@pushary/agent-hooks 1.4.2 → 1.5.1

package/dist/{chunk-DINDL2CF.js → chunk-HWJW3CPO.js}

@@ -3,6 +3,7 @@ import { readFileSync } from "fs";
 import { dirname, join, parse } from "path";
 import { fileURLToPath } from "url";
 var PACKAGE_NAME = "@pushary/agent-hooks";
+var UNKNOWN_VERSION = "0.0.0";
 var findOwnPackageJson = (start) => {
   const { root } = parse(start);
   let dir = start;
@@ -20,13 +21,24 @@ var findOwnPackageJson = (start) => {
   }
 };
 var getPackageVersion = () => {
+  const root = ownPackageRoot();
+  return (root === void 0 ? void 0 : packageVersionAt(root)) ?? UNKNOWN_VERSION;
+};
+var ownPackageRoot = () => {
   try {
     const found = findOwnPackageJson(dirname(fileURLToPath(import.meta.url)));
-    if (!found) return "0.0.0";
-    const pkg = JSON.parse(readFileSync(found, "utf-8"));
-    return pkg.version ?? "0.0.0";
+    return found ? dirname(found) : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var packageVersionAt = (packageRoot) => {
+  try {
+    const manifest = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf-8"));
+    const version = manifest && typeof manifest === "object" && "version" in manifest ? manifest.version : void 0;
+    return typeof version === "string" ? version : void 0;
   } catch {
-    return "0.0.0";
+    return void 0;
   }
 };
 var isNewerVersion = (candidate, current) => {
@@ -38,8 +50,16 @@ var isNewerVersion = (candidate, current) => {
   }
   return false;
 };
+var RELEASE_VERSION = /^\d+\.\d+\.\d+$/;
+var isReleaseVersion = (value) => RELEASE_VERSION.test(value);
+var majorOf = (version) => parseInt(version.split(".")[0] ?? "", 10) || 0;
+var isSameMajorVersion = (candidate, current) => majorOf(candidate) === majorOf(current);
 
 export {
   getPackageVersion,
-  isNewerVersion
+  ownPackageRoot,
+  packageVersionAt,
+  isNewerVersion,
+  isReleaseVersion,
+  isSameMajorVersion
 };

package/dist/{chunk-VW66JEGU.js → chunk-IV3RHICU.js}

@@ -2,27 +2,27 @@ import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-TYEO6T5J.js";
+} from "./chunk-5ZZG76S2.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-BZ4GDOJX.js";
+} from "./chunk-X7FESZTD.js";
 import {
   getMachineId
-} from "./chunk-NHTAHAIS.js";
-import {
-  getPackageVersion
-} from "./chunk-DINDL2CF.js";
+} from "./chunk-WOLPADR6.js";
 import {
   readControlMode,
   readKeySource
-} from "./chunk-FU2DFEAZ.js";
+} from "./chunk-USQDVBEV.js";
 import {
   getBaseUrl
-} from "./chunk-2UMNXADU.js";
+} from "./chunk-OSJEMXSR.js";
+import {
+  getPackageVersion
+} from "./chunk-HWJW3CPO.js";
 
 // src/machines.ts
 import { hostname } from "os";

package/dist/{chunk-ACYIZ3KH.js → chunk-JKBDGZFL.js}

@@ -1,18 +1,21 @@
 import {
   detectClaudeVersion
-} from "./chunk-PC6DU5C4.js";
+} from "./chunk-HUAOMX4U.js";
+import {
+  ensureCodexTrustsPusharyHooks
+} from "./chunk-6EEANS74.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "./chunk-II7PUMPB.js";
+} from "./chunk-4ERLRNOK.js";
 import {
   claudeUnprovenHolds,
   claudeWired,
   codexUnprovenHolds,
   codexWired,
   geminiWired
-} from "./chunk-WPVHRUDT.js";
+} from "./chunk-Z4VGIBJ7.js";
 import {
   CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
@@ -24,7 +27,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-LPYCPFBZ.js";
+} from "./chunk-2AUIEZYS.js";
 import {
   CODEX_HOOK_BINARY,
   addCodexHookTrust,
@@ -44,7 +47,7 @@ import {
   registrationHolderOf,
   resolveGlobalBinary,
   vscodePluginMcp
-} from "./chunk-TRLFZKVG.js";
+} from "./chunk-6IU45EHE.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -309,6 +312,8 @@ var reapplyAllAgents = (apiKey) => {
   }
   return done;
 };
+var isRewrittenCodex = (agent) => agent.id === "codex" && agent.result.hooks;
+var ensureCodexTrustAfterReapply = async (agents, options = {}) => agents.some(isRewrittenCodex) ? ensureCodexTrustsPusharyHooks(options) : null;
 
