@pushary/agent-hooks 1.9.30 → 1.9.31

package/dist/{chunk-JHVSVVHB.js → chunk-GSBOLJZ4.js}

@@ -3,46 +3,46 @@ import {
   loadPin,
   savePin,
   verifyRecipients
-} from "./chunk-VTR4VRL2.js";
+} from "./chunk-DWQYCOPI.js";
 import {
   ensureDaemonRunning
-} from "./chunk-QYD5TN2J.js";
+} from "./chunk-VFNYTVTJ.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-E2WJLU5U.js";
+} from "./chunk-7447DYNW.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-IMUCTAM2.js";
+} from "./chunk-EPVY3JU3.js";
 import {
   transcriptEnvironmentPreference,
   transcriptsEnabled
-} from "./chunk-434NFCK2.js";
+} from "./chunk-MRR4NQ3H.js";
 import {
   hookOwnerOf
-} from "./chunk-GFY6XONT.js";
+} from "./chunk-FXJ5SEQT.js";
 import {
   readTranscriptPreference
-} from "./chunk-LD3A63IE.js";
+} from "./chunk-IKJJB4QG.js";
 import {
   codexHome,
   pusharyDir
-} from "./chunk-2QEW5FJK.js";
+} from "./chunk-SRRJLA24.js";
 import {
   writeJsonAtomic
 } from "./chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-XNKFK27C.js";
+} from "./chunk-5EX2SD5N.js";
 
 // src/transcript-registration.ts
 import { createHash } from "crypto";
 import { readFileSync as readFileSync3, readdirSync as readdirSync2, statSync as statSync3, unlinkSync } from "fs";
-import { isAbsolute, join as join3, resolve as resolve2, sep } from "path";
+import { basename, isAbsolute, join as join3, resolve as resolve2, sep } from "path";
 
 // src/transcript-source.ts
 var normalizeTranscriptLines = (lines, source) => {
@@ -59,11 +59,42 @@ var normalizeTranscriptLines = (lines, source) => {
     }
   });
 };
+var createdDuringEpoch = (sighting, epochStartedAtMs) => sighting.birthtimeMs !== null && sighting.birthtimeMs >= epochStartedAtMs && sighting.birthtimeMs <= sighting.seenAtMs;
+var everythingAlreadyWritten = (sighting) => ({ identity: sighting.identity, offset: sighting.sizeBytes, startedBeforeEpoch: true });
+var cutoffAtFirstSight = (sighting, epochStartedAtMs) => sighting.identity === null || createdDuringEpoch(sighting, epochStartedAtMs) ? { identity: sighting.identity, offset: 0, startedBeforeEpoch: false } : everythingAlreadyWritten(sighting);
+var replacedOrShrunk = (previous, sighting) => previous.identity !== sighting.identity || sighting.sizeBytes < previous.offset;
+var nextTranscriptCutoff = (previous, sighting, epochStartedAtMs) => {
+  if (!previous) return cutoffAtFirstSight(sighting, epochStartedAtMs);
+  if (sighting.identity === null) return previous;
+  if (previous.identity === null) return { ...previous, identity: sighting.identity };
+  return replacedOrShrunk(previous, sighting) ? everythingAlreadyWritten(sighting) : previous;
+};
+var advancedTranscriptCutoff = (current, readFrom, settledThroughOffset) => current !== void 0 && current.identity === readFrom.identity && settledThroughOffset > current.offset ? { ...current, offset: settledThroughOffset } : current;
+var isTranscriptObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var parsedTranscriptRecord = (line) => {
+  try {
+    const value = JSON.parse(line);
+    return isTranscriptObject(value) ? value : null;
+  } catch {
+    return null;
+  }
+};
+var stampedBefore = (record, momentMs) => {
+  if (typeof record.timestamp !== "string") return false;
+  const stamped = Date.parse(record.timestamp);
+  return Number.isFinite(stamped) && stamped < momentMs;
+};
+var isCompactionSummary = (record) => record.isCompactSummary === true;
+var transcriptLinesSeenLive = (lines, epochStartedAtMs, startedBeforeEpoch) => lines.filter((line) => {
+  const record = parsedTranscriptRecord(line);
+  if (record === null) return true;
+  return !stampedBefore(record, epochStartedAtMs) && !(startedBeforeEpoch && isCompactionSummary(record));
+});
 
