@pushary/agent-hooks 1.9.7 → 1.9.9

package/dist/{chunk-R3YW55MY.js → chunk-AI7RMFVV.js}

@@ -1,21 +1,21 @@
-import {
-  activeHookSource,
-  activeIdentity
-} from "./chunk-MZPXVH4A.js";
 import {
   defersToNativeMode,
   reportMachineDenial
-} from "./chunk-3GNUXXDZ.js";
+} from "./chunk-B5NMSP3V.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-CBQACHKY.js";
+} from "./chunk-IIVZZMSO.js";
 import {
   announceSubscriptionRequired,
   denyReasonFrom,
   isDeferAnswer,
   oncePerSession
 } from "./chunk-5OP5MQI7.js";
+import {
+  activeHookSource,
+  activeIdentity
+} from "./chunk-UF6RBP5V.js";
 import {
   UNNAMED_ACTION,
   approvalAwaitingRetry,
@@ -39,13 +39,11 @@ import {
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-QFEM7R6T.js";
+} from "./chunk-KQFTBQ66.js";
 import {
   DEFAULT_SESSION
 } from "./chunk-N6IOSZOE.js";
 import {
-  DECISION_STOP_REASON,
-  UNVERIFIABLE_APPROVAL_REASON,
   askUser,
   cancelQuestion,
   claimBlockedAction,
@@ -55,24 +53,28 @@ import {
   requestGate,
   sendNotification,
   waitForQuestion
-} from "./chunk-D6S5EKXA.js";
+} from "./chunk-WRPYCIV2.js";
 import {
   SubscriptionRequiredError
-} from "./chunk-L76HTPU6.js";
+} from "./chunk-6AYSKVLL.js";
 import {
   getMachineId
-} from "./chunk-KYO45G5L.js";
+} from "./chunk-KOWFRUIT.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-Z6HPS67T.js";
+} from "./chunk-IRHABAQT.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-STQRUH3S.js";
+} from "./chunk-5DCDQ5VW.js";
 import {
   AGENT_QUESTION_STRATEGY,
+  DECISION_STOP_REASON,
   GATE_BLOCK_REASON_MAX_LENGTH,
   GATE_WIRE,
+  PLAN_DECLINED_REASON,
+  UNVERIFIABLE_APPROVAL_REASON,
+  WITHDRAWN_APPROVAL_REASON,
   agentQuestionStrategy,
   agentRulesAllowEveryInput,
   buildDecisionEpisodeFeatures,
@@ -82,8 +84,9 @@ import {
   claudePermissionRequestOutput,
   claudePermissionRulesFromSettings,
   claudePreToolUseOutput,
-  claudePromptsBeforeAnEdit,
-  editAsksAtTheAgentsPrompt,
+  claudeStoppedPermissionRequestOutput,
+  claudeStoppedPreToolUseOutput,
+  editGoesToTheAgentsPrompt,
   effectiveWaitSeconds,
   hookHoldWindowMs,
   hookWaitClamped,
@@ -94,9 +97,9 @@ import {
   isPusharyOwnTool,
   parseAgentQuestionAnswers,
   parseAgentQuestions,
-  resolveGate,
-  stoppedOutput
-} from "./chunk-QR6VE5ME.js";
+  questionHandedToTheTerminal,
+  resolveGate
+} from "./chunk-5RGA636G.js";
 
 // src/claude-permission-rules.ts
 import { readFileSync, statSync } from "fs";
@@ -174,7 +177,7 @@ var allow = (reason) => claudePreToolUseOutput("allow", reason);
 var deny = (reason) => claudePreToolUseOutput("deny", reason);
 var allowWithInput = (updatedInput) => claudePreToolUseOutput("allow", void 0, updatedInput);
 var ask = (reason) => claudePreToolUseOutput("ask", reason);
-var halted = (reason) => stoppedOutput(deny(reason), reason);
+var halted = (reason) => claudeStoppedPreToolUseOutput(reason);
 var outcomeOfFailedAsk = (error, sessionId, failure) => {
   if (!(error instanceof SubscriptionRequiredError)) return failure;
   announceSubscriptionRequired(error.upgradeUrl, sessionId);
@@ -218,7 +221,7 @@ var handlePushOnly = async (apiKey, description, projectName, timeoutSeconds, ti
     return answer.value === "yes" ? allow() : deny(denyReasonFrom(answer.value, answer.note));
   }
   if (timeoutAction === "wait" || clampCut || deadline < requestedDeadline) {
-    return ask("The phone question was withdrawn. Approve in the current client.");
+    return ask(WITHDRAWN_APPROVAL_REASON);
