@pushary/agent-hooks 0.95.8 → 0.97.0

package/dist/bin/pushary-upgrade.js

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import {
   reapplyAllAgents
-} from "../chunk-R6LBGKWQ.js";
-import "../chunk-4DUEIUUO.js";
+} from "../chunk-DOKFLZWL.js";
+import "../chunk-YRXVC4HL.js";
 import {
   waitForMachineReadiness
-} from "../chunk-RE25RJ5A.js";
-import "../chunk-ATKGKAP6.js";
+} from "../chunk-3SNTEHOH.js";
+import "../chunk-6WJKYD3Q.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "../chunk-54W7ELDQ.js";
-import "../chunk-QD73WATQ.js";
+} from "../chunk-DNLFSRCF.js";
+import "../chunk-FU5SQKAY.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
@@ -23,26 +23,23 @@ import {
   replaceDaemonService,
   stopDaemonService,
   waitForDaemonRemoteProof
-} from "../chunk-I7LKI4WO.js";
-import "../chunk-QV266EGS.js";
-import "../chunk-3AJIK5AO.js";
+} from "../chunk-LYWTLNMG.js";
+import "../chunk-IBRX7LRE.js";
 import {
   needsShell
 } from "../chunk-XHKBHWLX.js";
-import {
-  execNpm,
-  npmErrorMessage,
-  resolveGlobalBinary
-} from "../chunk-L4ZCFMWW.js";
-import "../chunk-XUTSZYYJ.js";
-import "../chunk-E47WV7BJ.js";
+import "../chunk-QFAZ6QCT.js";
+import "../chunk-IZKCA35M.js";
 import {
   claudeJson,
   codexConfigToml,
   cursorPluginDir,
+  execNpm,
   geminiSettings,
+  npmErrorMessage,
+  resolveGlobalBinary,
   vscodePluginDir
-} from "../chunk-NOVA7KZ2.js";
+} from "../chunk-67RNDRKL.js";
 import {
   exitOnHelpFlag
 } from "../chunk-GOQHN2UH.js";
@@ -52,13 +49,13 @@ import {
 } from "../chunk-DINDL2CF.js";
 import {
   readControlMode
-} from "../chunk-VMQU7YEJ.js";
+} from "../chunk-VF7YOT2W.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-L7NOG547.js";
+import "../chunk-VTUN7WSG.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
-import "../chunk-MC5WUOJJ.js";
+import "../chunk-HUZW6SEO.js";
 
 // bin/pushary-upgrade.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-wait.js

@@ -4,8 +4,8 @@ import {
 } from "../chunk-CVWG2N3Y.js";
 import {
   exitOnFailedResponse
-} from "../chunk-SDNTRS76.js";
-import "../chunk-BQL7UDIB.js";
+} from "../chunk-VDTC5DEM.js";
+import "../chunk-SW37HB27.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
@@ -28,7 +28,7 @@ import {
   getApiKey,
   getBaseUrl
 } from "../chunk-2UMNXADU.js";
-import "../chunk-MC5WUOJJ.js";
+import "../chunk-HUZW6SEO.js";
 
 // bin/pushary-wait.ts
 exitOnHelpFlag("wait");

package/dist/{chunk-RE25RJ5A.js → chunk-3SNTEHOH.js}

@@ -2,24 +2,24 @@ import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-54W7ELDQ.js";
+} from "./chunk-DNLFSRCF.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-I7LKI4WO.js";
+} from "./chunk-LYWTLNMG.js";
 import {
   getMachineId
-} from "./chunk-E47WV7BJ.js";
+} from "./chunk-IZKCA35M.js";
 import {
   getPackageVersion
 } from "./chunk-DINDL2CF.js";
 import {
   readControlMode,
   readKeySource
-} from "./chunk-VMQU7YEJ.js";
+} from "./chunk-VF7YOT2W.js";
 import {
   getBaseUrl
 } from "./chunk-2UMNXADU.js";

package/dist/{chunk-R3OZ5ISU.js → chunk-4AXWBCCO.js}

@@ -1,15 +1,15 @@
 import {
   AGENT_CHOICES
-} from "./chunk-XZWUOCJZ.js";
+} from "./chunk-H4VNAOCG.js";
 import {
   isBridgeLocator
-} from "./chunk-QJPYJVL3.js";
+} from "./chunk-BYH75I7Y.js";
 import {
   pusharyHookExecutable
-} from "./chunk-QD73WATQ.js";
+} from "./chunk-FU5SQKAY.js";
 import {
   BELL_HOOK_BINARY
-} from "./chunk-GOPIMNVC.js";
+} from "./chunk-WIKEADOS.js";
 
