@pushary/agent-hooks 0.97.0 → 0.99.0

package/dist/{chunk-VTUN7WSG.js → chunk-4LL6LG5X.js}

@@ -1,10 +1,3 @@
-import {
-  configFilePath
-} from "./chunk-2UMNXADU.js";
-import {
-  normalizeInstallSource
-} from "./chunk-HUZW6SEO.js";
-
 // src/cli/fsx.ts
 import { copyFileSync, existsSync, fsyncSync, mkdirSync, openSync, closeSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "fs";
 import { dirname, join } from "path";
@@ -64,45 +57,10 @@ var writeJsonAtomicDurable = (filePath, data, mode) => {
   }
 };
 
-// src/install-source.ts
-import { readFileSync as readFileSync2 } from "fs";
-var ENV_OVERRIDE = "PUSHARY_INSTALL_SOURCE";
-var PLUGIN_ROOT = "CLAUDE_PLUGIN_ROOT";
-var EDITOR_PLUGIN_MARKERS = ["cursor-plugin", "vscode-plugin"];
-var detectInstallSource = (env = process.env, argv = process.argv) => {
-  const declared = env[ENV_OVERRIDE]?.trim();
-  if (declared) return normalizeInstallSource(declared);
-  const pluginRoot = env[PLUGIN_ROOT]?.trim();
-  if (pluginRoot) {
-    return EDITOR_PLUGIN_MARKERS.some((marker) => pluginRoot.includes(marker)) ? "editor_plugin" : "claude_plugin";
-  }
-  const entry = argv[1] ?? "";
-  if (entry.includes("_npx")) return "npx";
-  if (entry) return "npm";
-  return "unknown";
-};
-var storedInstallSource = () => {
-  try {
-    const parsed = JSON.parse(readFileSync2(configFilePath(), "utf-8"));
-    const stored = parsed.installSource;
-    return typeof stored === "string" && stored ? normalizeInstallSource(stored) : void 0;
-  } catch {
-    return void 0;
-  }
-};
-var resolveInstallSourceFor = (config) => {
-  const stored = config.installSource;
-  if (typeof stored === "string" && stored) return normalizeInstallSource(stored);
-  return detectInstallSource();
-};
-var reportedInstallSource = () => storedInstallSource() ?? detectInstallSource();
-
 export {
   readJsonSafe,
   backupFile,
   writeFileAtomic,
   writeJsonAtomic,
-  writeJsonAtomicDurable,
-  resolveInstallSourceFor,
-  reportedInstallSource
+  writeJsonAtomicDurable
 };

package/dist/{chunk-VF7YOT2W.js → chunk-4PBCNVI3.js}

@@ -1,10 +1,12 @@
+import {
+  resolveInstallSourceFor
+} from "./chunk-GCD3SQSV.js";
 import {
   backupFile,
   readJsonSafe,
-  resolveInstallSourceFor,
   writeFileAtomic,
   writeJsonAtomic
-} from "./chunk-VTUN7WSG.js";
+} from "./chunk-4LL6LG5X.js";
 import {
   configFilePath
 } from "./chunk-2UMNXADU.js";

package/dist/{chunk-IZKCA35M.js → chunk-562UJ2DA.js}

@@ -1,9 +1,9 @@
 import {
   pusharyDir
-} from "./chunk-67RNDRKL.js";
+} from "./chunk-JBJBVERL.js";
 import {
   writeFileAtomic
-} from "./chunk-VTUN7WSG.js";
+} from "./chunk-4LL6LG5X.js";
 
 // src/identity.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-ROTIPRM4.js → chunk-5KLAETSU.js}

