@pushary/agent-hooks 1.5.0 → 1.5.1

package/dist/chunk-6EEANS74.js

@@ -0,0 +1,300 @@
+import {
+  spawnClaude
+} from "./chunk-XHKBHWLX.js";
+import {
+  codexHome,
+  codexHooksJsonIn,
+  isPusharyCodexCommand,
+  resolvePathBinary
+} from "./chunk-6IU45EHE.js";
+import {
+  getPackageVersion
+} from "./chunk-HWJW3CPO.js";
+
+// src/codex-app-server.ts
+import { existsSync, realpathSync } from "fs";
+import { join } from "path";
+var CODEX_HOOK_STATUS = {
+  trusted: "trusted",
+  untrusted: "untrusted",
+  modified: "modified",
+  managed: "managed",
+  disabled: "disabled",
+  notListed: "not listed"
+};
+var CODEX_APP_SERVER_ARGS = ["app-server"];
+var CODEX_APP_SERVER_TIMEOUT_MS = 1e4;
+var TERMINATE_GRACE_MS = 1e3;
+var MAX_RPC_LINE = 4 * 1024 * 1024;
+var STDERR_TAIL_LIMIT = 400;
+var PUSHARY_CLIENT_NAME = "pushary";
+var METHOD_INITIALIZE = "initialize";
+var METHOD_INITIALIZED = "initialized";
+var METHOD_HOOKS_LIST = "hooks/list";
+var METHOD_CONFIG_BATCH_WRITE = "config/batchWrite";
+var HOOKS_STATE_KEY_PATH = "hooks.state";
+var CODEX_INSTALLATION_ID_FILE = "installation_id";
+var CODEX_NOT_ASKED = {
+  notInteractive: "Pushary only starts Codex when you run setup, upgrade or doctor yourself at a terminal",
+  noCodexOnPath: "there is no codex command on PATH",
+  neverOpened: "Codex has not been opened on this machine yet"
+};
+var UNRECOGNISED_LISTING = "Codex answered hooks/list in a shape Pushary does not recognise";
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isCodexListedHook = (value) => isRecord(value) && typeof value.key === "string" && typeof value.eventName === "string" && typeof value.command === "string" && typeof value.sourcePath === "string" && typeof value.enabled === "boolean" && typeof value.isManaged === "boolean" && typeof value.currentHash === "string" && typeof value.trustStatus === "string";
+var listedHookFields = (hook) => ({
+  key: hook.key,
+  eventName: hook.eventName,
+  command: hook.command,
+  sourcePath: hook.sourcePath,
+  enabled: hook.enabled,
+  isManaged: hook.isManaged,
+  currentHash: hook.currentHash,
+  trustStatus: hook.trustStatus
+});
+var diagnosticMessages = (value) => {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((entry) => {
+    if (typeof entry === "string") return [entry];
+    if (isRecord(entry) && typeof entry.message === "string") return [entry.message];
+    return [];
+  });
+};
+var hooksListingOf = (result) => {
+  if (!isRecord(result) || !Array.isArray(result.data)) return null;
+  const hooks = [];
+  const warnings = [];
+  for (const layer of result.data) {
+    if (!isRecord(layer) || !Array.isArray(layer.hooks)) return null;
+    hooks.push(...layer.hooks.filter(isCodexListedHook).map(listedHookFields));
+    warnings.push(...diagnosticMessages(layer.warnings), ...diagnosticMessages(layer.errors));
+  }
+  return { hooks, warnings };
+};
+var isPusharyHookIn = (hooksJsonPath, hook) => hook.sourcePath === hooksJsonPath && isPusharyCodexCommand(hook.command);
+var isTrustableByPushary = (hook) => hook.enabled && !hook.isManaged && hook.trustStatus !== CODEX_HOOK_STATUS.managed;
+var pusharyHooksIn = (hooks, hooksJsonPath) => hooks.filter((hook) => isPusharyHookIn(hooksJsonPath, hook));
+var selectPusharyCodexHooks = (hooks, hooksJsonPath) => pusharyHooksIn(hooks, hooksJsonPath).filter(isTrustableByPushary);
+var codexTrustVerdict = (hooks, hooksJsonPath) => {
+  if (pusharyHooksIn(hooks, hooksJsonPath).length === 0) return { kind: "unlisted" };
