@pushary/agent-hooks 0.98.0 → 1.0.0

package/dist/{chunk-QXIF6R4P.js → chunk-MGI6MLFU.js}

@@ -1,17 +1,17 @@
 import {
   CLAUDE_HOOK_EVENTS,
   supportedClaudeEvents
-} from "./chunk-HFQ7WSHZ.js";
+} from "./chunk-2PS3DTHQ.js";
 import {
   guardBinary,
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-XL3RKJYQ.js";
+} from "./chunk-LTPQKBJH.js";
 import {
   HOOK_LOCATOR_BINARY,
   withHookHoldBudget
-} from "./chunk-OUAE3GKO.js";
+} from "./chunk-TTBRBWAK.js";
 
 // src/claude-config.ts
 import { join } from "path";
@@ -113,6 +113,16 @@ var removeClaudeMcpServers = (config) => {
   }
   return changed;
 };
+var removePusharyToolPermissions = (settings) => {
+  const permissions = asRecord(settings.permissions);
+  if (!permissions || !Array.isArray(permissions.allow)) return false;
+  const filtered = permissions.allow.filter((rule) => !isPusharyPermission(rule));
+  if (filtered.length === permissions.allow.length) return false;
+  if (filtered.length === 0) delete permissions.allow;
+  else permissions.allow = filtered;
+  if (Object.keys(permissions).length === 0) delete settings.permissions;
+  return true;
+};
 var addPusharyToolPermissions = (settings) => {
   const permissions = ensureRecord(settings, "permissions");
   const allow = Array.isArray(permissions.allow) ? permissions.allow : [];
@@ -151,19 +161,7 @@ var entry = (definition, resolve) => ({
 });
 var removePusharySettings = (settings, scope) => {
   let changed = scope?.keepMcpServer === true ? false : removeClaudeMcpServers(settings);
-  const permissions = scope?.keepMcpServer === true ? void 0 : asRecord(settings.permissions);
-  if (permissions && Array.isArray(permissions.allow)) {
-    const filtered = permissions.allow.filter((rule) => !isPusharyPermission(rule));
-    if (filtered.length !== permissions.allow.length) {
-      if (filtered.length === 0) {
-        delete permissions.allow;
-      } else {
-        permissions.allow = filtered;
-      }
-      if (Object.keys(permissions).length === 0) delete settings.permissions;
-      changed = true;
-    }
-  }
+  if (scope?.keepMcpServer !== true && removePusharyToolPermissions(settings)) changed = true;
   const hooks = asRecord(settings.hooks);
   if (hooks) {
     for (const { event: key } of CLAUDE_HOOK_EVENTS) {
@@ -185,12 +183,14 @@ var removePusharySettings = (settings, scope) => {
 };
 
 export {
+  isPusharyHook,
   addClaudeMcpServer,
   isClaudeMcpSnapshot,
   captureClaudeMcpServer,
   updateClaudeMcpSnapshot,
   restoreClaudeMcpServer,
   removeClaudeMcpServers,
+  removePusharyToolPermissions,
   addPusharyToolPermissions,
   addPusharyHooks,
   removePusharySettings

package/dist/{chunk-DOD3A6EU.js → chunk-MSOFZYI3.js}

@@ -4,23 +4,23 @@ import {
 } from "./chunk-XHKBHWLX.js";
 import {
   getMachineId
-} from "./chunk-WU6LSXJ6.js";
+} from "./chunk-7WMFPYR5.js";
 import {
   pusharyDir,
   resolveGlobalBinary
-} from "./chunk-XL3RKJYQ.js";
+} from "./chunk-LTPQKBJH.js";
 import {
   getPackageVersion
 } from "./chunk-DINDL2CF.js";
 import {
   readControlMode
-} from "./chunk-SJLGOVC6.js";
+} from "./chunk-DOYARIYB.js";
 import {
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic,
   writeJsonAtomicDurable
-} from "./chunk-VZD2GEKB.js";
+} from "./chunk-4LL6LG5X.js";
 import {
   getApiKey
 } from "./chunk-2UMNXADU.js";

package/dist/{chunk-JQU6PMH4.js → chunk-R744XA2M.js}

@@ -1,17 +1,20 @@
 import {
   detectClaudeVersion
-} from "./chunk-K6CH5NVW.js";
+} from "./chunk-Y55JNI2I.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "./chunk-QXIF6R4P.js";
+} from "./chunk-MGI6MLFU.js";
 import {
+  claudeUnprovenHolds,
   claudeWired,
+  codexUnprovenHolds,
   codexWired,
   geminiWired
-} from "./chunk-6LRGZJFB.js";
+} from "./chunk-XK34HTMW.js";
 import {
+  CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
   GEMINI_HOOK_BINARY,
   addGeminiHooks,
@@ -21,7 +24,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-HFQ7WSHZ.js";
+} from "./chunk-2PS3DTHQ.js";
 import {
   CODEX_HOOK_BINARY,
   addCodexHookTrust,
@@ -31,69 +34,48 @@ import {
   codexConfigToml,
   codexHookPositions,
   codexHooksJson,
+  codexRegistrationHolder,
   codexVacatedIndexes,
   dropVacatedCodexHookTrust,
   guardBinary,
   hasCodexHooks,
-  resolveGlobalBinDir,
+  namesOurBinary,
+  registeredCommands,
+  registrationHolderOf,
   resolveGlobalBinary,
   vscodePluginMcp
-} from "./chunk-XL3RKJYQ.js";
+} from "./chunk-LTPQKBJH.js";
 import {
   readJsonSafe,
+  writeFileAtomic,
   writeJsonAtomic
-} from "./chunk-VZD2GEKB.js";
-import {
-  HOOK_LOCATOR_BINARY
-} from "./chunk-OUAE3GKO.js";
+} from "./chunk-4LL6LG5X.js";
 
