@pushary/agent-hooks 1.9.20 → 1.9.22

package/dist/{chunk-P77EIWBJ.js → chunk-4PERN2SO.js}

@@ -2,10 +2,10 @@ import {
   autoUpdateLock,
   installPackageGlobally,
   npmErrorMessage
-} from "./chunk-YJWEQZJC.js";
+} from "./chunk-E7EOUEGQ.js";
 import {
   writeJsonAtomic
-} from "./chunk-FT7UNIS3.js";
+} from "./chunk-AQFEP65J.js";
 
 // src/upgrade-lock.ts
 import { fork } from "child_process";

package/dist/{chunk-5C2GFTWE.js → chunk-5AZ546F6.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/{chunk-MID7BURF.js → chunk-5TLRS3AK.js}

@@ -1,9 +1,9 @@
 import {
   configFilePath
-} from "./chunk-XQ4HTTBB.js";
+} from "./chunk-75MJRC5I.js";
 import {
   normalizeInstallSource
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";

package/dist/{chunk-4ABHSCFJ.js → chunk-6IOLTFNP.js}

@@ -1,15 +1,19 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-MID7BURF.js";
+} from "./chunk-5TLRS3AK.js";
 import {
   backupFile,
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic
-} from "./chunk-FT7UNIS3.js";
+} from "./chunk-AQFEP65J.js";
 import {
   configFilePath
-} from "./chunk-XQ4HTTBB.js";
+} from "./chunk-75MJRC5I.js";
+import {
+  API_KEY_PREFIX_PATTERN,
+  isRecord
+} from "./chunk-GFXZDU4V.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";
@@ -111,7 +115,6 @@ var isDisabledExport = (line) => {
 };
 var keyPrefix = (key) => key.split(".")[0] ?? key;
 var MAC_APP_KEY_PREFIX_FIELD = "macAppKeyPrefix";
-var KEY_PREFIX_SHAPE = /^pk_[a-f0-9]+$/;
 var findKeyExport = (contents) => {
   const lines = contents.split("\n");
   for (const [index, line] of lines.entries()) {
@@ -120,6 +123,10 @@ var findKeyExport = (contents) => {
   }
   return null;
 };
+var readConfigRecord = (configPath) => {
+  const result = readJsonSafe(configPath);
+  return result.kind === "ok" && isRecord(result.value) ? result.value : null;
+};
 var keepMacAppKeyPrefix = (current, apiKey) => {
   const { [MAC_APP_KEY_PREFIX_FIELD]: recorded, ...rest } = current;
   return recorded === keyPrefix(apiKey) ? { ...rest, [MAC_APP_KEY_PREFIX_FIELD]: recorded } : rest;
@@ -214,9 +221,9 @@ var writeKey = (apiKey, options = {}) => {
       `${configPath} exists but could not be read (${existing.error.message}). Fix its permissions or remove it, then re-run setup. Nothing was changed.`
     );
   }
-  if (existing.kind === "ok") {
+  if (existing.kind === "ok" && isRecord(existing.value)) {
     current = existing.value;
-  } else if (existing.kind === "unparseable") {
+  } else if (existing.kind === "ok" || existing.kind === "unparseable") {
     configBackupPath = backupFile(configPath);
   }
   writeJsonAtomic(
@@ -238,10 +245,10 @@ var writeKey = (apiKey, options = {}) => {
 };
 var clearKey = (options = {}) => {
   const configPath = configFilePath();
-  const existing = readJsonSafe(configPath);
+  const existing = readConfigRecord(configPath);
   let removedFromConfig = false;
-  if (existing.kind === "ok" && typeof existing.value.apiKey === "string") {
-    const { apiKey: _dropped, [MAC_APP_KEY_PREFIX_FIELD]: _adopted, ...rest } = existing.value;
+  if (existing !== null && typeof existing.apiKey === "string") {
+    const { apiKey: _dropped, [MAC_APP_KEY_PREFIX_FIELD]: _adopted, ...rest } = existing;
     writeJsonAtomic(configPath, rest, KEY_FILE_MODE);
