@pushary/agent-hooks 1.9.7 → 1.9.8

package/dist/{chunk-ADSQDYYG.js → chunk-N4QSPI3B.js}

@@ -1,6 +1,6 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-4D2AYNSE.js";
+} from "./chunk-FQ2GORVG.js";
 import {
   backupFile,
   readJsonSafe,
@@ -9,7 +9,7 @@ import {
 } from "./chunk-T7E75EKA.js";
 import {
   configFilePath
-} from "./chunk-Z6HPS67T.js";
+} from "./chunk-5QUPKDI5.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";
@@ -110,6 +110,20 @@ var isDisabledExport = (line) => {
   return OUR_EXPORT.test(trimmed.slice(1, -LOGOUT_MARK.length).trim());
 };
 var keyPrefix = (key) => key.split(".")[0] ?? key;
+var MAC_APP_KEY_PREFIX_FIELD = "macAppKeyPrefix";
+var KEY_PREFIX_SHAPE = /^pk_[a-f0-9]+$/;
+var findKeyExport = (contents) => {
+  const lines = contents.split("\n");
+  for (const [index, line] of lines.entries()) {
+    const key = line.match(OUR_EXPORT)?.[2];
+    if (key) return { line: index + 1, key };
+  }
+  return null;
+};
+var keepMacAppKeyPrefix = (current, apiKey) => {
+  const { [MAC_APP_KEY_PREFIX_FIELD]: recorded, ...rest } = current;
+  return recorded === keyPrefix(apiKey) ? { ...rest, [MAC_APP_KEY_PREFIX_FIELD]: recorded } : rest;
+};
 var manualKeyStepFor = (kind, platform) => kind === "no-rc" || platform === "win32" ? "config-only" : "paste-export";
 var rcResult = (kind, over = {}) => ({
   kind,
@@ -208,7 +222,7 @@ var writeKey = (apiKey, options = {}) => {
   writeJsonAtomic(
     configPath,
     {
-      ...current,
+      ...keepMacAppKeyPrefix(current, apiKey),
       apiKey,
       installSource: resolveInstallSourceFor(current),
       ...options.controlMode ? { controlMode: options.controlMode } : {},
@@ -227,7 +241,7 @@ var clearKey = (options = {}) => {
   const existing = readJsonSafe(configPath);
   let removedFromConfig = false;
   if (existing.kind === "ok" && typeof existing.value.apiKey === "string") {
-    const { apiKey: _dropped, ...rest } = existing.value;
+    const { apiKey: _dropped, [MAC_APP_KEY_PREFIX_FIELD]: _adopted, ...rest } = existing.value;
     writeJsonAtomic(configPath, rest, KEY_FILE_MODE);
     restrictFile(configPath);
     removedFromConfig = true;
@@ -289,6 +303,38 @@ var readKeySource = () => {
   if (fileKey) return { kind: "config", key: fileKey, origin: configPath, drift: null };
   return { kind: "none", key: null, origin: null, drift: null };
 };
+var readMacAppKeyPrefix = (configPath = configFilePath()) => {
+  const result = readJsonSafe(configPath);
+  if (result.kind !== "ok") return null;
+  const recorded = result.value[MAC_APP_KEY_PREFIX_FIELD];
+  return typeof recorded === "string" && KEY_PREFIX_SHAPE.test(recorded) ? recorded : null;
+};
+var recordMacAppKeyPrefix = (apiKey, configPath = configFilePath()) => {
+  const result = readJsonSafe(configPath);
+  if (result.kind !== "ok" || result.value.apiKey !== apiKey) return false;
+  if (result.value[MAC_APP_KEY_PREFIX_FIELD] === keyPrefix(apiKey)) return false;
+  writeJsonAtomic(configPath, { ...result.value, [MAC_APP_KEY_PREFIX_FIELD]: keyPrefix(apiKey) }, KEY_FILE_MODE);
+  restrictFile(configPath);
+  return true;
+};
+var shellProfileCandidates = () => {
+  const resolved = resolveShellRc();
+  const fallbacks = FALLBACK_RCS.map((name) => join2(homedir2(), name));
+  return resolved ? [resolved.path, ...fallbacks.filter((path) => path !== resolved.path)] : fallbacks;
+};
+var findExportedKeyLine = (profiles = shellProfileCandidates()) => {
+  for (const path of profiles) {
+    let contents;
+    try {
+      contents = readFileSync2(path, "utf8");
+    } catch {
+      continue;
+    }
+    const found = findKeyExport(contents);
+    if (found) return { path, ...found };
+  }
+  return null;
+};
 
 export {
   CANDIDATE_RCS,
@@ -305,5 +351,8 @@ export {
   readConfigFileKey,
   readControlMode,
   readTranscriptPreference,
-  readKeySource
+  readKeySource,
+  readMacAppKeyPrefix,
+  recordMacAppKeyPrefix,
+  findExportedKeyLine
 };

package/dist/{chunk-AQ55ZSSS.js → chunk-NWDG3MSW.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-3EGEA4KH.js";
 import {
   getBaseUrl
-} from "./chunk-Z6HPS67T.js";
+} from "./chunk-5QUPKDI5.js";
 