 export {
   reapplyClaudeSettings,
@@ -319,5 +324,6 @@ export {
   reapplyGeminiSettings,
   reapplyCursorPlugin,
   reapplyVsCodePlugin,
-  reapplyAllAgents
+  reapplyAllAgents,
+  ensureCodexTrustAfterReapply
 };

package/dist/{chunk-ZVY25BMK.js → chunk-K3QVDAZW.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_LOCATOR_BINARY
-} from "./chunk-SOUZBGYJ.js";
+} from "./chunk-T4QY64OR.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-MUVTZNJW.js → chunk-KHXVTWYS.js}

@@ -1,12 +1,12 @@
 import {
   openCodeConfigDirFrom
-} from "./chunk-F4UWL4NY.js";
+} from "./chunk-TUXFIVOH.js";
 import {
   codexHomeFrom
-} from "./chunk-TRLFZKVG.js";
+} from "./chunk-6IU45EHE.js";
 import {
   HOOK_COMPATIBLE_PROFILES
-} from "./chunk-SOUZBGYJ.js";
+} from "./chunk-T4QY64OR.js";
 
 // src/vscode-config.ts
 import { homedir } from "os";

package/dist/{chunk-T5SZ4PML.js → chunk-KJRALILH.js}

@@ -12,14 +12,17 @@ import {
 } from "./chunk-5RUIFDTP.js";
 import {
   callMcpTool
-} from "./chunk-EYRGBYZG.js";
+} from "./chunk-HETOKNIL.js";
 import {
   reportedInstallSource
-} from "./chunk-UM5J3J4V.js";
+} from "./chunk-HU5LSYL2.js";
 import {
   PAIR_TTL_SECONDS,
   isAnswerSource
-} from "./chunk-SOUZBGYJ.js";
+} from "./chunk-T4QY64OR.js";
+import {
+  NPX_LATEST_COMMAND
+} from "./chunk-EA3IELHP.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {
@@ -752,7 +755,7 @@ var PAIR_STOP_BEFORE_EXPIRY_MS = 1e4;
 var PAIR_TIMEOUT_MS = PAIR_TTL_SECONDS * 1e3 - PAIR_STOP_BEFORE_EXPIRY_MS;
 var PAIR_HINT_AFTER_MS = 45e3;
 var PAIR_BROWSER_FALLBACK_AFTER_MS = 6e4;
-var BROWSER_CONNECT_COMMAND = "npx @pushary/agent-hooks setup --connect browser";
+var BROWSER_CONNECT_COMMAND = `${NPX_LATEST_COMMAND} setup --connect browser`;
 var PAIR_BROWSER_FALLBACK_LINE = `Still waiting? Sign in with a browser instead: Ctrl-C, then ${BROWSER_CONNECT_COMMAND}`;
 var SYSTEM_PAIR_CLOCK = { now: () => Date.now(), sleep };
 var startPairing = async (cliPublicKey) => {

package/dist/{chunk-VOMOZ4D5.js → chunk-M2LMXPJZ.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-TRLFZKVG.js";
+} from "./chunk-6IU45EHE.js";
 import {
   readJsonSafe
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-SUWRZYQG.js → chunk-MDJJW3LP.js}

@@ -7,10 +7,10 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-G653QPTR.js";
+} from "./chunk-D573TLP6.js";
 import {
   canonicalJson
-} from "./chunk-TRLFZKVG.js";
+} from "./chunk-6IU45EHE.js";
 import {
   writeFileAtomic
 } from "./chunk-T7E75EKA.js";
@@ -20,7 +20,7 @@ import {
   machineDecisionFor,
   shouldDeferToNativeMode,
   wireVerdictFor
-} from "./chunk-SOUZBGYJ.js";
+} from "./chunk-T4QY64OR.js";
 
