@pushary/agent-hooks 1.6.4 → 1.7.0

package/dist/{chunk-UGKDBJJX.js → chunk-X6KDKOV5.js}

@@ -1,6 +1,6 @@
 import {
   pusharyFetch
-} from "./chunk-DESAUCH2.js";
+} from "./chunk-KW2RRR7D.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
@@ -9,11 +9,11 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-OSJEMXSR.js";
+} from "./chunk-V4AQBAVG.js";
 import {
   isValidApiKey,
   normalizeKeyScope
-} from "./chunk-CAS7GFWI.js";
+} from "./chunk-YROGUPOZ.js";
 
 // src/session.ts
 var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;

package/dist/{chunk-DZTKLE7Q.js → chunk-XNCMT7YY.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-K32C2RGK.js";
+} from "./chunk-DNJUSFBL.js";
 import {
   writeFileAtomic
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-CAS7GFWI.js → chunk-YROGUPOZ.js}

@@ -151,6 +151,13 @@ var AGENTS = {
     setupCommand: AGENT_HOOKS_SETUP_COMMAND,
     enforcementDetail: "Shell, writes, edits and web fetches when OpenCode itself asks for permission."
   },
+  fx: {
+    ...defaults,
+    label: "fx",
+    connectVia: "Local MCP bridge",
+    setupCommand: AGENT_HOOKS_SETUP_COMMAND,
+    capabilityNote: "fx has no hooks that other tools can register, so Pushary cannot answer fx's own approval prompts. fx's agent reaches Pushary through its MCP tools when it chooses to ask."
+  },
   qwen_code: {
     ...defaults,
     label: "Qwen Code",
@@ -467,8 +474,8 @@ var SECRET_REDACTION_RULES = [
   { pattern: /\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, replacement: "bearer [redacted]" },
   { pattern: /\bauthorization:\s*\S+/gi, replacement: "authorization: [redacted]" },
   {
-    pattern: /((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*)("[^"]*"|'[^']*'|\S+)/gi,
-    replacement: "$1[redacted]"
+    pattern: /((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)["']?\s*[=:]\s*)(?:(")(?:\\[\s\S]|[^"\\])*(?:"|\\?$)|(')[^']*(?:'|$)|\S+)/gi,
+    replacement: "$1$2$3[redacted]$2$3"
   }
 ];
 var HIGH_ENTROPY_RULE = { pattern: /[A-Za-z0-9+/]{40,}={0,2}/g, replacement: "[redacted]" };
@@ -497,6 +504,7 @@ var SETUP_AGENT_CHOICES = [
   "cursor",
   "vscode",
   "opencode",
+  "fx",
   ...COMPATIBLE_AGENT_TYPES,
   "custom"
 ];
@@ -1324,8 +1332,7 @@ var DESTRUCTIVE_SUBCOMMANDS = /* @__PURE__ */ new Set([
 var DATA_LOSS_COMMAND_PATTERNS = [
   "Bash(git branch -D:*)",
   "Bash(git branch --delete:*)",
-  "Bash(git checkout --:*)",
-  "Bash(git checkout .:*)",
+  "Bash(git checkout:*)",
   "Bash(git restore:*)",
   "Bash(git stash drop:*)",
   "Bash(git stash clear:*)",
@@ -2498,6 +2505,63 @@ var hookActivationResult = (report) => {
   return report && !report.truncated && report.evidence.length === 1 ? report.evidence[0].result : "unverified";
 };
 
