@pushary/agent-hooks 0.98.0 → 0.99.0

package/dist/{chunk-JQU6PMH4.js → chunk-LWKPMSBB.js}

@@ -1,17 +1,20 @@
 import {
   detectClaudeVersion
-} from "./chunk-K6CH5NVW.js";
+} from "./chunk-K4XFCEVI.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "./chunk-QXIF6R4P.js";
+} from "./chunk-QS55LDX4.js";
 import {
+  claudeUnprovenHolds,
   claudeWired,
+  codexUnprovenHolds,
   codexWired,
   geminiWired
-} from "./chunk-6LRGZJFB.js";
+} from "./chunk-JXELRCU5.js";
 import {
+  CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
   GEMINI_HOOK_BINARY,
   addGeminiHooks,
@@ -21,7 +24,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-HFQ7WSHZ.js";
+} from "./chunk-PD6JY33P.js";
 import {
   CODEX_HOOK_BINARY,
   addCodexHookTrust,
@@ -31,69 +34,48 @@ import {
   codexConfigToml,
   codexHookPositions,
   codexHooksJson,
+  codexRegistrationHolder,
   codexVacatedIndexes,
   dropVacatedCodexHookTrust,
   guardBinary,
   hasCodexHooks,
-  resolveGlobalBinDir,
+  namesOurBinary,
+  registeredCommands,
+  registrationHolderOf,
   resolveGlobalBinary,
   vscodePluginMcp
-} from "./chunk-XL3RKJYQ.js";
+} from "./chunk-JBJBVERL.js";
 import {
   readJsonSafe,
+  writeFileAtomic,
   writeJsonAtomic
-} from "./chunk-VZD2GEKB.js";
-import {
-  HOOK_LOCATOR_BINARY
-} from "./chunk-OUAE3GKO.js";
+} from "./chunk-4LL6LG5X.js";
 
 // src/reapply.ts
-import { join } from "path";
+import { dirname, join } from "path";
 import { homedir } from "os";
-import { readFileSync, writeFileSync } from "fs";
+import { readFileSync, statSync } from "fs";
 import { parse as parseTOML, stringify as stringifyTOML } from "smol-toml";
 