 // src/machine-decision-audit.ts
 import { basename } from "path";

package/dist/chunk-MU3WU2FO.js

@@ -0,0 +1,166 @@
+import {
+  autoUpdateState
+} from "./chunk-6IU45EHE.js";
+import {
+  readJsonSafe,
+  writeJsonAtomic
+} from "./chunk-T7E75EKA.js";
+import {
+  ownPackageRoot
+} from "./chunk-HWJW3CPO.js";
+
+// src/auto-update.ts
+import { spawn } from "child_process";
+import { dirname, join } from "path";
+var AUTO_UPDATE_DISABLE_ENV = "PUSHARY_DISABLE_AUTOUPDATE";
+var AUTO_UPDATE_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var AUTO_UPDATE_FLAG = "--auto";
+var GLOBAL_PACKAGE_SUBPATH = "/lib/node_modules/@pushary/agent-hooks";
+var UPGRADE_ENTRY_SUBPATH = ["dist", "bin", "pushary-upgrade.js"];
+var NON_GLOBAL_INSTALL_SEGMENTS = ["/_npx/", "/.volta/"];
+var NOT_DISABLED_VALUES = /* @__PURE__ */ new Set(["", "0"]);
+var AUTO_UPDATE_RESULTS = ["updated", "current", "needs_manual", "failed", "finish_pending"];
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isAutoUpdateResult = (value) => typeof value === "string" && AUTO_UPDATE_RESULTS.some((result) => result === value);
+var stringField = (record, key) => {
+  const value = record[key];
+  return typeof value === "string" ? value : void 0;
+};
+var booleanField = (record, key) => {
+  const value = record[key];
+  return typeof value === "boolean" ? value : void 0;
+};
+var parseAutoUpdateState = (value) => {
+  if (!isRecord(value)) return {};
+  return {
+    disabled: booleanField(value, "disabled"),
+    lastCheckAt: stringField(value, "lastCheckAt"),
+    lastResult: isAutoUpdateResult(value.lastResult) ? value.lastResult : void 0,
+    from: stringField(value, "from"),
+    to: stringField(value, "to"),
+    at: stringField(value, "at"),
+    detail: stringField(value, "detail"),
+    announced: booleanField(value, "announced")
+  };
+};
+var isAutoUpdateDisabledByEnv = (env) => {
+  const value = env[AUTO_UPDATE_DISABLE_ENV];
+  return value !== void 0 && !NOT_DISABLED_VALUES.has(value.trim());
+};
+var isContinuousIntegration = (env) => Boolean(env.CI);
+var autoUpdateOffReason = (input) => {
+  if (isAutoUpdateDisabledByEnv(input.env)) return "disabled_by_env";
+  if (input.state.disabled === true) return "disabled_by_user";
+  if (isContinuousIntegration(input.env)) return "ci";
+  if (input.platform === "win32") return "windows";
+  if (input.platform === "linux") return "linux";
+  return null;
+};
+var globalInstallPrefix = (packageRoot) => {
+  const root = packageRoot.replace(/\/+$/, "");
+  if (!root.endsWith(GLOBAL_PACKAGE_SUBPATH)) return null;
+  if (NON_GLOBAL_INSTALL_SEGMENTS.some((segment) => root.includes(segment))) return null;
+  const prefix = root.slice(0, -GLOBAL_PACKAGE_SUBPATH.length);
+  return prefix.startsWith("/") ? prefix : null;
+};
+var upgradeEntryFor = (prefix) => join(prefix, GLOBAL_PACKAGE_SUBPATH, ...UPGRADE_ENTRY_SUBPATH);
+var checkedWithinInterval = (lastCheckAt, now) => {
+  const last = lastCheckAt === void 0 ? Number.NaN : Date.parse(lastCheckAt);
+  if (Number.isNaN(last)) return false;
+  const elapsed = now - last;
+  return elapsed >= 0 && elapsed < AUTO_UPDATE_INTERVAL_MS;
+};
+var autoUpdateDecision = (input) => {
+  if (input.isSubagentStart) return { kind: "skip", reason: "subagent_start" };
+  const offReason = autoUpdateOffReason(input);
+  if (offReason !== null) return { kind: "skip", reason: offReason };
+  const prefix = input.packageRoot === void 0 ? null : globalInstallPrefix(input.packageRoot);
+  if (prefix === null) return { kind: "skip", reason: "not_global_install" };
+  if (checkedWithinInterval(input.state.lastCheckAt, input.now)) return { kind: "skip", reason: "checked_recently" };