+  const untrusted = selectPusharyCodexHooks(hooks, hooksJsonPath).filter((hook) => hook.trustStatus !== CODEX_HOOK_STATUS.trusted);
+  return untrusted.length === 0 ? { kind: "trusted" } : { kind: "untrusted", hooks: untrusted };
+};
+var codexTrustEdit = (hooks) => ({
+  edits: [{
+    keyPath: HOOKS_STATE_KEY_PATH,
+    mergeStrategy: "upsert",
+    value: Object.fromEntries(hooks.map((hook) => [hook.key, { trusted_hash: hook.currentHash }]))
+  }],
+  reloadUserConfig: true
+});
+var initializeParams = (clientVersion) => ({
+  clientInfo: { name: PUSHARY_CLIENT_NAME, title: null, version: clientVersion }
+});
+var hooksListParams = (cwd) => ({ cwds: [cwd] });
+var hookEventOf = (eventName) => eventName.charAt(0).toUpperCase() + eventName.slice(1);
+var readingOf = (hook) => ({
+  event: hookEventOf(hook.eventName),
+  status: hook.enabled ? hook.trustStatus : CODEX_HOOK_STATUS.disabled
+});
+var codexHookTrustByEvent = (events, hooks) => events.map((event) => hooks.map(readingOf).find((reading) => reading.event === event) ?? { event, status: CODEX_HOOK_STATUS.notListed });
+var CODEX_TRUST_FAILURES = /* @__PURE__ */ new Set([CODEX_HOOK_STATUS.untrusted, CODEX_HOOK_STATUS.modified]);
+var isCodexTrustFailure = (reading) => CODEX_TRUST_FAILURES.has(reading.status);
+var eventsWithStatus = (readings, status) => readings.filter((reading) => reading.status === status).map((reading) => reading.event);
+var assessCodexHookTrust = (events, hooks) => {
+  const readings = codexHookTrustByEvent(events, hooks);
+  const notListed = eventsWithStatus(readings, CODEX_HOOK_STATUS.notListed);
+  if (readings.length > 0 && notListed.length === readings.length) return { kind: "unlisted" };
+  const disabled = eventsWithStatus(readings, CODEX_HOOK_STATUS.disabled);
+  const failures = readings.filter(isCodexTrustFailure);
+  if (failures.length > 0) return { kind: "untrusted", failures, notListed, disabled };
+  const trusted = eventsWithStatus(readings, CODEX_HOOK_STATUS.trusted).length;
+  return { kind: "trusted", trusted, total: readings.length, notListed, disabled };
+};
+var mayAskCodex = (conditions) => {
+  if (!conditions.interactive) return { kind: "skipped", reason: CODEX_NOT_ASKED.notInteractive };
+  if (!conditions.codexOnPath) return { kind: "skipped", reason: CODEX_NOT_ASKED.noCodexOnPath };
+  if (!conditions.codexOpenedBefore) return { kind: "skipped", reason: CODEX_NOT_ASKED.neverOpened };
+  return { kind: "ask", binary: conditions.codexOnPath };
+};
+var canonicalPath = (path) => {
+  try {
+    return realpathSync(path);
+  } catch {
+    return path;
+  }
+};
+var withCanonicalSources = (hooks) => hooks.map((hook) => ({ ...hook, sourcePath: canonicalPath(hook.sourcePath) }));
+var hasExited = (child) => child.exitCode !== null || child.signalCode !== null;
+var waitForExit = (child, ms) => new Promise((resolve) => {
+  if (hasExited(child)) return resolve(true);
+  const timer = setTimeout(() => resolve(false), ms);
+  child.once("exit", () => {
+    clearTimeout(timer);
+    resolve(true);
+  });
+});
+var terminate = async (child) => {
+  if (child.pid === void 0 || hasExited(child)) return;
+  child.stdin?.end();
+  child.kill("SIGTERM");
+  if (await waitForExit(child, TERMINATE_GRACE_MS)) return;
+  child.kill("SIGKILL");
+  await waitForExit(child, TERMINATE_GRACE_MS);
+};
+var rpcErrorMessage = (error) => isRecord(error) && typeof error.message === "string" ? error.message : "Codex returned an error";