 // src/setup/hook-ownership.ts
 var commandsIn = (value) => {

package/dist/{chunk-XEVOPOKT.js → chunk-5ODZEFP3.js}

@@ -1,6 +1,6 @@
 import {
   registerTranscript
-} from "./chunk-3YFJGKJQ.js";
+} from "./chunk-6VXZKOBB.js";
 
 // src/admission.ts
 import { readFileSync } from "fs";

package/dist/{chunk-NOVA7KZ2.js → chunk-67RNDRKL.js}

@@ -1,7 +1,222 @@
 import {
   HOOK_BUDGETS,
-  HOOK_LOCATOR_BINARY
-} from "./chunk-MC5WUOJJ.js";
+  HOOK_LOCATOR_BINARY,
+  withHookHoldBudget
+} from "./chunk-HUZW6SEO.js";
+
+// src/npm.ts
+import { execFileSync, execSync } from "child_process";
+import { existsSync, readFileSync, realpathSync } from "fs";
+import { dirname, isAbsolute, join, relative, resolve } from "path";
+var cleanNpmEnv = () => {
+  const env = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (key.toLowerCase().startsWith("npm_config_workspace")) continue;
+    env[key] = value;
+  }
+  return env;
+};
+var npmErrorMessage = (err) => {
+  const e = err;
+  const text = [e?.stderr, e?.stdout].map((part) => part ? part.toString() : "").join("\n");
+  const line = text.split("\n").map((l) => l.replace(/^npm error\s*/i, "").trim()).find((l) => l && !l.startsWith("A complete log") && !/^code\s/i.test(l));
+  return line || e?.message || String(err);
+};
+var execNpm = (args, options = {}) => {
+  return execSync(`npm ${args}`, {
+    timeout: 12e4,
+    stdio: "pipe",
+    ...options,
+    env: { ...cleanNpmEnv(), ...options.env ?? {} }
+  });
+};
+var resolveGlobalBinary = (name) => {
+  try {
+    const prefix = execNpm("prefix -g --no-workspaces", { timeout: 5e3 }).toString().trim();
+    const candidates = process.platform === "win32" ? [join(prefix, `${name}.cmd`), join(prefix, name)] : [join(prefix, "bin", name)];
+    return candidates.find(existsSync);
+  } catch {
+    return void 0;
+  }
+};
+var resolvePathBinary = (name, platform = process.platform) => {
+  try {
+    return execFileSync(platform === "win32" ? "where" : "which", [name], {
+      encoding: "utf8",
+      stdio: "pipe",
+      timeout: 5e3
+    }).split(/\r?\n/, 1)[0]?.trim() || void 0;
+  } catch {
+    return void 0;
+  }
+};
+var resolveBinary = (name) => resolveGlobalBinary(name) ?? resolvePathBinary(name);
+var resolvePackageVersionFromBinary = (binary, packageName) => {
+  try {
+    let dir = dirname(realpathSync(binary));
+    const packagePath = packageName.split("/");
+    for (let depth = 0; depth < 8; depth++) {
+      for (const manifest of [
+        join(dir, "package.json"),
+        join(dir, "node_modules", ...packagePath, "package.json")
+      ]) {
+        try {
+          const value = JSON.parse(readFileSync(manifest, "utf8"));
+          if (value.name === packageName && typeof value.version === "string") return value.version;
+        } catch {
+        }
+      }
+      const parent = dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  } catch {
+  }
+  return void 0;
+};
+var resolveGlobalPackageVersion = (name) => {
+  try {
+    const result = JSON.parse(execNpm("list -g --depth=0 --json --no-workspaces", { timeout: 5e3 }).toString());
+    const value = result.dependencies?.[name]?.version;
+    return typeof value === "string" ? value : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var localImportsPresent = (entry, packageDir, seen = /* @__PURE__ */ new Set()) => {