     restrictFile(configPath);
     removedFromConfig = true;
@@ -277,22 +284,18 @@ var restrictFile = (filePath) => {
   }
 };
 var readConfigKey = (configPath) => {
-  const result = readJsonSafe(configPath);
-  if (result.kind !== "ok") return null;
-  const key = typeof result.value.apiKey === "string" ? result.value.apiKey.trim() : "";
+  const apiKey = readConfigRecord(configPath)?.apiKey;
+  const key = typeof apiKey === "string" ? apiKey.trim() : "";
   return key || null;
 };
 var readConfigFileKey = () => readConfigKey(configFilePath());
 var readControlMode = (configPath = configFilePath()) => {
-  const result = readJsonSafe(configPath);
-  if (result.kind !== "ok") return null;
-  const value = result.value.controlMode;
+  const value = readConfigRecord(configPath)?.controlMode;
   return value === "auto" || value === "on" || value === "off" ? value : null;
 };
 var readTranscriptPreference = () => {
-  const result = readJsonSafe(configFilePath());
-  if (result.kind !== "ok") return null;
-  return typeof result.value.transcriptsEnabled === "boolean" ? result.value.transcriptsEnabled : null;
+  const value = readConfigRecord(configFilePath())?.transcriptsEnabled;
+  return typeof value === "boolean" ? value : null;
 };
 var readKeySource = () => {
   const configPath = configFilePath();
@@ -304,16 +307,15 @@ var readKeySource = () => {
   return { kind: "none", key: null, origin: null, drift: null };
 };
 var readMacAppKeyPrefix = (configPath = configFilePath()) => {
-  const result = readJsonSafe(configPath);
-  if (result.kind !== "ok") return null;
-  const recorded = result.value[MAC_APP_KEY_PREFIX_FIELD];
-  return typeof recorded === "string" && KEY_PREFIX_SHAPE.test(recorded) ? recorded : null;
+  const recorded = readConfigRecord(configPath)?.[MAC_APP_KEY_PREFIX_FIELD];
+  return typeof recorded === "string" && API_KEY_PREFIX_PATTERN.test(recorded) ? recorded : null;
 };
+var isAdoptedMacAppKey = (key, adoptedPrefix) => keyPrefix(key) === adoptedPrefix;
 var recordMacAppKeyPrefix = (apiKey, configPath = configFilePath()) => {
-  const result = readJsonSafe(configPath);
-  if (result.kind !== "ok" || result.value.apiKey !== apiKey) return false;
-  if (result.value[MAC_APP_KEY_PREFIX_FIELD] === keyPrefix(apiKey)) return false;
-  writeJsonAtomic(configPath, { ...result.value, [MAC_APP_KEY_PREFIX_FIELD]: keyPrefix(apiKey) }, KEY_FILE_MODE);
+  const config = readConfigRecord(configPath);
+  if (config === null || config.apiKey !== apiKey) return false;
+  if (config[MAC_APP_KEY_PREFIX_FIELD] === keyPrefix(apiKey)) return false;
+  writeJsonAtomic(configPath, { ...config, [MAC_APP_KEY_PREFIX_FIELD]: keyPrefix(apiKey) }, KEY_FILE_MODE);
   restrictFile(configPath);
   return true;
 };
@@ -354,6 +356,7 @@ export {
   readTranscriptPreference,
   readKeySource,
   readMacAppKeyPrefix,
+  isAdoptedMacAppKey,
   recordMacAppKeyPrefix,
   findExportedKeyLines,
   findExportedKeyLine

package/dist/{chunk-HILWD7WM.js → chunk-6SFTI7LM.js}

@@ -1,12 +1,12 @@
 import {
   keyCheckFromResponse
-} from "./chunk-NESTNKCA.js";
+} from "./chunk-NB2PY5JX.js";
 import {
   installNetworkDefaults
-} from "./chunk-RZCTGLUJ.js";
+} from "./chunk-WAKQYJ6T.js";
 import {
   getBaseUrl
-} from "./chunk-XQ4HTTBB.js";
+} from "./chunk-75MJRC5I.js";
 