 // src/cli/login-ui.ts
 import { hostname } from "os";

package/dist/chunk-OP7IHC2I.js

@@ -0,0 +1,24 @@
+import {
+  isValidApiKey
+} from "./chunk-I5IJRMNV.js";
+
+// src/shared-mcp-key.ts
+var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var pusharyKey = (value) => typeof value === "string" && isValidApiKey(value.trim()) ? value.trim() : null;
+var bearerKey = (authorization) => typeof authorization === "string" && authorization.startsWith("Bearer ") ? pusharyKey(authorization.slice("Bearer ".length)) : null;
+var mcpServerBearer = (mcpServers) => bearerKey(asRecord(asRecord(asRecord(mcpServers)?.pushary)?.headers)?.Authorization);
+var appAgentKey = (bridgeAgentKey) => pusharyKey(asRecord(bridgeAgentKey)?.key);
+var setupReceiptKey = (claudeMcpReceipt) => bearerKey(asRecord(asRecord(asRecord(claudeMcpReceipt)?.installedPushary)?.headers)?.Authorization);
+var macAppKeepsMcpEntry = (entryKey, keys) => {
+  if (!entryKey) return true;
+  if (keys.appKey) return entryKey === keys.appKey;
+  return entryKey !== keys.setupKey;
+};
+
+export {
+  pusharyKey,
+  mcpServerBearer,
+  appAgentKey,
+  setupReceiptKey,
+  macAppKeepsMcpEntry
+};

package/dist/{chunk-KT5E2RLS.js → chunk-QOLITCIP.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-I5IJRMNV.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/{chunk-JXISQ7DT.js → chunk-TCQ43LSG.js}

@@ -1,16 +1,16 @@
 import {
   readExistingMachineId
-} from "./chunk-KYO45G5L.js";
+} from "./chunk-DUZVXBBU.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
 import {
   getBaseUrl
-} from "./chunk-Z6HPS67T.js";
+} from "./chunk-5QUPKDI5.js";
 import {
   clientContextHeaders,
   getPackageVersion
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-I5IJRMNV.js";
 
 // src/cli/net.ts
 import { createRequire } from "module";

package/dist/chunk-TCWKTUAE.js

@@ -0,0 +1,50 @@
+import {
+  pusharyHookExecutable
+} from "./chunk-2QGYMY7A.js";
+import {
+  isProtectedByScope,
+  registerHookEntry
+} from "./chunk-ZBHUHJG6.js";
+
+// src/cursor-config.ts
+var hookCommandOf = (entry) => {
+  const command = entry && typeof entry === "object" && !Array.isArray(entry) ? entry.command : void 0;
+  return typeof command === "string" ? command : "";
+};
+var isPusharyCursorEntry = (entry) => pusharyHookExecutable(hookCommandOf(entry)) !== null;
+var registerCursorGate = (existing, entry) => registerHookEntry(existing, isPusharyCursorEntry, entry);
+var withoutPusharyCursorHooks = (hooks, scope) => {
+  let removed = 0;
+  const kept = {};
+  for (const [event, entries] of Object.entries(hooks)) {
+    if (!Array.isArray(entries)) {
+      kept[event] = entries;
+      continue;
+    }
+    const others = entries.filter((entry) => !isPusharyCursorEntry(entry) || isProtectedByScope(hookCommandOf(entry), scope));
+    removed += entries.length - others.length;
+    if (others.length > 0 || entries.length === 0) kept[event] = others;
+  }
+  return { hooks: kept, removed };
+};
+var CURSOR_PLUGIN_NAME = "pushary";
+var CURSOR_PLUGIN_STAGING_PREFIX = ".pushary-staging-";
+var CURSOR_PLUGIN_BACKUP_INFIX = ".pushary-backup-";
+var isCursorPluginLeftover = (name) => name.startsWith(`${CURSOR_PLUGIN_NAME}${CURSOR_PLUGIN_BACKUP_INFIX}`) || name.startsWith(CURSOR_PLUGIN_STAGING_PREFIX);
+var isPusharyCursorPluginManifest = (contents) => {
+  try {
+    const manifest = JSON.parse(contents);
+    return typeof manifest === "object" && manifest !== null && !Array.isArray(manifest) && manifest.name === CURSOR_PLUGIN_NAME;
+  } catch {
+    return false;
+  }
+};
+
+export {
+  registerCursorGate,
+  withoutPusharyCursorHooks,
+  CURSOR_PLUGIN_STAGING_PREFIX,
+  CURSOR_PLUGIN_BACKUP_INFIX,
+  isCursorPluginLeftover,
+  isPusharyCursorPluginManifest
+};