+var describeExit = (code, signal, stderr) => {
+  const how = signal ? `signal ${signal}` : `code ${code ?? "unknown"}`;
+  const tail = stderr.trim();
+  return tail ? `Codex app-server exited (${how}): ${tail}` : `Codex app-server exited (${how})`;
+};
+var runCodexAppServer = (launch, conversation) => {
+  const child = spawnClaude(launch.binary, CODEX_APP_SERVER_ARGS, {
+    cwd: launch.codexHome,
+    env: { ...process.env, CODEX_HOME: launch.codexHome },
+    stdio: ["pipe", "pipe", "pipe"],
+    windowsHide: true
+  });
+  const pending = /* @__PURE__ */ new Map();
+  let nextId = 1;
+  let buffer = "";
+  let stderrTail = "";
+  let stoppedReason = null;
+  let stop = () => {
+  };
+  const stopped = new Promise((resolve) => {
+    stop = (reason) => {
+      if (stoppedReason !== null) return;
+      stoppedReason = reason;
+      for (const settle of pending.values()) settle({ kind: "error", message: reason });
+      pending.clear();
+      resolve({ kind: "unavailable", reason });
+    };
+  });
+  const write = (message) => {
+    if (stoppedReason === null) child.stdin?.write(`${JSON.stringify(message)}
+`);
+  };
+  const handleLine = (line) => {
+    let message;
+    try {
+      message = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (!isRecord(message) || typeof message.id !== "number" || "method" in message) return;
+    const settle = pending.get(message.id);
+    if (!settle) return;
+    pending.delete(message.id);
+    settle("error" in message && message.error !== void 0 && message.error !== null ? { kind: "error", message: rpcErrorMessage(message.error) } : { kind: "result", value: message.result });
+  };
+  child.stdin?.on("error", () => {
+  });
+  child.stdout?.setEncoding("utf8");
+  child.stdout?.on("data", (chunk) => {
+    buffer += chunk;
+    let newline = buffer.indexOf("\n");
+    while (newline >= 0) {
+      handleLine(buffer.slice(0, newline));
+      buffer = buffer.slice(newline + 1);
+      newline = buffer.indexOf("\n");
+    }
+    if (buffer.length > MAX_RPC_LINE) stop("Codex app-server sent an oversized message");
+  });
+  child.stderr?.setEncoding("utf8");
+  child.stderr?.on("data", (chunk) => {
+    stderrTail = (stderrTail + chunk).slice(-STDERR_TAIL_LIMIT);
+  });
+  child.once("error", (error) => stop(`could not start ${launch.binary}: ${error.message}`));
+  child.once("close", (code, signal) => stop(describeExit(code, signal, stderrTail)));
+  const timer = setTimeout(
+    () => stop(`Codex app-server did not answer within ${launch.timeoutMs / 1e3}s`),
+    launch.timeoutMs
+  );
+  const session = {
+    request: (method, params) => {
+      if (stoppedReason !== null) return Promise.resolve({ kind: "error", message: stoppedReason });
+      const id = nextId++;
+      return new Promise((resolve) => {
+        pending.set(id, resolve);
+        write({ id, method, params });
+      });
+    },
+    notify: (method) => write({ method })
+  };
+  const conversed = conversation(session).catch((error) => ({
+    kind: "unavailable",
+    reason: error instanceof Error ? error.message : String(error)
+  }));
+  return Promise.race([conversed, stopped]).finally(async () => {
+    clearTimeout(timer);
+    await terminate(child);
+  });
+};
+var launchOf = (options) => {
+  const home = options.codexHome ?? codexHome();
+  const decision = mayAskCodex({
+    interactive: options.interactive ?? process.stdout.isTTY === true,