   }
   switch (timeoutAction) {
     case "approve":
@@ -261,7 +264,7 @@ var handlePushFirst = async (apiKey, description, projectName, pushFirstSeconds,
     signals.humanDecision = true;
     return answer.value === "yes" ? allow() : deny(denyReasonFrom(answer.value, answer.note));
   }
-  return ask("The phone question was withdrawn. Approve in the current client.");
+  return ask(WITHDRAWN_APPROVAL_REASON);
 };
 var handleNotifyOnly = async (apiKey, description, projectName, sessionId, machineId) => {
   try {
@@ -448,7 +451,7 @@ var askQuestionByQuestion = async (apiKey, input, parsed, projectName, deadline)
   return answers;
 };
 var handleAskUserQuestion = async (apiKey, input, modeState) => {
-  if (modeState.askHandoff) return void 0;
+  if (questionHandedToTheTerminal(input.tool_name, modeState)) return void 0;
   const parsed = parseQuestions(input.tool_input ?? {});
   if (!parsed) return void 0;
   const projectName = basename(input.cwd ?? process.cwd());
@@ -494,7 +497,7 @@ var handleExitPlanMode = async (apiKey, input) => {
     return void 0;
   }
   if (value === PLAN_APPROVE) return allow();
-  return deny("Plan declined from the phone. Ask what to change before coding.");
+  return deny(PLAN_DECLINED_REASON);
 };
 var handleKeyless = (input) => {
   try {
@@ -615,7 +618,7 @@ var handlePreToolUse = async (input, canonical) => {
       return void 0;
     }
     if (claudeAllowlistOwnsCall(gateInput, verdict, input.permission_mode, claudePermissionRulesFor(input))) return void 0;
-    if (claudePromptsBeforeAnEdit(input.permission_mode) && editAsksAtTheAgentsPrompt(gateInput, verdict)) return handleTerminalOnly();
+    if (editGoesToTheAgentsPrompt({ source: ACTIVE_SOURCE, event: "PreToolUse", permissionMode: input.permission_mode }, gateInput, verdict)) return handleTerminalOnly();
     switch (verdict.kind) {
       case "allow":
         return allow();
@@ -635,7 +638,7 @@ var handlePreToolUse = async (input, canonical) => {
 };
 var permReqAllow = (updatedInput) => claudePermissionRequestOutput("allow", void 0, updatedInput);
 var permReqDeny = (message) => claudePermissionRequestOutput("deny", message);
-var permReqHalted = (reason) => stoppedOutput(permReqDeny(reason), reason);
+var permReqHalted = (reason) => claudeStoppedPermissionRequestOutput(reason);
 var toPermissionRequestOutput = (hookOutput) => {
   if (!hookOutput) return void 0;
   const d = hookOutput.hookSpecificOutput;

package/dist/{chunk-AUUXS44H.js → chunk-APP43AW7.js}

@@ -1,6 +1,6 @@
 import {
   redactSecretsFromContent
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";

package/dist/{chunk-RQGODFQN.js → chunk-AZOKPWVI.js}

@@ -2,7 +2,7 @@ import {
   autoUpdateLock,
   installPackageGlobally,
   npmErrorMessage
-} from "./chunk-ZUTU43FT.js";
+} from "./chunk-Z23ZBYDW.js";
 import {
   writeJsonAtomic
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-3GNUXXDZ.js → chunk-B5NMSP3V.js}

@@ -5,7 +5,7 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-QFEM7R6T.js";
+} from "./chunk-KQFTBQ66.js";
 import {
   DEFAULT_SESSION
 } from "./chunk-N6IOSZOE.js";
@@ -13,7 +13,7 @@ import {
   machineDecisionFor,
   shouldDeferToNativeMode,
   wireVerdictFor
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/machine-decision-audit.ts
 import { basename } from "path";

package/dist/{chunk-4D2AYNSE.js → chunk-BNSKVIAW.js}

@@ -1,9 +1,9 @@
 import {
   configFilePath
-} from "./chunk-Z6HPS67T.js";
+} from "./chunk-IRHABAQT.js";