 // src/transcript-sync.ts
 import { homedir as homedir2 } from "os";
 import { join as join2, resolve } from "path";
-import { existsSync as existsSync2, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { closeSync, existsSync as existsSync2, fstatSync, openSync, readFileSync as readFileSync2, readSync, statSync as statSync2 } from "fs";
 
 // src/transcript-session-key.ts
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "fs";
@@ -72,9 +103,9 @@ import { join } from "path";
 var sessionDir = () => process.env.PUSHARY_SESSION_KEY_DIR?.trim() || join(homedir(), ".pushary", "sessions");
 var SESSION_KEY_TTL_MS = 48 * 60 * 60 * 1e3;
 var SAFE_SESSION_ID = /^[A-Za-z0-9._-]{1,128}$/;
-var fileFor = (sessionId) => SAFE_SESSION_ID.test(sessionId) ? join(sessionDir(), `${sessionId}.json`) : null;
-var loadSessionKey = (sessionId) => {
-  const path = fileFor(sessionId);
+var fileFor = (sessionId, directory) => SAFE_SESSION_ID.test(sessionId) ? join(directory, `${sessionId}.json`) : null;
+var loadSessionKey = (sessionId, directory = sessionDir()) => {
+  const path = fileFor(sessionId, directory);
   if (!path || !existsSync(path)) return null;
   try {
     if (Date.now() - statSync(path).mtimeMs > SESSION_KEY_TTL_MS) return null;
@@ -92,11 +123,11 @@ var loadSessionKey = (sessionId) => {
     return null;
   }
 };
-var saveSessionKey = (sessionId, value) => {
-  const path = fileFor(sessionId);
+var saveSessionKey = (sessionId, value, directory = sessionDir()) => {
+  const path = fileFor(sessionId, directory);
   if (!path) return;
   try {
-    mkdirSync(sessionDir(), { recursive: true, mode: 448 });
+    mkdirSync(directory, { recursive: true, mode: 448 });
     writeFileSync(
       path,
       JSON.stringify({
@@ -111,8 +142,7 @@ var saveSessionKey = (sessionId, value) => {
   } catch {
   }
 };
-var sweepStaleSessionKeys = (now = Date.now()) => {
-  const dir = sessionDir();
+var sweepStaleSessionKeys = (now = Date.now(), dir = sessionDir()) => {
   if (!existsSync(dir)) return 0;
   let removed = 0;
   try {
@@ -237,14 +267,75 @@ var readLines = (path) => {
   }
 };
 var IDLE_CEILING_MS = 6e4;
+var recordedBirthtime = (info) => process.platform === "darwin" && info.birthtimeMs > 0 ? info.birthtimeMs : null;
+var sightingOf = (info, seenAtMs) => info ? { identity: `${info.dev}:${info.ino}`, sizeBytes: info.size, birthtimeMs: recordedBirthtime(info), seenAtMs } : { identity: null, sizeBytes: 0, birthtimeMs: null, seenAtMs };
+var storeCutoff = (epoch, path, cutoff) => {
+  epoch.cutoffs.set(path, cutoff);
+  epoch.positions.save(epoch.cutoffs);
+};
+var recordSighting = (epoch, path, sighting) => {
+  const previous = epoch.cutoffs.get(path);
+  const cutoff = nextTranscriptCutoff(previous, sighting, epoch.startedAtMs);
+  if (cutoff !== previous) storeCutoff(epoch, path, cutoff);
+  return cutoff;
+};
+var recordSettledPosition = (epoch, path, readFrom, settledThroughOffset) => {
+  const current = epoch.cutoffs.get(path);
+  const advanced = advancedTranscriptCutoff(current, readFrom, settledThroughOffset);
+  if (advanced !== void 0 && advanced !== current) storeCutoff(epoch, path, advanced);
+};
+var forgetUnregisteredTranscripts = (epoch, registeredPaths) => {
+  const unregistered = [...epoch.cutoffs.keys()].filter((path) => !registeredPaths.has(path));
+  if (unregistered.length === 0) return;
+  for (const path of unregistered) epoch.cutoffs.delete(path);
+  epoch.positions.save(epoch.cutoffs);
+};
+var statOrNull = (path) => {
+  try {
+    return statSync2(path);
+  } catch {
+    return null;
+  }
+};
+var sightTranscript = (epoch, path, seenAtMs) => recordSighting(epoch, path, sightingOf(statOrNull(path), seenAtMs));
+var LINE_FEED = 10;
+var nothingUnread = (cutoff) => ({ lines: [], cutoff, completeThroughOffset: cutoff.offset });
+var readLinesSinceCutoff = (epoch, path, seenAtMs) => {
+  let descriptor;
+  try {
+    descriptor = openSync(path, "r");
+  } catch {
+    return nothingUnread(sightTranscript(epoch, path, seenAtMs));
+  }
+  try {
+    const info = fstatSync(descriptor);
+    const cutoff = recordSighting(epoch, path, sightingOf(info, seenAtMs));
+    const unread = info.size - cutoff.offset;
+    if (unread <= 0) return nothingUnread(cutoff);
+    const buffer = Buffer.alloc(unread);
+    const received = buffer.subarray(0, readSync(descriptor, buffer, 0, unread, cutoff.offset));
+    return {
+      lines: received.toString("utf8").split("\n"),