+    codexOnPath: options.codexOnPath === void 0 ? resolvePathBinary("codex") ?? null : options.codexOnPath,
+    codexOpenedBefore: existsSync(join(home, CODEX_INSTALLATION_ID_FILE))
+  });
+  if (decision.kind === "skipped") return decision;
+  return { binary: decision.binary, codexHome: home, timeoutMs: options.timeoutMs ?? CODEX_APP_SERVER_TIMEOUT_MS };
+};
+var isSkipped = (value) => "kind" in value && value.kind === "skipped";
+var openSession = async (session) => {
+  const initialized = await session.request(METHOD_INITIALIZE, initializeParams(getPackageVersion()));
+  if (initialized.kind === "error") return { kind: "unavailable", reason: `Codex refused initialize: ${initialized.message}` };
+  session.notify(METHOD_INITIALIZED);
+  return null;
+};
+var listHooks = async (session, launch) => {
+  const listed = await session.request(METHOD_HOOKS_LIST, hooksListParams(launch.codexHome));
+  if (listed.kind === "error") return { kind: "unavailable", reason: `Codex could not list hooks: ${listed.message}` };
+  const listing = hooksListingOf(listed.value);
+  if (!listing) return { kind: "unavailable", reason: UNRECOGNISED_LISTING };
+  return { hooks: withCanonicalSources(listing.hooks), warnings: listing.warnings };
+};
+var isListing = (value) => !("kind" in value);
+var confirmationAfterWrite = (listing, hooksJsonPath, writeError) => {
+  const verdict = codexTrustVerdict(listing.hooks, hooksJsonPath);
+  if (verdict.kind === "trusted") return { kind: "verified", wrote: true };
+  if (verdict.kind === "unlisted") return { kind: "unlisted", warnings: listing.warnings };
+  return { kind: "refused", hooks: verdict.hooks.map(readingOf), writeError };
+};
+var trustConversation = (launch, hooksJsonPath) => async (session) => {
+  const unavailable = await openSession(session);
+  if (unavailable) return unavailable;
+  const before = await listHooks(session, launch);
+  if (!isListing(before)) return before;
+  const verdict = codexTrustVerdict(before.hooks, hooksJsonPath);
+  if (verdict.kind === "trusted") return { kind: "verified", wrote: false };
+  if (verdict.kind === "unlisted") return { kind: "unlisted", warnings: before.warnings };
+  const written = await session.request(METHOD_CONFIG_BATCH_WRITE, codexTrustEdit(verdict.hooks));
+  const after = await listHooks(session, launch);
+  if (!isListing(after)) return after;
+  return confirmationAfterWrite(after, hooksJsonPath, written.kind === "error" ? written.message : null);
+};
+var listingConversation = (launch, hooksJsonPath) => async (session) => {
+  const unavailable = await openSession(session);
+  if (unavailable) return unavailable;
+  const listing = await listHooks(session, launch);
+  if (!isListing(listing)) return listing;
+  return { kind: "listed", hooks: pusharyHooksIn(listing.hooks, hooksJsonPath) };
+};
+var ensureCodexTrustsPusharyHooks = async (options = {}) => {
+  const launch = launchOf(options);
+  if (isSkipped(launch)) return launch;
+  return runCodexAppServer(launch, trustConversation(launch, canonicalPath(codexHooksJsonIn(launch.codexHome))));
+};
+var readCodexTrustForPusharyHooks = async (options = {}) => {
+  const launch = launchOf(options);
+  if (isSkipped(launch)) return launch;
+  return runCodexAppServer(launch, listingConversation(launch, canonicalPath(codexHooksJsonIn(launch.codexHome))));
+};
+
+export {
+  assessCodexHookTrust,
+  ensureCodexTrustsPusharyHooks,
+  readCodexTrustForPusharyHooks
+};