+  if (seen.has(entry)) return true;
+  seen.add(entry);
+  try {
+    const source = readFileSync(entry, "utf8");
+    for (const match of source.matchAll(/\b(?:import|export)\s+(?:[^"'()]*?\s+from\s+)?["'](\.{1,2}\/[^"']+)["']|\bimport\s*\(\s*["'](\.{1,2}\/[^"']+)["']/g)) {
+      const dependency = resolve(dirname(entry), match[1] ?? match[2]);
+      const localPath = relative(packageDir, dependency);
+      if (localPath.startsWith("..") || isAbsolute(localPath) || !existsSync(dependency)) return false;
+      if (/\.[cm]?js$/.test(dependency) && !localImportsPresent(dependency, packageDir, seen)) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+};
+var packageBinsPresent = (packageDir, prefix, platform = process.platform, requiredFiles = []) => {
+  try {
+    const manifest = JSON.parse(readFileSync(join(packageDir, "package.json"), "utf8"));
+    if (!manifest.bin || typeof manifest.bin !== "object" || Array.isArray(manifest.bin)) return false;
+    const bins = Object.entries(manifest.bin);
+    if (bins.length === 0) return false;
+    if (!requiredFiles.every((path) => existsSync(join(packageDir, path)))) return false;
+    const seen = /* @__PURE__ */ new Set();
+    return bins.every(([name, target]) => {
+      if (typeof target !== "string") return false;
+      const shims = platform === "win32" ? [join(prefix, `${name}.cmd`), join(prefix, name)] : [join(prefix, "bin", name)];
+      const entry = join(packageDir, target);
+      return existsSync(entry) && shims.some(existsSync) && localImportsPresent(entry, packageDir, seen);
+    });
+  } catch {
+    return false;
+  }
+};
+var AGENT_HOOKS_RUNTIME_FILES = [
+  "data/SKILL.md",
+  "data/cursor-plugin/.cursor-plugin/plugin.json",
+  "data/cursor-plugin/hooks/hooks.json",
+  "data/cursor-plugin/mcp.json",
+  "data/cursor-plugin/scripts/pushary-gate.mjs",
+  "data/vscode-plugin/.claude-plugin/plugin.json",
+  "data/vscode-plugin/hooks/hooks.json",
+  "data/vscode-plugin/.mcp.json",
+  "data/vscode-plugin/scripts/pushary-gate.mjs"
+];
+var globalPackageBinsPresent = (name) => {
+  try {
+    const root = execNpm("root -g --no-workspaces", { timeout: 5e3 }).toString().trim();
+    const prefix = execNpm("prefix -g --no-workspaces", { timeout: 5e3 }).toString().trim();
+    return packageBinsPresent(join(root, ...name.split("/")), prefix, process.platform, AGENT_HOOKS_RUNTIME_FILES);
+  } catch {
+    return false;
+  }
+};
+var resolveGlobalBinDir = (probe) => {
+  if (process.platform === "win32") return void 0;
+  const resolved = resolveGlobalBinary(probe);
+  return resolved ? resolved.slice(0, resolved.length - probe.length - 1) : void 0;
+};
+var quoteIfNeeded = (path) => /\s/.test(path) ? `"${path}"` : path;
+var needsGlobalInstall = (requested, installed, binaryPresent) => requested !== installed || !binaryPresent;
+var installState;
+var installGlobally = (options) => {
+  if (installState) {
+    return installState.then((result) => result === "installed" ? "cached" : result);
+  }
+  const started = (async () => {
+    const pinned = process.env.PUSHARY_PIN_GLOBAL_VERSION !== "0";
+    if (pinned && !needsGlobalInstall(
+      options.version,
+      resolveGlobalPackageVersion("@pushary/agent-hooks"),