 // src/reregister.ts
 var asRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
-var commandsUnder = (settings) => {
-  const hooks = asRecord(settings?.hooks);
-  if (!hooks) return [];
-  const found = [];
-  for (const [event, value] of Object.entries(hooks)) {
-    if (!Array.isArray(value)) continue;
-    for (const item of value) {
-      const inner = asRecord(item)?.hooks;
-      if (!Array.isArray(inner)) continue;
-      for (const hook of inner) {
-        const command = asRecord(hook)?.command;
-        if (typeof command === "string") found.push({ event, command });
-      }
-    }
-  }
-  return found;
-};
-var segments = (command) => command.split(/[\s/\\"']+/).map((segment) => segment.replace(/\.(cmd|exe)$/i, ""));
-var CLI_BINARIES = new Set(CLAUDE_HOOK_EVENTS.map((hook) => hook.binary));
-var namesLocator = (command) => segments(command).includes(HOOK_LOCATOR_BINARY);
-var namesCliBinary = (command) => segments(command).some((segment) => CLI_BINARIES.has(segment));
-var registrationHolder = (settings) => {
-  const commands = commandsUnder(settings);
-  if (commands.some(({ command }) => namesLocator(command))) return "app";
-  return commands.some(({ command }) => namesCliBinary(command)) ? "cli" : "none";
-};
+var CLAUDE_CLI_BINARIES = new Set(CLAUDE_HOOK_EVENTS.map((hook) => hook.binary));
+var registrationHolder = (settings) => registrationHolderOf(settings, CLAUDE_CLI_BINARIES);
 var registeredPusharyEvents = (settings) => new Set(
-  commandsUnder(settings).filter(({ command }) => namesLocator(command) || namesCliBinary(command)).map(({ event }) => event)
+  registeredCommands(settings).filter(({ command }) => namesOurBinary(command, CLAUDE_CLI_BINARIES)).map(({ event }) => event)
 );
 var reregisterVerdict = ({ settings, stored, version }) => {
   const holder = registrationHolder(settings);
   if (holder === "none") return { kind: "not_wired" };
   if (holder === "app") return { kind: "app_owned" };
-  if (!needsReregistration(stored, version)) return { kind: "current" };
+  const unproven = claudeUnprovenHolds(settings);
+  if (unproven.length === 0 && !needsReregistration(stored, version)) return { kind: "current" };
   const supported = new Set(supportedClaudeEvents(version).map((hook) => hook.event));
   const present = registeredPusharyEvents(settings);
   const missing = [...supported].filter((event) => !present.has(event));
   const extra = [...present].filter((event) => !supported.has(event));
-  return missing.length > 0 || extra.length > 0 ? { kind: "stale", version, missing, extra } : { kind: "record_only", version };
+  const repairable = unproven.filter((event) => supported.has(event));
+  return missing.length > 0 || extra.length > 0 || repairable.length > 0 ? { kind: "stale", version, missing, extra, unproven: repairable } : { kind: "record_only", version };
 };
 var receiptFor = (version, now = /* @__PURE__ */ new Date()) => ({
   signatures: registrationSignatures(supportedClaudeEvents(version), version),
@@ -119,8 +101,17 @@ var readJson = (filePath) => {
   return null;
 };
 var writeJson = (filePath, data) => writeJsonAtomic(filePath, data);
-var hasPusharyClaudeHooks = (settings) => JSON.stringify(settings.hooks ?? {}).includes("pushary-hook");
+var hasPusharyClaudeHooks = (settings) => JSON.stringify(settings.hooks ?? {}).includes(CLAUDE_HOOK_BINARY);
 var hasPusharyMcp = (claudeJson) => !!claudeJson.mcpServers?.pushary;
+var PRIVATE_TO_OWNER = 384;
+var modeToPreserve = (filePath) => {
+  try {
+    return statSync(filePath).mode & 511;
+  } catch {
+    return PRIVATE_TO_OWNER;
+  }
+};
+var wouldWriteBareNames = (resolve, probe) => resolve(probe) === void 0;
 var reapplyClaudeSettings = (apiKey, paths = {}) => {
   const settingsPath = paths.settingsPath ?? CLAUDE_SETTINGS;
   const claudeJsonPath = paths.claudeJsonPath ?? CLAUDE_JSON;
@@ -136,7 +127,8 @@ var reapplyClaudeSettings = (apiKey, paths = {}) => {
     if (!settingsWritable) throw new Error("settings.json could not be parsed");
     const s = settings;
     addPusharyToolPermissions(s);
-    addPusharyHooks(s, resolveGlobalBinDir("pushary-hook"), (paths.detectVersion ?? detectClaudeVersion)());
+    const binary = (paths.resolveBinary ?? resolveGlobalBinary)(CLAUDE_HOOK_BINARY);
+    addPusharyHooks(s, binary ? dirname(binary) : void 0, (paths.detectVersion ?? detectClaudeVersion)());
     writeJson(settingsPath, s);
     hooks = true;
   } catch {
@@ -168,6 +160,10 @@ var reapplyClaudeForVersion = (apiKey, paths = {}) => {
     if (verdict.kind === "not_wired" || verdict.kind === "app_owned" || verdict.kind === "current") {
       return { verdict: verdict.kind, rewrote: false, missing: [] };
     }
+    const resolveBinary = paths.resolveBinary ?? resolveGlobalBinary;
+    if (verdict.kind === "stale" && wouldWriteBareNames(resolveBinary, CLAUDE_HOOK_BINARY)) {
+      return { verdict: "stale", rewrote: false, missing: verdict.missing };
+    }
     const rewrote = verdict.kind === "stale" ? reapplyClaudeSettings(apiKey, { ...paths, settingsPath }).hooks : false;
     if (verdict.kind === "stale" && !rewrote) return { verdict: "stale", rewrote: false, missing: verdict.missing };
     writeJsonAtomic(receiptPath, receiptFor(version));
@@ -213,7 +209,7 @@ var reapplyCodexSettings = (apiKey, paths = {}) => {
   const hooksConfig = readJson(hooksPath);
   const configured = config != null && !!config.mcp_servers?.pushary || hooksConfig != null && hasCodexHooks(hooksConfig);
   if (!configured) return { configured: false, reapplied: false, hooks: false, mcp: false };
-  const command = guardBinary(resolveGlobalBinary(CODEX_HOOK_BINARY) ?? CODEX_HOOK_BINARY);
+  const command = guardBinary((paths.resolveBinary ?? resolveGlobalBinary)(CODEX_HOOK_BINARY) ?? CODEX_HOOK_BINARY);
   let hooks = false;
   let mcp = false;
   const vacated = codexVacatedIndexes(hooksConfig ?? void 0);
@@ -235,12 +231,27 @@ var reapplyCodexSettings = (apiKey, paths = {}) => {
         addCodexMcpServer(config, apiKey);
         mcp = true;
       }
-      if (hooks || apiKey) writeFileSync(configPath, stringifyTOML(config), "utf-8");
+      if (hooks || apiKey) {
+        writeFileAtomic(configPath, stringifyTOML(config), modeToPreserve(configPath), "utf-8");
+      }
     } catch {
     }
   }
   return { configured: true, reapplied: hooks || mcp, hooks, mcp };
 };
+var repairCodexHolds = (paths = {}) => {
+  const idle = { configured: false, reapplied: false, hooks: false, mcp: false };
+  try {
+    const hooksPath = paths.hooksPath ?? codexHooksJson();
+    const hooksConfig = readJson(hooksPath);
+    if (!hooksConfig || codexRegistrationHolder(hooksConfig) !== "cli") return idle;
+    if (codexUnprovenHolds(hooksConfig).length === 0) return idle;
+    if (wouldWriteBareNames(paths.resolveBinary ?? resolveGlobalBinary, CODEX_HOOK_BINARY)) return idle;
+    return reapplyCodexSettings(void 0, paths);
+  } catch {
+    return idle;
+  }
+};
 var reapplyGeminiSettings = (apiKey, paths = {}) => {
   const settingsPath = paths.settingsPath ?? join(homedir(), ".gemini", "settings.json");
   const settings = readJson(settingsPath);
@@ -300,7 +311,13 @@ var reapplyAllAgents = (apiKey) => {
 };
 