package/dist/{chunk-DYHXOXUF.js → chunk-6IU45EHE.js}

@@ -314,7 +314,8 @@ var CODEX_HOOK_BINARY = "pushary-codex-hook";
 var codexHome = () => codexHomeFrom(homedir());
 var codexHomeFrom = (home) => process.env.CODEX_HOME?.trim() || join2(home, ".codex");
 var codexConfigToml = () => join2(codexHome(), "config.toml");
-var codexHooksJson = () => join2(codexHome(), "hooks.json");
+var codexHooksJsonIn = (home) => join2(home, "hooks.json");
+var codexHooksJson = () => codexHooksJsonIn(codexHome());
 var codexAgentsMd = () => join2(codexHome(), "AGENTS.md");
 var codexSkillDir = () => join2(codexHome(), "skills", "pushary");
 var CODEX_HOOK_EVENTS = [
@@ -386,10 +387,11 @@ var readCodexMcpAuth = (config) => {
   if (typeof pushary.bearer_token === "string") return { method: "legacy-bearer" };
   return void 0;
 };
+var isPusharyCodexCommand = (command) => command.includes(CODEX_HOOK_BINARY) || command.includes(HOOK_LOCATOR_BINARY);
 var isPusharyCommand = (hook, scope) => {
   const command = String(asRecord2(hook)?.command ?? "");
   if (isProtectedByScope(command, scope)) return false;
-  return command.includes(CODEX_HOOK_BINARY) || command.includes(HOOK_LOCATOR_BINARY);
+  return isPusharyCodexCommand(command);
 };
 var isPusharyCodexHook = (entry, scope) => {
   const hooks = asRecord2(entry)?.hooks;
@@ -463,23 +465,6 @@ var codexEntryTrustHash = (eventKey, entry) => {
   if (typeof entry.matcher === "string") identity.matcher = entry.matcher;
   return "sha256:" + createHash("sha256").update(canonicalJson(identity), "utf8").digest("hex");
 };
-var codexTrustSchemeAgrees = (hooksConfig, config, hooksJsonPath) => {
-  const hooks = asRecord2(hooksConfig?.hooks);
-  const state = asRecord2(asRecord2(config.hooks)?.state);
-  if (!hooks || !state) return false;
-  for (const [event, entries] of Object.entries(hooks)) {
-    if (!Array.isArray(entries)) continue;
-    const eventKey = CODEX_EVENT_KEY[event] ?? codexEventKeyOf(event);
-    for (const [index, entry] of entries.entries()) {
-      const record = asRecord2(entry);
-      if (!record) continue;
-      const stored = asRecord2(state[`${hooksJsonPath}:${eventKey}:${index}:0`])?.trusted_hash;
-      if (typeof stored !== "string") continue;
-      if (stored === codexEntryTrustHash(eventKey, record)) return true;
-    }
-  }
-  return false;
-};
 var codexHookPositions = (hooksConfig) => {
   const hooks = asRecord2(hooksConfig?.hooks);
   const positions = {};
@@ -676,18 +661,19 @@ export {
   codexHome,
   codexHomeFrom,
   codexConfigToml,
+  codexHooksJsonIn,
   codexHooksJson,
   codexAgentsMd,
   codexSkillDir,
   CODEX_HOOK_EVENTS,
   addCodexMcpServer,
   readCodexMcpAuth,
+  isPusharyCodexCommand,
   codexRegistrationHolder,
   addCodexHooks,
   removeCodexHooks,
   hasCodexHooks,
   missingCodexHookEvents,
-  codexTrustSchemeAgrees,
   codexHookPositions,
   codexVacatedIndexes,
   dropVacatedCodexHookTrust,