+// src/cli/version.ts
+import { readFileSync } from "fs";
+import { dirname, join, parse } from "path";
+import { fileURLToPath } from "url";
+var PACKAGE_NAME = "@pushary/agent-hooks";
+var UNKNOWN_VERSION = "0.0.0";
+var findOwnPackageJson = (start) => {
+  const { root } = parse(start);
+  let dir = start;
+  while (true) {
+    const candidate = join(dir, "package.json");
+    try {
+      const pkg = JSON.parse(readFileSync(candidate, "utf-8"));
+      if (pkg.name === PACKAGE_NAME) return candidate;
+    } catch {
+    }
+    if (dir === root) return void 0;
+    const parent = dirname(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+};
+var getPackageVersion = () => {
+  const root = ownPackageRoot();
+  return (root === void 0 ? void 0 : packageVersionAt(root)) ?? UNKNOWN_VERSION;
+};
+var ownPackageRoot = () => {
+  try {
+    const found = findOwnPackageJson(dirname(fileURLToPath(import.meta.url)));
+    return found ? dirname(found) : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var packageVersionAt = (packageRoot) => {
+  try {
+    const manifest = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf-8"));
+    const version = manifest && typeof manifest === "object" && "version" in manifest ? manifest.version : void 0;
+    return typeof version === "string" ? version : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var isNewerVersion = (candidate, current) => {
+  const a = candidate.split(".").map((part) => parseInt(part, 10) || 0);
+  const b = current.split(".").map((part) => parseInt(part, 10) || 0);
+  for (let i = 0; i < 3; i++) {
+    if ((a[i] ?? 0) > (b[i] ?? 0)) return true;
+    if ((a[i] ?? 0) < (b[i] ?? 0)) return false;
+  }
+  return false;
+};
+var RELEASE_VERSION = /^\d+\.\d+\.\d+$/;
+var isReleaseVersion = (value) => RELEASE_VERSION.test(value);
+var majorOf = (version) => parseInt(version.split(".")[0] ?? "", 10) || 0;
+var isSameMajorVersion = (candidate, current) => majorOf(candidate) === majorOf(current);
+
 export {
   CLAUDE_CONNECTOR_URL,
   CLAUDE_CONNECTOR_GUIDE,
@@ -2600,5 +2664,11 @@ export {
   readElicitationFields,
   planElicitationAsk,
   elicitationContent,
-  elicitationContentFromAnswers
+  elicitationContentFromAnswers,
+  getPackageVersion,
+  ownPackageRoot,
+  packageVersionAt,
+  isNewerVersion,
+  isReleaseVersion,
+  isSameMajorVersion
 };