+      globalPackageBinsPresent("@pushary/agent-hooks")
+    )) {
+      return "skipped";
+    }
+    const spec = pinned && options.version && options.version !== "0.0.0" ? `@pushary/agent-hooks@${options.version}` : "@pushary/agent-hooks@latest";
+    execNpm(`install -g --no-workspaces ${spec}`, { timeout: options.timeoutMs ?? 12e4 });
+    return "installed";
+  })();
+  installState = started;
+  started.catch(() => {
+    if (installState === started) installState = void 0;
+  });
+  return started;
+};
+
+// src/hook-command.ts
+var HOOK_SHELL = "/bin/sh -c";
+var holdBudgetOf = (hook) => hook.holds ? hook.timeout : void 0;
+var LOCATE = 'B=$(command -v "$0") || exit 0; [ -f "$B" ] || exit 0; [ -x "$B" ] || exit 0';
+var NODE_PRESENT = "command -v node >/dev/null 2>&1 || exit 0";
+var CURSOR_NO_OPINION = { permission: "deny", user_message: "Command denied via Pushary.", agent_message: "Pushary hook is unavailable. Repair the integration before retrying." };
+var shellDoubleQuoted = (text) => `"${text.replace(/(["\\$`])/g, "\\$1")}"`;
+var CURSOR_NATIVE_PROMPT = { permission: "ask" };
+var CURSOR_NATIVE_PROMPT_EVENTS = ["beforeShellExecution", "beforeMCPExecution"];
+var hookEventIsOneOf = (events) => events.flatMap((event) => [`*\\"hook_event_name\\":\\"${event}\\"*`, `*\\"hook_event_name\\":\\ \\"${event}\\"*`]).join("|");
+var CURSOR_MISS = `{ E=$(cat); case "$E" in ${hookEventIsOneOf(CURSOR_NATIVE_PROMPT_EVENTS)}) printf %s ${shellDoubleQuoted(JSON.stringify(CURSOR_NATIVE_PROMPT))} ;; *) printf %s ${shellDoubleQuoted(JSON.stringify(CURSOR_NO_OPINION))} ;; esac; exit 0; }`;
+var HOOK_GUARD_SCRIPTS = {
+  native_binary: `${LOCATE}; exec "$B" "$@"`,
+  node_binary: `${LOCATE}; ${NODE_PRESENT}; exec "$B" "$@"`,
+  node_script: `[ -f "$0" ] || exit 0; ${NODE_PRESENT}; exec node "$0" "$@"`,
+  cursor_gate_script: `[ -f "$0" ] || ${CURSOR_MISS}; command -v node >/dev/null 2>&1 || ${CURSOR_MISS}; exec node "$0" "$@"`
+};
+var BINARY_GUARDS = {
+  native: "native_binary",
+  node: "node_binary"
+};
+var guardKindOf = (target) => {
+  switch (target.kind) {
+    case "node":
+      return "node_script";
+    case "cursor_gate":
+      return "cursor_gate_script";
+    case "binary":
+      return BINARY_GUARDS[target.runtime];
+  }
+};
+var targetPath = (target) => target.kind === "binary" ? target.path : target.script;
+var runsThroughNode = (target) => target.kind !== "binary";
+var guardHookCommand = (target, platform = process.platform) => {
+  const path = quoteIfNeeded(targetPath(target));
+  if (platform === "win32") return runsThroughNode(target) ? `node ${path}` : path;
+  return `${HOOK_SHELL} '${HOOK_GUARD_SCRIPTS[guardKindOf(target)]}' ${path}`;
+};
+var guardBinary = (path, platform) => guardHookCommand({ kind: "binary", path, runtime: "node" }, platform);
+var guardCursorGate = (script, platform) => guardHookCommand({ kind: "cursor_gate", script }, platform);
+var guardedArgv = (target, args = [], platform = process.platform) => {
+  const path = targetPath(target);
+  if (platform === "win32") {
+    return runsThroughNode(target) ? ["node", path, ...args] : [path, ...args];
+  }
+  const [shell, ...shellArgs] = HOOK_SHELL.split(/\s+/);
+  return [shell, ...shellArgs, HOOK_GUARD_SCRIPTS[guardKindOf(target)], path, ...args];
+};
 