 import {
   normalizeInstallSource
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";

package/dist/chunk-BYLKCZ2G.js

@@ -0,0 +1,367 @@
+import {
+  CLAUDE_HOOK_EVENTS,
+  GEMINI_HOOK_EVENTS,
+  hasGeminiHooks
+} from "./chunk-M3STIAGU.js";
+import {
+  AGENT_CHOICES
+} from "./chunk-ZGADIZDS.js";
+import {
+  BELL_HOOK_BINARY
+} from "./chunk-MLGIVVSG.js";
+import {
+  CODEX_HOOK_EVENTS,
+  hasCodexHooks,
+  holdBudgetOf
+} from "./chunk-Z23ZBYDW.js";
+import {
+  CURSOR_GATE_EVENTS,
+  HOOK_LOCATOR_BINARY,
+  hookCommandHoldBudget
+} from "./chunk-5RGA636G.js";
+
+// src/diagnostics/bridge.ts
+import { execFileSync } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var BRIDGE_BUNDLE_IDENTIFIER = "com.pushary.app";
+var BRIDGE_HELPER_SUFFIX = "/Contents/Helpers/pushary-bridge";
+var BRIDGE_BUNDLE_ROOTS = ["/Applications/Pushary.app", "$HOME/Applications/Pushary.app"];
+var expandHome = (path, home) => path.replaceAll("$HOME", home);
+var parseBridgeStub = (contents, stubPath) => {
+  const helperSuffix = contents.match(/^H=(\S+)$/m)?.[1] ?? BRIDGE_HELPER_SUFFIX;
+  const cachePath = contents.match(/^C="([^"\n]+)"$/m)?.[1] ?? join(dirname(stubPath), ".bridge-cache");
+  const rootsLine = contents.match(/^for P in ((?:"[^"\n]*"\s*)+); do$/m)?.[1];
+  const bundleRoots = rootsLine ? [...rootsLine.matchAll(/"([^"]*)"/g)].map((match) => match[1]) : BRIDGE_BUNDLE_ROOTS;
+  const bundleIdentifier = contents.match(/kMDItemCFBundleIdentifier == "([^"]+)"/)?.[1] ?? BRIDGE_BUNDLE_IDENTIFIER;
+  return { helperSuffix, cachePath, bundleRoots, bundleIdentifier };
+};
+var resolveBridgeStub = (stubPath, probe) => {
+  const contents = probe.readFile(stubPath);
+  if (contents === null) return { kind: "no-stub", stub: stubPath };
+  const shape = parseBridgeStub(contents, stubPath);
+  const helperIn = (bundle) => `${bundle}${shape.helperSuffix}`;
+  const looked = [];
+  for (const root of shape.bundleRoots.map((root2) => expandHome(root2, probe.home))) {
+    looked.push(root);
+    if (probe.exists(helperIn(root))) return { kind: "bundle", helper: helperIn(root), via: "root" };
+  }
+  const cached = shape.cachePath ? probe.readFile(shape.cachePath)?.split("\n")[0]?.trim() : void 0;
+  if (cached) {
+    looked.push(cached);
+    if (probe.exists(helperIn(cached))) return { kind: "bundle", helper: helperIn(cached), via: "cache" };
+  }
+  for (const found of probe.mdfind(shape.bundleIdentifier)) {
+    looked.push(found);
+    if (probe.exists(helperIn(found))) return { kind: "bundle", helper: helperIn(found), via: "spotlight" };
+  }
+  return { kind: "missing", stub: stubPath, looked };
+};
+var BRIDGE_GONE_MESSAGE = "the Mac app is gone but its hooks remain; run pushary setup or reinstall the app";
+var describeBridgeResolution = (resolution) => {
+  switch (resolution.kind) {
+    case "bundle":
+      return `${resolution.helper} (${resolution.via === "root" ? "installed" : resolution.via === "cache" ? "cached path" : "found by Spotlight"})`;
+    case "missing":
+      return BRIDGE_GONE_MESSAGE;
+    case "no-stub":
+      return `${resolution.stub} is not there; ${BRIDGE_GONE_MESSAGE}`;
+  }
+};
+var isBridgeLocator = (executable) => executable !== null && executable.split(/[/\\]/).pop() === HOOK_LOCATOR_BINARY;
+var spotlight = (bundleIdentifier) => {
+  if (process.platform !== "darwin") return [];
+  try {
+    return execFileSync("/usr/bin/mdfind", [`kMDItemCFBundleIdentifier == "${bundleIdentifier}"`], {