package/dist/chunk-YYINL576.js

@@ -0,0 +1,120 @@
+import {
+  parseSseMessages
+} from "./chunk-JNXVOU6Y.js";
+import {
+  NPX_LATEST_COMMAND
+} from "./chunk-B3UXMSMW.js";
+
+// src/mcp-stdio-bridge.ts
+var MCP_BRIDGE_BINARY = "pushary-mcp";
+var MCP_BRIDGE_PATH = "/api/mcp/mcp";
+var MCP_BRIDGE_REQUEST_TIMEOUT_MS = 9e4;
+var JSON_RPC_PARSE_ERROR = -32700;
+var MCP_BRIDGE_ERROR = -32e3;
+var MCP_SESSION_HEADER = "mcp-session-id";
+var MCP_PROTOCOL_HEADER = "mcp-protocol-version";
+var INITIALIZE_METHOD = "initialize";
+var MISSING_KEY_MESSAGE = `Pushary has no API key for this machine. Run \`${NPX_LATEST_COMMAND} setup\`.`;
+var REJECTED_KEY_MESSAGE = `Pushary rejected this machine's API key. Run \`${NPX_LATEST_COMMAND} setup\` to sign in again.`;
+var PARSE_ERROR_MESSAGE = "Parse error";
+var NO_RESPONSE_MESSAGE = "Pushary sent no response.";
+var unreachableMessage = (err) => `Pushary is unreachable: ${err instanceof Error ? err.message : String(err)}`;
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var isJsonRpcId = (value) => typeof value === "string" || typeof value === "number";
+var messagesOf = (payload) => Array.isArray(payload) ? payload : [payload];
+var requestOf = (message) => {
+  const record = asRecord(message);
+  return record && typeof record.method === "string" && isJsonRpcId(record.id) ? [{ id: record.id, method: record.method }] : [];
+};
+var requestsIn = (payload) => messagesOf(payload).flatMap(requestOf);
+var isJsonRpcMessage = (message) => asRecord(message)?.jsonrpc === "2.0";
+var responseIdOf = (message) => {
+  const record = asRecord(message);
+  return record && !("method" in record) && isJsonRpcId(record.id) ? record.id : void 0;
+};
+var bridgeError = (id, message, code = MCP_BRIDGE_ERROR) => ({
+  jsonrpc: "2.0",
+  id,
+  error: { code, message }
+});
+var parseBridgeLine = (line) => {
+  try {
+    return { ok: true, payload: JSON.parse(line) };
+  } catch {
+    return { ok: false };
+  }
+};
+var parseMcpMessages = (body, contentType) => {
+  if (!body.trim()) return [];
+  if (contentType?.includes("text/event-stream")) return parseSseMessages(body);
+  const parsed = parseBridgeLine(body);
+  return parsed.ok ? messagesOf(parsed.payload) : [];
+};
+var httpFailureMessage = (status, hasKey, body) => {
+  if (status === 401) return hasKey ? REJECTED_KEY_MESSAGE : MISSING_KEY_MESSAGE;
+  const detail = body.trim().slice(0, 300);
+  return detail ? `Pushary returned ${status}: ${detail}` : `Pushary returned ${status}.`;
+};
+var negotiatedProtocolOf = (messages, initializeIds) => {
+  for (const message of messages) {
+    const id = responseIdOf(message);
+    const version = asRecord(asRecord(message)?.result)?.protocolVersion;
+    if (id !== void 0 && initializeIds.has(id) && typeof version === "string") return version;
+  }
+  return void 0;
+};
+var createMcpStdioBridge = (deps) => {
+  let sessionId = null;
+  let protocolVersion = null;
+  const headersFor = (apiKey) => ({
+    "Content-Type": "application/json",
+    "Accept": "application/json, text/event-stream",
+    ...apiKey ? { Authorization: `Bearer ${apiKey}` } : {},
+    ...sessionId ? { [MCP_SESSION_HEADER]: sessionId } : {},
+    ...protocolVersion ? { [MCP_PROTOCOL_HEADER]: protocolVersion } : {}
+  });
+  const failRequests = (requests, message, answered = /* @__PURE__ */ new Set()) => {
+    for (const request of requests) {
+      if (!answered.has(request.id)) deps.emit(bridgeError(request.id, message));
+    }
+  };
+  const post = async (line, apiKey) => deps.fetchImpl(deps.endpoint, {
+    method: "POST",
+    headers: headersFor(apiKey),
+    body: line,
+    signal: AbortSignal.timeout(deps.timeoutMs ?? MCP_BRIDGE_REQUEST_TIMEOUT_MS)
+  });
+  const forward = async (line) => {
+    const parsed = parseBridgeLine(line);
+    if (!parsed.ok) {
+      deps.emit(bridgeError(null, PARSE_ERROR_MESSAGE, JSON_RPC_PARSE_ERROR));
+      return;
+    }
+    const requests = requestsIn(parsed.payload);
+    const apiKey = deps.apiKey();
+    let response;
+    let body;
+    try {
+      response = await post(line, apiKey);
+      body = await response.text();
+    } catch (err) {
+      failRequests(requests, unreachableMessage(err));
+      return;
+    }
+    sessionId = response.headers.get(MCP_SESSION_HEADER) ?? sessionId;
+    const messages = parseMcpMessages(body, response.headers.get("content-type")).filter(isJsonRpcMessage);
+    const initializeIds = new Set(requests.filter((request) => request.method === INITIALIZE_METHOD).map((request) => request.id));
+    protocolVersion = negotiatedProtocolOf(messages, initializeIds) ?? protocolVersion;
+    for (const message of messages) deps.emit(message);
+    const answered = new Set(messages.map(responseIdOf).filter(isJsonRpcId));
+    const failure = response.ok ? NO_RESPONSE_MESSAGE : httpFailureMessage(response.status, apiKey !== null, body);
+    failRequests(requests, failure, answered);
+  };
+  return { forward };
+};
+
+export {
+  MCP_BRIDGE_BINARY,
+  MCP_BRIDGE_PATH,
+  createMcpStdioBridge
+};