+  return { kind: "check", prefix };
+};
+var parseAutoUpdateFlag = (args) => {
+  const token = args.find((arg) => arg === AUTO_UPDATE_FLAG || arg.startsWith(`${AUTO_UPDATE_FLAG}=`));
+  if (token === void 0) return { kind: "absent" };
+  if (token === AUTO_UPDATE_FLAG) return { kind: "run" };
+  const value = token.slice(AUTO_UPDATE_FLAG.length + 1);
+  if (value === "on") return { kind: "set", enabled: true };
+  if (value === "off") return { kind: "set", enabled: false };
+  return { kind: "invalid", value };
+};
+var AUTO_UPDATE_RESULT_LABELS = {
+  updated: "updated",
+  finish_pending: "installed; configuration refresh pending",
+  current: "up to date",
+  needs_manual: "needs a manual upgrade",
+  failed: "failed"
+};
+var versionsOf = (state) => state.from && state.to ? `${state.from} to ${state.to}` : state.from;
+var describeAutoUpdateCheck = (state) => {
+  const label = state.lastResult ? AUTO_UPDATE_RESULT_LABELS[state.lastResult] : "no result recorded";
+  return [label, versionsOf(state), state.detail].filter(Boolean).join(", ");
+};
+var hasPendingUpgradeFinish = (state, installed) => state.to === installed && (state.lastResult === "finish_pending" || state.lastResult === "updated" && Boolean(state.detail));
+var pendingAutoUpdateAnnouncement = (state) => state.lastResult === "updated" && state.announced !== true && state.from && state.to ? { from: state.from, to: state.to } : null;
+var describeAutoUpdateAnnouncement = (announcement) => `Pushary updated itself from ${announcement.from} to ${announcement.to}.`;
+var takeAutoUpdateAnnouncement = (statePath, markAnnounced) => {
+  try {
+    const announcement = pendingAutoUpdateAnnouncement(readAutoUpdateState(statePath));
+    if (announcement && markAnnounced) updateAutoUpdateState(statePath, { announced: true });
+    return announcement;
+  } catch {
+    return null;
+  }
+};
+var readAutoUpdateState = (statePath) => {
+  const read = readJsonSafe(statePath);
+  return read.kind === "ok" ? parseAutoUpdateState(read.value) : {};
+};
+var updateAutoUpdateState = (statePath, patch) => {
+  const next = { ...readAutoUpdateState(statePath), ...patch };
+  writeJsonAtomic(statePath, next);
+  return next;
+};
+var ignoreSpawnFailure = () => void 0;
+var spawnDetached = (command, args, cwd) => {
+  const child = spawn(command, [...args], { cwd, detached: true, stdio: "ignore" });
+  child.on("error", ignoreSpawnFailure);
+  child.unref();
+};
+var triggerAutoUpdate = (trigger) => {
+  try {
+    const statePath = trigger.statePath ?? autoUpdateState();
+    const now = trigger.now ?? Date.now();
+    const decision = autoUpdateDecision({
+      env: trigger.env ?? process.env,
+      state: readAutoUpdateState(statePath),
+      now,
+      platform: trigger.platform ?? process.platform,
+      packageRoot: trigger.packageRoot ?? ownPackageRoot(),
+      isSubagentStart: trigger.isSubagentStart
+    });
+    if (decision.kind === "skip") return decision;
+    updateAutoUpdateState(statePath, { lastCheckAt: new Date(now).toISOString() });
+    const spawnUpgrade = trigger.spawn ?? spawnDetached;
+    spawnUpgrade(trigger.execPath ?? process.execPath, [upgradeEntryFor(decision.prefix), AUTO_UPDATE_FLAG], dirname(statePath));
+    return decision;
+  } catch {
+    return null;
+  }
+};
+
+export {
+  AUTO_UPDATE_DISABLE_ENV,
+  isAutoUpdateDisabledByEnv,
+  autoUpdateOffReason,
+  globalInstallPrefix,
+  upgradeEntryFor,
+  parseAutoUpdateFlag,
+  describeAutoUpdateCheck,
+  hasPendingUpgradeFinish,
+  describeAutoUpdateAnnouncement,
+  takeAutoUpdateAnnouncement,
+  readAutoUpdateState,
+  updateAutoUpdateState,
+  triggerAutoUpdate
+};