+      encoding: "utf-8",
+      timeout: 5e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).split("\n").map((line) => line.trim()).filter((line) => line !== "");
+  } catch {
+    return [];
+  }
+};
+var readOrNull = (path) => {
+  try {
+    return readFileSync(path, "utf-8");
+  } catch {
+    return null;
+  }
+};
+var liveBridgeProbe = () => ({
+  exists: existsSync,
+  readFile: readOrNull,
+  mdfind: spotlight,
+  home: homedir()
+});
+
+// src/diagnostics/wiring.ts
+var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var CLAUDE_HOOK_BINARY = /pushary-[a-z-]*hook/;
+var EXACT_HOOK_BINARY = /^pushary-[a-z-]*(hook|gate)$/;
+var pusharyHookExecutable = (command) => {
+  const tokens = command.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+  for (const raw of tokens.reverse()) {
+    const token = raw[0] === '"' && raw.at(-1) === '"' || raw[0] === "'" && raw.at(-1) === "'" ? raw.slice(1, -1) : raw;
+    const name = token.split(/[/\\]/).pop()?.replace(/\.(cmd|exe|mjs)$/i, "") ?? "";
+    if (name === HOOK_LOCATOR_BINARY || EXACT_HOOK_BINARY.test(name)) return token;
+  }
+  return null;
+};
+var claudeWired = ({ claudeJson, settings, skillExists }) => {
+  if (record(record(claudeJson)?.mcpServers)?.pushary) return true;
+  const s = record(settings);
+  if (s) {
+    const hooks = JSON.stringify(s.hooks ?? {});
+    if (CLAUDE_HOOK_BINARY.test(hooks) || hooks.includes(HOOK_LOCATOR_BINARY)) return true;
+    const allow = record(s.permissions)?.allow;
+    if (Array.isArray(allow) && allow.some((rule) => String(rule).includes("mcp__pushary__"))) return true;
+  }
+  return skillExists;
+};
+var codexWired = ({ config, hooks, skillExists }) => {
+  if (record(record(config)?.mcp_servers)?.pushary) return true;
+  const h = record(hooks);
+  if (h && hasCodexHooks(h)) return true;
+  return skillExists;
+};
+var geminiWired = ({ settings }) => {
+  const s = record(settings);
+  if (!s) return false;
+  if (record(s.mcpServers)?.pushary) return true;
+  return hasGeminiHooks(s);
+};
+var cursorWired = ({ userHooks, mcp, pluginDirExists }) => {
+  if (pluginDirExists) return true;
+  if (record(record(mcp)?.mcpServers)?.pushary) return true;
+  const hooks = record(record(userHooks)?.hooks);
+  if (!hooks) return false;
+  return Object.values(hooks).some((entries) => Array.isArray(entries) && entries.some((entry) => pusharyHookExecutable(String(record(entry)?.command ?? "")) !== null));
+};
+var cursorMcpAuthorization = (pluginMcp, userMcp) => {
+  const pluginServers = record(record(pluginMcp)?.mcpServers);
+  const usePlugin = pluginServers !== null && Object.hasOwn(pluginServers, "pushary");
+  const servers = usePlugin ? pluginServers : record(record(userMcp)?.mcpServers);
+  const headers = record(record(servers?.pushary)?.headers);
+  return {
+    authorization: typeof headers?.Authorization === "string" ? headers.Authorization : null,
+    source: usePlugin ? "plugin mcp.json" : "~/.cursor/mcp.json"
+  };
+};
+var LONG_HOLD_SECONDS = 600;
+var toSeconds = (timeout, unit) => {
+  if (typeof timeout !== "number" || !Number.isFinite(timeout)) return null;
+  return unit === "milliseconds" ? timeout / 1e3 : timeout;
+};
+var registeredHooks = (entries, shape, unit) => {
+  if (!Array.isArray(entries)) return [];
+  return entries.flatMap((entry) => {
+    const container = record(entry);
+    if (!container) return [];
+    const hooks = shape === "nested" ? Array.isArray(container.hooks) ? container.hooks : [] : [container];