 // src/removal-scope.ts
 var namesAppLocator = (command) => command.includes(HOOK_LOCATOR_BINARY);
@@ -10,7 +225,7 @@ var isProtectedByScope = (command, scope) => scope?.keepAppWiring === true && na
 // src/codex-config.ts
 import { createHash } from "crypto";
 import { homedir } from "os";
-import { join } from "path";
+import { join as join2 } from "path";
 
 // src/canonical-json.ts
 var canonicalJson = (value) => {
@@ -23,17 +238,17 @@ var canonicalJson = (value) => {
 // src/codex-config.ts
 var CODEX_HOOK_BINARY = "pushary-codex-hook";
 var codexHome = () => codexHomeFrom(homedir());
-var codexHomeFrom = (home) => process.env.CODEX_HOME?.trim() || join(home, ".codex");
-var codexConfigToml = () => join(codexHome(), "config.toml");
-var codexHooksJson = () => join(codexHome(), "hooks.json");
-var codexAgentsMd = () => join(codexHome(), "AGENTS.md");
-var codexSkillDir = () => join(codexHome(), "skills", "pushary");
+var codexHomeFrom = (home) => process.env.CODEX_HOME?.trim() || join2(home, ".codex");
+var codexConfigToml = () => join2(codexHome(), "config.toml");
+var codexHooksJson = () => join2(codexHome(), "hooks.json");
+var codexAgentsMd = () => join2(codexHome(), "AGENTS.md");
+var codexSkillDir = () => join2(codexHome(), "skills", "pushary");
 var CODEX_HOOK_EVENTS = [
   { event: "PermissionRequest", delivery: "approval", timeout: HOOK_BUDGETS.codex.budgetSeconds, statusMessage: "Waiting for your phone" },
   { event: "PreToolUse", matcher: "Bash|apply_patch|mcp__.*", delivery: "approval", timeout: HOOK_BUDGETS.codex.budgetSeconds, statusMessage: "Checking Pushary policy" },
   { event: "PostToolUse", matcher: "Bash|apply_patch|mcp__.*", delivery: "telemetry", timeout: 10 },
   { event: "UserPromptSubmit", delivery: "telemetry", timeout: 10 },
-  { event: "Stop", delivery: "telemetry", timeout: 10 },
+  { event: "Stop", delivery: "rescue", timeout: HOOK_BUDGETS.codex.budgetSeconds, holds: true },
   // `clear` alongside startup and resume, matching what we already do on Claude
   // Code. Codex names all three in its own SessionStart sources, and without it a
   // session the person started by clearing is one we never see begin.
@@ -115,7 +330,7 @@ var addCodexHooks = (config, command) => {
       ...definition.matcher ? { matcher: definition.matcher } : {},
       hooks: [{
         type: "command",
-        command,
+        command: withHookHoldBudget(command, holdBudgetOf(definition)),
         timeout: definition.timeout,
         ...definition.statusMessage ? { statusMessage: definition.statusMessage } : {}
       }]
@@ -159,7 +374,7 @@ var missingCodexHookEvents = (config) => {
   }).map((definition) => definition.event);
 };
 var codexHookTrustHash = (definition, command) => {
-  const hook = { command, timeout: definition.timeout, type: "command" };
+  const hook = { command: withHookHoldBudget(command, holdBudgetOf(definition)), timeout: definition.timeout, type: "command" };
   if (definition.statusMessage) hook.statusMessage = definition.statusMessage;
   const entry = { hooks: [hook] };
   if (definition.matcher) entry.matcher = definition.matcher;
@@ -308,29 +523,42 @@ var staleTrustKeys = (state, hooksJsonPath, event, currentKey, ourHash) => {
 