@@ -3,7 +3,7 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-CDSA3NTB.js";
+} from "./chunk-XPPXOKIG.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords

package/dist/{chunk-DGUMR5LZ.js → chunk-64WARXGV.js}

@@ -18,11 +18,11 @@ import {
   summarizeStop,
   taskTitleFrom,
   toolResultErrorText
-} from "./chunk-VCKQ45QA.js";
+} from "./chunk-A76GNRIK.js";
 import {
   NOTIFICATION_PUSH_TYPES,
   POSTTOOLUSE_MIRROR_ONLY_TOOLS
-} from "./chunk-QFAZ6QCT.js";
+} from "./chunk-OPR2BPD4.js";
 import {
   cancelQuestion,
   isPolicyConfig,
@@ -31,13 +31,13 @@ import {
 } from "./chunk-LGXUGYUH.js";
 import {
   getMachineId
-} from "./chunk-IZKCA35M.js";
+} from "./chunk-562UJ2DA.js";
 import {
   withRetry
 } from "./chunk-EYRGBYZG.js";
 import {
   reportedInstallSource
-} from "./chunk-VTUN7WSG.js";
+} from "./chunk-GCD3SQSV.js";
 import {
   getApiKey,
   getBaseUrl
@@ -54,7 +54,7 @@ import {
   pendingCommandEvents,
   resolveAutoResolveOrigin,
   resolvePolicy
-} from "./chunk-HUZW6SEO.js";
+} from "./chunk-OUAE3GKO.js";
 
 // src/policy.ts
 import { createHash } from "crypto";

package/dist/{chunk-VDTC5DEM.js → chunk-6C6MS57P.js}

@@ -1,7 +1,7 @@
 import {
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-SW37HB27.js";
+} from "./chunk-3RVCQDC4.js";
 import {
   createIo
 } from "./chunk-5RUIFDTP.js";

package/dist/{chunk-KDPYXMUI.js → chunk-6IFUXNFX.js}

@@ -1,9 +1,9 @@
 import {
   pusharyDir
-} from "./chunk-67RNDRKL.js";
+} from "./chunk-JBJBVERL.js";
 import {
   readJsonSafe
-} from "./chunk-VTUN7WSG.js";
+} from "./chunk-4LL6LG5X.js";
 
 // src/process-ownership.ts
 import { createHash, randomUUID } from "crypto";

package/dist/{chunk-XDMHLQMH.js → chunk-6KLCP7VF.js}

@@ -1,17 +1,17 @@
 import {
   canonicalGateInputs
-} from "./chunk-VCKQ45QA.js";
+} from "./chunk-A76GNRIK.js";
 import {
   canonicalJson
-} from "./chunk-67RNDRKL.js";
+} from "./chunk-JBJBVERL.js";
 import {
   writeFileAtomic
-} from "./chunk-VTUN7WSG.js";
+} from "./chunk-4LL6LG5X.js";
 import {
   BLOCKED_ACTION_GRANT_TTL_SECONDS,
   blockedActionIdentity,
   shouldDeferToNativeMode
-} from "./chunk-HUZW6SEO.js";
+} from "./chunk-OUAE3GKO.js";
 
 // src/native-defer.ts
 var nativeDeferOptions = () => {

package/dist/{chunk-VCKQ45QA.js → chunk-A76GNRIK.js}

@@ -6,7 +6,7 @@ import {
   GATE_MAX_TOOL_INPUTS,
   redactSecrets,
   redactSecretsDeep
-} from "./chunk-HUZW6SEO.js";
+} from "./chunk-OUAE3GKO.js";
 
 // ../hook-mapping/src/describe.ts
 import { isAbsolute, relative, resolve } from "path";

package/dist/{chunk-ICUBJNFL.js → chunk-CP34FI4B.js}

@@ -1,6 +1,6 @@
 import {
   SETUP_FLAGS
-} from "./chunk-H4VNAOCG.js";
+} from "./chunk-LBNAGGLV.js";
 import {
   parseFlags
 } from "./chunk-GMXKITVA.js";
@@ -14,7 +14,7 @@ import {
   CLAUDE_CONNECTOR_URL,
   COWORK_CONNECTOR_LIMIT,
   COWORK_STANDING_INSTRUCTIONS
-} from "./chunk-HUZW6SEO.js";
+} from "./chunk-OUAE3GKO.js";
 