+    return hooks.flatMap((hook) => {
+      const command = record(hook)?.command;
+      if (typeof command !== "string" || command.trim() === "") return [];
+      return [{ command, timeoutSeconds: toSeconds(record(hook)?.timeout, unit) }];
+    });
+  });
+};
+var holdersOnEvent = (event, hooks) => {
+  if (!hooks.some((hook) => pusharyHookExecutable(hook.command) !== null)) return [];
+  return hooks.filter((hook) => pusharyHookExecutable(hook.command) === null).map((hook) => ({ event, command: hook.command, timeoutSeconds: hook.timeoutSeconds }));
+};
+var otherHolders = (hooks, events, shape, unit) => {
+  const table = record(hooks);
+  if (!table) return [];
+  return events.flatMap((event) => holdersOnEvent(event, registeredHooks(table[event], shape, unit)));
+};
+var approvalEvents = (table) => table.filter((hook) => hook.delivery === "approval").map((hook) => hook.event);
+var CLAUDE_GATE_EVENTS = approvalEvents(CLAUDE_HOOK_EVENTS);
+var CODEX_GATE_EVENTS = approvalEvents(CODEX_HOOK_EVENTS);
+var GEMINI_GATE_EVENTS = approvalEvents(GEMINI_HOOK_EVENTS);
+var claudeOtherHolders = (settings) => otherHolders(record(settings)?.hooks, CLAUDE_GATE_EVENTS, "nested", "seconds");
+var codexOtherHolders = (hooks) => otherHolders(record(hooks)?.hooks, CODEX_GATE_EVENTS, "nested", "seconds");
+var geminiOtherHolders = (settings) => otherHolders(record(settings)?.hooks, GEMINI_GATE_EVENTS, "nested", "milliseconds");
+var cursorOtherHolders = (userHooks) => otherHolders(record(userHooks)?.hooks, CURSOR_GATE_EVENTS, "flat", "seconds");
+var holdEvents = (table) => table.flatMap((hook) => {
+  const seconds = holdBudgetOf(hook);
+  return seconds === void 0 ? [] : [{ event: hook.event, seconds }];
+});
+var unprovenHolds = (hooks, events) => {
+  const table = record(hooks);
+  if (!table) return [];
+  return events.filter(({ event, seconds }) => registeredHooks(table[event], "nested", "seconds").some((hook) => pusharyHookExecutable(hook.command) !== null && hookCommandHoldBudget(hook.command) !== seconds)).map(({ event }) => event);
+};
+var claudeUnprovenHolds = (settings) => unprovenHolds(record(settings)?.hooks, holdEvents(CLAUDE_HOOK_EVENTS));
+var codexUnprovenHolds = (hooks) => unprovenHolds(record(hooks)?.hooks, holdEvents(CODEX_HOOK_EVENTS));
+var holdsLong = (holder) => holder.timeoutSeconds !== null && holder.timeoutSeconds > LONG_HOLD_SECONDS;
+var SHELLS = /* @__PURE__ */ new Set(["/bin/sh", "/bin/bash", "/bin/zsh", "/usr/bin/env"]);
+var holderExecutable = (command) => {
+  const pathLike = command.match(/[^\s"']*[/\\][^\s"']*/g) ?? [];
+  const target = pathLike.find((token) => !SHELLS.has(token));
+  return target ?? command.trim().split(/\s+/)[0] ?? command;
+};
+var describeHoldTimeout = (holder) => {
+  const seconds = holder.timeoutSeconds;
+  if (seconds === null) return "no timeout set, so the agent default applies";
+  if (seconds >= 3600 && seconds % 3600 === 0) return `${seconds / 3600}h timeout`;
+  if (seconds >= 60 && seconds % 60 === 0) return `${seconds / 60}m timeout`;
+  return `${seconds}s timeout`;
+};
+var describeOtherHolder = (holder) => `another hook also registered on ${holder.event}: ${holderExecutable(holder.command)} (${describeHoldTimeout(holder)})`;
+var describeHoldSentence = (agentLabel) => `${agentLabel} waits for every hook on an event, so the terminal cannot move until that one returns, however fast your phone answered.`;
+
+// src/setup/hook-ownership.ts
+var commandsIn = (value) => {