 export {
+  reapplyClaudeSettings,
   reapplyClaudeForVersion,
   inspectConfiguredManagedProviders,
+  reapplyCodexSettings,
+  repairCodexHolds,
+  reapplyGeminiSettings,
+  reapplyCursorPlugin,
+  reapplyVsCodePlugin,
   reapplyAllAgents
 };

package/dist/{chunk-5B5QV3KC.js → chunk-NSFNEDCT.js}

@@ -3,13 +3,13 @@ import {
   loadPin,
   savePin,
   verifyRecipients
-} from "./chunk-OBYC6SN4.js";
+} from "./chunk-YKLCWWEI.js";
 import {
   hookOwnerOf
-} from "./chunk-W2MG2P46.js";
+} from "./chunk-RALVI7OF.js";
 import {
   ensureDaemonRunning
-} from "./chunk-DOD3A6EU.js";
+} from "./chunk-CRFLU455.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
@@ -23,17 +23,17 @@ import {
 import {
   transcriptEnvironmentPreference,
   transcriptsEnabled
-} from "./chunk-NQGYPTJQ.js";
+} from "./chunk-ID5FDKDZ.js";
 import {
   codexHome,
   pusharyDir
-} from "./chunk-XL3RKJYQ.js";
+} from "./chunk-JBJBVERL.js";
 import {
   readTranscriptPreference
-} from "./chunk-SJLGOVC6.js";
+} from "./chunk-4PBCNVI3.js";
 import {
   writeJsonAtomic
-} from "./chunk-VZD2GEKB.js";
+} from "./chunk-4LL6LG5X.js";
 import {
   getApiKey,
   getBaseUrl

package/dist/{chunk-M4TVEMLH.js → chunk-O3LZQEQP.js}

@@ -1,6 +1,6 @@
 import {
   registerTranscript
-} from "./chunk-5B5QV3KC.js";
+} from "./chunk-NSFNEDCT.js";
 