 // src/cli/cowork.ts
 import { readFileSync } from "fs";

package/dist/{chunk-LYWTLNMG.js → chunk-CRFLU455.js}

@@ -4,23 +4,23 @@ import {
 } from "./chunk-XHKBHWLX.js";
 import {
   getMachineId
-} from "./chunk-IZKCA35M.js";
+} from "./chunk-562UJ2DA.js";
 import {
   pusharyDir,
   resolveGlobalBinary
-} from "./chunk-67RNDRKL.js";
+} from "./chunk-JBJBVERL.js";
 import {
   getPackageVersion
 } from "./chunk-DINDL2CF.js";
 import {
   readControlMode
-} from "./chunk-VF7YOT2W.js";
+} from "./chunk-4PBCNVI3.js";
 import {
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic,
   writeJsonAtomicDurable
-} from "./chunk-VTUN7WSG.js";
+} from "./chunk-4LL6LG5X.js";
 import {
   getApiKey
 } from "./chunk-2UMNXADU.js";

package/dist/{chunk-WIKEADOS.js → chunk-EXHXR2X5.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-67RNDRKL.js";
+} from "./chunk-JBJBVERL.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/chunk-GCD3SQSV.js

@@ -0,0 +1,44 @@
+import {
+  configFilePath
+} from "./chunk-2UMNXADU.js";
+import {
+  normalizeInstallSource
+} from "./chunk-OUAE3GKO.js";
+
+// src/install-source.ts
+import { readFileSync } from "fs";
+var ENV_OVERRIDE = "PUSHARY_INSTALL_SOURCE";
+var PLUGIN_ROOT = "CLAUDE_PLUGIN_ROOT";
+var EDITOR_PLUGIN_MARKERS = ["cursor-plugin", "vscode-plugin"];
+var detectInstallSource = (env = process.env, argv = process.argv) => {
+  const declared = env[ENV_OVERRIDE]?.trim();
+  if (declared) return normalizeInstallSource(declared);
+  const pluginRoot = env[PLUGIN_ROOT]?.trim();
+  if (pluginRoot) {
+    return EDITOR_PLUGIN_MARKERS.some((marker) => pluginRoot.includes(marker)) ? "editor_plugin" : "claude_plugin";
+  }
+  const entry = argv[1] ?? "";
+  if (entry.includes("_npx")) return "npx";
+  if (entry) return "npm";
+  return "unknown";
+};
+var storedInstallSource = () => {
+  try {
+    const parsed = JSON.parse(readFileSync(configFilePath(), "utf-8"));
+    const stored = parsed.installSource;
+    return typeof stored === "string" && stored ? normalizeInstallSource(stored) : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var resolveInstallSourceFor = (config) => {
+  const stored = config.installSource;
+  if (typeof stored === "string" && stored) return normalizeInstallSource(stored);
+  return detectInstallSource();
+};
+var reportedInstallSource = () => storedInstallSource() ?? detectInstallSource();
+
+export {
+  resolveInstallSourceFor,
+  reportedInstallSource
+};

package/dist/{chunk-EHQC3GWL.js → chunk-HB2KB7QL.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_BUDGETS,
   OPENCODE_APPROVAL_EVENT
-} from "./chunk-HUZW6SEO.js";
+} from "./chunk-OUAE3GKO.js";
 
 // src/opencode-plugin.ts
 var OPENCODE_PLUGIN_MARKER = "pushary-opencode-plugin w1";

package/dist/{chunk-C2FYSFTQ.js → chunk-ID5FDKDZ.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-VF7YOT2W.js";
+} from "./chunk-4PBCNVI3.js";
 
 // src/transcript-setting.ts
 var transcriptEnvironmentPreference = () => {

package/dist/{chunk-BYH75I7Y.js → chunk-IRLTW6KF.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_LOCATOR_BINARY
-} from "./chunk-HUZW6SEO.js";
+} from "./chunk-OUAE3GKO.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-67RNDRKL.js → chunk-JBJBVERL.js}

@@ -2,7 +2,7 @@ import {
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY,
   withHookHoldBudget
-} from "./chunk-HUZW6SEO.js";
+} from "./chunk-OUAE3GKO.js";
 
 // src/npm.ts
 import { execFileSync, execSync } from "child_process";
@@ -227,6 +227,52 @@ import { createHash } from "crypto";
 import { homedir } from "os";
 import { join as join2 } from "path";
 