package/dist/{chunk-RQGODFQN.js → chunk-V5HPPF3E.js}

@@ -2,7 +2,7 @@ import {
   autoUpdateLock,
   installPackageGlobally,
   npmErrorMessage
-} from "./chunk-ZUTU43FT.js";
+} from "./chunk-ZBHUHJG6.js";
 import {
   writeJsonAtomic
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-7264S5HZ.js → chunk-WG3K4TCH.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-ZUTU43FT.js";
+} from "./chunk-ZBHUHJG6.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-GKI6LFAV.js → chunk-WS4H76EP.js}

@@ -3,11 +3,11 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-AUUXS44H.js";
+} from "./chunk-ZBK6E2OR.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-4FK6RZVJ.js";
+} from "./chunk-CLOSJ4ES.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-XWAYAO3V.js → chunk-WWOHTTVP.js}

@@ -1,9 +1,9 @@
 import {
   registerTranscript
-} from "./chunk-BTQGAXZ3.js";
+} from "./chunk-DPGSLWOS.js";
 import {
   writeDegraded
-} from "./chunk-AVNKVF7N.js";
+} from "./chunk-DKMD6AWR.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode"];

package/dist/{chunk-SD3272LS.js → chunk-YIG2R3BJ.js}

@@ -1,15 +1,13 @@
 import {
   AGENT_CHOICES
-} from "./chunk-SBLPHUEB.js";
-import {
-  isBridgeLocator
-} from "./chunk-MNWRUGMH.js";
+} from "./chunk-DL7XWKYV.js";
 import {
+  isBridgeLocator,
   pusharyHookExecutable
-} from "./chunk-4YO4T5FV.js";
+} from "./chunk-2QGYMY7A.js";
 import {
   BELL_HOOK_BINARY
-} from "./chunk-7264S5HZ.js";
+} from "./chunk-WG3K4TCH.js";
 
 // src/setup/hook-ownership.ts
 var commandsIn = (value) => {
@@ -105,7 +103,10 @@ var hookOwnerOf = (document, appAvailable = true, hooksKeyPath = ["hooks"]) => {
     (node, key) => node && typeof node === "object" ? node[key] : void 0,
     document
   );
-  const executables = commandsIn(hooks).map(pusharyHookExecutable).filter((executable) => executable !== null);
+  return hookOwnerOfCommands(commandsIn(hooks), appAvailable);
+};
+var hookOwnerOfCommands = (commands, appAvailable = true) => {
+  const executables = commands.map(pusharyHookExecutable).filter((executable) => executable !== null);
   if (appAvailable && executables.some(isBridgeLocator)) return "app";
   if (executables.some((executable) => !isBridgeLocator(executable))) return "cli";
   return "none";
@@ -136,6 +137,7 @@ export {
   isHookTakeoverReceipt,
   restoreHookTakeover,
   hookOwnerOf,
+  hookOwnerOfCommands,
   planHooks,
   describeAppOwnership,
   KEEP_HINT,

package/dist/{chunk-ZUTU43FT.js → chunk-ZBHUHJG6.js}

@@ -13,7 +13,7 @@ import {
   isReleaseVersion,
   ownPackageName,
   withHookHoldBudget
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-I5IJRMNV.js";
 
 // src/setup/paths.ts
 import { homedir as homedir2 } from "os";
@@ -365,9 +365,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-E2HUEB4B.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-JCIDZMHF.js");
-    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-QVTEGNZV.js");
+    const { withUpgradeLock } = await import("./global-upgrade-I56HNM23.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-B34TAUKV.js");
+    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-AGY43CXS.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;

package/dist/{chunk-AUUXS44H.js → chunk-ZBK6E2OR.js}

@@ -1,6 +1,6 @@
 import {
   redactSecretsFromContent
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-I5IJRMNV.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";