@pushary/agent-hooks 1.9.64 → 1.9.66

package/dist/{chunk-7UBDBJTG.js → chunk-26W46E46.js}

@@ -2,25 +2,25 @@ import {
   SIGNED_OUT_ON_MAC_MESSAGE,
   describeSignedOutKey,
   readSignedOutDiagnosis
-} from "./chunk-O7PCNYEY.js";
+} from "./chunk-YB3HMDKE.js";
 import {
   createIo
 } from "./chunk-FO3MDD26.js";
 import {
   readKeySource
-} from "./chunk-BLAIETMP.js";
+} from "./chunk-CNJ7SI5V.js";
 import {
   absoluteUrl,
   checkApiKey,
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-QNATBOUH.js";
+} from "./chunk-QR2QWGQI.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-Y64JGYTB.js";
+} from "./chunk-A47UKPC7.js";
 
 // src/cli/report-key.ts
 var { dim, yellow } = createIo();

package/dist/{chunk-MIPJ2VXP.js → chunk-2BL6KWN7.js}

@@ -1,6 +1,6 @@
 import {
   repoKeyFor
-} from "./chunk-3KXBRSL3.js";
+} from "./chunk-XXIJBYNW.js";
 import {
   cancelQuestion,
   clientErrorKindOf,
@@ -8,29 +8,29 @@ import {
   reportClientError,
   sendNotification,
   waitForAnswer
-} from "./chunk-E23RKH3T.js";
+} from "./chunk-ZAZUDYSF.js";
 import {
   withRetry
-} from "./chunk-2KID4FK4.js";
+} from "./chunk-Q5RNYE2L.js";
 import {
   getMachineId
-} from "./chunk-ADRPW7KU.js";
+} from "./chunk-IA5VWIHV.js";
 import {
   reportedInstallSource
-} from "./chunk-2VADJ6JH.js";
+} from "./chunk-XIJTXRWB.js";
 import {
   IDLE_PROMPT_NOTIFICATION,
   NOTIFICATION_PUSH_TYPES,
   POSTTOOLUSE_MIRROR_ONLY_TOOLS,
   canonicalJson
-} from "./chunk-H4BKC2GN.js";
+} from "./chunk-GDLT32I4.js";
 import {
   writeFileAtomic
-} from "./chunk-BSZIPIFA.js";
+} from "./chunk-KS3O6O7E.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-Y64JGYTB.js";
+} from "./chunk-A47UKPC7.js";
 import {
   ACTION_BODY_MAX,
   AGENTS,
@@ -65,7 +65,7 @@ import {
   toToolLookup,
   truncateLine,
   unansweredRefusalReason
-} from "./chunk-MNKIR2ZB.js";
+} from "./chunk-EJR5JXMV.js";
 
 // ../hook-mapping/src/describe.ts
 import { isAbsolute, relative, resolve } from "path";

package/dist/{chunk-42PD2MQH.js → chunk-32ZT2ATY.js}

@@ -1,9 +1,9 @@
 import {
   APPROVAL_SETTINGS_PATH
-} from "./chunk-7UBDBJTG.js";
+} from "./chunk-26W46E46.js";
 import {
   readMacAppAgentKey
-} from "./chunk-QPPBH5NY.js";
+} from "./chunk-CN6JFM62.js";
 import {
   findExportedKeyLines,
   isAdoptedMacAppKey,
@@ -13,13 +13,13 @@ import {
   readConfigFileKey,
   readKeySource,
   readMacAppKeyPrefix
-} from "./chunk-BLAIETMP.js";
+} from "./chunk-CNJ7SI5V.js";
 import {
   absoluteUrl
-} from "./chunk-QNATBOUH.js";
+} from "./chunk-QR2QWGQI.js";
 import {
   isValidApiKey
-} from "./chunk-MNKIR2ZB.js";
+} from "./chunk-EJR5JXMV.js";
 
 // src/key-revocation.ts
 var SELF_REVOKE_PATH = "/api/v1/server/keys/self/revoke";

package/dist/{chunk-2EY4HGLG.js → chunk-376TUN72.js}

@@ -1,13 +1,13 @@
 import {
   readJsonSafe,
   writeJsonAtomic
-} from "./chunk-BSZIPIFA.js";
+} from "./chunk-KS3O6O7E.js";
 import {
   configFilePath
-} from "./chunk-Y64JGYTB.js";
+} from "./chunk-A47UKPC7.js";
 import {
   readSetupOutcomeProperties
-} from "./chunk-MNKIR2ZB.js";
+} from "./chunk-EJR5JXMV.js";
 
 // src/diagnostics/service-runtime.ts
 var unescapeXml = (value) => value.replaceAll("&quot;", '"').replaceAll("&apos;", "'").replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");

package/dist/{chunk-A5KQXZR7.js → chunk-3ELJIG2R.js}

@@ -1,12 +1,12 @@
 import {
   pusharyDir
-} from "./chunk-H4BKC2GN.js";
+} from "./chunk-GDLT32I4.js";
 import {
   readJsonSafe
-} from "./chunk-BSZIPIFA.js";
+} from "./chunk-KS3O6O7E.js";
 import {
   isRecord
-} from "./chunk-MNKIR2ZB.js";
+} from "./chunk-EJR5JXMV.js";
 
 // src/process-ownership.ts
 import { createHash, randomUUID } from "crypto";

package/dist/{chunk-ML2Q6WWE.js → chunk-3EZP5ZPS.js}

@@ -1,11 +1,11 @@
 import {
   addGeminiMcpServer,
   removeGeminiMcpServer
-} from "./chunk-6QPDBD7Q.js";
+} from "./chunk-YQDCTID4.js";
 import {
   CLAUDE_CODE_AGENT,
   compatibleToolLookup
-} from "./chunk-MIPJ2VXP.js";
+} from "./chunk-2BL6KWN7.js";
 import {
   CLAUDE_HOOK_EVENTS,
   PUSHARY_MCP_URL,
@@ -17,7 +17,7 @@ import {
   isPusharyHook,
   registerHookEntry,
   removeClaudeMcpServers
-} from "./chunk-H4BKC2GN.js";
+} from "./chunk-GDLT32I4.js";
 import {
   HOOK_COMPATIBLE_PROFILES,
   PHONE_ANSWERED_TOOLS,
@@ -28,7 +28,7 @@ import {
   pusharyMissingReason,
   refusalOutput,
   withHookHoldBudget
-} from "./chunk-MNKIR2ZB.js";
+} from "./chunk-EJR5JXMV.js";
 
 // src/config-document.ts
 import { parse, stringify } from "smol-toml";
@@ -312,6 +312,7 @@ export {
   profileFromArgv,
   activeIdentity,
   namedEvent,
+  namedSource,
   activeHookSource,
   normalizeToolCall,
   grokHome,

package/dist/{chunk-66FRMK7V.js → chunk-3FQX74E4.js}

@@ -1,16 +1,16 @@
 import {
   notificationAnswerStep
-} from "./chunk-JTOBQUIL.js";
+} from "./chunk-MNNQEUQC.js";
 import {
   matchMacAccountStep,
   retryAgentCommand
-} from "./chunk-NYV45Q25.js";
+} from "./chunk-5FJDODOA.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-BAGBCSXA.js";
+} from "./chunk-GO7YKPT3.js";
 
 // src/setup/closing.ts
 var ACTIVITY_URL = "pushary.com/dashboard/agent/activity";

package/dist/{chunk-HVOQUPSO.js → chunk-45KMS76L.js}

@@ -2,7 +2,7 @@ import {
   isApprovalMode,
   isRecord,
   isTimeoutAction
-} from "./chunk-MNKIR2ZB.js";
+} from "./chunk-EJR5JXMV.js";
 
 // src/cli/settings-response.ts
 var isFiniteNumber = (value) => typeof value === "number" && Number.isFinite(value);

package/dist/{chunk-LA7CKRZN.js → chunk-4APD2DPI.js}

@@ -1,9 +1,9 @@
 import {
   CODEX_HOOK_STATUS
-} from "./chunk-LV6DX4P6.js";
+} from "./chunk-JL3SZJJP.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-BAGBCSXA.js";
+} from "./chunk-GO7YKPT3.js";
 
 // src/setup/codex-trust.ts
 var CODEX_TRUST_TELEMETRY = {

package/dist/{chunk-5NP3OJ5P.js → chunk-57NTMVMI.js}

@@ -4,23 +4,23 @@ import {
 } from "./chunk-XHKBHWLX.js";
 import {
   readControlMode
-} from "./chunk-BLAIETMP.js";
+} from "./chunk-CNJ7SI5V.js";
 import {
   getMachineId
-} from "./chunk-ADRPW7KU.js";
+} from "./chunk-IA5VWIHV.js";
 import {
   pusharyDir
-} from "./chunk-H4BKC2GN.js";
+} from "./chunk-GDLT32I4.js";
 import {
   readJsonSafe,
   resolveGlobalBinary,
   writeFileAtomic,
   writeJsonAtomic,
   writeJsonAtomicDurable
-} from "./chunk-BSZIPIFA.js";
+} from "./chunk-KS3O6O7E.js";
 import {
   getApiKey
-} from "./chunk-Y64JGYTB.js";
+} from "./chunk-A47UKPC7.js";
 import {
   CLI_PACKAGE_NAMES,
   cmdShimTarget,
@@ -30,7 +30,7 @@ import {
 } from "./chunk-QTOLNRET.js";
 import {
   isRecord
-} from "./chunk-MNKIR2ZB.js";
+} from "./chunk-EJR5JXMV.js";
 
 // src/daemon-lifecycle.ts
 import { dirname, join, win32 as win32Path } from "path";

package/dist/{chunk-NYV45Q25.js → chunk-5FJDODOA.js}

@@ -3,13 +3,13 @@ import {
   NpmMissingError,
   NpmPermissionError,
   writeFileAtomic
-} from "./chunk-BSZIPIFA.js";
+} from "./chunk-KS3O6O7E.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-BAGBCSXA.js";
+} from "./chunk-GO7YKPT3.js";
 import {
   readSetupAgentFailures
-} from "./chunk-MNKIR2ZB.js";
+} from "./chunk-EJR5JXMV.js";
 
 // src/setup/config-write.ts
 var AgentConfigWriteError = class extends Error {

package/dist/{chunk-RY4EPMZX.js → chunk-5J7OZBJ4.js}

@@ -1,9 +1,9 @@
 import {
   findNativeClaudeInstall
-} from "./chunk-MXPOLQZH.js";
+} from "./chunk-RJ6JEHCP.js";
 import {
   isFile
-} from "./chunk-BSZIPIFA.js";
+} from "./chunk-KS3O6O7E.js";
 
 // src/wrapper/claudeBinary.ts
 import { homedir } from "os";

package/dist/{chunk-XJIIU36L.js → chunk-6BGVSV2Q.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-MNKIR2ZB.js";
+} from "./chunk-EJR5JXMV.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-2YXBCZ3Z.js → chunk-6RJZSBPD.js}

@@ -1,6 +1,6 @@
 import {
   readConfigFileKey
-} from "./chunk-BLAIETMP.js";
+} from "./chunk-CNJ7SI5V.js";
 
 // src/bell/fleet.ts
 import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";

package/dist/{chunk-MPPTIZ2G.js → chunk-6ZXCWK27.js}

@@ -4,13 +4,13 @@ import {
   configFailureKind,
   retryAgentCommand,
   writeSetupConfigFile
-} from "./chunk-NYV45Q25.js";
+} from "./chunk-5FJDODOA.js";
 import {
   MCP_BRIDGE_BINARY
-} from "./chunk-2PKHGHMA.js";
+} from "./chunk-HUGVJBDN.js";
 import {
   KEY_FILE_MODE
-} from "./chunk-BLAIETMP.js";
+} from "./chunk-CNJ7SI5V.js";
 import {
   CLINE_SERVER_NAME_TAKEN,
   CLINE_SETTINGS_REFUSALS,
@@ -30,12 +30,12 @@ import {
   withClinePusharyServer,
   withRefreshedClineKey,
   withoutClinePusharyServer
-} from "./chunk-H4BKC2GN.js";
+} from "./chunk-GDLT32I4.js";
 import {
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic
-} from "./chunk-BSZIPIFA.js";
+} from "./chunk-KS3O6O7E.js";
 
 // src/fx-config.ts
 var FX_SERVER_NAME = "pushary";

package/dist/{chunk-VNRWQCGU.js → chunk-7LK3Y6ET.js}

@@ -1,15 +1,15 @@
 import {
   compatibleConfigFile
-} from "./chunk-ML2Q6WWE.js";
+} from "./chunk-3EZP5ZPS.js";
 import {
   hookOwnerOf,
   hookOwnerOfCommands,
   liveBridgeProbe,
   resolveBridgeStub
-} from "./chunk-KA7JIMTG.js";
+} from "./chunk-YQDCTID4.js";
 import {
   AGENT_CHOICES
-} from "./chunk-SROWUG5W.js";
+} from "./chunk-UTAARXYQ.js";
 import {
   claudeSettings,
   codexHooksJson,
@@ -18,10 +18,10 @@ import {
   guardedArgv,
   pusharyDir,
   vscodePluginDir
-} from "./chunk-H4BKC2GN.js";
+} from "./chunk-GDLT32I4.js";
 import {
   readJsonSafe
-} from "./chunk-BSZIPIFA.js";
+} from "./chunk-KS3O6O7E.js";
 import {
   HOOK_BUDGETS,
   HOOK_COMPATIBLE_PROFILES,
@@ -29,7 +29,7 @@ import {
   OPENCODE_APPROVAL_EVENT,
   hookCompatibleProfile,
   isRecord
-} from "./chunk-MNKIR2ZB.js";
+} from "./chunk-EJR5JXMV.js";
 
 // src/opencode-plugin.ts
 var OPENCODE_PLUGIN_MARKER = "pushary-opencode-plugin w1";
@@ -456,6 +456,59 @@ var addOpenCodeMcpServer = (config, apiKey) => {
   };
   config.mcp = servers;
 };
+var OPENCODE_ASKED_PERMISSIONS = ["bash", "edit", "webfetch"];
+var PERMISSION_KEY = "permission";
+var TOOLS_KEY = "tools";
+var ASK_ACTION = "ask";
+var ALLOW_ACTION = "allow";
+var DENY_ACTION = "deny";
+var ALL_PATTERNS = "*";
+var OPENCODE_ACTION_NAMES = {
+  bash: ["bash", "shell"],
+  edit: ["edit", "write", "patch"],
+  webfetch: ["webfetch"]
+};
+var escapedForPattern = (text) => text.replace(/[.+^${}()|[\]\\]/g, "\\$&").replaceAll("?", ".");
+var keyMatches = (key, name) => new RegExp(`^${key.split(ALL_PATTERNS).map(escapedForPattern).join(".*")}$`).test(name);
+var ruleNamesPermission = (permission) => ([key]) => OPENCODE_ACTION_NAMES[permission].some((name) => keyMatches(key, name));
+var toolRules = (config) => Object.entries(asRecord(config[TOOLS_KEY]) ?? {}).filter(([, enabled]) => typeof enabled === "boolean").map(([key, enabled]) => [key, enabled ? ALLOW_ACTION : DENY_ACTION]);
+var permissionRules = (config) => {
+  const permission = config[PERMISSION_KEY];
+  if (permission === void 0) return [];
+  const rules = asRecord(permission);
+  return rules ? Object.entries(rules) : [[ALL_PATTERNS, permission]];
+};
+var rulesInOrder = (config) => [...toolRules(config), ...permissionRules(config)];
+var actionOfRule = (value) => {
+  const patterns = asRecord(value);
+  return patterns ? patterns[ALL_PATTERNS] : value;
+};
+var holdsTheCall = (action) => action === ASK_ACTION || action === DENY_ACTION;
+var withOpenCodeAskRules = (config) => {
+  const permission = config[PERMISSION_KEY];
+  const rules = asRecord(permission);
+  if (permission !== void 0 && !rules) return { config, change: { kind: "person-setting-kept" } };
+  const personRules = rulesInOrder(config);
+  const added = OPENCODE_ASKED_PERMISSIONS.filter((name) => !personRules.some(ruleNamesPermission(name)));
+  if (added.length === 0) return { config, change: { kind: "present" } };
+  const asks = Object.fromEntries(added.map((name) => [name, ASK_ACTION]));
+  return { config: { ...config, [PERMISSION_KEY]: { ...asks, ...rules } }, change: { kind: "added", added } };
+};
+var openCodePermissionsLeftOpen = (config) => {
+  const rules = rulesInOrder(asRecord(config) ?? {});
+  return OPENCODE_ASKED_PERMISSIONS.filter((name) => !holdsTheCall(
+    rules.filter(ruleNamesPermission(name)).map(([, value]) => actionOfRule(value)).filter((action) => action !== void 0).at(-1)
+  ));
+};
+var openCodeAskCheck = (config) => {
+  if (config.kind === "unreadable" || config.kind === "unparseable") return { kind: "unreadable" };
+  const value = config.kind === "ok" ? asRecord(config.value) ?? {} : {};
+  const open = openCodePermissionsLeftOpen(value);
+  if (open.length === 0) return { kind: "asks" };
+  const personRules = rulesInOrder(value);
+  const namedByPerson = (name) => personRules.some(ruleNamesPermission(name));
+  return { kind: "open", unset: open.filter((name) => !namedByPerson(name)), allowedByPerson: open.filter(namedByPerson) };
+};
 var removeOpenCodeMcpServer = (config) => {
   const servers = asRecord(config.mcp);
   if (!servers || !("pushary" in servers)) return false;
@@ -518,6 +571,10 @@ export {
   openCodeConfigFile,
   openCodeInstructionsFile,
   addOpenCodeMcpServer,
+  OPENCODE_ASKED_PERMISSIONS,
+  withOpenCodeAskRules,
+  openCodePermissionsLeftOpen,
+  openCodeAskCheck,
   removeOpenCodeMcpServer,
   agentHookFile,
   agentHooksKeyPath,

package/dist/{chunk-Y64JGYTB.js → chunk-A47UKPC7.js}

@@ -1,6 +1,6 @@
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-BAGBCSXA.js";
+} from "./chunk-GO7YKPT3.js";
 
 // src/config.ts
 import { readFileSync } from "fs";

package/dist/{chunk-5TNGBDIE.js → chunk-AVWECJSN.js}

@@ -294,7 +294,7 @@ var loadedOnce = (load) => {
 };
 
 // src/codex-desktop-proxy.ts
-var loadThePhone = () => import("./api-HDLTZTVR.js");
+var loadThePhone = () => import("./api-GDSVUTI2.js");
 var theFirstCardLoadsAgain = () => {
 };
 var APP_SERVER_COMMAND = "app-server";
@@ -827,7 +827,7 @@ var codexDesktopCommand = async (args, entry, readAccount) => {
     return runCodexDesktopProxy(engine2, args.slice(3), readAccount, { watchesForCards: layoutIsKnown });
   }
   if (args[0] === APP_CARDS_FLAG) {
-    const { codexAppCardsCommandOnThisMac } = await import("./codex-app-cards-switch-JQ6356VX.js");
+    const { codexAppCardsCommandOnThisMac } = await import("./codex-app-cards-switch-W7OLKOMO.js");
     return codexAppCardsCommandOnThisMac(args.slice(1), entry, readAccount);
   }
   if (args.length > 2) throw new Error("Usage: pushary codex --desktop [path/to/Codex.app]");