+// src/registration-holder.ts
+var asRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+var registeredCommands = (document) => {
+  const hooks = asRecord(document?.hooks);
+  if (!hooks) return [];
+  const found = [];
+  for (const [event, value] of Object.entries(hooks)) {
+    if (!Array.isArray(value)) continue;
+    for (const item of value) {
+      const inner = asRecord(item)?.hooks;
+      if (!Array.isArray(inner)) continue;
+      for (const hook of inner) {
+        const command = asRecord(hook)?.command;
+        if (typeof command === "string") found.push({ event, command });
+      }
+    }
+  }
+  return found;
+};
+var wholeSegments = (command) => command.split(/[\s/\\"']+/).map((segment) => segment.replace(/\.(cmd|exe)$/i, ""));
+var namesLocator = (command) => wholeSegments(command).includes(HOOK_LOCATOR_BINARY);
+var namesCliBinary = (command, cliBinaries) => wholeSegments(command).some((segment) => cliBinaries.has(segment));
+var namesOurBinary = (command, cliBinaries) => namesLocator(command) || namesCliBinary(command, cliBinaries);
+var registrationHolderOf = (document, cliBinaries) => {
+  const commands = registeredCommands(document);
+  if (commands.some(({ command }) => namesLocator(command))) return "app";
+  return commands.some(({ command }) => namesCliBinary(command, cliBinaries)) ? "cli" : "none";
+};
+
+// src/hook-entries.ts
+var registerHookEntry = (existing, isOurs, entry) => {
+  const rewritten = [];
+  let placed = false;
+  for (const item of existing) {
+    if (!isOurs(item)) {
+      rewritten.push(item);
+      continue;
+    }
+    if (placed) continue;
+    rewritten.push(entry);
+    placed = true;
+  }
+  if (!placed) rewritten.push(entry);
+  return rewritten;
+};
+
 // src/canonical-json.ts
 var canonicalJson = (value) => {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
@@ -281,9 +327,9 @@ var CODEX_EVENT_KEY = {
   PostCompact: "post_compact"
 };
 var codexEventKeyOf = (event) => event.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
-var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var asRecord2 = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 var ensureRecord = (target, key) => {
-  const existing = asRecord(target[key]);
+  const existing = asRecord2(target[key]);
   if (existing) return existing;
   const created = {};
   target[key] = created;
@@ -300,9 +346,9 @@ var addCodexMcpServer = (config, apiKey) => {
   delete pushary.tools;
 };
 var readCodexMcpAuth = (config) => {
-  const pushary = asRecord(asRecord(config.mcp_servers)?.pushary);
+  const pushary = asRecord2(asRecord2(config.mcp_servers)?.pushary);
   if (!pushary) return void 0;
-  const authorization = asRecord(pushary.http_headers)?.Authorization;
+  const authorization = asRecord2(pushary.http_headers)?.Authorization;
   if (typeof authorization === "string" && authorization.startsWith("Bearer ")) {
     return { method: "embedded", key: authorization.slice("Bearer ".length).trim() };
   }
@@ -313,20 +359,21 @@ var readCodexMcpAuth = (config) => {
   return void 0;
 };
 var isPusharyCommand = (hook, scope) => {
-  const command = String(asRecord(hook)?.command ?? "");
+  const command = String(asRecord2(hook)?.command ?? "");
   if (isProtectedByScope(command, scope)) return false;
   return command.includes(CODEX_HOOK_BINARY) || command.includes(HOOK_LOCATOR_BINARY);
 };
 var isPusharyCodexHook = (entry, scope) => {
-  const hooks = asRecord(entry)?.hooks;
+  const hooks = asRecord2(entry)?.hooks;
   return Array.isArray(hooks) && hooks.some((hook) => isPusharyCommand(hook, scope));
 };
+var CODEX_CLI_BINARIES = /* @__PURE__ */ new Set([CODEX_HOOK_BINARY]);
+var codexRegistrationHolder = (hooksConfig) => registrationHolderOf(hooksConfig, CODEX_CLI_BINARIES);
 var addCodexHooks = (config, command) => {
   const hooks = ensureRecord(config, "hooks");
   for (const definition of CODEX_HOOK_EVENTS) {
     const existing = Array.isArray(hooks[definition.event]) ? hooks[definition.event] : [];
-    const entries = existing.filter((entry) => !isPusharyCodexHook(entry));
-    entries.push({
+    hooks[definition.event] = registerHookEntry(existing, isPusharyCodexHook, {
       ...definition.matcher ? { matcher: definition.matcher } : {},
       hooks: [{