 // src/reapply.ts
-import { join } from "path";
+import { dirname, join } from "path";
 import { homedir } from "os";
-import { readFileSync, writeFileSync } from "fs";
+import { readFileSync, statSync } from "fs";
 import { parse as parseTOML, stringify as stringifyTOML } from "smol-toml";
 
 // src/reregister.ts
 var asRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
-var commandsUnder = (settings) => {
-  const hooks = asRecord(settings?.hooks);
-  if (!hooks) return [];
-  const found = [];
-  for (const [event, value] of Object.entries(hooks)) {
-    if (!Array.isArray(value)) continue;
-    for (const item of value) {
-      const inner = asRecord(item)?.hooks;
-      if (!Array.isArray(inner)) continue;
-      for (const hook of inner) {
-        const command = asRecord(hook)?.command;
-        if (typeof command === "string") found.push({ event, command });
-      }
-    }
-  }
-  return found;
-};
-var segments = (command) => command.split(/[\s/\\"']+/).map((segment) => segment.replace(/\.(cmd|exe)$/i, ""));
-var CLI_BINARIES = new Set(CLAUDE_HOOK_EVENTS.map((hook) => hook.binary));
-var namesLocator = (command) => segments(command).includes(HOOK_LOCATOR_BINARY);
-var namesCliBinary = (command) => segments(command).some((segment) => CLI_BINARIES.has(segment));
-var registrationHolder = (settings) => {
-  const commands = commandsUnder(settings);
-  if (commands.some(({ command }) => namesLocator(command))) return "app";
-  return commands.some(({ command }) => namesCliBinary(command)) ? "cli" : "none";
-};
+var CLAUDE_CLI_BINARIES = new Set(CLAUDE_HOOK_EVENTS.map((hook) => hook.binary));
+var registrationHolder = (settings) => registrationHolderOf(settings, CLAUDE_CLI_BINARIES);
 var registeredPusharyEvents = (settings) => new Set(
-  commandsUnder(settings).filter(({ command }) => namesLocator(command) || namesCliBinary(command)).map(({ event }) => event)
+  registeredCommands(settings).filter(({ command }) => namesOurBinary(command, CLAUDE_CLI_BINARIES)).map(({ event }) => event)
 );
 var reregisterVerdict = ({ settings, stored, version }) => {
   const holder = registrationHolder(settings);
   if (holder === "none") return { kind: "not_wired" };
   if (holder === "app") return { kind: "app_owned" };
-  if (!needsReregistration(stored, version)) return { kind: "current" };
+  const unproven = claudeUnprovenHolds(settings);
+  if (unproven.length === 0 && !needsReregistration(stored, version)) return { kind: "current" };
   const supported = new Set(supportedClaudeEvents(version).map((hook) => hook.event));
   const present = registeredPusharyEvents(settings);
   const missing = [...supported].filter((event) => !present.has(event));
   const extra = [...present].filter((event) => !supported.has(event));
-  return missing.length > 0 || extra.length > 0 ? { kind: "stale", version, missing, extra } : { kind: "record_only", version };
+  const repairable = unproven.filter((event) => supported.has(event));
+  return missing.length > 0 || extra.length > 0 || repairable.length > 0 ? { kind: "stale", version, missing, extra, unproven: repairable } : { kind: "record_only", version };
 };
 var receiptFor = (version, now = /* @__PURE__ */ new Date()) => ({
   signatures: registrationSignatures(supportedClaudeEvents(version), version),
@@ -119,8 +101,17 @@ var readJson = (filePath) => {
   return null;
 };
 var writeJson = (filePath, data) => writeJsonAtomic(filePath, data);
-var hasPusharyClaudeHooks = (settings) => JSON.stringify(settings.hooks ?? {}).includes("pushary-hook");
+var hasPusharyClaudeHooks = (settings) => JSON.stringify(settings.hooks ?? {}).includes(CLAUDE_HOOK_BINARY);
 var hasPusharyMcp = (claudeJson) => !!claudeJson.mcpServers?.pushary;
+var PRIVATE_TO_OWNER = 384;
+var modeToPreserve = (filePath) => {
+  try {
+    return statSync(filePath).mode & 511;
+  } catch {
+    return PRIVATE_TO_OWNER;
+  }
+};
+var wouldWriteBareNames = (resolve, probe) => resolve(probe) === void 0;
 var reapplyClaudeSettings = (apiKey, paths = {}) => {
   const settingsPath = paths.settingsPath ?? CLAUDE_SETTINGS;
   const claudeJsonPath = paths.claudeJsonPath ?? CLAUDE_JSON;
@@ -136,7 +127,8 @@ var reapplyClaudeSettings = (apiKey, paths = {}) => {
     if (!settingsWritable) throw new Error("settings.json could not be parsed");
     const s = settings;
     addPusharyToolPermissions(s);
-    addPusharyHooks(s, resolveGlobalBinDir("pushary-hook"), (paths.detectVersion ?? detectClaudeVersion)());
+    const binary = (paths.resolveBinary ?? resolveGlobalBinary)(CLAUDE_HOOK_BINARY);
+    addPusharyHooks(s, binary ? dirname(binary) : void 0, (paths.detectVersion ?? detectClaudeVersion)());
     writeJson(settingsPath, s);
     hooks = true;
   } catch {
@@ -168,6 +160,10 @@ var reapplyClaudeForVersion = (apiKey, paths = {}) => {
     if (verdict.kind === "not_wired" || verdict.kind === "app_owned" || verdict.kind === "current") {
       return { verdict: verdict.kind, rewrote: false, missing: [] };
     }
+    const resolveBinary = paths.resolveBinary ?? resolveGlobalBinary;
+    if (verdict.kind === "stale" && wouldWriteBareNames(resolveBinary, CLAUDE_HOOK_BINARY)) {
+      return { verdict: "stale", rewrote: false, missing: verdict.missing };
+    }
     const rewrote = verdict.kind === "stale" ? reapplyClaudeSettings(apiKey, { ...paths, settingsPath }).hooks : false;
     if (verdict.kind === "stale" && !rewrote) return { verdict: "stale", rewrote: false, missing: verdict.missing };
     writeJsonAtomic(receiptPath, receiptFor(version));
@@ -213,7 +209,7 @@ var reapplyCodexSettings = (apiKey, paths = {}) => {
   const hooksConfig = readJson(hooksPath);
   const configured = config != null && !!config.mcp_servers?.pushary || hooksConfig != null && hasCodexHooks(hooksConfig);
   if (!configured) return { configured: false, reapplied: false, hooks: false, mcp: false };
-  const command = guardBinary(resolveGlobalBinary(CODEX_HOOK_BINARY) ?? CODEX_HOOK_BINARY);
+  const command = guardBinary((paths.resolveBinary ?? resolveGlobalBinary)(CODEX_HOOK_BINARY) ?? CODEX_HOOK_BINARY);
   let hooks = false;
   let mcp = false;
   const vacated = codexVacatedIndexes(hooksConfig ?? void 0);
@@ -235,12 +231,27 @@ var reapplyCodexSettings = (apiKey, paths = {}) => {
         addCodexMcpServer(config, apiKey);
         mcp = true;
       }
-      if (hooks || apiKey) writeFileSync(configPath, stringifyTOML(config), "utf-8");
+      if (hooks || apiKey) {
+        writeFileAtomic(configPath, stringifyTOML(config), modeToPreserve(configPath), "utf-8");
+      }
     } catch {
     }
   }
   return { configured: true, reapplied: hooks || mcp, hooks, mcp };
 };
+var repairCodexHolds = (paths = {}) => {
+  const idle = { configured: false, reapplied: false, hooks: false, mcp: false };
+  try {
+    const hooksPath = paths.hooksPath ?? codexHooksJson();
+    const hooksConfig = readJson(hooksPath);
+    if (!hooksConfig || codexRegistrationHolder(hooksConfig) !== "cli") return idle;
+    if (codexUnprovenHolds(hooksConfig).length === 0) return idle;
+    if (wouldWriteBareNames(paths.resolveBinary ?? resolveGlobalBinary, CODEX_HOOK_BINARY)) return idle;
+    return reapplyCodexSettings(void 0, paths);
+  } catch {
+    return idle;
+  }
+};
 var reapplyGeminiSettings = (apiKey, paths = {}) => {
   const settingsPath = paths.settingsPath ?? join(homedir(), ".gemini", "settings.json");
   const settings = readJson(settingsPath);
@@ -300,7 +311,13 @@ var reapplyAllAgents = (apiKey) => {
 };
 
 export {
+  reapplyClaudeSettings,
   reapplyClaudeForVersion,
   inspectConfiguredManagedProviders,
+  reapplyCodexSettings,
+  repairCodexHolds,
+  reapplyGeminiSettings,
+  reapplyCursorPlugin,
+  reapplyVsCodePlugin,
   reapplyAllAgents
 };

package/dist/{chunk-FAJ4R7IB.js → chunk-RFNMSC6N.js}

@@ -1,6 +1,6 @@
 import {
   resolvePathBinary
-} from "./chunk-XL3RKJYQ.js";
+} from "./chunk-LTPQKBJH.js";
 
 // src/hermes-config.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-NIXVMMJM.js → chunk-S2W4ZSHE.js}

@@ -1,6 +1,6 @@
 import {
   readConfigFileKey
-} from "./chunk-SJLGOVC6.js";
+} from "./chunk-DOYARIYB.js";
 
 // src/bell/fleet.ts
 import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";