 // src/admission.ts
 import { readFileSync } from "fs";

package/dist/{chunk-HFQ7WSHZ.js → chunk-PD6JY33P.js}

@@ -5,7 +5,7 @@ import {
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-XL3RKJYQ.js";
+} from "./chunk-JBJBVERL.js";
 import {
   CLAUDE_PRETOOLUSE_MATCHER,
   HOOK_BUDGETS,
@@ -129,8 +129,9 @@ var formatVersion = (version) => version.join(".");
 var MIRRORED_TOOLS = POSTTOOLUSE_MIRRORED_TOOLS.join("|");
 var ESTABLISHED = [1, 0, 0];
 var OBSERVED = [2, 0, 0];
+var CLAUDE_HOOK_BINARY = "pushary-hook";
 var CLAUDE_HOOK_EVENTS = [
-  { event: "PreToolUse", binary: "pushary-hook", matcher: CLAUDE_PRETOOLUSE_MATCHER, timeout: HOOK_BUDGETS.claude.budgetSeconds, delivery: "approval", since: ESTABLISHED },
+  { event: "PreToolUse", binary: CLAUDE_HOOK_BINARY, matcher: CLAUDE_PRETOOLUSE_MATCHER, timeout: HOOK_BUDGETS.claude.budgetSeconds, delivery: "approval", since: ESTABLISHED },
   { event: "PostToolUse", binary: "pushary-post-hook", matcher: MIRRORED_TOOLS, timeout: 10, delivery: "telemetry", since: ESTABLISHED },
   { event: "Stop", binary: "pushary-stop-hook", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
   { event: "UserPromptSubmit", binary: "pushary-prompt-hook", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
@@ -175,6 +176,7 @@ export {
   parseVersion,
   compareVersion,
   formatVersion,
+  CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
   supportedClaudeEvents,
   registrationSignatures,

package/dist/{chunk-QXIF6R4P.js → chunk-QS55LDX4.js}

@@ -1,13 +1,13 @@
 import {
   CLAUDE_HOOK_EVENTS,
   supportedClaudeEvents
-} from "./chunk-HFQ7WSHZ.js";
+} from "./chunk-PD6JY33P.js";
 import {
   guardBinary,
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-XL3RKJYQ.js";
+} from "./chunk-JBJBVERL.js";
 import {
   HOOK_LOCATOR_BINARY,
   withHookHoldBudget

package/dist/{chunk-W2MG2P46.js → chunk-RALVI7OF.js}

@@ -6,10 +6,10 @@ import {
 } from "./chunk-IRLTW6KF.js";
 import {
   pusharyHookExecutable
-} from "./chunk-6LRGZJFB.js";
+} from "./chunk-JXELRCU5.js";
 import {
   BELL_HOOK_BINARY
-} from "./chunk-2GLOHBYB.js";
+} from "./chunk-EXHXR2X5.js";
 
 // src/setup/hook-ownership.ts
 var commandsIn = (value) => {

package/dist/{chunk-6CYB77VD.js → chunk-T3JZZUAR.js}

@@ -4,7 +4,7 @@ import {
   forgetBlockedActionHint,
   hasBlockedActionHint,
   recordBlockedActionHint
-} from "./chunk-53QCTSWY.js";
+} from "./chunk-6KLCP7VF.js";
 import {
   isGatingMoment,
   recordKeylessMoment
@@ -24,7 +24,7 @@ import {
   reportEvent,
   settleQuestionsForToolUse,
   throttlePass
-} from "./chunk-YJDRHQLG.js";
+} from "./chunk-64WARXGV.js";
 import {
   UNNAMED_ACTION,
   deriveAction,
@@ -49,7 +49,7 @@ import {
 } from "./chunk-LGXUGYUH.js";
 import {
   getMachineId
-} from "./chunk-WU6LSXJ6.js";
+} from "./chunk-562UJ2DA.js";
 import {
   getApiKey,
   getBaseUrl

package/dist/{chunk-V47GITZV.js → chunk-V262ATS5.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-HB2KB7QL.js";
 import {
   codexHomeFrom
-} from "./chunk-XL3RKJYQ.js";
+} from "./chunk-JBJBVERL.js";
 