         type: "command",
@@ -335,11 +382,10 @@ var addCodexHooks = (config, command) => {
         ...definition.statusMessage ? { statusMessage: definition.statusMessage } : {}
       }]
     });
-    hooks[definition.event] = entries;
   }
 };
 var removeCodexHooks = (config, scope) => {
-  const hooks = asRecord(config.hooks);
+  const hooks = asRecord2(config.hooks);
   if (!hooks) return false;
   let changed = false;
   for (const definition of CODEX_HOOK_EVENTS) {
@@ -359,7 +405,7 @@ var removeCodexHooks = (config, scope) => {
   return changed;
 };
 var hasCodexHooks = (config) => {
-  const hooks = asRecord(config.hooks);
+  const hooks = asRecord2(config.hooks);
   if (!hooks) return false;
   return CODEX_HOOK_EVENTS.some((definition) => {
     const entries = hooks[definition.event];
@@ -367,7 +413,7 @@ var hasCodexHooks = (config) => {
   });
 };
 var missingCodexHookEvents = (config) => {
-  const hooks = asRecord(config.hooks);
+  const hooks = asRecord2(config.hooks);
   return CODEX_HOOK_EVENTS.filter((definition) => {
     const entries = hooks?.[definition.event];
     return !Array.isArray(entries) || !entries.some((entry) => isPusharyCodexHook(entry));
@@ -384,22 +430,22 @@ var codexEntryTrustHash = (eventKey, entry) => {
   const hooks = Array.isArray(entry.hooks) ? entry.hooks : [];
   const identity = {
     event_name: eventKey,
-    hooks: hooks.map((hook) => ({ async: false, ...asRecord(hook) }))
+    hooks: hooks.map((hook) => ({ async: false, ...asRecord2(hook) }))
   };
   if (typeof entry.matcher === "string") identity.matcher = entry.matcher;
   return "sha256:" + createHash("sha256").update(canonicalJson(identity), "utf8").digest("hex");
 };
 var codexTrustSchemeAgrees = (hooksConfig, config, hooksJsonPath) => {
-  const hooks = asRecord(hooksConfig?.hooks);
-  const state = asRecord(asRecord(config.hooks)?.state);
+  const hooks = asRecord2(hooksConfig?.hooks);
+  const state = asRecord2(asRecord2(config.hooks)?.state);
   if (!hooks || !state) return false;
   for (const [event, entries] of Object.entries(hooks)) {
     if (!Array.isArray(entries)) continue;
     const eventKey = CODEX_EVENT_KEY[event] ?? codexEventKeyOf(event);
     for (const [index, entry] of entries.entries()) {
-      const record = asRecord(entry);
+      const record = asRecord2(entry);
       if (!record) continue;
-      const stored = asRecord(state[`${hooksJsonPath}:${eventKey}:${index}:0`])?.trusted_hash;
+      const stored = asRecord2(state[`${hooksJsonPath}:${eventKey}:${index}:0`])?.trusted_hash;
       if (typeof stored !== "string") continue;
       if (stored === codexEntryTrustHash(eventKey, record)) return true;
     }
@@ -407,22 +453,49 @@ var codexTrustSchemeAgrees = (hooksConfig, config, hooksJsonPath) => {
   return false;
 };
 var codexHookPositions = (hooksConfig) => {
-  const hooks = asRecord(hooksConfig?.hooks);
+  const hooks = asRecord2(hooksConfig?.hooks);
   const positions = {};
   for (const definition of CODEX_HOOK_EVENTS) {
     const entries = hooks?.[definition.event];
     if (!Array.isArray(entries)) continue;
     const entryIndex = entries.findIndex((entry) => isPusharyCodexHook(entry));
     if (entryIndex < 0) continue;
-    const inner = asRecord(entries[entryIndex])?.hooks;
+    const inner = asRecord2(entries[entryIndex])?.hooks;
     const hookIndex = Array.isArray(inner) ? inner.findIndex((hook) => isPusharyCommand(hook)) : -1;
     positions[definition.event] = [entryIndex, Math.max(hookIndex, 0)];
   }
   return positions;
 };
 var codexHookStateKey = (hooksJsonPath, event, position) => `${hooksJsonPath}:${CODEX_EVENT_KEY[event]}:${position[0]}:${position[1]}`;
+var codexVacatedIndexes = (hooksConfig) => {
+  const hooks = asRecord2(hooksConfig?.hooks);
+  const vacated = {};
+  for (const definition of CODEX_HOOK_EVENTS) {
+    const entries = hooks?.[definition.event];
+    if (!Array.isArray(entries)) continue;
+    const ours = entries.flatMap((entry, index) => isPusharyCodexHook(entry) ? [index] : []);
+    if (ours.length > 1) vacated[definition.event] = ours[1];
+  }
+  return vacated;
+};
+var dropVacatedCodexHookTrust = (config, hooksJsonPath, vacated) => {
+  const state = asRecord2(asRecord2(config.hooks)?.state);
+  if (!state) return false;
+  let changed = false;
+  for (const [event, from] of Object.entries(vacated)) {
+    const prefix = `${hooksJsonPath}:${CODEX_EVENT_KEY[event] ?? codexEventKeyOf(event)}:`;
+    for (const key of Object.keys(state)) {
+      if (!key.startsWith(prefix)) continue;
+      const entryIndex = Number(key.slice(prefix.length).split(":")[0]);
+      if (!Number.isInteger(entryIndex) || entryIndex < from) continue;
+      delete state[key];
+      changed = true;
+    }
+  }
+  return changed;
+};
 var captureCodexHookTrust = (config, hooksJsonPath, positions) => {
-  const state = asRecord(asRecord(config.hooks)?.state);
+  const state = asRecord2(asRecord2(config.hooks)?.state);
   if (!state) return {};
   const snapshot = {};
   for (const [event, position] of Object.entries(positions)) {
@@ -441,16 +514,16 @@ var restoreCodexHookTrust = (config, hooksJsonPath, positions, snapshot) => {
   return true;
 };
 var codexTrustGaps = (config, hooksConfig, hooksJsonPath, command, positions) => {
-  const state = asRecord(asRecord(config.hooks)?.state);
-  const hooks = asRecord(hooksConfig?.hooks);
+  const state = asRecord2(asRecord2(config.hooks)?.state);
+  const hooks = asRecord2(hooksConfig?.hooks);
   const gaps = [];
   for (const definition of CODEX_HOOK_EVENTS) {
     const position = positions[definition.event];
     if (!position) continue;
-    const stored = asRecord(state?.[codexHookStateKey(hooksJsonPath, definition.event, position)])?.trusted_hash;
+    const stored = asRecord2(state?.[codexHookStateKey(hooksJsonPath, definition.event, position)])?.trusted_hash;
     const eventKey = CODEX_EVENT_KEY[definition.event] ?? definition.event;
-    const onDisk = asRecord(
-      asRecord(hooks?.[definition.event]) ?? (Array.isArray(hooks?.[definition.event]) ? hooks[definition.event][position[0]] : void 0)
+    const onDisk = asRecord2(
+      asRecord2(hooks?.[definition.event]) ?? (Array.isArray(hooks?.[definition.event]) ? hooks[definition.event][position[0]] : void 0)
     );
     const diskHash = onDisk ? codexEntryTrustHash(eventKey, onDisk) : void 0;
     if (stored !== void 0 && diskHash !== void 0 && stored === diskHash) {
@@ -466,14 +539,14 @@ var codexTrustGaps = (config, hooksConfig, hooksJsonPath, command, positions) =>
   return gaps;
 };
 var removeCodexMcpServer = (config) => {
-  const servers = asRecord(config.mcp_servers);
+  const servers = asRecord2(config.mcp_servers);
   if (!servers?.pushary) return false;
   delete servers.pushary;
   if (Object.keys(servers).length === 0) delete config.mcp_servers;
   return true;
 };
 var removeCodexHookTrust = (config, hooksJsonPath, positions) => {
-  const state = asRecord(asRecord(config.hooks)?.state);
+  const state = asRecord2(asRecord2(config.hooks)?.state);
   if (!state) return false;
   let changed = false;
   for (const definition of CODEX_HOOK_EVENTS) {
@@ -486,7 +559,7 @@ var removeCodexHookTrust = (config, hooksJsonPath, positions) => {
     }
   }
   if (changed && Object.keys(state).length === 0) {
-    const hooks = asRecord(config.hooks);
+    const hooks = asRecord2(config.hooks);
     if (hooks) {
       delete hooks.state;
       if (Object.keys(hooks).length === 0) delete config.hooks;
@@ -507,7 +580,7 @@ var addCodexHookTrust = (config, hooksJsonPath, command, positions) => {
     if (!position) continue;
     const key = codexHookStateKey(hooksJsonPath, definition.event, position);
     const ours = codexHookTrustHash(definition, command);
-    const existing = asRecord(state[key]) ?? {};
+    const existing = asRecord2(state[key]) ?? {};
     state[key] = { ...existing, trusted_hash: ours };
     for (const stale of staleTrustKeys(state, hooksJsonPath, definition.event, key, ours)) {
       delete state[stale];
@@ -517,7 +590,7 @@ var addCodexHookTrust = (config, hooksJsonPath, command, positions) => {
 var staleTrustKeys = (state, hooksJsonPath, event, currentKey, ourHash) => {
   const prefix = `${hooksJsonPath}:${CODEX_EVENT_KEY[event]}:`;
   return Object.keys(state).filter(
-    (key) => key !== currentKey && key.startsWith(prefix) && asRecord(state[key])?.trusted_hash === ourHash
+    (key) => key !== currentKey && key.startsWith(prefix) && asRecord2(state[key])?.trusted_hash === ourHash
   );
 };
 