 // src/setup/paths.ts
 import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
-var claudeSettings = () => join2(homedir2(), ".claude", "settings.json");
-var claudeJson = () => join2(homedir2(), ".claude.json");
-var claudeSkillDir = () => join2(homedir2(), ".claude", "skills", "pushary");
-var cursorPluginDir = () => join2(homedir2(), ".cursor", "plugins", "local", "pushary");
-var cursorUserHooks = () => join2(homedir2(), ".cursor", "hooks.json");
-var cursorUserMcp = () => join2(homedir2(), ".cursor", "mcp.json");
-var vscodePluginDir = () => join2(homedir2(), ".pushary", "plugins", "vscode");
-var vscodePluginMcp = () => join2(vscodePluginDir(), ".mcp.json");
-var claudeSettingsLocal = () => join2(homedir2(), ".claude", "settings.local.json");
-var pusharyDir = () => join2(homedir2(), ".pushary");
-var claudeMcpReceipt = () => join2(pusharyDir(), "setup", "claude-mcp.json");
-var bridgeAgentKey = () => join2(pusharyDir(), "bridge-auth", "agent-key.json");
-var claudeRegistrationReceipt = () => join2(pusharyDir(), "setup", "claude-registration.json");
-var hermesConfigReceipt = () => join2(pusharyDir(), "setup", "hermes-config.json");
-var hookTakeoverReceipt = (agent) => join2(pusharyDir(), "setup", `hook-takeover-${agent}.json`);
-var codexSkillDir2 = () => join2(codexHome(), "skills", "pushary");
-var codexAgentsMd2 = () => join2(codexHome(), "AGENTS.md");
-var geminiSettings = () => join2(homedir2(), ".gemini", "settings.json");
-var geminiMd = () => join2(homedir2(), ".gemini", "GEMINI.md");
-var pusharyConfigFile = () => join2(homedir2(), ".pushary", "config.json");
+import { join as join3 } from "path";
+var claudeSettings = () => join3(homedir2(), ".claude", "settings.json");
+var claudeJson = () => join3(homedir2(), ".claude.json");
+var claudeSkillDir = () => join3(homedir2(), ".claude", "skills", "pushary");
+var cursorPluginDir = () => join3(homedir2(), ".cursor", "plugins", "local", "pushary");
+var cursorUserHooks = () => join3(homedir2(), ".cursor", "hooks.json");
+var cursorUserMcp = () => join3(homedir2(), ".cursor", "mcp.json");
+var vscodePluginDir = () => join3(homedir2(), ".pushary", "plugins", "vscode");
+var vscodePluginMcp = () => join3(vscodePluginDir(), ".mcp.json");
+var claudeSettingsLocal = () => join3(homedir2(), ".claude", "settings.local.json");
+var pusharyDir = () => join3(homedir2(), ".pushary");
+var claudeMcpReceipt = () => join3(pusharyDir(), "setup", "claude-mcp.json");
+var bridgeAgentKey = () => join3(pusharyDir(), "bridge-auth", "agent-key.json");
+var claudeRegistrationReceipt = () => join3(pusharyDir(), "setup", "claude-registration.json");
+var hermesConfigReceipt = () => join3(pusharyDir(), "setup", "hermes-config.json");
+var hookTakeoverReceipt = (agent) => join3(pusharyDir(), "setup", `hook-takeover-${agent}.json`);
+var codexSkillDir2 = () => join3(codexHome(), "skills", "pushary");
+var codexAgentsMd2 = () => join3(codexHome(), "AGENTS.md");
+var geminiSettings = () => join3(homedir2(), ".gemini", "settings.json");
+var geminiMd = () => join3(homedir2(), ".gemini", "GEMINI.md");
+var pusharyConfigFile = () => join3(homedir2(), ".pushary", "config.json");
 
 export {
+  npmErrorMessage,
+  execNpm,
+  resolveGlobalBinary,
+  resolvePathBinary,
+  resolveBinary,
+  resolvePackageVersionFromBinary,
+  resolveGlobalPackageVersion,
+  resolveGlobalBinDir,
+  installGlobally,
+  holdBudgetOf,
+  guardBinary,
+  guardCursorGate,
+  guardedArgv,
   isProtectedByScope,
   canonicalJson,
   CODEX_HOOK_BINARY,