package/dist/{chunk-ORLJNJEO.js → chunk-6QFEQIPM.js}

@@ -1,6 +1,6 @@
 import {
   registerTranscript
-} from "./chunk-NFKVRMTM.js";
+} from "./chunk-TZGCUNOX.js";
 import {
   degradedLine
 } from "./chunk-T4QY64OR.js";

package/dist/chunk-BY2CRWBO.js

@@ -0,0 +1,38 @@
+import {
+  NPX_LATEST_COMMAND
+} from "./chunk-EA3IELHP.js";
+
+// src/setup/codex-trust.ts
+var CODEX_TRUST_TELEMETRY = {
+  verified: "verified",
+  refused: "manual",
+  unlisted: "manual",
+  skipped: "unverified",
+  unavailable: "unverified"
+};
+var isUnanswered = (confirmation) => confirmation.kind === "skipped" || confirmation.kind === "unavailable";
+var codexTrustOutcome = (confirmation, portedTrustWritten) => isUnanswered(confirmation) && !portedTrustWritten ? "manual" : CODEX_TRUST_TELEMETRY[confirmation.kind];
+var CODEX_TRUST_REFUSED = "Codex did not accept the trust Pushary asked for, so its hooks are not trusted yet. Open Codex, run /hooks, and choose Trust for the Pushary hooks.";
+var describeUnlistedCodexHooks = (warnings) => {
+  const said = warnings[0] ? ` Codex said: ${warnings[0]}` : "";
+  return `Codex does not list the Pushary hooks, so it will not run them.${said} Run ${NPX_LATEST_COMMAND} doctor for details.`;
+};
+var describeCodexTrustConfirmation = (confirmation) => {
+  switch (confirmation.kind) {
+    case "verified":
+      return confirmation.wrote ? "Codex trusted the Pushary hooks when asked, and confirmed it." : "Codex confirms the Pushary hooks are trusted.";
+    case "refused":
+      return confirmation.writeError ? `${CODEX_TRUST_REFUSED} Codex said: ${confirmation.writeError}` : CODEX_TRUST_REFUSED;
+    case "unlisted":
+      return describeUnlistedCodexHooks(confirmation.warnings);
+    case "skipped":
+      return `Pushary did not ask Codex to confirm the trust: ${confirmation.reason}.`;
+    case "unavailable":
+      return `Codex could not be asked to confirm the Pushary hooks are trusted (${confirmation.reason}).`;
+  }
+};
+
+export {
+  codexTrustOutcome,
+  describeCodexTrustConfirmation
+};

package/dist/{chunk-FDHMNT24.js → chunk-D573TLP6.js}

@@ -10,7 +10,7 @@ import {
 } from "./chunk-PYCQXCI5.js";
 import {
   getMachineId
-} from "./chunk-UQHUUZ5H.js";
+} from "./chunk-WOLPADR6.js";
 import {
   withRetry
 } from "./chunk-HETOKNIL.js";

package/dist/{chunk-3NBODGQS.js → chunk-HUAOMX4U.js}

@@ -1,6 +1,6 @@
 import {
   parseVersion
-} from "./chunk-EADZPVYW.js";
+} from "./chunk-2AUIEZYS.js";
 
 // src/setup/agent-probe.ts
 import { execSync } from "child_process";

package/dist/{chunk-F57RGL7K.js → chunk-IV3RHICU.js}

@@ -2,17 +2,17 @@ import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-KEOLNHR3.js";
+} from "./chunk-5ZZG76S2.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-7XT76LWT.js";
+} from "./chunk-X7FESZTD.js";
 import {
   getMachineId
-} from "./chunk-UQHUUZ5H.js";
+} from "./chunk-WOLPADR6.js";
 import {
   readControlMode,
   readKeySource

package/dist/{chunk-PNNBMH4E.js → chunk-JKBDGZFL.js}

@@ -1,18 +1,21 @@
 import {
   detectClaudeVersion
-} from "./chunk-3NBODGQS.js";
+} from "./chunk-HUAOMX4U.js";
+import {
+  ensureCodexTrustsPusharyHooks
+} from "./chunk-6EEANS74.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "./chunk-J4J45VPZ.js";
+} from "./chunk-4ERLRNOK.js";
 import {
   claudeUnprovenHolds,
   claudeWired,
   codexUnprovenHolds,
   codexWired,
   geminiWired
-} from "./chunk-NTQSICPJ.js";
+} from "./chunk-Z4VGIBJ7.js";
 import {
   CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
@@ -24,7 +27,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-EADZPVYW.js";
+} from "./chunk-2AUIEZYS.js";
 import {
   CODEX_HOOK_BINARY,
   addCodexHookTrust,
@@ -44,7 +47,7 @@ import {
   registrationHolderOf,
   resolveGlobalBinary,
   vscodePluginMcp
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-6IU45EHE.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -309,6 +312,8 @@ var reapplyAllAgents = (apiKey) => {
   }
   return done;
 };
+var isRewrittenCodex = (agent) => agent.id === "codex" && agent.result.hooks;
+var ensureCodexTrustAfterReapply = async (agents, options = {}) => agents.some(isRewrittenCodex) ? ensureCodexTrustsPusharyHooks(options) : null;
 
 export {
   reapplyClaudeSettings,
@@ -319,5 +324,6 @@ export {
   reapplyGeminiSettings,
   reapplyCursorPlugin,
   reapplyVsCodePlugin,
-  reapplyAllAgents
+  reapplyAllAgents,
+  ensureCodexTrustAfterReapply
 };

package/dist/{chunk-DLJN5XEU.js → chunk-KHXVTWYS.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-TUXFIVOH.js";
 import {
   codexHomeFrom
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-6IU45EHE.js";
 import {
   HOOK_COMPATIBLE_PROFILES
 } from "./chunk-T4QY64OR.js";

package/dist/{chunk-MYP4UUFH.js → chunk-M2LMXPJZ.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-6IU45EHE.js";
 import {
   readJsonSafe
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-CQYHOHOK.js → chunk-MDJJW3LP.js}

@@ -7,10 +7,10 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-FDHMNT24.js";
+} from "./chunk-D573TLP6.js";
 import {
   canonicalJson
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-6IU45EHE.js";
 import {
   writeFileAtomic
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-OSSDK5RS.js → chunk-MU3WU2FO.js}

@@ -1,6 +1,6 @@
 import {
   autoUpdateState
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-6IU45EHE.js";
 import {
   readJsonSafe,
   writeJsonAtomic
@@ -19,7 +19,7 @@ var GLOBAL_PACKAGE_SUBPATH = "/lib/node_modules/@pushary/agent-hooks";
 var UPGRADE_ENTRY_SUBPATH = ["dist", "bin", "pushary-upgrade.js"];
 var NON_GLOBAL_INSTALL_SEGMENTS = ["/_npx/", "/.volta/"];
 var NOT_DISABLED_VALUES = /* @__PURE__ */ new Set(["", "0"]);
-var AUTO_UPDATE_RESULTS = ["updated", "current", "needs_manual", "failed"];
+var AUTO_UPDATE_RESULTS = ["updated", "current", "needs_manual", "failed", "finish_pending"];
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isAutoUpdateResult = (value) => typeof value === "string" && AUTO_UPDATE_RESULTS.some((result) => result === value);
 var stringField = (record, key) => {
@@ -53,6 +53,7 @@ var autoUpdateOffReason = (input) => {
   if (input.state.disabled === true) return "disabled_by_user";
   if (isContinuousIntegration(input.env)) return "ci";
   if (input.platform === "win32") return "windows";
+  if (input.platform === "linux") return "linux";
   return null;
 };
 var globalInstallPrefix = (packageRoot) => {
@@ -89,6 +90,7 @@ var parseAutoUpdateFlag = (args) => {
 };
 var AUTO_UPDATE_RESULT_LABELS = {
   updated: "updated",
+  finish_pending: "installed; configuration refresh pending",
   current: "up to date",
   needs_manual: "needs a manual upgrade",
   failed: "failed"
@@ -98,6 +100,7 @@ var describeAutoUpdateCheck = (state) => {
   const label = state.lastResult ? AUTO_UPDATE_RESULT_LABELS[state.lastResult] : "no result recorded";
   return [label, versionsOf(state), state.detail].filter(Boolean).join(", ");
 };
+var hasPendingUpgradeFinish = (state, installed) => state.to === installed && (state.lastResult === "finish_pending" || state.lastResult === "updated" && Boolean(state.detail));
 var pendingAutoUpdateAnnouncement = (state) => state.lastResult === "updated" && state.announced !== true && state.from && state.to ? { from: state.from, to: state.to } : null;
 var describeAutoUpdateAnnouncement = (announcement) => `Pushary updated itself from ${announcement.from} to ${announcement.to}.`;
 var takeAutoUpdateAnnouncement = (statePath, markAnnounced) => {
@@ -154,6 +157,7 @@ export {
   upgradeEntryFor,
   parseAutoUpdateFlag,
   describeAutoUpdateCheck,
+  hasPendingUpgradeFinish,
   describeAutoUpdateAnnouncement,
   takeAutoUpdateAnnouncement,
   readAutoUpdateState,

package/dist/{chunk-IYTQ4B5I.js → chunk-PJ27EHCD.js}

@@ -1,7 +1,7 @@
 import {
   activeHookSource,
   activeIdentity
-} from "./chunk-JF736N4C.js";
+} from "./chunk-R5KY3PBN.js";
 import {
   blockedActionFingerprint,
   defersToNativeMode,
@@ -9,7 +9,7 @@ import {
   hasBlockedActionHint,
   recordBlockedActionHint,
   reportMachineDenial
-} from "./chunk-CQYHOHOK.js";
+} from "./chunk-MDJJW3LP.js";
 import {
   isGatingMoment,
   recordKeylessMoment
@@ -36,7 +36,7 @@ import {
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-FDHMNT24.js";
+} from "./chunk-D573TLP6.js";
 import {
   DECISION_STOP_REASON,
   askUser,
@@ -51,7 +51,7 @@ import {
 } from "./chunk-PYCQXCI5.js";
 import {
   getMachineId
-} from "./chunk-UQHUUZ5H.js";
+} from "./chunk-WOLPADR6.js";
 import {
   getApiKey,
   getBaseUrl

package/dist/{chunk-JF736N4C.js → chunk-R5KY3PBN.js}

@@ -3,21 +3,21 @@ import {
   addPusharyToolPermissions,
   isPusharyHook,
   removeClaudeMcpServers
-} from "./chunk-J4J45VPZ.js";
+} from "./chunk-4ERLRNOK.js";
 import {
   CLAUDE_HOOK_EVENTS,
   addGeminiMcpServer,
   removeGeminiMcpServer
-} from "./chunk-EADZPVYW.js";
+} from "./chunk-2AUIEZYS.js";
 import {
   CLAUDE_CODE_AGENT,
   parseApplyPatchFiles
-} from "./chunk-FDHMNT24.js";
+} from "./chunk-D573TLP6.js";
 import {
   guardBinary,
   holdBudgetOf,
   registerHookEntry
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-6IU45EHE.js";
 import {
   PHONE_ANSWERED_TOOLS,
   hookCompatibleProfile,