 // src/retry.ts
 var isRetryable = (err) => {

package/dist/{chunk-DF2FSJ7B.js → chunk-6TSEEKPL.js}

@@ -3,18 +3,18 @@ import {
   addGeminiMcpServer,
   removeGeminiMcpServer,
   supportedClaudeEvents
-} from "./chunk-VOIN2NZW.js";
+} from "./chunk-YGR5PBOF.js";
 import {
   CLAUDE_CODE_AGENT,
   parseApplyPatchFiles
-} from "./chunk-CW4CF7NU.js";
+} from "./chunk-CW3QUV6B.js";
 import {
   guardBinary,
   guardBinaryRefusing,
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-YJWEQZJC.js";
+} from "./chunk-E7EOUEGQ.js";
 import {
   HOOK_LOCATOR_BINARY,
   PHONE_ANSWERED_TOOLS,
@@ -24,7 +24,7 @@ import {
   refusalOutput,
   toToolLookup,
   withHookHoldBudget
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/claude-config.ts
 import { join } from "path";

package/dist/{chunk-XQ4HTTBB.js → chunk-75MJRC5I.js}

@@ -1,6 +1,6 @@
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-LHGB64O2.js";
+} from "./chunk-TZWZVAMN.js";
 
 // src/config.ts
 import { readFileSync } from "fs";

package/dist/{chunk-MGW26CW7.js → chunk-76YNWUXC.js}

@@ -1,6 +1,6 @@
 import {
   readConfigFileKey
-} from "./chunk-4ABHSCFJ.js";
+} from "./chunk-6IOLTFNP.js";
 
 // src/bell/fleet.ts
 import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";

package/dist/{chunk-K5PUP76V.js → chunk-AGIO7SF5.js}

@@ -5,26 +5,27 @@ import {
 import {
   SubscriptionRequiredError,
   callMcpTool
-} from "./chunk-HILWD7WM.js";
+} from "./chunk-6SFTI7LM.js";
 import {
   installNetworkDefaults,
   isNetworkFailure
-} from "./chunk-RZCTGLUJ.js";
+} from "./chunk-WAKQYJ6T.js";
 import {
   clientReportClaims
-} from "./chunk-YJWEQZJC.js";
+} from "./chunk-E7EOUEGQ.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-XQ4HTTBB.js";
+} from "./chunk-75MJRC5I.js";
 import {
   ASK_AGENT_NAME_MAX,
   ASK_QUESTION_MAX,
   CLIENT_REPORT_PATH,
   DECISION_LINE_MAX,
+  GATE_PERMISSION_MODE_MAX_LENGTH,
   degradedLine,
   truncateLine
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/client-report-claim.ts
 import { createHash } from "crypto";
@@ -190,13 +191,15 @@ var unavailableQuestionUnlessSubscriptionRequired = (error) => {
   return { correlationId: "", status: "unavailable" };
 };
 var truncateOptional = (text, max) => text === void 0 ? void 0 : truncateLine(text, max);
+var boundedPermissionMode = (value) => typeof value === "string" && value.length > 0 ? value.slice(0, GATE_PERMISSION_MODE_MAX_LENGTH) : void 0;
 var withinAskUserLimits = (params) => ({
   ...params,
   question: truncateLine(params.question, ASK_QUESTION_MAX),
   agentName: truncateOptional(params.agentName, ASK_AGENT_NAME_MAX),
   intent: truncateOptional(params.intent, DECISION_LINE_MAX),
   action: truncateOptional(params.action, DECISION_LINE_MAX),
-  blocker: truncateOptional(params.blocker, DECISION_LINE_MAX)
+  blocker: truncateOptional(params.blocker, DECISION_LINE_MAX),
+  permissionMode: boundedPermissionMode(params.permissionMode)
 });
 var askUser = async (apiKey, params, timeoutMs = 15e3) => {
   const identified = params.toolUseId || params.requestId ? params : { ...params, requestId: randomUUID() };