+      cutoff,
+      completeThroughOffset: cutoff.offset + received.lastIndexOf(LINE_FEED) + 1
+    };
+  } finally {
+    closeSync(descriptor);
+  }
+};
+var linesSeenDuringEpoch = (epoch, path, source, seenAtMs) => {
+  const read2 = readLinesSinceCutoff(epoch, path, seenAtMs);
+  return { ...read2, lines: transcriptLinesSeenLive(normalizeTranscriptLines(read2.lines, source), epoch.startedAtMs, read2.cutoff.startedBeforeEpoch) };
+};
+var nothingLeftToUpload = (state, lines) => state.sessionKey !== null && !state.keyRejected && buildTranscriptRecords(lines, state.sessionKey, state.seen).records.length === 0;
 var nextInterval = (previousMs, idle, baseMs, maxMs) => idle ? Math.min(previousMs * 2, maxMs) : baseMs;
 var startTranscriptSync = (opts) => {
   let warnedAboutRecipients = false;
   const fetchPinnedRecipients = async () => {
-    const offer = await fetchTranscriptRecipients(opts.apiKey);
+    const offer = await fetchTranscriptRecipients(opts.apiKey, opts.baseUrl);
     if (!offer) return null;
-    const verdict = verifyRecipients(offer, loadPin());
-    if (verdict.kind === "first-use" && !savePin(verdict.pin)) return null;
+    const verdict = verifyRecipients(offer, loadPin(opts.storage?.recipientPinFile));
+    if (verdict.kind === "first-use" && !savePin(verdict.pin, opts.storage?.recipientPinFile)) return null;
     if (verdict.kind === "changed") {
       if (!warnedAboutRecipients) {
         warnedAboutRecipients = true;
@@ -257,12 +348,12 @@ var startTranscriptSync = (opts) => {
   };
   const uploader = {
     fetchTranscriptRecipients: fetchPinnedRecipients,
-    uploadRecords: (params) => (opts.enabled ? opts.enabled() : transcriptsEnabled()) ? uploadTranscriptRecords(opts.apiKey, params) : Promise.resolve({ ok: false, keyRegistered: false, keyConflict: false, keyUnavailable: false, settledIds: null, rejectedIds: [] })
+    uploadRecords: (params) => (opts.enabled ? opts.enabled() : transcriptsEnabled()) ? uploadTranscriptRecords(opts.apiKey, params, opts.baseUrl) : Promise.resolve({ ok: false, keyRegistered: false, keyConflict: false, keyUnavailable: false, settledIds: null, rejectedIds: [] })
   };
   const path = opts.path ?? claudeTranscriptPath(opts.cwd, opts.sessionId);
-  const persisted = loadSessionKey(opts.sessionId);
+  const persisted = loadSessionKey(opts.sessionId, opts.storage?.sessionKeyDirectory);
   let state = persisted ? { ...createSyncState(), ...persisted } : createSyncState();
-  sweepStaleSessionKeys();
+  sweepStaleSessionKeys(Date.now(), opts.storage?.sessionKeyDirectory);
   let persistedUploaded = persisted?.keyUploaded ?? false;
   let running = true;
   let inFlight = false;
@@ -273,7 +364,9 @@ var startTranscriptSync = (opts) => {
       const before = state.sessionKey;
       const ending = opts.ending?.() === true;
       const modified = existsSync2(path) ? statSync2(path).mtimeMs : null;
-      const lines = normalizeTranscriptLines(readLines(path), opts.source ?? "claude");
+      const source = opts.source ?? "claude";
+      const read2 = opts.epoch ? linesSeenDuringEpoch(opts.epoch, path, source, Date.now()) : null;
+      const lines = read2?.lines ?? normalizeTranscriptLines(readLines(path), source);
       state = await syncTick(lines, state, uploader, opts.sessionId, opts.machineId);
       if (state.sessionKey && (before !== state.sessionKey || state.keyUploaded !== persistedUploaded)) {
         persistedUploaded = state.keyUploaded;
@@ -283,9 +376,10 @@ var startTranscriptSync = (opts) => {
           providerWrappedKey: state.providerWrappedKey,
           providerKeyId: state.providerKeyId,
           keyUploaded: state.keyUploaded
-        });
+        }, opts.storage?.sessionKeyDirectory);
       }
-      if (ending && opts.ending?.() && existsSync2(path) && statSync2(path).mtimeMs === modified && state.keyUploaded && !state.keyRejected && buildTranscriptRecords(lines, state.sessionKey, state.seen).records.length === 0) opts.onDrained?.();
+      if (opts.epoch && read2 && nothingLeftToUpload(state, lines)) recordSettledPosition(opts.epoch, path, read2.cutoff, read2.completeThroughOffset);
+      if (ending && opts.ending?.() && existsSync2(path) && statSync2(path).mtimeMs === modified && state.keyUploaded && nothingLeftToUpload(state, lines)) opts.onDrained?.();
     } catch {
     } finally {
       inFlight = false;
@@ -316,17 +410,20 @@ var startTranscriptSync = (opts) => {
 
 // src/transcript-registration.ts
 import { homedir as homedir3 } from "os";
-var directory = () => process.env.PUSHARY_TRANSCRIPT_REGISTRY_DIR || join3(pusharyDir(), "transcript-capture");
-var accountFor = (apiKey) => createHash("sha256").update(`${getBaseUrl()}\0${apiKey}`).digest("hex");
+var defaultRegistryDirectory = () => process.env.PUSHARY_TRANSCRIPT_REGISTRY_DIR || join3(pusharyDir(), "transcript-capture");
+var cliRegistry = (apiKey = getApiKey()) => ({ apiKey, baseUrl: getBaseUrl(), directory: defaultRegistryDirectory() });
+var accountFor = (registry) => createHash("sha256").update(`${registry.baseUrl}\0${registry.apiKey}`).digest("hex");
 var TTL = 48 * 60 * 60 * 1e3;
 var read = (path) => JSON.parse(readFileSync3(path, "utf8"));
 var consent = (record) => record.consentOverride ?? readTranscriptPreference() ?? false;
-var sameServer = (url) => url.replace(/\/+$/, "") === getBaseUrl().replace(/\/+$/, "");
-var fileFor2 = (apiKey, sessionId) => join3(directory(), `${createHash("sha256").update(accountFor(apiKey) + sessionId).digest("hex")}.json`);
-var permitted = (apiKey, raw) => raw.account === accountFor(apiKey) && consent(raw) && !raw.drained && (raw.source !== "claude" || !!raw.expectedSiteId || !macOwnsClaudeHooks(raw.cwd)) && (!raw.expectedSiteId || raw.expectedSiteId === raw.verifiedSiteId && !!raw.expectedBaseUrl && sameServer(raw.expectedBaseUrl));
+var withoutTrailingSlash = (url) => url.replace(/\/+$/, "");
+var sameServer = (url, registry) => withoutTrailingSlash(url) === withoutTrailingSlash(registry.baseUrl);
+var fileFor2 = (registry, sessionId) => join3(registry.directory, `${createHash("sha256").update(accountFor(registry) + sessionId).digest("hex")}.json`);
+var permitted = (registry, raw) => raw.account === accountFor(registry) && consent(raw) && !raw.drained && (raw.source !== "claude" || !!raw.expectedSiteId || !macOwnsClaudeHooks(raw.cwd)) && (!raw.expectedSiteId || raw.expectedSiteId === raw.verifiedSiteId && !!raw.expectedBaseUrl && sameServer(raw.expectedBaseUrl, registry));
 var registeredTranscriptEnabled = (apiKey, sessionId) => {
+  const registry = cliRegistry(apiKey);
   try {
-    return permitted(apiKey, read(fileFor2(apiKey, sessionId)));
+    return permitted(registry, read(fileFor2(registry, sessionId)));
   } catch {
     return false;
   }
@@ -342,25 +439,29 @@ var macOwnsClaudeHooks = (cwd) => [
     return false;
   }
 });
+var TRANSCRIPT_ROOT_NAME = { claude: "projects", codex: "sessions" };
 var transcriptRoots = (source) => {
   const home = homedir3();
-  if (source === "codex") return [join3(codexHome(), "sessions")];
+  if (source === "codex") return [join3(codexHome(), TRANSCRIPT_ROOT_NAME.codex)];
   const configured = process.env.CLAUDE_CONFIG_DIR;
-  return [join3(configured || join3(home, ".claude"), "projects"), join3(home, ".claude", "projects")];
+  return [join3(configured || join3(home, ".claude"), TRANSCRIPT_ROOT_NAME.claude), join3(home, ".claude", TRANSCRIPT_ROOT_NAME.claude)];
 };
-var withinTranscriptRoot = (candidate, source) => {
+var isAgentTranscriptRoot = (root, source) => isAbsolute(root) && resolve2(root) === root && basename(root) === TRANSCRIPT_ROOT_NAME[source];
+var acceptedTranscriptRoots = (source, registeredRoot) => typeof registeredRoot === "string" && isAgentTranscriptRoot(registeredRoot, source) ? [...transcriptRoots(source), registeredRoot] : transcriptRoots(source);
+var transcriptRootContaining = (candidate, roots) => {
   const target = resolve2(candidate);
-  return transcriptRoots(source).some((root) => target.startsWith(resolve2(root) + sep));
+  return roots.map((root) => resolve2(root)).find((root) => target.startsWith(root + sep)) ?? null;
 };
-var captureRegistration = (source, value) => {
+var captureRegistration = (source, value, registeredRoot) => {
   const input = value;
   if (source !== "claude" && source !== "codex") return null;
   if (input.agent_id || typeof input.session_id !== "string" || !/^[\w-]{1,128}$/.test(input.session_id)) return null;
   if (typeof input.cwd !== "string" || !isAbsolute(input.cwd)) return null;
   const path = input.transcript_path ?? input.agent_transcript_path ?? (source === "claude" ? claudeTranscriptPath(input.cwd, input.session_id) : null);
   if (typeof path !== "string" || !isAbsolute(path) || !path.endsWith(".jsonl")) return null;
-  if (!withinTranscriptRoot(path, source)) return null;
-  return { sessionId: input.session_id, cwd: input.cwd, path, source };
+  const root = transcriptRootContaining(path, acceptedTranscriptRoots(source, registeredRoot));
+  if (root === null) return null;
+  return { sessionId: input.session_id, cwd: input.cwd, path, source, root };
 };
 var registerTranscript = (source, input, startDaemon = () => {
   void ensureDaemonRunning({ waitTimeoutMs: 0 }).catch(() => {
@@ -369,8 +470,9 @@ var registerTranscript = (source, input, startDaemon = () => {
   const registration = captureRegistration(source, input);
   if (!registration) return;
   try {
-    const account = accountFor(getApiKey());
-    const path = fileFor2(getApiKey(), registration.sessionId);
+    const registry = options.registry ?? cliRegistry();
+    const account = accountFor(registry);
+    const path = fileFor2(registry, registration.sessionId);
     let previous;
     try {
       previous = read(path);
@@ -381,7 +483,7 @@ var registerTranscript = (source, input, startDaemon = () => {
     const stored = {
       ...registration,
       account,
-      consentOverride: transcriptEnvironmentPreference(),
+      consentOverride: options.consentOverride ?? transcriptEnvironmentPreference(),
       // A wrapper refresh must not erase the Mac's account binding.
       expectedSiteId: options.siteId ?? previous?.expectedSiteId,
       expectedBaseUrl: options.baseUrl ?? previous?.expectedBaseUrl,
@@ -394,19 +496,33 @@ var registerTranscript = (source, input, startDaemon = () => {
   } catch {
   }
 };
-var startRegisteredTranscripts = (apiKey, machineId, intervalMs = 3e3) => {
+var sightRegisteredTranscripts = (epoch, registry, listing) => {
+  const seenAtMs = Date.now();
+  const registeredPaths = /* @__PURE__ */ new Set();
+  for (const raw of listing.records) {
+    const registration = captureRegistration(raw.source, { session_id: raw.sessionId, cwd: raw.cwd, transcript_path: raw.path }, raw.root);
+    if (!registration) continue;
+    registeredPaths.add(registration.path);
+    if (raw.account === accountFor(registry) && !raw.drained) sightTranscript(epoch, registration.path, seenAtMs);
+  }
+  if (listing.complete) forgetUnregisteredTranscripts(epoch, registeredPaths);
+};
+var startRegisteredTranscripts = (apiKey, machineId, options = {}) => {
+  const { intervalMs = 3e3, enabled = () => true, storage, epoch } = options;
+  const registry = { apiKey, baseUrl: options.baseUrl ?? getBaseUrl(), directory: options.registryDirectory ?? defaultRegistryDirectory() };
   const active = /* @__PURE__ */ new Map();
   let stopped = false;
   let scanning = false;
   let verifiedSiteId;
   let nextVerification = 0;
   const tick = async () => {
-    if (stopped || scanning) return;
+    if (stopped || scanning || !enabled()) return;
     scanning = true;
     const wanted = /* @__PURE__ */ new Map();
     try {
-      const files = readdirSync2(directory()).filter((name) => name.endsWith(".json")).flatMap((name) => {
-        const path = join3(directory(), name);