package/dist/{chunk-2UMNXADU.js → chunk-OSJEMXSR.js}

@@ -1,3 +1,7 @@
+import {
+  NPX_LATEST_COMMAND
+} from "./chunk-EA3IELHP.js";
+
 // src/config.ts
 import { readFileSync } from "fs";
 import { join } from "path";
@@ -33,7 +37,7 @@ var getApiKey = () => {
   const fileKey = readKeyFromConfigFile();
   if (fileKey) return fileKey;
   throw new Error(
-    "PUSHARY_API_KEY is not set and no key was found in ~/.pushary/config.json. Run `npx @pushary/agent-hooks setup`, or get your API key at https://pushary.com/sign-up?from=ai-coding"
+    `PUSHARY_API_KEY is not set and no key was found in ~/.pushary/config.json. Run \`${NPX_LATEST_COMMAND} setup\`, or get your API key at https://pushary.com/sign-up?from=ai-coding`
   );
 };
 var getBaseUrl = () => process.env.PUSHARY_BASE_URL?.trim() || process.env.PUSHARY_API_URL?.trim() || "https://pushary.com";

package/dist/{chunk-TWWLVOPB.js → chunk-P4BNYJ5Q.js}

@@ -1,12 +1,12 @@
+import {
+  EXIT
+} from "./chunk-KZERVKTD.js";
 import {
   renderCommandHelp
-} from "./chunk-FAH3D74E.js";
+} from "./chunk-EA3IELHP.js";
 import {
   getPackageVersion
-} from "./chunk-DINDL2CF.js";
-import {
-  EXIT
-} from "./chunk-KZERVKTD.js";
+} from "./chunk-HWJW3CPO.js";
 
 // src/cli/usage.ts
 var exitOnHelpFlag = (command) => {

package/dist/{chunk-XDP3UYH5.js → chunk-PJ27EHCD.js}

@@ -1,7 +1,7 @@
 import {
   activeHookSource,
   activeIdentity
-} from "./chunk-VIOL2DJS.js";
+} from "./chunk-R5KY3PBN.js";
 import {
   blockedActionFingerprint,
   defersToNativeMode,
@@ -9,11 +9,11 @@ import {
   hasBlockedActionHint,
   recordBlockedActionHint,
   reportMachineDenial
-} from "./chunk-SUWRZYQG.js";
+} from "./chunk-MDJJW3LP.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-LEAAERSQ.js";
+} from "./chunk-43ZDACBO.js";
 import {
   denyReasonFrom,
   isDeferAnswer
@@ -36,7 +36,7 @@ import {
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-G653QPTR.js";
+} from "./chunk-D573TLP6.js";
 import {
   DECISION_STOP_REASON,
   askUser,
@@ -48,14 +48,14 @@ import {
   requestGate,
   sendNotification,
   waitForQuestion
-} from "./chunk-LGXUGYUH.js";
+} from "./chunk-PYCQXCI5.js";
 import {
   getMachineId
-} from "./chunk-NHTAHAIS.js";
+} from "./chunk-WOLPADR6.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-2UMNXADU.js";
+} from "./chunk-OSJEMXSR.js";
 import {
   AGENT_QUESTION_STRATEGY,
   GATE_BLOCK_REASON_MAX_LENGTH,
@@ -79,7 +79,7 @@ import {
   parseAgentQuestions,
   resolveGate,
   stoppedOutput
-} from "./chunk-SOUZBGYJ.js";
+} from "./chunk-T4QY64OR.js";
 
 // src/decision-episode.ts
 var EPISODE_PATH = "/api/agent/decision-episode";

package/dist/{chunk-LGXUGYUH.js → chunk-PYCQXCI5.js}

@@ -1,12 +1,12 @@
 import {
   callMcpTool
-} from "./chunk-EYRGBYZG.js";
+} from "./chunk-HETOKNIL.js";
 import {
   installProxyDispatcher
 } from "./chunk-SAF6HGAA.js";
 import {
   getBaseUrl
-} from "./chunk-2UMNXADU.js";
+} from "./chunk-OSJEMXSR.js";
 
 // src/api.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-VIOL2DJS.js → chunk-R5KY3PBN.js}

@@ -3,28 +3,28 @@ import {
   addPusharyToolPermissions,
   isPusharyHook,
   removeClaudeMcpServers
-} from "./chunk-II7PUMPB.js";
+} from "./chunk-4ERLRNOK.js";
 import {
   CLAUDE_HOOK_EVENTS,
   addGeminiMcpServer,
   removeGeminiMcpServer
-} from "./chunk-LPYCPFBZ.js";
+} from "./chunk-2AUIEZYS.js";
 import {
   CLAUDE_CODE_AGENT,
   parseApplyPatchFiles
-} from "./chunk-G653QPTR.js";
+} from "./chunk-D573TLP6.js";
 import {
   guardBinary,
   holdBudgetOf,
   registerHookEntry
-} from "./chunk-TRLFZKVG.js";
+} from "./chunk-6IU45EHE.js";
 import {
   PHONE_ANSWERED_TOOLS,
   hookCompatibleProfile,
   hookCompatibleProfileBySource,
   toToolLookup,
   withHookHoldBudget
-} from "./chunk-SOUZBGYJ.js";
+} from "./chunk-T4QY64OR.js";
 
 // src/compatible-config.ts
 import { homedir } from "os";