package/dist/{chunk-FT7UNIS3.js → chunk-AQFEP65J.js}

@@ -12,7 +12,8 @@ var readJsonSafe = (filePath) => {
   }
   if (raw.trim() === "") return { kind: "ok", value: {} };
   try {
-    return { kind: "ok", value: JSON.parse(raw) };
+    const value = JSON.parse(raw);
+    return { kind: "ok", value };
   } catch (err) {
     return { kind: "unparseable", error: err, raw };
   }

package/dist/{chunk-DBEJIFJD.js → chunk-AR4NXO4Q.js}

@@ -6,12 +6,12 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-CW4CF7NU.js";
+} from "./chunk-CW3QUV6B.js";
 import {
   machineDecisionFor,
   shouldDeferToNativeMode,
   wireVerdictFor
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/machine-decision-audit.ts
 import { basename } from "path";

package/dist/{chunk-ANPECDYL.js → chunk-ARJSQUIS.js}

@@ -1,10 +1,10 @@
 import {
   pusharyDir
-} from "./chunk-YJWEQZJC.js";
+} from "./chunk-E7EOUEGQ.js";
 import {
   readJsonSafe,
   writeFileAtomic
-} from "./chunk-FT7UNIS3.js";
+} from "./chunk-AQFEP65J.js";
 import {
   DECLINED_AGENTS_FILE,
   DISCONNECT_AGENT_IDS,
@@ -13,7 +13,7 @@ import {
   serializeDeclinedAgents,
   withDeclinedAgent,
   withoutDeclinedAgent
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/declined-agents-file.ts
 import { join } from "path";

package/dist/{chunk-UVEIBBTR.js → chunk-BDGKWUK2.js}

@@ -1,9 +1,9 @@
 import {
   parseSseMessages
-} from "./chunk-HILWD7WM.js";
+} from "./chunk-6SFTI7LM.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-LHGB64O2.js";
+} from "./chunk-TZWZVAMN.js";
 
 // src/mcp-stdio-bridge.ts
 var MCP_BRIDGE_BINARY = "pushary-mcp";

package/dist/{chunk-CRW4P7JU.js → chunk-BDV4WDIA.js}

@@ -1,6 +1,6 @@
 import {
   PRETOOLUSE_GATED_TOOLS
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/claude-tools.ts
 var POSTTOOLUSE_MIRROR_ONLY_TOOLS = ["TodoWrite", "Task", "WebFetch", "WebSearch"];