+      let unreadable = 0;
+      const files = readdirSync2(registry.directory).filter((name) => name.endsWith(".json")).flatMap((name) => {
+        const path = join3(registry.directory, name);
         try {
           const time = statSync3(path).mtimeMs;
           if (Date.now() - time > TTL) {
@@ -415,16 +531,18 @@ var startRegisteredTranscripts = (apiKey, machineId, intervalMs = 3e3) => {
           }
           return [{ path, time, raw: read(path) }];
         } catch {
+          unreadable += 1;
           return [];
         }
       }).sort((a, b) => Number(!!a.raw.endedAt) - Number(!!b.raw.endedAt) || b.time - a.time);
+      if (epoch) sightRegisteredTranscripts(epoch, registry, { records: files.map((file) => file.raw), complete: unreadable === 0 });
       for (const file of files) {
         const raw = file.raw;
-        if (raw.account !== accountFor(apiKey) || !consent(raw) || raw.drained) continue;
-        if (raw.expectedSiteId && !verifiedSiteId && Date.now() >= nextVerification && raw.expectedBaseUrl && sameServer(raw.expectedBaseUrl)) {
+        if (raw.account !== accountFor(registry) || !consent(raw) || raw.drained) continue;
+        if (raw.expectedSiteId && !verifiedSiteId && Date.now() >= nextVerification && raw.expectedBaseUrl && sameServer(raw.expectedBaseUrl, registry)) {
           nextVerification = Date.now() + 3e4;
           try {
-            const response = await fetch(`${getBaseUrl()}/api/agent/encryption-account`, {
+            const response = await fetch(`${registry.baseUrl}/api/agent/encryption-account`, {
               headers: { Authorization: `Bearer ${apiKey}` },
               signal: AbortSignal.timeout(5e3)
             });
@@ -433,18 +551,18 @@ var startRegisteredTranscripts = (apiKey, machineId, intervalMs = 3e3) => {
           } catch {
           }
         }
-        if (raw.expectedSiteId && raw.expectedSiteId === verifiedSiteId && raw.expectedBaseUrl && sameServer(raw.expectedBaseUrl) && raw.verifiedSiteId !== verifiedSiteId) {
+        if (raw.expectedSiteId && raw.expectedSiteId === verifiedSiteId && raw.expectedBaseUrl && sameServer(raw.expectedBaseUrl, registry) && raw.verifiedSiteId !== verifiedSiteId) {
           const latest = read(file.path);
           if (JSON.stringify(latest) !== JSON.stringify(raw)) continue;
           raw.verifiedSiteId = verifiedSiteId;
           writeJsonAtomic(file.path, raw, 384);
         }
-        if (!permitted(apiKey, raw)) continue;
+        if (!permitted(registry, raw)) continue;
         if (wanted.size >= (raw.endedAt ? 33 : 32)) continue;
-        const registration = captureRegistration(raw.source, { session_id: raw.sessionId, cwd: raw.cwd, transcript_path: raw.path });
+        const registration = captureRegistration(raw.source, { session_id: raw.sessionId, cwd: raw.cwd, transcript_path: raw.path }, raw.root);
         if (registration) wanted.set(registration.sessionId, { ...registration, registrationPath: file.path });
       }
-      if (stopped) return;
+      if (stopped || !enabled()) return;
       for (const [id, reader] of active) {
         if (wanted.get(id)?.path === reader.path) continue;
         reader.stop();
@@ -458,9 +576,12 @@ var startRegisteredTranscripts = (apiKey, machineId, intervalMs = 3e3) => {
           machineId,
           ...registration,
           intervalMs,
+          baseUrl: registry.baseUrl,
+          storage,
+          epoch,
           enabled: () => {
             try {
-              return permitted(apiKey, current());
+              return !stopped && enabled() && permitted(registry, current());
             } catch {
               return false;
             }

