSHARY_WRAPPER_ACTIVE";
+var isFile = (path) => {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+};
+var findClaudeBinary = () => {
+  const override = process.env.PUSHARY_CLAUDE_BIN?.trim();
+  if (override) return isFile(override) ? override : null;
+  const pathVar = process.env.PATH ?? "";
+  const exts = process.platform === "win32" ? [".cmd", ".exe", ".bat", ""] : [""];
+  for (const dir of pathVar.split(delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = join(dir, `claude${ext}`);
+      if (isFile(candidate)) return candidate;
+    }
+  }
+  return null;
+};
+
+export {
+  WRAPPER_ACTIVE_ENV,
+  findClaudeBinary
+};

package/dist/{chunk-ROHFVGXM.js → chunk-R7NPGCSD.js}

@@ -15,7 +15,7 @@ import {
 } from "./chunk-EYRGBYZG.js";
 import {
   reportedInstallSource
-} from "./chunk-ODL52O5V.js";
+} from "./chunk-T5B3LRYF.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {

package/dist/{chunk-QGA2ZB4I.js → chunk-RNH2AE52.js}

@@ -1,6 +1,6 @@
 import {
   getMachineId
-} from "./chunk-NVPYRDCT.js";
+} from "./chunk-SSQ5X6SA.js";
 import {
   getPackageVersion
 } from "./chunk-DINDL2CF.js";

package/dist/{chunk-NVPYRDCT.js → chunk-SSQ5X6SA.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-Y6XXFXVB.js";
+} from "./chunk-3F4VV5TS.js";
 import {
   writeFileAtomic
 } from "./chunk-4LL6LG5X.js";

package/dist/{chunk-OB4RF2TF.js → chunk-T23EGPRI.js}

@@ -3,7 +3,7 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-46P3VES5.js";
+} from "./chunk-UFGDCMUD.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords

package/dist/{chunk-ODL52O5V.js → chunk-T5B3LRYF.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-2UMNXADU.js";
 import {
   normalizeInstallSource
-} from "./chunk-Z6CP5ZZD.js";
+} from "./chunk-VOWZ5VOO.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";

package/dist/{chunk-Y3UGCQQC.js → chunk-TTO76NZJ.js}

@@ -1,6 +1,6 @@
 import {
   ASKED_IN_EVERY_MODE_TOOLS
-} from "./chunk-Z6CP5ZZD.js";
+} from "./chunk-VOWZ5VOO.js";
 
 // src/claude-tools.ts
 var PRETOOLUSE_GATED_TOOLS = [

package/dist/{chunk-46P3VES5.js → chunk-UFGDCMUD.js}

@@ -1,6 +1,6 @@
 import {
   redactSecrets
-} from "./chunk-Z6CP5ZZD.js";
+} from "./chunk-VOWZ5VOO.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";
@@ -152,5 +152,6 @@ export {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey,
+  encryptRecord,
   buildTranscriptRecords
 };

package/dist/{chunk-2ORRI66J.js → chunk-UQSKCQBO.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-Z6CP5ZZD.js";
+} from "./chunk-VOWZ5VOO.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-4PE2SQVM.js → chunk-VLKEAYJ4.js}

@@ -5,7 +5,7 @@ import {
   FILE_TARGET_TOOLS,
   redactSecrets,
   redactSecretsDeep
-} from "./chunk-Z6CP5ZZD.js";
+} from "./chunk-VOWZ5VOO.js";
 
 // ../hook-mapping/src/describe.ts
 import { isAbsolute, relative, resolve } from "path";

package/dist/chunk-WJZUTMMU.js

@@ -0,0 +1,194 @@
+import {
+  CLAUDE_HOOK_EVENTS,
+  supportedClaudeEvents
+} from "./chunk-BWNU4MX4.js";
+import {
+  guardBinary
+} from "./chunk-EZIEXHYM.js";
+import {
+  isProtectedByScope
+} from "./chunk-3F4VV5TS.js";
+import {
+  HOOK_LOCATOR_BINARY
+} from "./chunk-VOWZ5VOO.js";
+
+// src/claude-config.ts
+import { join } from "path";
+import { isDeepStrictEqual } from "util";
+var PUSHARY_MCP_URL = "https://pushary.com/api/mcp/mcp";
+var PUSHARY_PERMISSION_RULE = "mcp__pushary__*";
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var ensureRecord = (target, key) => {
+  const existing = asRecord(target[key]);
+  if (existing) return existing;
+  const created = {};
+  target[key] = created;
+  return created;
+};
+var isPusharyPermission = (rule) => typeof rule === "string" && (rule.includes("pushary") || rule.includes("MCP(pushary"));
+var HOOK_BINARIES = /* @__PURE__ */ new Set([
+  ...CLAUDE_HOOK_EVENTS.map((hook) => hook.binary),
+  HOOK_LOCATOR_BINARY
+]);
+var namesPusharyBinary = (command) => command.split(/[\s/\\"']+/).some((segment) => HOOK_BINARIES.has(segment.replace(/\.(cmd|exe)$/i, "")));
+var isPusharyHook = (entry2, scope) => {
+  const hooks = asRecord(entry2)?.hooks;
+  if (!Array.isArray(hooks)) return false;
+  return hooks.some((hook) => {
+    const command = String(asRecord(hook)?.command ?? "");
+    if (isProtectedByScope(command, scope)) return false;
+    return namesPusharyBinary(command);
+  });
+};
+var pusharyMcpServer = (apiKey) => ({
+  type: "http",
+  url: PUSHARY_MCP_URL,
+  headers: { Authorization: `Bearer ${apiKey}` }
+});
+var addClaudeMcpServer = (config, apiKey) => {
+  const mcpServers = ensureRecord(config, "mcpServers");
+  mcpServers.pushary = pusharyMcpServer(apiKey);
+};
+var isClaudeMcpSnapshot = (value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const snapshot = value;
+  return typeof snapshot.hadMcpServers === "boolean" && typeof snapshot.mcpServersWasRecord === "boolean" && (!snapshot.hadMcpServers || snapshot.mcpServersWasRecord || Object.hasOwn(snapshot, "mcpServers")) && typeof snapshot.hadPushary === "boolean" && (!snapshot.hadPushary || Object.hasOwn(snapshot, "pushary")) && (!Object.hasOwn(snapshot, "installedPushary") || asRecord(snapshot.installedPushary)?.type === "http" && asRecord(snapshot.installedPushary)?.url === PUSHARY_MCP_URL);
+};
+var captureClaudeMcpServer = (config, apiKey) => {
+  const mcpServers = asRecord(config.mcpServers);
+  const hadMcpServers = Object.hasOwn(config, "mcpServers");
+  return {
+    hadMcpServers,
+    mcpServersWasRecord: Boolean(mcpServers),
+    ...hadMcpServers && !mcpServers ? { mcpServers: structuredClone(config.mcpServers) } : {},
+    hadPushary: Boolean(mcpServers && Object.hasOwn(mcpServers, "pushary")),
+    ...mcpServers && Object.hasOwn(mcpServers, "pushary") ? { pushary: structuredClone(mcpServers.pushary) } : {},
+    ...apiKey ? { installedPushary: pusharyMcpServer(apiKey) } : {}
+  };
+};
+var updateClaudeMcpSnapshot = (snapshot, apiKey) => ({
+  ...snapshot,
+  installedPushary: pusharyMcpServer(apiKey)
+});
+var restoreClaudeMcpServer = (config, snapshot) => {
+  const mcpServers = asRecord(config.mcpServers);
+  const current = asRecord(mcpServers?.pushary);
+  if (Object.hasOwn(snapshot, "installedPushary")) {
+    if (!isDeepStrictEqual(mcpServers?.pushary, snapshot.installedPushary)) return false;
+  } else if (current?.type !== "http" || current.url !== PUSHARY_MCP_URL) {
+    return false;
+  }
+  if (!snapshot.mcpServersWasRecord) {
+    if (Object.keys(mcpServers).length === 1) {
+      if (snapshot.hadMcpServers) config.mcpServers = structuredClone(snapshot.mcpServers);
+      else delete config.mcpServers;
+    } else {
+      delete mcpServers.pushary;
+    }
+  } else if (snapshot.hadPushary) {
+    mcpServers.pushary = structuredClone(snapshot.pushary);
+  } else {
+    delete mcpServers.pushary;
+    if (!snapshot.hadMcpServers && Object.keys(mcpServers).length === 0) delete config.mcpServers;
+  }
+  return true;
+};
+var removeClaudeMcpServers = (config) => {
+  let changed = false;
+  const removeFrom = (target) => {
+    const mcpServers = asRecord(target.mcpServers);
+    if (!mcpServers?.pushary) return;
+    delete mcpServers.pushary;
+    if (Object.keys(mcpServers).length === 0) delete target.mcpServers;
+    changed = true;
+  };
+  removeFrom(config);
+  const projects = asRecord(config.projects);
+  if (projects) {
+    for (const project of Object.values(projects)) {
+      const projectConfig = asRecord(project);
+      if (projectConfig) removeFrom(projectConfig);
+    }
+  }
+  return changed;
+};
+var addPusharyToolPermissions = (settings) => {
+  const permissions = ensureRecord(settings, "permissions");
+  const allow = Array.isArray(permissions.allow) ? permissions.allow : [];
+  const filtered = allow.filter((rule) => !isPusharyPermission(rule));
+  if (!filtered.includes(PUSHARY_PERMISSION_RULE)) {
+    filtered.push(PUSHARY_PERMISSION_RULE);
+  }
+  permissions.allow = filtered;
+};
+var addPusharyHooks = (settings, binDir, version = null) => {
+  const resolve = (name) => guardBinary(binDir ? join(binDir, name) : name);
+  const hooks = ensureRecord(settings, "hooks");
+  const supported = new Map(supportedClaudeEvents(version).map((hook) => [hook.event, hook]));
+  for (const known of CLAUDE_HOOK_EVENTS) {
+    const current = hooks[known.event];
+    const others = (Array.isArray(current) ? current : []).filter((item) => !isPusharyHook(item));
+    const definition = supported.get(known.event);
+    if (definition) {
+      hooks[known.event] = [...others, entry(definition, resolve)];
+    } else if (others.length > 0) {
+      hooks[known.event] = others;
+    } else {
+      delete hooks[known.event];
+    }
+  }
+};
+var entry = (definition, resolve) => ({
+  ...definition.matcher ? { matcher: definition.matcher } : {},
+  hooks: [{
+    type: "command",
+    command: resolve(definition.binary),
+    timeout: definition.timeout
+  }]
+});
+var removePusharySettings = (settings, scope) => {
+  let changed = scope?.keepMcpServer === true ? false : removeClaudeMcpServers(settings);
+  const permissions = scope?.keepMcpServer === true ? void 0 : asRecord(settings.permissions);
+  if (permissions && Array.isArray(permissions.allow)) {
+    const filtered = permissions.allow.filter((rule) => !isPusharyPermission(rule));
+    if (filtered.length !== permissions.allow.length) {
+      if (filtered.length === 0) {
+        delete permissions.allow;
+      } else {
+        permissions.allow = filtered;
+      }
+      if (Object.keys(permissions).length === 0) delete settings.permissions;
+      changed = true;
+    }
+  }
+  const hooks = asRecord(settings.hooks);
+  if (hooks) {
+    for (const { event: key } of CLAUDE_HOOK_EVENTS) {
+      const entries = hooks[key];
+      if (!Array.isArray(entries)) continue;
+      const filtered = entries.filter((entry2) => !isPusharyHook(entry2, scope));
+      if (filtered.length !== entries.length) {
+        if (filtered.length === 0) {
+          delete hooks[key];
+        } else {
+          hooks[key] = filtered;
+        }
+        changed = true;
+      }
+    }
+    if (Object.keys(hooks).length === 0) delete settings.hooks;
+  }
+  return changed;
+};
+
+export {
+  addClaudeMcpServer,
+  isClaudeMcpSnapshot,
+  captureClaudeMcpServer,
+  updateClaudeMcpSnapshot,
+  restoreClaudeMcpServer,
+  removeClaudeMcpServers,
+  addPusharyToolPermissions,
+  addPusharyHooks,
+  removePusharySettings
+};

package/dist/{chunk-QKNLW7H6.js → chunk-Y24D5ZWS.js}

@@ -1,10 +1,10 @@
 import {
   defersToNativeMode
-} from "./chunk-OYNPLEXP.js";
+} from "./chunk-C2MV4G4A.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-2ORRI66J.js";
+} from "./chunk-UQSKCQBO.js";
 import {
   denyReasonFrom,
   isDeferAnswer
@@ -19,7 +19,7 @@ import {
   reportEvent,
   settleQuestionsForToolUse,
   throttlePass
-} from "./chunk-5HGLZGI4.js";
+} from "./chunk-J55K6YS4.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -37,14 +37,14 @@ import {
   describeToolCall,
   permissionDeniedAction,
   scopePathFor
-} from "./chunk-4PE2SQVM.js";
+} from "./chunk-VLKEAYJ4.js";
 import {
   PRETOOLUSE_HANDLED_TOOLS,
   PRETOOLUSE_PHONE_ANSWERED_TOOLS
-} from "./chunk-Y3UGCQQC.js";
+} from "./chunk-TTO76NZJ.js";
 import {
   getMachineId
-} from "./chunk-NVPYRDCT.js";
+} from "./chunk-SSQ5X6SA.js";
 import {
   getApiKey,
   getBaseUrl
@@ -61,7 +61,7 @@ import {
   parseAgentQuestions,
   resolveGate,
   stoppedOutput
-} from "./chunk-Z6CP5ZZD.js";
+} from "./chunk-VOWZ5VOO.js";
 
 // src/decision-episode.ts
 var EPISODE_PATH = "/api/agent/decision-episode";