@@ -546,6 +619,9 @@ var geminiMd = () => join3(homedir2(), ".gemini", "GEMINI.md");
 var pusharyConfigFile = () => join3(homedir2(), ".pushary", "config.json");
 
 export {
+  registeredCommands,
+  namesOurBinary,
+  registrationHolderOf,
   npmErrorMessage,
   execNpm,
   resolveGlobalBinary,
@@ -559,6 +635,7 @@ export {
   guardBinary,
   guardCursorGate,
   guardedArgv,
+  registerHookEntry,
   isProtectedByScope,
   canonicalJson,
   CODEX_HOOK_BINARY,
@@ -571,12 +648,15 @@ export {
   CODEX_HOOK_EVENTS,
   addCodexMcpServer,
   readCodexMcpAuth,
+  codexRegistrationHolder,
   addCodexHooks,
   removeCodexHooks,
   hasCodexHooks,
   missingCodexHookEvents,
   codexTrustSchemeAgrees,
   codexHookPositions,
+  codexVacatedIndexes,
+  dropVacatedCodexHookTrust,
   captureCodexHookTrust,
   restoreCodexHookTrust,
   codexTrustGaps,

package/dist/{chunk-3SNTEHOH.js → chunk-JL33EDN7.js}

@@ -2,24 +2,24 @@ import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-DNLFSRCF.js";
+} from "./chunk-WGV3VY7O.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-LYWTLNMG.js";
+} from "./chunk-CRFLU455.js";
 import {
   getMachineId
-} from "./chunk-IZKCA35M.js";
+} from "./chunk-562UJ2DA.js";
 import {
   getPackageVersion
 } from "./chunk-DINDL2CF.js";
 import {
   readControlMode,
   readKeySource
-} from "./chunk-VF7YOT2W.js";
+} from "./chunk-4PBCNVI3.js";
 import {
   getBaseUrl
 } from "./chunk-2UMNXADU.js";