 // src/vscode-config.ts
 import { homedir } from "os";

package/dist/{chunk-TZHDKRMG.js → chunk-WGV3VY7O.js}

@@ -2,7 +2,7 @@ import {
   resolveBinary,
   resolveGlobalPackageVersion,
   resolvePackageVersionFromBinary
-} from "./chunk-XL3RKJYQ.js";
+} from "./chunk-JBJBVERL.js";
 import {
   MANAGED_PROVIDERS
 } from "./chunk-OUAE3GKO.js";

package/dist/{chunk-OBYC6SN4.js → chunk-YKLCWWEI.js}

@@ -1,6 +1,6 @@
 import {
   writeJsonAtomicDurable
-} from "./chunk-VZD2GEKB.js";
+} from "./chunk-4LL6LG5X.js";
 
 // src/transcript-recipient-pin.ts
 import { existsSync, mkdirSync, readFileSync, rmSync } from "fs";

package/dist/reapply-HQ264ZTR.js

@@ -0,0 +1,30 @@
+import {
+  inspectConfiguredManagedProviders,
+  reapplyAllAgents,
+  reapplyClaudeForVersion,
+  reapplyClaudeSettings,
+  reapplyCodexSettings,
+  reapplyCursorPlugin,
+  reapplyGeminiSettings,
+  reapplyVsCodePlugin,
+  repairCodexHolds
+} from "./chunk-LWKPMSBB.js";
+import "./chunk-K4XFCEVI.js";
+import "./chunk-QS55LDX4.js";
+import "./chunk-JXELRCU5.js";
+import "./chunk-PD6JY33P.js";
+import "./chunk-OPR2BPD4.js";
+import "./chunk-JBJBVERL.js";
+import "./chunk-4LL6LG5X.js";
+import "./chunk-OUAE3GKO.js";
+export {
+  inspectConfiguredManagedProviders,
+  reapplyAllAgents,
+  reapplyClaudeForVersion,
+  reapplyClaudeSettings,
+  reapplyCodexSettings,
+  reapplyCursorPlugin,
+  reapplyGeminiSettings,
+  reapplyVsCodePlugin,
+  repairCodexHolds
+};

package/dist/src/index.js

@@ -1,7 +1,7 @@
 import {
   handlePreToolUse
-} from "../chunk-6CYB77VD.js";
-import "../chunk-53QCTSWY.js";
+} from "../chunk-T3JZZUAR.js";
+import "../chunk-6KLCP7VF.js";
 import "../chunk-XOOWC62T.js";
 import "../chunk-YHG74UFF.js";
 import {
@@ -15,7 +15,7 @@ import {
   handlePostToolUse,
   handleStop,
   reportEvent
-} from "../chunk-YJDRHQLG.js";
+} from "../chunk-64WARXGV.js";
 import "../chunk-A76GNRIK.js";
 import "../chunk-OPR2BPD4.js";
 import {
@@ -23,13 +23,14 @@ import {
   cancelQuestion,
   waitForAnswer
 } from "../chunk-LGXUGYUH.js";
-import "../chunk-WU6LSXJ6.js";
-import "../chunk-XL3RKJYQ.js";
+import "../chunk-562UJ2DA.js";
+import "../chunk-JBJBVERL.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-VZD2GEKB.js";
+import "../chunk-GCD3SQSV.js";
+import "../chunk-4LL6LG5X.js";
 import {
   getApiKey,
   getBaseUrl

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.98.0",
+  "version": "0.99.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",