package/dist/{chunk-3YFJGKJQ.js → chunk-6VXZKOBB.js}

@@ -3,19 +3,19 @@ import {
   loadPin,
   savePin,
   verifyRecipients
-} from "./chunk-EMGGUO2Q.js";
+} from "./chunk-A4AIISZZ.js";
 import {
   hookOwnerOf
-} from "./chunk-R3OZ5ISU.js";
+} from "./chunk-4AXWBCCO.js";
 import {
   ensureDaemonRunning
-} from "./chunk-I7LKI4WO.js";
+} from "./chunk-LYWTLNMG.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-SKPXQRKN.js";
+} from "./chunk-CDSA3NTB.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
@@ -23,17 +23,17 @@ import {
 import {
   transcriptEnvironmentPreference,
   transcriptsEnabled
-} from "./chunk-VERXHIQF.js";
+} from "./chunk-C2FYSFTQ.js";
 import {
   codexHome,
   pusharyDir
-} from "./chunk-NOVA7KZ2.js";
+} from "./chunk-67RNDRKL.js";
 import {
   readTranscriptPreference
-} from "./chunk-VMQU7YEJ.js";
+} from "./chunk-VF7YOT2W.js";
 import {
   writeJsonAtomic
-} from "./chunk-L7NOG547.js";
+} from "./chunk-VTUN7WSG.js";
 import {
   getApiKey,
   getBaseUrl

package/dist/{chunk-ATKGKAP6.js → chunk-6WJKYD3Q.js}

@@ -1,16 +1,16 @@
 import {
   CLAUDE_HOOK_EVENTS,
   supportedClaudeEvents
-} from "./chunk-QV266EGS.js";
-import {
-  guardBinary
-} from "./chunk-3AJIK5AO.js";
+} from "./chunk-IBRX7LRE.js";
 import {
+  guardBinary,
+  holdBudgetOf,
   isProtectedByScope
-} from "./chunk-NOVA7KZ2.js";
+} from "./chunk-67RNDRKL.js";
 import {
-  HOOK_LOCATOR_BINARY
-} from "./chunk-MC5WUOJJ.js";
+  HOOK_LOCATOR_BINARY,
+  withHookHoldBudget
+} from "./chunk-HUZW6SEO.js";
 
 // src/claude-config.ts
 import { join } from "path";
@@ -142,7 +142,7 @@ var entry = (definition, resolve) => ({
   ...definition.matcher ? { matcher: definition.matcher } : {},
   hooks: [{
     type: "command",
-    command: resolve(definition.binary),
+    command: withHookHoldBudget(resolve(definition.binary), holdBudgetOf(definition)),
     timeout: definition.timeout
   }]
 });

package/dist/{chunk-EMGGUO2Q.js → chunk-A4AIISZZ.js}

@@ -1,6 +1,6 @@
 import {
   writeJsonAtomicDurable
-} from "./chunk-L7NOG547.js";
+} from "./chunk-VTUN7WSG.js";
 
 // src/transcript-recipient-pin.ts
 import { existsSync, mkdirSync, readFileSync, rmSync } from "fs";

package/dist/{chunk-N6FAXQDD.js → chunk-AXSDMDJI.js}

@@ -1,6 +1,6 @@
 import {
   resolvePathBinary
-} from "./chunk-L4ZCFMWW.js";
+} from "./chunk-67RNDRKL.js";
 
 // src/hermes-config.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-XO3JR3OP.js → chunk-B3557BDL.js}

@@ -15,10 +15,10 @@ import {
 } from "./chunk-EYRGBYZG.js";
 import {
   reportedInstallSource
-} from "./chunk-L7NOG547.js";
+} from "./chunk-VTUN7WSG.js";
 import {
   isAnswerSource
-} from "./chunk-MC5WUOJJ.js";
+} from "./chunk-HUZW6SEO.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {

package/dist/{chunk-QJPYJVL3.js → chunk-BYH75I7Y.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_LOCATOR_BINARY
-} from "./chunk-MC5WUOJJ.js";
+} from "./chunk-HUZW6SEO.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-VERXHIQF.js → chunk-C2FYSFTQ.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-VMQU7YEJ.js";
+} from "./chunk-VF7YOT2W.js";
 
 // src/transcript-setting.ts
 var transcriptEnvironmentPreference = () => {

package/dist/{chunk-SKPXQRKN.js → chunk-CDSA3NTB.js}

@@ -1,6 +1,6 @@
 import {
   redactSecrets
-} from "./chunk-MC5WUOJJ.js";
+} from "./chunk-HUZW6SEO.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";