+  if (Array.isArray(value)) return value.flatMap(commandsIn);
+  if (!value || typeof value !== "object") return [];
+  return Object.entries(value).flatMap(([key, item]) => key === "command" && typeof item === "string" ? [item] : commandsIn(item));
+};
+var isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var hasPaidPusharyCommand = (value) => commandsIn(value).some((command) => {
+  const executable = pusharyHookExecutable(command);
+  const name = executable?.split(/[/\\]/).pop()?.replace(/\.(cmd|exe|mjs)$/i, "");
+  return executable !== null && !isBridgeLocator(executable) && name !== BELL_HOOK_BINARY;
+});
+var hasAppCommand = (value) => commandsIn(value).some((command) => {
+  const executable = pusharyHookExecutable(command);
+  return executable !== null && isBridgeLocator(executable);
+});
+var mcpBearerKey = (document, containerKey, headersKey) => {
+  const servers = isRecord(document?.[containerKey]) ? document[containerKey] : null;
+  const pushary = isRecord(servers?.pushary) ? servers.pushary : null;
+  const headers = isRecord(pushary?.[headersKey]) ? pushary[headersKey] : null;
+  const authorization = headers?.Authorization;
+  const match = typeof authorization === "string" ? authorization.trim().match(/^Bearer\s+(\S+)$/) : null;
+  return match?.[1] ?? null;
+};
+var captureMcpServer = (document, containerKey) => {
+  const container = document[containerKey];
+  const servers = isRecord(container) ? container : null;
+  if (!servers && Object.hasOwn(document, containerKey)) {
+    return { present: false, containerValue: structuredClone(container) };
+  }
+  return servers && Object.hasOwn(servers, "pushary") ? { present: true, value: structuredClone(servers.pushary) } : { present: false };
+};
+var restoreMcpServer = (document, containerKey, snapshot) => {
+  const before = JSON.stringify(document);
+  const existing = isRecord(document[containerKey]) ? document[containerKey] : null;
+  if (snapshot.present) {
+    const servers = existing ?? {};
+    servers.pushary = structuredClone(snapshot.value);
+    document[containerKey] = servers;
+  } else if (Object.hasOwn(snapshot, "containerValue")) {
+    document[containerKey] = structuredClone(snapshot.containerValue);
+  } else if (existing && Object.hasOwn(existing, "pushary")) {
+    delete existing.pushary;
+    if (Object.keys(existing).length === 0) delete document[containerKey];
+  }
+  return JSON.stringify(document) !== before;
+};
+var captureHookTakeover = (agent, document) => {
+  const hooks = isRecord(document?.hooks) ? document.hooks : null;
+  if (!hooks) return null;
+  const captured = {};
+  for (const [event, entries] of Object.entries(hooks)) {
+    if (!Array.isArray(entries)) continue;
+    const appEntries = entries.flatMap((value, index) => isRecord(value) && hasAppCommand(value) ? [{ index, value: structuredClone(value) }] : []);
+    if (appEntries.length > 0) captured[event] = appEntries;
+  }
+  return Object.keys(captured).length > 0 ? { version: 1, agent, hooks: captured } : null;
+};
+var isHookTakeoverReceipt = (value) => {
+  if (!isRecord(value) || value.version !== 1 || typeof value.agent !== "string" || !AGENT_CHOICES.includes(value.agent) || !isRecord(value.hooks)) return false;
+  const expectsMcp = ["claude_code", "codex", "gemini_cli", "vscode"].includes(value.agent);
+  if (value.mcpServer !== void 0 !== expectsMcp) return false;
+  if (value.codexTrust !== void 0 !== (value.agent === "codex")) return false;