package/dist/{chunk-2VQULZ4L.js → chunk-H2PQXK26.js}

@@ -3,11 +3,11 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-E2WJLU5U.js";
+} from "./chunk-7447DYNW.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-IMUCTAM2.js";
+} from "./chunk-EPVY3JU3.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-S6J3A4DF.js → chunk-IDGESFKZ.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-2QEW5FJK.js";
+} from "./chunk-SRRJLA24.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-GSMB7FWI.js → chunk-IIP4LEO3.js}

@@ -1,6 +1,6 @@
 import {
   ensureCodexTrustsPusharyHooks
-} from "./chunk-PGFLQXW5.js";
+} from "./chunk-Q2GSTQ3R.js";
 import {
   detectClaudeVersion
 } from "./chunk-RIVNNBEK.js";
@@ -12,7 +12,7 @@ import {
   openCodeHookArgv,
   openCodePluginDir,
   openCodeWired
-} from "./chunk-EDEEITT3.js";
+} from "./chunk-OULHOX5C.js";
 import {
   addClaudeMcpServer,
   addCompatibleHooks,
@@ -20,7 +20,7 @@ import {
   addPusharyToolPermissions,
   compatibleConfigFile,
   hasCompatibleHooks
-} from "./chunk-KT4SP73I.js";
+} from "./chunk-SAHD5DYW.js";
 import {
   claudeUnprovenHolds,
   claudeWired,
@@ -28,7 +28,7 @@ import {
   codexWired,
   geminiWired,
   planHooks
-} from "./chunk-GFY6XONT.js";
+} from "./chunk-FXJ5SEQT.js";
 import {
   CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
@@ -39,7 +39,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-2OIGS4P2.js";
+} from "./chunk-OS6AE2MR.js";
 import {
   formatVersion
 } from "./chunk-6ICPEJY5.js";
@@ -63,7 +63,7 @@ import {
   resolveGlobalBinDir,
   resolveGlobalBinary,
   vscodePluginMcp
-} from "./chunk-2QEW5FJK.js";
+} from "./chunk-SRRJLA24.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -73,7 +73,7 @@ import {
   HOOK_COMPATIBLE_PROFILES,
   isCompatibleAgentType,
   isRecord
-} from "./chunk-JBVKA3UR.js";
+} from "./chunk-TDLEFGAM.js";
 
 // src/reapply.ts
 import { dirname, join } from "path";

package/dist/{chunk-LD3A63IE.js → chunk-IKJJB4QG.js}

@@ -1,6 +1,6 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-KRZECDHA.js";
+} from "./chunk-KBRKQMCI.js";
 import {
   backupFile,
   readJsonSafe,
@@ -9,11 +9,11 @@ import {
 } from "./chunk-AQFEP65J.js";
 import {
   configFilePath
-} from "./chunk-XNKFK27C.js";
+} from "./chunk-5EX2SD5N.js";
 import {
   API_KEY_PREFIX_PATTERN,
   isRecord
-} from "./chunk-JBVKA3UR.js";
+} from "./chunk-TDLEFGAM.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";

package/dist/{chunk-KRZECDHA.js → chunk-KBRKQMCI.js}

@@ -1,9 +1,9 @@
 import {
   configFilePath
-} from "./chunk-XNKFK27C.js";
+} from "./chunk-5EX2SD5N.js";
 import {
   normalizeInstallSource
-} from "./chunk-JBVKA3UR.js";
+} from "./chunk-TDLEFGAM.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";

package/dist/{chunk-J3HI2SRD.js → chunk-MG523AVN.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULT_SESSION
-} from "./chunk-XLNSQLTV.js";
+} from "./chunk-X427XA76.js";
 
 // src/answer.ts
 var isDeferAnswer = (value) => value === "defer";

package/dist/{chunk-434NFCK2.js → chunk-MRR4NQ3H.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-LD3A63IE.js";
+} from "./chunk-IKJJB4QG.js";
 
 // src/transcript-setting.ts
 var transcriptEnvironmentPreference = () => {

package/dist/{chunk-V2FRBKMP.js → chunk-N4LLBUU2.js}

@@ -4,10 +4,10 @@ import {
   keyPrefix,
   readConfigFileKey,
   readMacAppKeyPrefix
-} from "./chunk-LD3A63IE.js";
+} from "./chunk-IKJJB4QG.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-SMA7LUCS.js";
+} from "./chunk-2ROXUEZV.js";
 
 // src/key-signed-out.ts
 var VERDICT_BY_CHECK = {

package/dist/{chunk-6DJBVMTR.js → chunk-NTWTU6FA.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-2QEW5FJK.js";
+} from "./chunk-SRRJLA24.js";
 import {
   writeFileAtomic
 } from "./chunk-AQFEP65J.js";

package/dist/{chunk-2OIGS4P2.js → chunk-OS6AE2MR.js}

@@ -5,16 +5,16 @@ import {
 import {
   NOTIFICATION_MATCHED_TYPES,
   POSTTOOLUSE_MIRRORED_TOOLS
-} from "./chunk-Q6HJD6SH.js";
+} from "./chunk-4JOWKPUF.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-2QEW5FJK.js";
+} from "./chunk-SRRJLA24.js";
 import {
   CLAUDE_PRETOOLUSE_MATCHER,
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-JBVKA3UR.js";
+} from "./chunk-TDLEFGAM.js";
 
 // src/gemini-config.ts
 var GEMINI_HOOK_BINARY = "pushary-gemini-hook";

package/dist/{chunk-MTPE6BW7.js → chunk-OSUAY4SA.js}

@@ -2,7 +2,7 @@ import {
   autoUpdateLock,
   installPackageGlobally,
   npmErrorMessage
-} from "./chunk-2QEW5FJK.js";
+} from "./chunk-SRRJLA24.js";
 import {
   writeJsonAtomic
 } from "./chunk-AQFEP65J.js";

package/dist/{chunk-SM4P6VIY.js → chunk-OTDRNEED.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-3EGEA4KH.js";
 import {
   getBaseUrl
-} from "./chunk-XNKFK27C.js";
+} from "./chunk-5EX2SD5N.js";
 
 // src/cli/login-ui.ts
 import { hostname } from "os";