package/dist/{chunk-7CLTSZOL.js → chunk-ZQ7IDOKY.js}

@@ -1,16 +1,16 @@
 import {
   NOTIFICATION_MATCHED_TYPES,
   POSTTOOLUSE_MIRRORED_TOOLS
-} from "./chunk-YUGGNZSF.js";
+} from "./chunk-DZURML2D.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-K32C2RGK.js";
+} from "./chunk-DNJUSFBL.js";
 import {
   CLAUDE_PRETOOLUSE_MATCHER,
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-CAS7GFWI.js";
+} from "./chunk-YROGUPOZ.js";
 
 // src/gemini-config.ts
 var GEMINI_HOOK_BINARY = "pushary-gemini-hook";

package/dist/{reapply-4DAJKNVP.js → reapply-6PH3FMPX.js}

@@ -9,18 +9,17 @@ import {
   reapplyGeminiSettings,
   reapplyVsCodePlugin,
   repairCodexHolds
-} from "./chunk-YPONELWS.js";
-import "./chunk-PBKEYMAO.js";
-import "./chunk-53DN77WB.js";
-import "./chunk-ZA5UXRNE.js";
-import "./chunk-YXPGFRRW.js";
-import "./chunk-7CLTSZOL.js";
+} from "./chunk-BBKNJJVX.js";
+import "./chunk-O2LEPIU6.js";
+import "./chunk-7OS4IHGI.js";
+import "./chunk-KYQXUGH7.js";
+import "./chunk-PQ4F64M2.js";
+import "./chunk-ZQ7IDOKY.js";
 import "./chunk-XHKBHWLX.js";
-import "./chunk-YUGGNZSF.js";
-import "./chunk-K32C2RGK.js";
+import "./chunk-DZURML2D.js";
+import "./chunk-DNJUSFBL.js";
 import "./chunk-T7E75EKA.js";
-import "./chunk-CAS7GFWI.js";
-import "./chunk-HWJW3CPO.js";
+import "./chunk-YROGUPOZ.js";
 export {
   ensureCodexTrustAfterReapply,
   inspectConfiguredManagedProviders,

package/dist/src/index.js

@@ -1,15 +1,15 @@
 import {
   handlePreToolUse
-} from "../chunk-5U3FJ6YF.js";
-import "../chunk-LJEL7IB5.js";
-import "../chunk-ZA5UXRNE.js";
-import "../chunk-NYMPLNV3.js";
-import "../chunk-5UWV5GHM.js";
+} from "../chunk-DVQDPI3T.js";
+import "../chunk-WUNZAE7I.js";
+import "../chunk-KYQXUGH7.js";
+import "../chunk-52NVBNJT.js";
+import "../chunk-2C7CCWVX.js";
 import "../chunk-YHG74UFF.js";
-import "../chunk-7CLTSZOL.js";
+import "../chunk-ZQ7IDOKY.js";
 import {
   fetchAccountPublicKey
-} from "../chunk-66H2QQAK.js";
+} from "../chunk-KXMZMZD3.js";
 import {
   fetchModeOverride,
   fetchModeState,
@@ -18,32 +18,31 @@ import {
   handlePostToolUse,
   handleStop,
   reportEvent
-} from "../chunk-H6XU22TN.js";
-import "../chunk-YUGGNZSF.js";
+} from "../chunk-IJ6ECPA6.js";
+import "../chunk-DZURML2D.js";
 import {
   askUser,
   cancelQuestion,
   waitForAnswer
-} from "../chunk-EREBZHN2.js";
-import "../chunk-VOCZHOXV.js";
+} from "../chunk-EGKXSQCY.js";
+import "../chunk-V6QRSU2G.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-BJENQBMH.js";
-import "../chunk-DESAUCH2.js";
-import "../chunk-DZTKLE7Q.js";
+import "../chunk-JNXVOU6Y.js";
+import "../chunk-KW2RRR7D.js";
+import "../chunk-XNCMT7YY.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-VHNDE3ZD.js";
-import "../chunk-K32C2RGK.js";
+import "../chunk-ROQK7IN3.js";
+import "../chunk-DNJUSFBL.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-OSJEMXSR.js";
+} from "../chunk-V4AQBAVG.js";
+import "../chunk-B3UXMSMW.js";
 import {
   resolvePolicy
-} from "../chunk-CAS7GFWI.js";
-import "../chunk-EA3IELHP.js";
-import "../chunk-HWJW3CPO.js";
+} from "../chunk-YROGUPOZ.js";
 export {
   askUser,
   cancelQuestion,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "1.6.4",
+  "version": "1.7.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",
@@ -67,6 +67,7 @@
     "pushary-connect": "./dist/bin/pushary-connect.js",
     "pushary-doctor": "./dist/bin/pushary-doctor.js",
     "pushary-mode": "./dist/bin/pushary-mode.js",
+    "pushary-mcp": "./dist/bin/pushary-mcp.js",
     "pushary-wait": "./dist/bin/pushary-wait.js",
     "pushary-stats": "./dist/bin/pushary-stats.js",
     "pushary-suggestions": "./dist/bin/pushary-suggestions.js",