package/dist/{chunk-CW4CF7NU.js → chunk-CW3QUV6B.js}

@@ -2,7 +2,7 @@ import {
   IDLE_PROMPT_NOTIFICATION,
   NOTIFICATION_PUSH_TYPES,
   POSTTOOLUSE_MIRROR_ONLY_TOOLS
-} from "./chunk-CRW4P7JU.js";
+} from "./chunk-BDV4WDIA.js";
 import {
   cancelQuestion,
   clientErrorKindOf,
@@ -10,26 +10,26 @@ import {
   reportClientError,
   sendNotification,
   waitForAnswer
-} from "./chunk-K5PUP76V.js";
+} from "./chunk-AGIO7SF5.js";
 import {
   withRetry
-} from "./chunk-HILWD7WM.js";
+} from "./chunk-6SFTI7LM.js";
 import {
   getMachineId
-} from "./chunk-XJGGGDHX.js";
+} from "./chunk-U2IEM5FF.js";
 import {
   reportedInstallSource
-} from "./chunk-MID7BURF.js";
+} from "./chunk-5TLRS3AK.js";
 import {
   canonicalJson
-} from "./chunk-YJWEQZJC.js";
+} from "./chunk-E7EOUEGQ.js";
 import {
   writeFileAtomic
-} from "./chunk-FT7UNIS3.js";
+} from "./chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-XQ4HTTBB.js";
+} from "./chunk-75MJRC5I.js";
 import {
   ACTION_BODY_MAX,
   AGENT_LABELS_BY_TYPE,
@@ -60,7 +60,7 @@ import {
   resolvePolicy,
   toToolLookup,
   truncateLine
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // ../hook-mapping/src/describe.ts
 import { isAbsolute, relative, resolve } from "path";
@@ -204,6 +204,7 @@ var parseApplyPatchOps = (command) => {
   return ops;
 };
 var parseApplyPatchFiles = (command) => [...new Set(parseApplyPatchOps(command).map((entry) => entry.path))];
+var patchDeletesFiles = (toolName, toolInput) => toolName === "apply_patch" && parseApplyPatchOps(toolInput.command).some((entry) => entry.op === "delete");
 var OPENCODE_TOOL_NAMES = {
   bash: "Bash",
   // A shell command reaching outside the worktree asks a second time under its
@@ -1359,7 +1360,6 @@ var toCodexWire = (event, decision) => {
     decision.kind === "deny" ? decision.reason : void 0
   ) ?? null;
 };
-var patchDeletesFiles = (toolName, toolInput) => toolName === "apply_patch" && parseApplyPatchOps(toolInput.command).some((entry) => entry.op === "delete");
 var describeApplyPatch = (command) => {
   const ops = parseApplyPatchOps(command);
   if (ops.length === 0) return null;
@@ -2246,6 +2246,7 @@ export {
   describeToolCall,
   deriveToolTarget,
   parseApplyPatchFiles,
+  patchDeletesFiles,
   OPENCODE_TOOL_NAMES,
   canonicalGateInputs,
   scopePathFor,
@@ -2279,7 +2280,6 @@ export {
   codexDeny,
   codexPass,
   toCodexWire,
-  patchDeletesFiles,
   describeApplyPatch,
   toPolicyLookup,
   toPolicyLookups,

package/dist/{chunk-A6U4RRFM.js → chunk-DV26ZWUC.js}

@@ -3,11 +3,11 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-XGHXQUDG.js";
+} from "./chunk-E3FSKKTJ.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-ATDOYZXC.js";
+} from "./chunk-GNQZY4GL.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-XGHXQUDG.js → chunk-E3FSKKTJ.js}

@@ -1,6 +1,6 @@
 import {
   redactSecretsFromContent
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";

package/dist/{chunk-YJWEQZJC.js → chunk-E7EOUEGQ.js}

@@ -13,7 +13,7 @@ import {
   isReleaseVersion,
   ownPackageName,
   withHookHoldBudget
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/setup/paths.ts
 import { homedir as homedir2 } from "os";
@@ -395,9 +395,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-EELV2YEK.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-VPL5AYPQ.js");
-    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-MDOKPY7A.js");
+    const { withUpgradeLock } = await import("./global-upgrade-F3QY6OHE.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-N3G5V2QS.js");
+    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-CBEAZNJR.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;

package/dist/{chunk-LU7JPQKL.js → chunk-E7HOX73X.js}

@@ -1,16 +1,16 @@
 import {
   registerTranscript
-} from "./chunk-PPAMIQOV.js";
+} from "./chunk-LH3GTSXC.js";
 import {
   namedEvent
-} from "./chunk-DF2FSJ7B.js";
+} from "./chunk-6TSEEKPL.js";
 import {
   writeDegraded
-} from "./chunk-K5PUP76V.js";
+} from "./chunk-AGIO7SF5.js";
 import {
   claudeShapedHookInput,
   hookCompatibleProfileBySource
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode"];

package/dist/{chunk-RGSG2GYV.js → chunk-G5YMVGAK.js}

@@ -14,19 +14,19 @@ import {
 } from "./chunk-FO3MDD26.js";
 import {
   callMcpTool
-} from "./chunk-HILWD7WM.js";
+} from "./chunk-6SFTI7LM.js";
 import {
   reportedInstallSource
-} from "./chunk-MID7BURF.js";
+} from "./chunk-5TLRS3AK.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-LHGB64O2.js";
+} from "./chunk-TZWZVAMN.js";
 import {
   NO_PAIRING_COMPUTER,
   PAIR_TTL_SECONDS,
   classifyConfirmResponse,
   isAnswerSource
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {