@pushary/agent-hooks 1.9.6 → 1.9.8

package/dist/{chunk-2I23NFVT.js → chunk-MXHTGVFZ.js}

@@ -1,21 +1,36 @@
+import {
+  agentHookOwner,
+  macAppBridgeAvailable,
+  openCodePluginOwner
+} from "./chunk-3Z3A37WD.js";
 import {
   ensureCodexTrustsPusharyHooks
-} from "./chunk-IMGJYFCX.js";
+} from "./chunk-MGRFDGWU.js";
+import {
+  OPENCODE_HOOK_BINARY,
+  installOpenCodePlugin,
+  openCodeHookArgv,
+  openCodePluginDir,
+  openCodeWired
+} from "./chunk-MFF3ONG5.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "./chunk-IR5FRUPQ.js";
+} from "./chunk-KHNFLYJO.js";
 import {
   detectClaudeVersion
 } from "./chunk-RIVNNBEK.js";
+import {
+  planHooks
+} from "./chunk-YIG2R3BJ.js";
 import {
   claudeUnprovenHolds,
   claudeWired,
   codexUnprovenHolds,
   codexWired,
   geminiWired
-} from "./chunk-D7SOOVHX.js";
+} from "./chunk-2QGYMY7A.js";
 import {
   CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
@@ -26,7 +41,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-UKNKYTTY.js";
+} from "./chunk-3I6IVOZV.js";
 import {
   formatVersion
 } from "./chunk-6ICPEJY5.js";
@@ -49,7 +64,7 @@ import {
   registrationHolderOf,
   resolveGlobalBinary,
   vscodePluginMcp
-} from "./chunk-HJXZJF6O.js";
+} from "./chunk-ZBHUHJG6.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -305,21 +320,48 @@ var reapplyCursorPlugin = (apiKey, paths = {}) => reapplyPluginMcp(
   apiKey
 );
 var reapplyVsCodePlugin = (apiKey, paths = {}) => reapplyPluginMcp(paths.pluginMcpPath ?? vscodePluginMcp(), apiKey);
-var reapplyAllAgents = (apiKey) => {
+var reapplyOpenCodePlugin = (paths = {}) => {
+  const pluginDir = paths.pluginDir ?? openCodePluginDir();
+  if (!openCodeWired(pluginDir)) return { configured: false, reapplied: false, hooks: false, mcp: false };
+  try {
+    installOpenCodePlugin(openCodeHookArgv((paths.resolveBinary ?? resolveGlobalBinary)(OPENCODE_HOOK_BINARY)), pluginDir);
+    return { configured: true, reapplied: true, hooks: true, mcp: false };
+  } catch {
+    return { configured: true, reapplied: false, hooks: false, mcp: false, failed: true };
+  }
+};
+var SETUP_CHOICE_BY_REAPPLY_ID = {
+  claude: "claude_code",
+  codex: "codex",
+  gemini: "gemini_cli",
+  cursor: "cursor",
+  vscode: "vscode"
+};
+var reapplyHookOwner = (id, appAvailable) => id === "opencode" ? openCodePluginOwner(appAvailable) : agentHookOwner(SETUP_CHOICE_BY_REAPPLY_ID[id], appAvailable);
+var reapplyHolder = (id, appAvailable) => planHooks({ owner: reapplyHookOwner(id, appAvailable), takeOverHooks: false, nonInteractive: true }) === "keep" ? "app" : "cli";
+var KEPT_FOR_APP = { configured: true, reapplied: false, hooks: false, mcp: false };
+var FAILED_REAPPLY = { configured: false, reapplied: false, hooks: false, mcp: false, failed: true };
+var reapplyAllAgents = (apiKey, options = {}) => {
   const runners = [
     { id: "claude", label: "Claude Code", run: () => reapplyClaudeSettings(apiKey) },
     { id: "codex", label: "Codex", run: () => reapplyCodexSettings(apiKey) },
     { id: "gemini", label: "Gemini CLI", run: () => reapplyGeminiSettings(apiKey) },
     { id: "cursor", label: "Cursor", run: () => reapplyCursorPlugin(apiKey) },
-    { id: "vscode", label: "VS Code", run: () => reapplyVsCodePlugin(apiKey) }
+    { id: "vscode", label: "VS Code", run: () => reapplyVsCodePlugin(apiKey) },
+    { id: "opencode", label: "OpenCode", run: () => reapplyOpenCodePlugin() }
   ];
+  const appAvailable = (options.appAvailable ?? macAppBridgeAvailable)();
   const done = [];
   for (const runner of runners) {
     try {
+      if (reapplyHolder(runner.id, appAvailable) === "app") {
+        done.push({ id: runner.id, label: runner.label, heldBy: "app", result: KEPT_FOR_APP });
+        continue;
+      }
       const result = runner.run();
-      if (result.configured) done.push({ id: runner.id, label: runner.label, result });
+      if (result.configured) done.push({ id: runner.id, label: runner.label, heldBy: "cli", result });
     } catch {
-      done.push({ id: runner.id, label: runner.label, result: { configured: false, reapplied: false, hooks: false, mcp: false, failed: true } });
+      done.push({ id: runner.id, label: runner.label, heldBy: "cli", result: FAILED_REAPPLY });
     }
   }
   return done;
@@ -336,6 +378,7 @@ export {
   reapplyGeminiSettings,
   reapplyCursorPlugin,
   reapplyVsCodePlugin,
+  reapplyOpenCodePlugin,
   reapplyAllAgents,
   ensureCodexTrustAfterReapply
 };

package/dist/{chunk-5BHROGRB.js → chunk-N4QSPI3B.js}

@@ -1,6 +1,6 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-75CA37FZ.js";
+} from "./chunk-FQ2GORVG.js";
 import {
   backupFile,
   readJsonSafe,
@@ -9,7 +9,7 @@ import {
 } from "./chunk-T7E75EKA.js";
 import {
   configFilePath
-} from "./chunk-2QRE6QH2.js";
+} from "./chunk-5QUPKDI5.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";
@@ -110,6 +110,20 @@ var isDisabledExport = (line) => {
   return OUR_EXPORT.test(trimmed.slice(1, -LOGOUT_MARK.length).trim());
 };
 var keyPrefix = (key) => key.split(".")[0] ?? key;
+var MAC_APP_KEY_PREFIX_FIELD = "macAppKeyPrefix";
+var KEY_PREFIX_SHAPE = /^pk_[a-f0-9]+$/;
+var findKeyExport = (contents) => {
+  const lines = contents.split("\n");
+  for (const [index, line] of lines.entries()) {
+    const key = line.match(OUR_EXPORT)?.[2];
+    if (key) return { line: index + 1, key };
+  }
+  return null;
+};
+var keepMacAppKeyPrefix = (current, apiKey) => {
+  const { [MAC_APP_KEY_PREFIX_FIELD]: recorded, ...rest } = current;
+  return recorded === keyPrefix(apiKey) ? { ...rest, [MAC_APP_KEY_PREFIX_FIELD]: recorded } : rest;
+};
 var manualKeyStepFor = (kind, platform) => kind === "no-rc" || platform === "win32" ? "config-only" : "paste-export";
 var rcResult = (kind, over = {}) => ({
   kind,
@@ -208,7 +222,7 @@ var writeKey = (apiKey, options = {}) => {
   writeJsonAtomic(
     configPath,
     {
-      ...current,
+      ...keepMacAppKeyPrefix(current, apiKey),
       apiKey,
       installSource: resolveInstallSourceFor(current),
       ...options.controlMode ? { controlMode: options.controlMode } : {},
@@ -227,7 +241,7 @@ var clearKey = (options = {}) => {
   const existing = readJsonSafe(configPath);
   let removedFromConfig = false;
   if (existing.kind === "ok" && typeof existing.value.apiKey === "string") {
-    const { apiKey: _dropped, ...rest } = existing.value;
+    const { apiKey: _dropped, [MAC_APP_KEY_PREFIX_FIELD]: _adopted, ...rest } = existing.value;
     writeJsonAtomic(configPath, rest, KEY_FILE_MODE);
     restrictFile(configPath);
     removedFromConfig = true;
@@ -289,6 +303,38 @@ var readKeySource = () => {
   if (fileKey) return { kind: "config", key: fileKey, origin: configPath, drift: null };
   return { kind: "none", key: null, origin: null, drift: null };
 };
+var readMacAppKeyPrefix = (configPath = configFilePath()) => {
+  const result = readJsonSafe(configPath);
+  if (result.kind !== "ok") return null;
+  const recorded = result.value[MAC_APP_KEY_PREFIX_FIELD];
+  return typeof recorded === "string" && KEY_PREFIX_SHAPE.test(recorded) ? recorded : null;
+};
+var recordMacAppKeyPrefix = (apiKey, configPath = configFilePath()) => {
+  const result = readJsonSafe(configPath);
+  if (result.kind !== "ok" || result.value.apiKey !== apiKey) return false;
+  if (result.value[MAC_APP_KEY_PREFIX_FIELD] === keyPrefix(apiKey)) return false;
+  writeJsonAtomic(configPath, { ...result.value, [MAC_APP_KEY_PREFIX_FIELD]: keyPrefix(apiKey) }, KEY_FILE_MODE);
+  restrictFile(configPath);
+  return true;
+};
+var shellProfileCandidates = () => {
+  const resolved = resolveShellRc();
+  const fallbacks = FALLBACK_RCS.map((name) => join2(homedir2(), name));
+  return resolved ? [resolved.path, ...fallbacks.filter((path) => path !== resolved.path)] : fallbacks;
+};
+var findExportedKeyLine = (profiles = shellProfileCandidates()) => {
+  for (const path of profiles) {
+    let contents;
+    try {
+      contents = readFileSync2(path, "utf8");
+    } catch {
+      continue;
+    }
+    const found = findKeyExport(contents);
+    if (found) return { path, ...found };
+  }
+  return null;
+};
 
 export {
   CANDIDATE_RCS,
@@ -305,5 +351,8 @@ export {
   readConfigFileKey,
   readControlMode,
   readTranscriptPreference,
-  readKeySource
+  readKeySource,
+  readMacAppKeyPrefix,
+  recordMacAppKeyPrefix,
+  findExportedKeyLine
 };

package/dist/{chunk-DGQTJDSJ.js → chunk-NWDG3MSW.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-3EGEA4KH.js";
 import {
   getBaseUrl
-} from "./chunk-2QRE6QH2.js";
+} from "./chunk-5QUPKDI5.js";
 
 // src/cli/login-ui.ts
 import { hostname } from "os";

package/dist/chunk-OP7IHC2I.js

@@ -0,0 +1,24 @@
+import {
+  isValidApiKey
+} from "./chunk-I5IJRMNV.js";
+
+// src/shared-mcp-key.ts
+var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var pusharyKey = (value) => typeof value === "string" && isValidApiKey(value.trim()) ? value.trim() : null;
+var bearerKey = (authorization) => typeof authorization === "string" && authorization.startsWith("Bearer ") ? pusharyKey(authorization.slice("Bearer ".length)) : null;
+var mcpServerBearer = (mcpServers) => bearerKey(asRecord(asRecord(asRecord(mcpServers)?.pushary)?.headers)?.Authorization);
+var appAgentKey = (bridgeAgentKey) => pusharyKey(asRecord(bridgeAgentKey)?.key);
+var setupReceiptKey = (claudeMcpReceipt) => bearerKey(asRecord(asRecord(asRecord(claudeMcpReceipt)?.installedPushary)?.headers)?.Authorization);
+var macAppKeepsMcpEntry = (entryKey, keys) => {
+  if (!entryKey) return true;
+  if (keys.appKey) return entryKey === keys.appKey;
+  return entryKey !== keys.setupKey;
+};
+
+export {
+  pusharyKey,
+  mcpServerBearer,
+  appAgentKey,
+  setupReceiptKey,
+  macAppKeepsMcpEntry
+};

package/dist/{chunk-EVFY3VE6.js → chunk-QOLITCIP.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-Q4E56K4X.js";
+} from "./chunk-I5IJRMNV.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/{chunk-W4Q7NFXU.js → chunk-TCQ43LSG.js}

@@ -1,16 +1,16 @@
 import {
   readExistingMachineId
-} from "./chunk-3BUAEQCY.js";
+} from "./chunk-DUZVXBBU.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
 import {
   getBaseUrl
-} from "./chunk-2QRE6QH2.js";
+} from "./chunk-5QUPKDI5.js";
 import {
   clientContextHeaders,
   getPackageVersion
-} from "./chunk-Q4E56K4X.js";
+} from "./chunk-I5IJRMNV.js";
 
 // src/cli/net.ts
 import { createRequire } from "module";

package/dist/chunk-TCWKTUAE.js

@@ -0,0 +1,50 @@
+import {
+  pusharyHookExecutable
+} from "./chunk-2QGYMY7A.js";
+import {
+  isProtectedByScope,
+  registerHookEntry
+} from "./chunk-ZBHUHJG6.js";
+
+// src/cursor-config.ts
+var hookCommandOf = (entry) => {
+  const command = entry && typeof entry === "object" && !Array.isArray(entry) ? entry.command : void 0;
+  return typeof command === "string" ? command : "";
+};
+var isPusharyCursorEntry = (entry) => pusharyHookExecutable(hookCommandOf(entry)) !== null;
+var registerCursorGate = (existing, entry) => registerHookEntry(existing, isPusharyCursorEntry, entry);
+var withoutPusharyCursorHooks = (hooks, scope) => {
+  let removed = 0;
+  const kept = {};
+  for (const [event, entries] of Object.entries(hooks)) {
+    if (!Array.isArray(entries)) {
+      kept[event] = entries;
+      continue;
+    }
+    const others = entries.filter((entry) => !isPusharyCursorEntry(entry) || isProtectedByScope(hookCommandOf(entry), scope));
+    removed += entries.length - others.length;
+    if (others.length > 0 || entries.length === 0) kept[event] = others;
+  }
+  return { hooks: kept, removed };
+};
+var CURSOR_PLUGIN_NAME = "pushary";
+var CURSOR_PLUGIN_STAGING_PREFIX = ".pushary-staging-";
+var CURSOR_PLUGIN_BACKUP_INFIX = ".pushary-backup-";
+var isCursorPluginLeftover = (name) => name.startsWith(`${CURSOR_PLUGIN_NAME}${CURSOR_PLUGIN_BACKUP_INFIX}`) || name.startsWith(CURSOR_PLUGIN_STAGING_PREFIX);
+var isPusharyCursorPluginManifest = (contents) => {
+  try {
+    const manifest = JSON.parse(contents);
+    return typeof manifest === "object" && manifest !== null && !Array.isArray(manifest) && manifest.name === CURSOR_PLUGIN_NAME;
+  } catch {
+    return false;
+  }
+};
+
+export {
+  registerCursorGate,
+  withoutPusharyCursorHooks,
+  CURSOR_PLUGIN_STAGING_PREFIX,
+  CURSOR_PLUGIN_BACKUP_INFIX,
+  isCursorPluginLeftover,
+  isPusharyCursorPluginManifest
+};

package/dist/{chunk-EZAFBC2C.js → chunk-V5HPPF3E.js}

@@ -2,7 +2,7 @@ import {
   autoUpdateLock,
   installPackageGlobally,
   npmErrorMessage
-} from "./chunk-HJXZJF6O.js";
+} from "./chunk-ZBHUHJG6.js";
 import {
   writeJsonAtomic
 } from "./chunk-T7E75EKA.js";
@@ -133,7 +133,7 @@ var releaseAutoUpdateLock = (lockPath) => {
     server.close();
   }
 };
-var finishWithUpgradeLock = (request) => new Promise((resolve, reject) => {
+var forkFinishWithUpgradeLock = (request) => new Promise((resolve, reject) => {
   const path = canonicalLockPath(request.lockPath ?? autoUpdateLock());
   const server = heldLocks.get(path);
   if (!server) return reject(new Error("Cannot finish an upgrade without its lock"));
@@ -154,10 +154,13 @@ var finishWithUpgradeLock = (request) => new Promise((resolve, reject) => {
   });
   child.once("exit", (code, signal) => {
     clearTimeout(timer);
-    if (code === 0) resolve();
-    else reject(new Error(`Upgrade finish exited with ${signal ?? code}`));
+    resolve({ code, signal });
   });
 });
+var finishWithUpgradeLock = async (request) => {
+  const exit = await forkFinishWithUpgradeLock(request);
+  if (exit.code !== 0) throw new Error(`Upgrade finish exited with ${exit.signal ?? exit.code}`);
+};
 var installWithUpgradeLock = (request, lockPath = autoUpdateLock(), runNpm) => {
   const path = canonicalLockPath(lockPath);
   if (!heldLocks.has(path)) throw new Error("Cannot install an upgrade without its lock");
@@ -170,6 +173,7 @@ export {
   claimUpgradeLock,
   ownsUpgradeLock,
   releaseAutoUpdateLock,
+  forkFinishWithUpgradeLock,
   finishWithUpgradeLock,
   installWithUpgradeLock
 };

package/dist/{chunk-Q23MMVTD.js → chunk-WG3K4TCH.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-HJXZJF6O.js";
+} from "./chunk-ZBHUHJG6.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-F56SB65Y.js → chunk-WS4H76EP.js}

@@ -3,11 +3,11 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-5AXCOTIT.js";
+} from "./chunk-ZBK6E2OR.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-7JTVYR5B.js";
+} from "./chunk-CLOSJ4ES.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-HWQNQVY6.js → chunk-WWOHTTVP.js}

@@ -1,9 +1,9 @@
 import {
   registerTranscript
-} from "./chunk-VRT3EEZN.js";
+} from "./chunk-DPGSLWOS.js";
 import {
   writeDegraded
-} from "./chunk-DA4FTGTK.js";
+} from "./chunk-DKMD6AWR.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode"];

package/dist/{chunk-NVGDMTX3.js → chunk-YIG2R3BJ.js}

@@ -1,15 +1,13 @@
 import {
   AGENT_CHOICES
-} from "./chunk-SPXBXN23.js";
-import {
-  isBridgeLocator
-} from "./chunk-SJN22ADZ.js";
+} from "./chunk-DL7XWKYV.js";
 import {
+  isBridgeLocator,
   pusharyHookExecutable
-} from "./chunk-D7SOOVHX.js";
+} from "./chunk-2QGYMY7A.js";
 import {
   BELL_HOOK_BINARY
-} from "./chunk-Q23MMVTD.js";
+} from "./chunk-WG3K4TCH.js";
 
 // src/setup/hook-ownership.ts
 var commandsIn = (value) => {
@@ -105,7 +103,10 @@ var hookOwnerOf = (document, appAvailable = true, hooksKeyPath = ["hooks"]) => {
     (node, key) => node && typeof node === "object" ? node[key] : void 0,
     document
   );
-  const executables = commandsIn(hooks).map(pusharyHookExecutable).filter((executable) => executable !== null);
+  return hookOwnerOfCommands(commandsIn(hooks), appAvailable);
+};
+var hookOwnerOfCommands = (commands, appAvailable = true) => {
+  const executables = commands.map(pusharyHookExecutable).filter((executable) => executable !== null);
   if (appAvailable && executables.some(isBridgeLocator)) return "app";
   if (executables.some((executable) => !isBridgeLocator(executable))) return "cli";
   return "none";
@@ -136,6 +137,7 @@ export {
   isHookTakeoverReceipt,
   restoreHookTakeover,
   hookOwnerOf,
+  hookOwnerOfCommands,
   planHooks,
   describeAppOwnership,
   KEEP_HINT,

package/dist/{chunk-HJXZJF6O.js → chunk-ZBHUHJG6.js}

@@ -13,7 +13,7 @@ import {
   isReleaseVersion,
   ownPackageName,
   withHookHoldBudget
-} from "./chunk-Q4E56K4X.js";
+} from "./chunk-I5IJRMNV.js";
 
 // src/setup/paths.ts
 import { homedir as homedir2 } from "os";
@@ -365,9 +365,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-7F5RP45B.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-AHRBA66K.js");
-    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-MELXIVBO.js");
+    const { withUpgradeLock } = await import("./global-upgrade-I56HNM23.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-B34TAUKV.js");
+    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-AGY43CXS.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;

package/dist/{chunk-5AXCOTIT.js → chunk-ZBK6E2OR.js}

@@ -1,6 +1,6 @@
 import {
   redactSecretsFromContent
-} from "./chunk-Q4E56K4X.js";
+} from "./chunk-I5IJRMNV.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";