package/dist/chunk-HWJW3CPO.js

@@ -1,65 +0,0 @@
-// src/cli/version.ts
-import { readFileSync } from "fs";
-import { dirname, join, parse } from "path";
-import { fileURLToPath } from "url";
-var PACKAGE_NAME = "@pushary/agent-hooks";
-var UNKNOWN_VERSION = "0.0.0";
-var findOwnPackageJson = (start) => {
-  const { root } = parse(start);
-  let dir = start;
-  while (true) {
-    const candidate = join(dir, "package.json");
-    try {
-      const pkg = JSON.parse(readFileSync(candidate, "utf-8"));
-      if (pkg.name === PACKAGE_NAME) return candidate;
-    } catch {
-    }
-    if (dir === root) return void 0;
-    const parent = dirname(dir);
-    if (parent === dir) return void 0;
-    dir = parent;
-  }
-};
-var getPackageVersion = () => {
-  const root = ownPackageRoot();
-  return (root === void 0 ? void 0 : packageVersionAt(root)) ?? UNKNOWN_VERSION;
-};
-var ownPackageRoot = () => {
-  try {
-    const found = findOwnPackageJson(dirname(fileURLToPath(import.meta.url)));
-    return found ? dirname(found) : void 0;
-  } catch {
-    return void 0;
-  }
-};
-var packageVersionAt = (packageRoot) => {
-  try {
-    const manifest = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf-8"));
-    const version = manifest && typeof manifest === "object" && "version" in manifest ? manifest.version : void 0;
-    return typeof version === "string" ? version : void 0;
-  } catch {
-    return void 0;
-  }
-};
-var isNewerVersion = (candidate, current) => {
-  const a = candidate.split(".").map((part) => parseInt(part, 10) || 0);
-  const b = current.split(".").map((part) => parseInt(part, 10) || 0);
-  for (let i = 0; i < 3; i++) {
-    if ((a[i] ?? 0) > (b[i] ?? 0)) return true;
-    if ((a[i] ?? 0) < (b[i] ?? 0)) return false;
-  }
-  return false;
-};
-var RELEASE_VERSION = /^\d+\.\d+\.\d+$/;
-var isReleaseVersion = (value) => RELEASE_VERSION.test(value);
-var majorOf = (version) => parseInt(version.split(".")[0] ?? "", 10) || 0;
-var isSameMajorVersion = (candidate, current) => majorOf(candidate) === majorOf(current);
-
-export {
-  getPackageVersion,
-  ownPackageRoot,
-  packageVersionAt,
-  isNewerVersion,
-  isReleaseVersion,
-  isSameMajorVersion
-};