+  if (value.codexTrust !== void 0 && !isRecord(value.codexTrust)) return false;
+  if (value.mcpServer !== void 0 && (!isRecord(value.mcpServer) || typeof value.mcpServer.present !== "boolean" || value.mcpServer.present && !Object.hasOwn(value.mcpServer, "value"))) return false;
+  return Object.values(value.hooks).every((entries) => Array.isArray(entries) && entries.length > 0 && entries.every((item) => isRecord(item) && Number.isInteger(item.index) && item.index >= 0 && isRecord(item.value)));
+};
+var restoreHookTakeover = (document, receipt) => {
+  const before = JSON.stringify(document);
+  const appOwnsNow = hookOwnerOf(document) === "app";
+  const hooks = isRecord(document.hooks) ? document.hooks : {};
+  for (const [event, value] of Object.entries(hooks)) {
+    if (!Array.isArray(value)) continue;
+    const kept = value.filter((entry) => !hasPaidPusharyCommand(entry));
+    if (kept.length === 0) delete hooks[event];
+    else hooks[event] = kept;
+  }
+  if (!appOwnsNow) {
+    for (const [event, snapshots] of Object.entries(receipt.hooks)) {
+      const entries = Array.isArray(hooks[event]) ? [...hooks[event]] : [];
+      for (const snapshot of snapshots) {
+        entries.splice(Math.min(snapshot.index, entries.length), 0, structuredClone(snapshot.value));
+      }
+      hooks[event] = entries;
+    }
+  }
+  document.hooks = hooks;
+  return JSON.stringify(document) !== before;
+};
+var hookOwnerOf = (document, appAvailable = true, hooksKeyPath = ["hooks"]) => {
+  const hooks = hooksKeyPath.reduce(
+    (node, key) => node && typeof node === "object" ? node[key] : void 0,
+    document
+  );
+  return hookOwnerOfCommands(commandsIn(hooks), appAvailable);
+};
+var hookOwnerOfCommands = (commands, appAvailable = true) => {
+  const executables = commands.map(pusharyHookExecutable).filter((executable) => executable !== null);
+  if (appAvailable && executables.some(isBridgeLocator)) return "app";
+  if (executables.some((executable) => !isBridgeLocator(executable))) return "cli";
+  return "none";
+};
+var planHooks = (context) => {
+  if (context.owner !== "app") return "install";
+  if (context.takeOverHooks) return "install";
+  return "keep";
+};
+var describeAppOwnership = (agentName) => `The Pushary Mac app owns ${agentName}'s hooks.`;
+var KEEP_HINT = "Kept with the app's account. Pass --take-over-hooks to have the CLI own them instead.";
+var OWNER_LABELS = {
+  app: "the Pushary Mac app",
+  cli: "the CLI"
+};
+var describeHookOwnership = (entries, names) => {
+  const owned = entries.filter((entry) => entry.owner !== "none");
+  if (owned.length === 0) return null;
+  const parts = owned.map((entry) => `${names[entry.agent]} by ${OWNER_LABELS[entry.owner]}${entry.kept ? " (kept)" : ""}`);
+  return `Hooks: ${parts.join(", ")}.`;
+};
+
+export {
+  resolveBridgeStub,
+  describeBridgeResolution,
+  isBridgeLocator,
+  liveBridgeProbe,
+  pusharyHookExecutable,
+  claudeWired,
+  codexWired,
+  geminiWired,
+  cursorWired,
+  cursorMcpAuthorization,
+  claudeOtherHolders,
+  codexOtherHolders,
+  geminiOtherHolders,
+  cursorOtherHolders,
+  claudeUnprovenHolds,
+  codexUnprovenHolds,
+  holdsLong,
+  describeOtherHolder,
+  describeHoldSentence,
+  mcpBearerKey,
+  captureMcpServer,
+  restoreMcpServer,
+  captureHookTakeover,
+  isHookTakeoverReceipt,
+  restoreHookTakeover,
+  hookOwnerOf,
+  hookOwnerOfCommands,
+  planHooks,
+  describeAppOwnership,
+  KEEP_HINT,
+  describeHookOwnership
+};